Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 18-07-2017
Ran by al (administrator) on XP (18-07-2017 19:40:12)
Running from C:\Documents and Settings\al\Desktop\virus_et_al\July 2017
Loaded Profiles: al (Available Profiles: al & Administrator & Guest)
Platform: Microsoft Windows XP Professional Service Pack 3 (X86) Language: English (United States)
Internet Explorer Version 8 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool:
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Sun Microsystems, Inc.) C:\Program Files\Java\jre6\bin\jqs.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
(Microsoft Corporation) C:\WINDOWS\SYSTEM32\locator.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(Microsoft Corporation) C:\WINDOWS\SYSTEM32\wscntfy.exe
(Microsoft Corporation) C:\PROGRA~1\WINDOW~2\wmplayer.exe
(Microsoft Corporation) C:\WINDOWS\SYSTEM32\taskmgr.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
==================== Registry (Whitelisted) ====================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKU\S-1-5-21-3960577219-1813400529-1317427278-1006\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINDOWS\System32\sstext3d.scr [679936 2008-04-14] (Microsoft Corporation)
Lsa: [Authentication Packages] msv1_0 relog_ap
ShellExecuteHooks: Eudora's Shell Extension - {EDB0E980-90BD-11D4-8599-0008C7D3B6F8} - C:\eudora_7\EuShlExt.dll [86016 2005-08-09] (Qualcomm Inc.)
Startup: C:\Documents and Settings\al\Start Menu\Programs\Startup\156_Long_Soothing_Rain.mp3 [2014-11-02] ()
Startup: C:\Documents and Settings\al\Start Menu\Programs\Startup\alt_mich.com.lnk [2004-01-10]
ShortcutTarget: alt_mich.com.lnk -> (No File)
Startup: C:\Documents and Settings\al\Start Menu\Programs\Startup\Mozilla Firefox.lnk [2016-10-17]
ShortcutTarget: Mozilla Firefox.lnk -> C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Tcpip\..\Interfaces\{8AA62950-D597-4798-9F57-32AEF4529374}: [NameServer] 216.234.97.2 216.234.97.3
Internet Explorer:
==================
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.dell4me.com/myway
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-3960577219-1813400529-1317427278-1006\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-3960577219-1813400529-1317427278-1006\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: RealPlayer Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll [2011-02-12] (RealPlayer)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_92\bin\ssv.dll [2016-04-22] (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_92\bin\jp2ssv.dll [2016-04-22] (Oracle Corporation)
BHO: JQSIEStartDetectorImpl Class -> {E7E6F031-17CE-4C07-BC86-EABFE594F69C} -> C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2013-06-08] (Sun Microsystems, Inc.)
DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} hxxps://support.microsoft.com/oas/ActiveX/MSDcode.cab
DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} hxxp://us.chat1.yimg.com/us.yimg.com/I/chat/applet/v45/yacscom.cab
DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} hxxp://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,76/mcinsctl.cab
DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} hxxp://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} hxxp://chat.yahoo.com/cab/yacsui.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_45-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} hxxp://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,16/mcgdmgr.cab
DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0045-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_45-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_45-windows-i586.cab
DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} hxxp://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL [2001-01-22] (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll [2001-06-20] (Microsoft Corporation)
FireFox:
========
FF ProfilePath: C:\Documents and Settings\al\Application Data\Mozilla\Firefox\Profiles\nkz4233i.default [2017-07-18]
FF DefaultSearchEngine: C:\Documents and Settings\al\Application Data\Mozilla\Firefox\Profiles\nkz4233i.default -> Bing
FF DefaultSearchEngine.US: C:\Documents and Settings\al\Application Data\Mozilla\Firefox\Profiles\nkz4233i.default -> Bing
FF SelectedSearchEngine: C:\Documents and Settings\al\Application Data\Mozilla\Firefox\Profiles\nkz4233i.default -> Bing
FF Homepage: C:\Documents and Settings\al\Application Data\Mozilla\Firefox\Profiles\nkz4233i.default -> hxxp://www.cloudynights.com/ubbthreads/
hxxp://www.cloudynights.com/ubbthreads/ubbthreads.php?Cat=
FF Extension: (Adblock Plus) - C:\Documents and Settings\al\Application Data\Mozilla\Firefox\Profiles\nkz4233i.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-11-26]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: (Microsoft .NET Framework Assistant) - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2011-02-12] [not signed]
FF HKLM\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
FF Extension: (RealPlayer Browser Record Plugin) - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011-02-12] [not signed]
FF HKLM\...\Firefox\Extensions: [jqs@sun.com] - C:\Program Files\Java\jre6\lib\deploy\jqs\ff
FF Extension: (Java Quick Starter) - C:\Program Files\Java\jre6\lib\deploy\jqs\ff [2013-06-08] [not signed]
FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll [2012-04-14] (Google)
FF Plugin: @java.com/DTPlugin,version=11.92.2 -> C:\Program Files\Java\jre1.8.0_92\bin\dtplugin\npDeployJava1.dll [2016-04-22] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.92.2 -> C:\Program Files\Java\jre1.8.0_92\bin\plugin2\npjp2.dll [2016-04-22] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-29] (Microsoft Corporation)
FF Plugin: @nosltd.com/getPlus+(R),version=1.6.2.100 -> C:\Program Files\NOS\bin\np_gp.dll [2011-03-01] (NOS Microsystems Ltd.)
FF Plugin: @real.com/nppl3260;version=12.0.1.633 -> c:\program files\real\realplayer\Netscape6\nppl3260.dll [2011-02-12] (RealNetworks, Inc.)
FF Plugin: @real.com/nprjplug;version=12.0.1.633 -> c:\program files\real\realplayer\Netscape6\nprjplug.dll [2011-02-12] (RealNetworks, Inc.)
FF Plugin: @real.com/nprphtml5videoshim;version=12.0.1.633 -> C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll [2011-02-12] (RealNetworks, Inc.)
FF Plugin: @real.com/nprpjplug;version=12.0.1.633 -> c:\program files\real\realplayer\Netscape6\nprpjplug.dll [2011-02-12] (RealNetworks, Inc.)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.31.5\npGoogleUpdate3.dll [No File]
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.31.5\npGoogleUpdate3.dll [No File]
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-08-05] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-3960577219-1813400529-1317427278-1006: @tools.google.com/Google Update;version=8 -> C:\Documents and Settings\al\Local Settings\Application Data\Google\Update\1.2.183.39\npGoogleOneClick8.dll [2010-10-20] (Google Inc.)
Chrome:
=======
CHR HKLM\...\Chrome\Extension: [jfmjfhklogoienhpfnppmbcbjfjnkonk] - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Chrome\Ext\rphtml5video.crx [2011-02-12]
StartMenuInternet: chrome.exe - C:\Documents and Settings\al\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
StartMenuInternet: Google Chrome - C:\Documents and Settings\al\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
==================== Services (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S3 ACDaemon; C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
S3 AcrSch2Svc; C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe [660576 2011-02-12] (Acronis)
S3 getPlus(R) Helper; C:\Program Files\NOS\bin\getPlus_HelperSvc.exe [31592 2008-06-26] (NOS Microsystems Ltd.)
S2 helpsvc; C:\WINDOWS\System32\svchost.exe [14336 2008-04-14] (Microsoft Corporation) <==== ATTENTION (no ServiceDLL)
R2 JavaQuickStarterService; C:\Program Files\Java\jre6\bin\jqs.exe [158128 2013-06-08] (Sun Microsystems, Inc.)
R2 MDM; C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe [335872 2003-03-19] (Microsoft Corporation) [File not signed]
S4 MSSQLServerADHelper; C:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe [44384 2010-12-10] (Microsoft Corporation)
S3 NetSvc; C:\Program Files\Intel\NCS\Sync\NetSvc.exe [143360 2003-03-03] (Intel(R) Corporation) [File not signed]
S4 gupdate; "C:\Program Files\Google\Update\GoogleUpdate.exe" /svc [X]
S4 gupdatem; "C:\Program Files\Google\Update\GoogleUpdate.exe" /medsvc [X]
===================== Drivers (Whitelisted) ======================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S4 abp480n5; C:\WINDOWS\System32\DRIVERS\ABP480N5.SYS [23552 2003-07-16] (Microsoft Corporation)
R3 Afc; C:\WINDOWS\System32\drivers\Afc.sys [11776 2005-02-23] (Arcsoft, Inc.) [File not signed]
R3 BCMModem; C:\WINDOWS\System32\DRIVERS\BCMSM.sys [1101696 2003-08-29] (Broadcom Corporation)
R2 BrPar; C:\WINDOWS\System32\drivers\BrPar.sys [19537 2000-07-24] (Brother Industries Ltd.) [File not signed]
S3 CCDECODE; C:\WINDOWS\System32\DRIVERS\CCDECODE.sys [17024 2008-04-14] (Microsoft Corporation)
S3 DIGIRPS; C:\WINDOWS\System32\DRIVERS\digirlpt.sys [152376 2008-07-10] (Digi International Inc.)
R2 DriverX; C:\WINDOWS\System32\Drivers\driverx.sys [52512 2001-06-11] (Microsoft Corporation) [File not signed]
R0 drvmcdb; C:\WINDOWS\System32\drivers\drvmcdb.sys [84576 2003-07-31] (Sonic Solutions) [File not signed]
R2 drvnddm; C:\WINDOWS\System32\drivers\drvnddm.sys [40448 2003-06-20] (Sonic Solutions) [File not signed]
R1 eeCtrl; C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [383800 2007-02-13] (Symantec Corporation)
S3 evserial; C:\WINDOWS\System32\DRIVERS\evserial.sys [53888 2008-05-19] (ELTIMA Software)
S3 FTDIBUS; C:\WINDOWS\System32\drivers\ftdibus.sys [57536 2008-03-13] (FTDI Ltd.)
R1 hwinterface; C:\WINDOWS\System32\Drivers\hwinterface.sys [3026 2009-10-09] (Logix4u) [File not signed]
S3 i81x; C:\WINDOWS\System32\DRIVERS\i81xnt5.sys [161020 2004-08-03] (Intel(R) Corporation)
S3 iAimFP0; C:\WINDOWS\System32\DRIVERS\wADV01nt.sys [12415 2004-08-03] (Intel(R) Corporation)
S3 iAimFP1; C:\WINDOWS\System32\DRIVERS\wADV02NT.sys [12127 2004-08-03] (Intel(R) Corporation)
S3 iAimFP2; C:\WINDOWS\System32\DRIVERS\wADV05NT.sys [11775 2004-08-03] (Intel(R) Corporation)
S3 iAimFP3; C:\WINDOWS\System32\DRIVERS\wSiINTxx.sys [12063 2004-08-03] (Intel(R) Corporation)
S3 iAimFP4; C:\WINDOWS\System32\DRIVERS\wVchNTxx.sys [19455 2004-08-03] (Intel(R) Corporation)
S3 iAimTV0; C:\WINDOWS\System32\DRIVERS\wATV01nt.sys [29311 2004-08-03] (Intel(R) Corporation)
S3 iAimTV1; C:\WINDOWS\System32\DRIVERS\wATV02NT.sys [19551 2004-08-03] (Intel(R) Corporation)
S3 iAimTV3; C:\WINDOWS\System32\DRIVERS\wATV04nt.sys [33599 2004-08-03] (Intel(R) Corporation)
S3 iAimTV4; C:\WINDOWS\System32\DRIVERS\wCh7xxNT.sys [23615 2004-08-03] (Intel(R) Corporation)
S3 MPE; C:\WINDOWS\System32\DRIVERS\MPE.sys [15232 2008-04-14] (Microsoft Corporation)
R3 MxlW2k; C:\WINDOWS\system32\Drivers\MxlW2k.sys [28256 2010-05-07] (MusicMatch, Inc.) [File not signed]
S3 NdisIP; C:\WINDOWS\System32\DRIVERS\NdisIP.sys [10880 2008-04-14] (Microsoft Corporation)
R1 omci; C:\WINDOWS\System32\DRIVERS\omci.sys [17217 2002-11-08] (Dell Computer Corporation) [File not signed]
S1 P3; C:\WINDOWS\System32\DRIVERS\p3.sys [42752 2008-04-14] (Microsoft Corporation)
R0 PxHelp20; C:\WINDOWS\System32\DRIVERS\PxHelp20.sys [17168 2003-07-30] (Sonic Solutions) [File not signed]
R0 snapman; C:\WINDOWS\System32\DRIVERS\snapman.sys [99776 2009-08-04] (Acronis) [File not signed]
R1 sscdbhk5; C:\WINDOWS\System32\drivers\sscdbhk5.sys [5621 2003-07-14] (Sonic Solutions) [File not signed]
R1 ssrtln; C:\WINDOWS\System32\drivers\ssrtln.sys [23219 2003-07-14] (Sonic Solutions) [File not signed]
R2 tfsnboio; C:\WINDOWS\System32\dla\tfsnboio.sys [25685 2003-08-06] (Sonic Solutions) [File not signed]
R2 tfsncofs; C:\WINDOWS\System32\dla\tfsncofs.sys [34837 2003-08-06] (Sonic Solutions) [File not signed]
R2 tfsndrct; C:\WINDOWS\System32\dla\tfsndrct.sys [4117 2003-08-06] (Sonic Solutions) [File not signed]
R2 tfsndres; C:\WINDOWS\System32\dla\tfsndres.sys [2233 2003-08-06] (Sonic Solutions) [File not signed]
R2 tfsnifs; C:\WINDOWS\System32\dla\tfsnifs.sys [83284 2003-08-06] (Sonic Solutions) [File not signed]
R2 tfsnopio; C:\WINDOWS\System32\dla\tfsnopio.sys [14229 2003-08-06] (Sonic Solutions) [File not signed]
R2 tfsnpool; C:\WINDOWS\System32\dla\tfsnpool.sys [6357 2003-08-06] (Sonic Solutions) [File not signed]
R2 tfsnudf; C:\WINDOWS\System32\dla\tfsnudf.sys [98068 2003-08-06] (Sonic Solutions) [File not signed]
R2 tfsnudfa; C:\WINDOWS\System32\dla\tfsnudfa.sys [100373 2003-08-06] (Sonic Solutions) [File not signed]
R2 tifsfilter; C:\WINDOWS\System32\DRIVERS\tifsfilt.sys [32224 2009-08-04] (Acronis) [File not signed]
R0 timounter; C:\WINDOWS\System32\DRIVERS\timntr.sys [387520 2009-08-04] (Acronis) [File not signed]
S3 TVicHW32; C:\WINDOWS\system32\DRIVERS\TVICHW32.SYS [29536 2006-10-13] (EnTech Taiwan)
R2 tviclpt; C:\WINDOWS\system32\Drivers\tviclpt.sys [15536 2003-03-12] (EnTech Taiwan) [File not signed]
S3 USB28xxBGA; C:\WINDOWS\System32\DRIVERS\emBDA.sys [608128 2011-03-10] (eMPIA Technology, Inc.)
S3 USB28xxOEM; C:\WINDOWS\System32\DRIVERS\emOEM.sys [1038080 2011-03-10] (eMPIA Technology, Inc.)
R1 vcdrom; C:\WINDOWS\SYSTEM32\DRIVERS\VCdRom.sys [8576 2001-12-19] (Microsoft Corporation) [File not signed]
R3 VSBC; C:\WINDOWS\System32\DRIVERS\evsbc.sys [27904 2008-05-19] (ELTIMA Software)
R3 vsbus; C:\WINDOWS\System32\DRIVERS\vsb.sys [18180 2003-03-14] (ELTIMA Software) [File not signed]
S3 vserial; C:\WINDOWS\System32\DRIVERS\vserial.sys [69932 2003-03-14] (ELTIMA Software) [File not signed]
S3 {6080A529-897E-4629-A488-ABA0C29B635E}; C:\WINDOWS\System32\drivers\ialmsbw.sys [113504 2003-04-15] (Intel Corporation)
S3 {D31A0762-0CEB-444e-ACFF-B049A1F6FE91}; C:\WINDOWS\System32\drivers\ialmkchw.sys [78752 2003-04-15] (Intel Corporation)
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2017-07-18 19:38 - 2017-07-18 19:40 - 00000000 ____D C:\FRST
2017-07-18 18:41 - 2017-07-18 18:41 - 00000000 ____D C:\WINDOWS\LastGood
2017-07-18 10:15 - 2017-07-18 10:17 - 00000000 ____D C:\AdwCleaner
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2017-07-18 19:41 - 2016-04-19 00:05 - 00000000 ____D C:\Documents and Settings\al\Local Settings\temp
2017-07-18 19:35 - 2015-03-30 17:59 - 00000886 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2017-07-18 19:11 - 2011-02-06 08:41 - 00000000 ____D C:\Documents and Settings\al\Desktop\virus_et_al
2017-07-18 19:10 - 2004-01-03 18:45 - 00009492 _____ C:\WINDOWS\ModemLog_BCM V.92 56K Modem.txt
2017-07-18 18:50 - 2013-04-20 16:27 - 00000830 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2017-07-18 16:46 - 2017-02-27 18:45 - 00018468 _____ C:\Documents and Settings\al\Desktop\syslog.txt
2017-07-18 16:45 - 2016-04-21 09:56 - 00002463 _____ C:\Documents and Settings\al\Desktop\Sophos Virus Removal Tool.lnk
2017-07-18 15:19 - 2014-06-14 10:17 - 00170200 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2017-07-18 13:13 - 2015-03-30 17:59 - 00000882 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2017-07-18 13:13 - 2011-12-02 21:09 - 00000272 _____ C:\WINDOWS\Tasks\RealUpgradeLogonTaskS-1-5-21-3960577219-1813400529-1317427278-1006.job
2017-07-18 13:11 - 2004-01-09 06:49 - 00000427 _____ C:\WINDOWS\system32\Drivers\etc\hosts.ics
2017-07-18 13:10 - 2004-01-03 18:46 - 00032172 _____ C:\WINDOWS\SchedLgU.Txt
2017-07-18 13:10 - 2004-01-03 18:46 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2017-07-18 13:10 - 2004-01-03 18:32 - 00000000 ____D C:\Documents and Settings\NetworkService\Local Settings\Temp
2017-07-18 13:09 - 2004-01-08 16:03 - 00000278 ___SH C:\Documents and Settings\al\NTUSER.INI
2017-07-18 10:06 - 2016-04-19 00:05 - 00000000 ____D C:\Documents and Settings\Administrator\Local Settings\temp
2017-07-18 09:00 - 2017-04-29 20:28 - 00017408 _____ C:\Documents and Settings\al\Desktop\diatom.xls
2017-07-18 09:00 - 2013-08-12 14:25 - 00016077 _____ C:\WINDOWS\al8.xlb
2017-07-18 08:52 - 2016-07-18 13:20 - 00000000 ____D C:\Program Files\Mozilla Firefox
2017-07-16 22:08 - 2012-07-24 17:53 - 00012208 _____ C:\Documents and Settings\al\Desktop\GP.txt
2017-07-16 13:55 - 2016-10-27 09:06 - 00054156 ____H C:\WINDOWS\QTFont.qfn
2017-07-16 13:31 - 2013-10-06 09:31 - 00009563 _____ C:\Documents and Settings\al\Desktop\Empty.txt
2017-07-15 21:30 - 2004-01-03 18:43 - 00001170 _____ C:\WINDOWS\system32\WPA.DBL
2017-07-10 12:19 - 2011-10-01 19:00 - 00000280 _____ C:\WINDOWS\Tasks\RealUpgradeScheduledTaskS-1-5-21-3960577219-1813400529-1317427278-1006.job
2017-06-19 21:42 - 2004-09-13 18:43 - 00000000 __SHD C:\WINDOWS\CSC
==================== Files in the root of some directories =======
2006-11-19 09:23 - 2007-02-14 21:25 - 0009871 _____ () C:\Documents and Settings\al\Application Data\Microsoft\2240.dat
2015-05-01 08:16 - 2015-06-11 20:14 - 0005632 _____ () C:\Documents and Settings\al\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2011-06-10 22:08 - 2013-06-23 14:09 - 0004955 _____ () C:\Documents and Settings\All Users\Application Data\gmqvfgar.pta
2012-07-17 15:31 - 2012-07-17 15:31 - 0004983 _____ () C:\Documents and Settings\All Users\Application Data\lomppayd.qfv
2012-02-05 10:33 - 2016-02-25 23:19 - 0001639 _____ () C:\Documents and Settings\All Users\Application Data\Microsoft.SqlServer.Compact.400.32.bc
==================== Bamital & volsnap ======================
(There is no automatic fix for files that do not pass verification.)
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed
==================== End of FRST.txt ============================
Ran by al (administrator) on XP (18-07-2017 19:40:12)
Running from C:\Documents and Settings\al\Desktop\virus_et_al\July 2017
Loaded Profiles: al (Available Profiles: al & Administrator & Guest)
Platform: Microsoft Windows XP Professional Service Pack 3 (X86) Language: English (United States)
Internet Explorer Version 8 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool:
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Sun Microsystems, Inc.) C:\Program Files\Java\jre6\bin\jqs.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
(Microsoft Corporation) C:\WINDOWS\SYSTEM32\locator.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(Microsoft Corporation) C:\WINDOWS\SYSTEM32\wscntfy.exe
(Microsoft Corporation) C:\PROGRA~1\WINDOW~2\wmplayer.exe
(Microsoft Corporation) C:\WINDOWS\SYSTEM32\taskmgr.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
==================== Registry (Whitelisted) ====================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKU\S-1-5-21-3960577219-1813400529-1317427278-1006\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINDOWS\System32\sstext3d.scr [679936 2008-04-14] (Microsoft Corporation)
Lsa: [Authentication Packages] msv1_0 relog_ap
ShellExecuteHooks: Eudora's Shell Extension - {EDB0E980-90BD-11D4-8599-0008C7D3B6F8} - C:\eudora_7\EuShlExt.dll [86016 2005-08-09] (Qualcomm Inc.)
Startup: C:\Documents and Settings\al\Start Menu\Programs\Startup\156_Long_Soothing_Rain.mp3 [2014-11-02] ()
Startup: C:\Documents and Settings\al\Start Menu\Programs\Startup\alt_mich.com.lnk [2004-01-10]
ShortcutTarget: alt_mich.com.lnk -> (No File)
Startup: C:\Documents and Settings\al\Start Menu\Programs\Startup\Mozilla Firefox.lnk [2016-10-17]
ShortcutTarget: Mozilla Firefox.lnk -> C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Tcpip\..\Interfaces\{8AA62950-D597-4798-9F57-32AEF4529374}: [NameServer] 216.234.97.2 216.234.97.3
Internet Explorer:
==================
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.dell4me.com/myway
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-3960577219-1813400529-1317427278-1006\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-3960577219-1813400529-1317427278-1006\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: RealPlayer Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll [2011-02-12] (RealPlayer)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_92\bin\ssv.dll [2016-04-22] (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_92\bin\jp2ssv.dll [2016-04-22] (Oracle Corporation)
BHO: JQSIEStartDetectorImpl Class -> {E7E6F031-17CE-4C07-BC86-EABFE594F69C} -> C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2013-06-08] (Sun Microsystems, Inc.)
DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} hxxps://support.microsoft.com/oas/ActiveX/MSDcode.cab
DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} hxxp://us.chat1.yimg.com/us.yimg.com/I/chat/applet/v45/yacscom.cab
DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} hxxp://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,76/mcinsctl.cab
DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} hxxp://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} hxxp://chat.yahoo.com/cab/yacsui.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_45-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} hxxp://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,16/mcgdmgr.cab
DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0045-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_45-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_45-windows-i586.cab
DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} hxxp://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL [2001-01-22] (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll [2001-06-20] (Microsoft Corporation)
FireFox:
========
FF ProfilePath: C:\Documents and Settings\al\Application Data\Mozilla\Firefox\Profiles\nkz4233i.default [2017-07-18]
FF DefaultSearchEngine: C:\Documents and Settings\al\Application Data\Mozilla\Firefox\Profiles\nkz4233i.default -> Bing
FF DefaultSearchEngine.US: C:\Documents and Settings\al\Application Data\Mozilla\Firefox\Profiles\nkz4233i.default -> Bing
FF SelectedSearchEngine: C:\Documents and Settings\al\Application Data\Mozilla\Firefox\Profiles\nkz4233i.default -> Bing
FF Homepage: C:\Documents and Settings\al\Application Data\Mozilla\Firefox\Profiles\nkz4233i.default -> hxxp://www.cloudynights.com/ubbthreads/
hxxp://www.cloudynights.com/ubbthreads/ubbthreads.php?Cat=
FF Extension: (Adblock Plus) - C:\Documents and Settings\al\Application Data\Mozilla\Firefox\Profiles\nkz4233i.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-11-26]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: (Microsoft .NET Framework Assistant) - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2011-02-12] [not signed]
FF HKLM\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
FF Extension: (RealPlayer Browser Record Plugin) - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011-02-12] [not signed]
FF HKLM\...\Firefox\Extensions: [jqs@sun.com] - C:\Program Files\Java\jre6\lib\deploy\jqs\ff
FF Extension: (Java Quick Starter) - C:\Program Files\Java\jre6\lib\deploy\jqs\ff [2013-06-08] [not signed]
FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll [2012-04-14] (Google)
FF Plugin: @java.com/DTPlugin,version=11.92.2 -> C:\Program Files\Java\jre1.8.0_92\bin\dtplugin\npDeployJava1.dll [2016-04-22] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.92.2 -> C:\Program Files\Java\jre1.8.0_92\bin\plugin2\npjp2.dll [2016-04-22] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-29] (Microsoft Corporation)
FF Plugin: @nosltd.com/getPlus+(R),version=1.6.2.100 -> C:\Program Files\NOS\bin\np_gp.dll [2011-03-01] (NOS Microsystems Ltd.)
FF Plugin: @real.com/nppl3260;version=12.0.1.633 -> c:\program files\real\realplayer\Netscape6\nppl3260.dll [2011-02-12] (RealNetworks, Inc.)
FF Plugin: @real.com/nprjplug;version=12.0.1.633 -> c:\program files\real\realplayer\Netscape6\nprjplug.dll [2011-02-12] (RealNetworks, Inc.)
FF Plugin: @real.com/nprphtml5videoshim;version=12.0.1.633 -> C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll [2011-02-12] (RealNetworks, Inc.)
FF Plugin: @real.com/nprpjplug;version=12.0.1.633 -> c:\program files\real\realplayer\Netscape6\nprpjplug.dll [2011-02-12] (RealNetworks, Inc.)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.31.5\npGoogleUpdate3.dll [No File]
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.31.5\npGoogleUpdate3.dll [No File]
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-08-05] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-3960577219-1813400529-1317427278-1006: @tools.google.com/Google Update;version=8 -> C:\Documents and Settings\al\Local Settings\Application Data\Google\Update\1.2.183.39\npGoogleOneClick8.dll [2010-10-20] (Google Inc.)
Chrome:
=======
CHR HKLM\...\Chrome\Extension: [jfmjfhklogoienhpfnppmbcbjfjnkonk] - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Chrome\Ext\rphtml5video.crx [2011-02-12]
StartMenuInternet: chrome.exe - C:\Documents and Settings\al\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
StartMenuInternet: Google Chrome - C:\Documents and Settings\al\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
==================== Services (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S3 ACDaemon; C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
S3 AcrSch2Svc; C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe [660576 2011-02-12] (Acronis)
S3 getPlus(R) Helper; C:\Program Files\NOS\bin\getPlus_HelperSvc.exe [31592 2008-06-26] (NOS Microsystems Ltd.)
S2 helpsvc; C:\WINDOWS\System32\svchost.exe [14336 2008-04-14] (Microsoft Corporation) <==== ATTENTION (no ServiceDLL)
R2 JavaQuickStarterService; C:\Program Files\Java\jre6\bin\jqs.exe [158128 2013-06-08] (Sun Microsystems, Inc.)
R2 MDM; C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe [335872 2003-03-19] (Microsoft Corporation) [File not signed]
S4 MSSQLServerADHelper; C:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe [44384 2010-12-10] (Microsoft Corporation)
S3 NetSvc; C:\Program Files\Intel\NCS\Sync\NetSvc.exe [143360 2003-03-03] (Intel(R) Corporation) [File not signed]
S4 gupdate; "C:\Program Files\Google\Update\GoogleUpdate.exe" /svc [X]
S4 gupdatem; "C:\Program Files\Google\Update\GoogleUpdate.exe" /medsvc [X]
===================== Drivers (Whitelisted) ======================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S4 abp480n5; C:\WINDOWS\System32\DRIVERS\ABP480N5.SYS [23552 2003-07-16] (Microsoft Corporation)
R3 Afc; C:\WINDOWS\System32\drivers\Afc.sys [11776 2005-02-23] (Arcsoft, Inc.) [File not signed]
R3 BCMModem; C:\WINDOWS\System32\DRIVERS\BCMSM.sys [1101696 2003-08-29] (Broadcom Corporation)
R2 BrPar; C:\WINDOWS\System32\drivers\BrPar.sys [19537 2000-07-24] (Brother Industries Ltd.) [File not signed]
S3 CCDECODE; C:\WINDOWS\System32\DRIVERS\CCDECODE.sys [17024 2008-04-14] (Microsoft Corporation)
S3 DIGIRPS; C:\WINDOWS\System32\DRIVERS\digirlpt.sys [152376 2008-07-10] (Digi International Inc.)
R2 DriverX; C:\WINDOWS\System32\Drivers\driverx.sys [52512 2001-06-11] (Microsoft Corporation) [File not signed]
R0 drvmcdb; C:\WINDOWS\System32\drivers\drvmcdb.sys [84576 2003-07-31] (Sonic Solutions) [File not signed]
R2 drvnddm; C:\WINDOWS\System32\drivers\drvnddm.sys [40448 2003-06-20] (Sonic Solutions) [File not signed]
R1 eeCtrl; C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [383800 2007-02-13] (Symantec Corporation)
S3 evserial; C:\WINDOWS\System32\DRIVERS\evserial.sys [53888 2008-05-19] (ELTIMA Software)
S3 FTDIBUS; C:\WINDOWS\System32\drivers\ftdibus.sys [57536 2008-03-13] (FTDI Ltd.)
R1 hwinterface; C:\WINDOWS\System32\Drivers\hwinterface.sys [3026 2009-10-09] (Logix4u) [File not signed]
S3 i81x; C:\WINDOWS\System32\DRIVERS\i81xnt5.sys [161020 2004-08-03] (Intel(R) Corporation)
S3 iAimFP0; C:\WINDOWS\System32\DRIVERS\wADV01nt.sys [12415 2004-08-03] (Intel(R) Corporation)
S3 iAimFP1; C:\WINDOWS\System32\DRIVERS\wADV02NT.sys [12127 2004-08-03] (Intel(R) Corporation)
S3 iAimFP2; C:\WINDOWS\System32\DRIVERS\wADV05NT.sys [11775 2004-08-03] (Intel(R) Corporation)
S3 iAimFP3; C:\WINDOWS\System32\DRIVERS\wSiINTxx.sys [12063 2004-08-03] (Intel(R) Corporation)
S3 iAimFP4; C:\WINDOWS\System32\DRIVERS\wVchNTxx.sys [19455 2004-08-03] (Intel(R) Corporation)
S3 iAimTV0; C:\WINDOWS\System32\DRIVERS\wATV01nt.sys [29311 2004-08-03] (Intel(R) Corporation)
S3 iAimTV1; C:\WINDOWS\System32\DRIVERS\wATV02NT.sys [19551 2004-08-03] (Intel(R) Corporation)
S3 iAimTV3; C:\WINDOWS\System32\DRIVERS\wATV04nt.sys [33599 2004-08-03] (Intel(R) Corporation)
S3 iAimTV4; C:\WINDOWS\System32\DRIVERS\wCh7xxNT.sys [23615 2004-08-03] (Intel(R) Corporation)
S3 MPE; C:\WINDOWS\System32\DRIVERS\MPE.sys [15232 2008-04-14] (Microsoft Corporation)
R3 MxlW2k; C:\WINDOWS\system32\Drivers\MxlW2k.sys [28256 2010-05-07] (MusicMatch, Inc.) [File not signed]
S3 NdisIP; C:\WINDOWS\System32\DRIVERS\NdisIP.sys [10880 2008-04-14] (Microsoft Corporation)
R1 omci; C:\WINDOWS\System32\DRIVERS\omci.sys [17217 2002-11-08] (Dell Computer Corporation) [File not signed]
S1 P3; C:\WINDOWS\System32\DRIVERS\p3.sys [42752 2008-04-14] (Microsoft Corporation)
R0 PxHelp20; C:\WINDOWS\System32\DRIVERS\PxHelp20.sys [17168 2003-07-30] (Sonic Solutions) [File not signed]
R0 snapman; C:\WINDOWS\System32\DRIVERS\snapman.sys [99776 2009-08-04] (Acronis) [File not signed]
R1 sscdbhk5; C:\WINDOWS\System32\drivers\sscdbhk5.sys [5621 2003-07-14] (Sonic Solutions) [File not signed]
R1 ssrtln; C:\WINDOWS\System32\drivers\ssrtln.sys [23219 2003-07-14] (Sonic Solutions) [File not signed]
R2 tfsnboio; C:\WINDOWS\System32\dla\tfsnboio.sys [25685 2003-08-06] (Sonic Solutions) [File not signed]
R2 tfsncofs; C:\WINDOWS\System32\dla\tfsncofs.sys [34837 2003-08-06] (Sonic Solutions) [File not signed]
R2 tfsndrct; C:\WINDOWS\System32\dla\tfsndrct.sys [4117 2003-08-06] (Sonic Solutions) [File not signed]
R2 tfsndres; C:\WINDOWS\System32\dla\tfsndres.sys [2233 2003-08-06] (Sonic Solutions) [File not signed]
R2 tfsnifs; C:\WINDOWS\System32\dla\tfsnifs.sys [83284 2003-08-06] (Sonic Solutions) [File not signed]
R2 tfsnopio; C:\WINDOWS\System32\dla\tfsnopio.sys [14229 2003-08-06] (Sonic Solutions) [File not signed]
R2 tfsnpool; C:\WINDOWS\System32\dla\tfsnpool.sys [6357 2003-08-06] (Sonic Solutions) [File not signed]
R2 tfsnudf; C:\WINDOWS\System32\dla\tfsnudf.sys [98068 2003-08-06] (Sonic Solutions) [File not signed]
R2 tfsnudfa; C:\WINDOWS\System32\dla\tfsnudfa.sys [100373 2003-08-06] (Sonic Solutions) [File not signed]
R2 tifsfilter; C:\WINDOWS\System32\DRIVERS\tifsfilt.sys [32224 2009-08-04] (Acronis) [File not signed]
R0 timounter; C:\WINDOWS\System32\DRIVERS\timntr.sys [387520 2009-08-04] (Acronis) [File not signed]
S3 TVicHW32; C:\WINDOWS\system32\DRIVERS\TVICHW32.SYS [29536 2006-10-13] (EnTech Taiwan)
R2 tviclpt; C:\WINDOWS\system32\Drivers\tviclpt.sys [15536 2003-03-12] (EnTech Taiwan) [File not signed]
S3 USB28xxBGA; C:\WINDOWS\System32\DRIVERS\emBDA.sys [608128 2011-03-10] (eMPIA Technology, Inc.)
S3 USB28xxOEM; C:\WINDOWS\System32\DRIVERS\emOEM.sys [1038080 2011-03-10] (eMPIA Technology, Inc.)
R1 vcdrom; C:\WINDOWS\SYSTEM32\DRIVERS\VCdRom.sys [8576 2001-12-19] (Microsoft Corporation) [File not signed]
R3 VSBC; C:\WINDOWS\System32\DRIVERS\evsbc.sys [27904 2008-05-19] (ELTIMA Software)
R3 vsbus; C:\WINDOWS\System32\DRIVERS\vsb.sys [18180 2003-03-14] (ELTIMA Software) [File not signed]
S3 vserial; C:\WINDOWS\System32\DRIVERS\vserial.sys [69932 2003-03-14] (ELTIMA Software) [File not signed]
S3 {6080A529-897E-4629-A488-ABA0C29B635E}; C:\WINDOWS\System32\drivers\ialmsbw.sys [113504 2003-04-15] (Intel Corporation)
S3 {D31A0762-0CEB-444e-ACFF-B049A1F6FE91}; C:\WINDOWS\System32\drivers\ialmkchw.sys [78752 2003-04-15] (Intel Corporation)
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2017-07-18 19:38 - 2017-07-18 19:40 - 00000000 ____D C:\FRST
2017-07-18 18:41 - 2017-07-18 18:41 - 00000000 ____D C:\WINDOWS\LastGood
2017-07-18 10:15 - 2017-07-18 10:17 - 00000000 ____D C:\AdwCleaner
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2017-07-18 19:41 - 2016-04-19 00:05 - 00000000 ____D C:\Documents and Settings\al\Local Settings\temp
2017-07-18 19:35 - 2015-03-30 17:59 - 00000886 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2017-07-18 19:11 - 2011-02-06 08:41 - 00000000 ____D C:\Documents and Settings\al\Desktop\virus_et_al
2017-07-18 19:10 - 2004-01-03 18:45 - 00009492 _____ C:\WINDOWS\ModemLog_BCM V.92 56K Modem.txt
2017-07-18 18:50 - 2013-04-20 16:27 - 00000830 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2017-07-18 16:46 - 2017-02-27 18:45 - 00018468 _____ C:\Documents and Settings\al\Desktop\syslog.txt
2017-07-18 16:45 - 2016-04-21 09:56 - 00002463 _____ C:\Documents and Settings\al\Desktop\Sophos Virus Removal Tool.lnk
2017-07-18 15:19 - 2014-06-14 10:17 - 00170200 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2017-07-18 13:13 - 2015-03-30 17:59 - 00000882 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2017-07-18 13:13 - 2011-12-02 21:09 - 00000272 _____ C:\WINDOWS\Tasks\RealUpgradeLogonTaskS-1-5-21-3960577219-1813400529-1317427278-1006.job
2017-07-18 13:11 - 2004-01-09 06:49 - 00000427 _____ C:\WINDOWS\system32\Drivers\etc\hosts.ics
2017-07-18 13:10 - 2004-01-03 18:46 - 00032172 _____ C:\WINDOWS\SchedLgU.Txt
2017-07-18 13:10 - 2004-01-03 18:46 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2017-07-18 13:10 - 2004-01-03 18:32 - 00000000 ____D C:\Documents and Settings\NetworkService\Local Settings\Temp
2017-07-18 13:09 - 2004-01-08 16:03 - 00000278 ___SH C:\Documents and Settings\al\NTUSER.INI
2017-07-18 10:06 - 2016-04-19 00:05 - 00000000 ____D C:\Documents and Settings\Administrator\Local Settings\temp
2017-07-18 09:00 - 2017-04-29 20:28 - 00017408 _____ C:\Documents and Settings\al\Desktop\diatom.xls
2017-07-18 09:00 - 2013-08-12 14:25 - 00016077 _____ C:\WINDOWS\al8.xlb
2017-07-18 08:52 - 2016-07-18 13:20 - 00000000 ____D C:\Program Files\Mozilla Firefox
2017-07-16 22:08 - 2012-07-24 17:53 - 00012208 _____ C:\Documents and Settings\al\Desktop\GP.txt
2017-07-16 13:55 - 2016-10-27 09:06 - 00054156 ____H C:\WINDOWS\QTFont.qfn
2017-07-16 13:31 - 2013-10-06 09:31 - 00009563 _____ C:\Documents and Settings\al\Desktop\Empty.txt
2017-07-15 21:30 - 2004-01-03 18:43 - 00001170 _____ C:\WINDOWS\system32\WPA.DBL
2017-07-10 12:19 - 2011-10-01 19:00 - 00000280 _____ C:\WINDOWS\Tasks\RealUpgradeScheduledTaskS-1-5-21-3960577219-1813400529-1317427278-1006.job
2017-06-19 21:42 - 2004-09-13 18:43 - 00000000 __SHD C:\WINDOWS\CSC
==================== Files in the root of some directories =======
2006-11-19 09:23 - 2007-02-14 21:25 - 0009871 _____ () C:\Documents and Settings\al\Application Data\Microsoft\2240.dat
2015-05-01 08:16 - 2015-06-11 20:14 - 0005632 _____ () C:\Documents and Settings\al\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2011-06-10 22:08 - 2013-06-23 14:09 - 0004955 _____ () C:\Documents and Settings\All Users\Application Data\gmqvfgar.pta
2012-07-17 15:31 - 2012-07-17 15:31 - 0004983 _____ () C:\Documents and Settings\All Users\Application Data\lomppayd.qfv
2012-02-05 10:33 - 2016-02-25 23:19 - 0001639 _____ () C:\Documents and Settings\All Users\Application Data\Microsoft.SqlServer.Compact.400.32.bc
==================== Bamital & volsnap ======================
(There is no automatic fix for files that do not pass verification.)
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\dnsapi.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed
==================== End of FRST.txt ============================