malware altering proxy setting

[hdk]

Can't adjust proxy settings (which affects IE and Chrome; able to force "no proxy" with FF).

Have run: MicrosoftFixit for proxy problems, Combofix, MBAM, SuperAntispyware, Avira, CCleaner, TDSSkiller  and Spybot. Found some entries, but problem still exists.

 

Here are the two reports.

Thanks,

hdk

 

DDS:

 

DDS (Ver_2012-11-20.01) - NTFS_x86
Internet Explorer: 8.0.6001.18702  BrowserJavaVersion: 10.25.2
Run by Owner at 12:29:19 on 2013-09-22
Microsoft Windows XP Home Edition  5.1.2600.3.1252.1.1033.18.2430.1547 [GMT -7:00]
.
AV: Avira Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
AV: Lavasoft Ad-Aware *Disabled/Outdated* {964FCE60-0B18-4D30-ADD6-EB178909041C}
FW: Lavasoft Ad-Aware *Disabled*
.
============== Running Processes ================
.
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\BUFFALO\Client Manager3\bwsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe
C:\Program Files\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe
C:\Program Files\Java\jre7\bin\jqs.exe
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
C:\Program Files\BUFFALO\Client Manager3\cm3_tray.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\msdtc.exe
C:\Documents and Settings\All Users\Application Data\Ad-Aware Browsing Protection\adawarebp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Ad-Aware Antivirus\AdAwareService.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
c:\program files\avira\antivir desktop\avcenter.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
C:\WINDOWS\system32\svchost.exe -k rpcss
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\svchost.exe -k imgsvc
.
============== Pseudo HJT Report ===============
.
uStart Page = about:blank
uURLSearchHooks: {6c97a91e-4524-4019-86af-2aa2d567bf5c} - <orphaned>
BHO: DivX Plus Web Player HTML5 <video>: {326E768D-4182-46FD-9C16-1449A49795F4} - c:\program files\divx\divx plus web player\ie\divxhtml5\DivXHTML5.dll
BHO: ElnkPubBHO Class: {512ACF1B-64D9-4928-B382-A80556F28DB4} - c:\program files\earthlink\toolbar\ElnkPuB.dll
BHO: Spybot-S&D IE Protection: {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll
BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre7\bin\ssv.dll
BHO: ElnkProtectionBHO Class: {9579D574-D4D8-4335-9560-FE8641A013BD} - c:\program files\earthlink\toolbar\ProtctIE.dll
BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
BHO: Skype Browser Helper: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre7\bin\jp2ssv.dll
BHO: ElnkLegacyUninstBHO Class: {E713904C-DF05-4C79-BBAD-02DB923253BE} - c:\program files\earthlink\toolbar\uninsttb.dll
TB: &Google: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
TB: EarthLink Toolbar: {C7768536-96F8-4001-B1A2-90EE21279187} - c:\program files\earthlink\toolbar\Toolbar.dll
TB: &Google: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
TB: EarthLink Toolbar: {C7768536-96F8-4001-B1A2-90EE21279187} - c:\program files\earthlink\toolbar\Toolbar.dll
uRun: [spybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
uRunOnce: [CleanUp!] c:\progra~1\cleanup!\CleanUp.exe /WindowsRestart
uRunOnce: [adawarebp] reg.exe delete "HKCU\Software\AppDataLow\Software\adawarebp" /f
uRunOnce: [adawarebp_XP] reg.exe delete "HKCU\Software\adawarebp" /f
mRun: [Recguard] c:\windows\sminst\RECGUARD.EXE
mRun: [soundMan] SOUNDMAN.EXE
mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe
mRun: [ATIPTA] c:\program files\ati technologies\ati control panel\atiptaxx.exe
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [ElbyCheckAnyDVD] "c:\program files\slysoft\anydvd\ElbyCheck.exe" /L AnyDVD
mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe"
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [showWnd] ShowWnd.exe
mRun: [Ad-Aware Browsing Protection] "c:\documents and settings\all users\application data\ad-aware browsing protection\adawarebp.exe"
mRun: [Ad-Aware Antivirus] "c:\program files\ad-aware antivirus\AdAwareLauncher" --windows-run
StartupFolder: c:\docume~1\owner\startm~1\programs\startup\nexdef~1.lnk - c:\documents and settings\owner\local settings\application data\autobahn\nexdef.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\client~1.lnk - c:\program files\buffalo\client manager3\cm3_tray.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE
StartupFolder: c:\documents and settings\all users\start menu\programs\startup\run_startmenu.cmd
uPolicies-Explorer: NoDriveTypeAutoRun = dword:323
uPolicies-Explorer: NoDriveAutoRun = dword:67108863
uPolicies-Explorer: NoDrives = dword:0
mPolicies-Explorer: NoDriveAutoRun = dword:67108863
mPolicies-Explorer: NoDriveTypeAutoRun = dword:323
mPolicies-Explorer: NoDrives = dword:0
mPolicies-Windows\System: Allow-LogonScript-NetbiosDisabled = dword:1
mPolicies-Explorer: NoDriveTypeAutoRun = dword:323
mPolicies-Explorer: NoDriveAutoRun = dword:67108863
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office10\EXCEL.EXE/3000
IE: EarthLink Google Search - c:\program files\earthlink\toolbar\SearchUI.dll/search.html
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - LocalServer32 - <no file>
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE}
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
.
INFO: HKCU has more than 50 listed domains.
If you wish to scan all of them, select the 'Force scan all domains' option.
.
.
INFO: HKLM has more than 50 listed domains.
   If you wish to scan all of them, select the 'Force scan all domains' option.
.





TCP: NameServer = 192.168.11.1
TCP: Interfaces\{14C3684D-03ED-4A2C-BDB8-B69C9F8E0861} : DHCPNameServer = 192.168.11.1
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\program files\common files\skype\Skype4COM.dll
Notify: AtiExtEvent - Ati2evxx.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
Hosts: 127.0.0.1    www.spywareinfo.com
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\owner\application data\mozilla\firefox\profiles\hihxz9a0.default-1378943744140\
FF - prefs.js: network.proxy.type - 0
FF - plugin: c:\documents and settings\owner\application data\mozilla\plugins\npgoogletalk.dll
FF - plugin: c:\documents and settings\owner\application data\mozilla\plugins\npgtpo3dautoplugin.dll
FF - plugin: c:\documents and settings\owner\application data\mozilla\plugins\npo1d.dll
FF - plugin: c:\documents and settings\owner\local settings\application data\google\update\1.3.21.153\npGoogleUpdate3.dll
FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\divx\divx ovs helper\npovshelper.dll
FF - plugin: c:\program files\divx\divx plus web player\npdivx32.dll
FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\google\update\1.3.21.153\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre7\bin\plugin2\npjp2.dll
FF - plugin: c:\program files\microsoft silverlight\5.1.20513.0\npctrlui.dll
FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll
FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_8_800_168.dll
FF - plugin: c:\windows\system32\npDeployJava1.dll
FF - plugin: c:\windows\system32\npptools.dll
FF - ExtSQL: 2013-08-23 08:45; {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}; c:\program files\mozilla firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
FF - ExtSQL: 2013-09-18 22:13; {e5bbc237-c99b-4ced-a061-0be27703295f}; c:\documents and settings\owner\application data\mozilla\firefox\profiles\hihxz9a0.default-1378943744140\extensions\{e5bbc237-c99b-4ced-a061-0be27703295f}.xpi
.
============= SERVICES / DRIVERS ===============
.
R1 avkmgr;avkmgr;c:\windows\system32\drivers\avkmgr.sys [2012-10-10 37352]
R2 Ad-Aware Service;Ad-Aware Service;c:\program files\ad-aware antivirus\AdAwareService.exe [2013-6-13 1236336]
R2 AntiVirSchedulerService;Avira Scheduler;c:\program files\avira\antivir desktop\sched.exe [2012-10-10 84024]
R2 AntiVirService;Avira Real-Time Protection;c:\program files\avira\antivir desktop\avguard.exe [2012-10-10 108088]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2012-10-10 88840]
R2 Garmin Core Update Service;Garmin Core Update Service;c:\program files\garmin\core update service\Garmin.Cartography.MapUpdate.CoreService.exe [2013-3-27 185688]
R2 IntuitUpdateServiceV4;Intuit Update Service v4;c:\program files\common files\intuit\update service v4\IntuitUpdateService.exe [2012-8-23 13672]
R2 sxuptp;SXUPTP Driver;c:\windows\system32\drivers\sxuptp.sys [2013-5-12 248960]
S0 gfibto;gfibto;c:\windows\system32\drivers\gfibto.sys [2013-9-22 13560]
S1 SASDIFSV;SASDIFSV;\??\l:\\sasdifsv.sys --> l:\\SASDIFSV.SYS [?]
S1 SASKUTIL;SASKUTIL;\??\l:\\saskutil.sys --> l:\\SASKUTIL.SYS [?]
S2 !SASCORE;SAS Core Service;"l:\sascore.exe" --> l:\SASCORE.EXE [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 FreeAgentGoNext Service;Seagate Service;c:\program files\seagate\seagatemanager\sync\FreeAgentService.exe [2009-12-18 189736]
S2 SBAMSvc;Ad-Aware;c:\program files\ad-aware antivirus\SBAMSvc.exe [2012-9-20 3677000]
S2 Skype C2C Service;Skype C2C Service;c:\documents and settings\all users\application data\skype\toolbars\skype c2c service\c2c_service.exe [2013-8-14 3291008]
S2 SkypeUpdate;Skype Updater;c:\program files\skype\updater\Updater.exe [2013-6-3 162408]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2013-4-18 754856]
.
=============== Created Last 30 ================
.
2013-09-22 19:00:54    --------    d-----w-    c:\documents and settings\owner\application data\LavasoftStatistics
2013-09-22 19:00:54    --------    d-----w-    c:\documents and settings\all users\application data\Ad-Aware Antivirus
2013-09-22 18:59:52    --------    d-----w-    c:\program files\Ad-Aware Antivirus
2013-09-22 18:59:28    --------    d-----w-    c:\documents and settings\all users\application data\Downloaded Installations
2013-09-22 18:59:27    --------    d-----w-    c:\documents and settings\owner\local settings\application data\adawarebp
2013-09-22 18:59:27    --------    d-----w-    c:\documents and settings\all users\application data\blekko toolbars
2013-09-22 18:59:24    --------    d-----w-    c:\documents and settings\all users\application data\Ad-Aware Browsing Protection
2013-09-22 18:59:20    --------    d-----w-    c:\program files\Lavasoft
2013-09-22 18:59:20    --------    d-----w-    c:\documents and settings\owner\application data\adawaretb
2013-09-22 18:59:18    --------    d-----w-    c:\program files\Toolbar Cleaner
2013-09-22 18:57:32    44424    ----a-w-    c:\windows\system32\sbbd.exe
2013-09-22 18:57:32    13560    ----a-w-    c:\windows\system32\drivers\gfibto.sys
2013-09-22 18:57:30    --------    d-----w-    c:\documents and settings\owner\application data\Ad-Aware Antivirus
2013-09-22 17:19:55    --------    d-sha-r-    C:\cmdcons
2013-09-19 05:10:59    827392    ----a-w-    c:\program files\mozilla firefox\updated\plugins\webex\12_1324\mcsnew.dll
2013-09-12 01:45:07    --------    d-----w-    c:\documents and settings\owner\application data\SUPERAntiSpyware.com
2013-09-12 01:44:54    --------    d-----w-    c:\documents and settings\all users\application data\SUPERAntiSpyware.com
2013-09-12 00:09:34    --------    d-----w-    c:\documents and settings\owner\application data\Malwarebytes
2013-09-12 00:09:16    --------    d-----w-    c:\documents and settings\all users\application data\Malwarebytes
2013-09-12 00:09:15    22856    ----a-w-    c:\windows\system32\drivers\mbam.sys
2013-09-12 00:09:15    --------    d-----w-    c:\program files\Malwarebytes' Anti-Malware
2013-09-10 21:47:38    386560    -c----w-    c:\windows\system32\dllcache\themeui.dll
2013-09-08 04:34:05    --------    d-----w-    c:\program files\privoxy
2013-09-08 04:33:59    --------    d-----w-    c:\program files\Web Protect
2013-09-08 04:33:21    --------    d-----w-    c:\documents and settings\owner\local settings\application data\CRE
2013-09-08 04:33:20    --------    d-----w-    c:\program files\Conduit
2013-09-08 04:32:42    --------    d-----w-    c:\program files\SearchProtect
2013-09-03 13:53:52    187248    ----a-w-    c:\program files\mozilla firefox\plugins\nppdf32.dll
2013-09-03 13:53:52    187248    ----a-w-    c:\program files\internet explorer\plugins\nppdf32.dll
.
==================== Find3M  ====================
.
2013-09-10 19:01:17    71048    ----a-w-    c:\windows\system32\FlashPlayerCPLApp.cpl
2013-09-10 19:01:17    692616    ----a-w-    c:\windows\system32\FlashPlayerApp.exe
2013-09-05 16:00:23    88840    ----a-w-    c:\windows\system32\drivers\avgntflt.sys
2013-08-09 01:56:45    386560    ----a-w-    c:\windows\system32\themeui.dll
2013-08-08 06:05:59    920064    ----a-w-    c:\windows\system32\wininet.dll
2013-08-08 06:05:59    43520    ----a-w-    c:\windows\system32\licmgr10.dll
2013-08-08 06:05:59    1469440    ------w-    c:\windows\system32\inetcpl.cpl
2013-08-08 06:05:58    18944    ----a-w-    c:\windows\system32\corpol.dll
2013-08-08 01:27:48    1877760    ----a-w-    c:\windows\system32\win32k.sys
2013-08-08 00:02:34    385024    ----a-w-    c:\windows\system32\html.iec
2013-08-05 13:30:32    1289728    ----a-w-    c:\windows\system32\ole32.dll
2013-08-03 21:18:38    1543680    ------w-    c:\windows\system32\wmvdecod.dll
2013-07-10 10:37:53    406016    ----a-w-    c:\windows\system32\usp10.dll
2013-07-04 02:59:11    2193536    ----a-w-    c:\windows\system32\ntoskrnl.exe
2013-07-04 02:08:30    2070144    ----a-w-    c:\windows\system32\ntkrnlpa.exe
2013-06-27 15:52:24    94632    ----a-w-    c:\windows\system32\WindowsAccessBridge.dll
2013-06-27 15:52:22    867240    ----a-w-    c:\windows\system32\npDeployJava1.dll
2013-06-27 15:52:22    789416    ----a-w-    c:\windows\system32\deployJava1.dll
2013-06-27 15:52:22    144896    ----a-w-    c:\windows\system32\javacpl.cpl
.
============= FINISH: 12:29:39.68 ===============

 

 

Attach:

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2012-11-20.01)
.
Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume1
Install Date: 5/22/2011 11:54:06 AM
System Uptime: 9/22/2013 9:42:11 AM (3 hours ago)
.
Motherboard:   |  | MS-7093
Processor: AMD Athlon 64 Processor 3200+ | Socket 939 | 1989/199mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 145 GiB total, 49.338 GiB free.
D: is FIXED (FAT32) - 4 GiB total, 1.682 GiB free.
E: is CDROM ()
F: is CDROM ()
G: is CDROM ()
H: is Removable
I: is Removable
J: is Removable
K: is Removable
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP660: 6/24/2013 11:33:33 AM - System Checkpoint
RP661: 6/25/2013 12:07:21 PM - System Checkpoint
RP662: 6/26/2013 3:16:04 PM - System Checkpoint
RP663: 6/27/2013 8:51:43 AM - Removed Java 7 Update 17
RP664: 6/27/2013 8:52:15 AM - Installed Java 7 Update 25
RP665: 6/28/2013 12:09:53 PM - System Checkpoint
RP666: 6/29/2013 12:49:31 PM - System Checkpoint
RP667: 6/30/2013 5:38:54 PM - System Checkpoint
RP668: 7/1/2013 6:24:13 PM - System Checkpoint
RP669: 7/2/2013 6:59:24 PM - System Checkpoint
RP670: 7/3/2013 7:28:15 PM - System Checkpoint
RP671: 7/4/2013 8:09:24 PM - System Checkpoint
RP672: 7/5/2013 9:00:22 PM - System Checkpoint
RP673: 7/7/2013 12:10:51 PM - System Checkpoint
RP674: 7/8/2013 12:36:42 PM - System Checkpoint
RP675: 7/9/2013 1:00:23 PM - System Checkpoint
RP676: 7/10/2013 8:30:36 AM - Software Distribution Service 3.0
RP677: 7/11/2013 9:32:06 AM - System Checkpoint
RP678: 7/12/2013 11:19:44 AM - System Checkpoint
RP679: 7/13/2013 12:04:02 PM - System Checkpoint
RP680: 7/14/2013 4:03:33 PM - System Checkpoint
RP681: 7/15/2013 12:56:11 PM - Installed Microsoft Office Word Viewer 2003
RP682: 7/15/2013 12:57:06 PM - Installed Compatibility Pack for the 2007 Office system
RP683: 7/15/2013 12:57:54 PM - Installed Microsoft Office Excel Viewer
RP684: 7/15/2013 12:58:32 PM - Installed Microsoft PowerPoint Viewer
RP685: 7/16/2013 2:46:18 PM - System Checkpoint
RP686: 7/16/2013 11:17:35 PM - Software Distribution Service 3.0
RP687: 7/17/2013 9:59:26 AM - Software Distribution Service 3.0
RP688: 7/18/2013 10:54:36 AM - System Checkpoint
RP689: 7/19/2013 5:32:48 PM - System Checkpoint
RP690: 7/20/2013 6:29:32 PM - System Checkpoint
RP691: 7/21/2013 6:41:47 PM - System Checkpoint
RP692: 7/22/2013 7:51:49 PM - System Checkpoint
RP693: 7/23/2013 8:26:48 PM - System Checkpoint
RP694: 7/24/2013 8:41:56 PM - System Checkpoint
RP695: 7/25/2013 9:30:03 PM - System Checkpoint
RP696: 7/26/2013 9:45:07 PM - System Checkpoint
RP697: 7/27/2013 9:56:47 PM - System Checkpoint
RP698: 7/29/2013 8:07:26 AM - System Checkpoint
RP699: 7/30/2013 9:20:33 AM - System Checkpoint
RP700: 7/31/2013 1:44:05 PM - System Checkpoint
RP701: 8/1/2013 2:32:44 PM - System Checkpoint
RP702: 8/5/2013 9:25:11 AM - System Checkpoint
RP703: 8/6/2013 11:09:07 AM - System Checkpoint
RP704: 8/6/2013 9:15:50 PM - Software Distribution Service 3.0
RP705: 8/8/2013 12:15:48 PM - System Checkpoint
RP706: 8/9/2013 12:52:56 PM - System Checkpoint
RP707: 8/10/2013 1:01:52 PM - System Checkpoint
RP708: 8/11/2013 3:26:35 PM - System Checkpoint
RP709: 8/12/2013 3:53:11 PM - System Checkpoint
RP710: 8/13/2013 4:28:56 PM - System Checkpoint
RP711: 8/14/2013 5:00:25 PM - System Checkpoint
RP712: 8/14/2013 9:25:04 PM - Software Distribution Service 3.0
RP713: 8/16/2013 9:37:55 AM - System Checkpoint
RP714: 8/17/2013 10:18:35 AM - System Checkpoint
RP715: 8/21/2013 12:52:10 PM - System Checkpoint
RP716: 8/22/2013 12:55:43 PM - System Checkpoint
RP717: 8/23/2013 2:01:26 PM - System Checkpoint
RP718: 8/24/2013 3:24:14 PM - System Checkpoint
RP719: 8/25/2013 4:13:44 PM - System Checkpoint
RP720: 8/26/2013 5:27:50 PM - System Checkpoint
RP721: 8/28/2013 6:59:17 AM - System Checkpoint
RP722: 8/28/2013 10:21:55 PM - Software Distribution Service 3.0
RP723: 9/4/2013 6:30:34 PM - System Checkpoint
RP724: 9/5/2013 6:31:46 PM - System Checkpoint
RP725: 9/6/2013 7:11:16 PM - System Checkpoint
RP726: 9/7/2013 8:10:49 PM - System Checkpoint
RP727: 9/7/2013 9:48:18 PM - Removed Garmin Communicator Plugin
RP728: 9/10/2013 7:33:02 PM - Software Distribution Service 3.0
RP729: 9/10/2013 11:06:33 PM - Software Distribution Service 3.0
RP730: 9/11/2013 12:53:22 PM - Software Distribution Service 3.0
RP731: 9/12/2013 2:29:41 PM - System Checkpoint
RP732: 9/12/2013 10:24:56 PM - Software Distribution Service 3.0
RP733: 9/14/2013 1:28:12 PM - System Checkpoint
RP734: 9/15/2013 2:16:19 PM - System Checkpoint
RP735: 9/16/2013 2:24:52 PM - System Checkpoint
RP736: 9/18/2013 9:12:59 AM - Software Distribution Service 3.0
RP737: 9/18/2013 10:17:41 AM - Software Distribution Service 3.0
RP738: 9/18/2013 10:39:40 PM - Software Distribution Service 3.0
RP739: 9/20/2013 7:55:46 AM - System Checkpoint
RP740: 9/21/2013 9:59:02 AM - System Checkpoint
RP741: 9/22/2013 9:41:01 AM - Installed Microsoft Fix it 50566
RP742: 9/22/2013 10:06:11 AM - Installed Microsoft Fix it 50566
.
==== Installed Programs ======================
.
AC3Filter (remove only)
Ad-Aware Antivirus
Ad-Aware Browsing Protection
Adobe AIR
Adobe Flash Player 11 ActiveX
Adobe Flash Player 11 Plugin
Adobe Reader X (10.1.8)
Apple Application Support
Apple Software Update
ATI - Software Uninstall Utility
ATI Control Panel
ATI Display Driver
Audacity 2.0.2
Avira Free Antivirus
BUFFALO AirStation Configuration Tool
BUFFALO Client Manager 3
BUFFALO Network-USB Navigator
CCleaner
CDisplay 1.8
Cisco WebEx Meetings
CleanUp!
CloneDVD
Compatibility Pack for the 2007 Office system
Digital Media Reader
DivX Setup
EarthLink Common Authentication
EarthLink MailBox
EarthLink Toolbar
Elevated Installer
foobar2000 v1.2.9
Garmin Express
Garmin Express Tray
Garmin Update Service
Google Chrome
Google Drive
Google Earth
Google Talk Plugin
Google Toolbar for Internet Explorer
Google Update Helper
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB2443685)
Hotfix for Windows XP (KB2570791)
Hotfix for Windows XP (KB2633952)
Hotfix for Windows XP (KB2756822)
Hotfix for Windows XP (KB2779562)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB981793)
Java 7 Update 25
Java Auto Updater
Java 6 Update 27
LAME v3.99.3 (for Windows)
Learn2 Player (Uninstall Only)
Logitech Vid HD
Logitech Webcam Software
Logitech Webcam Software Driver Package
Malwarebytes Anti-Malware version 1.75.0.1300
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB2698023)
Microsoft .NET Framework 1.1 Security Update (KB2833941)
Microsoft .NET Framework 1.1 Security Update (KB979906)
Microsoft .NET Framework 4 Client Profile
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Office Excel Viewer
Microsoft Office Word Viewer 2003
Microsoft Office XP Professional with FrontPage
Microsoft PowerPoint Viewer
Microsoft Silverlight
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
Microsoft XML Parser
Mozilla Firefox 23.0.1 (x86 en-US)
Mozilla Maintenance Service
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
Multimedia Keyboard Driver
MyPaint 1.0.0
Nero BurnRights
Nero OEM
NexDef Plug-in
PhotoScape
PowerDVD
QuickTime
RealPlayer Basic
Realtek AC'97 Audio
Redistributed Files
Security Update for CAPICOM (KB931906)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2789642)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2804576)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2832407)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2835393)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2840628)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2840628v2)
Security Update for Microsoft Windows (KB2564958)
Security Update for Windows Internet Explorer 8 (KB2497640)
Security Update for Windows Internet Explorer 8 (KB2510531)
Security Update for Windows Internet Explorer 8 (KB2530548)
Security Update for Windows Internet Explorer 8 (KB2544521)
Security Update for Windows Internet Explorer 8 (KB2559049)
Security Update for Windows Internet Explorer 8 (KB2586448)
Security Update for Windows Internet Explorer 8 (KB2618444)
Security Update for Windows Internet Explorer 8 (KB2647516)
Security Update for Windows Internet Explorer 8 (KB2675157)
Security Update for Windows Internet Explorer 8 (KB2699988)
Security Update for Windows Internet Explorer 8 (KB2722913)
Security Update for Windows Internet Explorer 8 (KB2744842)
Security Update for Windows Internet Explorer 8 (KB2761465)
Security Update for Windows Internet Explorer 8 (KB2792100)
Security Update for Windows Internet Explorer 8 (KB2797052)
Security Update for Windows Internet Explorer 8 (KB2799329)
Security Update for Windows Internet Explorer 8 (KB2809289)
Security Update for Windows Internet Explorer 8 (KB2817183)
Security Update for Windows Internet Explorer 8 (KB2829530)
Security Update for Windows Internet Explorer 8 (KB2838727)
Security Update for Windows Internet Explorer 8 (KB2846071)
Security Update for Windows Internet Explorer 8 (KB2847204)
Security Update for Windows Internet Explorer 8 (KB2862772)
Security Update for Windows Internet Explorer 8 (KB2870699)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB981332)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows Media Player (KB2378111)
Security Update for Windows Media Player (KB2834904-v2)
Security Update for Windows Media Player (KB2834904)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB975558)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB2079403)
Security Update for Windows XP (KB2115168)
Security Update for Windows XP (KB2121546)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB2296011)
Security Update for Windows XP (KB2347290)
Security Update for Windows XP (KB2360937)
Security Update for Windows XP (KB2387149)
Security Update for Windows XP (KB2393802)
Security Update for Windows XP (KB2412687)
Security Update for Windows XP (KB2419632)
Security Update for Windows XP (KB2423089)
Security Update for Windows XP (KB2440591)
Security Update for Windows XP (KB2443105)
Security Update for Windows XP (KB2476490)
Security Update for Windows XP (KB2476687)
Security Update for Windows XP (KB2478960)
Security Update for Windows XP (KB2478971)
Security Update for Windows XP (KB2479943)
Security Update for Windows XP (KB2481109)
Security Update for Windows XP (KB2483185)
Security Update for Windows XP (KB2485663)
Security Update for Windows XP (KB2503658)
Security Update for Windows XP (KB2503665)
Security Update for Windows XP (KB2506212)
Security Update for Windows XP (KB2506223)
Security Update for Windows XP (KB2507618)
Security Update for Windows XP (KB2507938)
Security Update for Windows XP (KB2508272)
Security Update for Windows XP (KB2508429)
Security Update for Windows XP (KB2509553)
Security Update for Windows XP (KB2511455)
Security Update for Windows XP (KB2524375)
Security Update for Windows XP (KB2535512)
Security Update for Windows XP (KB2536276-v2)
Security Update for Windows XP (KB2536276)
Security Update for Windows XP (KB2544893-v2)
Security Update for Windows XP (KB2544893)
Security Update for Windows XP (KB2555917)
Security Update for Windows XP (KB2562937)
Security Update for Windows XP (KB2566454)
Security Update for Windows XP (KB2567053)
Security Update for Windows XP (KB2567680)
Security Update for Windows XP (KB2570222)
Security Update for Windows XP (KB2570947)
Security Update for Windows XP (KB2584146)
Security Update for Windows XP (KB2585542)
Security Update for Windows XP (KB2592799)
Security Update for Windows XP (KB2598479)
Security Update for Windows XP (KB2603381)
Security Update for Windows XP (KB2618451)
Security Update for Windows XP (KB2619339)
Security Update for Windows XP (KB2620712)
Security Update for Windows XP (KB2621440)
Security Update for Windows XP (KB2624667)
Security Update for Windows XP (KB2631813)
Security Update for Windows XP (KB2633171)
Security Update for Windows XP (KB2639417)
Security Update for Windows XP (KB2641653)
Security Update for Windows XP (KB2646524)
Security Update for Windows XP (KB2647518)
Security Update for Windows XP (KB2653956)
Security Update for Windows XP (KB2655992)
Security Update for Windows XP (KB2659262)
Security Update for Windows XP (KB2660465)
Security Update for Windows XP (KB2661637)
Security Update for Windows XP (KB2676562)
Security Update for Windows XP (KB2685939)
Security Update for Windows XP (KB2686509)
Security Update for Windows XP (KB2691442)
Security Update for Windows XP (KB2695962)
Security Update for Windows XP (KB2698365)
Security Update for Windows XP (KB2705219)
Security Update for Windows XP (KB2707511)
Security Update for Windows XP (KB2709162)
Security Update for Windows XP (KB2712808)
Security Update for Windows XP (KB2718523)
Security Update for Windows XP (KB2719985)
Security Update for Windows XP (KB2723135)
Security Update for Windows XP (KB2724197)
Security Update for Windows XP (KB2727528)
Security Update for Windows XP (KB2731847)
Security Update for Windows XP (KB2753842-v2)
Security Update for Windows XP (KB2753842)
Security Update for Windows XP (KB2757638)
Security Update for Windows XP (KB2758857)
Security Update for Windows XP (KB2761226)
Security Update for Windows XP (KB2770660)
Security Update for Windows XP (KB2778344)
Security Update for Windows XP (KB2779030)
Security Update for Windows XP (KB2780091)
Security Update for Windows XP (KB2799494)
Security Update for Windows XP (KB2802968)
Security Update for Windows XP (KB2807986)
Security Update for Windows XP (KB2808735)
Security Update for Windows XP (KB2813170)
Security Update for Windows XP (KB2813345)
Security Update for Windows XP (KB2820197)
Security Update for Windows XP (KB2820917)
Security Update for Windows XP (KB2829361)
Security Update for Windows XP (KB2834886)
Security Update for Windows XP (KB2839229)
Security Update for Windows XP (KB2845187)
Security Update for Windows XP (KB2849470)
Security Update for Windows XP (KB2850851)
Security Update for Windows XP (KB2850869)
Security Update for Windows XP (KB2859537)
Security Update for Windows XP (KB2864063)
Security Update for Windows XP (KB2876217)
Security Update for Windows XP (KB2876315)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB979687)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB980436)
Security Update for Windows XP (KB981322)
Security Update for Windows XP (KB981997)
Security Update for Windows XP (KB982132)
Security Update for Windows XP (KB982381)
Security Update for Windows XP (KB982665)
Skype Click to Call
Skype™ 6.5
SoftV92 Data Fax Modem with SmartCP
Spybot - Search & Destroy
TurboTax 2012
TurboTax 2012 wcaiper
TurboTax 2012 WinPerFedFormset
TurboTax 2012 WinPerReleaseEngine
TurboTax 2012 WinPerTaxSupport
TurboTax 2012 wrapper
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows XP (KB2345886)
Update for Windows XP (KB2541763)
Update for Windows XP (KB2607712)
Update for Windows XP (KB2616676)
Update for Windows XP (KB2641690)
Update for Windows XP (KB2661254-v2)
Update for Windows XP (KB2718704)
Update for Windows XP (KB2736233)
Update for Windows XP (KB2749655)
Update for Windows XP (KB2863058)
Update for Windows XP (KB951978)
Update for Windows XP (KB953356)
Update for Windows XP (KB955759)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971029)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
VC80CRTRedist - 8.0.50727.6195
Viewpoint Media Player
VLC media player 2.0.3
Web Protect for Windows
WebFldrs XP
Windows Backup Utility
Windows Internet Explorer 8
Windows Media Format 11 runtime
Windows Media Player 11
Windows XP Service Pack 3
WinRAR 4.01 (32-bit)
Xvid Video Codec
.
==== Event Viewer Messages From Past Week ========
.
9/22/2013 9:44:47 AM, error: Service Control Manager [7009]  - Timeout (30000 milliseconds) waiting for the BITS service to connect.
9/22/2013 9:44:47 AM, error: Service Control Manager [7000]  - The BITS service failed to start due to the following error:  The service did not respond to the start or control request in a timely fashion.
9/22/2013 9:44:47 AM, error: DCOM [10005]  - DCOM got error "%1053" attempting to start the service BITS with arguments "" in order to run the server: {4991D34B-80A1-4291-83B6-3328366B9097}
9/22/2013 10:16:44 AM, error: Service Control Manager [7034]  - The Process Monitor service terminated unexpectedly.  It has done this 1 time(s).
9/22/2013 10:16:43 AM, error: Service Control Manager [7034]  - The Skype C2C Service service terminated unexpectedly.  It has done this 1 time(s).
9/18/2013 9:10:26 AM, error: Service Control Manager [7034]  - The Seagate Service service terminated unexpectedly.  It has done this 1 time(s).
9/16/2013 8:21:41 AM, error: Service Control Manager [7026]  - The following boot-start or system-start driver(s) failed to load:  SASDIFSV SASKUTIL
9/16/2013 8:21:15 AM, error: Service Control Manager [7000]  - The SAS Core Service service failed to start due to the following error:  The system cannot find the path specified.
.
==== End Of File ===========================

 

[AdvancedSetup]

Hello and
 
Please visit this webpage and read the ComboFix User's Guide:

• Once you've read the article and are ready to use the program you can download it directly from the link below.
• Important! - Please make sure you save combofix to your desktop and do not run it from your browser
• Direct download link for: ComboFix.exe
• Please make sure you disable your security applications before running ComboFix.
• Once Combofix has completed it will produce and open a log file.  Please be patient as it can take some time to load.
• Please attach that log file to your next reply.
• If needed the file can be located here:  C:\combofix.txt
• NOTE: If you receive the message "illegal operation has been attempted on a registry key that has been marked for deletion", just reboot the computer.

[hdk]

Thanks for the follow up. I was able to read through this thread http://forums.malwarebytes.org/index.php?showtopic=133202&page=1

and while not the same problem, it explained enough to use the tools to remove the problem (keeping fingers crossed).

 

This is great site.

[AdvancedSetup]

Well it's up to you but I would suggest posting your log so that it can be reviewed. Rarely is everything corrected automatically.

If you think you're okay though please let me know and I'll go ahead and close your topic.

Thanks

[hdk]

Which log should I rerun/post? They were deleted in the cleanup process.

[AdvancedSetup]

The combofix log.  That log should still be there in the root of the drive.

[hdk]

I believe that was deleted during the Combofix uninstall process. Search turned up nothing.

[AdvancedSetup]

Okay please run these tools and post back their logs.
 
Please download MiniToolBox save it to your desktop and run it.

Checkmark the following check-boxes:

• Flush DNS
• Report IE Proxy Settings
• Reset IE Proxy Settings
• Report FF Proxy Settings
• Reset FF Proxy Settings
• List content of Hosts
• List IP configuration
• List Winsock Entries
• List last 10 Event Viewer log
• List Installed Programs
• List Devices
• List Users, Partitions and Memory size.
• List Minidump Files

Click Go and post the result (Result.txt). A copy of Result.txt will be saved in the same directory the tool is run.

Note: When using Reset FF Proxy Settings option Firefox should be closed.
 
 
 
Next, Please run the following scanner and send back the logs.

Download DDS from one of the locations below and save to your Desktop
dds.scr
dds.com

Temporarily disable any script blocker if your Anti-Virus/Anti-Malware has it.
How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs

Once downloaded you can disconnect from the Internet and disable your Ant-Virus temporarily if needed.
Then double click dds.scr or dds.com to run the tool.
Click the Run button if prompted with an Open File - Security Warning dialog box.
A black DOS console should open and run for a moment.

• When done, DDS will open two (2) logs:
  • DDS.txt
  • Attach.txt

• Save both reports to your desktop
• Please include the following logs in your next reply as an attachment: DDS.txt and Attach.txt
• You can ignore the note about zipping the Attach.txt file and just post it or attach it.

[hdk]

Result:

 

MiniToolBox by Farbar  Version: 13-07-2013
Ran by Owner (administrator) on 24-09-2013 at 16:18:39
Running from "C:\Documents and Settings\Owner\Desktop"
Microsoft Windows XP Home Edition Service Pack 3 (X86)
Boot Mode: Normal
***************************************************************************

========================= Flush DNS: ===================================


Windows IP Configuration



Successfully flushed the DNS Resolver Cache.


========================= IE Proxy Settings: ==============================

Proxy is not enabled.
No Proxy Server is set.

"Reset IE Proxy Settings": IE Proxy Settings were reset.

========================= FF Proxy Settings: ==============================

"network.proxy.type", 0

"Reset FF Proxy Settings": Firefox Proxy settings were reset.

========================= Hosts content: =================================

127.0.0.1    localhost

========================= IP Configuration: ================================

Realtek RTL8139 Family PCI Fast Ethernet NIC = Local Area Connection (Connected)
1394 Net Adapter = 1394 Connection (Connected)


# ----------------------------------
# Interface IP Configuration         
# ----------------------------------
pushd interface ip


# Interface IP Configuration for "Local Area Connection"

set address name="Local Area Connection" source=dhcp
set dns name="Local Area Connection" source=dhcp register=PRIMARY
set wins name="Local Area Connection" source=dhcp


popd
# End of interface IP configuration




Windows IP Configuration



        Host Name . . . . . . . . . . . . : YOUR-694230950D

        Primary Dns Suffix  . . . . . . . :

        Node Type . . . . . . . . . . . . : Unknown

        IP Routing Enabled. . . . . . . . : No

        WINS Proxy Enabled. . . . . . . . : No

        DNS Suffix Search List. . . . . . : san.rr.com



Ethernet adapter Local Area Connection:



        Connection-specific DNS Suffix  . : san.rr.com

        Description . . . . . . . . . . . : Realtek RTL8139 Family PCI Fast Ethernet NIC

        Physical Address. . . . . . . . . : 00-11-09-03-8A-4C

        Dhcp Enabled. . . . . . . . . . . : Yes

        Autoconfiguration Enabled . . . . : Yes

        IP Address. . . . . . . . . . . . : 192.168.11.53

        Subnet Mask . . . . . . . . . . . : 255.255.255.0

        Default Gateway . . . . . . . . . : 192.168.11.1

        DHCP Server . . . . . . . . . . . : 192.168.11.1

        DNS Servers . . . . . . . . . . . : 192.168.11.1

        Lease Obtained. . . . . . . . . . : Tuesday, September 24, 2013 10:30:40 AM

        Lease Expires . . . . . . . . . . : Wednesday, September 25, 2013 10:30:40 AM

Server:  DD-WRT
Address:  192.168.11.1

Name:    google.com
Addresses:  74.125.228.101, 74.125.228.97, 74.125.228.96, 74.125.228.103
      74.125.228.98, 74.125.228.105, 74.125.228.100, 74.125.228.104, 74.125.228.99
      74.125.228.110, 74.125.228.102



Pinging google.com [74.125.228.102] with 32 bytes of data:



Reply from 74.125.228.102: bytes=32 time=87ms TTL=49

Reply from 74.125.228.102: bytes=32 time=88ms TTL=49



Ping statistics for 74.125.228.102:

    Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

    Minimum = 87ms, Maximum = 88ms, Average = 87ms

Server:  DD-WRT
Address:  192.168.11.1

Name:    yahoo.com
Addresses:  98.139.183.24, 98.138.253.109, 206.190.36.45



Pinging yahoo.com [206.190.36.45] with 32 bytes of data:



Reply from 206.190.36.45: bytes=32 time=117ms TTL=47

Reply from 206.190.36.45: bytes=32 time=41ms TTL=47



Ping statistics for 206.190.36.45:

    Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

    Minimum = 41ms, Maximum = 117ms, Average = 79ms



Pinging 127.0.0.1 with 32 bytes of data:



Reply from 127.0.0.1: bytes=32 time<1ms TTL=128

Reply from 127.0.0.1: bytes=32 time<1ms TTL=128



Ping statistics for 127.0.0.1:

    Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

    Minimum = 0ms, Maximum = 0ms, Average = 0ms

===========================================================================
Interface List
0x1 ........................... MS TCP Loopback interface
0x2 ...00 11 09 03 8a 4c ...... Realtek RTL8139 Family PCI Fast Ethernet NIC - Packet Scheduler Miniport
===========================================================================
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0     192.168.11.1   192.168.11.53      20
        127.0.0.0        255.0.0.0        127.0.0.1       127.0.0.1      1
     192.168.11.0    255.255.255.0    192.168.11.53   192.168.11.53      20
    192.168.11.53  255.255.255.255        127.0.0.1       127.0.0.1      20
   192.168.11.255  255.255.255.255    192.168.11.53   192.168.11.53      20
        224.0.0.0        240.0.0.0    192.168.11.53   192.168.11.53      20
  255.255.255.255  255.255.255.255    192.168.11.53   192.168.11.53      1
Default Gateway:      192.168.11.1
===========================================================================
Persistent Routes:
  None
========================= Winsock entries =====================================

Catalog5 01 C:\WINDOWS\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog5 02 C:\WINDOWS\system32\winrnr.dll [16896] (Microsoft Corporation)
Catalog5 03 C:\WINDOWS\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 01 C:\WINDOWS\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 02 C:\WINDOWS\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 03 C:\WINDOWS\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 04 C:\WINDOWS\system32\rsvpsp.dll [92672] (Microsoft Corporation)
Catalog9 05 C:\WINDOWS\system32\rsvpsp.dll [92672] (Microsoft Corporation)
Catalog9 06 C:\WINDOWS\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 07 C:\WINDOWS\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 08 C:\WINDOWS\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 09 C:\WINDOWS\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 10 C:\WINDOWS\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 11 C:\WINDOWS\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 12 C:\WINDOWS\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 13 C:\WINDOWS\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 14 C:\WINDOWS\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 15 C:\WINDOWS\system32\mswsock.dll [245248] (Microsoft Corporation)

========================= Event log errors: ===============================

Application errors:
==================
Error: (09/24/2013 10:36:01 AM) (Source: Application Error) (User: )
Description: Faulting application FreeAgentService.exe, version 5.0.0.4, faulting module msvcr80.dll, version 8.0.50727.6195, fault address 0x000046b4.
Processing media-specific event for [FreeAgentService.exe!ws!]

Error: (09/24/2013 10:09:32 AM) (Source: Application Error) (User: )
Description: Faulting application FreeAgentService.exe, version 5.0.0.4, faulting module msvcr80.dll, version 8.0.50727.6195, fault address 0x000046b4.
Processing media-specific event for [FreeAgentService.exe!ws!]

Error: (09/23/2013 10:10:21 PM) (Source: Application Error) (User: )
Description: Faulting application FreeAgentService.exe, version 5.0.0.4, faulting module msvcr80.dll, version 8.0.50727.6195, fault address 0x000046b4.
Processing media-specific event for [FreeAgentService.exe!ws!]

Error: (09/23/2013 09:35:30 PM) (Source: crypt32) (User: )
Description: Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: A connection with the server could not be established

Error: (09/23/2013 09:31:17 PM) (Source: crypt32) (User: )
Description: Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: This network connection does not exist.

Error: (09/23/2013 09:31:17 PM) (Source: crypt32) (User: )
Description: Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: This network connection does not exist.

Error: (09/23/2013 09:31:17 PM) (Source: crypt32) (User: )
Description: Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: This network connection does not exist.

Error: (09/23/2013 09:31:05 PM) (Source: crypt32) (User: )
Description: Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: A connection with the server could not be established

Error: (09/23/2013 09:31:01 PM) (Source: crypt32) (User: )
Description: Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: This network connection does not exist.

Error: (09/23/2013 09:30:57 PM) (Source: crypt32) (User: )
Description: Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: This network connection does not exist.


System errors:
=============
Error: (09/24/2013 10:36:04 AM) (Source: Service Control Manager) (User: )
Description: The Seagate Service service terminated unexpectedly.  It has done this 1 time(s).

Error: (09/24/2013 10:31:19 AM) (Source: Service Control Manager) (User: )
Description: The following boot-start or system-start driver(s) failed to load:
SASDIFSV
SASKUTIL

Error: (09/24/2013 10:30:55 AM) (Source: Service Control Manager) (User: )
Description: The SAS Core Service service failed to start due to the following error:
%%3

Error: (09/24/2013 10:10:42 AM) (Source: Service Control Manager) (User: )
Description: The Seagate Service service terminated unexpectedly.  It has done this 1 time(s).

Error: (09/24/2013 10:09:24 AM) (Source: Windows Update Agent) (User: )
Description: Unable to Connect: Windows is unable to connect to the automatic updates service and therefore cannot download and install updates according to the set schedule. Windows will continue to try to establish a connection.

Error: (09/24/2013 10:05:02 AM) (Source: Service Control Manager) (User: )
Description: The following boot-start or system-start driver(s) failed to load:
SASDIFSV
SASKUTIL

Error: (09/24/2013 10:04:34 AM) (Source: Service Control Manager) (User: )
Description: The SAS Core Service service failed to start due to the following error:
%%3

Error: (09/23/2013 10:10:35 PM) (Source: Service Control Manager) (User: )
Description: The Seagate Service service terminated unexpectedly.  It has done this 1 time(s).

Error: (09/23/2013 10:05:54 PM) (Source: Service Control Manager) (User: )
Description: The following boot-start or system-start driver(s) failed to load:
SASDIFSV
SASKUTIL

Error: (09/23/2013 10:05:23 PM) (Source: Service Control Manager) (User: )
Description: The System Restore Service service terminated with the following error:
%%2


Microsoft Office Sessions:
=========================
Error: (09/24/2013 10:36:01 AM) (Source: Application Error)(User: )
Description: FreeAgentService.exe5.0.0.4msvcr80.dll8.0.50727.6195000046b4

Error: (09/24/2013 10:09:32 AM) (Source: Application Error)(User: )
Description: FreeAgentService.exe5.0.0.4msvcr80.dll8.0.50727.6195000046b4

Error: (09/23/2013 10:10:21 PM) (Source: Application Error)(User: )
Description: FreeAgentService.exe5.0.0.4msvcr80.dll8.0.50727.6195000046b4

Error: (09/23/2013 09:35:30 PM) (Source: crypt32)(User: )
Description: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txtA connection with the server could not be established

Error: (09/23/2013 09:31:17 PM) (Source: crypt32)(User: )
Description: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txtThis network connection does not exist.

Error: (09/23/2013 09:31:17 PM) (Source: crypt32)(User: )
Description: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txtThis network connection does not exist.

Error: (09/23/2013 09:31:17 PM) (Source: crypt32)(User: )
Description: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txtThis network connection does not exist.

Error: (09/23/2013 09:31:05 PM) (Source: crypt32)(User: )
Description: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txtA connection with the server could not be established

Error: (09/23/2013 09:31:01 PM) (Source: crypt32)(User: )
Description: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txtThis network connection does not exist.

Error: (09/23/2013 09:30:57 PM) (Source: crypt32)(User: )
Description: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txtThis network connection does not exist.


=========================== Installed Programs ============================

AC3Filter (remove only)
Adobe AIR (Version: 2.6.0.19140)
Adobe Flash Player 11 ActiveX (Version: 11.8.800.168)
Adobe Flash Player 11 Plugin (Version: 11.8.800.168)
Adobe Reader X (10.1.8) (Version: 10.1.8)
Apple Application Support (Version: 2.1.7)
Apple Software Update (Version: 2.1.3.127)
ATI - Software Uninstall Utility (Version: 6.14.10.1010)
ATI Control Panel (Version: 6.14.10.5134)
ATI Display Driver (Version: 8.08-041111a-019690C)
Audacity 2.0.2 (Version: 2.0.2)
Avira Free Antivirus (Version: 13.0.0.4052)
BUFFALO AirStation Configuration Tool (Version: 2.0.13)
BUFFALO Client Manager 3
BUFFALO Network-USB Navigator (Version: 1.40)
CCleaner (Version: 4.05)
CDisplay 1.8
Cisco WebEx Meetings
CleanUp!
Compatibility Pack for the 2007 Office system (Version: 12.0.6612.1000)
Digital Media Reader (Version: 1.10)
DivX Setup (Version: 2.6.1.44)
EarthLink Common Authentication (Version: 1.0.87.0)
EarthLink MailBox
EarthLink MailBox (Version: 2005.3.14.0)
EarthLink Toolbar
Elevated Installer (Version: 2.1.13)
foobar2000 v1.2.9 (Version: 1.2.9)
Garmin Express (Version: 2.1.13)
Garmin Express Tray (Version: 2.1.13)
Garmin Update Service (Version: 2.1.13)
Google Chrome (Version: 29.0.1547.66)
Google Drive (Version: 1.11.4865.2530)
Google Earth (Version: 7.1.1.1888)
Google Talk Plugin (Version: 4.5.3.14917)
Google Toolbar for Internet Explorer
Java 7 Update 25 (Version: 7.0.250)
Java Auto Updater (Version: 2.1.9.5)
Java 6 Update 27 (Version: 6.0.270)
LAME v3.99.3 (for Windows)
Learn2 Player (Uninstall Only)
Logitech Vid HD (Version: 7.2 (7248))
Logitech Webcam Software (Version: 12.10.1113)
Logitech Webcam Software Driver Package (Version: 12.10.1110)
Malwarebytes Anti-Malware version 1.75.0.1300 (Version: 1.75.0.1300)
Microsoft .NET Framework 1.1 (Version: 1.1.4322)
Microsoft .NET Framework 1.1 Security Update (KB2698023)
Microsoft .NET Framework 1.1 Security Update (KB2833941)
Microsoft .NET Framework 1.1 Security Update (KB979906)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft Compression Client Pack 1.0 for Windows XP (Version: 1)
Microsoft Office Excel Viewer (Version: 12.0.6612.1000)
Microsoft Office Word Viewer 2003 (Version: 11.0.8173.0)
Microsoft Office XP Professional with FrontPage (Version: 10.0.2627.01)
Microsoft PowerPoint Viewer (Version: 14.0.6029.1000)
Microsoft Silverlight (Version: 5.1.20513.0)
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft XML Parser (Version: 8.20.8730.4)
Mozilla Firefox 23.0.1 (x86 en-US) (Version: 23.0.1)
Mozilla Maintenance Service (Version: 23.0.1)
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)
Multimedia Keyboard Driver
MyPaint 1.0.0 (Version: 1.0.0)
Nero BurnRights
Nero OEM
NexDef Plug-in
PhotoScape
PowerDVD
QuickTime (Version: 7.72.80.56)
RealPlayer Basic
Realtek AC'97 Audio
Redistributed Files (Version: 2.0.46.0)
Skype Click to Call (Version: 6.11.13348)
Skype™ 6.5 (Version: 6.5.158)
SoftV92 Data Fax Modem with SmartCP
Spybot - Search & Destroy (Version: 1.6.2)
TurboTax 2012 (Version: 2012.0)
TurboTax 2012 wcaiper (Version: 012.000.1267)
TurboTax 2012 WinPerFedFormset (Version: 012.000.1881)
TurboTax 2012 WinPerReleaseEngine (Version: 012.000.0419)
TurboTax 2012 WinPerTaxSupport (Version: 012.000.0178)
TurboTax 2012 wrapper (Version: 012.000.0127)
Update for Windows Internet Explorer 8 (KB976662) (Version: 1)
Update for Windows XP (KB2345886) (Version: 1)
Update for Windows XP (KB2541763) (Version: 1)
Update for Windows XP (KB2607712) (Version: 1)
Update for Windows XP (KB2616676) (Version: 1)
Update for Windows XP (KB2641690) (Version: 1)
Update for Windows XP (KB2661254-v2) (Version: 2)
Update for Windows XP (KB2718704) (Version: 1)
Update for Windows XP (KB2736233) (Version: 1)
Update for Windows XP (KB2749655) (Version: 1)
Update for Windows XP (KB2863058) (Version: 1)
Update for Windows XP (KB951978) (Version: 1)
Update for Windows XP (KB953356) (Version: 1)
Update for Windows XP (KB955759) (Version: 1)
Update for Windows XP (KB967715) (Version: 1)
Update for Windows XP (KB968389) (Version: 1)
Update for Windows XP (KB971029) (Version: 1)
Update for Windows XP (KB971737) (Version: 1)
Update for Windows XP (KB973687) (Version: 1)
Update for Windows XP (KB973815) (Version: 1)
VC80CRTRedist - 8.0.50727.6195 (Version: 1.2.0)
VLC media player 2.0.3 (Version: 2.0.3)
Web Protect for Windows (Version: 3.28.33)
WebFldrs XP (Version: 9.50.7523)
Windows Backup Utility (Version: 5.1)
Windows Internet Explorer 8 (Version: 20090308.140743)
Windows Media Format 11 runtime
Windows Media Player 11
Windows XP Service Pack 3 (Version: 20080414.031525)
WinRAR 4.01 (32-bit) (Version: 4.01.0)
Xvid Video Codec (Version: 1.3.2)

========================= Devices: ================================


========================= Memory info: ===================================

Percentage of memory in use: 28%
Total physical RAM: 2430.48 MB
Available physical RAM: 1740.1 MB
Total Pagefile: 4319.53 MB
Available Pagefile: 3573.37 MB
Total Virtual: 2047.88 MB
Available Virtual: 1971.54 MB

========================= Partitions: =====================================

1 Drive c: () (Fixed) (Total:145.29 GB) (Free:55.19 GB) NTFS
2 Drive d: () (Fixed) (Total:3.75 GB) (Free:1.68 GB) FAT32

========================= Users: ========================================

User accounts for \\YOUR-694230950D

Administrator            ASPNET                   Guest                    
HelpAssistant            Owner                    SUPPORT_388945a0         

========================= Minidump Files ==================================

No minidump file found


**** End of log ****
 

dds:

 

DDS (Ver_2012-11-20.01) - NTFS_x86
Internet Explorer: 8.0.6001.18702  BrowserJavaVersion: 10.25.2
Run by Owner at 16:32:09 on 2013-09-24
Microsoft Windows XP Home Edition  5.1.2600.3.1252.1.1033.18.2430.1547 [GMT -7:00]
.
AV: Avira Desktop *Enabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
.
============== Running Processes ================
.
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\BUFFALO\Client Manager3\bwsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe
C:\Program Files\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe
C:\Program Files\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe
C:\Program Files\Java\jre7\bin\jqs.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\Documents and Settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\BUFFALO\Client Manager3\cm3_tray.exe
C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
C:\WINDOWS\system32\svchost.exe -k rpcss
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\system32\svchost.exe -k netsvcs
.
============== Pseudo HJT Report ===============
.
uStart Page = about:blank
BHO: {2CEBF6C7-2B40-469B-B5D5-CD3F3676C3C4} - <orphaned>
BHO: DivX Plus Web Player HTML5 <video>: {326E768D-4182-46FD-9C16-1449A49795F4} - c:\program files\divx\divx plus web player\ie\divxhtml5\DivXHTML5.dll
BHO: ElnkPubBHO Class: {512ACF1B-64D9-4928-B382-A80556F28DB4} - c:\program files\earthlink\toolbar\ElnkPuB.dll
BHO: Spybot-S&D IE Protection: {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll
BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre7\bin\ssv.dll
BHO: ElnkProtectionBHO Class: {9579D574-D4D8-4335-9560-FE8641A013BD} - c:\program files\earthlink\toolbar\ProtctIE.dll
BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
BHO: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - <orphaned>
BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre7\bin\jp2ssv.dll
BHO: ElnkLegacyUninstBHO Class: {E713904C-DF05-4C79-BBAD-02DB923253BE} - c:\program files\earthlink\toolbar\uninsttb.dll
TB: &Google: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
TB: EarthLink Toolbar: {C7768536-96F8-4001-B1A2-90EE21279187} - c:\program files\earthlink\toolbar\Toolbar.dll
TB: &Google: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
TB: EarthLink Toolbar: {C7768536-96F8-4001-B1A2-90EE21279187} - c:\program files\earthlink\toolbar\Toolbar.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [Recguard] c:\windows\sminst\RECGUARD.EXE
mRun: [soundMan] SOUNDMAN.EXE
mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe
mRun: [ATIPTA] c:\program files\ati technologies\ati control panel\atiptaxx.exe
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [ElbyCheckAnyDVD] "c:\program files\slysoft\anydvd\ElbyCheck.exe" /L AnyDVD
mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe"
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [showWnd] ShowWnd.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\client~1.lnk - c:\program files\buffalo\client manager3\cm3_tray.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE
StartupFolder: c:\documents and settings\all users\start menu\programs\startup\run_startmenu.cmd
uPolicies-Explorer: NoDriveTypeAutoRun = dword:323
uPolicies-Explorer: NoDriveAutoRun = dword:67108863
uPolicies-Explorer: NoDrives = dword:0
mPolicies-Explorer: NoDriveAutoRun = dword:67108863
mPolicies-Explorer: NoDriveTypeAutoRun = dword:323
mPolicies-Explorer: NoDrives = dword:0
mPolicies-Windows\System: Allow-LogonScript-NetbiosDisabled = dword:1
mPolicies-Explorer: NoDriveTypeAutoRun = dword:323
mPolicies-Explorer: NoDriveAutoRun = dword:67108863
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office10\EXCEL.EXE/3000
IE: EarthLink Google Search - c:\program files\earthlink\toolbar\SearchUI.dll/search.html
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - LocalServer32 - <no file>
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE}
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
.
INFO: HKCU has more than 50 listed domains.
If you wish to scan all of them, select the 'Force scan all domains' option.
.
.
INFO: HKLM has more than 50 listed domains.
   If you wish to scan all of them, select the 'Force scan all domains' option.
.





TCP: NameServer = 192.168.11.1
TCP: Interfaces\{14C3684D-03ED-4A2C-BDB8-B69C9F8E0861} : DHCPNameServer = 192.168.11.1
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\program files\common files\skype\Skype4COM.dll
Notify: AtiExtEvent - Ati2evxx.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\owner\application data\mozilla\firefox\profiles\hihxz9a0.default-1378943744140\
FF - plugin: c:\documents and settings\owner\application data\mozilla\plugins\npgoogletalk.dll
FF - plugin: c:\documents and settings\owner\application data\mozilla\plugins\npgtpo3dautoplugin.dll
FF - plugin: c:\documents and settings\owner\application data\mozilla\plugins\npo1d.dll
FF - plugin: c:\documents and settings\owner\local settings\application data\google\update\1.3.21.153\npGoogleUpdate3.dll
FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\divx\divx ovs helper\npovshelper.dll
FF - plugin: c:\program files\divx\divx plus web player\npdivx32.dll
FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\google\update\1.3.21.153\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre7\bin\plugin2\npjp2.dll
FF - plugin: c:\program files\microsoft silverlight\5.1.20513.0\npctrlui.dll
FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_8_800_168.dll
FF - plugin: c:\windows\system32\npDeployJava1.dll
FF - plugin: c:\windows\system32\npptools.dll
FF - ExtSQL: 2013-08-23 08:45; {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}; c:\program files\mozilla firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
FF - ExtSQL: 2013-09-18 22:13; {e5bbc237-c99b-4ced-a061-0be27703295f}; c:\documents and settings\owner\application data\mozilla\firefox\profiles\hihxz9a0.default-1378943744140\extensions\{e5bbc237-c99b-4ced-a061-0be27703295f}.xpi
.
============= SERVICES / DRIVERS ===============
.
R0 gfibto;gfibto;c:\windows\system32\drivers\gfibto.sys [2013-9-22 13560]
R1 avkmgr;avkmgr;c:\windows\system32\drivers\avkmgr.sys [2012-10-10 37352]
R2 AntiVirSchedulerService;Avira Scheduler;c:\program files\avira\antivir desktop\sched.exe [2012-10-10 84024]
R2 AntiVirService;Avira Real-Time Protection;c:\program files\avira\antivir desktop\avguard.exe [2012-10-10 108088]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2012-10-10 88840]
R2 FreeAgentGoNext Service;Seagate Service;c:\program files\seagate\seagatemanager\sync\FreeAgentService.exe [2009-12-18 189736]
R2 Garmin Core Update Service;Garmin Core Update Service;c:\program files\garmin\core update service\Garmin.Cartography.MapUpdate.CoreService.exe [2013-3-27 185688]
R2 IntuitUpdateServiceV4;Intuit Update Service v4;c:\program files\common files\intuit\update service v4\IntuitUpdateService.exe [2012-8-23 13672]
R2 Skype C2C Service;Skype C2C Service;c:\documents and settings\all users\application data\skype\toolbars\skype c2c service\c2c_service.exe [2013-8-14 3291008]
R2 sxuptp;SXUPTP Driver;c:\windows\system32\drivers\sxuptp.sys [2013-5-12 248960]
S1 SASDIFSV;SASDIFSV;\??\l:\\sasdifsv.sys --> l:\\SASDIFSV.SYS [?]
S1 SASKUTIL;SASKUTIL;\??\l:\\saskutil.sys --> l:\\SASKUTIL.SYS [?]
S2 !SASCORE;SAS Core Service;"l:\sascore.exe" --> l:\SASCORE.EXE [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 SkypeUpdate;Skype Updater;c:\program files\skype\updater\Updater.exe [2013-6-3 162408]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2013-4-18 754856]
.
=============== Created Last 30 ================
.
2013-09-24 01:42:36    --------    d-sha-r-    C:\cmdcons
2013-09-24 00:30:58    --------    d-----w-    c:\documents and settings\all users\application data\Malwarebytes' Anti-Malware (portable)
2013-09-22 19:00:54    --------    d-----w-    c:\documents and settings\owner\application data\LavasoftStatistics
2013-09-22 19:00:54    --------    d-----w-    c:\documents and settings\all users\application data\Ad-Aware Antivirus
2013-09-22 18:59:52    --------    d-----w-    c:\program files\Ad-Aware Antivirus
2013-09-22 18:59:28    --------    d-----w-    c:\documents and settings\all users\application data\Downloaded Installations
2013-09-22 18:59:20    --------    d-----w-    c:\program files\Lavasoft
2013-09-22 18:59:18    --------    d-----w-    c:\program files\Toolbar Cleaner
2013-09-22 18:57:32    44424    ----a-w-    c:\windows\system32\sbbd.exe
2013-09-22 18:57:32    13560    ----a-w-    c:\windows\system32\drivers\gfibto.sys
2013-09-22 18:57:30    --------    d-----w-    c:\documents and settings\owner\application data\Ad-Aware Antivirus
2013-09-19 05:10:59    827392    ----a-w-    c:\program files\mozilla firefox\updated\plugins\webex\12_1324\mcsnew.dll
2013-09-12 01:45:07    --------    d-----w-    c:\documents and settings\owner\application data\SUPERAntiSpyware.com
2013-09-12 01:44:54    --------    d-----w-    c:\documents and settings\all users\application data\SUPERAntiSpyware.com
2013-09-12 00:09:34    --------    d-----w-    c:\documents and settings\owner\application data\Malwarebytes
2013-09-12 00:09:16    --------    d-----w-    c:\documents and settings\all users\application data\Malwarebytes
2013-09-12 00:09:15    22856    ----a-w-    c:\windows\system32\drivers\mbam.sys
2013-09-12 00:09:15    --------    d-----w-    c:\program files\Malwarebytes' Anti-Malware
2013-09-10 21:47:38    386560    -c----w-    c:\windows\system32\dllcache\themeui.dll
2013-09-08 04:34:05    --------    d-----w-    c:\program files\privoxy
2013-09-08 04:33:59    --------    d-----w-    c:\program files\Web Protect
2013-09-03 13:53:52    187248    ----a-w-    c:\program files\mozilla firefox\plugins\nppdf32.dll
2013-09-03 13:53:52    187248    ----a-w-    c:\program files\internet explorer\plugins\nppdf32.dll
.
==================== Find3M  ====================
.
2013-09-10 19:01:17    71048    ----a-w-    c:\windows\system32\FlashPlayerCPLApp.cpl
2013-09-10 19:01:17    692616    ----a-w-    c:\windows\system32\FlashPlayerApp.exe
2013-09-05 16:00:23    88840    ----a-w-    c:\windows\system32\drivers\avgntflt.sys
2013-08-09 01:56:45    386560    ----a-w-    c:\windows\system32\themeui.dll
2013-08-08 06:05:59    920064    ----a-w-    c:\windows\system32\wininet.dll
2013-08-08 06:05:59    43520    ----a-w-    c:\windows\system32\licmgr10.dll
2013-08-08 06:05:59    1469440    ------w-    c:\windows\system32\inetcpl.cpl
2013-08-08 06:05:58    18944    ----a-w-    c:\windows\system32\corpol.dll
2013-08-08 01:27:48    1877760    ----a-w-    c:\windows\system32\win32k.sys
2013-08-08 00:02:34    385024    ----a-w-    c:\windows\system32\html.iec
2013-08-05 13:30:32    1289728    ----a-w-    c:\windows\system32\ole32.dll
2013-08-03 21:18:38    1543680    ------w-    c:\windows\system32\wmvdecod.dll
2013-07-10 10:37:53    406016    ----a-w-    c:\windows\system32\usp10.dll
2013-07-04 02:59:11    2193536    ----a-w-    c:\windows\system32\ntoskrnl.exe
2013-07-04 02:08:30    2070144    ----a-w-    c:\windows\system32\ntkrnlpa.exe
2013-06-27 15:52:24    94632    ----a-w-    c:\windows\system32\WindowsAccessBridge.dll
2013-06-27 15:52:22    867240    ----a-w-    c:\windows\system32\npDeployJava1.dll
2013-06-27 15:52:22    789416    ----a-w-    c:\windows\system32\deployJava1.dll
2013-06-27 15:52:22    144896    ----a-w-    c:\windows\system32\javacpl.cpl
.
============= FINISH: 16:34:09.01 ===============
 

Attach:

 

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2012-11-20.01)
.
Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume1
Install Date: 5/22/2011 11:54:06 AM
System Uptime: 9/24/2013 4:28:54 PM (0 hours ago)
.
Motherboard:   |  | MS-7093
Processor: AMD Athlon 64 Processor 3200+ | Socket 939 | 1989/199mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 145 GiB total, 55.19 GiB free.
D: is FIXED (FAT32) - 4 GiB total, 1.683 GiB free.
E: is CDROM ()
F: is CDROM ()
G: is CDROM ()
H: is Removable
I: is Removable
J: is Removable
K: is Removable
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP1: 9/23/2013 10:46:34 PM - System Checkpoint
RP2: 9/23/2013 10:47:09 PM - fixed? proxy prob
RP3: 9/24/2013 10:24:28 AM - Installed Microsoft Fix it 50566
.
==== Installed Programs ======================
.
AC3Filter (remove only)
Adobe AIR
Adobe Flash Player 11 ActiveX
Adobe Flash Player 11 Plugin
Adobe Reader X (10.1.8)
Apple Application Support
Apple Software Update
ATI - Software Uninstall Utility
ATI Control Panel
ATI Display Driver
Audacity 2.0.2
Avira Free Antivirus
BUFFALO AirStation Configuration Tool
BUFFALO Client Manager 3
BUFFALO Network-USB Navigator
CCleaner
CDisplay 1.8
Cisco WebEx Meetings
CleanUp!
CloneDVD
Compatibility Pack for the 2007 Office system
Digital Media Reader
DivX Setup
EarthLink Common Authentication
EarthLink MailBox
EarthLink Toolbar
Elevated Installer
foobar2000 v1.2.9
Garmin Express
Garmin Express Tray
Garmin Update Service
Google Chrome
Google Drive
Google Earth
Google Talk Plugin
Google Toolbar for Internet Explorer
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB2443685)
Hotfix for Windows XP (KB2570791)
Hotfix for Windows XP (KB2633952)
Hotfix for Windows XP (KB2756822)
Hotfix for Windows XP (KB2779562)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB981793)
Java 7 Update 25
Java Auto Updater
Java 6 Update 27
LAME v3.99.3 (for Windows)
Learn2 Player (Uninstall Only)
Logitech Vid HD
Logitech Webcam Software
Logitech Webcam Software Driver Package
Malwarebytes Anti-Malware version 1.75.0.1300
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB2698023)
Microsoft .NET Framework 1.1 Security Update (KB2833941)
Microsoft .NET Framework 1.1 Security Update (KB979906)
Microsoft .NET Framework 4 Client Profile
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Office Excel Viewer
Microsoft Office Word Viewer 2003
Microsoft Office XP Professional with FrontPage
Microsoft PowerPoint Viewer
Microsoft Silverlight
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
Microsoft XML Parser
Mozilla Firefox 23.0.1 (x86 en-US)
Mozilla Maintenance Service
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
Multimedia Keyboard Driver
MyPaint 1.0.0
Nero BurnRights
Nero OEM
NexDef Plug-in
PhotoScape
PowerDVD
QuickTime
RealPlayer Basic
Realtek AC'97 Audio
Redistributed Files
Security Update for CAPICOM (KB931906)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2789642)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2804576)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2832407)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2835393)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2840628)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2840628v2)
Security Update for Microsoft Windows (KB2564958)
Security Update for Windows Internet Explorer 8 (KB2497640)
Security Update for Windows Internet Explorer 8 (KB2510531)
Security Update for Windows Internet Explorer 8 (KB2530548)
Security Update for Windows Internet Explorer 8 (KB2544521)
Security Update for Windows Internet Explorer 8 (KB2559049)
Security Update for Windows Internet Explorer 8 (KB2586448)
Security Update for Windows Internet Explorer 8 (KB2618444)
Security Update for Windows Internet Explorer 8 (KB2647516)
Security Update for Windows Internet Explorer 8 (KB2675157)
Security Update for Windows Internet Explorer 8 (KB2699988)
Security Update for Windows Internet Explorer 8 (KB2722913)
Security Update for Windows Internet Explorer 8 (KB2744842)
Security Update for Windows Internet Explorer 8 (KB2761465)
Security Update for Windows Internet Explorer 8 (KB2792100)
Security Update for Windows Internet Explorer 8 (KB2797052)
Security Update for Windows Internet Explorer 8 (KB2799329)
Security Update for Windows Internet Explorer 8 (KB2809289)
Security Update for Windows Internet Explorer 8 (KB2817183)
Security Update for Windows Internet Explorer 8 (KB2829530)
Security Update for Windows Internet Explorer 8 (KB2838727)
Security Update for Windows Internet Explorer 8 (KB2846071)
Security Update for Windows Internet Explorer 8 (KB2847204)
Security Update for Windows Internet Explorer 8 (KB2862772)
Security Update for Windows Internet Explorer 8 (KB2870699)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB981332)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows Media Player (KB2378111)
Security Update for Windows Media Player (KB2834904-v2)
Security Update for Windows Media Player (KB2834904)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB975558)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB2079403)
Security Update for Windows XP (KB2115168)
Security Update for Windows XP (KB2121546)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB2296011)
Security Update for Windows XP (KB2347290)
Security Update for Windows XP (KB2360937)
Security Update for Windows XP (KB2387149)
Security Update for Windows XP (KB2393802)
Security Update for Windows XP (KB2412687)
Security Update for Windows XP (KB2419632)
Security Update for Windows XP (KB2423089)
Security Update for Windows XP (KB2440591)
Security Update for Windows XP (KB2443105)
Security Update for Windows XP (KB2476490)
Security Update for Windows XP (KB2476687)
Security Update for Windows XP (KB2478960)
Security Update for Windows XP (KB2478971)
Security Update for Windows XP (KB2479943)
Security Update for Windows XP (KB2481109)
Security Update for Windows XP (KB2483185)
Security Update for Windows XP (KB2485663)
Security Update for Windows XP (KB2503658)
Security Update for Windows XP (KB2503665)
Security Update for Windows XP (KB2506212)
Security Update for Windows XP (KB2506223)
Security Update for Windows XP (KB2507618)
Security Update for Windows XP (KB2507938)
Security Update for Windows XP (KB2508272)
Security Update for Windows XP (KB2508429)
Security Update for Windows XP (KB2509553)
Security Update for Windows XP (KB2511455)
Security Update for Windows XP (KB2524375)
Security Update for Windows XP (KB2535512)
Security Update for Windows XP (KB2536276-v2)
Security Update for Windows XP (KB2536276)
Security Update for Windows XP (KB2544893-v2)
Security Update for Windows XP (KB2544893)
Security Update for Windows XP (KB2555917)
Security Update for Windows XP (KB2562937)
Security Update for Windows XP (KB2566454)
Security Update for Windows XP (KB2567053)
Security Update for Windows XP (KB2567680)
Security Update for Windows XP (KB2570222)
Security Update for Windows XP (KB2570947)
Security Update for Windows XP (KB2584146)
Security Update for Windows XP (KB2585542)
Security Update for Windows XP (KB2592799)
Security Update for Windows XP (KB2598479)
Security Update for Windows XP (KB2603381)
Security Update for Windows XP (KB2618451)
Security Update for Windows XP (KB2619339)
Security Update for Windows XP (KB2620712)
Security Update for Windows XP (KB2621440)
Security Update for Windows XP (KB2624667)
Security Update for Windows XP (KB2631813)
Security Update for Windows XP (KB2633171)
Security Update for Windows XP (KB2639417)
Security Update for Windows XP (KB2641653)
Security Update for Windows XP (KB2646524)
Security Update for Windows XP (KB2647518)
Security Update for Windows XP (KB2653956)
Security Update for Windows XP (KB2655992)
Security Update for Windows XP (KB2659262)
Security Update for Windows XP (KB2660465)
Security Update for Windows XP (KB2661637)
Security Update for Windows XP (KB2676562)
Security Update for Windows XP (KB2685939)
Security Update for Windows XP (KB2686509)
Security Update for Windows XP (KB2691442)
Security Update for Windows XP (KB2695962)
Security Update for Windows XP (KB2698365)
Security Update for Windows XP (KB2705219)
Security Update for Windows XP (KB2707511)
Security Update for Windows XP (KB2709162)
Security Update for Windows XP (KB2712808)
Security Update for Windows XP (KB2718523)
Security Update for Windows XP (KB2719985)
Security Update for Windows XP (KB2723135)
Security Update for Windows XP (KB2724197)
Security Update for Windows XP (KB2727528)
Security Update for Windows XP (KB2731847)
Security Update for Windows XP (KB2753842-v2)
Security Update for Windows XP (KB2753842)
Security Update for Windows XP (KB2757638)
Security Update for Windows XP (KB2758857)
Security Update for Windows XP (KB2761226)
Security Update for Windows XP (KB2770660)
Security Update for Windows XP (KB2778344)
Security Update for Windows XP (KB2779030)
Security Update for Windows XP (KB2780091)
Security Update for Windows XP (KB2799494)
Security Update for Windows XP (KB2802968)
Security Update for Windows XP (KB2807986)
Security Update for Windows XP (KB2808735)
Security Update for Windows XP (KB2813170)
Security Update for Windows XP (KB2813345)
Security Update for Windows XP (KB2820197)
Security Update for Windows XP (KB2820917)
Security Update for Windows XP (KB2829361)
Security Update for Windows XP (KB2834886)
Security Update for Windows XP (KB2839229)
Security Update for Windows XP (KB2845187)
Security Update for Windows XP (KB2849470)
Security Update for Windows XP (KB2850851)
Security Update for Windows XP (KB2850869)
Security Update for Windows XP (KB2859537)
Security Update for Windows XP (KB2864063)
Security Update for Windows XP (KB2876217)
Security Update for Windows XP (KB2876315)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB979687)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB980436)
Security Update for Windows XP (KB981322)
Security Update for Windows XP (KB981997)
Security Update for Windows XP (KB982132)
Security Update for Windows XP (KB982381)
Security Update for Windows XP (KB982665)
Skype Click to Call
Skype™ 6.5
SoftV92 Data Fax Modem with SmartCP
Spybot - Search & Destroy
TurboTax 2012
TurboTax 2012 wcaiper
TurboTax 2012 WinPerFedFormset
TurboTax 2012 WinPerReleaseEngine
TurboTax 2012 WinPerTaxSupport
TurboTax 2012 wrapper
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows XP (KB2345886)
Update for Windows XP (KB2541763)
Update for Windows XP (KB2607712)
Update for Windows XP (KB2616676)
Update for Windows XP (KB2641690)
Update for Windows XP (KB2661254-v2)
Update for Windows XP (KB2718704)
Update for Windows XP (KB2736233)
Update for Windows XP (KB2749655)
Update for Windows XP (KB2863058)
Update for Windows XP (KB951978)
Update for Windows XP (KB953356)
Update for Windows XP (KB955759)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971029)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
VC80CRTRedist - 8.0.50727.6195
VLC media player 2.0.3
Web Protect for Windows
WebFldrs XP
Windows Backup Utility
Windows Internet Explorer 8
Windows Media Format 11 runtime
Windows Media Player 11
Windows XP Service Pack 3
WinRAR 4.01 (32-bit)
Xvid Video Codec
.
==== Event Viewer Messages From Past Week ========
.
9/23/2013 8:39:45 PM, error: DCOM [10005]  - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
9/23/2013 8:38:45 PM, error: DCOM [10005]  - DCOM got error "%1084" attempting to start the service netman with arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
9/23/2013 8:38:39 PM, error: DCOM [10005]  - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
9/23/2013 8:34:36 PM, error: Service Control Manager [7026]  - The following boot-start or system-start driver(s) failed to load:  AFD avipbb avkmgr BUFADPT Fips IPSec MRxSmb NetBIOS NetBT Processor RasAcd Rdbss SASDIFSV SASKUTIL ssmdrv Tcpip WS2IFSL
9/23/2013 8:34:36 PM, error: Service Control Manager [7001]  - The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error:  A device attached to the system is not functioning.
9/23/2013 8:34:36 PM, error: Service Control Manager [7001]  - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error:  A device attached to the system is not functioning.
9/23/2013 8:34:36 PM, error: Service Control Manager [7001]  - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error:  A device attached to the system is not functioning.
9/23/2013 8:34:36 PM, error: Service Control Manager [7001]  - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error:  A device attached to the system is not functioning.
9/23/2013 8:34:36 PM, error: Service Control Manager [7001]  - The Bwsvc service depends on the BUFADPT service which failed to start because of the following error:  A device attached to the system is not functioning.
9/23/2013 8:12:05 PM, error: Service Control Manager [7023]  - The System Restore Service service terminated with the following error:  The system cannot find the file specified.
9/23/2013 8:12:01 PM, error: SRService [104]  - The System Restore initialization process failed.
9/22/2013 9:49:45 AM, error: Service Control Manager [7034]  - The Seagate Service service terminated unexpectedly.  It has done this 1 time(s).
9/22/2013 9:44:47 AM, error: Service Control Manager [7009]  - Timeout (30000 milliseconds) waiting for the BITS service to connect.
9/22/2013 9:44:47 AM, error: Service Control Manager [7000]  - The BITS service failed to start due to the following error:  The service did not respond to the start or control request in a timely fashion.
9/22/2013 9:44:47 AM, error: DCOM [10005]  - DCOM got error "%1053" attempting to start the service BITS with arguments "" in order to run the server: {4991D34B-80A1-4291-83B6-3328366B9097}
9/22/2013 9:44:14 AM, error: Service Control Manager [7026]  - The following boot-start or system-start driver(s) failed to load:  SASDIFSV SASKUTIL
9/22/2013 9:43:20 AM, error: Service Control Manager [7000]  - The SAS Core Service service failed to start due to the following error:  The system cannot find the path specified.
9/22/2013 10:16:44 AM, error: Service Control Manager [7034]  - The Process Monitor service terminated unexpectedly.  It has done this 1 time(s).
9/22/2013 10:16:43 AM, error: Service Control Manager [7034]  - The Skype C2C Service service terminated unexpectedly.  It has done this 1 time(s).
.
==== End Of File ===========================
 

[AdvancedSetup]

It looks like probably most of its been cleaned up but has a few minor things left over. 
 
I would recommend uninstalling ALL versions of Java and rebooting the computer.
 
Then run the following.
 
Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

• Double-click to run it. When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
• The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

[hdk]

FRST:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 24-09-2013
Ran by Owner (administrator) on YOUR-694230950D on 24-09-2013 21:21:36
Running from C:\Documents and Settings\Owner\Desktop
Microsoft Windows XP Home Edition Service Pack 3 (X86) OS Language: English(US)
Internet Explorer Version 8
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(ATI Technologies Inc.) C:\WINDOWS\system32\Ati2evxx.exe
(BUFFALO INC.) C:\Program Files\BUFFALO\Client Manager3\bwsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(ATI Technologies Inc.) C:\WINDOWS\system32\Ati2evxx.exe
(Realtek Semiconductor Corp.) C:\WINDOWS\SOUNDMAN.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Seagate Technology LLC) C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe
(Garmin Ltd or its subsidiaries) C:\Program Files\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Intuit Inc.) C:\Program Files\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe
(Logitech Inc.) C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
(New Boundary Technologies, Inc.) C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
(Skype Technologies S.A.) C:\Documents and Settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe
(Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
(Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
(BUFFALO INC.) C:\Program Files\BUFFALO\Client Manager3\cm3_tray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\WINDOWS\system32\dwwin.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Recguard] - C:\WINDOWS\SMINST\RECGUARD.EXE [212992 2002-09-13] ()
HKLM\...\Run: [soundMan] - C:\Windows\SOUNDMAN.EXE [77824 2004-11-15] (Realtek Semiconductor Corp.)
HKLM\...\Run: [NeroFilterCheck] - C:\WINDOWS\system32\NeroCheck.exe [155648 2001-07-09] (Ahead Software Gmbh)
HKLM\...\Run: [ATIPTA] - C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe [344064 2004-11-11] (ATI Technologies, Inc.)
HKLM\...\Run: [QuickTime Task] - C:\Program Files\QuickTime\QTTask.exe [421888 2012-04-18] (Apple Inc.)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [ElbyCheckAnyDVD] - C:\Program Files\SlySoft\AnyDVD\ElbyCheck.exe [45056 2003-09-20] (Elaborate Bytes AG)
HKLM\...\Run: [APSDaemon] - C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59240 2012-02-20] (Apple Inc.)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [347192 2013-08-29] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [showWnd] - C:\Windows\ShowWnd.exe [36864 2003-09-19] ()
Winlogon\Notify\AtiExtEvent: C:\Windows\system32\Ati2evxx.dll (ATI Technologies Inc.)
HKCU\...\Run: [spybotSD TeaTimer] - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2260480 2009-03-05] (Safer-Networking Ltd.)
Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ClientManager3.lnk
ShortcutTarget: ClientManager3.lnk -> C:\Program Files\BUFFALO\Client Manager3\cm3_tray.exe (BUFFALO INC.)
Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
ShortcutTarget: Microsoft Office.lnk -> C:\Program Files\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation)
Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\run_startmenu.cmd ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {65A95FBF-F5AC-44fa-8112-5C493C4DE412} URL = http://eimg.net/sw/toolbar/4/2/rd601.html?area=earthlink-ws-altsearchbox&channel=elnkdsearch&q={searchTerms}
SearchScopes: HKCU - {65A95FBF-F5AC-44fa-8112-5C493C4DE412} URL = http://eimg.net/sw/toolbar/4/2/rd601.html?area=earthlink-ws-altsearchbox&channel=elnkdsearch&q={searchTerms}
SearchScopes: HKCU - {BE42A5C1-646D-4C24-B72B-DF7E033F1509} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3298566&CUI=UN89475019113436272&UM=2
BHO: No Name - {2CEBF6C7-2B40-469B-B5D5-CD3F3676C3C4} -  No File
BHO: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
BHO: ElnkPubBHO Class - {512ACF1B-64D9-4928-B382-A80556F28DB4} - C:\Program Files\EarthLink\Toolbar\ElnkPuB.dll (EarthLink, Inc.)
BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll (Safer Networking Limited)
BHO: ElnkProtectionBHO Class - {9579D574-D4D8-4335-9560-FE8641A013BD} - C:\Program Files\EarthLink\Toolbar\ProtctIE.dll (EarthLink, Inc.)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll (Google Inc.)
BHO: No Name - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -  No File
BHO: ElnkLegacyUninstBHO Class - {E713904C-DF05-4C79-BBAD-02DB923253BE} - C:\Program Files\EarthLink\Toolbar\uninsttb.dll (EarthLink, Inc.)
Toolbar: HKLM - &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll (Google Inc.)
Toolbar: HKLM - EarthLink Toolbar - {C7768536-96F8-4001-B1A2-90EE21279187} - C:\Program Files\EarthLink\Toolbar\Toolbar.dll (EarthLink, Inc.)
Toolbar: HKCU -&Google - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll (Google Inc.)
Toolbar: HKCU -EarthLink Toolbar - {C7768536-96F8-4001-B1A2-90EE21279187} - C:\Program Files\EarthLink\Toolbar\Toolbar.dll (EarthLink, Inc.)
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-1_7_0_25-windows-i586.cab
DPF: {CAFEEFAC-0017-0000-0025-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_25-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_25-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Hosts: 127.0.0.1    localhost
Tcpip\Parameters: [DhcpNameServer] 192.168.11.1

FireFox:
========
FF ProfilePath: C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\hihxz9a0.default-1378943744140
FF Plugin: @adobe.com/FlashPlayer - C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin: @divx.com/DivX Plus Web Player Plug-In,version=1.0.0 - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.0.3 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @talk.google.com/GoogleTalkPlugin - C:\Documents and Settings\Owner\Application Data\Mozilla\plugins\npgoogletalk.dll (Google)
FF Plugin HKCU: @talk.google.com/O1DPlugin - C:\Documents and Settings\Owner\Application Data\Mozilla\plugins\npo1d.dll (Google)
FF Plugin HKCU: @talk.google.com/O3DPlugin - C:\Documents and Settings\Owner\Application Data\Mozilla\plugins\npgtpo3dautoplugin.dll ()
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Extension: No Name - C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\hihxz9a0.default-1378943744140\Extensions\{e5bbc237-c99b-4ced-a061-0be27703295f}.xpi
FF Extension: Skype Click to Call - C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
FF Extension: Skype Click to Call - C:\Program Files\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
FF HKLM\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF Extension: DivX Plus Web Player HTML5 <video> - C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5

========================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [84024 2013-08-29] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [108088 2013-08-29] (Avira Operations GmbH & Co. KG)
R2 Bwsvc; C:\Program Files\BUFFALO\Client Manager3\bwsvc.exe [238592 2009-06-09] (BUFFALO INC.)
S2 FreeAgentGoNext Service; C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe [189736 2009-12-18] (Seagate Technology LLC)
R2 Garmin Core Update Service; C:\Program Files\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [185688 2013-03-27] (Garmin Ltd or its subsidiaries)
R2 PrismXL; C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS [172032 2011-05-22] (New Boundary Technologies, Inc.)
R2 Skype C2C Service; C:\Documents and Settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe [3291008 2013-08-14] (Skype Technologies S.A.)
S2 !SASCORE; "L:\SASCORE.EXE" [x]

==================== Drivers (Whitelisted) ====================

R3 ALCXWDM; C:\Windows\System32\drivers\ALCXWDM.SYS [2297664 2004-11-17] (Realtek Semiconductor Corp.)
R3 AnyDVD; C:\Windows\System32\Drivers\AnyDVD.sys [22912 2003-09-29] (SlySoft, Inc.)
R2 ASCTRM; C:\Windows\System32\Drivers\ASCTRM.sys [8552 2011-05-22] (Windows ® 2000 DDK provider)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [88840 2013-09-05] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136672 2013-08-29] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-03-27] (Avira Operations GmbH & Co. KG)
R1 BUFADPT; C:\WINDOWS\system32\BUFADPT.SYS [11136 2008-12-15] (BUFFALO INC.)
R2 ElbyCDIO; C:\Windows\System32\Drivers\ElbyCDIO.sys [31088 2010-12-16] (Elaborate Bytes AG)
S3 FilterService; C:\Windows\System32\DRIVERS\lvuvcflt.sys [23832 2009-10-07] (Logitech Inc.)
R0 gfibto; C:\Windows\System32\drivers\gfibto.sys [13560 2013-09-22] (GFI Software)
R3 LVPr2Mon; C:\Windows\System32\DRIVERS\LVPr2Mon.sys [25752 2009-10-07] ()
S3 mxnic; C:\Windows\System32\DRIVERS\mxnic.sys [19968 2001-08-17] (Macronix International Co., Ltd.                                               )
S3 NdisIP; C:\Windows\System32\DRIVERS\NdisIP.sys [10880 2008-04-13] (Microsoft Corporation)
S1 P3; C:\Windows\System32\DRIVERS\p3.sys [42752 2008-04-13] (Microsoft Corporation)
R3 rtl8139; C:\Windows\System32\DRIVERS\RTL8139.SYS [20992 2004-08-03] (Realtek Semiconductor Corporation)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH)
R3 SunkFilt; C:\WINDOWS\System32\Drivers\sunkfilt.sys [36804 2004-11-15] (Alcor Micro Corp.)
R2 sxuptp; C:\Windows\System32\DRIVERS\sxuptp.sys [248960 2011-07-11] (silex technology, Inc.)
U4 intelppm;
S1 SASDIFSV; \??\L:\\SASDIFSV.SYS [x]
S1 SASKUTIL; \??\L:\\SASKUTIL.SYS [x]
U5 ScsiPort; C:\Windows\system32\drivers\scsiport.sys [96384 2008-04-13] (Microsoft Corporation)
U3 TlntSvr;
S3 wanatw; system32\DRIVERS\wanatw4.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-09-24 21:21 - 2013-09-24 21:21 - 00000000 ____D C:\FRST
2013-09-24 21:10 - 2013-09-24 21:10 - 01088653 _____ (Farbar) C:\Documents and Settings\Owner\Desktop\FRST.exe
2013-09-24 16:34 - 2013-09-24 16:34 - 00019654 _____ C:\Documents and Settings\Owner\Desktop\attach.txt
2013-09-24 16:34 - 2013-09-24 16:34 - 00014395 _____ C:\Documents and Settings\Owner\Desktop\dds.txt
2013-09-24 16:18 - 2013-09-24 16:21 - 00020105 _____ C:\Documents and Settings\Owner\Desktop\Result.txt
2013-09-24 16:17 - 2013-09-24 16:17 - 00688992 ____R (Swearware) C:\Documents and Settings\Owner\Desktop\dds.scr
2013-09-24 16:16 - 2013-09-24 16:16 - 00760937 _____ (Farbar) C:\Documents and Settings\Owner\Desktop\MiniToolBox.exe
2013-09-23 22:36 - 2013-09-23 21:17 - 00000741 ____R C:\WINDOWS\system32\Drivers\etc\hosts.20130923-223631.backup
2013-09-23 20:40 - 2013-09-23 20:40 - 00000000 __SHD C:\Documents and Settings\Administrator\PrivacIE
2013-09-23 20:37 - 2013-09-23 20:42 - 00000178 ___SH C:\Documents and Settings\Administrator\ntuser.ini
2013-09-23 20:37 - 2013-09-23 20:40 - 00000000 ____D C:\Documents and Settings\Administrator
2013-09-23 20:37 - 2013-08-09 14:02 - 00000000 ____D C:\Documents and Settings\Administrator\Local Settings\Application Data\Google
2013-09-23 20:37 - 2012-01-25 00:12 - 00000000 __SHD C:\Documents and Settings\Administrator\IETldCache
2013-09-23 20:37 - 2011-05-26 11:06 - 00000000 ____D C:\Documents and Settings\Administrator\Application Data\Macromedia
2013-09-23 20:37 - 2011-05-22 11:24 - 00000000 ____D C:\Documents and Settings\Administrator\Application Data\McAfee
2013-09-23 20:37 - 2011-05-22 11:21 - 00000000 ____D C:\Documents and Settings\Administrator\Application Data\SampleView
2013-09-23 20:37 - 2011-05-22 10:53 - 00000000 ___RD C:\Documents and Settings\Administrator\Start Menu\Programs\Accessories
2013-09-23 20:37 - 2004-08-26 11:09 - 00000767 _____ C:\Documents and Settings\Administrator\Start Menu\Programs\Internet Explorer.lnk
2013-09-23 20:37 - 2004-08-26 11:09 - 00000738 _____ C:\Documents and Settings\Administrator\Start Menu\Programs\Outlook Express.lnk
2013-09-23 20:37 - 2004-08-26 11:04 - 00001599 _____ C:\Documents and Settings\Administrator\Start Menu\Programs\Remote Assistance.lnk
2013-09-23 19:40 - 2013-09-23 19:40 - 98840431 _____ C:\WINDOWS\system32\琧噔6
2013-09-23 18:42 - 2013-09-23 18:42 - 00000000 _RSHD C:\cmdcons
2013-09-23 18:42 - 2013-09-22 10:20 - 00000354 _____ C:\Boot.bak
2013-09-23 17:30 - 2013-09-23 21:59 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Malwarebytes' Anti-Malware (portable)
2013-09-22 12:01 - 2013-09-22 12:01 - 00000944 _____ C:\WINDOWS\Tasks\Ad-Aware Antivirus Scheduled Scan.job
2013-09-22 12:00 - 2013-09-22 12:00 - 00000000 ____D C:\Documents and Settings\Owner\Application Data\LavasoftStatistics
2013-09-22 12:00 - 2013-09-22 12:00 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Ad-Aware Antivirus
2013-09-22 11:59 - 2013-09-23 20:28 - 00000000 ____D C:\Program Files\Ad-Aware Antivirus
2013-09-22 11:59 - 2013-09-22 11:59 - 00000000 ____D C:\Program Files\Toolbar Cleaner
2013-09-22 11:59 - 2013-09-22 11:59 - 00000000 ____D C:\Program Files\Lavasoft
2013-09-22 11:59 - 2013-09-22 11:59 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Lavasoft
2013-09-22 11:59 - 2013-09-22 11:59 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Downloaded Installations
2013-09-22 11:57 - 2013-09-22 12:28 - 00000000 ____D C:\Documents and Settings\Owner\Application Data\Ad-Aware Antivirus
2013-09-22 11:57 - 2013-09-22 11:57 - 00044424 _____ (GFI Software) C:\WINDOWS\system32\sbbd.exe
2013-09-22 11:57 - 2013-09-22 11:57 - 00013560 _____ (GFI Software) C:\WINDOWS\system32\Drivers\gfibto.sys
2013-09-22 10:43 - 2013-09-22 10:25 - 00000027 _____ C:\WINDOWS\system32\Drivers\etc\hosts.20130922-104338.backup
2013-09-20 09:46 - 2013-09-20 09:46 - 98487876 _____ C:\WINDOWS\system32\뗈噔6
2013-09-19 16:53 - 2013-09-19 16:54 - 00000000 ____D C:\Documents and Settings\Owner\Desktop\pauls
2013-09-18 11:53 - 2012-04-05 16:06 - 00441368 _____ C:\WINDOWS\system32\Drivers\etc\hosts.20130918-115353.backup
2013-09-18 11:43 - 2012-04-05 16:06 - 00441368 _____ C:\WINDOWS\system32\Drivers\etc\hosts.20130918-114353.backup
2013-09-18 10:39 - 2013-09-18 10:39 - 00000000 ____D C:\Documents and Settings\LocalService\Application Data\Mozilla
2013-09-11 19:31 - 2013-09-22 10:44 - 00000000 ____D C:\Documents and Settings\All Users\Start Menu\Programs\SUPERAntiSpyware
2013-09-11 18:45 - 2013-09-11 18:45 - 00000000 ____D C:\Documents and Settings\Owner\Application Data\SUPERAntiSpyware.com
2013-09-11 18:44 - 2013-09-11 18:44 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2013-09-11 17:09 - 2013-09-11 17:09 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-09-11 17:09 - 2013-09-11 17:09 - 00000000 ____D C:\Documents and Settings\Owner\Application Data\Malwarebytes
2013-09-11 17:09 - 2013-09-11 17:09 - 00000000 ____D C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
2013-09-11 17:09 - 2013-09-11 17:09 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Malwarebytes
2013-09-11 17:09 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2013-09-10 20:44 - 2012-04-05 16:06 - 00441368 _____ C:\WINDOWS\system32\Drivers\etc\hosts.20130910-204412.backup
2013-09-10 20:38 - 2013-09-10 20:38 - 97021647 _____ C:\WINDOWS\system32\獎뉪噔6
2013-09-10 19:39 - 2013-09-10 19:39 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2876315$
2013-09-10 19:39 - 2013-09-10 19:39 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2876217$
2013-09-10 19:38 - 2013-09-10 19:39 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2864063$
2013-09-10 14:47 - 2013-08-08 18:56 - 00386560 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\themeui.dll
2013-09-10 14:39 - 2013-09-10 14:39 - 97004533 _____ C:\WINDOWS\system32\熈꘳噔6
2013-09-07 21:34 - 2013-09-07 21:34 - 00000000 ____D C:\Program Files\privoxy
2013-09-07 21:33 - 2013-09-11 11:18 - 00000000 ____D C:\Program Files\Web Protect
2013-09-07 17:45 - 2013-09-07 17:45 - 00000779 _____ C:\Documents and Settings\Owner\Local Settings\Application Data\recently-used.xbel
2013-09-04 18:58 - 2012-04-05 16:06 - 00441368 _____ C:\WINDOWS\system32\Drivers\etc\hosts.20130904-185856.backup
2013-08-28 22:21 - 2013-08-28 22:21 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2834904-v2_WM11$
2013-08-28 10:12 - 2012-04-05 16:06 - 00441368 _____ C:\WINDOWS\system32\Drivers\etc\hosts.20130828-101253.backup

==================== One Month Modified Files and Folders =======

2013-09-24 21:21 - 2013-09-24 21:21 - 00000000 ____D C:\FRST
2013-09-24 21:18 - 2004-08-26 11:02 - 01974915 _____ C:\WINDOWS\WindowsUpdate.log
2013-09-24 21:16 - 2011-06-05 01:01 - 00000880 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2013-09-24 21:16 - 2004-08-26 11:08 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2013-09-24 21:16 - 2004-08-26 03:58 - 00000159 _____ C:\WINDOWS\wiadebug.log
2013-09-24 21:16 - 2004-08-26 03:58 - 00000049 _____ C:\WINDOWS\wiaservc.log
2013-09-24 21:14 - 2004-08-26 11:09 - 00000278 ___SH C:\Documents and Settings\Owner\ntuser.ini
2013-09-24 21:14 - 2004-08-26 11:09 - 00000000 ____D C:\Documents and Settings\Owner
2013-09-24 21:14 - 2004-08-26 11:08 - 00032584 _____ C:\WINDOWS\SchedLgU.Txt
2013-09-24 21:13 - 2013-07-18 17:28 - 00000000 ____D C:\Documents and Settings\Owner\Application Data\foobar2000
2013-09-24 21:13 - 2011-05-22 11:15 - 00000000 ____D C:\Program Files\Java
2013-09-24 21:10 - 2013-09-24 21:10 - 01088653 _____ (Farbar) C:\Documents and Settings\Owner\Desktop\FRST.exe
2013-09-24 21:02 - 2011-06-02 23:01 - 00000978 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-4043274209-3714135117-914160933-1003UA.job
2013-09-24 21:01 - 2012-07-15 09:39 - 00000830 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2013-09-24 21:01 - 2011-06-05 01:01 - 00000884 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2013-09-24 19:02 - 2011-06-02 23:01 - 00000926 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-4043274209-3714135117-914160933-1003Core.job
2013-09-24 16:34 - 2013-09-24 16:34 - 00019654 _____ C:\Documents and Settings\Owner\Desktop\attach.txt
2013-09-24 16:34 - 2013-09-24 16:34 - 00014395 _____ C:\Documents and Settings\Owner\Desktop\dds.txt
2013-09-24 16:21 - 2013-09-24 16:18 - 00020105 _____ C:\Documents and Settings\Owner\Desktop\Result.txt
2013-09-24 16:17 - 2013-09-24 16:17 - 00688992 ____R (Swearware) C:\Documents and Settings\Owner\Desktop\dds.scr
2013-09-24 16:16 - 2013-09-24 16:16 - 00760937 _____ (Farbar) C:\Documents and Settings\Owner\Desktop\MiniToolBox.exe
2013-09-24 14:33 - 2013-08-11 12:41 - 00000000 ____D C:\Documents and Settings\Owner\Desktop\submitted res
2013-09-24 14:33 - 2013-08-11 12:41 - 00000000 ____D C:\Documents and Settings\Owner\Desktop\master res
2013-09-24 12:59 - 2011-05-24 15:10 - 00000000 ____D C:\Documents and Settings\Owner\Desktop\arc h9-21-13
2013-09-24 11:14 - 2011-05-22 19:45 - 00000000 ____D C:\Documents and Settings\Owner\My Documents\docs
2013-09-24 10:34 - 2004-08-26 03:45 - 00000000 ____D C:\WINDOWS\Help
2013-09-23 22:46 - 2004-08-26 11:01 - 00000000 ____D C:\WINDOWS\system32\Restore
2013-09-23 22:24 - 2011-05-22 14:37 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2013-09-23 21:59 - 2013-09-23 17:30 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Malwarebytes' Anti-Malware (portable)
2013-09-23 21:17 - 2013-09-23 22:36 - 00000741 ____R C:\WINDOWS\system32\Drivers\etc\hosts.20130923-223631.backup
2013-09-23 20:42 - 2013-09-23 20:37 - 00000178 ___SH C:\Documents and Settings\Administrator\ntuser.ini
2013-09-23 20:40 - 2013-09-23 20:40 - 00000000 __SHD C:\Documents and Settings\Administrator\PrivacIE
2013-09-23 20:40 - 2013-09-23 20:37 - 00000000 ____D C:\Documents and Settings\Administrator
2013-09-23 20:28 - 2013-09-22 11:59 - 00000000 ____D C:\Program Files\Ad-Aware Antivirus
2013-09-23 19:52 - 2011-05-28 09:44 - 00042872 _____ C:\Documents and Settings\Owner\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2013-09-23 19:50 - 2011-05-22 14:32 - 00000000 ____D C:\Documents and Settings\Owner\Desktop\security
2013-09-23 19:46 - 2004-08-26 03:54 - 00192184 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2013-09-23 19:43 - 2011-07-07 11:39 - 00000000 ____D C:\WINDOWS\ERDNT
2013-09-23 19:40 - 2013-09-23 19:40 - 98840431 _____ C:\WINDOWS\system32\琧噔6
2013-09-23 18:52 - 2004-08-26 11:08 - 00000000 __SHD C:\Documents and Settings\NetworkService
2013-09-23 18:50 - 2004-08-26 09:12 - 00000227 _____ C:\WINDOWS\system.ini
2013-09-23 18:42 - 2013-09-23 18:42 - 00000000 _RSHD C:\cmdcons
2013-09-23 18:42 - 2004-08-26 09:12 - 00000354 __RSH C:\boot.ini
2013-09-23 10:37 - 2011-05-22 17:36 - 00002489 _____ C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Word.lnk
2013-09-23 10:16 - 2011-05-24 15:15 - 00000000 ____D C:\Documents and Settings\Owner\Desktop\pdf
2013-09-22 12:28 - 2013-09-22 11:57 - 00000000 ____D C:\Documents and Settings\Owner\Application Data\Ad-Aware Antivirus
2013-09-22 12:01 - 2013-09-22 12:01 - 00000944 _____ C:\WINDOWS\Tasks\Ad-Aware Antivirus Scheduled Scan.job
2013-09-22 12:00 - 2013-09-22 12:00 - 00000000 ____D C:\Documents and Settings\Owner\Application Data\LavasoftStatistics
2013-09-22 12:00 - 2013-09-22 12:00 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Ad-Aware Antivirus
2013-09-22 11:59 - 2013-09-22 11:59 - 00000000 ____D C:\Program Files\Toolbar Cleaner
2013-09-22 11:59 - 2013-09-22 11:59 - 00000000 ____D C:\Program Files\Lavasoft
2013-09-22 11:59 - 2013-09-22 11:59 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Lavasoft
2013-09-22 11:59 - 2013-09-22 11:59 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Downloaded Installations
2013-09-22 11:59 - 2004-08-26 03:54 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared
2013-09-22 11:57 - 2013-09-22 11:57 - 00044424 _____ (GFI Software) C:\WINDOWS\system32\sbbd.exe
2013-09-22 11:57 - 2013-09-22 11:57 - 00013560 _____ (GFI Software) C:\WINDOWS\system32\Drivers\gfibto.sys
2013-09-22 11:45 - 2011-05-22 15:04 - 00000000 ____D C:\WINDOWS\system32\NtmsData
2013-09-22 10:45 - 2004-08-26 11:01 - 00000000 ____D C:\WINDOWS\Registration
2013-09-22 10:44 - 2013-09-11 19:31 - 00000000 ____D C:\Documents and Settings\All Users\Start Menu\Programs\SUPERAntiSpyware
2013-09-22 10:29 - 2011-07-05 21:45 - 00000000 ____D C:\Program Files\CleanUp!
2013-09-22 10:25 - 2013-09-22 10:43 - 00000027 _____ C:\WINDOWS\system32\Drivers\etc\hosts.20130922-104338.backup
2013-09-22 10:20 - 2013-09-23 18:42 - 00000354 _____ C:\Boot.bak
2013-09-20 19:48 - 2012-02-14 13:10 - 00000000 ____D C:\Documents and Settings\Owner\Desktop\jobs
2013-09-20 09:46 - 2013-09-20 09:46 - 98487876 _____ C:\WINDOWS\system32\뗈噔6
2013-09-19 16:54 - 2013-09-19 16:53 - 00000000 ____D C:\Documents and Settings\Owner\Desktop\pauls
2013-09-18 22:11 - 2013-08-16 20:13 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-09-18 10:39 - 2013-09-18 10:39 - 00000000 ____D C:\Documents and Settings\LocalService\Application Data\Mozilla
2013-09-18 09:00 - 2004-08-26 09:12 - 00001170 _____ C:\WINDOWS\system32\wpa.dbl
2013-09-11 18:45 - 2013-09-11 18:45 - 00000000 ____D C:\Documents and Settings\Owner\Application Data\SUPERAntiSpyware.com
2013-09-11 18:44 - 2013-09-11 18:44 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2013-09-11 18:20 - 2011-05-22 16:12 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB930178$
2013-09-11 17:09 - 2013-09-11 17:09 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-09-11 17:09 - 2013-09-11 17:09 - 00000000 ____D C:\Documents and Settings\Owner\Application Data\Malwarebytes
2013-09-11 17:09 - 2013-09-11 17:09 - 00000000 ____D C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
2013-09-11 17:09 - 2013-09-11 17:09 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Malwarebytes
2013-09-11 11:18 - 2013-09-07 21:33 - 00000000 ____D C:\Program Files\Web Protect
2013-09-11 07:47 - 2011-06-16 13:35 - 00002347 _____ C:\Documents and Settings\All Users\Start Menu\Programs\Adobe Reader X.lnk
2013-09-11 07:47 - 2011-05-22 19:43 - 00000000 ____D C:\Program Files\Common Files\Adobe
2013-09-10 20:38 - 2013-09-10 20:38 - 97021647 _____ C:\WINDOWS\system32\獎뉪噔6
2013-09-10 19:40 - 2011-05-22 16:20 - 00000000 ____D C:\WINDOWS\ie8updates
2013-09-10 19:39 - 2013-09-10 19:39 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2876315$
2013-09-10 19:39 - 2013-09-10 19:39 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2876217$
2013-09-10 19:39 - 2013-09-10 19:38 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2864063$
2013-09-10 19:36 - 2013-08-06 21:16 - 00000000 ____D C:\WINDOWS\system32\MRT
2013-09-10 19:33 - 2011-05-22 16:17 - 76725432 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2013-09-10 14:39 - 2013-09-10 14:39 - 97004533 _____ C:\WINDOWS\system32\熈꘳噔6
2013-09-10 12:01 - 2012-03-31 09:50 - 00692616 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerApp.exe
2013-09-10 12:01 - 2011-05-23 10:24 - 00071048 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerCPLApp.cpl
2013-09-07 21:34 - 2013-09-07 21:34 - 00000000 ____D C:\Program Files\privoxy
2013-09-07 17:45 - 2013-09-07 17:45 - 00000779 _____ C:\Documents and Settings\Owner\Local Settings\Application Data\recently-used.xbel
2013-09-07 17:45 - 2013-07-13 12:56 - 00000000 ____D C:\Documents and Settings\Owner\Local Settings\Application Data\mypaint
2013-09-07 15:58 - 2011-05-22 20:58 - 00000049 _____ C:\WINDOWS\NeroDigital.ini
2013-09-06 08:10 - 2011-06-02 23:02 - 00002284 _____ C:\Documents and Settings\Owner\Desktop\Google Chrome.lnk
2013-09-05 09:00 - 2012-10-10 13:20 - 00088840 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avgntflt.sys
2013-09-04 18:33 - 2011-05-22 15:33 - 00000000 ____D C:\Program Files\CCleaner
2013-09-04 18:02 - 2011-06-05 19:43 - 00000000 ____D C:\Documents and Settings\Owner\Application Data\Mozilla
2013-08-29 06:42 - 2012-10-10 13:20 - 00136672 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avipbb.sys
2013-08-28 22:21 - 2013-08-28 22:21 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2834904-v2_WM11$
2013-08-27 22:22 - 2011-12-21 17:44 - 00000000 ____D C:\Documents and Settings\Owner\Application Data\Skype

Some content of TEMP:
====================
C:\Documents and Settings\Owner\Local Settings\temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== End Of Log ============================

 

Addition:

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 24-09-2013
Ran by Owner at 2013-09-24 21:22:23
Running from C:\Documents and Settings\Owner\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Disabled - Up to date) {AD166499-45F9-482A-A743-FDD3350758C7}

==================== Installed Programs ======================

AC3Filter (remove only)
Adobe AIR (Version: 2.6.0.19140)
Adobe Flash Player 11 ActiveX (Version: 11.8.800.168)
Adobe Flash Player 11 Plugin (Version: 11.8.800.168)
Adobe Reader X (10.1.8) (Version: 10.1.8)
Apple Application Support (Version: 2.1.7)
Apple Software Update (Version: 2.1.3.127)
ATI - Software Uninstall Utility (Version: 6.14.10.1010)
ATI Control Panel (Version: 6.14.10.5134)
ATI Display Driver (Version: 8.08-041111a-019690C)
Audacity 2.0.2 (Version: 2.0.2)
Avira Free Antivirus (Version: 13.0.0.4052)
BUFFALO AirStation Configuration Tool (Version: 2.0.13)
BUFFALO Client Manager 3
BUFFALO Network-USB Navigator (Version: 1.40)
CCleaner (Version: 4.05)
CDisplay 1.8
Cisco WebEx Meetings
CleanUp!
CloneDVD
Compatibility Pack for the 2007 Office system (Version: 12.0.6612.1000)
Digital Media Reader (Version: 1.10)
DivX Setup (Version: 2.6.1.44)
EarthLink Common Authentication (Version: 1.0.87.0)
EarthLink MailBox
EarthLink MailBox (Version: 2005.3.14.0)
EarthLink Toolbar
Elevated Installer (Version: 2.1.13)
foobar2000 v1.2.9 (Version: 1.2.9)
Garmin Express (Version: 2.1.13)
Garmin Express Tray (Version: 2.1.13)
Garmin Update Service (Version: 2.1.13)
Google Chrome (HKCU Version: 29.0.1547.66)
Google Drive (Version: 1.11.4865.2530)
Google Earth (Version: 7.1.1.1888)
Google Talk Plugin (Version: 4.5.3.14917)
Google Toolbar for Internet Explorer
LAME v3.99.3 (for Windows)
Learn2 Player (Uninstall Only)
Logitech Vid HD (Version: 7.2 (7248))
Logitech Webcam Software (Version: 12.10.1113)
Logitech Webcam Software Driver Package (Version: 12.10.1110)
Malwarebytes Anti-Malware version 1.75.0.1300 (Version: 1.75.0.1300)
Microsoft .NET Framework 1.1 (Version: 1.1.4322)
Microsoft .NET Framework 1.1 Security Update (KB2698023)
Microsoft .NET Framework 1.1 Security Update (KB2833941)
Microsoft .NET Framework 1.1 Security Update (KB979906)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft Compression Client Pack 1.0 for Windows XP (Version: 1)
Microsoft Office Excel Viewer (Version: 12.0.6612.1000)
Microsoft Office Word Viewer 2003 (Version: 11.0.8173.0)
Microsoft Office XP Professional with FrontPage (Version: 10.0.2627.01)
Microsoft PowerPoint Viewer (Version: 14.0.6029.1000)
Microsoft Silverlight (Version: 5.1.20513.0)
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft XML Parser (Version: 8.20.8730.4)
Mozilla Firefox 23.0.1 (x86 en-US) (Version: 23.0.1)
Mozilla Maintenance Service (Version: 23.0.1)
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)
Multimedia Keyboard Driver
MyPaint 1.0.0 (HKCU Version: 1.0.0)
Nero BurnRights
Nero OEM
NexDef Plug-in
PhotoScape
PowerDVD
QuickTime (Version: 7.72.80.56)
RealPlayer Basic
Realtek AC'97 Audio
Redistributed Files (Version: 2.0.46.0)
Skype Click to Call (Version: 6.11.13348)
Skype™ 6.5 (Version: 6.5.158)
SoftV92 Data Fax Modem with SmartCP
Spybot - Search & Destroy (Version: 1.6.2)
TurboTax 2012 (Version: 2012.0)
TurboTax 2012 wcaiper (Version: 012.000.1267)
TurboTax 2012 WinPerFedFormset (Version: 012.000.1881)
TurboTax 2012 WinPerReleaseEngine (Version: 012.000.0419)
TurboTax 2012 WinPerTaxSupport (Version: 012.000.0178)
TurboTax 2012 wrapper (Version: 012.000.0127)
Update for Windows Internet Explorer 8 (KB976662) (Version: 1)
Update for Windows XP (KB2345886) (Version: 1)
Update for Windows XP (KB2541763) (Version: 1)
Update for Windows XP (KB2607712) (Version: 1)
Update for Windows XP (KB2616676) (Version: 1)
Update for Windows XP (KB2641690) (Version: 1)
Update for Windows XP (KB2661254-v2) (Version: 2)
Update for Windows XP (KB2718704) (Version: 1)
Update for Windows XP (KB2736233) (Version: 1)
Update for Windows XP (KB2749655) (Version: 1)
Update for Windows XP (KB2863058) (Version: 1)
Update for Windows XP (KB951978) (Version: 1)
Update for Windows XP (KB953356) (Version: 1)
Update for Windows XP (KB955759) (Version: 1)
Update for Windows XP (KB967715) (Version: 1)
Update for Windows XP (KB968389) (Version: 1)
Update for Windows XP (KB971029) (Version: 1)
Update for Windows XP (KB971737) (Version: 1)
Update for Windows XP (KB973687) (Version: 1)
Update for Windows XP (KB973815) (Version: 1)
VC80CRTRedist - 8.0.50727.6195 (Version: 1.2.0)
VLC media player 2.0.3 (Version: 2.0.3)
Web Protect for Windows (Version: 3.28.33)
WebFldrs XP (Version: 9.50.7523)
Windows Backup Utility (Version: 5.1)
Windows Internet Explorer 8 (Version: 20090308.140743)
Windows Media Format 11 runtime
Windows Media Player 11
Windows XP Service Pack 3 (Version: 20080414.031525)
WinRAR 4.01 (32-bit) (Version: 4.01.0)
Xvid Video Codec (Version: 1.3.2)

==================== Restore Points  =========================

24-09-2013 05:46:34 System Checkpoint
24-09-2013 05:47:09 fixed? proxy prob
24-09-2013 17:24:28 Installed Microsoft Fix it 50566
25-09-2013 04:11:47 Removed Java 6 Update 27
25-09-2013 04:12:50 Removed Java 7 Update 25

==================== Hosts content: ==========================

2004-08-26 09:11 - 2013-09-23 21:17 - 00000741 ____N C:\WINDOWS\system32\Drivers\etc\hosts
127.0.0.1    localhost

==================== Scheduled Tasks (whitelisted) =============

Task: C:\WINDOWS\Tasks\Ad-Aware Antivirus Scheduled Scan.job => C:\PROGRA~1\AD-AWA~1\AdAwareLauncher.exe
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-4043274209-3714135117-914160933-1003Core.job => C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-4043274209-3714135117-914160933-1003UA.job => C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2013-05-12 19:31 - 2010-05-04 17:47 - 00261632 ____N (BUFFALO INC.) C:\Program Files\BUFFALO\Client Manager3\ESSIDSET.DLL
2013-05-12 19:31 - 2009-05-28 11:11 - 00982528 ____N (BUFFALO INC.) C:\Program Files\BUFFALO\Client Manager3\ds_core_api.dll
2013-05-12 19:31 - 2008-12-15 15:20 - 00114688 ____N (BUFFALO) C:\Program Files\BUFFALO\Client Manager3\WNetProf2.dll
2012-10-10 13:20 - 2012-09-19 19:17 - 00397088 _____ () C:\Program Files\Avira\AntiVir Desktop\sqlite3.dll
2013-09-24 21:16 - 2009-10-07 01:47 - 00109080 _____ (Logitech Inc.) C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll
2012-10-10 13:20 - 2012-10-10 13:25 - 00263992 _____ (The cURL library, http://curl.haxx.se/) C:\Program Files\Avira\AntiVir Desktop\libcurl.dll
2013-05-12 19:31 - 2009-06-09 08:21 - 00118784 ____N (BUFFALO INC.) C:\Program Files\BUFFALO\Client Manager3\cm3_tray_0409.dll
2013-05-12 19:31 - 2008-12-15 15:20 - 00053248 ____N (BUFFALO INC.) C:\Program Files\BUFFALO\Client Manager3\cm_common.dll
2004-08-26 09:11 - 2004-08-04 12:00 - 00055632 _____ (Microsoft Corporation) C:\WINDOWS\system32\1033\dwintl.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (09/24/2013 09:21:31 PM) (Source: Application Error) (User: )
Description: Faulting application FreeAgentService.exe, version 5.0.0.4, faulting module msvcr80.dll, version 8.0.50727.6195, fault address 0x000046b4.
Processing media-specific event for [FreeAgentService.exe!ws!]

Error: (09/24/2013 04:44:52 PM) (Source: Application Error) (User: )
Description: Faulting application FreeAgentService.exe, version 5.0.0.4, faulting module msvcr80.dll, version 8.0.50727.6195, fault address 0x000046b4.
Processing media-specific event for [FreeAgentService.exe!ws!]

Error: (09/24/2013 04:35:02 PM) (Source: Application Error) (User: )
Description: Faulting application FreeAgentService.exe, version 5.0.0.4, faulting module msvcr80.dll, version 8.0.50727.6195, fault address 0x000046b4.
Processing media-specific event for [FreeAgentService.exe!ws!]

Error: (09/24/2013 10:36:01 AM) (Source: Application Error) (User: )
Description: Faulting application FreeAgentService.exe, version 5.0.0.4, faulting module msvcr80.dll, version 8.0.50727.6195, fault address 0x000046b4.
Processing media-specific event for [FreeAgentService.exe!ws!]

Error: (09/24/2013 10:09:32 AM) (Source: Application Error) (User: )
Description: Faulting application FreeAgentService.exe, version 5.0.0.4, faulting module msvcr80.dll, version 8.0.50727.6195, fault address 0x000046b4.
Processing media-specific event for [FreeAgentService.exe!ws!]

Error: (09/23/2013 10:10:21 PM) (Source: Application Error) (User: )
Description: Faulting application FreeAgentService.exe, version 5.0.0.4, faulting module msvcr80.dll, version 8.0.50727.6195, fault address 0x000046b4.
Processing media-specific event for [FreeAgentService.exe!ws!]

Error: (09/23/2013 09:35:30 PM) (Source: crypt32) (User: )
Description: Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: A connection with the server could not be established

Error: (09/23/2013 09:31:17 PM) (Source: crypt32) (User: )
Description: Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: This network connection does not exist.

Error: (09/23/2013 09:31:17 PM) (Source: crypt32) (User: )
Description: Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: This network connection does not exist.

Error: (09/23/2013 09:31:17 PM) (Source: crypt32) (User: )
Description: Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: This network connection does not exist.


System errors:
=============
Error: (09/24/2013 09:21:44 PM) (Source: Service Control Manager) (User: )
Description: The Seagate Service service terminated unexpectedly.  It has done this 1 time(s).

Error: (09/24/2013 09:17:35 PM) (Source: Service Control Manager) (User: )
Description: The following boot-start or system-start driver(s) failed to load:
SASDIFSV
SASKUTIL

Error: (09/24/2013 09:16:30 PM) (Source: Service Control Manager) (User: )
Description: The SAS Core Service service failed to start due to the following error:
%%3

Error: (09/24/2013 04:44:55 PM) (Source: Service Control Manager) (User: )
Description: The Seagate Service service terminated unexpectedly.  It has done this 1 time(s).

Error: (09/24/2013 04:41:40 PM) (Source: Service Control Manager) (User: )
Description: The BITS service failed to start due to the following error:
%%1053

Error: (09/24/2013 04:41:40 PM) (Source: Service Control Manager) (User: )
Description: Timeout (30000 milliseconds) waiting for the BITS service to connect.

Error: (09/24/2013 04:41:40 PM) (Source: DCOM) (User: NT AUTHORITY)
Description: DCOM got error "%%1053" attempting to start the service BITS with arguments ""
in order to run the server:
{4991D34B-80A1-4291-83B6-3328366B9097}

Error: (09/24/2013 04:41:05 PM) (Source: Service Control Manager) (User: )
Description: The following boot-start or system-start driver(s) failed to load:
SASDIFSV
SASKUTIL

Error: (09/24/2013 04:39:48 PM) (Source: Service Control Manager) (User: )
Description: The SAS Core Service service failed to start due to the following error:
%%3

Error: (09/24/2013 04:35:04 PM) (Source: Service Control Manager) (User: )
Description: The Seagate Service service terminated unexpectedly.  It has done this 1 time(s).


Microsoft Office Sessions:
=========================
Error: (09/24/2013 09:21:31 PM) (Source: Application Error)(User: )
Description: FreeAgentService.exe5.0.0.4msvcr80.dll8.0.50727.6195000046b4

Error: (09/24/2013 04:44:52 PM) (Source: Application Error)(User: )
Description: FreeAgentService.exe5.0.0.4msvcr80.dll8.0.50727.6195000046b4

Error: (09/24/2013 04:35:02 PM) (Source: Application Error)(User: )
Description: FreeAgentService.exe5.0.0.4msvcr80.dll8.0.50727.6195000046b4

Error: (09/24/2013 10:36:01 AM) (Source: Application Error)(User: )
Description: FreeAgentService.exe5.0.0.4msvcr80.dll8.0.50727.6195000046b4

Error: (09/24/2013 10:09:32 AM) (Source: Application Error)(User: )
Description: FreeAgentService.exe5.0.0.4msvcr80.dll8.0.50727.6195000046b4

Error: (09/23/2013 10:10:21 PM) (Source: Application Error)(User: )
Description: FreeAgentService.exe5.0.0.4msvcr80.dll8.0.50727.6195000046b4

Error: (09/23/2013 09:35:30 PM) (Source: crypt32)(User: )
Description: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txtA connection with the server could not be established

Error: (09/23/2013 09:31:17 PM) (Source: crypt32)(User: )
Description: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txtThis network connection does not exist.

Error: (09/23/2013 09:31:17 PM) (Source: crypt32)(User: )
Description: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txtThis network connection does not exist.

Error: (09/23/2013 09:31:17 PM) (Source: crypt32)(User: )
Description: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txtThis network connection does not exist.


==================== Memory info ===========================

Percentage of memory in use: 32%
Total physical RAM: 2430.48 MB
Available physical RAM: 1632.85 MB
Total Pagefile: 4319.53 MB
Available Pagefile: 3563.51 MB
Total Virtual: 2047.88 MB
Available Virtual: 1950.19 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:145.29 GB) (Free:55.12 GB) NTFS ==>[Drive with boot components (Windows XP)]
Drive d: () (Fixed) (Total:3.75 GB) (Free:1.68 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 149 GB) (Disk ID: 4B36BDEA)
Partition 1: (Active) - (Size=145 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=4 GB) - (Type=0B)

==================== End Of Log ============================

[hdk]

One other thing- I always get an error message on startup related to Sync Windows Services. Is this the Windows updater? Can it be reset?

[AdvancedSetup]

Not sure about that yet.  Please do the following.
 

Please download the attached fixlist.txt file and save it to the Desktop.
NOTE. It's important that both files, FRST or FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system.

Run FRST or FRST64 and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and save the update to your computer and quit your browser, do not run the updated version from the browser.

fixlist.txt

[hdk]

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 24-09-2013
Ran by Owner at 2013-09-25 09:25:08 Run:1
Running from C:\Documents and Settings\Owner\Desktop
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\run_startmenu.cmd ()
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft...=ie&ar=iesearch
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {65A95FBF-F5AC-44fa-8112-5C493C4DE412} URL = http://eimg.net/sw/t...=elnkdsearch&q={searchTerms}
SearchScopes: HKCU - {65A95FBF-F5AC-44fa-8112-5C493C4DE412} URL = http://eimg.net/sw/t...=elnkdsearch&q={searchTerms}
SearchScopes: HKCU - {BE42A5C1-646D-4C24-B72B-DF7E033F1509} URL = http://search.condui...ultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3298566&CUI=UN89475019113436272&UM=2
BHO: No Name - {2CEBF6C7-2B40-469B-B5D5-CD3F3676C3C4} -  No File
BHO: ElnkPubBHO Class - {512ACF1B-64D9-4928-B382-A80556F28DB4} - C:\Program Files\EarthLink\Toolbar\ElnkPuB.dll (EarthLink, Inc.)
BHO: ElnkProtectionBHO Class - {9579D574-D4D8-4335-9560-FE8641A013BD} - C:\Program Files\EarthLink\Toolbar\ProtctIE.dll (EarthLink, Inc.)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll (Google Inc.)
BHO: No Name - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -  No File
BHO: ElnkLegacyUninstBHO Class - {E713904C-DF05-4C79-BBAD-02DB923253BE} - C:\Program Files\EarthLink\Toolbar\uninsttb.dll (EarthLink, Inc.)
Toolbar: HKLM - &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll (Google Inc.)
Toolbar: HKLM - EarthLink Toolbar - {C7768536-96F8-4001-B1A2-90EE21279187} - C:\Program Files\EarthLink\Toolbar\Toolbar.dll (EarthLink, Inc.)
Toolbar: HKCU -&Google - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll (Google Inc.)
Toolbar: HKCU -EarthLink Toolbar - {C7768536-96F8-4001-B1A2-90EE21279187} - C:\Program Files\EarthLink\Toolbar\Toolbar.dll (EarthLink, Inc.)
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab
DPF: {CAFEEFAC-0017-0000-0025-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.m...ash/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.ad...Plus/1.6/gp.cab
FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)
FF Extension: No Name - C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\hihxz9a0.default-1378943744140\Extensions\{e5bbc237-c99b-4ced-a061-0be27703295f}.xpi
S2 !SASCORE; "L:\SASCORE.EXE" [x]
S1 SASDIFSV; \??\L:\\SASDIFSV.SYS [x]
S1 SASKUTIL; \??\L:\\SASKUTIL.SYS [x]
C:\Documents and Settings\Owner\Local Settings\temp\Quarantine.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-4043274209-3714135117-914160933-1003Core.job => C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-4043274209-3714135117-914160933-1003UA.job => C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe

*****************

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\run_startmenu.cmd => Moved successfully.
HKCU\Software\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully.
HKCU\Software\Microsoft\Internet Explorer\Main\\Search Page => Value was restored successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{65A95FBF-F5AC-44fa-8112-5C493C4DE412} => Key deleted successfully.
HKCR\Wow6432Node\CLSID\{65A95FBF-F5AC-44fa-8112-5C493C4DE412} => Key not found.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{65A95FBF-F5AC-44fa-8112-5C493C4DE412} => Key deleted successfully.
HKCR\Wow6432Node\CLSID\{65A95FBF-F5AC-44fa-8112-5C493C4DE412} => Key not found.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{BE42A5C1-646D-4C24-B72B-DF7E033F1509} => Key deleted successfully.
HKCR\Wow6432Node\CLSID\{BE42A5C1-646D-4C24-B72B-DF7E033F1509} => Key not found.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2CEBF6C7-2B40-469B-B5D5-CD3F3676C3C4} => Key deleted successfully.
HKCR\CLSID\{2CEBF6C7-2B40-469B-B5D5-CD3F3676C3C4} => Key not found.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{512ACF1B-64D9-4928-B382-A80556F28DB4} => Key deleted successfully.
HKCR\CLSID\{512ACF1B-64D9-4928-B382-A80556F28DB4} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9579D574-D4D8-4335-9560-FE8641A013BD} => Key deleted successfully.
HKCR\CLSID\{9579D574-D4D8-4335-9560-FE8641A013BD} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7} => Key deleted successfully.
HKCR\CLSID\{AA58ED58-01DD-4d91-8333-CF10577473F7} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} => Key deleted successfully.
HKCR\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} => Key not found.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E713904C-DF05-4C79-BBAD-02DB923253BE} => Key deleted successfully.
HKCR\CLSID\{E713904C-DF05-4C79-BBAD-02DB923253BE} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{2318C2B1-4965-11d4-9B18-009027A5CD4F} => Value deleted successfully.
HKCR\CLSID\{2318C2B1-4965-11d4-9B18-009027A5CD4F} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{C7768536-96F8-4001-B1A2-90EE21279187} => Value deleted successfully.
HKCR\CLSID\{C7768536-96F8-4001-B1A2-90EE21279187} => Key deleted successfully.
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} => Value deleted successfully.
HKCR\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F} => Key not found.
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{C7768536-96F8-4001-B1A2-90EE21279187} => Value deleted successfully.
HKCR\CLSID\{C7768536-96F8-4001-B1A2-90EE21279187} => Key not found.
HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93} => Key deleted successfully.
HKCR\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93} => Key not found.
HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0017-0000-0025-ABCDEFFEDCBA} => Key deleted successfully.
HKCR\CLSID\{CAFEEFAC-0017-0000-0025-ABCDEFFEDCBA} => Key not found.
HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} => Key deleted successfully.
HKCR\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} => Key not found.
HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{D27CDB6E-AE6D-11CF-96B8-444553540000} => Key deleted successfully.
HKCR\CLSID\{D27CDB6E-AE6D-11CF-96B8-444553540000} => Key not found.
HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7} => Key deleted successfully.
HKCR\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7} => Key not found.
HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.25.2 => Key deleted successfully.
C:\WINDOWS\system32\npDeployJava1.dll => Moved successfully.
C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\hihxz9a0.default-1378943744140\Extensions\{e5bbc237-c99b-4ced-a061-0be27703295f}.xpi => Moved successfully.
!SASCORE => Service deleted successfully.
SASDIFSV => Service deleted successfully.
SASKUTIL => Service deleted successfully.
C:\Documents and Settings\Owner\Local Settings\temp\Quarantine.exe => Moved successfully.
C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => Moved successfully.
C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => Moved successfully.
C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-4043274209-3714135117-914160933-1003Core.job => Moved successfully.
C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-4043274209-3714135117-914160933-1003UA.job => Moved successfully.

==== End of Fixlog ====

[AdvancedSetup]

Great, okay let me have you run the following.
 
 

• Please download Dr.Web CureIt! antivirus and save it to your computer. The file size is in excess of 100MB
• NOTE: Free usage of Dr.Web CureIt! for business purposes is illegal.
• Internet Explorer may show a warning when downloading - the file is safe to download from the provided link.
• Shutdown your antivirus to avoid any conflicts while scanning.
• Once the scans have completed please re-enable your antivirus.
• If using Malwarebytes Anti-Malware PRO you can right click over the tray icon and disable the Protection Modules
• If needed you can also temporarily disable it from starting with Windows
• Temporarily turn off any other security add-ons or applications you may also have.
• Once you have downloaded Dr.Web CureIt! you should right click over it and choose Properties and verify it has a Digital Signature.
• If it does not have a Digital Signature then do not run it.
• Close all open programs including all Web browsers and then double-click on drweb-cureit.exe to start the installer.
• You should have your User Account Control (UAC) enabled for improved security and which should then produce a dialog box asking for approval to run the installer.
• Click on the Yes button to start the installer.
• Click OK to scan your computer in the Enhanced Protection Mode
• Click on the check box to agree to participate in their software improvement program.
• Then if needed choose your Language by clicking on the small globe like icon in the upper right corner by the wrench.
• Then click on the Continue button and then click on the Select objects for scanning link just below the "Start scanning" button.
• Place a check mark on all the items except for Temporary files and System restore points - those items should not have a check mark on them.
• Then click on the Start scanning button.
• If a threat is found you can click on the Action column in the program.
• Your options will be Cure or Ignore
• If you see an item that you are absolutely sure is OK, then un-check the check box for that item, otherwise keep it on Cure.
• Then click on the Neutralize button.
• Once completed click on the green Open Report link. It will open the report in NOTEPAD
• Save the report to your desktop. The report will be called Cureit.log
• Close Dr.Web Cureit!
• Reboot your computer to allow files that were in use to be moved/deleted during reboot.
• After reboot, attach the log Cureit.log you saved previously in your next reply.
• Re-Enable your antivirus and other security programs when all done.

[hdk]

Ran Dr. Web. No problems found., Did not have the option to "open report". Only visible buttons were "<" (back) and the "language" and "tools".

[AdvancedSetup]

Good, let me have you run the following which should find and remove any minor trace items.
 
Please go ahead and run through the following steps and post back the logs when ready.

STEP 03
Please download Malwarebytes Anti-Rootkit from here

• Unzip the contents to a folder in a convenient location.
• Open the folder where the contents were unzipped and run mbar.exe
• Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
• Click on the Cleanup button to remove any threats and reboot if prompted to do so.
• Wait while the system shuts down and the cleanup process is performed.
• Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
• When done, please post the two logs produced they will be in the MBAR folder... mbar-log.txt and system-log.txt

STEP 04
Please download Junkware Removal Tool to your desktop.

• Shutdown your antivirus to avoid any conflicts.
• Right click over JRT.exe and select Run as administrator on Windows Vista or Windows 7, double-click on XP.
• The tool will open and start scanning your system.
• Please be patient as this can take a while to complete.
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
• Post the contents of JRT.txt into your next reply message
• When completed make sure to re-enable your antivirus

STEP 05
Please download AdwCleaner by Xplode and save to your Desktop.

• Double click on AdwCleaner.exe to run the tool.
• Click on the Scan button.
• AdwCleaner will begin...be patient as the scan may take some time to complete.
• After the scan has finished, click on the Report button...a logfile (AdwCleaner[R0].txt) will open in Notepad for review.
• The contents of the log file may be confusing. Unless you see a program name that you know should not be removed, don't worry about it. If you see an entry you want to keep, let me know about it.
• Copy and paste the contents of that logfile in your next reply.
• A copy of all logfiles are saved in the C:\AdwCleaner folder which was created when running the tool.
• STEP 06
  
  
  Please go here to run the online antivirus scannner from ESET.
  • Turn off the real time scanner of any existing antivirus program while performing the online scan
  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the activex control to install
  • Click Start
  • Make sure that the option Remove found threats is unticked
  • Click on Advanced Settings and ensure these options are ticked:
    • Scan for potentially unwanted applications
    • Scan for potentially unsafe applications
    • Enable Anti-Stealth Technology
  • Click Scan
  • Wait for the scan to finish
  • If any threats were found, click the 'List of found threats' , then click Export to text file....
  • Save it to your desktop, then please copy and paste that log as a reply to this topic.
  STEP 07
  Please download the Farbar Recovery Scan Tool and save it to your desktop.
  
  Note: You need to run the version compatibale with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit
  • Double-click to run it. When the tool opens click Yes to disclaimer.
  • Press the Scan button.
  • It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
  • The first time the tool is run, it also makes another log (Addition.txt). Please attach it to your reply as well.

[hdk]

mbar-log

 

Malwarebytes Anti-Rootkit BETA 1.07.0.1005
www.malwarebytes.org

Database version: v2013.09.25.09

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
Owner :: YOUR-694230950D [administrator]

9/25/2013 5:24:04 PM
mbar-log-2013-09-25 (17-24-04).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 215685
Time elapsed: 22 minute(s), 12 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

Physical Sectors Detected: 0
(No malicious items detected)

(end)
 

system-log:

 

---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.07.0.1005

© Malwarebytes Corporation 2011-2012

OS version: 5.1.2600 Windows XP Service Pack 3 x86

Account is Administrative

Internet Explorer version: 8.0.6001.18702

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED
CPU speed: 1.989000 GHz
Memory total: 2548547584, free: 1683099648

---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.07.0.1005

© Malwarebytes Corporation 2011-2012

OS version: 5.1.2600 Windows XP Service Pack 3 x86

Account is Administrative

Internet Explorer version: 8.0.6001.18702

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED
CPU speed: 1.989000 GHz
Memory total: 2548547584, free: 1647345664

Downloaded database version: v2013.09.25.09
Downloaded database version: v2013.09.23.01
=======================================
Initializing...
DDA Driver installation error.
=======================================


=======================================


---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.07.0.1005

© Malwarebytes Corporation 2011-2012

OS version: 5.1.2600 Windows XP Service Pack 3 x86

Account is Administrative

Internet Explorer version: 8.0.6001.18702

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED
CPU speed: 1.989000 GHz
Memory total: 2548547584, free: 1678831616

=======================================
Initializing...
------------ Kernel report ------------
     09/25/2013 17:23:53
------------ Loaded modules -----------
\WINDOWS\system32\ntkrnlpa.exe
\WINDOWS\system32\hal.dll
\WINDOWS\system32\KDCOM.DLL
\WINDOWS\system32\BOOTVID.dll
ACPI.sys
\WINDOWS\system32\DRIVERS\WMILIB.SYS
pci.sys
isapnp.sys
gfibto.sys
pciide.sys
\WINDOWS\system32\DRIVERS\PCIIDEX.SYS
aliide.sys
cmdide.sys
toside.sys
viaide.sys
intelide.sys
MountMgr.sys
ftdisk.sys
PartMgr.sys
VolSnap.sys
cpqarray.sys
\WINDOWS\system32\DRIVERS\SCSIPORT.SYS
atapi.sys
aha154x.sys
sparrow.sys
symc810.sys
aic78xx.sys
dac960nt.sys
ql10wnt.sys
amsint.sys
asc.sys
asc3550.sys
mraid35x.sys
i2omp.sys
ini910u.sys
ql1240.sys
aic78u2.sys
symc8xx.sys
sym_hi.sys
sym_u3.sys
ABP480N5.SYS
asc3350p.sys
cd20xrnt.sys
ultra.sys
adpu160m.sys
dpti2o.sys
ql1080.sys
ql1280.sys
ql12160.sys
perc2.sys
perc2hib.sys
hpn.sys
cbidf2k.sys
dac2w2k.sys
disk.sys
\WINDOWS\system32\DRIVERS\CLASSPNP.SYS
fltmgr.sys
sr.sys
PxHelp20.sys
KSecDD.sys
WudfPf.sys
Ntfs.sys
NDIS.sys
sisagp.sys
viaagp.sys
ohci1394.sys
\WINDOWS\system32\DRIVERS\1394BUS.SYS
Mup.sys
agp440.sys
alim1541.sys
amdagp.sys
agpCPQ.sys
\SystemRoot\system32\DRIVERS\nic1394.sys
\SystemRoot\system32\DRIVERS\processr.sys
\SystemRoot\system32\DRIVERS\ati2mtag.sys
\SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
\SystemRoot\system32\DRIVERS\usbohci.sys
\SystemRoot\system32\DRIVERS\USBPORT.SYS
\SystemRoot\system32\DRIVERS\usbehci.sys
\SystemRoot\system32\DRIVERS\imapi.sys
\SystemRoot\System32\Drivers\AnyDVD.sys
\SystemRoot\system32\DRIVERS\cdrom.sys
\SystemRoot\system32\DRIVERS\redbook.sys
\SystemRoot\system32\DRIVERS\ks.sys
\SystemRoot\system32\DRIVERS\HSFHWBS2.sys
\SystemRoot\system32\DRIVERS\HSF_DP.sys
\SystemRoot\system32\DRIVERS\HSF_CNXT.sys
\SystemRoot\System32\Drivers\Modem.SYS
\SystemRoot\system32\DRIVERS\RTL8139.SYS
\SystemRoot\system32\drivers\ALCXWDM.SYS
\SystemRoot\system32\drivers\portcls.sys
\SystemRoot\system32\drivers\drmk.sys
\SystemRoot\system32\DRIVERS\fdc.sys
\SystemRoot\system32\DRIVERS\serial.sys
\SystemRoot\system32\DRIVERS\serenum.sys
\SystemRoot\system32\DRIVERS\parport.sys
\SystemRoot\system32\DRIVERS\audstub.sys
\SystemRoot\system32\DRIVERS\rasl2tp.sys
\SystemRoot\system32\DRIVERS\ndistapi.sys
\SystemRoot\system32\DRIVERS\ndiswan.sys
\SystemRoot\system32\DRIVERS\raspppoe.sys
\SystemRoot\system32\DRIVERS\raspptp.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\SystemRoot\system32\DRIVERS\psched.sys
\SystemRoot\system32\DRIVERS\msgpc.sys
\SystemRoot\system32\DRIVERS\ptilink.sys
\SystemRoot\system32\DRIVERS\raspti.sys
\SystemRoot\system32\DRIVERS\termdd.sys
\SystemRoot\system32\DRIVERS\kbdclass.sys
\SystemRoot\system32\DRIVERS\mouclass.sys
\SystemRoot\system32\DRIVERS\swenum.sys
\SystemRoot\system32\DRIVERS\update.sys
\SystemRoot\system32\DRIVERS\mssmbios.sys
\SystemRoot\system32\DRIVERS\sxuptp.sys
\SystemRoot\System32\Drivers\NDProxy.SYS
\SystemRoot\system32\DRIVERS\usbhub.sys
\SystemRoot\system32\DRIVERS\USBD.SYS
\SystemRoot\System32\Drivers\i2omgmt.SYS
\SystemRoot\system32\DRIVERS\usbccgp.sys
\??\C:\WINDOWS\System32\Drivers\sunkfilt.sys
\SystemRoot\system32\DRIVERS\USBSTOR.SYS
\SystemRoot\System32\Drivers\Fs_Rec.SYS
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\SystemRoot\system32\DRIVERS\HIDPARSE.SYS
\SystemRoot\System32\drivers\vga.sys
\SystemRoot\System32\Drivers\mnmdd.SYS
\SystemRoot\System32\DRIVERS\RDPCDD.sys
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\system32\DRIVERS\rasacd.sys
\SystemRoot\system32\DRIVERS\ipsec.sys
\SystemRoot\system32\DRIVERS\tcpip.sys
\SystemRoot\system32\DRIVERS\netbt.sys
\SystemRoot\System32\drivers\ws2ifsl.sys
\SystemRoot\System32\drivers\afd.sys
\SystemRoot\system32\DRIVERS\netbios.sys
\SystemRoot\system32\DRIVERS\ssmdrv.sys
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\System32\Drivers\Fips.SYS
\SystemRoot\system32\DRIVERS\ipnat.sys
\SystemRoot\system32\DRIVERS\wanarp.sys
\SystemRoot\system32\DRIVERS\arp1394.sys
\??\C:\WINDOWS\system32\BUFADPT.SYS
\SystemRoot\system32\DRIVERS\avkmgr.sys
\SystemRoot\system32\DRIVERS\avipbb.sys
\SystemRoot\system32\DRIVERS\hidusb.sys
\SystemRoot\system32\DRIVERS\HIDCLASS.SYS
\SystemRoot\system32\DRIVERS\kbdhid.sys
\SystemRoot\system32\DRIVERS\mouhid.sys
\SystemRoot\System32\Drivers\Fastfat.SYS
\SystemRoot\System32\Drivers\dump_atapi.sys
\SystemRoot\System32\Drivers\dump_WMILIB.SYS
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\drivers\Dxapi.sys
\SystemRoot\System32\watchdog.sys
\SystemRoot\System32\drivers\dxg.sys
\SystemRoot\System32\drivers\dxgthk.sys
\SystemRoot\System32\ati2dvag.dll
\SystemRoot\System32\ati2cqag.dll
\SystemRoot\System32\ati3duag.dll
\SystemRoot\System32\ativvaxx.dll
\SystemRoot\System32\ATMFD.DLL
\SystemRoot\system32\DRIVERS\avgntflt.sys
\SystemRoot\system32\DRIVERS\mrxdav.sys
\SystemRoot\System32\Drivers\ASCTRM.SYS
\SystemRoot\System32\Drivers\ElbyCDIO.sys
\SystemRoot\system32\DRIVERS\srv.sys
\SystemRoot\system32\drivers\wdmaud.sys
\SystemRoot\system32\drivers\sysaudio.sys
\SystemRoot\system32\DRIVERS\mdmxsdk.sys
\SystemRoot\System32\Drivers\Cdfs.SYS
\SystemRoot\system32\DRIVERS\LVPr2Mon.sys
\SystemRoot\System32\Drivers\HTTP.sys
\SystemRoot\System32\Drivers\Udfs.SYS
\??\C:\WINDOWS\system32\drivers\mbamchameleon.sys
\SystemRoot\system32\drivers\kmixer.sys
\??\C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys
\WINDOWS\system32\ntdll.dll
----------- End -----------
Done!
<<<1>>>
Upper Device Name: \Device\Harddisk4\DR6
Upper Device Object: 0xffffffff8a00a030
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\00000095\
Lower Device Object: 0xffffffff8a4257c0
Lower Device Driver Name: \Driver\USBSTOR\
<<<1>>>
Upper Device Name: \Device\Harddisk3\DR5
Upper Device Object: 0xffffffff8a13b7e0
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\00000094\
Lower Device Object: 0xffffffff8a341d08
Lower Device Driver Name: \Driver\USBSTOR\
<<<1>>>
Upper Device Name: \Device\Harddisk2\DR4
Upper Device Object: 0xffffffff8a010920
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\00000093\
Lower Device Object: 0xffffffff8a4568b8
Lower Device Driver Name: \Driver\USBSTOR\
<<<1>>>
Upper Device Name: \Device\Harddisk1\DR3
Upper Device Object: 0xffffffff8a013ab8
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\00000092\
Lower Device Object: 0xffffffff8a103d08
Lower Device Driver Name: \Driver\USBSTOR\
<<<1>>>
Upper Device Name: \Device\Harddisk0\DR0
Upper Device Object: 0xffffffff8a7f2ab8
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IdeDeviceP4T0L0-1f\
Lower Device Object: 0xffffffff8a7f4940
Lower Device Driver Name: \Driver\atapi\
<<<2>>>
Physical Sector Size: 512
Drive: 0, DevicePointer: 0xffffffff8a7f2ab8, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xffffffff8a80de08, DeviceName: Unknown, DriverName: \Driver\PartMgr\
DevicePointer: 0xffffffff8a7f2ab8, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
DevicePointer: 0xffffffff8a8805a8, DeviceName: \Device\00000085\, DriverName: \Driver\ACPI\
DevicePointer: 0xffffffff8a7f4940, DeviceName: \Device\Ide\IdeDeviceP4T0L0-1f\, DriverName: \Driver\atapi\
------------ End ----------
Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
<<<2>>>
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Scanning drivers directory: C:\WINDOWS\SYSTEM32\drivers...
<<<2>>>
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Done!
Drive 0
Scanning MBR on drive 0...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: 4B36BDEA

Partition information:

    Partition 0 type is Primary (0x7)
    Partition is ACTIVE.
    Partition starts at LBA: 7871850  Numsec = 304704855
    Partition file system is NTFS
    Partition is bootable

    Partition 1 type is Other (0xb)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 63  Numsec = 7871787

    Partition 2 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0

    Partition 3 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0

Disk Size: 160041885696 bytes
Sector size: 512 bytes

Scanning physical sectors of unpartitioned space on drive 0 (1-62-312561808-312581808)...
Done!
Physical Sector Size: 0
Drive: 1, DevicePointer: 0xffffffff8a013ab8, DeviceName: \Device\Harddisk1\DR3\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xffffffff8a3ac2d8, DeviceName: Unknown, DriverName: \Driver\PartMgr\
DevicePointer: 0xffffffff8a013ab8, DeviceName: \Device\Harddisk1\DR3\, DriverName: \Driver\Disk\
DevicePointer: 0xffffffff8a103d08, DeviceName: \Device\00000092\, DriverName: \Driver\USBSTOR\
------------ End ----------
Physical Sector Size: 0
Drive: 2, DevicePointer: 0xffffffff8a010920, DeviceName: \Device\Harddisk2\DR4\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xffffffff8a16c8b0, DeviceName: Unknown, DriverName: \Driver\PartMgr\
DevicePointer: 0xffffffff8a010920, DeviceName: \Device\Harddisk2\DR4\, DriverName: \Driver\Disk\
DevicePointer: 0xffffffff8a4568b8, DeviceName: \Device\00000093\, DriverName: \Driver\USBSTOR\
------------ End ----------
Physical Sector Size: 0
Drive: 3, DevicePointer: 0xffffffff8a13b7e0, DeviceName: \Device\Harddisk3\DR5\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xffffffff8a13b5b8, DeviceName: Unknown, DriverName: \Driver\PartMgr\
DevicePointer: 0xffffffff8a13b7e0, DeviceName: \Device\Harddisk3\DR5\, DriverName: \Driver\Disk\
DevicePointer: 0xffffffff8a341d08, DeviceName: \Device\00000094\, DriverName: \Driver\USBSTOR\
------------ End ----------
Physical Sector Size: 0
Drive: 4, DevicePointer: 0xffffffff8a00a030, DeviceName: \Device\Harddisk4\DR6\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xffffffff8a40d3d0, DeviceName: Unknown, DriverName: \Driver\PartMgr\
DevicePointer: 0xffffffff8a00a030, DeviceName: \Device\Harddisk4\DR6\, DriverName: \Driver\Disk\
DevicePointer: 0xffffffff8a4257c0, DeviceName: \Device\00000095\, DriverName: \Driver\USBSTOR\
------------ End ----------
Scan finished
=======================================


Removal queue found; removal started
Removing C:\Documents and Settings\All Users\Application Data\Malwarebytes' Anti-Malware (portable)\MBR_0_i.mbam...
Removing C:\Documents and Settings\All Users\Application Data\Malwarebytes' Anti-Malware (portable)\Bootstrap_0_0_7871850_i.mbam...
Removing C:\Documents and Settings\All Users\Application Data\Malwarebytes' Anti-Malware (portable)\MBR_0_r.mbam...
Removal finished
 

[AdvancedSetup]

Please continue running the other scans and post back the logs when completed

[hdk]

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.0.2 (09.22.2013:1)
OS: Microsoft Windows XP x86
Ran by Owner on Wed 09/25/2013 at 18:01:34.78
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\Documents and Settings\Owner\Local Settings\Application Data\apn"





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Wed 09/25/2013 at 18:06:35.31
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

 

# AdwCleaner v3.005 - Report created 25/09/2013 at 18:09:42
# Updated 22/09/2013 by Xplode
# Operating System : Microsoft Windows XP Service Pack 3 (32 bits)
# Username : Owner - YOUR-694230950D
# Running from : C:\Documents and Settings\Owner\Desktop\AdwCleaner.exe
# Option : Scan

***** [ Services ] *****


***** [ Files / Folders ] *****


***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\grusskartencenter.com
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\grusskartencenter.com
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}

***** [ Browsers ] *****

-\\ Internet Explorer v8.0.6001.18702


-\\ Mozilla Firefox v23.0.1 (en-US)

[ File : C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\hihxz9a0.default-1378943744140\prefs.js ]


*************************

AdwCleaner[R0].txt - [1155 octets] - [25/09/2013 18:09:42]

########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [1215 octets] ##########
 

 

ESET log:

C:\Documents and Settings\Owner\Desktop\security\avira_free_antivirus_en.exe    a variant of Win32/Bundled.Toolbar.Ask application
C:\Program Files\Avira\AntiVir Desktop\apnic.dll    a variant of Win32/Bundled.Toolbar.Ask application
C:\Program Files\Avira\AntiVir Desktop\apntoolbarinstaller.exe    a variant of Win32/Bundled.Toolbar.Ask application
C:\Program Files\Avira\AntiVir Desktop\Offercast_AVIRAV7_.exe    a variant of Win32/Bundled.Toolbar.Ask.D application
 

 

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 26-09-2013
Ran by Owner (administrator) on YOUR-694230950D on 25-09-2013 19:03:12
Running from C:\Documents and Settings\Owner\Desktop
Microsoft Windows XP Home Edition Service Pack 3 (X86) OS Language: English(US)
Internet Explorer Version 8
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(ATI Technologies Inc.) C:\WINDOWS\system32\Ati2evxx.exe
(BUFFALO INC.) C:\Program Files\BUFFALO\Client Manager3\bwsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Garmin Ltd or its subsidiaries) C:\Program Files\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe
(Intuit Inc.) C:\Program Files\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe
(Logitech Inc.) C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
(New Boundary Technologies, Inc.) C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
(Skype Technologies S.A.) C:\Documents and Settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe
(ATI Technologies Inc.) C:\WINDOWS\system32\Ati2evxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Realtek Semiconductor Corp.) C:\WINDOWS\SOUNDMAN.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(BUFFALO INC.) C:\Program Files\BUFFALO\Client Manager3\cm3_tray.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Microsoft Corporation) C:\WINDOWS\system32\wscntfy.exe
(ESET) C:\Program Files\ESET\ESET Online Scanner\OnlineScannerApp.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Recguard] - C:\WINDOWS\SMINST\RECGUARD.EXE [212992 2002-09-13] ()
HKLM\...\Run: [soundMan] - C:\Windows\SOUNDMAN.EXE [77824 2004-11-15] (Realtek Semiconductor Corp.)
HKLM\...\Run: [NeroFilterCheck] - C:\WINDOWS\system32\NeroCheck.exe [155648 2001-07-09] (Ahead Software Gmbh)
HKLM\...\Run: [ATIPTA] - C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe [344064 2004-11-11] (ATI Technologies, Inc.)
HKLM\...\Run: [QuickTime Task] - C:\Program Files\QuickTime\QTTask.exe [421888 2012-04-18] (Apple Inc.)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [ElbyCheckAnyDVD] - C:\Program Files\SlySoft\AnyDVD\ElbyCheck.exe [45056 2003-09-20] (Elaborate Bytes AG)
HKLM\...\Run: [APSDaemon] - C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59240 2012-02-20] (Apple Inc.)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [347192 2013-08-29] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [showWnd] - C:\Windows\ShowWnd.exe [36864 2003-09-19] ()
Winlogon\Notify\AtiExtEvent: C:\Windows\system32\Ati2evxx.dll (ATI Technologies Inc.)
Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ClientManager3.lnk
ShortcutTarget: ClientManager3.lnk -> C:\Program Files\BUFFALO\Client Manager3\cm3_tray.exe (BUFFALO INC.)
Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
ShortcutTarget: Microsoft Office.lnk -> C:\Program Files\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xC0F67E8555BACE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
BHO: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll (Safer Networking Limited)
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Hosts: 127.0.0.1    localhost
Tcpip\Parameters: [DhcpNameServer] 192.168.11.1

FireFox:
========
FF ProfilePath: C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\hihxz9a0.default-1378943744140
FF Plugin: @adobe.com/FlashPlayer - C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin: @divx.com/DivX Plus Web Player Plug-In,version=1.0.0 - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.0.3 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @talk.google.com/GoogleTalkPlugin - C:\Documents and Settings\Owner\Application Data\Mozilla\plugins\npgoogletalk.dll (Google)
FF Plugin HKCU: @talk.google.com/O1DPlugin - C:\Documents and Settings\Owner\Application Data\Mozilla\plugins\npo1d.dll (Google)
FF Plugin HKCU: @talk.google.com/O3DPlugin - C:\Documents and Settings\Owner\Application Data\Mozilla\plugins\npgtpo3dautoplugin.dll ()
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Extension: Skype Click to Call - C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
FF Extension: Skype Click to Call - C:\Program Files\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
FF HKLM\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF Extension: DivX Plus Web Player HTML5 <video> - C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5

========================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [84024 2013-08-29] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [108088 2013-08-29] (Avira Operations GmbH & Co. KG)
R2 Bwsvc; C:\Program Files\BUFFALO\Client Manager3\bwsvc.exe [238592 2009-06-09] (BUFFALO INC.)
S2 FreeAgentGoNext Service; C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe [189736 2009-12-18] (Seagate Technology LLC)
R2 Garmin Core Update Service; C:\Program Files\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [185688 2013-03-27] (Garmin Ltd or its subsidiaries)
R2 PrismXL; C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS [172032 2011-05-22] (New Boundary Technologies, Inc.)
R2 Skype C2C Service; C:\Documents and Settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe [3291008 2013-08-14] (Skype Technologies S.A.)

==================== Drivers (Whitelisted) ====================

R3 ALCXWDM; C:\Windows\System32\drivers\ALCXWDM.SYS [2297664 2004-11-17] (Realtek Semiconductor Corp.)
R3 AnyDVD; C:\Windows\System32\Drivers\AnyDVD.sys [22912 2003-09-29] (SlySoft, Inc.)
R2 ASCTRM; C:\Windows\System32\Drivers\ASCTRM.sys [8552 2011-05-22] (Windows ® 2000 DDK provider)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [88840 2013-09-05] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136672 2013-08-29] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-03-27] (Avira Operations GmbH & Co. KG)
R1 BUFADPT; C:\WINDOWS\system32\BUFADPT.SYS [11136 2008-12-15] (BUFFALO INC.)
R2 ElbyCDIO; C:\Windows\System32\Drivers\ElbyCDIO.sys [31088 2010-12-16] (Elaborate Bytes AG)
S3 FilterService; C:\Windows\System32\DRIVERS\lvuvcflt.sys [23832 2009-10-07] (Logitech Inc.)
R0 gfibto; C:\Windows\System32\drivers\gfibto.sys [13560 2013-09-22] (GFI Software)
R3 LVPr2Mon; C:\Windows\System32\DRIVERS\LVPr2Mon.sys [25752 2009-10-07] ()
S3 mxnic; C:\Windows\System32\DRIVERS\mxnic.sys [19968 2001-08-17] (Macronix International Co., Ltd.                                               )
S3 NdisIP; C:\Windows\System32\DRIVERS\NdisIP.sys [10880 2008-04-13] (Microsoft Corporation)
S1 P3; C:\Windows\System32\DRIVERS\p3.sys [42752 2008-04-13] (Microsoft Corporation)
R3 rtl8139; C:\Windows\System32\DRIVERS\RTL8139.SYS [20992 2004-08-03] (Realtek Semiconductor Corporation)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH)
R3 SunkFilt; C:\WINDOWS\System32\Drivers\sunkfilt.sys [36804 2004-11-15] (Alcor Micro Corp.)
R2 sxuptp; C:\Windows\System32\DRIVERS\sxuptp.sys [248960 2011-07-11] (silex technology, Inc.)
U4 intelppm;
U5 ScsiPort; C:\Windows\system32\drivers\scsiport.sys [96384 2008-04-13] (Microsoft Corporation)
U3 TlntSvr;
S3 wanatw; system32\DRIVERS\wanatw4.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-09-25 19:02 - 2013-09-25 19:02 - 01089329 _____ (Farbar) C:\Documents and Settings\Owner\Desktop\FRST.exe
2013-09-25 18:15 - 2013-09-25 18:15 - 00000000 ____D C:\Program Files\ESET
2013-09-25 18:13 - 2013-09-25 18:15 - 02347384 _____ (ESET) C:\Documents and Settings\Owner\Desktop\esetsmartinstaller_enu.exe
2013-09-25 18:10 - 2013-09-25 18:10 - 00001295 _____ C:\Documents and Settings\Owner\Desktop\AdwCleaner[R0].txt
2013-09-25 18:09 - 2013-09-25 18:10 - 00000000 ____D C:\AdwCleaner
2013-09-25 18:09 - 2013-09-25 18:09 - 01042066 _____ C:\Documents and Settings\Owner\Desktop\AdwCleaner.exe
2013-09-25 18:06 - 2013-09-25 18:06 - 00000693 _____ C:\Documents and Settings\Owner\Desktop\JRT.txt
2013-09-25 18:01 - 2013-09-25 18:01 - 00000000 ____D C:\WINDOWS\ERUNT
2013-09-25 17:49 - 2013-09-25 17:49 - 01030038 _____ (Thisisu) C:\Documents and Settings\Owner\Desktop\JRT.exe
2013-09-25 17:21 - 2013-09-25 17:48 - 00000000 ____D C:\Documents and Settings\Owner\Desktop\mbar
2013-09-25 17:18 - 2013-09-25 19:01 - 00000000 ____D C:\Documents and Settings\Owner\Desktop\fix
2013-09-25 14:47 - 2013-09-25 15:35 - 00065536 _____ C:\WINDOWS\system32\config\Doctor Web.evt
2013-09-25 14:47 - 2013-09-25 14:47 - 00000000 ____D C:\Documents and Settings\Owner\Doctor Web
2013-09-24 21:48 - 2013-09-24 22:20 - 00000000 ____D C:\Documents and Settings\Owner\Desktop\home
2013-09-24 21:21 - 2013-09-24 21:21 - 00000000 ____D C:\FRST
2013-09-23 22:36 - 2013-09-23 21:17 - 00000741 ____R C:\WINDOWS\system32\Drivers\etc\hosts.20130923-223631.backup
2013-09-23 20:40 - 2013-09-23 20:40 - 00000000 __SHD C:\Documents and Settings\Administrator\PrivacIE
2013-09-23 20:37 - 2013-09-23 20:42 - 00000178 ___SH C:\Documents and Settings\Administrator\ntuser.ini
2013-09-23 20:37 - 2013-09-23 20:40 - 00000000 ____D C:\Documents and Settings\Administrator
2013-09-23 20:37 - 2013-08-09 14:02 - 00000000 ____D C:\Documents and Settings\Administrator\Local Settings\Application Data\Google
2013-09-23 20:37 - 2012-01-25 00:12 - 00000000 __SHD C:\Documents and Settings\Administrator\IETldCache
2013-09-23 20:37 - 2011-05-26 11:06 - 00000000 ____D C:\Documents and Settings\Administrator\Application Data\Macromedia
2013-09-23 20:37 - 2011-05-22 11:24 - 00000000 ____D C:\Documents and Settings\Administrator\Application Data\McAfee
2013-09-23 20:37 - 2011-05-22 11:21 - 00000000 ____D C:\Documents and Settings\Administrator\Application Data\SampleView
2013-09-23 20:37 - 2011-05-22 10:53 - 00000000 ___RD C:\Documents and Settings\Administrator\Start Menu\Programs\Accessories
2013-09-23 20:37 - 2004-08-26 11:09 - 00000767 _____ C:\Documents and Settings\Administrator\Start Menu\Programs\Internet Explorer.lnk
2013-09-23 20:37 - 2004-08-26 11:09 - 00000738 _____ C:\Documents and Settings\Administrator\Start Menu\Programs\Outlook Express.lnk
2013-09-23 20:37 - 2004-08-26 11:04 - 00001599 _____ C:\Documents and Settings\Administrator\Start Menu\Programs\Remote Assistance.lnk
2013-09-23 19:40 - 2013-09-23 19:40 - 98840431 _____ C:\WINDOWS\system32\琧噔6
2013-09-23 18:42 - 2013-09-23 18:42 - 00000000 _RSHD C:\cmdcons
2013-09-23 18:42 - 2013-09-22 10:20 - 00000354 _____ C:\Boot.bak
2013-09-23 17:30 - 2013-09-25 17:46 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Malwarebytes' Anti-Malware (portable)
2013-09-22 12:01 - 2013-09-22 12:01 - 00000944 _____ C:\WINDOWS\Tasks\Ad-Aware Antivirus Scheduled Scan.job
2013-09-22 12:00 - 2013-09-22 12:00 - 00000000 ____D C:\Documents and Settings\Owner\Application Data\LavasoftStatistics
2013-09-22 12:00 - 2013-09-22 12:00 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Ad-Aware Antivirus
2013-09-22 11:59 - 2013-09-23 20:28 - 00000000 ____D C:\Program Files\Ad-Aware Antivirus
2013-09-22 11:59 - 2013-09-22 11:59 - 00000000 ____D C:\Program Files\Toolbar Cleaner
2013-09-22 11:59 - 2013-09-22 11:59 - 00000000 ____D C:\Program Files\Lavasoft
2013-09-22 11:59 - 2013-09-22 11:59 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Lavasoft
2013-09-22 11:59 - 2013-09-22 11:59 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Downloaded Installations
2013-09-22 11:57 - 2013-09-22 12:28 - 00000000 ____D C:\Documents and Settings\Owner\Application Data\Ad-Aware Antivirus
2013-09-22 11:57 - 2013-09-22 11:57 - 00044424 _____ (GFI Software) C:\WINDOWS\system32\sbbd.exe
2013-09-22 11:57 - 2013-09-22 11:57 - 00013560 _____ (GFI Software) C:\WINDOWS\system32\Drivers\gfibto.sys
2013-09-22 10:43 - 2013-09-22 10:25 - 00000027 _____ C:\WINDOWS\system32\Drivers\etc\hosts.20130922-104338.backup
2013-09-20 09:46 - 2013-09-20 09:46 - 98487876 _____ C:\WINDOWS\system32\뗈噔6
2013-09-19 16:53 - 2013-09-19 16:54 - 00000000 ____D C:\Documents and Settings\Owner\Desktop\pauls
2013-09-18 11:53 - 2012-04-05 16:06 - 00441368 _____ C:\WINDOWS\system32\Drivers\etc\hosts.20130918-115353.backup
2013-09-18 11:43 - 2012-04-05 16:06 - 00441368 _____ C:\WINDOWS\system32\Drivers\etc\hosts.20130918-114353.backup
2013-09-18 10:39 - 2013-09-18 10:39 - 00000000 ____D C:\Documents and Settings\LocalService\Application Data\Mozilla
2013-09-11 19:31 - 2013-09-22 10:44 - 00000000 ____D C:\Documents and Settings\All Users\Start Menu\Programs\SUPERAntiSpyware
2013-09-11 18:45 - 2013-09-11 18:45 - 00000000 ____D C:\Documents and Settings\Owner\Application Data\SUPERAntiSpyware.com
2013-09-11 18:44 - 2013-09-11 18:44 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2013-09-11 17:09 - 2013-09-11 17:09 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-09-11 17:09 - 2013-09-11 17:09 - 00000000 ____D C:\Documents and Settings\Owner\Application Data\Malwarebytes
2013-09-11 17:09 - 2013-09-11 17:09 - 00000000 ____D C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
2013-09-11 17:09 - 2013-09-11 17:09 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Malwarebytes
2013-09-11 17:09 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2013-09-10 20:44 - 2012-04-05 16:06 - 00441368 _____ C:\WINDOWS\system32\Drivers\etc\hosts.20130910-204412.backup
2013-09-10 20:38 - 2013-09-10 20:38 - 97021647 _____ C:\WINDOWS\system32\獎뉪噔6
2013-09-10 19:39 - 2013-09-10 19:39 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2876315$
2013-09-10 19:39 - 2013-09-10 19:39 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2876217$
2013-09-10 19:38 - 2013-09-10 19:39 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2864063$
2013-09-10 14:47 - 2013-08-08 18:56 - 00386560 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\themeui.dll
2013-09-10 14:39 - 2013-09-10 14:39 - 97004533 _____ C:\WINDOWS\system32\熈꘳噔6
2013-09-07 21:34 - 2013-09-07 21:34 - 00000000 ____D C:\Program Files\privoxy
2013-09-07 21:33 - 2013-09-11 11:18 - 00000000 ____D C:\Program Files\Web Protect
2013-09-07 17:45 - 2013-09-07 17:45 - 00000779 _____ C:\Documents and Settings\Owner\Local Settings\Application Data\recently-used.xbel
2013-09-04 18:58 - 2012-04-05 16:06 - 00441368 _____ C:\WINDOWS\system32\Drivers\etc\hosts.20130904-185856.backup
2013-08-28 22:21 - 2013-08-28 22:21 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2834904-v2_WM11$
2013-08-28 10:12 - 2012-04-05 16:06 - 00441368 _____ C:\WINDOWS\system32\Drivers\etc\hosts.20130828-101253.backup

==================== One Month Modified Files and Folders =======

2013-09-25 19:02 - 2013-09-25 19:02 - 01089329 _____ (Farbar) C:\Documents and Settings\Owner\Desktop\FRST.exe
2013-09-25 19:01 - 2013-09-25 17:18 - 00000000 ____D C:\Documents and Settings\Owner\Desktop\fix
2013-09-25 19:01 - 2012-07-15 09:39 - 00000830 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2013-09-25 18:15 - 2013-09-25 18:15 - 00000000 ____D C:\Program Files\ESET
2013-09-25 18:15 - 2013-09-25 18:13 - 02347384 _____ (ESET) C:\Documents and Settings\Owner\Desktop\esetsmartinstaller_enu.exe
2013-09-25 18:10 - 2013-09-25 18:10 - 00001295 _____ C:\Documents and Settings\Owner\Desktop\AdwCleaner[R0].txt
2013-09-25 18:10 - 2013-09-25 18:09 - 00000000 ____D C:\AdwCleaner
2013-09-25 18:09 - 2013-09-25 18:09 - 01042066 _____ C:\Documents and Settings\Owner\Desktop\AdwCleaner.exe
2013-09-25 18:06 - 2013-09-25 18:06 - 00000693 _____ C:\Documents and Settings\Owner\Desktop\JRT.txt
2013-09-25 18:01 - 2013-09-25 18:01 - 00000000 ____D C:\WINDOWS\ERUNT
2013-09-25 17:54 - 2004-08-26 11:02 - 02024127 _____ C:\WINDOWS\WindowsUpdate.log
2013-09-25 17:53 - 2004-08-26 03:58 - 00000159 _____ C:\WINDOWS\wiadebug.log
2013-09-25 17:53 - 2004-08-26 03:58 - 00000049 _____ C:\WINDOWS\wiaservc.log
2013-09-25 17:52 - 2004-08-26 11:08 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2013-09-25 17:51 - 2004-08-26 11:09 - 00000278 ___SH C:\Documents and Settings\Owner\ntuser.ini
2013-09-25 17:51 - 2004-08-26 11:09 - 00000000 ____D C:\Documents and Settings\Owner
2013-09-25 17:51 - 2004-08-26 11:08 - 00032584 _____ C:\WINDOWS\SchedLgU.Txt
2013-09-25 17:50 - 2013-07-18 17:28 - 00000000 ____D C:\Documents and Settings\Owner\Application Data\foobar2000
2013-09-25 17:49 - 2013-09-25 17:49 - 01030038 _____ (Thisisu) C:\Documents and Settings\Owner\Desktop\JRT.exe
2013-09-25 17:48 - 2013-09-25 17:21 - 00000000 ____D C:\Documents and Settings\Owner\Desktop\mbar
2013-09-25 17:46 - 2013-09-23 17:30 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Malwarebytes' Anti-Malware (portable)
2013-09-25 17:18 - 2011-05-22 14:32 - 00000000 ____D C:\Documents and Settings\Owner\Desktop\security
2013-09-25 15:35 - 2013-09-25 14:47 - 00065536 _____ C:\WINDOWS\system32\config\Doctor Web.evt
2013-09-25 14:47 - 2013-09-25 14:47 - 00000000 ____D C:\Documents and Settings\Owner\Doctor Web
2013-09-25 13:14 - 2004-08-26 11:08 - 00000000 __SHD C:\Documents and Settings\NetworkService
2013-09-25 11:12 - 2011-06-24 22:06 - 00042872 _____ C:\Documents and Settings\Owner\Application Data\GDIPFONTCACHEV1.DAT
2013-09-25 11:12 - 2011-05-22 17:36 - 00002489 _____ C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Word.lnk
2013-09-25 09:39 - 2011-05-22 14:37 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2013-09-25 09:36 - 2011-05-24 15:10 - 00000000 ____D C:\Documents and Settings\Owner\Desktop\arc h9-21-13
2013-09-24 22:20 - 2013-09-24 21:48 - 00000000 ____D C:\Documents and Settings\Owner\Desktop\home
2013-09-24 21:57 - 2012-03-20 14:02 - 00043520 ___SH C:\Documents and Settings\Owner\Desktop\Thumbs.db
2013-09-24 21:21 - 2013-09-24 21:21 - 00000000 ____D C:\FRST
2013-09-24 21:13 - 2011-05-22 11:15 - 00000000 ____D C:\Program Files\Java
2013-09-24 14:33 - 2013-08-11 12:41 - 00000000 ____D C:\Documents and Settings\Owner\Desktop\submitted res
2013-09-24 14:33 - 2013-08-11 12:41 - 00000000 ____D C:\Documents and Settings\Owner\Desktop\master res
2013-09-24 11:14 - 2011-05-22 19:45 - 00000000 ____D C:\Documents and Settings\Owner\My Documents\docs
2013-09-24 10:34 - 2004-08-26 03:45 - 00000000 ____D C:\WINDOWS\Help
2013-09-23 22:46 - 2004-08-26 11:01 - 00000000 ____D C:\WINDOWS\system32\Restore
2013-09-23 21:17 - 2013-09-23 22:36 - 00000741 ____R C:\WINDOWS\system32\Drivers\etc\hosts.20130923-223631.backup
2013-09-23 20:42 - 2013-09-23 20:37 - 00000178 ___SH C:\Documents and Settings\Administrator\ntuser.ini
2013-09-23 20:40 - 2013-09-23 20:40 - 00000000 __SHD C:\Documents and Settings\Administrator\PrivacIE
2013-09-23 20:40 - 2013-09-23 20:37 - 00000000 ____D C:\Documents and Settings\Administrator
2013-09-23 20:28 - 2013-09-22 11:59 - 00000000 ____D C:\Program Files\Ad-Aware Antivirus
2013-09-23 19:52 - 2011-05-28 09:44 - 00042872 _____ C:\Documents and Settings\Owner\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2013-09-23 19:46 - 2004-08-26 03:54 - 00192184 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2013-09-23 19:43 - 2011-07-07 11:39 - 00000000 ____D C:\WINDOWS\ERDNT
2013-09-23 19:40 - 2013-09-23 19:40 - 98840431 _____ C:\WINDOWS\system32\琧噔6
2013-09-23 18:50 - 2004-08-26 09:12 - 00000227 _____ C:\WINDOWS\system.ini
2013-09-23 18:42 - 2013-09-23 18:42 - 00000000 _RSHD C:\cmdcons
2013-09-23 18:42 - 2004-08-26 09:12 - 00000354 __RSH C:\boot.ini
2013-09-23 10:16 - 2011-05-24 15:15 - 00000000 ____D C:\Documents and Settings\Owner\Desktop\pdf
2013-09-22 12:28 - 2013-09-22 11:57 - 00000000 ____D C:\Documents and Settings\Owner\Application Data\Ad-Aware Antivirus
2013-09-22 12:01 - 2013-09-22 12:01 - 00000944 _____ C:\WINDOWS\Tasks\Ad-Aware Antivirus Scheduled Scan.job
2013-09-22 12:00 - 2013-09-22 12:00 - 00000000 ____D C:\Documents and Settings\Owner\Application Data\LavasoftStatistics
2013-09-22 12:00 - 2013-09-22 12:00 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Ad-Aware Antivirus
2013-09-22 11:59 - 2013-09-22 11:59 - 00000000 ____D C:\Program Files\Toolbar Cleaner
2013-09-22 11:59 - 2013-09-22 11:59 - 00000000 ____D C:\Program Files\Lavasoft
2013-09-22 11:59 - 2013-09-22 11:59 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Lavasoft
2013-09-22 11:59 - 2013-09-22 11:59 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Downloaded Installations
2013-09-22 11:59 - 2004-08-26 03:54 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared
2013-09-22 11:57 - 2013-09-22 11:57 - 00044424 _____ (GFI Software) C:\WINDOWS\system32\sbbd.exe
2013-09-22 11:57 - 2013-09-22 11:57 - 00013560 _____ (GFI Software) C:\WINDOWS\system32\Drivers\gfibto.sys
2013-09-22 11:45 - 2011-05-22 15:04 - 00000000 ____D C:\WINDOWS\system32\NtmsData
2013-09-22 10:45 - 2004-08-26 11:01 - 00000000 ____D C:\WINDOWS\Registration
2013-09-22 10:44 - 2013-09-11 19:31 - 00000000 ____D C:\Documents and Settings\All Users\Start Menu\Programs\SUPERAntiSpyware
2013-09-22 10:29 - 2011-07-05 21:45 - 00000000 ____D C:\Program Files\CleanUp!
2013-09-22 10:25 - 2013-09-22 10:43 - 00000027 _____ C:\WINDOWS\system32\Drivers\etc\hosts.20130922-104338.backup
2013-09-22 10:20 - 2013-09-23 18:42 - 00000354 _____ C:\Boot.bak
2013-09-20 19:48 - 2012-02-14 13:10 - 00000000 ____D C:\Documents and Settings\Owner\Desktop\jobs
2013-09-20 09:46 - 2013-09-20 09:46 - 98487876 _____ C:\WINDOWS\system32\뗈噔6
2013-09-19 16:54 - 2013-09-19 16:53 - 00000000 ____D C:\Documents and Settings\Owner\Desktop\pauls
2013-09-18 22:11 - 2013-08-16 20:13 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-09-18 10:39 - 2013-09-18 10:39 - 00000000 ____D C:\Documents and Settings\LocalService\Application Data\Mozilla
2013-09-18 09:00 - 2004-08-26 09:12 - 00001170 _____ C:\WINDOWS\system32\wpa.dbl
2013-09-11 18:45 - 2013-09-11 18:45 - 00000000 ____D C:\Documents and Settings\Owner\Application Data\SUPERAntiSpyware.com
2013-09-11 18:44 - 2013-09-11 18:44 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2013-09-11 18:20 - 2011-05-22 16:12 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB930178$
2013-09-11 17:09 - 2013-09-11 17:09 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-09-11 17:09 - 2013-09-11 17:09 - 00000000 ____D C:\Documents and Settings\Owner\Application Data\Malwarebytes
2013-09-11 17:09 - 2013-09-11 17:09 - 00000000 ____D C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
2013-09-11 17:09 - 2013-09-11 17:09 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Malwarebytes
2013-09-11 11:18 - 2013-09-07 21:33 - 00000000 ____D C:\Program Files\Web Protect
2013-09-11 07:47 - 2011-06-16 13:35 - 00002347 _____ C:\Documents and Settings\All Users\Start Menu\Programs\Adobe Reader X.lnk
2013-09-11 07:47 - 2011-05-22 19:43 - 00000000 ____D C:\Program Files\Common Files\Adobe
2013-09-10 20:38 - 2013-09-10 20:38 - 97021647 _____ C:\WINDOWS\system32\獎뉪噔6
2013-09-10 19:40 - 2011-05-22 16:20 - 00000000 ____D C:\WINDOWS\ie8updates
2013-09-10 19:39 - 2013-09-10 19:39 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2876315$
2013-09-10 19:39 - 2013-09-10 19:39 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2876217$
2013-09-10 19:39 - 2013-09-10 19:38 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2864063$
2013-09-10 19:36 - 2013-08-06 21:16 - 00000000 ____D C:\WINDOWS\system32\MRT
2013-09-10 19:33 - 2011-05-22 16:17 - 76725432 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2013-09-10 14:39 - 2013-09-10 14:39 - 97004533 _____ C:\WINDOWS\system32\熈꘳噔6
2013-09-10 12:01 - 2012-03-31 09:50 - 00692616 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerApp.exe
2013-09-10 12:01 - 2011-05-23 10:24 - 00071048 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerCPLApp.cpl
2013-09-07 21:34 - 2013-09-07 21:34 - 00000000 ____D C:\Program Files\privoxy
2013-09-07 17:45 - 2013-09-07 17:45 - 00000779 _____ C:\Documents and Settings\Owner\Local Settings\Application Data\recently-used.xbel
2013-09-07 17:45 - 2013-07-13 12:56 - 00000000 ____D C:\Documents and Settings\Owner\Local Settings\Application Data\mypaint
2013-09-07 15:58 - 2011-05-22 20:58 - 00000049 _____ C:\WINDOWS\NeroDigital.ini
2013-09-06 08:10 - 2011-06-02 23:02 - 00002284 _____ C:\Documents and Settings\Owner\Desktop\Google Chrome.lnk
2013-09-05 09:00 - 2012-10-10 13:20 - 00088840 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avgntflt.sys
2013-09-04 18:33 - 2011-05-22 15:33 - 00000000 ____D C:\Program Files\CCleaner
2013-09-04 18:02 - 2011-06-05 19:43 - 00000000 ____D C:\Documents and Settings\Owner\Application Data\Mozilla
2013-08-29 06:42 - 2012-10-10 13:20 - 00136672 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avipbb.sys
2013-08-28 22:21 - 2013-08-28 22:21 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2834904-v2_WM11$
2013-08-27 22:22 - 2011-12-21 17:44 - 00000000 ____D C:\Documents and Settings\Owner\Application Data\Skype

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== End Of Log ============================

 

[AdvancedSetup]

Overall looks much better now.

 

How is the computer running now?

Are there still any signs of an infection?

 

Please download Security Check from here or here.

• Save it to your Desktop.
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.
  

 

[hdk]

Computer's running the same as it was after the initial "clean" I posted the other day. Still have the windows error message after startup but no proxy issues. Should I unintstall the various check programs? Thanks again for your help.

 

 Results of screen317's Security Check version 0.99.73  
 Windows XP Service Pack 3 x86   
 Internet Explorer 8  
``````````````Antivirus/Firewall Check:``````````````
 Windows Firewall Enabled!  
 Avira Free Antivirus    
 ESET Online Scanner v3   
 Avira successfully updated!
`````````Anti-malware/Other Utilities Check:`````````
 Spybot - Search & Destroy
 Malwarebytes Anti-Malware version 1.75.0.1300  
 CCleaner     
 Adobe Flash Player     11.8.800.168  
 Adobe Reader 10.1.8 Adobe Reader out of Date!  
 Mozilla Firefox (23.0.1)
````````Process Check: objlist.exe by Laurent````````  
 Avira Antivir avgnt.exe
 Avira Antivir avguard.exe
`````````````````System Health check`````````````````
 Total Fragmentation on Drive C:: 3%
````````````````````End of Log``````````````````````
 

[AdvancedSetup]

Please update your Adobe Reader.  Then show me a screen shot of the error message you're seeing and also please point out where you're seeing a proxy change

 

Thanks

[hdk]

the original problem was a forced proxy from the malware. It was evident in the internet options/connections/lan where it was forcing a proxy and the options were grayed out and not changeable. IE and Chrome would not find the internet. That is no longer the case.

 

See attached for error message after startup.

[AdvancedSetup]

I think this one is from your Seagate Free Agent application.

 

If you click on that link it will provide a path to the files that they want to upload to Microsoft.  You can upload them here and we can take a look at them too.

 

You could try reinstalling that application and see if that corrects it or not.