Jump to content

Unsure if infected - would someone mind taking a look at these logs?


Recommended Posts

I'm trying to help a friend of the family determine if his PC is infected with any viruses/malware. It is an older machine running Windows XP (with SP3). The machine is having several problems, including being unable to run its Norton Security Suite installation.

I was able to install Malwarebytes, but it would not update in XP's Normal mode. I received the message "program_error_updating (0, 0, I/O error". I was able to boot into Safe Mode with Networking, and successfully updated Malwarebytes with the latest definitions. I ran scans in both Safe and Normal modes, and the program said no malicious items were found.

Before I get into any involved Windows troubleshooting, would someone mind taking a look at the two DDS logs? I can also attach the Malwarebytes scan logs if necessary.

Many thanks! Please let me know if I need to provide any more information, about either the PC or the symptoms.

----------

DDS (Ver_2012-11-20.01) - NTFS_x86

Internet Explorer: 6.0.2900.5512

Run by Arliss at 23:05:26 on 2013-10-03

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.767.388 [GMT -5:00]

.

AV: Norton Security Suite *Enabled/Updated* {E10A9785-9598-4754-B552-92431C1C35F8}

FW: Norton Security Suite *Enabled*

.

============== Running Processes ================

.

C:\windows\system32\spoolsv.exe

C:\windows\Explorer.EXE

C:\Program Files\Analog Devices\SoundMAX\Smax4.exe

C:\Program Files\Microsoft IntelliType Pro\type32.exe

C:\Program Files\Microsoft IntelliPoint\point32.exe

C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe

C:\windows\RTHDCPL.EXE

C:\Program Files\Epson Software\Event Manager\EEventManager.exe

C:\windows\system32\ctfmon.exe

C:\windows\system32\CTsvcCDA.exe

C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe

C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

C:\windows\System32\alg.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\windows\system32\wbem\wmiprvse.exe

C:\windows\System32\svchost.exe -k netsvcs

C:\windows\system32\svchost.exe -k NetworkService

C:\windows\system32\svchost.exe -k LocalService

C:\windows\system32\svchost.exe -k LocalService

C:\windows\system32\svchost.exe -k imgsvc

C:\windows\System32\svchost.exe -k HTTPFilter

.

============== Pseudo HJT Report ===============

.

uProxyOverride = <local>

BHO: Symantec NCO BHO: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - c:\program files\norton security suite\engine\4.4.0.12\coieplg.dll

BHO: Symantec Intrusion Prevention: {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - c:\program files\norton security suite\engine\4.4.0.12\ipsbho.dll

TB: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - c:\program files\norton security suite\engine\4.4.0.12\coieplg.dll

TB: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - c:\program files\norton security suite\engine\4.4.0.12\coieplg.dll

uRun: [EPSON NX125 NX127 Series] c:\windows\system32\spool\drivers\w32x86\3\e_fatigga.exe /fu "c:\windows\temp\E_SC.tmp" /EF "HKCU"

uRun: [Download] "c:\documents and settings\arliss\local settings\application data\supportsoft\ddoctorv2\arliss\ssGet.exe" 120 "http://pcmctbc.cmc.motive.com/motivedocs/EasySolveInstaller.exe" "EasySolveInstaller.exe"

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

mRun: [soundMAXPnP] c:\program files\analog devices\core\smax4pnp.exe

mRun: [soundMAX] "c:\program files\analog devices\soundmax\Smax4.exe" /tray

mRun: [type32] "c:\program files\microsoft intellitype pro\type32.exe"

mRun: [intelliPoint] "c:\program files\microsoft intellipoint\point32.exe"

mRun: [ddoctorv2] "c:\program files\comcast\desktop doctor\bin\sprtcmd.exe" /P ddoctorv2

mRun: [RTHDCPL] RTHDCPL.EXE

mRun: [EEventManager] "c:\program files\epson software\event manager\EEventManager.exe"

StartupFolder: c:\docume~1\arliss\startm~1\programs\startup\epsona~1.lnk - g:\common\epsonreg\EpsonReg.exe

uPolicies-Explorer: NoDriveTypeAutoRun = dword:145

mPolicies-Windows\System: Allow-LogonScript-NetbiosDisabled = dword:1

mPolicies-Explorer: NoDriveTypeAutoRun = dword:145

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

TCP: NameServer = 192.168.1.1

TCP: Interfaces\{DB5CB3D8-4286-4492-98D2-D14E66CCB12C} : DHCPNameServer = 192.168.1.1

.

============= SERVICES / DRIVERS ===============

.

R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\n360\0404000.00c\symds.sys [2012-1-31 328752]

R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\n360\0404000.00c\symefa.sys [2012-1-31 173176]

R1 BHDrvx86;BHDrvx86;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\n360_4.0.0.127\definitions\bashdefs\20120215.001\BHDrvx86.sys [2012-2-17 820344]

R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\n360\0404000.00c\cchpx86.sys [2012-1-31 485512]

R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\n360\0404000.00c\ironx86.sys [2012-1-31 116784]

R3 IDSxpx86;IDSxpx86;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\n360_4.0.0.127\definitions\ipsdefs\20120302.002\IDSXpx86.sys [2012-3-2 356280]

S2 0040591294192944mcinstcleanup;McAfee Application Installer Cleanup (0040591294192944);c:\docume~1\arliss\locals~1\temp\004059~1.exe c:\progra~1\common~1\mcafee\instal~1\cleanup.ini -cleanup -nolog -service --> c:\docume~1\arliss\locals~1\temp\004059~1.exe c:\progra~1\common~1\mcafee\instal~1\cleanup.ini -cleanup -nolog -service [?]

S2 N360;Norton Security Suite;c:\program files\norton security suite\engine\4.4.0.12\ccsvchst.exe [2012-1-31 126400]

S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [2009-12-27 1684736]

S3 EraserUtilDrvI10;EraserUtilDrvI10;\??\c:\program files\common files\symantec shared\eengine\eraserutildrvi10.sys --> c:\program files\common files\symantec shared\eengine\EraserUtilDrvI10.sys [?]

S3 MSICDSetup;MSICDSetup;\??\g:\cdriver.sys --> g:\CDriver.sys [?]

S3 NAVENG;NAVENG;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\n360_4.0.0.127\definitions\virusdefs\20120302.002\NAVENG.SYS [2012-3-2 86136]

S3 NAVEX15;NAVEX15;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\n360_4.0.0.127\definitions\virusdefs\20120302.002\NAVEX15.SYS [2012-3-2 1576312]

.

=============== Created Last 30 ================

.

2013-10-04 01:37:46 22856 ----a-w- c:\windows\system32\drivers\mbam.sys

2013-10-03 23:44:17 1072544 ----a-w- c:\windows\system32\nvdrsdb1.bin

2013-10-03 23:44:17 1072544 ----a-w- c:\windows\system32\nvdrsdb0.bin

2013-10-03 23:44:17 1 ----a-w- c:\windows\system32\nvdrssel.bin

2013-10-03 23:21:29 -------- d-----w- c:\program files\NVIDIA Corporation

2013-09-10 22:19:32 2452872 -c----w- c:\windows\system32\dllcache\ieapfltr.dat

2013-09-10 22:19:31 63488 -c----w- c:\windows\system32\dllcache\icardie.dll

2013-09-10 22:19:31 380928 -c----w- c:\windows\system32\dllcache\ieapfltr.dll

2013-09-10 22:19:31 13824 -c----w- c:\windows\system32\dllcache\ieudinit.exe

2013-09-10 21:21:40 -------- d-sh--w- c:\documents and settings\arliss\IECompatCache

2013-09-10 21:21:22 -------- d-sh--w- c:\documents and settings\arliss\PrivacIE

2013-09-10 21:20:40 -------- d-sh--w- c:\documents and settings\arliss\IETldCache

2013-09-10 21:17:34 -------- d-----w- c:\windows\ie8updates

2013-09-10 21:16:23 78336 -c--a-w- c:\windows\system32\dllcache\ieencode.dll

2013-09-10 21:16:23 78336 ----a-w- c:\windows\system32\ieencode.dll

2013-09-10 21:11:39 522240 -c----w- c:\windows\system32\dllcache\jsdbgui.dll

2013-09-10 21:11:18 6144 -c----w- c:\windows\system32\dllcache\iecompat.dll

2013-09-10 21:11:17 630272 -c----w- c:\windows\system32\dllcache\msfeeds.dll

2013-09-10 21:11:17 55296 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll

2013-09-10 21:11:17 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll

2013-09-10 21:11:16 743424 -c----w- c:\windows\system32\dllcache\iedvtool.dll

2013-09-10 21:11:16 247808 -c----w- c:\windows\system32\dllcache\ieproxy.dll

2013-09-10 21:11:15 2006016 -c----w- c:\windows\system32\dllcache\iertutil.dll

2013-09-10 21:11:14 11113472 -c----w- c:\windows\system32\dllcache\ieframe.dll

.

==================== Find3M ====================

.

2013-08-09 01:56:45 386560 ----a-w- c:\windows\system32\themeui.dll

2013-08-08 01:27:48 1877760 ----a-w- c:\windows\system32\win32k.sys

2013-08-05 13:30:32 1289728 ----a-w- c:\windows\system32\ole32.dll

2013-08-02 17:18:57 17408 ----a-w- c:\windows\system32\corpol.dll

2013-08-01 04:17:51 668672 ----a-w- c:\windows\system32\wininet.dll

2013-08-01 04:17:51 61952 ----a-w- c:\windows\system32\tdc.ocx

2013-07-31 20:11:22 810496 ----a-w- c:\windows\system32\wmvdmod.dll

2013-07-10 10:37:53 406016 ----a-w- c:\windows\system32\usp10.dll

.

============= FINISH: 23:05:45.76 ===============

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2012-11-20.01)

.

Microsoft Windows XP Home Edition

Boot Device: \Device\HarddiskVolume1

Install Date: 12/26/2009 12:05:33 PM

System Uptime: 10/3/2013 10:53:06 PM (1 hours ago)

.

Motherboard: MSI | | K9N6PGM2-V2 (MS-7309)

Processor: AMD Athlon 64 X2 Dual Core Processor 3800+ | CPU1 | 2009/200mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 47 GiB total, 35.678 GiB free.

D: is FIXED (NTFS) - 47 GiB total, 46.874 GiB free.

E: is FIXED (NTFS) - 47 GiB total, 46.159 GiB free.

F: is FIXED (NTFS) - 48 GiB total, 47.24 GiB free.

G: is CDROM ()

.

==== Disabled Device Manager Items =============

.

Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}

Description: NVIDIA nForce Networking Controller

Device ID: {1A3E09BE-1E45-494B-9174-D7385B45BBF5}\NVNET_DEV03EF\4&16787711&0&00

Manufacturer: NVIDIA

Name: NVIDIA nForce 10/100 Mbps Ethernet

PNP Device ID: {1A3E09BE-1E45-494B-9174-D7385B45BBF5}\NVNET_DEV03EF\4&16787711&0&00

Service: NVENETFD

.

==== System Restore Points ===================

.

RP299: 7/13/2013 10:47:12 PM - Software Distribution Service 3.0

RP300: 7/14/2013 10:53:38 AM - Software Distribution Service 3.0

RP301: 7/15/2013 4:11:29 PM - Software Distribution Service 3.0

RP302: 7/15/2013 4:21:43 PM - Software Distribution Service 3.0

RP303: 7/16/2013 9:20:13 PM - Software Distribution Service 3.0

RP304: 7/16/2013 9:58:09 PM - Software Distribution Service 3.0

RP305: 7/17/2013 12:55:39 PM - Software Distribution Service 3.0

RP306: 7/17/2013 2:22:06 PM - Software Distribution Service 3.0

RP307: 7/18/2013 9:28:52 AM - Software Distribution Service 3.0

RP308: 7/19/2013 7:32:28 AM - Software Distribution Service 3.0

RP309: 7/20/2013 7:40:07 PM - Software Distribution Service 3.0

RP310: 7/20/2013 8:12:40 PM - Software Distribution Service 3.0

RP311: 7/20/2013 10:50:22 PM - Software Distribution Service 3.0

RP312: 7/21/2013 6:52:04 PM - Software Distribution Service 3.0

RP313: 7/21/2013 10:27:09 PM - Software Distribution Service 3.0

RP314: 7/22/2013 11:22:55 AM - Software Distribution Service 3.0

RP315: 7/22/2013 10:08:56 PM - Software Distribution Service 3.0

RP316: 7/23/2013 2:10:23 PM - Software Distribution Service 3.0

RP317: 7/23/2013 10:57:57 PM - Software Distribution Service 3.0

RP318: 7/24/2013 10:40:20 AM - Software Distribution Service 3.0

RP319: 7/24/2013 11:15:07 PM - Software Distribution Service 3.0

RP320: 7/25/2013 9:24:09 PM - Software Distribution Service 3.0

RP321: 7/26/2013 11:21:10 AM - Software Distribution Service 3.0

RP322: 7/26/2013 8:18:04 PM - Software Distribution Service 3.0

RP323: 7/27/2013 3:10:31 PM - Software Distribution Service 3.0

RP324: 7/27/2013 10:47:17 PM - Software Distribution Service 3.0

RP325: 7/28/2013 11:00:05 AM - Software Distribution Service 3.0

RP326: 7/28/2013 11:00:58 PM - Software Distribution Service 3.0

RP327: 7/29/2013 11:05:50 PM - Software Distribution Service 3.0

RP328: 7/30/2013 11:02:23 AM - Software Distribution Service 3.0

RP329: 7/30/2013 10:43:40 PM - Software Distribution Service 3.0

RP330: 7/31/2013 1:52:40 PM - Software Distribution Service 3.0

RP331: 7/31/2013 6:40:47 PM - Software Distribution Service 3.0

RP332: 7/31/2013 10:26:18 PM - Software Distribution Service 3.0

RP333: 8/1/2013 2:22:28 PM - Software Distribution Service 3.0

RP334: 8/1/2013 9:20:45 PM - Software Distribution Service 3.0

RP335: 8/2/2013 11:13:35 AM - Software Distribution Service 3.0

RP336: 8/2/2013 10:17:19 PM - Software Distribution Service 3.0

RP337: 8/3/2013 1:49:59 PM - Software Distribution Service 3.0

RP338: 8/4/2013 4:49:44 PM - Software Distribution Service 3.0

RP339: 8/4/2013 10:55:06 PM - Software Distribution Service 3.0

RP340: 8/5/2013 5:34:18 PM - Software Distribution Service 3.0

RP341: 8/5/2013 10:24:52 PM - Software Distribution Service 3.0

RP342: 8/6/2013 9:48:56 PM - Software Distribution Service 3.0

RP343: 8/7/2013 8:31:39 PM - Software Distribution Service 3.0

RP344: 8/7/2013 10:15:09 PM - Software Distribution Service 3.0

RP345: 8/8/2013 11:11:17 AM - Software Distribution Service 3.0

RP346: 8/8/2013 9:38:07 PM - Software Distribution Service 3.0

RP347: 8/9/2013 6:56:10 PM - Software Distribution Service 3.0

RP348: 8/10/2013 1:11:41 PM - Software Distribution Service 3.0

RP349: 8/10/2013 10:59:37 PM - Software Distribution Service 3.0

RP350: 8/11/2013 9:45:56 PM - Software Distribution Service 3.0

RP351: 8/12/2013 12:55:20 PM - Software Distribution Service 3.0

RP352: 8/12/2013 9:33:10 PM - Software Distribution Service 3.0

RP353: 8/13/2013 9:53:48 AM - Software Distribution Service 3.0

RP354: 8/15/2013 9:23:24 AM - System Checkpoint

RP355: 8/15/2013 11:39:37 AM - Software Distribution Service 3.0

RP356: 8/17/2013 10:59:59 AM - Software Distribution Service 3.0

RP357: 8/17/2013 11:53:37 AM - Software Distribution Service 3.0

RP358: 8/17/2013 11:26:37 PM - Software Distribution Service 3.0

RP359: 8/18/2013 10:51:51 AM - Software Distribution Service 3.0

RP360: 8/18/2013 11:49:47 PM - Software Distribution Service 3.0

RP361: 8/19/2013 9:43:08 PM - Software Distribution Service 3.0

RP362: 8/20/2013 10:20:31 PM - Software Distribution Service 3.0

RP363: 8/21/2013 3:19:49 PM - Software Distribution Service 3.0

RP364: 8/21/2013 8:02:25 PM - Software Distribution Service 3.0

RP365: 8/23/2013 10:04:56 PM - Software Distribution Service 3.0

RP366: 8/23/2013 10:19:06 PM - Software Distribution Service 3.0

RP367: 8/24/2013 12:40:59 PM - Software Distribution Service 3.0

RP368: 8/24/2013 9:38:23 PM - Software Distribution Service 3.0

RP369: 8/24/2013 10:08:47 PM - Software Distribution Service 3.0

RP370: 8/25/2013 9:51:09 PM - Software Distribution Service 3.0

RP371: 8/26/2013 12:39:55 PM - Software Distribution Service 3.0

RP372: 8/26/2013 10:45:46 PM - Software Distribution Service 3.0

RP373: 8/27/2013 11:02:40 AM - Software Distribution Service 3.0

RP374: 8/27/2013 10:47:56 PM - Software Distribution Service 3.0

RP375: 8/28/2013 10:45:44 PM - Software Distribution Service 3.0

RP376: 8/29/2013 11:19:36 PM - Software Distribution Service 3.0

RP377: 8/30/2013 1:57:06 PM - Software Distribution Service 3.0

RP378: 8/31/2013 11:43:56 AM - Software Distribution Service 3.0

RP379: 8/31/2013 7:21:40 PM - Software Distribution Service 3.0

RP380: 8/31/2013 10:15:09 PM - Software Distribution Service 3.0

RP381: 9/2/2013 11:17:41 AM - Software Distribution Service 3.0

RP382: 9/2/2013 10:56:09 PM - Software Distribution Service 3.0

RP383: 9/3/2013 12:47:41 PM - Software Distribution Service 3.0

RP384: 9/3/2013 10:34:38 PM - Software Distribution Service 3.0

RP385: 9/4/2013 10:47:31 PM - Software Distribution Service 3.0

RP386: 9/5/2013 10:35:56 PM - Software Distribution Service 3.0

RP387: 9/6/2013 4:43:36 PM - Software Distribution Service 3.0

RP388: 9/6/2013 11:35:27 PM - Software Distribution Service 3.0

RP389: 9/8/2013 8:59:01 PM - Software Distribution Service 3.0

RP390: 9/9/2013 4:57:04 PM - Software Distribution Service 3.0

RP391: 9/10/2013 4:12:15 PM - Software Distribution Service 3.0

RP392: 9/10/2013 4:16:35 PM - Installed Windows Internet Explorer 8.

RP393: 9/10/2013 4:17:04 PM - Software Distribution Service 3.0

RP394: 9/10/2013 5:22:56 PM - Installed Windows XP KB915865.

RP395: 9/10/2013 5:23:26 PM - Installed Windows NLSDownlevelMapping.

RP396: 9/10/2013 5:23:39 PM - Installed Windows IDNMitigationAPIs.

RP397: 9/10/2013 5:24:02 PM - Installed Windows Internet Explorer 7.

RP398: 9/10/2013 5:24:27 PM - Software Distribution Service 3.0

RP399: 9/10/2013 8:00:46 PM - Software Distribution Service 3.0

RP400: 9/11/2013 10:51:37 PM - Software Distribution Service 3.0

RP401: 9/17/2013 10:41:15 PM - Software Distribution Service 3.0

RP402: 9/18/2013 1:25:32 PM - Software Distribution Service 3.0

RP403: 9/18/2013 11:11:42 PM - Software Distribution Service 3.0

RP404: 9/20/2013 7:58:16 AM - Software Distribution Service 3.0

RP405: 9/21/2013 8:14:58 AM - Software Distribution Service 3.0

RP406: 9/21/2013 9:01:27 AM - Software Distribution Service 3.0

RP407: 9/21/2013 11:06:44 PM - Software Distribution Service 3.0

RP408: 9/22/2013 9:42:35 PM - Software Distribution Service 3.0

RP409: 9/23/2013 10:48:23 PM - Software Distribution Service 3.0

RP410: 9/24/2013 10:56:29 AM - Software Distribution Service 3.0

RP411: 9/25/2013 12:02:48 AM - Software Distribution Service 3.0

RP412: 9/25/2013 3:46:06 PM - Software Distribution Service 3.0

RP413: 9/25/2013 11:12:57 PM - Software Distribution Service 3.0

RP414: 9/26/2013 2:14:03 PM - Software Distribution Service 3.0

RP415: 9/26/2013 11:06:46 PM - Software Distribution Service 3.0

RP416: 9/27/2013 11:45:21 PM - Software Distribution Service 3.0

RP417: 9/28/2013 12:10:42 PM - Software Distribution Service 3.0

RP418: 9/29/2013 7:35:42 PM - Software Distribution Service 3.0

RP419: 9/29/2013 10:16:15 PM - Software Distribution Service 3.0

RP420: 9/30/2013 10:39:07 PM - Software Distribution Service 3.0

RP421: 10/1/2013 10:24:22 AM - Software Distribution Service 3.0

RP422: 10/1/2013 10:52:21 PM - Software Distribution Service 3.0

RP423: 10/2/2013 11:17:26 PM - Software Distribution Service 3.0

RP424: 10/3/2013 3:18:03 PM - Software Distribution Service 3.0

RP425: 10/3/2013 6:20:52 PM - Software Distribution Service 3.0

RP426: 10/3/2013 6:43:16 PM - Software Distribution Service 3.0

RP427: 10/3/2013 8:11:01 PM - Unsigned driver install

.

==== Installed Programs ======================

.

Adobe Download Manager

Adobe Flash Player 11 ActiveX

Athlon 64 Processor Driver

Creative MediaSource 5

Creative Software AutoUpdate

D-Link DFE-530TX+

D-Link PCI Fast Ethernet Adapter

Desktop Doctor

Download Updater (AOL LLC)

Epson Event Manager

EPSON NX125 NX127 Series Printer Uninstall

EPSON Scan

High Definition Audio Driver Package - KB888111

HijackThis 1.99.1

Hotfix for Windows XP (KB2158563)

Hotfix for Windows XP (KB2443685)

Hotfix for Windows XP (KB2570791)

Hotfix for Windows XP (KB2633952)

Hotfix for Windows XP (KB2756822)

Hotfix for Windows XP (KB2779562)

Hotfix for Windows XP (KB915865)

Hotfix for Windows XP (KB952287)

Hotfix for Windows XP (KB976098-v2)

Hotfix for Windows XP (KB979306)

Hotfix for Windows XP (KB981793)

Malwarebytes Anti-Malware version 1.75.0.1300

Microsoft IntelliPoint 5.2

Microsoft IntelliType Pro 5.2

Microsoft Internationalized Domain Names Mitigation APIs

Microsoft Kernel-Mode Driver Framework Feature Pack 1.5

Microsoft National Language Support Downlevel APIs

Microsoft Visual C++ 2005 Redistributable

MSN

Norton Security Suite

NVIDIA Drivers

PhotoMail Maker

Realtek High Definition Audio Driver

Security Update for Microsoft Windows (KB2564958)

Security Update for Windows Media Player (KB2378111)

Security Update for Windows Media Player (KB2803821-v2)

Security Update for Windows Media Player (KB2803821)

Security Update for Windows Media Player (KB952069)

Security Update for Windows Media Player (KB954155)

Security Update for Windows Media Player (KB968816)

Security Update for Windows Media Player (KB973540)

Security Update for Windows Media Player (KB975558)

Security Update for Windows Media Player (KB978695)

Security Update for Windows Media Player (KB979402)

Security Update for Windows XP (KB2079403)

Security Update for Windows XP (KB2115168)

Security Update for Windows XP (KB2121546)

Security Update for Windows XP (KB2160329)

Security Update for Windows XP (KB2183461)

Security Update for Windows XP (KB2229593)

Security Update for Windows XP (KB2259922)

Security Update for Windows XP (KB2279986)

Security Update for Windows XP (KB2286198)

Security Update for Windows XP (KB2296011)

Security Update for Windows XP (KB2296199)

Security Update for Windows XP (KB2347290)

Security Update for Windows XP (KB2360131)

Security Update for Windows XP (KB2360937)

Security Update for Windows XP (KB2387149)

Security Update for Windows XP (KB2393802)

Security Update for Windows XP (KB2412687)

Security Update for Windows XP (KB2416400)

Security Update for Windows XP (KB2419632)

Security Update for Windows XP (KB2423089)

Security Update for Windows XP (KB2436673)

Security Update for Windows XP (KB2440591)

Security Update for Windows XP (KB2443105)

Security Update for Windows XP (KB2476490)

Security Update for Windows XP (KB2476687)

Security Update for Windows XP (KB2478960)

Security Update for Windows XP (KB2478971)

Security Update for Windows XP (KB2479628)

Security Update for Windows XP (KB2479943)

Security Update for Windows XP (KB2481109)

Security Update for Windows XP (KB2482017)

Security Update for Windows XP (KB2483185)

Security Update for Windows XP (KB2485376)

Security Update for Windows XP (KB2485663)

Security Update for Windows XP (KB2497640)

Security Update for Windows XP (KB2503658)

Security Update for Windows XP (KB2503665)

Security Update for Windows XP (KB2506212)

Security Update for Windows XP (KB2506223)

Security Update for Windows XP (KB2507618)

Security Update for Windows XP (KB2507938)

Security Update for Windows XP (KB2508272)

Security Update for Windows XP (KB2508429)

Security Update for Windows XP (KB2509553)

Security Update for Windows XP (KB2510581)

Security Update for Windows XP (KB2511455)

Security Update for Windows XP (KB2524375)

Security Update for Windows XP (KB2530548)

Security Update for Windows XP (KB2535512)

Security Update for Windows XP (KB2536276-v2)

Security Update for Windows XP (KB2536276)

Security Update for Windows XP (KB2544521)

Security Update for Windows XP (KB2544893-v2)

Security Update for Windows XP (KB2544893)

Security Update for Windows XP (KB2555917)

Security Update for Windows XP (KB2559049)

Security Update for Windows XP (KB2562937)

Security Update for Windows XP (KB2566454)

Security Update for Windows XP (KB2567053)

Security Update for Windows XP (KB2567680)

Security Update for Windows XP (KB2570222)

Security Update for Windows XP (KB2570947)

Security Update for Windows XP (KB2584146)

Security Update for Windows XP (KB2585542)

Security Update for Windows XP (KB2586448)

Security Update for Windows XP (KB2592799)

Security Update for Windows XP (KB2598479)

Security Update for Windows XP (KB2603381)

Security Update for Windows XP (KB2618444)

Security Update for Windows XP (KB2618451)

Security Update for Windows XP (KB2619339)

Security Update for Windows XP (KB2620712)

Security Update for Windows XP (KB2621440)

Security Update for Windows XP (KB2624667)

Security Update for Windows XP (KB2631813)

Security Update for Windows XP (KB2633171)

Security Update for Windows XP (KB2639417)

Security Update for Windows XP (KB2641653)

Security Update for Windows XP (KB2646524)

Security Update for Windows XP (KB2647516)

Security Update for Windows XP (KB2647518)

Security Update for Windows XP (KB2653956)

Security Update for Windows XP (KB2655992)

Security Update for Windows XP (KB2659262)

Security Update for Windows XP (KB2660465)

Security Update for Windows XP (KB2661637)

Security Update for Windows XP (KB2675157)

Security Update for Windows XP (KB2676562)

Security Update for Windows XP (KB2685939)

Security Update for Windows XP (KB2686509)

Security Update for Windows XP (KB2691442)

Security Update for Windows XP (KB2695962)

Security Update for Windows XP (KB2698365)

Security Update for Windows XP (KB2699988)

Security Update for Windows XP (KB2705219)

Security Update for Windows XP (KB2707511)

Security Update for Windows XP (KB2709162)

Security Update for Windows XP (KB2712808)

Security Update for Windows XP (KB2718523)

Security Update for Windows XP (KB2719985)

Security Update for Windows XP (KB2722913)

Security Update for Windows XP (KB2723135)

Security Update for Windows XP (KB2724197)

Security Update for Windows XP (KB2727528)

Security Update for Windows XP (KB2731847)

Security Update for Windows XP (KB2744842)

Security Update for Windows XP (KB2753842-v2)

Security Update for Windows XP (KB2753842)

Security Update for Windows XP (KB2757638)

Security Update for Windows XP (KB2758857)

Security Update for Windows XP (KB2761226)

Security Update for Windows XP (KB2761465)

Security Update for Windows XP (KB2770660)

Security Update for Windows XP (KB2778344)

Security Update for Windows XP (KB2779030)

Security Update for Windows XP (KB2780091)

Security Update for Windows XP (KB2792100)

Security Update for Windows XP (KB2797052)

Security Update for Windows XP (KB2799329)

Security Update for Windows XP (KB2799494)

Security Update for Windows XP (KB2802968)

Security Update for Windows XP (KB2807986)

Security Update for Windows XP (KB2808735)

Security Update for Windows XP (KB2809289)

Security Update for Windows XP (KB2813170)

Security Update for Windows XP (KB2813345)

Security Update for Windows XP (KB2817183)

Security Update for Windows XP (KB2820197)

Security Update for Windows XP (KB2820917)

Security Update for Windows XP (KB2829361)

Security Update for Windows XP (KB2829530)

Security Update for Windows XP (KB2834886)

Security Update for Windows XP (KB2838727)

Security Update for Windows XP (KB2839229)

Security Update for Windows XP (KB2845187)

Security Update for Windows XP (KB2846071)

Security Update for Windows XP (KB2849470)

Security Update for Windows XP (KB2850851)

Security Update for Windows XP (KB2850869)

Security Update for Windows XP (KB2859537)

Security Update for Windows XP (KB2862772)

Security Update for Windows XP (KB2864063)

Security Update for Windows XP (KB2870699)

Security Update for Windows XP (KB2876217)

Security Update for Windows XP (KB2876315)

Security Update for Windows XP (KB923561)

Security Update for Windows XP (KB946648)

Security Update for Windows XP (KB950762)

Security Update for Windows XP (KB950974)

Security Update for Windows XP (KB951066)

Security Update for Windows XP (KB951376-v2)

Security Update for Windows XP (KB951748)

Security Update for Windows XP (KB952004)

Security Update for Windows XP (KB952954)

Security Update for Windows XP (KB955069)

Security Update for Windows XP (KB956572)

Security Update for Windows XP (KB956744)

Security Update for Windows XP (KB956802)

Security Update for Windows XP (KB956803)

Security Update for Windows XP (KB956844)

Security Update for Windows XP (KB957097)

Security Update for Windows XP (KB958644)

Security Update for Windows XP (KB958687)

Security Update for Windows XP (KB958869)

Security Update for Windows XP (KB959426)

Security Update for Windows XP (KB960225)

Security Update for Windows XP (KB960803)

Security Update for Windows XP (KB960859)

Security Update for Windows XP (KB961371-v2)

Security Update for Windows XP (KB961501)

Security Update for Windows XP (KB969059)

Security Update for Windows XP (KB969947)

Security Update for Windows XP (KB970238)

Security Update for Windows XP (KB970430)

Security Update for Windows XP (KB971468)

Security Update for Windows XP (KB971486)

Security Update for Windows XP (KB971557)

Security Update for Windows XP (KB971633)

Security Update for Windows XP (KB971657)

Security Update for Windows XP (KB971961)

Security Update for Windows XP (KB972270)

Security Update for Windows XP (KB973354)

Security Update for Windows XP (KB973507)

Security Update for Windows XP (KB973525)

Security Update for Windows XP (KB973869)

Security Update for Windows XP (KB973904)

Security Update for Windows XP (KB974112)

Security Update for Windows XP (KB974318)

Security Update for Windows XP (KB974392)

Security Update for Windows XP (KB974571)

Security Update for Windows XP (KB975025)

Security Update for Windows XP (KB975467)

Security Update for Windows XP (KB975560)

Security Update for Windows XP (KB975561)

Security Update for Windows XP (KB975562)

Security Update for Windows XP (KB975713)

Security Update for Windows XP (KB976325)

Security Update for Windows XP (KB977165)

Security Update for Windows XP (KB977816)

Security Update for Windows XP (KB977914)

Security Update for Windows XP (KB978037)

Security Update for Windows XP (KB978251)

Security Update for Windows XP (KB978262)

Security Update for Windows XP (KB978338)

Security Update for Windows XP (KB978542)

Security Update for Windows XP (KB978601)

Security Update for Windows XP (KB978706)

Security Update for Windows XP (KB979309)

Security Update for Windows XP (KB979482)

Security Update for Windows XP (KB979559)

Security Update for Windows XP (KB979683)

Security Update for Windows XP (KB979687)

Security Update for Windows XP (KB980195)

Security Update for Windows XP (KB980218)

Security Update for Windows XP (KB980232)

Security Update for Windows XP (KB980436)

Security Update for Windows XP (KB981322)

Security Update for Windows XP (KB981349)

Security Update for Windows XP (KB981852)

Security Update for Windows XP (KB981957)

Security Update for Windows XP (KB981997)

Security Update for Windows XP (KB982132)

Security Update for Windows XP (KB982214)

Security Update for Windows XP (KB982381)

Security Update for Windows XP (KB982665)

Security Update for Windows XP (KB982802)

SoundMAX

Update for Windows XP (KB2141007)

Update for Windows XP (KB2345886)

Update for Windows XP (KB2467659)

Update for Windows XP (KB2541763)

Update for Windows XP (KB2607712)

Update for Windows XP (KB2616676)

Update for Windows XP (KB2641690)

Update for Windows XP (KB2661254-v2)

Update for Windows XP (KB2718704)

Update for Windows XP (KB2736233)

Update for Windows XP (KB2749655)

Update for Windows XP (KB2863058)

Update for Windows XP (KB951978)

Update for Windows XP (KB955759)

Update for Windows XP (KB967715)

Update for Windows XP (KB968389)

Update for Windows XP (KB971029)

Update for Windows XP (KB971737)

Update for Windows XP (KB973687)

Update for Windows XP (KB973815)

Update for Windows XP (KB978207)

Update for Windows XP (KB980182)

WeatherBug

WebFldrs XP

Windows Genuine Advantage Validation Tool (KB892130)

Windows XP Service Pack 3

Yahoo! Messenger

Yahoo! Software Update

.

==== Event Viewer Messages From Past Week ========

.

9/29/2013 9:49:50 PM, error: Service Control Manager [7024] - The Norton Security Suite service terminated with service-specific error 4294967295 (0xFFFFFFFF).

9/29/2013 7:36:07 PM, error: Windows Update Agent [20] - Installation Failure: Windows failed to install the following update with error 0x800f020d: nVidia - Other hardware - NVIDIA GeForce 6150SE nForce 430.

10/3/2013 9:38:21 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD BHDrvx86 ccHP eeCtrl Fips IPSec MRxSmb NetBIOS NetBT Processor RasAcd Rdbss SRTSPX SymIRON SYMTDI Tcpip WS2IFSL

10/3/2013 9:38:21 PM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error: A device attached to the system is not functioning.

10/3/2013 9:38:21 PM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning.

10/3/2013 9:38:21 PM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.

10/3/2013 9:38:21 PM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning.

10/3/2013 9:09:37 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: BHDrvx86 ccHP eeCtrl Fips Processor SRTSPX SymIRON SYMTDI

10/3/2013 9:09:06 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}

10/3/2013 8:10:24 PM, error: Dhcp [1002] - The IP address lease 98.199.18.141 for the Network Card with network address 00265A6C8A34 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message).

10/3/2013 8:08:37 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

10/3/2013 8:08:29 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}

10/3/2013 10:07:20 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}

.

==== End Of File ===========================

Link to post
Share on other sites

  • Root Admin

Please visit this webpage and read the ComboFix User's Guide:

  • Once you've read the article and are ready to use the program you can download it directly from the link below.
  • Important! - Please make sure you save combofix to your desktop and do not run it from your browser
  • Direct download link for: ComboFix.exe
  • Please make sure you disable your security applications before running ComboFix.
  • Once Combofix has completed it will produce and open a log file.  Please be patient as it can take some time to load.
  • Please attach that log file to your next reply.
  • If needed the file can be located here:  C:\combofix.txt
  • NOTE: If you receive the message "illegal operation has been attempted on a registry key that has been marked for deletion", just reboot the computer.


 

Link to post
Share on other sites

Hi - Thank you for the reply.

 

I have downloaded ComboFix, and attempted to run the software.  I keep getting an error message that says CF cannot run because Norton antivirus scanner is still running.  However, I cannot find any Norton processes running.  I used both the XP Task Manager as well as Process Explorer (the MSMVP free program) to look for them.  Should I try to run CF in Safe Mode?  Or is it safe to ignore the CF warning about Norton?  The last 2 times I tried to run CF, I had to use Task Manager to kill the process once the warning popup appeared.

 

A few other issues, in case they point to an infection:

 

I also burned a Hiren BootCD, but I could not get the PC to boot from the DVD drive.  When going through the starup process, an error message briefly states that "Invalid boot.ini file - Booting from c:\windows".  I've tried to edit boot.ini manually, but the file came up completely blank when I tried to open it.  I also checked the BIOS for the boot configuration, and everything except the hard drive is disabled via brackets/parantheses - which I believe is controlled by Windows (?).  I didn't attempt to change it manually in the BIOS.

 

I'm not sure how to proceed, and I appreciate any advice you can offer.

Link to post
Share on other sites

I got an error message regarding the MS Recovery Console, which would not download or repair itself. But ComboFix was able to complete a scan after it skipped the MRC step.

----------

ComboFix 13-10-04.02 - Arliss 10/04/2013 17:59:54.1.2 - x86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.767.340 [GMT -5:00]

Running from: c:\documents and settings\Arliss\Desktop\ComboFix.exe

AV: Norton Security Suite *Enabled/Updated* {E10A9785-9598-4754-B552-92431C1C35F8}

FW: Norton Security Suite *Enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}

.

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\windows\system32\SET55.tmp

.

.

((((((((((((((((((((((((( Files Created from 2013-09-04 to 2013-10-04 )))))))))))))))))))))))))))))))

.

.

2013-10-04 19:20 . 2013-10-04 19:20 -------- d-----w- c:\program files\CCleaner

2013-10-04 01:37 . 2013-04-04 19:50 22856 ----a-w- c:\windows\system32\drivers\mbam.sys

2013-10-04 01:19 . 2013-10-04 03:07 -------- d-----w- c:\documents and settings\Administrator

2013-10-03 23:44 . 2013-10-03 23:44 1072544 ----a-w- c:\windows\system32\nvdrsdb0.bin

2013-10-03 23:44 . 2013-10-03 23:44 1 ----a-w- c:\windows\system32\nvdrssel.bin

2013-10-03 23:44 . 2013-10-03 23:44 1072544 ----a-w- c:\windows\system32\nvdrsdb1.bin

2013-10-03 23:21 . 2013-10-03 23:43 -------- d-----w- c:\program files\NVIDIA Corporation

2013-09-10 22:19 . 2010-02-22 22:04 2452872 -c----w- c:\windows\system32\dllcache\ieapfltr.dat

2013-09-10 22:19 . 2013-08-02 17:18 63488 -c----w- c:\windows\system32\dllcache\icardie.dll

2013-09-10 22:19 . 2013-08-02 17:18 380928 -c----w- c:\windows\system32\dllcache\ieapfltr.dll

2013-09-10 22:19 . 2013-08-01 00:07 13824 -c----w- c:\windows\system32\dllcache\ieudinit.exe

2013-09-10 21:21 . 2013-09-10 21:21 -------- d-sh--w- c:\documents and settings\Arliss\IECompatCache

2013-09-10 21:21 . 2013-09-10 21:21 -------- d-sh--w- c:\documents and settings\Arliss\PrivacIE

2013-09-10 21:20 . 2013-09-10 21:20 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache

2013-09-10 21:20 . 2013-09-10 21:20 -------- d-sh--w- c:\documents and settings\Arliss\IETldCache

2013-09-10 21:17 . 2013-09-10 22:09 -------- d-----w- c:\windows\ie8updates

2013-09-10 21:16 . 2013-08-02 17:18 78336 -c--a-w- c:\windows\system32\dllcache\ieencode.dll

2013-09-10 21:16 . 2013-08-02 17:18 78336 ----a-w- c:\windows\system32\ieencode.dll

2013-09-10 21:11 . 2013-08-08 06:05 522240 -c----w- c:\windows\system32\dllcache\jsdbgui.dll

2013-09-10 21:11 . 2011-08-16 10:45 6144 -c----w- c:\windows\system32\dllcache\iecompat.dll

2013-09-10 21:11 . 2013-08-08 06:05 630272 -c----w- c:\windows\system32\dllcache\msfeeds.dll

2013-09-10 21:11 . 2013-08-08 06:05 55296 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll

2013-09-10 21:11 . 2013-08-08 06:05 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll

2013-09-10 21:11 . 2013-08-08 06:05 743424 -c----w- c:\windows\system32\dllcache\iedvtool.dll

2013-09-10 21:11 . 2013-08-08 06:05 247808 -c----w- c:\windows\system32\dllcache\ieproxy.dll

2013-09-10 21:11 . 2013-08-08 06:05 2006016 -c----w- c:\windows\system32\dllcache\iertutil.dll

2013-09-10 21:11 . 2013-08-08 06:05 11113472 -c----w- c:\windows\system32\dllcache\ieframe.dll

.

.

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-08-09 01:56 . 2004-08-04 12:00 386560 ----a-w- c:\windows\system32\themeui.dll

2013-08-08 01:27 . 2004-08-04 12:00 1877760 ----a-w- c:\windows\system32\win32k.sys

2013-08-05 13:30 . 2004-08-04 12:00 1289728 ----a-w- c:\windows\system32\ole32.dll

2013-08-02 17:18 . 2004-08-04 12:00 17408 ----a-w- c:\windows\system32\corpol.dll

2013-08-01 04:17 . 2004-08-04 12:00 668672 ----a-w- c:\windows\system32\wininet.dll

2013-08-01 04:17 . 2004-08-04 12:00 61952 ----a-w- c:\windows\system32\tdc.ocx

2013-07-31 20:11 . 2004-08-04 12:00 810496 ----a-w- c:\windows\system32\wmvdmod.dll

2013-07-10 10:37 . 2004-08-04 12:00 406016 ----a-w- c:\windows\system32\usp10.dll

.

.

------- Sigcheck -------

Note: Unsigned files aren't necessarily malware.

.

[-] 2008-04-13 . 9F3A2F5AA6875C72BF062C712CFA2674 . 96512 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\atapi.sys

[-] 2008-04-13 . 9F3A2F5AA6875C72BF062C712CFA2674 . 96512 . . [5.1.2600.5512] . . c:\windows\system32\drivers\atapi.sys

[-] 2004-08-04 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\atapi.sys

[-] 2004-08-04 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\system32\ReinstallBackups\0000\DriverFiles\i386\atapi.sys

[-] 2004-08-04 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\system32\ReinstallBackups\0001\DriverFiles\i386\atapi.sys

[-] 2004-08-04 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\system32\ReinstallBackups\0008\DriverFiles\i386\atapi.sys

.

[-] 2008-04-13 . B153AFFAC761E7F5FCFA822B9C4E97BC . 14336 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\asyncmac.sys

[-] 2008-04-13 . B153AFFAC761E7F5FCFA822B9C4E97BC . 14336 . . [5.1.2600.5512] . . c:\windows\system32\drivers\asyncmac.sys

[-] 2004-08-04 . 02000ABF34AF4C218C35D257024807D6 . 14336 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\asyncmac.sys

.

[-] 2004-08-04 . DA1F27D85E0D1525F6621372E7B685E9 . 4224 . . [5.1.2600.0] . . c:\windows\system32\dllcache\beep.sys

[-] 2004-08-04 . DA1F27D85E0D1525F6621372E7B685E9 . 4224 . . [5.1.2600.0] . . c:\windows\system32\drivers\beep.sys

.

[-] 2008-04-13 . 463C1EC80CD17420A542B7F36A36F128 . 24576 . . [5.1.2600.5512] . . c:\windows\system32\drivers\kbdclass.sys

[-] 2008-04-13 . 463C1EC80CD17420A542B7F36A36F128 . 24576 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\kbdclass.sys

[-] 2004-08-04 . EBDEE8A2EE5393890A1ACEE971C4C246 . 24576 . . [5.1.2600.2180] . . c:\windows\system32\ReinstallBackups\0004\DriverFiles\i386\kbdclass.sys

[-] 2004-08-04 . EBDEE8A2EE5393890A1ACEE971C4C246 . 24576 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\kbdclass.sys

.

[-] 2008-04-13 . 1DF7F42665C94B825322FAE71721130D . 182656 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ndis.sys

[-] 2008-04-13 . 1DF7F42665C94B825322FAE71721130D . 182656 . . [5.1.2600.5512] . . c:\windows\system32\drivers\ndis.sys

[-] 2004-08-04 . 558635D3AF1C7546D26067D5D9B6959E . 182912 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\ndis.sys

.

[-] 2008-04-13 . 78A08DD6A8D65E697C18E1DB01C5CDCA . 574976 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ntfs.sys

[-] 2008-04-13 . 78A08DD6A8D65E697C18E1DB01C5CDCA . 574976 . . [5.1.2600.5512] . . c:\windows\system32\drivers\ntfs.sys

[-] 2004-08-04 . B78BE402C3F63DD55521F73876951CDD . 574592 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\ntfs.sys

.

[-] 2004-08-04 . 73C1E1F395918BC2C6DD67AF7591A3AD . 2944 . . [5.1.2600.0] . . c:\windows\system32\dllcache\null.sys

[-] 2004-08-04 . 73C1E1F395918BC2C6DD67AF7591A3AD . 2944 . . [5.1.2600.0] . . c:\windows\system32\drivers\null.sys

.

[-] 2008-04-14 . BF2466B3E18E970D8A976FB95FC1CA85 . 13312 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\lsass.exe

[-] 2008-04-14 . BF2466B3E18E970D8A976FB95FC1CA85 . 13312 . . [5.1.2600.5512] . . c:\windows\system32\lsass.exe

[-] 2004-08-04 . 84885F9B82F4D55C6146EBF6065D75D2 . 13312 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\lsass.exe

.

[-] 2008-04-14 . 13E67B55B3ABD7BF3FE7AAE5A0F9A9DE . 198144 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\netman.dll

[-] 2008-04-14 . 13E67B55B3ABD7BF3FE7AAE5A0F9A9DE . 198144 . . [5.1.2600.5512] . . c:\windows\system32\netman.dll

[-] 2004-08-04 . DAB9E6C7105D2EF49876FE92C524F565 . 198144 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\netman.dll

.

[-] 2008-04-14 00:11 . 1280A158C722FA95A80FB7AEBE78FA7D . 792064 . . [2001.12.4414.700] . . c:\windows\ServicePackFiles\i386\comres.dll

[-] 2008-04-14 00:11 . 1280A158C722FA95A80FB7AEBE78FA7D . 792064 . . [2001.12.4414.700] . . c:\windows\system32\comres.dll

[-] 2004-08-04 12:00 . 6728270CB7DBB776ED086F5AC4C82310 . 792064 . . [2001.12.4414.258] . . c:\windows\$NtServicePackUninstall$\comres.dll

.

[-] 2008-04-14 . 574738F61FCA2935F5265DC4E5691314 . 409088 . . [6.7.2600.5512] . . c:\windows\ServicePackFiles\i386\qmgr.dll

[-] 2008-04-14 . 574738F61FCA2935F5265DC4E5691314 . 409088 . . [6.7.2600.5512] . . c:\windows\system32\qmgr.dll

[-] 2008-04-14 . 574738F61FCA2935F5265DC4E5691314 . 409088 . . [6.7.2600.5512] . . c:\windows\system32\bits\qmgr.dll

[-] 2004-08-04 . 2C69EC7E5A311334D10DD95F338FCCEA . 382464 . . [6.6.2600.2180] . . c:\windows\$NtServicePackUninstall$\qmgr.dll

.

[-] 2009-02-09 . 6B27A5C03DFB94B4245739065431322C . 401408 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3GDR\rpcss.dll

[-] 2009-02-09 . 6B27A5C03DFB94B4245739065431322C . 401408 . . [5.1.2600.5755] . . c:\windows\system32\rpcss.dll

[-] 2009-02-09 . 6B27A5C03DFB94B4245739065431322C . 401408 . . [5.1.2600.5755] . . c:\windows\system32\dllcache\rpcss.dll

[-] 2009-02-09 . 9222562D44021B988B9F9F62207FB6F2 . 401408 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3QFE\rpcss.dll

[-] 2009-02-09 . 01095FEBF33BEEA00C2A0730B9B3EC28 . 399360 . . [5.1.2600.3520] . . c:\windows\$NtServicePackUninstall$\rpcss.dll

[-] 2009-02-09 . 24B5D53B9ACCC1E2EDCF0A878D6659D4 . 401408 . . [5.1.2600.3520] . . c:\windows\$hf_mig$\KB956572\SP2QFE\rpcss.dll

[-] 2008-04-14 . 2589FE6015A316C0F5D5112B4DA7B509 . 399360 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB956572$\rpcss.dll

[-] 2008-04-14 . 2589FE6015A316C0F5D5112B4DA7B509 . 399360 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\rpcss.dll

[-] 2004-08-04 . 5C83A4408604F737717AB96371201680 . 395776 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB956572_0$\rpcss.dll

.

[-] 2009-02-06 . 37561F8D4160D62DA86D24AE41FAE8DE . 110592 . . [5.1.2600.3520] . . c:\windows\$NtServicePackUninstall$\services.exe

[-] 2009-02-06 . 65DF52F5B8B6E9BBD183505225C37315 . 110592 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3GDR\services.exe

[-] 2009-02-06 . 65DF52F5B8B6E9BBD183505225C37315 . 110592 . . [5.1.2600.5755] . . c:\windows\system32\services.exe

[-] 2009-02-06 . 65DF52F5B8B6E9BBD183505225C37315 . 110592 . . [5.1.2600.5755] . . c:\windows\system32\dllcache\services.exe

[-] 2009-02-06 . 020CEAAEDC8EB655B6506B8C70D53BB6 . 110592 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3QFE\services.exe

[-] 2009-02-06 . 4712531AB7A01B7EE059853CA17D39BD . 110592 . . [5.1.2600.3520] . . c:\windows\$hf_mig$\KB956572\SP2QFE\services.exe

[-] 2008-04-14 . 0E776ED5F7CC9F94299E70461B7B8185 . 108544 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB956572$\services.exe

[-] 2008-04-14 . 0E776ED5F7CC9F94299E70461B7B8185 . 108544 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\services.exe

[-] 2004-08-04 . C6CE6EEC82F187615D1002BB3BB50ED4 . 108032 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB956572_0$\services.exe

.

[-] 2010-08-17 . 258DD5D4283FD9F9A7166BE9AE45CE73 . 58880 . . [5.1.2600.6024] . . c:\windows\$hf_mig$\KB2347290\SP3QFE\spoolsv.exe

[-] 2010-08-17 . 60784F891563FB1B767F70117FC2428F . 58880 . . [5.1.2600.6024] . . c:\windows\system32\spoolsv.exe

[-] 2010-08-17 . 60784F891563FB1B767F70117FC2428F . 58880 . . [5.1.2600.6024] . . c:\windows\system32\dllcache\spoolsv.exe

[-] 2008-04-14 . D8E14A61ACC1D4A6CD0D38AEBAC7FA3B . 57856 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB2347290$\spoolsv.exe

[-] 2008-04-14 . D8E14A61ACC1D4A6CD0D38AEBAC7FA3B . 57856 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\spoolsv.exe

[-] 2004-08-04 . 7435B108B935E42EA92CA94F59C8E717 . 57856 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\spoolsv.exe

.

[-] 2008-04-14 . ED0EF0A136DEC83DF69F04118870003E . 507904 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\winlogon.exe

[-] 2008-04-14 . ED0EF0A136DEC83DF69F04118870003E . 507904 . . [5.1.2600.5512] . . c:\windows\system32\winlogon.exe

[-] 2004-08-04 . 01C3346C241652F43AED8E2149881BFE . 502272 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\winlogon.exe

.

[-] 2008-04-13 . 23C74D75E36E7158768DD63D92789A91 . 75264 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ipsec.sys

[-] 2008-04-13 . 23C74D75E36E7158768DD63D92789A91 . 75264 . . [5.1.2600.5512] . . c:\windows\system32\drivers\ipsec.sys

[-] 2004-08-04 . 64537AA5C003A6AFEEE1DF819062D0D1 . 74752 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\ipsec.sys

.

[-] 2010-08-23 . 93AFB83FBC1F9443CAC722FCA63D73BF . 617472 . . [5.82] . . c:\windows\system32\comctl32.dll

[-] 2010-08-23 . 93AFB83FBC1F9443CAC722FCA63D73BF . 617472 . . [5.82] . . c:\windows\system32\dllcache\comctl32.dll

[-] 2010-08-23 . 736B12B725AEB2B07F0241A9F680CB10 . 1054208 . . [6.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll

[-] 2008-04-14 . BD38D1EBE24A46BD3EDA059560AFBA12 . 1054208 . . [6.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll

[-] 2008-04-14 . 06F247492BC786CE5C24A23E178C711A . 617472 . . [5.82] . . c:\windows\$NtUninstallKB2296011$\comctl32.dll

[-] 2008-04-14 . 06F247492BC786CE5C24A23E178C711A . 617472 . . [5.82] . . c:\windows\ServicePackFiles\i386\comctl32.dll

[-] 2004-08-04 . A77DFB85FAEE49D66C74DA6024EBC69B . 611328 . . [5.82] . . c:\windows\$NtServicePackUninstall$\comctl32.dll

[-] 2004-08-04 . AEF3D788DBF40C7C4D204EA45EB0C505 . 921088 . . [6.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll

[-] 2004-08-04 . 5AF68A5E44734A082442668E9C787743 . 1050624 . . [6.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll

.

[-] 2008-04-14 . 3D4E199942E29207970E04315D02AD3B . 62464 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\cryptsvc.dll

[-] 2008-04-14 . 3D4E199942E29207970E04315D02AD3B . 62464 . . [5.1.2600.5512] . . c:\windows\system32\cryptsvc.dll

[-] 2004-08-04 . 10654F9DDCEA9C46CFB77554231BE73B . 60416 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\cryptsvc.dll

.

[-] 2008-07-07 20:32 . 60D1A6342238378BFB7545C81EE3606C . 253952 . . [2001.12.4414.320] . . c:\windows\$NtServicePackUninstall$\es.dll

[-] 2008-07-07 20:26 . D4991D98F2DB73C60D042F1AEF79EFAE . 253952 . . [2001.12.4414.706] . . c:\windows\$hf_mig$\KB950974\SP3GDR\es.dll

[-] 2008-07-07 20:26 . D4991D98F2DB73C60D042F1AEF79EFAE . 253952 . . [2001.12.4414.706] . . c:\windows\system32\es.dll

[-] 2008-07-07 20:26 . D4991D98F2DB73C60D042F1AEF79EFAE . 253952 . . [2001.12.4414.706] . . c:\windows\system32\dllcache\es.dll

[-] 2008-07-07 20:23 . F17F6226BDC0CD5F0BEF0DAF84D29BEC . 253952 . . [2001.12.4414.706] . . c:\windows\$hf_mig$\KB950974\SP3QFE\es.dll

[-] 2008-07-07 20:06 . A4AB3DCA4A383F0DF4988ABDEB84F9A4 . 253952 . . [2001.12.4414.320] . . c:\windows\$hf_mig$\KB950974\SP2QFE\es.dll

[-] 2008-04-14 00:11 . 19A799805B24990867B00C120D300C3A . 246272 . . [2001.12.4414.701] . . c:\windows\$NtUninstallKB950974$\es.dll

[-] 2008-04-14 00:11 . 19A799805B24990867B00C120D300C3A . 246272 . . [2001.12.4414.701] . . c:\windows\ServicePackFiles\i386\es.dll

[-] 2004-08-04 12:00 . ACD36A2DD7D1E9D8A060AA651DC07E63 . 243200 . . [2001.12.4414.258] . . c:\windows\$NtUninstallKB950974_0$\es.dll

.

[-] 2008-04-14 . 0DA85218E92526972A821587E6A8BF8F . 110080 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\imm32.dll

[-] 2008-04-14 . 0DA85218E92526972A821587E6A8BF8F . 110080 . . [5.1.2600.5512] . . c:\windows\system32\imm32.dll

[-] 2004-08-04 . 87CA7CE6469577F059297B9D6556D66D . 110080 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\imm32.dll

.

[-] 2008-04-14 . 2DC5A8019E2387987905F77C664E4BE2 . 19968 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\linkinfo.dll

[-] 2008-04-14 . 2DC5A8019E2387987905F77C664E4BE2 . 19968 . . [5.1.2600.5512] . . c:\windows\system32\linkinfo.dll

[-] 2004-08-04 . C2BBD044C741EA4292016C36F718D2E4 . 18944 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\linkinfo.dll

.

[-] 2008-04-14 . 012DF358CEBAA23ACB26D82077820817 . 22016 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\lpk.dll

[-] 2008-04-14 . 012DF358CEBAA23ACB26D82077820817 . 22016 . . [5.1.2600.5512] . . c:\windows\system32\lpk.dll

[-] 2004-08-04 . 74D66B3DE265E8789153414E75175F26 . 22016 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\lpk.dll

.

[-] 2008-04-14 . D7075E95AA599EE77B7A89D39296BD3D . 343040 . . [7.0.2600.5512] . . c:\windows\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.5512_x-ww_3fd60d63\msvcrt.dll

[-] 2008-04-14 . 355EDBB4D412B01F1740C17E3F50FA00 . 343040 . . [7.0.2600.5512] . . c:\windows\ServicePackFiles\i386\msvcrt.dll

[-] 2008-04-14 . 355EDBB4D412B01F1740C17E3F50FA00 . 343040 . . [7.0.2600.5512] . . c:\windows\system32\msvcrt.dll

[-] 2004-08-04 . B0FEFA816D61EC66AA765DDF534EAB5E . 343040 . . [7.0.2600.2180] . . c:\windows\$NtServicePackUninstall$\msvcrt.dll

[-] 2004-08-04 . 4200BE3808F6406DBE45A7B88DAE5035 . 322560 . . [7.0.2600.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.0.0_x-ww_2726e76a\msvcrt.dll

[-] 2004-08-04 . 98EC447E00229AFD88D5161A25D065DA . 343040 . . [7.0.2600.2180] . . c:\windows\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.2180_x-ww_b2505ed9\msvcrt.dll

.

[-] 2009-02-06 . 6C476D33D82F1054849790181E8F7772 . 408064 . . [5.1.2600.3520] . . c:\windows\$hf_mig$\KB968389\SP2QFE\netlogon.dll

[-] 2009-02-06 . 6C476D33D82F1054849790181E8F7772 . 408064 . . [5.1.2600.3520] . . c:\windows\$hf_mig$\KB975467\SP2QFE\netlogon.dll

[-] 2008-04-14 . 1B7F071C51B77C272875C3A23E1E4550 . 407040 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\netlogon.dll

[-] 2008-04-14 . 1B7F071C51B77C272875C3A23E1E4550 . 407040 . . [5.1.2600.5512] . . c:\windows\system32\netlogon.dll

[-] 2004-08-04 . 96353FCECBA774BB8DA74A1C6507015A . 407040 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\netlogon.dll

.

[-] 2008-04-14 . 50A166237A0FA771261275A405646CC0 . 17408 . . [6.00.2900.5512] . . c:\windows\ServicePackFiles\i386\powrprof.dll

[-] 2008-04-14 . 50A166237A0FA771261275A405646CC0 . 17408 . . [6.00.2900.5512] . . c:\windows\system32\powrprof.dll

[-] 2004-08-04 . 1B5F6923ABB450692E9FE0672C897AED . 17408 . . [6.00.2900.2180] . . c:\windows\$NtServicePackUninstall$\powrprof.dll

.

[-] 2008-04-14 . A86BB5E61BF3E39B62AB4C7E7085A084 . 181248 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\scecli.dll

[-] 2008-04-14 . A86BB5E61BF3E39B62AB4C7E7085A084 . 181248 . . [5.1.2600.5512] . . c:\windows\system32\scecli.dll

[-] 2004-08-04 . 0F78E27F563F2AAF74B91A49E2ABF19A . 180224 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\scecli.dll

.

[-] 2008-04-14 . 96E1C926F22EE1BFBAE82901A35F6BF3 . 5120 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\sfc.dll

[-] 2008-04-14 . 96E1C926F22EE1BFBAE82901A35F6BF3 . 5120 . . [5.1.2600.5512] . . c:\windows\system32\sfc.dll

[-] 2004-08-04 . E8A12A12EA9088B4327D49EDCA3ADD3E . 5120 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\sfc.dll

.

[-] 2008-04-14 . 27C6D03BCDB8CFEB96B716F3D8BE3E18 . 14336 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\svchost.exe

[-] 2008-04-14 . 27C6D03BCDB8CFEB96B716F3D8BE3E18 . 14336 . . [5.1.2600.5512] . . c:\windows\system32\svchost.exe

[-] 2004-08-04 . 8F078AE4ED187AAABC0A305146DE6716 . 14336 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\svchost.exe

.

[-] 2008-04-14 . 3CB78C17BB664637787C9A1C98F79C38 . 249856 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\tapisrv.dll

[-] 2008-04-14 . 3CB78C17BB664637787C9A1C98F79C38 . 249856 . . [5.1.2600.5512] . . c:\windows\system32\tapisrv.dll

[-] 2004-08-04 . EB4A4187D74A8EFDCBEA3EA2CB1BDFBD . 246272 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\tapisrv.dll

.

[-] 2008-04-14 . B26B135FF1B9F60C9388B4A7D16F600B . 578560 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\user32.dll

[-] 2008-04-14 . B26B135FF1B9F60C9388B4A7D16F600B . 578560 . . [5.1.2600.5512] . . c:\windows\system32\user32.dll

[-] 2004-08-04 . C72661F8552ACE7C5C85E16A3CF505C4 . 577024 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\user32.dll

.

[-] 2008-04-14 . A93AEE1928A9D7CE3E16D24EC7380F89 . 26112 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\userinit.exe

[-] 2008-04-14 . A93AEE1928A9D7CE3E16D24EC7380F89 . 26112 . . [5.1.2600.5512] . . c:\windows\system32\userinit.exe

[-] 2004-08-04 . 39B1FFB03C2296323832ACBAE50D2AFF . 24576 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\userinit.exe

.

[-] 2008-04-14 . 2CCC474EB85CEAA3E1FA1726580A3E5A . 82432 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ws2_32.dll

[-] 2008-04-14 . 2CCC474EB85CEAA3E1FA1726580A3E5A . 82432 . . [5.1.2600.5512] . . c:\windows\system32\ws2_32.dll

[-] 2004-08-04 . 2ED0B7F12A60F90092081C50FA0EC2B2 . 82944 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\ws2_32.dll

.

[-] 2008-04-14 . 9789E95E1D88EEB4B922BF3EA7779C28 . 19968 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ws2help.dll

[-] 2008-04-14 . 9789E95E1D88EEB4B922BF3EA7779C28 . 19968 . . [5.1.2600.5512] . . c:\windows\system32\ws2help.dll

[-] 2004-08-04 . 9BEACB911CA61E5881102188AB7FB431 . 19968 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\ws2help.dll

.

[-] 2008-04-14 . 12896823FB95BFB3DC9B46BCAEDC9923 . 1033728 . . [6.00.2900.5512] . . c:\windows\explorer.exe

[-] 2008-04-14 . 12896823FB95BFB3DC9B46BCAEDC9923 . 1033728 . . [6.00.2900.5512] . . c:\windows\ServicePackFiles\i386\explorer.exe

[-] 2004-08-04 . A0732187050030AE399B241436565E64 . 1032192 . . [6.00.2900.2180] . . c:\windows\$NtServicePackUninstall$\explorer.exe

.

[-] 2008-04-14 . 058710B720282CA82B909912D3EF28DB . 146432 . . [5.1.2600.5512] . . c:\windows\regedit.exe

[-] 2008-04-14 . 058710B720282CA82B909912D3EF28DB . 146432 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\regedit.exe

[-] 2004-08-04 . 783AFC80383C176B22DBF8333343992D . 146432 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\regedit.exe

.

[-] 2008-04-14 . 9B9F1C38D559047B8AC0DBA2D5FEBDE9 . 4096 . . [5.3.2600.5512] . . c:\windows\ServicePackFiles\i386\ksuser.dll

[-] 2008-04-14 . 9B9F1C38D559047B8AC0DBA2D5FEBDE9 . 4096 . . [5.3.2600.5512] . . c:\windows\system32\ksuser.dll

[-] 2004-08-04 . CBCD254547689BFF80C9F547B20911E9 . 4096 . . [5.3.2600.2180] . . c:\windows\$NtServicePackUninstall$\ksuser.dll

[-] 2004-08-04 . CBCD254547689BFF80C9F547B20911E9 . 4096 . . [5.3.2600.2180] . . c:\windows\system32\ReinstallBackups\0002\DriverFiles\i386\ksuser.dll

.

[-] 2008-04-14 . 5F1D5F88303D4A4DBC8E5F97BA967CC3 . 15360 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ctfmon.exe

[-] 2008-04-14 . 5F1D5F88303D4A4DBC8E5F97BA967CC3 . 15360 . . [5.1.2600.5512] . . c:\windows\system32\ctfmon.exe

[-] 2004-08-04 . 24232996A38C0B0CF151C2140AE29FC8 . 15360 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\ctfmon.exe

.

[-] 2008-04-14 . AFFC87E2501FCE8F09D4C10BA6421CCF . 4608 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\msimg32.dll

[-] 2008-04-14 . AFFC87E2501FCE8F09D4C10BA6421CCF . 4608 . . [5.1.2600.5512] . . c:\windows\system32\msimg32.dll

[-] 2004-08-04 . B5331F2B6F37C66C29C847F3B94FF900 . 4608 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\msimg32.dll

.

[-] 2008-04-14 . 3805DF0AC4296A34BA4BF93B346CC378 . 171008 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\srsvc.dll

[-] 2008-04-14 . 3805DF0AC4296A34BA4BF93B346CC378 . 171008 . . [5.1.2600.5512] . . c:\windows\system32\srsvc.dll

[-] 2004-08-04 . 92BDF74F12D6CBEC43C94D4B7F804838 . 170496 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\srsvc.dll

.

[-] 2008-04-14 . F92E1076C42FCD6DB3D72D8CFE9816D5 . 13824 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\wscntfy.exe

[-] 2008-04-14 . F92E1076C42FCD6DB3D72D8CFE9816D5 . 13824 . . [5.1.2600.5512] . . c:\windows\system32\wscntfy.exe

[-] 2004-08-04 . 49911DD39E023BB6C45E4E436CFBD297 . 13824 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\wscntfy.exe

.

[-] 2008-04-14 . 295D21F14C335B53CB8154E5B1F892B9 . 129024 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\xmlprov.dll

[-] 2008-04-14 . 295D21F14C335B53CB8154E5B1F892B9 . 129024 . . [5.1.2600.5512] . . c:\windows\system32\xmlprov.dll

[-] 2004-08-04 . EEF46DAB68229A14DA3D8E73C99E2959 . 129536 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\xmlprov.dll

.

[-] 2008-04-14 . 5733177BCF16EE78B99543C9B0AB81EA . 177152 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\msctfime.ime

[-] 2008-04-14 . 5733177BCF16EE78B99543C9B0AB81EA . 177152 . . [5.1.2600.5512] . . c:\windows\system32\msctfime.ime

[-] 2004-08-04 . D87041EAA67ECA4394F6D5D09C0C2885 . 177152 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\msctfime.ime

.

[-] 2008-04-14 . 6D4FEB43EE538FC5428CC7F0565AA656 . 56320 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\eventlog.dll

[-] 2008-04-14 . 6D4FEB43EE538FC5428CC7F0565AA656 . 56320 . . [5.1.2600.5512] . . c:\windows\system32\eventlog.dll

[-] 2004-08-04 . 82B24CB70E5944E6E34662205A2A5B78 . 55808 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\eventlog.dll

.

[-] 2008-04-14 . 9DD07AF82244867CA36681EA2D29CE79 . 1614848 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\sfcfiles.dll

[-] 2008-04-14 . 9DD07AF82244867CA36681EA2D29CE79 . 1614848 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll

[-] 2004-08-04 . 30A609E00BD1D4FFC49D6B5A432BE7F2 . 1580544 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\sfcfiles.dll

.

[-] 2008-04-13 . 23C74D75E36E7158768DD63D92789A91 . 75264 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ipsec.sys

[-] 2008-04-13 . 23C74D75E36E7158768DD63D92789A91 . 75264 . . [5.1.2600.5512] . . c:\windows\system32\drivers\ipsec.sys

[-] 2004-08-04 . 64537AA5C003A6AFEEE1DF819062D0D1 . 74752 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\ipsec.sys

.

[-] 2008-04-14 . 5B19B557B0C188210A56A6B699D90B8F . 59904 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\regsvc.dll

[-] 2008-04-14 . 5B19B557B0C188210A56A6B699D90B8F . 59904 . . [5.1.2600.5512] . . c:\windows\system32\regsvc.dll

[-] 2004-08-04 . 3151427DB7D87107D1C5BE58FAC53960 . 59904 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\regsvc.dll

.

[-] 2008-04-14 . 0A9A7365A1CA4319AA7C1D6CD8E4EAFA . 192512 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\schedsvc.dll

[-] 2008-04-14 . 0A9A7365A1CA4319AA7C1D6CD8E4EAFA . 192512 . . [5.1.2600.5512] . . c:\windows\system32\schedsvc.dll

[-] 2004-08-04 . 92360854316611F6CC471612213C3D92 . 190976 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\schedsvc.dll

.

[-] 2008-04-14 . 0A5679B3714EDAB99E357057EE88FCA6 . 71680 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ssdpsrv.dll

[-] 2008-04-14 . 0A5679B3714EDAB99E357057EE88FCA6 . 71680 . . [5.1.2600.5512] . . c:\windows\system32\ssdpsrv.dll

[-] 2004-08-04 . 4B8D61792F7175BED48859CC18CE4E38 . 71680 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\ssdpsrv.dll

.

[-] 2008-04-14 . FF3477C03BE7201C294C35F684B3479F . 295424 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\termsrv.dll

[-] 2008-04-14 . FF3477C03BE7201C294C35F684B3479F . 295424 . . [5.1.2600.5512] . . c:\windows\system32\termsrv.dll

[-] 2004-08-04 . B60C877D16D9C880B952FDA04ADF16E6 . 295424 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\termsrv.dll

.

[-] 2008-04-14 . 3CB32D3B8CBE79899D63280BB7A83CD9 . 344064 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\hnetcfg.dll

[-] 2008-04-14 . 3CB32D3B8CBE79899D63280BB7A83CD9 . 344064 . . [5.1.2600.5512] . . c:\windows\system32\hnetcfg.dll

[-] 2004-08-04 . 765B30C776A1780B46B479FE614F707C . 344064 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\hnetcfg.dll

.

[-] 2004-08-04 . 9859C0F6936E723E4892D7141B1327D5 . 11648 . . [5.1.2600.0] . . c:\windows\system32\drivers\acpiec.sys

.

[-] 2008-04-13 16:39 . 8BED39E3C35D6A489438B8141717A557 . 142592 . . [5.1.2601.3142] . . c:\windows\ServicePackFiles\i386\aec.sys

[-] 2008-04-13 16:39 . 8BED39E3C35D6A489438B8141717A557 . 142592 . . [5.1.2601.3142] . . c:\windows\system32\drivers\aec.sys

[-] 2004-08-03 22:39 . 841F385C6CFAF66B58FBD898722BB4F0 . 142464 . . [5.1.2601.2078] . . c:\windows\$NtServicePackUninstall$\aec.sys

.

[-] 2008-04-13 . 08FD04AA961BDC77FB983F328334E3D7 . 42368 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\agp440.sys

[-] 2008-04-13 . 08FD04AA961BDC77FB983F328334E3D7 . 42368 . . [5.1.2600.5512] . . c:\windows\system32\drivers\agp440.sys

.

[-] 2008-04-13 . 3BB22519A194418D5FEC05D800A19AD0 . 36608 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ip6fw.sys

[-] 2008-04-13 . 3BB22519A194418D5FEC05D800A19AD0 . 36608 . . [5.1.2600.5512] . . c:\windows\system32\drivers\ip6fw.sys

[-] 2004-08-04 . 4448006B6BC60E6C027932CFC38D6855 . 29056 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\ip6fw.sys

.

[-] 2010-09-18 07:18 . 842900DEDBC8E3E8DBCCCB298FD88F65 . 953856 . . [4.1.6151] . . c:\windows\$hf_mig$\KB2387149\SP3QFE\mfc40u.dll

[-] 2010-09-18 06:53 . E76A5C202E68AF5A322D16B5A78F48B9 . 953856 . . [4.1.6151] . . c:\windows\system32\mfc40u.dll

[-] 2010-09-18 06:53 . E76A5C202E68AF5A322D16B5A78F48B9 . 953856 . . [4.1.6151] . . c:\windows\system32\dllcache\mfc40u.dll

[-] 2008-04-14 00:11 . CDDD4416B2B4C7295FE3FDB6DDE57E4E . 927504 . . [4.1.0.61] . . c:\windows\$NtUninstallKB2387149$\mfc40u.dll

[-] 2008-04-14 00:11 . CDDD4416B2B4C7295FE3FDB6DDE57E4E . 927504 . . [4.1.0.61] . . c:\windows\ServicePackFiles\i386\mfc40u.dll

[-] 2004-08-04 12:00 . DDF8D47ACF8FC3FE5F7F2B95C4D4D136 . 924432 . . [4.1.6140] . . c:\windows\$NtServicePackUninstall$\mfc40u.dll

.

[-] 2008-04-14 . 986B1FF5814366D71E0AC5755C88F2D3 . 33792 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\msgsvc.dll

[-] 2008-04-14 . 986B1FF5814366D71E0AC5755C88F2D3 . 33792 . . [5.1.2600.5512] . . c:\windows\system32\msgsvc.dll

[-] 2004-08-04 . 95FD808E4AC22ABA025A7B3EAC0375D2 . 33792 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\msgsvc.dll

.

[-] 2008-04-14 00:12 . C7E39EA41233E9F5B86C8DA3A9F1E4A8 . 52224 . . [9.0.1.56] . . c:\windows\system32\mspmsnsv.dll

[-] 2008-04-14 00:12 . C7E39EA41233E9F5B86C8DA3A9F1E4A8 . 52224 . . [9.0.1.56] . . c:\windows\system32\dllcache\mspmsnsv.dll

[-] 2004-08-04 12:00 . C086483E3DBA8C1C0A687EC8D5B3D4C1 . 52224 . . [9.0.1.56] . . c:\windows\$NtServicePackUninstall$\mspmsnsv.dll

.

[-] 2008-04-14 00:12 . 156F64A3345BD23C600655FB4D10BC08 . 435200 . . [5.1.2400.5512] . . c:\windows\ServicePackFiles\i386\ntmssvc.dll

[-] 2008-04-14 00:12 . 156F64A3345BD23C600655FB4D10BC08 . 435200 . . [5.1.2400.5512] . . c:\windows\system32\ntmssvc.dll

[-] 2004-08-04 12:00 . B62F29C00AC55A761B2E45877D85EA0F . 435200 . . [5.1.2400.2180] . . c:\windows\$NtServicePackUninstall$\ntmssvc.dll

.

[-] 2008-04-14 . 1EBAFEB9A3FBDC41B8D9C7F0F687AD91 . 185856 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\upnphost.dll

[-] 2008-04-14 . 1EBAFEB9A3FBDC41B8D9C7F0F687AD91 . 185856 . . [5.1.2600.5512] . . c:\windows\system32\upnphost.dll

[-] 2004-08-04 . 0546477BDE979E33294FE97F6B3DE84A . 185344 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\upnphost.dll

.

[-] 2008-04-14 . 4D83ED8BDDEC431FC8AD907B47CFB6E3 . 367616 . . [5.3.2600.5512] . . c:\windows\ServicePackFiles\i386\dsound.dll

[-] 2008-04-14 . 4D83ED8BDDEC431FC8AD907B47CFB6E3 . 367616 . . [5.3.2600.5512] . . c:\windows\system32\dsound.dll

[-] 2004-08-04 . 55E148C01296696588EAFA425782C3E8 . 367616 . . [5.3.2600.2180] . . c:\windows\$NtServicePackUninstall$\dsound.dll

.

[-] 2008-04-14 . 0607CBC6FA20114CB491EFE4B2F9EFAD . 1689088 . . [5.03.2600.5512] . . c:\windows\ServicePackFiles\i386\d3d9.dll

[-] 2008-04-14 . 0607CBC6FA20114CB491EFE4B2F9EFAD . 1689088 . . [5.03.2600.5512] . . c:\windows\system32\d3d9.dll

[-] 2004-08-04 . D67BDBBDA86CC9AEEBBAF3217C1717D8 . 1689088 . . [5.03.2600.2180] . . c:\windows\$NtServicePackUninstall$\d3d9.dll

.

[-] 2008-04-14 . A340CD71EB535A3DD751B5F28723E50C . 279552 . . [5.03.2600.5512] . . c:\windows\ServicePackFiles\i386\ddraw.dll

[-] 2008-04-14 . A340CD71EB535A3DD751B5F28723E50C . 279552 . . [5.03.2600.5512] . . c:\windows\system32\ddraw.dll

[-] 2004-08-04 . 7ED462F353B3D915A418A689FA881F96 . 266240 . . [5.03.2600.2180] . . c:\windows\$NtServicePackUninstall$\ddraw.dll

.

[-] 2008-04-14 00:12 . 5652F6CE1D9E9D8068B9D29BC21B5409 . 84992 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\olepro32.dll

[-] 2008-04-14 00:12 . 5652F6CE1D9E9D8068B9D29BC21B5409 . 84992 . . [5.1.2600.5512] . . c:\windows\system32\olepro32.dll

[-] 2004-08-04 12:00 . B48D3193DD1474DCBCC32BF4779AC698 . 83456 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\olepro32.dll

.

[-] 2008-04-14 . DBE2B62353660ECCA0D75EA307A717E9 . 39936 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\perfctrs.dll

[-] 2008-04-14 . DBE2B62353660ECCA0D75EA307A717E9 . 39936 . . [5.1.2600.5512] . . c:\windows\system32\perfctrs.dll

[-] 2004-08-04 . 96492C721C6EA517E2BFD5381FEF55E3 . 39936 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\perfctrs.dll

.

[-] 2008-04-14 . C7CE131408739B0B3A318BE2D0032719 . 18944 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\version.dll

[-] 2008-04-14 . C7CE131408739B0B3A318BE2D0032719 . 18944 . . [5.1.2600.5512] . . c:\windows\system32\version.dll

[-] 2004-08-04 . D38408967BE738D0C1B47005BCE8CEEB . 18944 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\version.dll

.

[7] 2013-07-25 . 2AA65CE72D26FF391C7722E18A5FDCF4 . 643224 . . [7.00.6000.21348] . . c:\windows\ie7updates\KB2870699-IE7\iexplore.exe

[7] 2011-10-31 . 1C5DA2D9EA2A59D0D5C116FA3A5A21AA . 634504 . . [7.00.6000.21308] . . c:\windows\ie7updates\KB2744842-IE7\iexplore.exe

[-] 2008-04-14 . 55794B97A7FAABD2910873C85274F409 . 93184 . . [6.00.2900.5512] . . c:\windows\ServicePackFiles\i386\iexplore.exe

[-] 2004-08-04 . E7484514C0464642BE7B4DC2689354C8 . 93184 . . [6.00.2900.2180] . . c:\windows\$NtServicePackUninstall$\iexplore.exe

.

[-] 2008-04-14 . 3805DF0AC4296A34BA4BF93B346CC378 . 171008 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\srsvc.dll

[-] 2008-04-14 . 3805DF0AC4296A34BA4BF93B346CC378 . 171008 . . [5.1.2600.5512] . . c:\windows\system32\srsvc.dll

[-] 2004-08-04 . 92BDF74F12D6CBEC43C94D4B7F804838 . 170496 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\srsvc.dll

.

[-] 2008-04-14 . 54AF4B1D5459500EF0937F6D33B1914F . 175104 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\w32time.dll

[-] 2008-04-14 . 54AF4B1D5459500EF0937F6D33B1914F . 175104 . . [5.1.2600.5512] . . c:\windows\system32\w32time.dll

[-] 2004-08-04 . 2B281958F5D0CF99ED626E3EF39D5C8D . 174592 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\w32time.dll

.

[-] 2008-04-14 . 8BAD69CBAC032D4BBACFCE0306174C30 . 333824 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\wiaservc.dll

[-] 2008-04-14 . 8BAD69CBAC032D4BBACFCE0306174C30 . 333824 . . [5.1.2600.5512] . . c:\windows\system32\wiaservc.dll

[-] 2004-08-04 . D9F6C4F6B1E188ADAFC42B561D9BC2E6 . 333312 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\wiaservc.dll

.

[-] 2008-04-14 . 5C12660A97822F6E61576943B49AAAD6 . 18944 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\midimap.dll

[-] 2008-04-14 . 5C12660A97822F6E61576943B49AAAD6 . 18944 . . [5.1.2600.5512] . . c:\windows\system32\midimap.dll

[-] 2004-08-04 . 3B4702155BB2AE9DC00C06A68834BDFA . 18944 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\midimap.dll

.

[-] 2008-04-14 . 6F9BEF24C578D5D6740E080BEDD6A448 . 7680 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\rasadhlp.dll

[-] 2008-04-14 . 6F9BEF24C578D5D6740E080BEDD6A448 . 7680 . . [5.1.2600.5512] . . c:\windows\system32\rasadhlp.dll

[-] 2004-08-04 . 4CAEC028C1E21C75E17877D4522D3DB4 . 8192 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\rasadhlp.dll

.

[-] 2008-04-14 . 4E3D06D6E68EEDB52565080F55B460D3 . 19456 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\wshtcpip.dll

[-] 2008-04-14 . 4E3D06D6E68EEDB52565080F55B460D3 . 19456 . . [5.1.2600.5512] . . c:\windows\system32\wshtcpip.dll

[-] 2004-08-04 . A7F95A53EE055115DF03588997A47D4D . 19968 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\wshtcpip.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2005-05-20 925696]

"type32"="c:\program files\Microsoft IntelliType Pro\type32.exe" [2004-06-03 172032]

"IntelliPoint"="c:\program files\Microsoft IntelliPoint\point32.exe" [2004-06-03 204800]

"RTHDCPL"="RTHDCPL.EXE" [2009-03-12 17531392]

"EEventManager"="c:\program files\Epson Software\Event Manager\EEventManager.exe" [2009-12-03 976320]

.

[HKLM\~\startupfolder\C:^Documents and Settings^Arliss^Start Menu^Programs^Startup^Epson all-in-one Registration.lnk]

path=c:\documents and settings\Arliss\Start Menu\Programs\Startup\Epson all-in-one Registration.lnk

backup=c:\windows\pss\Epson all-in-one Registration.lnkStartup

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ddoctorv2]

2008-04-24 19:25 202560 ----a-w- c:\program files\Comcast\Desktop Doctor\bin\sprtcmd.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Download]

2012-01-11 15:06 987648 ----a-w- c:\documents and settings\Arliss\Local Settings\Application Data\SupportSoft\ddoctorv2\Arliss\SSGet.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"FirewallOverride"=dword:00000001

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

.

R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\N360\0404000.00C\symds.sys [1/31/2012 12:22 PM 328752]

R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\N360\0404000.00C\symefa.sys [1/31/2012 12:22 PM 173176]

R1 BHDrvx86;BHDrvx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\BASHDefs\20120215.001\BHDrvx86.sys [2/17/2012 2:27 PM 820344]

R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\N360\0404000.00C\cchpx86.sys [1/31/2012 12:22 PM 485512]

R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\N360\0404000.00C\ironx86.sys [1/31/2012 12:22 PM 116784]

R3 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\IPSDefs\20120302.002\IDSXpx86.sys [3/2/2012 6:10 PM 356280]

S2 0040591294192944mcinstcleanup;McAfee Application Installer Cleanup (0040591294192944);c:\docume~1\Arliss\LOCALS~1\Temp\004059~1.EXE c:\progra~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog -service --> c:\docume~1\Arliss\LOCALS~1\Temp\004059~1.EXE c:\progra~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog -service [?]

S2 N360;Norton Security Suite;c:\program files\Norton Security Suite\Engine\4.4.0.12\ccsvchst.exe [1/31/2012 12:21 PM 126400]

S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [12/27/2009 6:13 PM 1684736]

S3 EraserUtilDrvI10;EraserUtilDrvI10;\??\c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilDrvI10.sys --> c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilDrvI10.sys [?]

S3 MSICDSetup;MSICDSetup;\??\g:\cdriver.sys --> g:\CDriver.sys [?]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

getPlusHelper REG_MULTI_SZ getPlusHelper

.

.

------- Supplementary Scan -------

.

uInternet Settings,ProxyOverride = <local>

TCP: DhcpNameServer = 192.168.1.1

.

- - - - ORPHANS REMOVED - - - -

.

SafeBoot-mcmscsvc

SafeBoot-MCODS

.

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2013-10-04 18:07

Windows 5.1.2600 Service Pack 3 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\N360]

"ImagePath"="\"c:\program files\Norton Security Suite\Engine\4.4.0.12\ccSvcHst.exe\" /s \"N360\" /m \"c:\program files\Norton Security Suite\Engine\4.4.0.12\diMaster.dll\" /prefetch:1"

.

Completion time: 2013-10-04 18:10:35

ComboFix-quarantined-files.txt 2013-10-04 23:10

.

Pre-Run: 38,260,948,992 bytes free

Post-Run: 40,830,140,416 bytes free

.

- - End Of File - - 2BC44253F3DAB240DE088641773228A4

8F558EB6672622401DA993E1E865C861

Link to post
Share on other sites

  • Root Admin

Please disable Norton antivirus and run the following online antivirus scan.

 

 

dr_web_cureit_zpse80d87bf.jpg

  1. Please download Dr.Web CureIt! antivirus and save it to your computer. The file size is in excess of 100MB
  2. NOTE: Free usage of Dr.Web CureIt! for business purposes is illegal.
  3. Internet Explorer may show a warning when downloading - the file is safe to download from the provided link.
  4. Shutdown your antivirus to avoid any conflicts while scanning.
  5. Once the scans have completed please re-enable your antivirus.
  6. If using Malwarebytes Anti-Malware PRO you can right click over the tray icon and disable the Protection Modules
  7. If needed you can also temporarily disable it from starting with Windows
  8. Temporarily turn off any other security add-ons or applications you may also have.
  9. Once you have downloaded Dr.Web CureIt! you should right click over it and choose Properties and verify it has a Digital Signature.
  10. If it does not have a Digital Signature then do not run it.
  11. Close all open programs including all Web browsers and then double-click on drweb-cureit.exe to start the installer.
  12. You should have your User Account Control (UAC) enabled for improved security and which should then produce a dialog box asking for approval to run the installer.
  13. Click on the Yes button to start the installer.
  14. Click OK to scan your computer in the Enhanced Protection Mode
  15. Click on the check box to agree to participate in their software improvement program.
  16. Then if needed choose your Language by clicking on the small globe like icon in the upper right corner by the wrench.
  17. Then click on the Continue button and then click on the Select objects for scanning link just below the "Start scanning" button.
  18. Place a check mark on all the items except for Temporary files and System restore points - those items should not have a check mark on them.
  19. Then click on the Start scanning button.
  20. If a threat is found you can click on the Action column in the program.
  21. Your options will be Cure or Ignore
  22. If you see an item that you are absolutely sure is OK, then un-check the check box for that item, otherwise keep it on Cure.
  23. Then click on the Neutralize button.
  24. Once completed click on the green Open Report link. It will open the report in NOTEPAD
  25. Save the report to your desktop. The report will be called Cureit.log
  26. Close Dr.Web Cureit!
  27. Reboot your computer to allow files that were in use to be moved/deleted during reboot.
  28. After reboot, attach the log Cureit.log you saved previously in your next reply.
  29. Re-Enable your antivirus and other security programs when all done.


 

Link to post
Share on other sites

Thanks for the reply.  Is there a way to determine which process controls Norton?

 

I can see that Norton is installed on the machine.  However, when viewing through Task Manager or Process Explorer, there are no processes running which are IDed as Norton or Symantec.  Also, I installed CCleaner to use its Startup manager function, and I disabled the Norton entries there (Windows Startup, IE addons, Context Menu).  However, ComboFix still says there is a Norton process running.

 

Since the Norton install seems to be corrupted, should I use the Norton Removal Tool?

Link to post
Share on other sites

Thanks. I was able to uninstall Norton, then found additional old McAfee and EZArmor installations. I ran ComboFix again, and this time got no antivirus errors. However, it still would not download the MS Recovery Console, because it says boot.ini is corrupt. Should I download the Recovery Console and fix that separately?

I'm posting the second ComboFix log, just in case. I will run the Dr.Web program next, and post its log when the scan finishes.

ComboFix Log #2

---------------

ComboFix 13-10-04.02 - Arliss 10/04/2013 22:25:56.2.2 - x86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.767.379 [GMT -5:00]

Running from: c:\documents and settings\Arliss\Desktop\ComboFix.exe

.

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\windows\system32\SET53.tmp

.

.

((((((((((((((((((((((((( Files Created from 2013-09-05 to 2013-10-05 )))))))))))))))))))))))))))))))

.

.

2013-10-05 01:42 . 2013-10-05 01:42 -------- d-----w- C:\temp

2013-10-05 01:42 . 2013-03-23 06:22 65536 ----a-w- c:\windows\system32\OpenCL.dll

2013-10-04 19:20 . 2013-10-04 19:20 -------- d-----w- c:\program files\CCleaner

2013-10-04 01:37 . 2013-04-04 19:50 22856 ----a-w- c:\windows\system32\drivers\mbam.sys

2013-10-04 01:19 . 2013-10-04 03:07 -------- d-----w- c:\documents and settings\Administrator

2013-10-03 23:44 . 2013-10-05 01:45 1072544 ----a-w- c:\windows\system32\nvdrsdb0.bin

2013-10-03 23:44 . 2013-10-05 01:45 1 ----a-w- c:\windows\system32\nvdrssel.bin

2013-10-03 23:44 . 2013-10-05 01:40 1072544 ----a-w- c:\windows\system32\nvdrsdb1.bin

2013-10-03 23:21 . 2013-10-05 01:44 -------- d-----w- c:\program files\NVIDIA Corporation

2013-09-10 22:19 . 2010-02-22 22:04 2452872 -c----w- c:\windows\system32\dllcache\ieapfltr.dat

2013-09-10 22:19 . 2013-08-02 17:18 63488 -c----w- c:\windows\system32\dllcache\icardie.dll

2013-09-10 22:19 . 2013-08-02 17:18 380928 -c----w- c:\windows\system32\dllcache\ieapfltr.dll

2013-09-10 22:19 . 2013-08-01 00:07 13824 -c----w- c:\windows\system32\dllcache\ieudinit.exe

2013-09-10 21:21 . 2013-09-10 21:21 -------- d-sh--w- c:\documents and settings\Arliss\IECompatCache

2013-09-10 21:21 . 2013-09-10 21:21 -------- d-sh--w- c:\documents and settings\Arliss\PrivacIE

2013-09-10 21:20 . 2013-09-10 21:20 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache

2013-09-10 21:20 . 2013-09-10 21:20 -------- d-sh--w- c:\documents and settings\Arliss\IETldCache

2013-09-10 21:17 . 2013-09-10 22:09 -------- d-----w- c:\windows\ie8updates

2013-09-10 21:16 . 2013-08-02 17:18 78336 -c--a-w- c:\windows\system32\dllcache\ieencode.dll

2013-09-10 21:16 . 2013-08-02 17:18 78336 ----a-w- c:\windows\system32\ieencode.dll

2013-09-10 21:11 . 2013-08-08 06:05 522240 -c----w- c:\windows\system32\dllcache\jsdbgui.dll

2013-09-10 21:11 . 2011-08-16 10:45 6144 -c----w- c:\windows\system32\dllcache\iecompat.dll

2013-09-10 21:11 . 2013-08-08 06:05 630272 -c----w- c:\windows\system32\dllcache\msfeeds.dll

2013-09-10 21:11 . 2013-08-08 06:05 55296 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll

2013-09-10 21:11 . 2013-08-08 06:05 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll

2013-09-10 21:11 . 2013-08-08 06:05 743424 -c----w- c:\windows\system32\dllcache\iedvtool.dll

2013-09-10 21:11 . 2013-08-08 06:05 247808 -c----w- c:\windows\system32\dllcache\ieproxy.dll

2013-09-10 21:11 . 2013-08-08 06:05 2006016 -c----w- c:\windows\system32\dllcache\iertutil.dll

2013-09-10 21:11 . 2013-08-08 06:05 11113472 -c----w- c:\windows\system32\dllcache\ieframe.dll

.

.

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-08-09 01:56 . 2004-08-04 12:00 386560 ----a-w- c:\windows\system32\themeui.dll

2013-08-08 01:27 . 2004-08-04 12:00 1877760 ----a-w- c:\windows\system32\win32k.sys

2013-08-05 13:30 . 2004-08-04 12:00 1289728 ----a-w- c:\windows\system32\ole32.dll

2013-08-02 17:18 . 2004-08-04 12:00 17408 ----a-w- c:\windows\system32\corpol.dll

2013-08-01 04:17 . 2004-08-04 12:00 668672 ----a-w- c:\windows\system32\wininet.dll

2013-08-01 04:17 . 2004-08-04 12:00 61952 ----a-w- c:\windows\system32\tdc.ocx

2013-07-31 20:11 . 2004-08-04 12:00 810496 ----a-w- c:\windows\system32\wmvdmod.dll

2013-07-10 10:37 . 2004-08-04 12:00 406016 ----a-w- c:\windows\system32\usp10.dll

.

.

------- Sigcheck -------

Note: Unsigned files aren't necessarily malware.

.

[-] 2008-04-13 . 9F3A2F5AA6875C72BF062C712CFA2674 . 96512 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\atapi.sys

[-] 2008-04-13 . 9F3A2F5AA6875C72BF062C712CFA2674 . 96512 . . [5.1.2600.5512] . . c:\windows\system32\drivers\atapi.sys

[-] 2004-08-04 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\atapi.sys

[-] 2004-08-04 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\system32\ReinstallBackups\0000\DriverFiles\i386\atapi.sys

[-] 2004-08-04 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\system32\ReinstallBackups\0001\DriverFiles\i386\atapi.sys

[-] 2004-08-04 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\system32\ReinstallBackups\0008\DriverFiles\i386\atapi.sys

.

[-] 2008-04-13 . B153AFFAC761E7F5FCFA822B9C4E97BC . 14336 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\asyncmac.sys

[-] 2008-04-13 . B153AFFAC761E7F5FCFA822B9C4E97BC . 14336 . . [5.1.2600.5512] . . c:\windows\system32\drivers\asyncmac.sys

[-] 2004-08-04 . 02000ABF34AF4C218C35D257024807D6 . 14336 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\asyncmac.sys

.

[-] 2004-08-04 . DA1F27D85E0D1525F6621372E7B685E9 . 4224 . . [5.1.2600.0] . . c:\windows\system32\dllcache\beep.sys

[-] 2004-08-04 . DA1F27D85E0D1525F6621372E7B685E9 . 4224 . . [5.1.2600.0] . . c:\windows\system32\drivers\beep.sys

.

[-] 2008-04-13 . 463C1EC80CD17420A542B7F36A36F128 . 24576 . . [5.1.2600.5512] . . c:\windows\system32\drivers\kbdclass.sys

[-] 2008-04-13 . 463C1EC80CD17420A542B7F36A36F128 . 24576 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\kbdclass.sys

[-] 2004-08-04 . EBDEE8A2EE5393890A1ACEE971C4C246 . 24576 . . [5.1.2600.2180] . . c:\windows\system32\ReinstallBackups\0004\DriverFiles\i386\kbdclass.sys

[-] 2004-08-04 . EBDEE8A2EE5393890A1ACEE971C4C246 . 24576 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\kbdclass.sys

.

[-] 2008-04-13 . 1DF7F42665C94B825322FAE71721130D . 182656 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ndis.sys

[-] 2008-04-13 . 1DF7F42665C94B825322FAE71721130D . 182656 . . [5.1.2600.5512] . . c:\windows\system32\drivers\ndis.sys

[-] 2004-08-04 . 558635D3AF1C7546D26067D5D9B6959E . 182912 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\ndis.sys

.

[-] 2008-04-13 . 78A08DD6A8D65E697C18E1DB01C5CDCA . 574976 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ntfs.sys

[-] 2008-04-13 . 78A08DD6A8D65E697C18E1DB01C5CDCA . 574976 . . [5.1.2600.5512] . . c:\windows\system32\drivers\ntfs.sys

[-] 2004-08-04 . B78BE402C3F63DD55521F73876951CDD . 574592 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\ntfs.sys

.

[-] 2004-08-04 . 73C1E1F395918BC2C6DD67AF7591A3AD . 2944 . . [5.1.2600.0] . . c:\windows\system32\dllcache\null.sys

[-] 2004-08-04 . 73C1E1F395918BC2C6DD67AF7591A3AD . 2944 . . [5.1.2600.0] . . c:\windows\system32\drivers\null.sys

.

[-] 2008-04-14 . BF2466B3E18E970D8A976FB95FC1CA85 . 13312 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\lsass.exe

[-] 2008-04-14 . BF2466B3E18E970D8A976FB95FC1CA85 . 13312 . . [5.1.2600.5512] . . c:\windows\system32\lsass.exe

[-] 2004-08-04 . 84885F9B82F4D55C6146EBF6065D75D2 . 13312 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\lsass.exe

.

[-] 2008-04-14 . 13E67B55B3ABD7BF3FE7AAE5A0F9A9DE . 198144 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\netman.dll

[-] 2008-04-14 . 13E67B55B3ABD7BF3FE7AAE5A0F9A9DE . 198144 . . [5.1.2600.5512] . . c:\windows\system32\netman.dll

[-] 2004-08-04 . DAB9E6C7105D2EF49876FE92C524F565 . 198144 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\netman.dll

.

[-] 2008-04-14 00:11 . 1280A158C722FA95A80FB7AEBE78FA7D . 792064 . . [2001.12.4414.700] . . c:\windows\ServicePackFiles\i386\comres.dll

[-] 2008-04-14 00:11 . 1280A158C722FA95A80FB7AEBE78FA7D . 792064 . . [2001.12.4414.700] . . c:\windows\system32\comres.dll

[-] 2004-08-04 12:00 . 6728270CB7DBB776ED086F5AC4C82310 . 792064 . . [2001.12.4414.258] . . c:\windows\$NtServicePackUninstall$\comres.dll

.

[-] 2008-04-14 . 574738F61FCA2935F5265DC4E5691314 . 409088 . . [6.7.2600.5512] . . c:\windows\ServicePackFiles\i386\qmgr.dll

[-] 2008-04-14 . 574738F61FCA2935F5265DC4E5691314 . 409088 . . [6.7.2600.5512] . . c:\windows\system32\qmgr.dll

[-] 2008-04-14 . 574738F61FCA2935F5265DC4E5691314 . 409088 . . [6.7.2600.5512] . . c:\windows\system32\bits\qmgr.dll

[-] 2004-08-04 . 2C69EC7E5A311334D10DD95F338FCCEA . 382464 . . [6.6.2600.2180] . . c:\windows\$NtServicePackUninstall$\qmgr.dll

.

[-] 2009-02-09 . 6B27A5C03DFB94B4245739065431322C . 401408 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3GDR\rpcss.dll

[-] 2009-02-09 . 6B27A5C03DFB94B4245739065431322C . 401408 . . [5.1.2600.5755] . . c:\windows\system32\rpcss.dll

[-] 2009-02-09 . 6B27A5C03DFB94B4245739065431322C . 401408 . . [5.1.2600.5755] . . c:\windows\system32\dllcache\rpcss.dll

[-] 2009-02-09 . 9222562D44021B988B9F9F62207FB6F2 . 401408 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3QFE\rpcss.dll

[-] 2009-02-09 . 01095FEBF33BEEA00C2A0730B9B3EC28 . 399360 . . [5.1.2600.3520] . . c:\windows\$NtServicePackUninstall$\rpcss.dll

[-] 2009-02-09 . 24B5D53B9ACCC1E2EDCF0A878D6659D4 . 401408 . . [5.1.2600.3520] . . c:\windows\$hf_mig$\KB956572\SP2QFE\rpcss.dll

[-] 2008-04-14 . 2589FE6015A316C0F5D5112B4DA7B509 . 399360 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB956572$\rpcss.dll

[-] 2008-04-14 . 2589FE6015A316C0F5D5112B4DA7B509 . 399360 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\rpcss.dll

[-] 2004-08-04 . 5C83A4408604F737717AB96371201680 . 395776 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB956572_0$\rpcss.dll

.

[-] 2009-02-06 . 37561F8D4160D62DA86D24AE41FAE8DE . 110592 . . [5.1.2600.3520] . . c:\windows\$NtServicePackUninstall$\services.exe

[-] 2009-02-06 . 65DF52F5B8B6E9BBD183505225C37315 . 110592 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3GDR\services.exe

[-] 2009-02-06 . 65DF52F5B8B6E9BBD183505225C37315 . 110592 . . [5.1.2600.5755] . . c:\windows\system32\services.exe

[-] 2009-02-06 . 65DF52F5B8B6E9BBD183505225C37315 . 110592 . . [5.1.2600.5755] . . c:\windows\system32\dllcache\services.exe

[-] 2009-02-06 . 020CEAAEDC8EB655B6506B8C70D53BB6 . 110592 . . [5.1.2600.5755] . . c:\windows\$hf_mig$\KB956572\SP3QFE\services.exe

[-] 2009-02-06 . 4712531AB7A01B7EE059853CA17D39BD . 110592 . . [5.1.2600.3520] . . c:\windows\$hf_mig$\KB956572\SP2QFE\services.exe

[-] 2008-04-14 . 0E776ED5F7CC9F94299E70461B7B8185 . 108544 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB956572$\services.exe

[-] 2008-04-14 . 0E776ED5F7CC9F94299E70461B7B8185 . 108544 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\services.exe

[-] 2004-08-04 . C6CE6EEC82F187615D1002BB3BB50ED4 . 108032 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB956572_0$\services.exe

.

[-] 2010-08-17 . 258DD5D4283FD9F9A7166BE9AE45CE73 . 58880 . . [5.1.2600.6024] . . c:\windows\$hf_mig$\KB2347290\SP3QFE\spoolsv.exe

[-] 2010-08-17 . 60784F891563FB1B767F70117FC2428F . 58880 . . [5.1.2600.6024] . . c:\windows\system32\spoolsv.exe

[-] 2010-08-17 . 60784F891563FB1B767F70117FC2428F . 58880 . . [5.1.2600.6024] . . c:\windows\system32\dllcache\spoolsv.exe

[-] 2008-04-14 . D8E14A61ACC1D4A6CD0D38AEBAC7FA3B . 57856 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB2347290$\spoolsv.exe

[-] 2008-04-14 . D8E14A61ACC1D4A6CD0D38AEBAC7FA3B . 57856 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\spoolsv.exe

[-] 2004-08-04 . 7435B108B935E42EA92CA94F59C8E717 . 57856 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\spoolsv.exe

.

[-] 2008-04-14 . ED0EF0A136DEC83DF69F04118870003E . 507904 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\winlogon.exe

[-] 2008-04-14 . ED0EF0A136DEC83DF69F04118870003E . 507904 . . [5.1.2600.5512] . . c:\windows\system32\winlogon.exe

[-] 2004-08-04 . 01C3346C241652F43AED8E2149881BFE . 502272 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\winlogon.exe

.

[-] 2008-04-13 . 23C74D75E36E7158768DD63D92789A91 . 75264 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ipsec.sys

[-] 2008-04-13 . 23C74D75E36E7158768DD63D92789A91 . 75264 . . [5.1.2600.5512] . . c:\windows\system32\drivers\ipsec.sys

[-] 2004-08-04 . 64537AA5C003A6AFEEE1DF819062D0D1 . 74752 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\ipsec.sys

.

[-] 2010-08-23 . 93AFB83FBC1F9443CAC722FCA63D73BF . 617472 . . [5.82] . . c:\windows\system32\comctl32.dll

[-] 2010-08-23 . 93AFB83FBC1F9443CAC722FCA63D73BF . 617472 . . [5.82] . . c:\windows\system32\dllcache\comctl32.dll

[-] 2010-08-23 . 736B12B725AEB2B07F0241A9F680CB10 . 1054208 . . [6.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll

[-] 2008-04-14 . BD38D1EBE24A46BD3EDA059560AFBA12 . 1054208 . . [6.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll

[-] 2008-04-14 . 06F247492BC786CE5C24A23E178C711A . 617472 . . [5.82] . . c:\windows\$NtUninstallKB2296011$\comctl32.dll

[-] 2008-04-14 . 06F247492BC786CE5C24A23E178C711A . 617472 . . [5.82] . . c:\windows\ServicePackFiles\i386\comctl32.dll

[-] 2004-08-04 . A77DFB85FAEE49D66C74DA6024EBC69B . 611328 . . [5.82] . . c:\windows\$NtServicePackUninstall$\comctl32.dll

[-] 2004-08-04 . AEF3D788DBF40C7C4D204EA45EB0C505 . 921088 . . [6.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll

[-] 2004-08-04 . 5AF68A5E44734A082442668E9C787743 . 1050624 . . [6.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll

.

[-] 2008-04-14 . 3D4E199942E29207970E04315D02AD3B . 62464 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\cryptsvc.dll

[-] 2008-04-14 . 3D4E199942E29207970E04315D02AD3B . 62464 . . [5.1.2600.5512] . . c:\windows\system32\cryptsvc.dll

[-] 2004-08-04 . 10654F9DDCEA9C46CFB77554231BE73B . 60416 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\cryptsvc.dll

.

[-] 2008-07-07 20:32 . 60D1A6342238378BFB7545C81EE3606C . 253952 . . [2001.12.4414.320] . . c:\windows\$NtServicePackUninstall$\es.dll

[-] 2008-07-07 20:26 . D4991D98F2DB73C60D042F1AEF79EFAE . 253952 . . [2001.12.4414.706] . . c:\windows\$hf_mig$\KB950974\SP3GDR\es.dll

[-] 2008-07-07 20:26 . D4991D98F2DB73C60D042F1AEF79EFAE . 253952 . . [2001.12.4414.706] . . c:\windows\system32\es.dll

[-] 2008-07-07 20:26 . D4991D98F2DB73C60D042F1AEF79EFAE . 253952 . . [2001.12.4414.706] . . c:\windows\system32\dllcache\es.dll

[-] 2008-07-07 20:23 . F17F6226BDC0CD5F0BEF0DAF84D29BEC . 253952 . . [2001.12.4414.706] . . c:\windows\$hf_mig$\KB950974\SP3QFE\es.dll

[-] 2008-07-07 20:06 . A4AB3DCA4A383F0DF4988ABDEB84F9A4 . 253952 . . [2001.12.4414.320] . . c:\windows\$hf_mig$\KB950974\SP2QFE\es.dll

[-] 2008-04-14 00:11 . 19A799805B24990867B00C120D300C3A . 246272 . . [2001.12.4414.701] . . c:\windows\$NtUninstallKB950974$\es.dll

[-] 2008-04-14 00:11 . 19A799805B24990867B00C120D300C3A . 246272 . . [2001.12.4414.701] . . c:\windows\ServicePackFiles\i386\es.dll

[-] 2004-08-04 12:00 . ACD36A2DD7D1E9D8A060AA651DC07E63 . 243200 . . [2001.12.4414.258] . . c:\windows\$NtUninstallKB950974_0$\es.dll

.

[-] 2008-04-14 . 0DA85218E92526972A821587E6A8BF8F . 110080 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\imm32.dll

[-] 2008-04-14 . 0DA85218E92526972A821587E6A8BF8F . 110080 . . [5.1.2600.5512] . . c:\windows\system32\imm32.dll

[-] 2004-08-04 . 87CA7CE6469577F059297B9D6556D66D . 110080 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\imm32.dll

.

[-] 2008-04-14 . 2DC5A8019E2387987905F77C664E4BE2 . 19968 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\linkinfo.dll

[-] 2008-04-14 . 2DC5A8019E2387987905F77C664E4BE2 . 19968 . . [5.1.2600.5512] . . c:\windows\system32\linkinfo.dll

[-] 2004-08-04 . C2BBD044C741EA4292016C36F718D2E4 . 18944 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\linkinfo.dll

.

[-] 2008-04-14 . 012DF358CEBAA23ACB26D82077820817 . 22016 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\lpk.dll

[-] 2008-04-14 . 012DF358CEBAA23ACB26D82077820817 . 22016 . . [5.1.2600.5512] . . c:\windows\system32\lpk.dll

[-] 2004-08-04 . 74D66B3DE265E8789153414E75175F26 . 22016 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\lpk.dll

.

[-] 2008-04-14 . D7075E95AA599EE77B7A89D39296BD3D . 343040 . . [7.0.2600.5512] . . c:\windows\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.5512_x-ww_3fd60d63\msvcrt.dll

[-] 2008-04-14 . 355EDBB4D412B01F1740C17E3F50FA00 . 343040 . . [7.0.2600.5512] . . c:\windows\ServicePackFiles\i386\msvcrt.dll

[-] 2008-04-14 . 355EDBB4D412B01F1740C17E3F50FA00 . 343040 . . [7.0.2600.5512] . . c:\windows\system32\msvcrt.dll

[-] 2004-08-04 . B0FEFA816D61EC66AA765DDF534EAB5E . 343040 . . [7.0.2600.2180] . . c:\windows\$NtServicePackUninstall$\msvcrt.dll

[-] 2004-08-04 . 4200BE3808F6406DBE45A7B88DAE5035 . 322560 . . [7.0.2600.0] . . c:\windows\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.0.0_x-ww_2726e76a\msvcrt.dll

[-] 2004-08-04 . 98EC447E00229AFD88D5161A25D065DA . 343040 . . [7.0.2600.2180] . . c:\windows\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.2180_x-ww_b2505ed9\msvcrt.dll

.

[-] 2009-02-06 . 6C476D33D82F1054849790181E8F7772 . 408064 . . [5.1.2600.3520] . . c:\windows\$hf_mig$\KB968389\SP2QFE\netlogon.dll

[-] 2009-02-06 . 6C476D33D82F1054849790181E8F7772 . 408064 . . [5.1.2600.3520] . . c:\windows\$hf_mig$\KB975467\SP2QFE\netlogon.dll

[-] 2008-04-14 . 1B7F071C51B77C272875C3A23E1E4550 . 407040 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\netlogon.dll

[-] 2008-04-14 . 1B7F071C51B77C272875C3A23E1E4550 . 407040 . . [5.1.2600.5512] . . c:\windows\system32\netlogon.dll

[-] 2004-08-04 . 96353FCECBA774BB8DA74A1C6507015A . 407040 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\netlogon.dll

.

[-] 2008-04-14 . 50A166237A0FA771261275A405646CC0 . 17408 . . [6.00.2900.5512] . . c:\windows\ServicePackFiles\i386\powrprof.dll

[-] 2008-04-14 . 50A166237A0FA771261275A405646CC0 . 17408 . . [6.00.2900.5512] . . c:\windows\system32\powrprof.dll

[-] 2004-08-04 . 1B5F6923ABB450692E9FE0672C897AED . 17408 . . [6.00.2900.2180] . . c:\windows\$NtServicePackUninstall$\powrprof.dll

.

[-] 2008-04-14 . A86BB5E61BF3E39B62AB4C7E7085A084 . 181248 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\scecli.dll

[-] 2008-04-14 . A86BB5E61BF3E39B62AB4C7E7085A084 . 181248 . . [5.1.2600.5512] . . c:\windows\system32\scecli.dll

[-] 2004-08-04 . 0F78E27F563F2AAF74B91A49E2ABF19A . 180224 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\scecli.dll

.

[-] 2008-04-14 . 96E1C926F22EE1BFBAE82901A35F6BF3 . 5120 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\sfc.dll

[-] 2008-04-14 . 96E1C926F22EE1BFBAE82901A35F6BF3 . 5120 . . [5.1.2600.5512] . . c:\windows\system32\sfc.dll

[-] 2004-08-04 . E8A12A12EA9088B4327D49EDCA3ADD3E . 5120 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\sfc.dll

.

[-] 2008-04-14 . 27C6D03BCDB8CFEB96B716F3D8BE3E18 . 14336 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\svchost.exe

[-] 2008-04-14 . 27C6D03BCDB8CFEB96B716F3D8BE3E18 . 14336 . . [5.1.2600.5512] . . c:\windows\system32\svchost.exe

[-] 2004-08-04 . 8F078AE4ED187AAABC0A305146DE6716 . 14336 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\svchost.exe

.

[-] 2008-04-14 . 3CB78C17BB664637787C9A1C98F79C38 . 249856 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\tapisrv.dll

[-] 2008-04-14 . 3CB78C17BB664637787C9A1C98F79C38 . 249856 . . [5.1.2600.5512] . . c:\windows\system32\tapisrv.dll

[-] 2004-08-04 . EB4A4187D74A8EFDCBEA3EA2CB1BDFBD . 246272 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\tapisrv.dll

.

[-] 2008-04-14 . B26B135FF1B9F60C9388B4A7D16F600B . 578560 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\user32.dll

[-] 2008-04-14 . B26B135FF1B9F60C9388B4A7D16F600B . 578560 . . [5.1.2600.5512] . . c:\windows\system32\user32.dll

[-] 2004-08-04 . C72661F8552ACE7C5C85E16A3CF505C4 . 577024 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\user32.dll

.

[-] 2008-04-14 . A93AEE1928A9D7CE3E16D24EC7380F89 . 26112 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\userinit.exe

[-] 2008-04-14 . A93AEE1928A9D7CE3E16D24EC7380F89 . 26112 . . [5.1.2600.5512] . . c:\windows\system32\userinit.exe

[-] 2004-08-04 . 39B1FFB03C2296323832ACBAE50D2AFF . 24576 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\userinit.exe

.

[-] 2008-04-14 . 2CCC474EB85CEAA3E1FA1726580A3E5A . 82432 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ws2_32.dll

[-] 2008-04-14 . 2CCC474EB85CEAA3E1FA1726580A3E5A . 82432 . . [5.1.2600.5512] . . c:\windows\system32\ws2_32.dll

[-] 2004-08-04 . 2ED0B7F12A60F90092081C50FA0EC2B2 . 82944 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\ws2_32.dll

.

[-] 2008-04-14 . 9789E95E1D88EEB4B922BF3EA7779C28 . 19968 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ws2help.dll

[-] 2008-04-14 . 9789E95E1D88EEB4B922BF3EA7779C28 . 19968 . . [5.1.2600.5512] . . c:\windows\system32\ws2help.dll

[-] 2004-08-04 . 9BEACB911CA61E5881102188AB7FB431 . 19968 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\ws2help.dll

.

[-] 2008-04-14 . 12896823FB95BFB3DC9B46BCAEDC9923 . 1033728 . . [6.00.2900.5512] . . c:\windows\explorer.exe

[-] 2008-04-14 . 12896823FB95BFB3DC9B46BCAEDC9923 . 1033728 . . [6.00.2900.5512] . . c:\windows\ServicePackFiles\i386\explorer.exe

[-] 2004-08-04 . A0732187050030AE399B241436565E64 . 1032192 . . [6.00.2900.2180] . . c:\windows\$NtServicePackUninstall$\explorer.exe

.

[-] 2008-04-14 . 058710B720282CA82B909912D3EF28DB . 146432 . . [5.1.2600.5512] . . c:\windows\regedit.exe

[-] 2008-04-14 . 058710B720282CA82B909912D3EF28DB . 146432 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\regedit.exe

[-] 2004-08-04 . 783AFC80383C176B22DBF8333343992D . 146432 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\regedit.exe

.

[-] 2008-04-14 . 9B9F1C38D559047B8AC0DBA2D5FEBDE9 . 4096 . . [5.3.2600.5512] . . c:\windows\ServicePackFiles\i386\ksuser.dll

[-] 2008-04-14 . 9B9F1C38D559047B8AC0DBA2D5FEBDE9 . 4096 . . [5.3.2600.5512] . . c:\windows\system32\ksuser.dll

[-] 2004-08-04 . CBCD254547689BFF80C9F547B20911E9 . 4096 . . [5.3.2600.2180] . . c:\windows\$NtServicePackUninstall$\ksuser.dll

[-] 2004-08-04 . CBCD254547689BFF80C9F547B20911E9 . 4096 . . [5.3.2600.2180] . . c:\windows\system32\ReinstallBackups\0002\DriverFiles\i386\ksuser.dll

.

[-] 2008-04-14 . 5F1D5F88303D4A4DBC8E5F97BA967CC3 . 15360 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ctfmon.exe

[-] 2008-04-14 . 5F1D5F88303D4A4DBC8E5F97BA967CC3 . 15360 . . [5.1.2600.5512] . . c:\windows\system32\ctfmon.exe

[-] 2004-08-04 . 24232996A38C0B0CF151C2140AE29FC8 . 15360 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\ctfmon.exe

.

[-] 2008-04-14 . AFFC87E2501FCE8F09D4C10BA6421CCF . 4608 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\msimg32.dll

[-] 2008-04-14 . AFFC87E2501FCE8F09D4C10BA6421CCF . 4608 . . [5.1.2600.5512] . . c:\windows\system32\msimg32.dll

[-] 2004-08-04 . B5331F2B6F37C66C29C847F3B94FF900 . 4608 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\msimg32.dll

.

[-] 2008-04-14 . 3805DF0AC4296A34BA4BF93B346CC378 . 171008 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\srsvc.dll

[-] 2008-04-14 . 3805DF0AC4296A34BA4BF93B346CC378 . 171008 . . [5.1.2600.5512] . . c:\windows\system32\srsvc.dll

[-] 2004-08-04 . 92BDF74F12D6CBEC43C94D4B7F804838 . 170496 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\srsvc.dll

.

[-] 2008-04-14 . F92E1076C42FCD6DB3D72D8CFE9816D5 . 13824 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\wscntfy.exe

[-] 2008-04-14 . F92E1076C42FCD6DB3D72D8CFE9816D5 . 13824 . . [5.1.2600.5512] . . c:\windows\system32\wscntfy.exe

[-] 2004-08-04 . 49911DD39E023BB6C45E4E436CFBD297 . 13824 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\wscntfy.exe

.

[-] 2008-04-14 . 295D21F14C335B53CB8154E5B1F892B9 . 129024 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\xmlprov.dll

[-] 2008-04-14 . 295D21F14C335B53CB8154E5B1F892B9 . 129024 . . [5.1.2600.5512] . . c:\windows\system32\xmlprov.dll

[-] 2004-08-04 . EEF46DAB68229A14DA3D8E73C99E2959 . 129536 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\xmlprov.dll

.

[-] 2008-04-14 . 5733177BCF16EE78B99543C9B0AB81EA . 177152 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\msctfime.ime

[-] 2008-04-14 . 5733177BCF16EE78B99543C9B0AB81EA . 177152 . . [5.1.2600.5512] . . c:\windows\system32\msctfime.ime

[-] 2004-08-04 . D87041EAA67ECA4394F6D5D09C0C2885 . 177152 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\msctfime.ime

.

[-] 2008-04-14 . 6D4FEB43EE538FC5428CC7F0565AA656 . 56320 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\eventlog.dll

[-] 2008-04-14 . 6D4FEB43EE538FC5428CC7F0565AA656 . 56320 . . [5.1.2600.5512] . . c:\windows\system32\eventlog.dll

[-] 2004-08-04 . 82B24CB70E5944E6E34662205A2A5B78 . 55808 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\eventlog.dll

.

[-] 2008-04-14 . 9DD07AF82244867CA36681EA2D29CE79 . 1614848 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\sfcfiles.dll

[-] 2008-04-14 . 9DD07AF82244867CA36681EA2D29CE79 . 1614848 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll

[-] 2004-08-04 . 30A609E00BD1D4FFC49D6B5A432BE7F2 . 1580544 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\sfcfiles.dll

.

[-] 2008-04-13 . 23C74D75E36E7158768DD63D92789A91 . 75264 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ipsec.sys

[-] 2008-04-13 . 23C74D75E36E7158768DD63D92789A91 . 75264 . . [5.1.2600.5512] . . c:\windows\system32\drivers\ipsec.sys

[-] 2004-08-04 . 64537AA5C003A6AFEEE1DF819062D0D1 . 74752 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\ipsec.sys

.

[-] 2008-04-14 . 5B19B557B0C188210A56A6B699D90B8F . 59904 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\regsvc.dll

[-] 2008-04-14 . 5B19B557B0C188210A56A6B699D90B8F . 59904 . . [5.1.2600.5512] . . c:\windows\system32\regsvc.dll

[-] 2004-08-04 . 3151427DB7D87107D1C5BE58FAC53960 . 59904 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\regsvc.dll

.

[-] 2008-04-14 . 0A9A7365A1CA4319AA7C1D6CD8E4EAFA . 192512 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\schedsvc.dll

[-] 2008-04-14 . 0A9A7365A1CA4319AA7C1D6CD8E4EAFA . 192512 . . [5.1.2600.5512] . . c:\windows\system32\schedsvc.dll

[-] 2004-08-04 . 92360854316611F6CC471612213C3D92 . 190976 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\schedsvc.dll

.

[-] 2008-04-14 . 0A5679B3714EDAB99E357057EE88FCA6 . 71680 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ssdpsrv.dll

[-] 2008-04-14 . 0A5679B3714EDAB99E357057EE88FCA6 . 71680 . . [5.1.2600.5512] . . c:\windows\system32\ssdpsrv.dll

[-] 2004-08-04 . 4B8D61792F7175BED48859CC18CE4E38 . 71680 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\ssdpsrv.dll

.

[-] 2008-04-14 . FF3477C03BE7201C294C35F684B3479F . 295424 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\termsrv.dll

[-] 2008-04-14 . FF3477C03BE7201C294C35F684B3479F . 295424 . . [5.1.2600.5512] . . c:\windows\system32\termsrv.dll

[-] 2004-08-04 . B60C877D16D9C880B952FDA04ADF16E6 . 295424 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\termsrv.dll

.

[-] 2008-04-14 . 3CB32D3B8CBE79899D63280BB7A83CD9 . 344064 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\hnetcfg.dll

[-] 2008-04-14 . 3CB32D3B8CBE79899D63280BB7A83CD9 . 344064 . . [5.1.2600.5512] . . c:\windows\system32\hnetcfg.dll

[-] 2004-08-04 . 765B30C776A1780B46B479FE614F707C . 344064 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\hnetcfg.dll

.

[-] 2004-08-04 . 9859C0F6936E723E4892D7141B1327D5 . 11648 . . [5.1.2600.0] . . c:\windows\system32\drivers\acpiec.sys

.

[-] 2008-04-13 16:39 . 8BED39E3C35D6A489438B8141717A557 . 142592 . . [5.1.2601.3142] . . c:\windows\ServicePackFiles\i386\aec.sys

[-] 2008-04-13 16:39 . 8BED39E3C35D6A489438B8141717A557 . 142592 . . [5.1.2601.3142] . . c:\windows\system32\drivers\aec.sys

[-] 2004-08-03 22:39 . 841F385C6CFAF66B58FBD898722BB4F0 . 142464 . . [5.1.2601.2078] . . c:\windows\$NtServicePackUninstall$\aec.sys

.

[-] 2008-04-13 . 08FD04AA961BDC77FB983F328334E3D7 . 42368 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\agp440.sys

[-] 2008-04-13 . 08FD04AA961BDC77FB983F328334E3D7 . 42368 . . [5.1.2600.5512] . . c:\windows\system32\drivers\agp440.sys

.

[-] 2008-04-13 . 3BB22519A194418D5FEC05D800A19AD0 . 36608 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ip6fw.sys

[-] 2008-04-13 . 3BB22519A194418D5FEC05D800A19AD0 . 36608 . . [5.1.2600.5512] . . c:\windows\system32\drivers\ip6fw.sys

[-] 2004-08-04 . 4448006B6BC60E6C027932CFC38D6855 . 29056 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\ip6fw.sys

.

[-] 2010-09-18 07:18 . 842900DEDBC8E3E8DBCCCB298FD88F65 . 953856 . . [4.1.6151] . . c:\windows\$hf_mig$\KB2387149\SP3QFE\mfc40u.dll

[-] 2010-09-18 06:53 . E76A5C202E68AF5A322D16B5A78F48B9 . 953856 . . [4.1.6151] . . c:\windows\system32\mfc40u.dll

[-] 2010-09-18 06:53 . E76A5C202E68AF5A322D16B5A78F48B9 . 953856 . . [4.1.6151] . . c:\windows\system32\dllcache\mfc40u.dll

[-] 2008-04-14 00:11 . CDDD4416B2B4C7295FE3FDB6DDE57E4E . 927504 . . [4.1.0.61] . . c:\windows\$NtUninstallKB2387149$\mfc40u.dll

[-] 2008-04-14 00:11 . CDDD4416B2B4C7295FE3FDB6DDE57E4E . 927504 . . [4.1.0.61] . . c:\windows\ServicePackFiles\i386\mfc40u.dll

[-] 2004-08-04 12:00 . DDF8D47ACF8FC3FE5F7F2B95C4D4D136 . 924432 . . [4.1.6140] . . c:\windows\$NtServicePackUninstall$\mfc40u.dll

.

[-] 2008-04-14 . 986B1FF5814366D71E0AC5755C88F2D3 . 33792 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\msgsvc.dll

[-] 2008-04-14 . 986B1FF5814366D71E0AC5755C88F2D3 . 33792 . . [5.1.2600.5512] . . c:\windows\system32\msgsvc.dll

[-] 2004-08-04 . 95FD808E4AC22ABA025A7B3EAC0375D2 . 33792 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\msgsvc.dll

.

[-] 2008-04-14 00:12 . C7E39EA41233E9F5B86C8DA3A9F1E4A8 . 52224 . . [9.0.1.56] . . c:\windows\system32\mspmsnsv.dll

[-] 2008-04-14 00:12 . C7E39EA41233E9F5B86C8DA3A9F1E4A8 . 52224 . . [9.0.1.56] . . c:\windows\system32\dllcache\mspmsnsv.dll

[-] 2004-08-04 12:00 . C086483E3DBA8C1C0A687EC8D5B3D4C1 . 52224 . . [9.0.1.56] . . c:\windows\$NtServicePackUninstall$\mspmsnsv.dll

.

[-] 2008-04-14 00:12 . 156F64A3345BD23C600655FB4D10BC08 . 435200 . . [5.1.2400.5512] . . c:\windows\ServicePackFiles\i386\ntmssvc.dll

[-] 2008-04-14 00:12 . 156F64A3345BD23C600655FB4D10BC08 . 435200 . . [5.1.2400.5512] . . c:\windows\system32\ntmssvc.dll

[-] 2004-08-04 12:00 . B62F29C00AC55A761B2E45877D85EA0F . 435200 . . [5.1.2400.2180] . . c:\windows\$NtServicePackUninstall$\ntmssvc.dll

.

[-] 2008-04-14 . 1EBAFEB9A3FBDC41B8D9C7F0F687AD91 . 185856 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\upnphost.dll

[-] 2008-04-14 . 1EBAFEB9A3FBDC41B8D9C7F0F687AD91 . 185856 . . [5.1.2600.5512] . . c:\windows\system32\upnphost.dll

[-] 2004-08-04 . 0546477BDE979E33294FE97F6B3DE84A . 185344 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\upnphost.dll

.

[-] 2008-04-14 . 4D83ED8BDDEC431FC8AD907B47CFB6E3 . 367616 . . [5.3.2600.5512] . . c:\windows\ServicePackFiles\i386\dsound.dll

[-] 2008-04-14 . 4D83ED8BDDEC431FC8AD907B47CFB6E3 . 367616 . . [5.3.2600.5512] . . c:\windows\system32\dsound.dll

[-] 2004-08-04 . 55E148C01296696588EAFA425782C3E8 . 367616 . . [5.3.2600.2180] . . c:\windows\$NtServicePackUninstall$\dsound.dll

.

[-] 2008-04-14 . 0607CBC6FA20114CB491EFE4B2F9EFAD . 1689088 . . [5.03.2600.5512] . . c:\windows\ServicePackFiles\i386\d3d9.dll

[-] 2008-04-14 . 0607CBC6FA20114CB491EFE4B2F9EFAD . 1689088 . . [5.03.2600.5512] . . c:\windows\system32\d3d9.dll

[-] 2004-08-04 . D67BDBBDA86CC9AEEBBAF3217C1717D8 . 1689088 . . [5.03.2600.2180] . . c:\windows\$NtServicePackUninstall$\d3d9.dll

.

[-] 2008-04-14 . A340CD71EB535A3DD751B5F28723E50C . 279552 . . [5.03.2600.5512] . . c:\windows\ServicePackFiles\i386\ddraw.dll

[-] 2008-04-14 . A340CD71EB535A3DD751B5F28723E50C . 279552 . . [5.03.2600.5512] . . c:\windows\system32\ddraw.dll

[-] 2004-08-04 . 7ED462F353B3D915A418A689FA881F96 . 266240 . . [5.03.2600.2180] . . c:\windows\$NtServicePackUninstall$\ddraw.dll

.

[-] 2008-04-14 00:12 . 5652F6CE1D9E9D8068B9D29BC21B5409 . 84992 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\olepro32.dll

[-] 2008-04-14 00:12 . 5652F6CE1D9E9D8068B9D29BC21B5409 . 84992 . . [5.1.2600.5512] . . c:\windows\system32\olepro32.dll

[-] 2004-08-04 12:00 . B48D3193DD1474DCBCC32BF4779AC698 . 83456 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\olepro32.dll

.

[-] 2008-04-14 . DBE2B62353660ECCA0D75EA307A717E9 . 39936 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\perfctrs.dll

[-] 2008-04-14 . DBE2B62353660ECCA0D75EA307A717E9 . 39936 . . [5.1.2600.5512] . . c:\windows\system32\perfctrs.dll

[-] 2004-08-04 . 96492C721C6EA517E2BFD5381FEF55E3 . 39936 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\perfctrs.dll

.

[-] 2008-04-14 . C7CE131408739B0B3A318BE2D0032719 . 18944 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\version.dll

[-] 2008-04-14 . C7CE131408739B0B3A318BE2D0032719 . 18944 . . [5.1.2600.5512] . . c:\windows\system32\version.dll

[-] 2004-08-04 . D38408967BE738D0C1B47005BCE8CEEB . 18944 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\version.dll

.

[7] 2013-07-25 . 2AA65CE72D26FF391C7722E18A5FDCF4 . 643224 . . [7.00.6000.21348] . . c:\windows\ie7updates\KB2870699-IE7\iexplore.exe

[7] 2011-10-31 . 1C5DA2D9EA2A59D0D5C116FA3A5A21AA . 634504 . . [7.00.6000.21308] . . c:\windows\ie7updates\KB2744842-IE7\iexplore.exe

[-] 2008-04-14 . 55794B97A7FAABD2910873C85274F409 . 93184 . . [6.00.2900.5512] . . c:\windows\ServicePackFiles\i386\iexplore.exe

[-] 2004-08-04 . E7484514C0464642BE7B4DC2689354C8 . 93184 . . [6.00.2900.2180] . . c:\windows\$NtServicePackUninstall$\iexplore.exe

.

[-] 2008-04-14 . 3805DF0AC4296A34BA4BF93B346CC378 . 171008 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\srsvc.dll

[-] 2008-04-14 . 3805DF0AC4296A34BA4BF93B346CC378 . 171008 . . [5.1.2600.5512] . . c:\windows\system32\srsvc.dll

[-] 2004-08-04 . 92BDF74F12D6CBEC43C94D4B7F804838 . 170496 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\srsvc.dll

.

[-] 2008-04-14 . 54AF4B1D5459500EF0937F6D33B1914F . 175104 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\w32time.dll

[-] 2008-04-14 . 54AF4B1D5459500EF0937F6D33B1914F . 175104 . . [5.1.2600.5512] . . c:\windows\system32\w32time.dll

[-] 2004-08-04 . 2B281958F5D0CF99ED626E3EF39D5C8D . 174592 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\w32time.dll

.

[-] 2008-04-14 . 8BAD69CBAC032D4BBACFCE0306174C30 . 333824 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\wiaservc.dll

[-] 2008-04-14 . 8BAD69CBAC032D4BBACFCE0306174C30 . 333824 . . [5.1.2600.5512] . . c:\windows\system32\wiaservc.dll

[-] 2004-08-04 . D9F6C4F6B1E188ADAFC42B561D9BC2E6 . 333312 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\wiaservc.dll

.

[-] 2008-04-14 . 5C12660A97822F6E61576943B49AAAD6 . 18944 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\midimap.dll

[-] 2008-04-14 . 5C12660A97822F6E61576943B49AAAD6 . 18944 . . [5.1.2600.5512] . . c:\windows\system32\midimap.dll

[-] 2004-08-04 . 3B4702155BB2AE9DC00C06A68834BDFA . 18944 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\midimap.dll

.

[-] 2008-04-14 . 6F9BEF24C578D5D6740E080BEDD6A448 . 7680 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\rasadhlp.dll

[-] 2008-04-14 . 6F9BEF24C578D5D6740E080BEDD6A448 . 7680 . . [5.1.2600.5512] . . c:\windows\system32\rasadhlp.dll

[-] 2004-08-04 . 4CAEC028C1E21C75E17877D4522D3DB4 . 8192 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\rasadhlp.dll

.

[-] 2008-04-14 . 4E3D06D6E68EEDB52565080F55B460D3 . 19456 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\wshtcpip.dll

[-] 2008-04-14 . 4E3D06D6E68EEDB52565080F55B460D3 . 19456 . . [5.1.2600.5512] . . c:\windows\system32\wshtcpip.dll

[-] 2004-08-04 . A7F95A53EE055115DF03588997A47D4D . 19968 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\wshtcpip.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2005-05-20 925696]

"type32"="c:\program files\Microsoft IntelliType Pro\type32.exe" [2004-06-03 172032]

"IntelliPoint"="c:\program files\Microsoft IntelliPoint\point32.exe" [2004-06-03 204800]

"RTHDCPL"="RTHDCPL.EXE" [2009-03-12 17531392]

"EEventManager"="c:\program files\Epson Software\Event Manager\EEventManager.exe" [2009-12-03 976320]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2013-03-21 15517984]

.

[HKLM\~\startupfolder\C:^Documents and Settings^Arliss^Start Menu^Programs^Startup^Epson all-in-one Registration.lnk]

path=c:\documents and settings\Arliss\Start Menu\Programs\Startup\Epson all-in-one Registration.lnk

backup=c:\windows\pss\Epson all-in-one Registration.lnkStartup

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ddoctorv2]

2008-04-24 19:25 202560 ----a-w- c:\program files\Comcast\Desktop Doctor\bin\sprtcmd.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Download]

2012-01-11 15:06 987648 ----a-w- c:\documents and settings\Arliss\Local Settings\Application Data\SupportSoft\ddoctorv2\Arliss\SSGet.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"FirewallOverride"=dword:00000001

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Epson Software\\Event Manager\\EEventManager.exe"=

.

S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [12/27/2009 6:13 PM 1684736]

S3 MSICDSetup;MSICDSetup;\??\g:\cdriver.sys --> g:\CDriver.sys [?]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

getPlusHelper REG_MULTI_SZ getPlusHelper

.

.

------- Supplementary Scan -------

.

uInternet Settings,ProxyOverride = <local>

TCP: DhcpNameServer = 192.168.1.1

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2013-10-04 22:32

Windows 5.1.2600 Service Pack 3 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

Completion time: 2013-10-04 22:34:28

ComboFix-quarantined-files.txt 2013-10-05 03:34

ComboFix2.txt 2013-10-04 23:10

.

Pre-Run: 39,992,483,840 bytes free

Post-Run: 40,050,700,288 bytes free

.

- - End Of File - - 80E4E19A04B7B46311E7894869699ED3

8F558EB6672622401DA993E1E865C861

Link to post
Share on other sites

  • Root Admin

Please do the following.
 
You may have corrupted files on your disk.  Please try running the following.
First close ALL Applications as this routine will automatically restart your computer.
Click on START - RUN and copy / paste the following entry into the box and click OK

CMD /C ECHO Y|CHKDSK C: /R | SHUTDOWN /R /T 30
Link to post
Share on other sites

Thanks - I entered the chkdsk command, and the computer shut down.  I ran the Dr.Web program afterwards.  It found 2 items in the Comcast Desk Doctor.  I let the program neutralize the items, but also completely removed Desk Doctor (just to be sure).  I never got the green Open Report link after the Dr.Web scan.  Does it save its log file somewhere else, or should I run the scan again?

Link to post
Share on other sites

  • Root Admin

No, that's fine.

Please go ahead and run through the following steps and post back the logs when ready.

STEP 03

Please download Malwarebytes Anti-Rootkit from here

  • Unzip the contents to a folder in a convenient location.
  • Open the folder where the contents were unzipped and run mbar.exe
  • Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
  • Click on the Cleanup button to remove any threats and reboot if prompted to do so.
  • Wait while the system shuts down and the cleanup process is performed.
  • Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
  • When done, please post the two logs produced they will be in the MBAR folder... mbar-log.txt and system-log.txt
STEP 04

Please download Junkware Removal Tool to your desktop.

  • Shutdown your antivirus to avoid any conflicts.
  • Right click over JRT.exe and select Run as administrator on Windows Vista or Windows 7, double-click on XP.
  • The tool will open and start scanning your system.
  • Please be patient as this can take a while to complete.
  • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
  • Post the contents of JRT.txt into your next reply message
  • When completed make sure to re-enable your antivirus
STEP 05

Please download AdwCleaner by Xplode and save to your Desktop.

  • Double click on AdwCleaner.exe to run the tool.
  • Click on the Scan button.
  • AdwCleaner will begin...be patient as the scan may take some time to complete.
  • After the scan has finished, click on the Report button...a logfile (AdwCleaner[R0].txt) will open in Notepad for review.
  • The contents of the log file may be confusing. Unless you see a program name that you know should not be removed, don't worry about it. If you see an entry you want to keep, let me know about it.
  • Copy and paste the contents of that logfile in your next reply.
  • A copy of all logfiles are saved in the C:\AdwCleaner folder which was created when running the tool.
  • STEP 06

    button_eos.gif

    Please go here to run the online antivirus scannner from ESET.

    • Turn off the real time scanner of any existing antivirus program while performing the online scan
    • Tick the box next to YES, I accept the Terms of Use.
    • Click Start
    • When asked, allow the activex control to install
    • Click Start
    • Make sure that the option Remove found threats is unticked
    • Click on Advanced Settings and ensure these options are ticked:
      • Scan for potentially unwanted applications
      • Scan for potentially unsafe applications
      • Enable Anti-Stealth Technology
    • Click Scan
    • Wait for the scan to finish
    • If any threats were found, click the 'List of found threats' , then click Export to text file....
    • Save it to your desktop, then please copy and paste that log as a reply to this topic.
    STEP 07

    Please download the Farbar Recovery Scan Tool and save it to your desktop.

    Note: You need to run the version compatibale with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit

    • Double-click to run it. When the tool opens click Yes to disclaimer.
    • Press the Scan button.
    • It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
    • The first time the tool is run, it also makes another log (Addition.txt). Please attach it to your reply as well.
Link to post
Share on other sites

Thanks again.

 

STEP 03
 

Malwarebytes Anti-Rootkit BETA 1.07.0.1005
www.malwarebytes.org

Database version: v2013.10.07.01

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
Arliss :: ARLISS-9C803478 [administrator]

10/6/2013 7:52:25 PM
mbar-log-2013-10-06 (19-52-25).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 211379
Time elapsed: 9 minute(s), 16 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

Physical Sectors Detected: 0
(No malicious items detected)

(end)

 

-----------------------------------------------------------------------------------------------------------------------

 

Malwarebytes Anti-Rootkit BETA 1.07.0.1005

© Malwarebytes Corporation 2011-2012

OS version: 5.1.2600 Windows XP Service Pack 3 x86

Account is Administrative

Internet Explorer version: 8.0.6001.18702

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED, E:\ DRIVE_FIXED, F:\ DRIVE_FIXED
CPU speed: 2.009000 GHz
Memory total: 804433920, free: 392523776

Downloaded database version: v2013.10.07.01
Downloaded database version: v2013.09.30.01
=======================================
Initializing...
------------ Kernel report ------------
     10/06/2013 19:52:15
------------ Loaded modules -----------
\windows\system32\ntkrnlpa.exe
\windows\system32\hal.dll
\windows\system32\KDCOM.DLL
\windows\system32\BOOTVID.dll
ACPI.sys
\windows\system32\DRIVERS\WMILIB.SYS
pci.sys
isapnp.sys
ohci1394.sys
\windows\system32\DRIVERS\1394BUS.SYS
pciide.sys
\windows\system32\DRIVERS\PCIIDEX.SYS
MountMgr.sys
ftdisk.sys
PartMgr.sys
VolSnap.sys
atapi.sys
nvata.sys
nvgts.sys
\windows\system32\DRIVERS\SCSIPORT.SYS
disk.sys
\windows\system32\DRIVERS\CLASSPNP.SYS
fltmgr.sys
sr.sys
MpFilter.sys
KSecDD.sys
Ntfs.sys
NDIS.sys
Mup.sys
\SystemRoot\system32\DRIVERS\AmdPPM.sys
\SystemRoot\system32\DRIVERS\serial.sys
\SystemRoot\system32\DRIVERS\serenum.sys
\SystemRoot\system32\DRIVERS\parport.sys
\SystemRoot\system32\DRIVERS\i8042prt.sys
\SystemRoot\system32\DRIVERS\kbdclass.sys
\SystemRoot\system32\DRIVERS\usbohci.sys
\SystemRoot\system32\DRIVERS\USBPORT.SYS
\SystemRoot\system32\DRIVERS\usbehci.sys
\SystemRoot\system32\DRIVERS\dlkfet5b.sys
\SystemRoot\system32\DRIVERS\HDAudBus.sys
\SystemRoot\system32\DRIVERS\imapi.sys
\SystemRoot\system32\DRIVERS\cdrom.sys
\SystemRoot\system32\DRIVERS\redbook.sys
\SystemRoot\system32\DRIVERS\ks.sys
\SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
\SystemRoot\system32\DRIVERS\nvnetbus.sys
\SystemRoot\system32\DRIVERS\NVNRM.SYS
\SystemRoot\system32\DRIVERS\nv4_mini.sys
\SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
\SystemRoot\system32\DRIVERS\audstub.sys
\SystemRoot\system32\DRIVERS\rasl2tp.sys
\SystemRoot\system32\DRIVERS\ndistapi.sys
\SystemRoot\system32\DRIVERS\ndiswan.sys
\SystemRoot\system32\DRIVERS\raspppoe.sys
\SystemRoot\system32\DRIVERS\raspptp.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\SystemRoot\system32\DRIVERS\psched.sys
\SystemRoot\system32\DRIVERS\msgpc.sys
\SystemRoot\system32\DRIVERS\ptilink.sys
\SystemRoot\system32\DRIVERS\raspti.sys
\SystemRoot\system32\DRIVERS\termdd.sys
\SystemRoot\system32\DRIVERS\mouclass.sys
\SystemRoot\system32\DRIVERS\swenum.sys
\SystemRoot\system32\DRIVERS\update.sys
\SystemRoot\system32\DRIVERS\mssmbios.sys
\SystemRoot\System32\Drivers\NDProxy.SYS
\SystemRoot\system32\DRIVERS\usbhub.sys
\SystemRoot\system32\DRIVERS\USBD.SYS
\SystemRoot\system32\drivers\RtkHDAud.sys
\SystemRoot\system32\drivers\portcls.sys
\SystemRoot\system32\drivers\drmk.sys
\SystemRoot\System32\Drivers\Fs_Rec.SYS
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\SystemRoot\system32\DRIVERS\HIDPARSE.SYS
\SystemRoot\System32\drivers\vga.sys
\SystemRoot\System32\Drivers\mnmdd.SYS
\SystemRoot\System32\DRIVERS\RDPCDD.sys
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\system32\DRIVERS\rasacd.sys
\SystemRoot\system32\DRIVERS\ipsec.sys
\SystemRoot\system32\DRIVERS\tcpip.sys
\SystemRoot\system32\DRIVERS\netbt.sys
\SystemRoot\system32\DRIVERS\ipnat.sys
\SystemRoot\system32\DRIVERS\wanarp.sys
\SystemRoot\System32\drivers\ws2ifsl.sys
\SystemRoot\System32\drivers\afd.sys
\SystemRoot\system32\DRIVERS\netbios.sys
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\System32\Drivers\Fips.SYS
\SystemRoot\system32\DRIVERS\usbccgp.sys
\SystemRoot\system32\DRIVERS\hidusb.sys
\SystemRoot\system32\DRIVERS\HIDCLASS.SYS
\SystemRoot\system32\DRIVERS\kbdhid.sys
\SystemRoot\system32\DRIVERS\NuidFltr.sys
\SystemRoot\system32\DRIVERS\WDFLDR.SYS
\SystemRoot\system32\DRIVERS\Wdf01000.sys
\SystemRoot\system32\DRIVERS\mouhid.sys
\SystemRoot\system32\DRIVERS\point32.sys
\SystemRoot\System32\Drivers\Cdfs.SYS
\SystemRoot\System32\Drivers\dump_diskdump.sys
\SystemRoot\System32\Drivers\dump_nvgts.sys
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\drivers\Dxapi.sys
\SystemRoot\System32\watchdog.sys
\SystemRoot\System32\drivers\dxg.sys
\SystemRoot\System32\drivers\dxgthk.sys
\SystemRoot\System32\nv4_disp.dll
\SystemRoot\System32\ATMFD.DLL
\SystemRoot\system32\DRIVERS\ndisuio.sys
\SystemRoot\system32\drivers\wdmaud.sys
\SystemRoot\system32\drivers\sysaudio.sys
\SystemRoot\system32\DRIVERS\mrxdav.sys
\SystemRoot\System32\Drivers\ParVdm.SYS
\SystemRoot\system32\DRIVERS\srv.sys
\SystemRoot\System32\Drivers\HTTP.sys
\SystemRoot\system32\drivers\kmixer.sys
\??\C:\windows\system32\drivers\mbamchameleon.sys
\??\C:\windows\system32\drivers\MBAMSwissArmy.sys
\WINDOWS\system32\ntdll.dll
----------- End -----------
Done!
<<<1>>>
Upper Device Name: \Device\Harddisk0\DR0
Upper Device Object: 0xffffffff839e3ab8
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Scsi\nvgts1Port2Path1Target1Lun0\
Lower Device Object: 0xffffffff839dea38
Lower Device Driver Name: \Driver\nvgts\
<<<2>>>
Physical Sector Size: 512
Drive: 0, DevicePointer: 0xffffffff839e3ab8, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xffffffff83a069b0, DeviceName: Unknown, DriverName: \Driver\PartMgr\
DevicePointer: 0xffffffff839e3ab8, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
DevicePointer: 0xffffffff839de920, DeviceName: \Device\00000061\, DriverName: \Driver\ACPI\
DevicePointer: 0xffffffff839dea38, DeviceName: \Device\Scsi\nvgts1Port2Path1Target1Lun0\, DriverName: \Driver\nvgts\
------------ End ----------
Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
<<<2>>>
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Scanning drivers directory: C:\WINDOWS\SYSTEM32\drivers...
<<<2>>>
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Done!
Drive 0
Scanning MBR on drive 0...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: 30063006

Partition information:

    Partition 0 type is Primary (0x7)
    Partition is ACTIVE.
    Partition starts at LBA: 63  Numsec = 99538677
    Partition file system is NTFS
    Partition is bootable

    Partition 1 type is Extended with LBA (0xf)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 99538740  Numsec = 298728675

    Partition 2 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0

    Partition 3 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0

Disk Size: 203928109056 bytes
Sector size: 512 bytes

Scanning physical sectors of unpartitioned space on drive 0 (1-62-398277088-398297088)...
Done!
Read File: File "C:\Documents and Settings\LocalService\Cookies\index.dat" is compressed (flags = 1)
Read File: File "C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat" is compressed (flags = 1)
Scan finished
=======================================

Removal queue found; removal started
Removing C:\Documents and Settings\All Users\Application Data\Malwarebytes' Anti-Malware (portable)\MBR_0_i.mbam...
Removing C:\Documents and Settings\All Users\Application Data\Malwarebytes' Anti-Malware (portable)\Bootstrap_0_0_63_i.mbam...
Removing C:\Documents and Settings\All Users\Application Data\Malwarebytes' Anti-Malware (portable)\MBR_0_r.mbam...
Removal finished

 

 

Link to post
Share on other sites

STEP 04

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.0.4 (10.06.2013:1)
OS: Microsoft Windows XP x86
Ran by Arliss on Sun 10/06/2013 at 20:11:40.09
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

~~~ Services

 

~~~ Registry Values

Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\\DisplayName
Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\\URL

 

~~~ Registry Keys

 

~~~ Files

 

~~~ Folders

 

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Sun 10/06/2013 at 20:16:04.48
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

 

STEP 05

 

# AdwCleaner v3.006 - Report created 06/10/2013 at 20:31:39
# Updated 01/10/2013 by Xplode
# Operating System : Microsoft Windows XP Service Pack 3 (32 bits)
# Username : Arliss - ARLISS-9C803478
# Running from : C:\Documents and Settings\Arliss\Desktop\AdwCleaner.exe
# Option : Clean

***** [ Services ] *****

***** [ Files / Folders ] *****

***** [ Shortcuts ] *****

***** [ Registry ] *****

Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{EF99BD32-C1FB-11D2-892F-0090271D4F88}]
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\SoftwareUpdUtility

***** [ Browsers ] *****

-\\ Internet Explorer v8.0.6001.18702

*************************

AdwCleaner[R0].txt - [879 octets] - [06/10/2013 20:29:55]
AdwCleaner[s0].txt - [805 octets] - [06/10/2013 20:31:39]

########## EOF - C:\AdwCleaner\AdwCleaner[s0].txt - [864 octets] ##########

 

 

STEP 06

 

I did not intruct the ESET program to remove these - was that correct?

 

----------

  

C:\Program Files\AWS\WeatherBug\Local\askToolbarInstaller-1.5.0.0.exe a variant of Win32/Bundled.Toolbar.Ask.A application
C:\RECYCLER\S-1-5-21-1202660629-299502267-839522115-1004\Dc2.exe a variant of Win32/Kryptik.BLXE trojan

 

 

STEP 07

 

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 03-10-2013
Ran by Arliss (administrator) on ARLISS-9C803478 on 06-10-2013 21:41:51
Running from C:\Documents and Settings\Arliss\Desktop
Microsoft Windows XP Home Edition Service Pack 3 (X86) OS Language: English(US)
Internet Explorer Version 8
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Creative Technology Ltd) C:\windows\system32\CTsvcCDA.exe
(Oracle Corporation) C:\Program Files\Java\jre7\bin\jqs.exe
(NVIDIA Corporation) C:\windows\system32\nvsvc32.exe
(Microsoft Corporation) C:\windows\system32\wscntfy.exe
(Microsoft Corporation) C:\Program Files\Microsoft IntelliType Pro\type32.exe
(Microsoft Corporation) C:\Program Files\Microsoft IntelliPoint\point32.exe
(Realtek Semiconductor Corp.) C:\windows\RTHDCPL.EXE
(SEIKO EPSON CORPORATION) C:\Program Files\Epson Software\Event Manager\EEventManager.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\IEXPLORE.EXE
(Microsoft Corporation) C:\Program Files\Internet Explorer\IEXPLORE.EXE
(Microsoft Corporation) C:\Program Files\Internet Explorer\IEXPLORE.EXE

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [soundMAXPnP] - C:\Program Files\Analog Devices\Core\smax4pnp.exe [925696 2005-05-19] (Analog Devices, Inc.)
HKLM\...\Run: [type32] - C:\Program Files\Microsoft IntelliType Pro\type32.exe [172032 2004-06-03] (Microsoft Corporation)
HKLM\...\Run: [intelliPoint] - C:\Program Files\Microsoft IntelliPoint\point32.exe [204800 2004-06-03] (Microsoft Corporation)
HKLM\...\Run: [RTHDCPL] - C:\Windows\RTHDCPL.EXE [17531392 2009-03-12] (Realtek Semiconductor Corp.)
HKLM\...\Run: [EEventManager] - C:\Program Files\Epson Software\Event Manager\EEventManager.exe [976320 2009-12-03] (SEIKO EPSON CORPORATION)
HKLM\...\Run: [NvCplDaemon] - RUNDLL32.EXE C:\windows\system32\NvCpl.dll,NvStartup
HKLM\...\Run: [MSC] - C:\Program Files\Microsoft Security Client\msseces.exe [995184 2013-07-18] (Microsoft Corporation)
HKLM\...\Run: [sunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKU\Administrator\...\RunOnce: [sYMNRT] - C:\Program Files\Internet Explorer\iexplore.exe [ 2009-03-08] (Microsoft Corporation)
BootExecute: autocheck autochk *

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - DefaultScope {C45E413E-D612-4F2A-B751-10A6AA87BEB2} URL = http://search.yahoo.com/search?p={searchTerms}&b={startPage?}&fr=ie8
SearchScopes: HKCU - {C45E413E-D612-4F2A-B751-10A6AA87BEB2} URL = http://search.yahoo.com/search?p={searchTerms}&b={startPage?}&fr=ie8
BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1261958726546
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} http://ccfiles.creative.com/Web/softwareupdate/su2/ocx/15111/CTPID.cab
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

========================== Services (Whitelisted) =================

R2 Creative Service for CDROM Access; C:\windows\system32\CTsvcCDA.exe [44032 1999-12-11] (Creative Technology Ltd)
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [22216 2013-07-18] (Microsoft Corporation)
R2 JavaQuickStarterService; "C:\Program Files\Java\jre7\bin\jqs.exe" -service -config "C:\Program Files\Java\jre7\lib\deploy\jqs\jqs.conf"

==================== Drivers (Whitelisted) ====================

S3 AEAudioService; C:\Windows\System32\drivers\AEAudio.sys [127872 2005-03-04] (Andrea Electronics Corporation)
S3 Ambfilt; C:\Windows\System32\drivers\Ambfilt.sys [1684736 2008-08-05] (Creative)
S1 AmdK8; C:\Windows\System32\DRIVERS\AmdK8.sys [36352 2005-03-09] ()
R1 AmdPPM; C:\Windows\System32\DRIVERS\AmdPPM.sys [33792 2007-04-16] (Advanced Micro Devices)
R3 FETNDISB; C:\Windows\System32\DRIVERS\dlkfet5b.sys [43008 2007-07-13] (D-Link                              )
S3 HdAudAddService; C:\Windows\System32\drivers\HdAudio.sys [145920 2005-01-07] (Windows ® Server 2003 DDK provider)
S3 Monfilt; C:\Windows\System32\drivers\Monfilt.sys [1389056 2006-01-04] (Creative Technology Ltd.)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [211560 2013-06-18] (Microsoft Corporation)
S3 ms_mpu401; C:\Windows\System32\drivers\msmpu401.sys [2944 2001-08-17] (Microsoft Corporation)
S3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [5810 2004-08-12] ()
R3 NuidFltr; C:\Windows\System32\DRIVERS\NuidFltr.sys [14736 2009-05-09] (Microsoft Corporation)
R0 nvata; C:\Windows\System32\DRIVERS\nvata.sys [99584 2006-01-27] (NVIDIA Corporation)
S3 NVENETFD; C:\Windows\System32\DRIVERS\NVENETFD.sys [71936 2010-08-12] (NVIDIA Corporation)
R0 nvgts; C:\Windows\System32\DRIVERS\nvgts.sys [145952 2008-11-12] (NVIDIA Corporation)
R3 nvnetbus; C:\Windows\System32\DRIVERS\nvnetbus.sys [22016 2008-07-31] (NVIDIA Corporation)
S3 SenFiltService; C:\Windows\System32\drivers\Senfilt.sys [393088 2005-08-11] (Sensaura)
S3 catchme; \??\C:\DOCUME~1\Arliss\LOCALS~1\Temp\catchme.sys [x]
S4 IntelIde; No ImagePath
S3 MSICDSetup; \??\G:\CDriver.sys [x]
S3 NTIOLib_1_0_4; \??\C:\Program Files\MSI\Live Update 5\NTIOLib.sys [x]
U5 ScsiPort; C:\Windows\system32\drivers\scsiport.sys [96384 2008-04-13] (Microsoft Corporation)
U3 TlntSvr;

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2013-10-06 21:41 - 2013-10-06 21:41 - 01087213 _____ (Farbar) C:\Documents and Settings\Arliss\Desktop\FRST.exe
2013-10-06 21:41 - 2013-10-06 21:41 - 00000000 ____D C:\FRST
2013-10-06 20:37 - 2013-10-06 20:37 - 00000000 ____D C:\Program Files\ESET
2013-10-06 20:29 - 2013-10-06 20:34 - 00000000 ____D C:\AdwCleaner
2013-10-06 20:29 - 2013-10-06 20:29 - 01045226 _____ C:\Documents and Settings\Arliss\Desktop\AdwCleaner.exe
2013-10-06 20:16 - 2013-10-06 20:16 - 00000908 _____ C:\Documents and Settings\Arliss\Desktop\JRT.txt
2013-10-06 20:11 - 2013-10-06 20:11 - 00000000 ____D C:\windows\ERUNT
2013-10-06 20:10 - 2013-10-06 20:10 - 01032220 _____ (Thisisu) C:\Documents and Settings\Arliss\Desktop\JRT.exe
2013-10-06 20:09 - 2013-10-06 21:39 - 00000000 ____D C:\Documents and Settings\Arliss\Desktop\For MB post
2013-10-06 19:52 - 2013-10-06 20:09 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Malwarebytes' Anti-Malware (portable)
2013-10-06 19:51 - 2013-10-06 20:09 - 00000000 ____D C:\Documents and Settings\Arliss\Desktop\mbar
2013-10-06 19:50 - 2013-10-06 19:50 - 12907592 _____ (Malwarebytes Corp.) C:\Documents and Settings\Arliss\Desktop\mbar-1.07.0.1005.exe
2013-10-06 19:31 - 2013-10-06 20:37 - 00001654 _____ C:\windows\setupapi.log
2013-10-06 17:57 - 2013-10-06 17:57 - 00000000 ____D C:\windows\Sun
2013-10-06 17:57 - 2013-10-06 17:57 - 00000000 ____D C:\Documents and Settings\Arliss\Local Settings\Application Data\Sun
2013-10-06 17:57 - 2013-10-06 17:57 - 00000000 ____D C:\Documents and Settings\Arliss\Application Data\Oracle
2013-10-06 17:56 - 2013-10-06 17:56 - 00000000 ____D C:\Program Files\Common Files\Java
2013-10-06 17:56 - 2013-10-06 17:56 - 00000000 ____D C:\Documents and Settings\Arliss\Application Data\Macromedia
2013-10-06 17:56 - 2013-10-06 17:56 - 00000000 ____D C:\Documents and Settings\Arliss\Application Data\Adobe
2013-10-06 17:56 - 2013-10-06 17:56 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Sun
2013-10-06 17:55 - 2013-10-06 17:55 - 00000000 ____D C:\Documents and Settings\All Users\Start Menu\Programs\Java
2013-10-06 17:55 - 2013-10-06 17:54 - 00868264 _____ (Oracle Corporation) C:\windows\system32\npDeployJava1.dll
2013-10-06 17:55 - 2013-10-06 17:54 - 00790440 _____ (Oracle Corporation) C:\windows\system32\deployJava1.dll
2013-10-06 17:55 - 2013-10-06 17:54 - 00264616 _____ (Oracle Corporation) C:\windows\system32\javaws.exe
2013-10-06 17:55 - 2013-10-06 17:54 - 00175016 _____ (Oracle Corporation) C:\windows\system32\javaw.exe
2013-10-06 17:55 - 2013-10-06 17:54 - 00175016 _____ (Oracle Corporation) C:\windows\system32\java.exe
2013-10-06 17:55 - 2013-10-06 17:54 - 00144896 _____ (Oracle Corporation) C:\windows\system32\javacpl.cpl
2013-10-06 17:55 - 2013-10-06 17:54 - 00094632 _____ (Oracle Corporation) C:\windows\system32\WindowsAccessBridge.dll
2013-10-06 17:54 - 2013-10-06 17:54 - 00000000 ____D C:\Program Files\Java
2013-10-06 17:53 - 2013-10-06 21:07 - 00000830 _____ C:\windows\Tasks\Adobe Flash Player Updater.job
2013-10-06 17:53 - 2013-10-06 17:53 - 00692616 _____ (Adobe Systems Incorporated) C:\windows\system32\FlashPlayerApp.exe
2013-10-06 17:53 - 2013-10-06 17:53 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\system32\FlashPlayerCPLApp.cpl
2013-10-06 17:53 - 2013-10-06 17:53 - 00000000 ____D C:\Documents and Settings\Arliss\Application Data\Sun
2013-10-06 11:34 - 2013-10-06 11:34 - 00000000 ____D C:\Program Files\Setup Files
2013-10-06 11:29 - 2012-08-22 10:19 - 00011832 _____ (Windows ® Codename Longhorn DDK provider) C:\windows\acpimof.dll
2013-10-06 10:34 - 2012-06-02 15:18 - 00275696 _____ (Microsoft Corporation) C:\windows\system32\mucltui.dll
2013-10-06 10:34 - 2012-06-02 15:18 - 00214256 _____ (Microsoft Corporation) C:\windows\system32\muweb.dll
2013-10-06 10:34 - 2012-06-02 15:18 - 00017136 _____ (Microsoft Corporation) C:\windows\system32\mucltui.dll.mui
2013-10-06 00:37 - 2013-10-06 19:28 - 00025992 _____ (Sysinternals - www.sysinternals.com) C:\windows\system32\pgdfgsvc.exe
2013-10-06 00:37 - 2013-10-06 00:37 - 00000000 ____D C:\Documents and Settings\Arliss\Desktop\PageDefrag
2013-10-05 21:45 - 2013-10-06 20:42 - 00000384 ____H C:\windows\Tasks\Microsoft Antimalware Scheduled Scan.job
2013-10-05 21:45 - 2013-10-06 20:42 - 00000366 ____H C:\windows\Tasks\MpIdleTask.job
2013-10-05 21:42 - 2013-10-05 21:42 - 00001945 _____ C:\windows\epplauncher.mif
2013-10-05 21:38 - 2013-05-02 10:28 - 00238872 ____N (Microsoft Corporation) C:\windows\system32\MpSigStub.exe
2013-10-05 21:35 - 2013-10-05 21:35 - 00001698 _____ C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Security Essentials.lnk
2013-10-05 21:34 - 2013-10-05 21:35 - 00000000 ____D C:\Program Files\Microsoft Security Client
2013-10-05 19:05 - 2013-10-05 20:43 - 00065536 _____ C:\windows\system32\config\WindowsPowerShell.evt
2013-10-05 19:05 - 2013-10-05 20:43 - 00065536 _____ C:\windows\system32\config\EventForwarding-Operational.Evt
2013-10-05 19:04 - 2013-10-05 19:05 - 00000000 __HDC C:\windows\$968930Uinstall_KB968930$
2013-10-05 19:04 - 2013-10-05 19:04 - 00000000 ____D C:\windows\system32\winrm
2013-10-05 19:04 - 2013-10-05 19:04 - 00000000 ____D C:\windows\system32\WindowsPowerShell
2013-10-05 19:04 - 2013-10-05 19:04 - 00000000 ____D C:\windows\system32\GroupPolicy
2013-10-05 18:50 - 2013-10-05 18:50 - 00000000 ____D C:\Program Files\Microsoft.NET
2013-10-05 17:01 - 2009-01-09 14:19 - 01089593 ____C C:\windows\system32\dllcache\ntprint.cat
2013-10-05 16:45 - 2013-10-05 18:18 - 00000000 ____D C:\windows\system32\XPSViewer
2013-10-05 16:45 - 2013-10-05 16:45 - 00000000 ____D C:\Program Files\Reference Assemblies
2013-10-05 16:45 - 2013-10-05 16:45 - 00000000 ____D C:\Program Files\MSBuild
2013-10-05 16:44 - 2008-07-06 07:06 - 01676288 ____N (Microsoft Corporation) C:\windows\system32\xpssvcs.dll
2013-10-05 16:44 - 2008-07-06 07:06 - 01676288 ____C (Microsoft Corporation) C:\windows\system32\dllcache\xpssvcs.dll
2013-10-05 16:44 - 2008-07-06 07:06 - 00575488 ____N (Microsoft Corporation) C:\windows\system32\xpsshhdr.dll
2013-10-05 16:44 - 2008-07-06 07:06 - 00575488 ____C (Microsoft Corporation) C:\windows\system32\dllcache\xpsshhdr.dll
2013-10-05 16:44 - 2008-07-06 07:06 - 00117760 ____N (Microsoft Corporation) C:\windows\system32\prntvpt.dll
2013-10-05 16:44 - 2008-07-06 07:06 - 00089088 ____C (Microsoft Corporation) C:\windows\system32\dllcache\filterpipelineprintproc.dll
2013-10-05 16:44 - 2008-07-06 05:50 - 00597504 ____C (Microsoft Corporation) C:\windows\system32\dllcache\printfilterpipelinesvc.exe
2013-10-05 16:38 - 2013-10-05 16:38 - 00000000 __HDC C:\windows\$NtUninstallMSCompPackV1$
2013-10-05 16:38 - 2013-10-05 16:38 - 00000000 ____D C:\Program Files\Windows Media Connect 2
2013-10-05 16:38 - 2007-07-27 23:11 - 00016760 ____N (Microsoft Corporation) C:\windows\system32\spmsg.dll
2013-10-05 16:37 - 2013-10-05 16:38 - 00000000 __HDC C:\windows\$NtUninstallwmp11$
2013-10-05 16:36 - 2013-10-05 16:36 - 00000000 __HDC C:\windows\$NtUninstallWudf01000$
2013-10-05 16:36 - 2013-10-05 16:36 - 00000000 __HDC C:\windows\$NtUninstallWMFDist11$
2013-10-05 16:33 - 2013-10-05 20:49 - 00000000 ____D C:\windows\Microsoft.NET
2013-10-05 16:24 - 2013-10-05 16:24 - 00000000 __HDC C:\windows\$NtUninstallbasecsp$
2013-10-05 15:59 - 2013-10-05 16:01 - 00000000 __HDC C:\windows\ie8
2013-10-05 15:27 - 2013-10-05 15:27 - 00000264 _____ C:\windows\UPGRADE.TXT
2013-10-05 15:27 - 2013-10-05 15:27 - 00000000 ____D C:\windows\setup.pss
2013-10-05 15:27 - 2009-12-26 15:20 - 00000099 ___SH C:\BOOT.BAK
2013-10-04 22:49 - 2013-10-05 00:16 - 00065536 _____ C:\windows\system32\config\Doctor Web.evt
2013-10-04 22:45 - 2013-10-05 00:12 - 00000000 ____D C:\Documents and Settings\Arliss\Doctor Web
2013-10-04 22:45 - 2013-10-04 22:48 - 00065536 _____ C:\windows\system32\config\Doctor W.evt
2013-10-04 22:34 - 2013-10-04 22:34 - 00039781 _____ C:\ComboFix.txt
2013-10-04 22:10 - 2013-10-06 18:14 - 00000000 ____D C:\Documents and Settings\Arliss\My Documents\Software
2013-10-04 21:13 - 2013-10-04 21:10 - 00869456 _____ C:\Documents and Settings\Administrator\Desktop\Norton_Removal_Tool.exe
2013-10-04 20:42 - 2013-03-23 01:22 - 00065536 _____ (Khronos Group) C:\windows\system32\OpenCL.dll
2013-10-04 20:33 - 2013-10-04 20:33 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
2013-10-04 17:55 - 2011-06-26 01:45 - 00256000 _____ C:\windows\PEV.exe
2013-10-04 17:55 - 2010-11-07 12:20 - 00208896 _____ C:\windows\MBR.exe
2013-10-04 17:55 - 2009-04-19 23:56 - 00060416 _____ (NirSoft) C:\windows\NIRCMD.exe
2013-10-04 17:55 - 2000-08-30 19:00 - 00518144 _____ (SteelWerX) C:\windows\SWREG.exe
2013-10-04 17:55 - 2000-08-30 19:00 - 00406528 _____ (SteelWerX) C:\windows\SWSC.exe
2013-10-04 17:55 - 2000-08-30 19:00 - 00212480 _____ (SteelWerX) C:\windows\SWXCACLS.exe
2013-10-04 17:55 - 2000-08-30 19:00 - 00098816 _____ C:\windows\sed.exe
2013-10-04 17:55 - 2000-08-30 19:00 - 00080412 _____ C:\windows\grep.exe
2013-10-04 17:55 - 2000-08-30 19:00 - 00068096 _____ C:\windows\zip.exe
2013-10-04 14:21 - 2013-10-04 14:21 - 00000000 ____D C:\windows\pss
2013-10-04 14:20 - 2013-10-04 14:20 - 00000000 ____D C:\Program Files\CCleaner
2013-10-04 14:20 - 2013-10-04 14:20 - 00000000 ____D C:\Documents and Settings\All Users\Start Menu\Programs\CCleaner
2013-10-04 14:15 - 2013-10-04 14:15 - 00000000 ____D C:\Documents and Settings\Arliss\Desktop\ProcessExplorer
2013-10-04 13:51 - 2013-10-06 20:17 - 00000000 ____D C:\Qoobox
2013-10-04 13:50 - 2013-10-04 18:08 - 00000000 ____D C:\windows\erdnt
2013-10-04 10:55 - 2013-10-06 19:42 - 00000256 _____ C:\Documents and Settings\Arliss\Desktop\Help - Malwarebytes Forum.url
2013-10-04 00:03 - 2008-04-13 13:45 - 00026368 _____ (Microsoft Corporation) C:\windows\system32\Drivers\USBSTOR.SYS
2013-10-03 22:07 - 2013-10-03 22:07 - 00000000 ___SD C:\Documents and Settings\Administrator\UserData
2013-10-03 21:08 - 2013-10-03 21:08 - 00000000 ____D C:\Documents and Settings\Administrator\Application Data\Malwarebytes
2013-10-03 20:37 - 2013-10-03 20:37 - 00000000 ____D C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
2013-10-03 20:37 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2013-10-03 20:29 - 2013-10-03 20:29 - 00000000 ____D C:\Documents and Settings\Arliss\My Documents\My Received Files
2013-10-03 20:19 - 2013-10-04 21:15 - 00000178 ___SH C:\Documents and Settings\Administrator\ntuser.ini
2013-10-03 20:19 - 2013-10-03 22:07 - 00000000 ____D C:\Documents and Settings\Administrator
2013-10-03 20:19 - 2009-12-26 13:03 - 00001599 _____ C:\Documents and Settings\Administrator\Start Menu\Programs\Remote Assistance.lnk
2013-10-03 20:19 - 2009-12-26 13:03 - 00000792 _____ C:\Documents and Settings\Administrator\Start Menu\Programs\Windows Media Player.lnk
2013-10-03 20:19 - 2009-12-26 13:03 - 00000000 ___RD C:\Documents and Settings\Administrator\Start Menu\Programs\Accessories
2013-10-03 18:44 - 2013-10-04 20:45 - 01072544 _____ C:\windows\system32\nvdrsdb0.bin
2013-10-03 18:44 - 2013-10-04 20:45 - 00000001 _____ C:\windows\system32\nvdrssel.bin
2013-10-03 18:44 - 2013-10-04 20:40 - 01072544 _____ C:\windows\system32\nvdrsdb1.bin
2013-10-03 18:44 - 2013-10-03 18:44 - 00000000 _____ C:\windows\system32\nvdrswr.lk
2013-10-03 18:21 - 2013-10-04 20:44 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2013-09-10 17:24 - 2013-09-10 17:32 - 00000000 ____D C:\windows\ie7updates
2013-09-10 17:23 - 2013-09-10 17:23 - 00000000 __HDC C:\windows\$NtServicePackUninstallNLSDownlevelMapping$
2013-09-10 17:23 - 2013-09-10 17:23 - 00000000 __HDC C:\windows\$NtServicePackUninstallIDNMitigationAPIs$
2013-09-10 17:19 - 2013-07-31 19:07 - 00013824 ____C (Microsoft Corporation) C:\windows\system32\dllcache\ieudinit.exe
2013-09-10 17:19 - 2009-03-08 14:22 - 01241088 ____C (Microsoft Corporation) C:\windows\system32\dllcache\ieframe.dll.mui
2013-09-10 17:19 - 2009-03-08 04:31 - 00059904 ____C (Microsoft Corporation) C:\windows\system32\dllcache\icardie.dll
2013-09-10 17:19 - 2009-03-08 04:11 - 00445952 ____C (Microsoft Corporation) C:\windows\system32\dllcache\ieapfltr.dll
2013-09-10 17:19 - 2009-02-06 21:07 - 03698584 ____C (Microsoft Corporation) C:\windows\system32\dllcache\ieapfltr.dat
2013-09-10 16:21 - 2013-09-10 16:21 - 00000000 __SHD C:\Documents and Settings\Arliss\PrivacIE
2013-09-10 16:21 - 2013-09-10 16:21 - 00000000 __SHD C:\Documents and Settings\Arliss\IECompatCache
2013-09-10 16:20 - 2013-09-10 16:20 - 00000000 __SHD C:\Documents and Settings\LocalService\IETldCache
2013-09-10 16:20 - 2013-09-10 16:20 - 00000000 __SHD C:\Documents and Settings\Arliss\IETldCache
2013-09-10 16:17 - 2013-09-10 17:09 - 00000000 ____D C:\windows\ie8updates
2013-09-10 16:16 - 2013-09-10 16:19 - 00065536 _____ C:\windows\system32\config\Internet.evt
2013-09-10 16:11 - 2013-08-08 01:05 - 11113472 ____C (Microsoft Corporation) C:\windows\system32\dllcache\ieframe.dll
2013-09-10 16:11 - 2013-08-08 01:05 - 02006016 ____C (Microsoft Corporation) C:\windows\system32\dllcache\iertutil.dll
2013-09-10 16:11 - 2013-08-08 01:05 - 00743424 ____C (Microsoft Corporation) C:\windows\system32\dllcache\iedvtool.dll
2013-09-10 16:11 - 2013-08-08 01:05 - 00630272 ____C (Microsoft Corporation) C:\windows\system32\dllcache\msfeeds.dll
2013-09-10 16:11 - 2013-08-08 01:05 - 00522240 ____C (Microsoft Corporation) C:\windows\system32\dllcache\jsdbgui.dll
2013-09-10 16:11 - 2013-08-08 01:05 - 00247808 ____C (Microsoft Corporation) C:\windows\system32\dllcache\ieproxy.dll
2013-09-10 16:11 - 2013-08-08 01:05 - 00055296 ____C (Microsoft Corporation) C:\windows\system32\dllcache\msfeedsbs.dll
2013-09-10 16:11 - 2013-08-08 01:05 - 00012800 ____C (Microsoft Corporation) C:\windows\system32\dllcache\xpshims.dll
2013-09-10 16:11 - 2011-08-16 05:45 - 00006144 ____C (Microsoft Corporation) C:\windows\system32\dllcache\iecompat.dll

==================== One Month Modified Files and Folders =======

2013-10-06 21:41 - 2013-10-06 21:41 - 01087213 _____ (Farbar) C:\Documents and Settings\Arliss\Desktop\FRST.exe
2013-10-06 21:41 - 2013-10-06 21:41 - 00000000 ____D C:\FRST
2013-10-06 21:39 - 2013-10-06 20:09 - 00000000 ____D C:\Documents and Settings\Arliss\Desktop\For MB post
2013-10-06 21:07 - 2013-10-06 17:53 - 00000830 _____ C:\windows\Tasks\Adobe Flash Player Updater.job
2013-10-06 20:42 - 2013-10-05 21:45 - 00000384 ____H C:\windows\Tasks\Microsoft Antimalware Scheduled Scan.job
2013-10-06 20:42 - 2013-10-05 21:45 - 00000366 ____H C:\windows\Tasks\MpIdleTask.job
2013-10-06 20:37 - 2013-10-06 20:37 - 00000000 ____D C:\Program Files\ESET
2013-10-06 20:37 - 2013-10-06 19:31 - 00001654 _____ C:\windows\setupapi.log
2013-10-06 20:34 - 2013-10-06 20:29 - 00000000 ____D C:\AdwCleaner
2013-10-06 20:33 - 2009-12-26 13:02 - 02040491 _____ C:\windows\WindowsUpdate.log
2013-10-06 20:32 - 2009-12-26 13:22 - 00000178 __SHC C:\Documents and Settings\Arliss\ntuser.ini
2013-10-06 20:32 - 2009-12-26 13:21 - 00032298 _____ C:\windows\SchedLgU.Txt
2013-10-06 20:32 - 2009-12-26 13:21 - 00000006 ____H C:\windows\Tasks\SA.DAT
2013-10-06 20:32 - 2009-12-26 06:56 - 00000159 _____ C:\windows\wiadebug.log
2013-10-06 20:32 - 2009-12-26 06:56 - 00000049 _____ C:\windows\wiaservc.log
2013-10-06 20:29 - 2013-10-06 20:29 - 01045226 _____ C:\Documents and Settings\Arliss\Desktop\AdwCleaner.exe
2013-10-06 20:17 - 2013-10-04 13:51 - 00000000 ____D C:\Qoobox
2013-10-06 20:16 - 2013-10-06 20:16 - 00000908 _____ C:\Documents and Settings\Arliss\Desktop\JRT.txt
2013-10-06 20:11 - 2013-10-06 20:11 - 00000000 ____D C:\windows\ERUNT
2013-10-06 20:10 - 2013-10-06 20:10 - 01032220 _____ (Thisisu) C:\Documents and Settings\Arliss\Desktop\JRT.exe
2013-10-06 20:09 - 2013-10-06 19:52 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Malwarebytes' Anti-Malware (portable)
2013-10-06 20:09 - 2013-10-06 19:51 - 00000000 ____D C:\Documents and Settings\Arliss\Desktop\mbar
2013-10-06 19:50 - 2013-10-06 19:50 - 12907592 _____ (Malwarebytes Corp.) C:\Documents and Settings\Arliss\Desktop\mbar-1.07.0.1005.exe
2013-10-06 19:42 - 2013-10-04 10:55 - 00000256 _____ C:\Documents and Settings\Arliss\Desktop\Help - Malwarebytes Forum.url
2013-10-06 19:28 - 2013-10-06 00:37 - 00025992 _____ (Sysinternals - www.sysinternals.com) C:\windows\system32\pgdfgsvc.exe
2013-10-06 18:21 - 2009-12-28 08:10 - 00000000 __SHD C:\Documents and Settings\Arliss\UserData
2013-10-06 18:21 - 2009-12-26 13:22 - 00000000 ____D C:\Documents and Settings\Arliss
2013-10-06 18:14 - 2013-10-04 22:10 - 00000000 ____D C:\Documents and Settings\Arliss\My Documents\Software
2013-10-06 17:57 - 2013-10-06 17:57 - 00000000 ____D C:\windows\Sun
2013-10-06 17:57 - 2013-10-06 17:57 - 00000000 ____D C:\Documents and Settings\Arliss\Local Settings\Application Data\Sun
2013-10-06 17:57 - 2013-10-06 17:57 - 00000000 ____D C:\Documents and Settings\Arliss\Application Data\Oracle
2013-10-06 17:56 - 2013-10-06 17:56 - 00000000 ____D C:\Program Files\Common Files\Java
2013-10-06 17:56 - 2013-10-06 17:56 - 00000000 ____D C:\Documents and Settings\Arliss\Application Data\Macromedia
2013-10-06 17:56 - 2013-10-06 17:56 - 00000000 ____D C:\Documents and Settings\Arliss\Application Data\Adobe
2013-10-06 17:56 - 2013-10-06 17:56 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Sun
2013-10-06 17:55 - 2013-10-06 17:55 - 00000000 ____D C:\Documents and Settings\All Users\Start Menu\Programs\Java
2013-10-06 17:54 - 2013-10-06 17:55 - 00868264 _____ (Oracle Corporation) C:\windows\system32\npDeployJava1.dll
2013-10-06 17:54 - 2013-10-06 17:55 - 00790440 _____ (Oracle Corporation) C:\windows\system32\deployJava1.dll
2013-10-06 17:54 - 2013-10-06 17:55 - 00264616 _____ (Oracle Corporation) C:\windows\system32\javaws.exe
2013-10-06 17:54 - 2013-10-06 17:55 - 00175016 _____ (Oracle Corporation) C:\windows\system32\javaw.exe
2013-10-06 17:54 - 2013-10-06 17:55 - 00175016 _____ (Oracle Corporation) C:\windows\system32\java.exe
2013-10-06 17:54 - 2013-10-06 17:55 - 00144896 _____ (Oracle Corporation) C:\windows\system32\javacpl.cpl
2013-10-06 17:54 - 2013-10-06 17:55 - 00094632 _____ (Oracle Corporation) C:\windows\system32\WindowsAccessBridge.dll
2013-10-06 17:54 - 2013-10-06 17:54 - 00000000 ____D C:\Program Files\Java
2013-10-06 17:53 - 2013-10-06 17:53 - 00692616 _____ (Adobe Systems Incorporated) C:\windows\system32\FlashPlayerApp.exe
2013-10-06 17:53 - 2013-10-06 17:53 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\system32\FlashPlayerCPLApp.cpl
2013-10-06 17:53 - 2013-10-06 17:53 - 00000000 ____D C:\Documents and Settings\Arliss\Application Data\Sun
2013-10-06 17:30 - 2004-08-04 07:00 - 00013700 _____ C:\windows\system32\wpa.dbl
2013-10-06 11:35 - 2011-01-22 16:20 - 00000000 ____D C:\Documents and Settings\Arliss\Application Data\Epson
2013-10-06 11:35 - 2011-01-22 15:18 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\EPSON
2013-10-06 11:34 - 2013-10-06 11:34 - 00000000 ____D C:\Program Files\Setup Files
2013-10-06 11:25 - 2009-12-26 06:53 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared
2013-10-06 00:37 - 2013-10-06 00:37 - 00000000 ____D C:\Documents and Settings\Arliss\Desktop\PageDefrag
2013-10-05 22:15 - 2009-12-27 18:17 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\NOS
2013-10-05 21:42 - 2013-10-05 21:42 - 00001945 _____ C:\windows\epplauncher.mif
2013-10-05 21:42 - 2009-12-27 18:14 - 00013104 ____C C:\Documents and Settings\Arliss\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2013-10-05 21:36 - 2009-12-26 13:06 - 00000000 __SHD C:\Documents and Settings\NetworkService
2013-10-05 21:35 - 2013-10-05 21:35 - 00001698 _____ C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Security Essentials.lnk
2013-10-05 21:35 - 2013-10-05 21:34 - 00000000 ____D C:\Program Files\Microsoft Security Client
2013-10-05 20:49 - 2013-10-05 16:33 - 00000000 ____D C:\windows\Microsoft.NET
2013-10-05 20:43 - 2013-10-05 19:05 - 00065536 _____ C:\windows\system32\config\WindowsPowerShell.evt
2013-10-05 20:43 - 2013-10-05 19:05 - 00065536 _____ C:\windows\system32\config\EventForwarding-Operational.Evt
2013-10-05 20:43 - 2009-12-26 06:43 - 00000000 ____D C:\windows\security
2013-10-05 20:37 - 2009-12-26 06:53 - 00570382 _____ C:\windows\system32\PerfStringBackup.INI
2013-10-05 19:05 - 2013-10-05 19:04 - 00000000 __HDC C:\windows\$968930Uinstall_KB968930$
2013-10-05 19:05 - 2009-12-26 12:58 - 00000000 ___RD C:\Documents and Settings\All Users\Start Menu\Programs\Accessories
2013-10-05 19:05 - 2009-12-26 06:43 - 00000000 ____D C:\windows\Help
2013-10-05 19:04 - 2013-10-05 19:04 - 00000000 ____D C:\windows\system32\winrm
2013-10-05 19:04 - 2013-10-05 19:04 - 00000000 ____D C:\windows\system32\WindowsPowerShell
2013-10-05 19:04 - 2013-10-05 19:04 - 00000000 ____D C:\windows\system32\GroupPolicy
2013-10-05 18:50 - 2013-10-05 18:50 - 00000000 ____D C:\Program Files\Microsoft.NET
2013-10-05 18:18 - 2013-10-05 16:45 - 00000000 ____D C:\windows\system32\XPSViewer
2013-10-05 17:09 - 2009-12-26 13:00 - 00000000 ____D C:\windows\Registration
2013-10-05 16:57 - 2009-12-26 06:50 - 00095072 _____ C:\windows\system32\FNTCACHE.DAT
2013-10-05 16:45 - 2013-10-05 16:45 - 00000000 ____D C:\Program Files\Reference Assemblies
2013-10-05 16:45 - 2013-10-05 16:45 - 00000000 ____D C:\Program Files\MSBuild
2013-10-05 16:44 - 2009-12-26 06:43 - 00000000 ____D C:\windows\system32\spool
2013-10-05 16:38 - 2013-10-05 16:38 - 00000000 __HDC C:\windows\$NtUninstallMSCompPackV1$
2013-10-05 16:38 - 2013-10-05 16:38 - 00000000 ____D C:\Program Files\Windows Media Connect 2
2013-10-05 16:38 - 2013-10-05 16:37 - 00000000 __HDC C:\windows\$NtUninstallwmp11$
2013-10-05 16:38 - 2009-12-26 13:22 - 00000788 _____ C:\Documents and Settings\Arliss\Start Menu\Programs\Windows Media Player.lnk
2013-10-05 16:38 - 2009-12-26 13:03 - 00023392 _____ C:\windows\system32\nscompat.tlb
2013-10-05 16:38 - 2009-12-26 13:03 - 00016832 _____ C:\windows\system32\amcompat.tlb
2013-10-05 16:38 - 2004-08-04 07:00 - 00000507 _____ C:\windows\win.ini
2013-10-05 16:37 - 2009-12-26 13:02 - 00000000 __SHD C:\Documents and Settings\All Users\DRM
2013-10-05 16:36 - 2013-10-05 16:36 - 00000000 __HDC C:\windows\$NtUninstallWudf01000$
2013-10-05 16:36 - 2013-10-05 16:36 - 00000000 __HDC C:\windows\$NtUninstallWMFDist11$
2013-10-05 16:36 - 2011-01-04 21:00 - 00000000 ____D C:\windows\system32\LogFiles
2013-10-05 16:33 - 2009-12-26 06:43 - 00000000 ____D C:\windows\system32\mui
2013-10-05 16:26 - 2009-12-27 19:07 - 00000000 ___HD C:\windows\$hf_mig$
2013-10-05 16:24 - 2013-10-05 16:24 - 00000000 __HDC C:\windows\$NtUninstallbasecsp$
2013-10-05 16:11 - 2009-12-26 13:22 - 00000803 _____ C:\Documents and Settings\Arliss\Start Menu\Programs\Internet Explorer.lnk
2013-10-05 16:01 - 2013-10-05 15:59 - 00000000 __HDC C:\windows\ie8
2013-10-05 16:01 - 2009-12-26 06:43 - 00000000 ____D C:\windows\Media
2013-10-05 15:27 - 2013-10-05 15:27 - 00000264 _____ C:\windows\UPGRADE.TXT
2013-10-05 15:27 - 2013-10-05 15:27 - 00000000 ____D C:\windows\setup.pss
2013-10-05 01:00 - 2010-08-24 15:04 - 00000000 ____D C:\windows\Minidump
2013-10-05 00:21 - 2009-12-26 15:25 - 00000000 ____D C:\Documents and Settings\Arliss\Local Settings\Application Data\SupportSoft
2013-10-05 00:21 - 2009-12-26 15:24 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\SupportSoft
2013-10-05 00:16 - 2013-10-04 22:49 - 00065536 _____ C:\windows\system32\config\Doctor Web.evt
2013-10-05 00:12 - 2013-10-04 22:45 - 00000000 ____D C:\Documents and Settings\Arliss\Doctor Web
2013-10-04 22:48 - 2013-10-04 22:45 - 00065536 _____ C:\windows\system32\config\Doctor W.evt
2013-10-04 22:34 - 2013-10-04 22:34 - 00039781 _____ C:\ComboFix.txt
2013-10-04 22:32 - 2004-08-04 07:00 - 00000227 _____ C:\windows\system.ini
2013-10-04 21:28 - 2009-12-27 18:17 - 00000000 ____D C:\Program Files\Yahoo!
2013-10-04 21:15 - 2013-10-03 20:19 - 00000178 ___SH C:\Documents and Settings\Administrator\ntuser.ini
2013-10-04 21:15 - 2011-01-04 21:02 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Norton
2013-10-04 21:10 - 2013-10-04 21:13 - 00869456 _____ C:\Documents and Settings\Administrator\Desktop\Norton_Removal_Tool.exe
2013-10-04 20:45 - 2013-10-03 18:44 - 01072544 _____ C:\windows\system32\nvdrsdb0.bin
2013-10-04 20:45 - 2013-10-03 18:44 - 00000001 _____ C:\windows\system32\nvdrssel.bin
2013-10-04 20:44 - 2013-10-03 18:21 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2013-10-04 20:40 - 2013-10-03 18:44 - 01072544 _____ C:\windows\system32\nvdrsdb1.bin
2013-10-04 20:38 - 2009-12-26 13:28 - 00000000 ____D C:\windows\system32\ReinstallBackups
2013-10-04 20:33 - 2013-10-04 20:33 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
2013-10-04 20:16 - 2012-01-28 16:38 - 00000664 _____ C:\windows\system32\d3d9caps.dat
2013-10-04 18:08 - 2013-10-04 13:50 - 00000000 ____D C:\windows\erdnt
2013-10-04 14:21 - 2013-10-04 14:21 - 00000000 ____D C:\windows\pss
2013-10-04 14:20 - 2013-10-04 14:20 - 00000000 ____D C:\Program Files\CCleaner
2013-10-04 14:20 - 2013-10-04 14:20 - 00000000 ____D C:\Documents and Settings\All Users\Start Menu\Programs\CCleaner
2013-10-04 14:15 - 2013-10-04 14:15 - 00000000 ____D C:\Documents and Settings\Arliss\Desktop\ProcessExplorer
2013-10-04 14:05 - 2011-01-04 21:22 - 00003072 __SHC C:\Documents and Settings\Arliss\Desktop\Thumbs.db
2013-10-03 22:07 - 2013-10-03 22:07 - 00000000 ___SD C:\Documents and Settings\Administrator\UserData
2013-10-03 22:07 - 2013-10-03 20:19 - 00000000 ____D C:\Documents and Settings\Administrator
2013-10-03 21:08 - 2013-10-03 21:08 - 00000000 ____D C:\Documents and Settings\Administrator\Application Data\Malwarebytes
2013-10-03 20:37 - 2013-10-03 20:37 - 00000000 ____D C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
2013-10-03 20:37 - 2011-01-04 21:16 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-10-03 20:29 - 2013-10-03 20:29 - 00000000 ____D C:\Documents and Settings\Arliss\My Documents\My Received Files
2013-10-03 18:44 - 2013-10-03 18:44 - 00000000 _____ C:\windows\system32\nvdrswr.lk
2013-10-03 18:31 - 2009-12-27 18:23 - 00000000 ____D C:\Documents and Settings\Arliss\Local Settings\Application Data\WeatherBug
2013-10-03 18:12 - 2009-12-26 13:03 - 00001507 _____ C:\Documents and Settings\All Users\Start Menu\Windows Update.lnk
2013-10-03 17:04 - 2009-12-26 14:30 - 00197801 _____ C:\windows\system32\nvapps.xml
2013-09-10 17:32 - 2013-09-10 17:24 - 00000000 ____D C:\windows\ie7updates
2013-09-10 17:28 - 2009-12-26 13:22 - 00000000 ___RD C:\Documents and Settings\Arliss\Start Menu\Programs\Accessories
2013-09-10 17:23 - 2013-09-10 17:23 - 00000000 __HDC C:\windows\$NtServicePackUninstallNLSDownlevelMapping$
2013-09-10 17:23 - 2013-09-10 17:23 - 00000000 __HDC C:\windows\$NtServicePackUninstallIDNMitigationAPIs$
2013-09-10 17:09 - 2013-09-10 16:17 - 00000000 ____D C:\windows\ie8updates
2013-09-10 16:36 - 2009-12-26 12:59 - 00000000 ____D C:\Program Files\MSN
2013-09-10 16:21 - 2013-09-10 16:21 - 00000000 __SHD C:\Documents and Settings\Arliss\PrivacIE
2013-09-10 16:21 - 2013-09-10 16:21 - 00000000 __SHD C:\Documents and Settings\Arliss\IECompatCache
2013-09-10 16:20 - 2013-09-10 16:20 - 00000000 __SHD C:\Documents and Settings\LocalService\IETldCache
2013-09-10 16:20 - 2013-09-10 16:20 - 00000000 __SHD C:\Documents and Settings\Arliss\IETldCache
2013-09-10 16:20 - 2009-12-26 13:21 - 00000000 __SHD C:\Documents and Settings\LocalService
2013-09-10 16:19 - 2013-09-10 16:16 - 00065536 _____ C:\windows\system32\config\Internet.evt

Some content of TEMP:
====================
C:\Documents and Settings\Arliss\Local Settings\temp\System.Data.SQLite.dll

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== End Of Log ============================

 

----------------------------------------------------------------------------------------------------------------------------------------------------------

 

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 03-10-2013
Ran by Arliss at 2013-10-06 21:42:26
Running from C:\Documents and Settings\Arliss\Desktop
Boot Mode: Normal
==========================================================

==================== Security Center ========================

AV: Microsoft Security Essentials (Disabled - Up to date) {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}

==================== Installed Programs ======================

Adobe Flash Player 11 ActiveX (Version: 11.8.800.175)
Athlon 64 Processor Driver (Version: 1.2.2.2)
CCleaner (Version: 4.06)
Creative MediaSource 5 (Version: 5.00)
Creative Software AutoUpdate
D-Link DFE-530TX+ (Version: )
D-Link PCI Fast Ethernet Adapter
Epson Event Manager (Version: 2.40.0001)
EPSON NX125 NX127 Series Printer Uninstall
EPSON Scan
ESET Online Scanner v3
High Definition Audio Driver Package - KB888111 (Version: 20040219.000000)
Java 7 Update 40 (Version: 7.0.400)
Java Auto Updater (Version: 2.1.9.8)
Malwarebytes Anti-Malware version 1.75.0.1300 (Version: 1.75.0.1300)
Microsoft .NET Framework 1.1 (Version: 1.1.4322)
Microsoft .NET Framework 1.1 Security Update (KB2833941)
Microsoft .NET Framework 2.0 Service Pack 2 (Version: 2.2.30729)
Microsoft .NET Framework 3.0 Service Pack 2 (Version: 3.2.30729)
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6012.5000)
Microsoft Base Smart Card Cryptographic Service Provider Package
Microsoft Compression Client Pack 1.0 for Windows XP (Version: 1)
Microsoft IntelliPoint 5.2 (Version: 5.20.413.0)
Microsoft IntelliType Pro 5.2 (Version: 5.20.413.0)
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
Microsoft National Language Support Downlevel APIs
Microsoft Security Client (Version: 4.3.0216.0)
Microsoft Security Essentials (Version: 4.3.216.0)
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001)
MSN
NVIDIA Drivers (Version: 1.3)
PhotoMail Maker (Version: 1.0.0.1040)
Realtek High Definition Audio Driver (Version: 5.10.0.5809)
SoundMAX (Version: 5.10.01.4151)
Update for Microsoft .NET Framework 3.5 SP1 (KB2836940) (Version: 1)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (Version: 1)
Update for Windows Internet Explorer 8 (KB2598845) (Version: 1)
Update for Windows Internet Explorer 8 (KB2632503) (Version: 1)
Update for Windows XP (KB2141007) (Version: 1)
Update for Windows XP (KB2345886) (Version: 1)
Update for Windows XP (KB2467659) (Version: 1)
Update for Windows XP (KB2492386) (Version: 1)
Update for Windows XP (KB2541763) (Version: 1)
Update for Windows XP (KB2607712) (Version: 1)
Update for Windows XP (KB2616676) (Version: 1)
Update for Windows XP (KB2641690) (Version: 1)
Update for Windows XP (KB2661254-v2) (Version: 2)
Update for Windows XP (KB2718704) (Version: 1)
Update for Windows XP (KB2736233) (Version: 1)
Update for Windows XP (KB2749655) (Version: 1)
Update for Windows XP (KB2808679) (Version: 1)
Update for Windows XP (KB2863058) (Version: 1)
Update for Windows XP (KB951978) (Version: 1)
Update for Windows XP (KB955759) (Version: 1)
Update for Windows XP (KB967715) (Version: 1)
Update for Windows XP (KB968389) (Version: 1)
Update for Windows XP (KB971029) (Version: 1)
Update for Windows XP (KB971737) (Version: 1)
Update for Windows XP (KB973687) (Version: 1)
Update for Windows XP (KB973815) (Version: 1)
Update for Windows XP (KB978207) (Version: 1)
Update for Windows XP (KB980182) (Version: 1)
WeatherBug (Version: 7.0.0.2)
WebFldrs XP (Version: 9.50.7523)
Windows Genuine Advantage Validation Tool (KB892130)
Windows Genuine Advantage Validation Tool (KB892130) (Version: 1.7.0069.2)
Windows Internet Explorer 8 (Version: 20090308.140743)
Windows Management Framework Core
Windows Media Format 11 runtime
Windows Media Player 11
Windows XP Service Pack 3 (Version: 20080414.031525)
Yahoo! Messenger

==================== Restore Points  =========================

05-10-2013 21:32:54 Software Distribution Service 3.0
05-10-2013 22:04:19 Software Distribution Service 3.0
05-10-2013 23:39:21 Software Distribution Service 3.0
05-10-2013 23:48:40 Software Distribution Service 3.0
06-10-2013 00:04:33 Software Distribution Service 3.0
06-10-2013 02:38:42 Software Distribution Service 3.0
06-10-2013 16:24:54 Software Distribution Service 3.0
06-10-2013 16:38:57 Software Distribution Service 3.0
06-10-2013 22:54:23 Installed Java 7 Update 40

==================== Hosts content: ==========================

2004-08-04 07:00 - 2013-10-04 22:32 - 00000027 ____A C:\windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\Microsoft Antimalware Scheduled Scan.job => C:\Program Files\Microsoft Security Client\MpCmdRun.exe
Task: C:\windows\Tasks\MpIdleTask.job => C:\Program Files\Microsoft Security Client\MpCmdRun.exe

==================== Loaded Modules (whitelisted) =============

==================== Alternate Data Streams (whitelisted) =========

==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MpfService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{1a3e09be-1e45-494b-9174-d7385b45bbf5} => ""=""

==================== Faulty Device Manager Devices =============

Name: NVIDIA nForce 10/100 Mbps Ethernet
Description: NVIDIA nForce Networking Controller
Class Guid: {4D36E972-E325-11CE-BFC1-08002BE10318}
Manufacturer: NVIDIA
Service: NVENETFD
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

==================== Event log errors: =========================

Application errors:
==================
Error: (10/05/2013 09:35:23 PM) (Source: MPSampleSubmission) (User: )
Description: EventType mptelemetry, P1 0x80070003, P2 moac, P3 cachereset, P4 4.3.216.0, P5 unspecified, P6 unspecified, P7 unspecified, P8 NIL, P9 mptelemetry0, P10 mptelemetry1.

Error: (10/05/2013 03:51:40 PM) (Source: Application Hang) (User: )
Description: Hanging application iexplore.exe, version 6.0.2900.5512, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Error: (10/04/2013 09:32:14 PM) (Source: crypt32) (User: )
Description: Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> with error: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.

Error: (10/04/2013 09:32:14 PM) (Source: crypt32) (User: )
Description: Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> with error: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.

Error: (10/04/2013 09:03:04 PM) (Source: Application Error) (User: )
Description: Faulting application iexplore.exe, version 6.0.2900.5512, faulting module mshtml.dll, version 6.0.2900.6434, fault address 0x00072941.
Processing media-specific event for [iexplore.exe!ws!]

Error: (10/04/2013 09:00:35 PM) (Source: Application Error) (User: )
Description: Faulting application iexplore.exe, version 6.0.2900.5512, faulting module mshtml.dll, version 6.0.2900.6434, fault address 0x00072941.
Processing media-specific event for [iexplore.exe!ws!]

Error: (10/04/2013 02:32:14 PM) (Source: Application Error) (User: )
Description: Faulting application iexplore.exe, version 6.0.2900.5512, faulting module mshtml.dll, version 6.0.2900.6434, fault address 0x00072941.
Processing media-specific event for [iexplore.exe!ws!]

Error: (10/03/2013 07:04:19 PM) (Source: Application Error) (User: )
Description: Faulting application iexplore.exe, version 6.0.2900.5512, faulting module mshtml.dll, version 6.0.2900.6434, fault address 0x00072941.
Processing media-specific event for [iexplore.exe!ws!]

Error: (10/03/2013 06:57:46 PM) (Source: Application Error) (User: )
Description: Faulting application iexplore.exe, version 6.0.2900.5512, faulting module mshtml.dll, version 6.0.2900.6434, fault address 0x00072941.
Processing media-specific event for [iexplore.exe!ws!]

Error: (10/03/2013 06:57:09 PM) (Source: Application Error) (User: )
Description: Faulting application iexplore.exe, version 6.0.2900.5512, faulting module mshtml.dll, version 6.0.2900.6434, fault address 0x00072941.
Processing media-specific event for [iexplore.exe!ws!]

System errors:
=============
Error: (10/05/2013 09:53:41 PM) (Source: 0) (User: )
Description: \Device\Harddisk0\D

Error: (10/05/2013 09:51:47 PM) (Source: 0) (User: )
Description: \Device\Harddisk0\D

Error: (10/05/2013 09:51:31 PM) (Source: 0) (User: )
Description: \Device\Harddisk0\D

Error: (10/05/2013 06:11:28 PM) (Source: 0) (User: )
Description: \Device\Scsi\nvgts1

Error: (10/05/2013 03:58:34 PM) (Source: 0) (User: )
Description: \Device\Harddisk0\D

Error: (10/05/2013 00:17:20 AM) (Source: Service Control Manager) (User: )
Description: The following boot-start or system-start driver(s) failed to load:
nvata

Error: (10/05/2013 00:17:16 AM) (Source: 0) (User: )
Description: 0xC0000001HarddiskVolume1

Error: (10/04/2013 09:15:49 PM) (Source: DCOM) (User: NT AUTHORITY)
Description: DCOM got error "%%1084" attempting to start the service EventSystem with arguments ""
in order to run the server:
{1BE1F766-5536-11D1-B726-00C04FB926AF}

Error: (10/04/2013 09:14:43 PM) (Source: Service Control Manager) (User: )
Description: The following boot-start or system-start driver(s) failed to load:
AmdPPM
BHDrvx86
ccHP
eeCtrl
Fips
SRTSPX
SymIRON
SYMTDI

Error: (10/04/2013 09:13:38 PM) (Source: DCOM) (User: ARLISS-9C803478)
Description: DCOM got error "%%1084" attempting to start the service StiSvc with arguments ""
in order to run the server:
{A1F4E726-8CF1-11D1-BF92-0060081ED811}

Microsoft Office Sessions:
=========================
Error: (10/05/2013 09:35:23 PM) (Source: MPSampleSubmission)(User: )
Description: mptelemetry0x80070003moaccachereset4.3.216.0unspecifiedunspecifiedunspecifiedNILNILNIL

Error: (10/05/2013 03:51:40 PM) (Source: Application Hang)(User: )
Description: iexplore.exe6.0.2900.5512hungapp0.0.0.000000000

Error: (10/04/2013 09:32:14 PM) (Source: crypt32)(User: )
Description: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabA required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.

Error: (10/04/2013 09:32:14 PM) (Source: crypt32)(User: )
Description: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabA required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.

Error: (10/04/2013 09:03:04 PM) (Source: Application Error)(User: )
Description: iexplore.exe6.0.2900.5512mshtml.dll6.0.2900.643400072941

Error: (10/04/2013 09:00:35 PM) (Source: Application Error)(User: )
Description: iexplore.exe6.0.2900.5512mshtml.dll6.0.2900.643400072941

Error: (10/04/2013 02:32:14 PM) (Source: Application Error)(User: )
Description: iexplore.exe6.0.2900.5512mshtml.dll6.0.2900.643400072941

Error: (10/03/2013 07:04:19 PM) (Source: Application Error)(User: )
Description: iexplore.exe6.0.2900.5512mshtml.dll6.0.2900.643400072941

Error: (10/03/2013 06:57:46 PM) (Source: Application Error)(User: )
Description: iexplore.exe6.0.2900.5512mshtml.dll6.0.2900.643400072941

Error: (10/03/2013 06:57:09 PM) (Source: Application Error)(User: )
Description: iexplore.exe6.0.2900.5512mshtml.dll6.0.2900.643400072941

==================== Memory info ===========================

Percentage of memory in use: 57%
Total physical RAM: 767.17 MB
Available physical RAM: 329.45 MB
Total Pagefile: 1873.67 MB
Available Pagefile: 1545.27 MB
Total Virtual: 2047.88 MB
Available Virtual: 1955.28 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:47.46 GB) (Free:33.8 GB) NTFS
Drive d: () (Fixed) (Total:47.46 GB) (Free:46.94 GB) NTFS
Drive e: () (Fixed) (Total:47.46 GB) (Free:46.16 GB) NTFS
Drive f: () (Fixed) (Total:47.52 GB) (Free:47.27 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows XP) (Size: 190 GB) (Disk ID: 30063006)
Partition 1: (Active) - (Size=47 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=142 GB) - (Type=OF Extended)

==================== End Of Log ============================

Link to post
Share on other sites

  • Root Admin

Please uninstall ALL versions of Java for now.  Once done here if you want to reinstall Java you can.

 

Please download the attached fixlist.txt file and save it to the Desktop.
NOTE. It's important that both files, FRST or FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system.

Run FRST or FRST64 and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.
 

fixlist.txt

Link to post
Share on other sites

Thank you.  When I started Internet Explorer after the reboot, it showed a popup which stated my search setting had been modified by a program.  I had set the search engine to Yahoo manually, since the PC's owner uses Yahoo for email and his Home page.  I realize I can reset it to Yahoo - I just wanted to mention the popup in case it had other implications regarding the virus/spyware infections FRST cleaned out.

 

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 03-10-2013
Ran by Arliss at 2013-10-06 23:47:50 Run:1
Running from C:\Documents and Settings\Arliss\Desktop
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
DeleteJunctionsInDirectory: C:\Program Files\Windows Defender
DeleteJunctionsInDirectory: C:\Program Files\Microsoft Security Client
C:\Program Files\AWS\WeatherBug\Local\askToolbarInstaller-1.5.0.0.exe
C:\RECYCLER\S-1-5-21-1202660629-299502267-839522115-1004\Dc2.exe
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft...=ie&ar=iesearch
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - DefaultScope {C45E413E-D612-4F2A-B751-10A6AA87BEB2} URL = http://search.yahoo....rtPage?}&fr=ie8
SearchScopes: HKCU - {C45E413E-D612-4F2A-B751-10A6AA87BEB2} URL = http://search.yahoo....rtPage?}&fr=ie8
BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
R2 JavaQuickStarterService; "C:\Program Files\Java\jre7\bin\jqs.exe" -service -config "C:\Program Files\Java\jre7\lib\deploy\jqs\jqs.conf"
C:\Documents and Settings\Arliss\Local Settings\temp\System.Data.SQLite.dll

*****************

"C:\Program Files\Windows Defender" => Not Found
"C:\Program Files\Microsoft Security Client" => Deleting reparse point and unlocking started.
"C:\Program Files\Microsoft Security Client" => Deleting reparse point and unlocking completed.
C:\Program Files\AWS\WeatherBug\Local\askToolbarInstaller-1.5.0.0.exe => Moved successfully.
C:\RECYCLER\S-1-5-21-1202660629-299502267-839522115-1004\Dc2.exe => Moved successfully.
HKCU\Software\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully.
HKCU\Software\Microsoft\Internet Explorer\Main\\Search Page => Value was restored successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value deleted successfully.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{C45E413E-D612-4F2A-B751-10A6AA87BEB2} => Key deleted successfully.
HKCR\Wow6432Node\CLSID\{C45E413E-D612-4F2A-B751-10A6AA87BEB2} => Key not found.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} => Key not found.
HKCR\CLSID\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9} => Key not found.
HKCR\CLSID\{DBC80044-A445-435b-BC74-9C25C1C588A9} => Key deleted successfully.
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} => Value deleted successfully.
HKCR\CLSID\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} => Key not found.
JavaQuickStarterService => Service not found.
C:\Documents and Settings\Arliss\Local Settings\temp\System.Data.SQLite.dll => Moved successfully.

The system needs a manual reboot.

==== End of Fixlog ====

Link to post
Share on other sites

Also, one more thing I noticed:  The owner does use the WeatherBug desktop app, and asked that it remain if possible.

 

Was this line from the fixlist removing something extra from the WeatherBug folder, and will removing affect the app's use?

 

"C:\Program Files\AWS\WeatherBug\Local\askToolbarInstaller-1.5.0.0.exe => Moved successfully"

Link to post
Share on other sites

  • Root Admin

It is the Ask toolbar.  Some applications may not work as expected if removed.  You can leave it if wanted.  I'm more of a purist myself and despise almost ALL toolbars.

 

 

Please download Security Check from here or here.

  • Save it to your Desktop.
  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt; please post the contents of that document.


 

 

 

How is the computer running now?

Link to post
Share on other sites

I agree about the toolbars - hate them.  The computer seems to be running OK.  I'm going to leave it on overnight, and check it in the morning.

 

Here is the Security Check log.  I really appreciate all your help.

 

 

 

 Results of screen317's Security Check version 0.99.74 
 Windows XP Service Pack 3 x86  
 Internet Explorer 8 
``````````````Antivirus/Firewall Check:``````````````
 Windows Firewall Enabled! 
 ESET Online Scanner v3  
 Microsoft Security Essentials   
`````````Anti-malware/Other Utilities Check:`````````
 Malwarebytes Anti-Malware version 1.75.0.1300 
 CCleaner    
````````Process Check: objlist.exe by Laurent```````` 
 Microsoft Security Essentials MSMpEng.exe
 Microsoft Security Essentials msseces.exe
`````````````````System Health check`````````````````
 Total Fragmentation on Drive C:: 5%
````````````````````End of Log``````````````````````

Link to post
Share on other sites

  • Root Admin

At this time there are no more signs of an infection on your system.
However if you are still seeing any signs of an infection please let me know.

Let's go ahead and remove the tools and logs we've used during this process.

Most of the tools used are potentially dangerous to use unsupervised or if ran at the wrong time.
They are often updated daily so if you went to use them again in the future they would be outdated anyways.

The following procedures will implement some cleanup procedures to remove these tools.
It will also reset your System Restore by flushing out previous restore points and create a new restore point.
It will also remove all the backups our tools may have created.

Uninstall ComboFix (if used):

  • Turn off all active protection software including your antivirus.
  • Push the "Windows key" + "R" (between the "Ctrl" button and "Alt" Button)
  • Please copy and past the following into the box ComboFix /Uninstall and click OK.
  • Note the space between the X and the /Uninstall, it needs to be there.

CF-Uninstall.png

Remove the rest of the tools used:



Please download
OTCleanIt
and save it to your Desktop. This tool will remove all the tools we used to clean your pc.

  • Double-click OTCleanIt.exe.
  • Click the CleanUp! button.
  • Select Yes when the "Begin cleanup Process?" prompt appears.
  • If you are prompted to Reboot during the cleanup, select Yes.
  • The tool will delete itself once it finishes, if not go ahead and delete it by yourself.
  • If asked to restart the computer, please do so


Note:

If you receive a warning from your firewall or other security programs regarding
OTCleanIt
attempting to contact the internet, please allow it to do so.


AdwCleaner Removal:
  • Double click on AdwCleaner.exe to run the tool.
  • Click on Uninstall
  • Confirm with Yes

ESET antivirus Removal:
  • This tool can be uninstalled via the Control Panel, Programs, Uninstall


If there are any other left over Folders, Files, Logs then you can delete them on your own.

Please visit the following link to see how to delete old System Restore Points. Please delete all of them and create a new one at this time.
How to Delete System Protection Restore Points in Windows 7 and Windows 8

Remove all but the most recent Restore Point on Windows XP


As Java seems to get exploited on a regular basis I advise not using Java if possible but to at least disable java in your web browsers
How do I disable Java in my web browser? - Disable Java

A lot of reading here but if you take the time to read a bit of it you'll see why/how infections and general damage are so easily inflicted on the computer. There is also advice on how to prevent it and keep the system working well. Don't forget about good, solid backups of your data to an external drive that is not connected except when backing up your data. If you leave a backup drive connected and you do get infected it can easily damage, encrypt, delete, or corrupt your backups as well and then you'd lose all data.
Nothing is 100% bulletproof but with a little bit of education you can certainly swing things in your favor.


 
If you're not currently using Malwarebytes PRO then you may want to consider purchasing the product which can also help greatly reduce the risk of a future infection.
 

Link to post
Share on other sites

  • Root Admin

Glad we could help. :)

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.