Hijack.userinit and stolen.data

numoupower · March 29, 2014

Hello again MBF,

After doing a semi-routine scan of my parents' desktop PC, MBAM has found "Hijack.userinit.gen" and a large number of "Stolen.Data" files that end in .dc. I am concerned as to what this 'Stolen.Data' is and how it got there, and how to make sure it doesn't come back. :unsure:

Here is the mbam log (also the dds.txt log is below and attach.txt is attached):

Malwarebytes Anti-Malware

www.malwarebytes.org

Scan Date: 3/28/2014

Scan Time: 7:49:45 PM

Logfile: mbam1.txt

Administrator: Yes

Version: 2.00.0.1000

Malware Database: v2014.03.28.08

Rootkit Database: v2014.03.27.01

License: Free

Malware Protection: Disabled

Malicious Website Protection: Disabled

Chameleon: Disabled

OS: Windows XP Service Pack 3

CPU: x86

File System: NTFS

User: Administrator

Scan Type: Threat Scan

Result: Completed

Objects Scanned: 224600

Time Elapsed: 41 min, 47 sec

Memory: Enabled

Startup: Enabled

Filesystem: Enabled

Archives: Enabled

Rootkits: Disabled

Shuriken: Enabled

PUP: Enabled

PUM: Enabled

Processes: 0

(No malicious items detected)

Modules: 0

(No malicious items detected)

Registry Keys: 0

(No malicious items detected)

Registry Values: 0

(No malicious items detected)

Registry Data: 3

PUM.Disabled.SecurityCenter, HKLM\SOFTWARE\MICROSOFT\SECURITY CENTER|AntiVirusDisableNotify, 1, Good: (0), Bad: (1),,

[bcecb55337449a9cb2db9d6816ee2ed2]

PUM.Disabled.SecurityCenter, HKLM\SOFTWARE\MICROSOFT\SECURITY CENTER|UpdatesDisableNotify, 1, Good: (0), Bad: (1),,

[d3d507014b303501c3cc7c895ba9c838]

Hijack.UserInit.Gen, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON|Userinit, C:\WINXP\system32\userinit.exe,C:\Documents

and Settings\Administrator\My Documents\MSDCSC\msdcsc.exe, Good: (userinit.exe), Bad: (C:\WINXP\system32\userinit.exe,C:\Documents and

Settings\Administrator\My Documents\MSDCSC\msdcsc.exe),,[228695736714a98ddfaa48bb5da7d12f]

Folders: 1

Stolen.Data, C:\Documents and Settings\Administrator\Application Data\dclogs, , [d9cf3acecab137ff25f6ff386e95b14f],

Files: 23

Stolen.Data, C:\Documents and Settings\Administrator\Application Data\dclogs\2012-08-03-6.dc, , [d9cf3acecab137ff25f6ff386e95b14f],

Stolen.Data, C:\Documents and Settings\Administrator\Application Data\dclogs\2012-10-11-5.dc, , [d9cf3acecab137ff25f6ff386e95b14f],

Stolen.Data, C:\Documents and Settings\Administrator\Application Data\dclogs\2012-08-11-7.dc, , [d9cf3acecab137ff25f6ff386e95b14f],

Stolen.Data, C:\Documents and Settings\Administrator\Application Data\dclogs\2012-08-15-4.dc, , [d9cf3acecab137ff25f6ff386e95b14f],

Stolen.Data, C:\Documents and Settings\Administrator\Application Data\dclogs\2012-08-16-5.dc, , [d9cf3acecab137ff25f6ff386e95b14f],

Stolen.Data, C:\Documents and Settings\Administrator\Application Data\dclogs\2012-08-24-6.dc, , [d9cf3acecab137ff25f6ff386e95b14f],

Stolen.Data, C:\Documents and Settings\Administrator\Application Data\dclogs\2012-08-25-7.dc, , [d9cf3acecab137ff25f6ff386e95b14f],

Stolen.Data, C:\Documents and Settings\Administrator\Application Data\dclogs\2012-08-28-3.dc, , [d9cf3acecab137ff25f6ff386e95b14f],

Stolen.Data, C:\Documents and Settings\Administrator\Application Data\dclogs\2012-09-03-2.dc, , [d9cf3acecab137ff25f6ff386e95b14f],

Stolen.Data, C:\Documents and Settings\Administrator\Application Data\dclogs\2012-09-06-5.dc, , [d9cf3acecab137ff25f6ff386e95b14f],

Stolen.Data, C:\Documents and Settings\Administrator\Application Data\dclogs\2012-09-09-1.dc, , [d9cf3acecab137ff25f6ff386e95b14f],

Stolen.Data, C:\Documents and Settings\Administrator\Application Data\dclogs\2012-09-20-5.dc, , [d9cf3acecab137ff25f6ff386e95b14f],

Stolen.Data, C:\Documents and Settings\Administrator\Application Data\dclogs\2012-09-22-7.dc, , [d9cf3acecab137ff25f6ff386e95b14f],

Stolen.Data, C:\Documents and Settings\Administrator\Application Data\dclogs\2012-09-24-2.dc, , [d9cf3acecab137ff25f6ff386e95b14f],

Stolen.Data, C:\Documents and Settings\Administrator\Application Data\dclogs\2012-09-30-1.dc, , [d9cf3acecab137ff25f6ff386e95b14f],

Stolen.Data, C:\Documents and Settings\Administrator\Application Data\dclogs\2012-10-17-4.dc, , [d9cf3acecab137ff25f6ff386e95b14f],

Stolen.Data, C:\Documents and Settings\Administrator\Application Data\dclogs\2012-10-30-3.dc, , [d9cf3acecab137ff25f6ff386e95b14f],

Stolen.Data, C:\Documents and Settings\Administrator\Application Data\dclogs\2012-11-01-5.dc, , [d9cf3acecab137ff25f6ff386e95b14f],

Stolen.Data, C:\Documents and Settings\Administrator\Application Data\dclogs\2012-11-15-5.dc, , [d9cf3acecab137ff25f6ff386e95b14f],

Stolen.Data, C:\Documents and Settings\Administrator\Application Data\dclogs\2012-11-19-2.dc, , [d9cf3acecab137ff25f6ff386e95b14f],

Stolen.Data, C:\Documents and Settings\Administrator\Application Data\dclogs\2012-11-21-4.dc, , [d9cf3acecab137ff25f6ff386e95b14f],

Stolen.Data, C:\Documents and Settings\Administrator\Application Data\dclogs\2012-11-22-5.dc, , [d9cf3acecab137ff25f6ff386e95b14f],

Stolen.Data, C:\Documents and Settings\Administrator\Application Data\dclogs\2012-11-29-5.dc, , [d9cf3acecab137ff25f6ff386e95b14f],

Physical Sectors: 0

(No malicious items detected)

(end)

===================================================================================================================================================================

DDS.txt:

DDS (Ver_2012-11-20.01) - NTFS_x86

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 10.5.1

Run by Administrator at 21:17:28 on 2014-03-28

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1278.552 [GMT -3:00]

.

AV: Microsoft Security Essentials *Enabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}

AV: Microsoft Security Essentials *Disabled/Updated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}

.

============== Running Processes ================

.

c:\Program Files\Microsoft Security Client\MsMpEng.exe

C:\WINXP\system32\spoolsv.exe

C:\Program Files\SUPERAntiSpyware\SASCORE.EXE

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jqs.exe

C:\Program Files\CDBurnerXP\NMSAccessU.exe

C:\WINXP\Explorer.EXE

C:\WINXP\system32\wuauclt.exe

C:\WINXP\System32\alg.exe

C:\Program Files\Analog Devices\Core\smax4pnp.exe

C:\WINXP\system32\hkcmd.exe

C:\WINXP\system32\igfxpers.exe

C:\WINXP\System32\spool\DRIVERS\W32X86\3\E_FATIADA.EXE

C:\Program Files\Microsoft Security Client\msseces.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\Samsung\Kies\KiesTrayAgent.exe

C:\WINXP\system32\ctfmon.exe

C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

C:\Program Files\Samsung\Kies\Kies.exe

C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe

C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe

C:\WINXP\system32\wbem\wmiprvse.exe

C:\WINXP\System32\svchost.exe -k netsvcs

C:\WINXP\system32\svchost.exe -k WudfServiceGroup

C:\WINXP\system32\svchost.exe -k NetworkService

C:\WINXP\system32\svchost.exe -k LocalService

C:\WINXP\system32\svchost.exe -k imgsvc

C:\WINXP\System32\svchost.exe -k HTTPFilter

.

============== Pseudo HJT Report ===============

.

mWinlogon: Userinit = userinit.exe,

BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - c:\program files\microsoft office\office14\GROOVEEX.DLL

BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\oracle\javafx 2.1 runtime\bin\ssv.dll

BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

BHO: Google Toolbar Notifier BHO: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - c:\program files\google\googletoolbarnotifier\5.7.9012.1008\swg.dll

BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - c:\program files\microsoft office\office14\URLREDIR.DLL

BHO: Foxit Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} -

BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\oracle\javafx 2.1 runtime\bin\jp2ssv.dll

TB: Foxit Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} -

TB: Google Toolbar: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

TB: Foxit Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} -

TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"

uRun: [Google Update] "c:\documents and settings\administrator\local settings\application data\google\update\GoogleUpdate.exe" /c

uRun: [ctfmon.exe] c:\winxp\system32\ctfmon.exe

uRun: [cdloader] "c:\documents and settings\administrator\application data\mjusbsp\cdloader2.exe" MAGICJACK

uRun: [EPSON Stylus CX4800 Series] c:\winxp\system32\spool\drivers\w32x86\3\E_FATIADA.EXE /P26 "EPSON Stylus CX4800 Series" /M "Stylus CX4800" /EF "HKCU"

uRun: [sUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe

uRun: [KiesPreload] c:\program files\samsung\kies\Kies.exe /preload

uRun: [KiesAirMessage] c:\program files\samsung\kies\KiesAirMessage.exe -startup

uRun: [] c:\program files\samsung\kies\external\firmwareupdate\KiesPDLR.exe

uRun: [A24802D8E0033B87C7A71FBB6D39DEF74469BA10._service_run] "c:\documents and settings\administrator\local settings\application data\google\chrome\application\chrome.exe" --type=service

uRun: [CmTray] "c:\program files\content manager\launchCM.exe"

mRun: [soundMAXPnP] c:\program files\analog devices\core\smax4pnp.exe

mRun: [igfxtray] c:\winxp\system32\igfxtray.exe

mRun: [igfxhkcmd] c:\winxp\system32\hkcmd.exe

mRun: [igfxpers] c:\winxp\system32\igfxpers.exe

mRun: [EPSON Stylus CX4800 Series] c:\winxp\system32\spool\drivers\w32x86\3\E_FATIADA.EXE /P26 "EPSON Stylus CX4800 Series" /O6 "USB001" /M "Stylus CX4800"

mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey

mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe"

mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

mRun: [KiesTrayAgent] c:\program files\samsung\kies\KiesTrayAgent.exe

dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t

uPolicies-Explorer: NoDriveTypeAutoRun = dword:145

mPolicies-Explorer: NoDriveTypeAutoRun = dword:145

IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office14\EXCEL.EXE/3000

IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html

IE: Se&nd to OneNote - c:\progra~1\micros~3\office14\ONBttnIE.dll/105

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office14\ONBttnIE.dll

IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - c:\program files\microsoft office\office14\ONBttnIELinkedNotes.dll

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

TCP: NameServer = 192.168.1.1

TCP: Interfaces\{6574BEB9-0320-4B59-8DB6-D7C6A2DD3522} : DHCPNameServer = 192.168.1.1

Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\common files\microsoft shared\office14\MSOXMLMF.DLL

Notify: igfxcui - igfxdev.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\winxp\system32\wpdshserviceobj.dll

SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - c:\program files\microsoft office\office14\GROOVEEX.DLL

SEH: SABShellExecuteHook Class - {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - c:\program files\superantispyware\SASSEH.DLL

.

============= SERVICES / DRIVERS ===============

.

R0 MpFilter;Microsoft Malware Protection Driver;c:\winxp\system32\drivers\MpFilter.sys [2010-3-25 214696]

R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2011-7-22 12880]

R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2011-7-12 67664]

R2 !SASCORE;SAS Core Service;c:\program files\superantispyware\SASCore.exe [2012-7-11 116608]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\winxp\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\winxp\system32\drivers\ssudbus.sys [2013-1-20 83168]

S3 libusb0;libusb-win32 - Kernel Driver, Version 1.2.4.0;c:\winxp\system32\drivers\libusb0.sys [2011-12-19 21504]

S3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\winxp\system32\drivers\ssudmdm.sys [2013-1-20 181344]

S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\winxp\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2013-7-20 756392]

.

=============== File Associations ===============

.

ShellExec: Foxit Reader.exe: print="c:\program files\foxit software\foxit reader\Foxit Reader.exe"/p "%1"

ShellExec: Foxit Reader.exe: printto="c:\program files\foxit software\foxit reader\Foxit Reader.exe"/t "%1" "%2" "%3" "%4"

.

=============== Created Last 30 ================

.

2014-03-28 21:58:39 107736 ----a-w- c:\winxp\system32\drivers\MBAMSwissArmy.sys

2014-03-28 21:58:07 50648 ----a-w- c:\winxp\system32\drivers\mbamchameleon.sys

2014-03-28 21:58:07 23256 ----a-w- c:\winxp\system32\drivers\mbam.sys

2014-03-28 21:58:07 -------- d-----w- c:\program files\Malwarebytes Anti-Malware

2014-03-28 21:58:07 -------- d-----w- c:\documents and settings\all users\application data\Malwarebytes

2014-03-28 19:27:36 -------- d-----w- c:\winxp\system32\MRT

2014-03-28 19:19:00 7969936 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{5b77bc54-6dbf-43e6-a76d-f81d7f444497}\mpengine.dll

2014-03-28 19:10:28 13312 -c----w- c:\winxp\system32\dllcache\xp_eos.exe

2014-03-28 19:10:28 13312 ------w- c:\winxp\system32\xp_eos.exe

2014-03-14 13:00:40 7947048 ------w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\backup\mpengine.dll

.

==================== Find3M ====================

.

2014-03-12 02:05:48 71048 ----a-w- c:\winxp\system32\FlashPlayerCPLApp.cpl

2014-03-12 02:05:48 692616 ----a-w- c:\winxp\system32\FlashPlayerApp.exe

2014-03-12 02:05:33 5128584 ----a-w- c:\winxp\system32\FlashPlayerInstaller.exe

2014-02-24 11:46:36 920064 ----a-w- c:\winxp\system32\wininet.dll

2014-02-24 11:45:58 43520 ----a-w- c:\winxp\system32\licmgr10.dll

2014-02-24 11:45:57 1469440 ----a-w- c:\winxp\system32\inetcpl.cpl

2014-02-24 11:45:42 18944 ----a-w- c:\winxp\system32\corpol.dll

2014-02-24 10:54:21 385024 ----a-w- c:\winxp\system32\html.iec

2014-02-07 02:01:37 1879040 ----a-w- c:\winxp\system32\win32k.sys

2014-02-05 08:55:04 562688 ----a-w- c:\winxp\system32\qedit.dll

2014-01-19 07:32:23 231584 ------w- c:\winxp\system32\MpSigStub.exe

2014-01-04 03:13:05 420864 ----a-w- c:\winxp\system32\vbscript.dll

.

============= FINISH: 21:18:59.42 ===============

attach.txt

AdvancedSetup · March 31, 2014

Sorry for the delay.

This is used when the infection involved is designed to steal your data and pass it along to some control center. You should not use this computer for any type of banking or other secure operation until it has been cleaned or rebuilt. Do not change passwords from this computer either. You should log onto a known clean computer and change passwords if needed.

Let me have you run the following scanner and post back the log.

Please visit this webpage and read the ComboFix User's Guide:

Once you've read the article and are ready to use the program you can download it directly from the link below.
Important! - Please make sure you save combofix to your desktop and do not run it from your browser
Direct download link for: ComboFix.exe
Please make sure you disable your security applications before running ComboFix.
Once Combofix has completed it will produce and open a log file. Please be patient as it can take some time to load.
Please attach that log file to your next reply.
If needed the file can be located here: C:\combofix.txt
NOTE: If you receive the message "illegal operation has been attempted on a registry key that has been marked for deletion", just reboot the computer.

numoupower · April 1, 2014

Thank you so much for the reply.

I've attached the combofix.txt below.

ComboFix.txt

numoupower · April 1, 2014

I have found that MSE has quarantined Trojan.Vundo.AB back in February. I am thinking that Trojan.Vundo had something to do with the Stolen.Data or the Hijack.Userinit. Here is the log from the event viewer:

Microsoft Antimalware has detected malware or other potentially unwanted software.
For more information please see the following:
http://go.microsoft.com/fwlink/?linkid=37020&name=TrojanDropper:Win32/Vundo.AB&threatid=2147684724
Name: TrojanDropper:Win32/Vundo.AB
ID: 2147684724
Severity: Severe
Category: Trojan Dropper
Path: containerfile:_C:\Documents and Settings\Administrator\My Documents\Downloads\free_bookwolf_com.zip;file:_C:\Documents and Settings\Administrator\My Documents\Downloads\free_bookwolf_com.zip->free_bookwolf_com.exe
Detection Origin: Local machine
Detection Type: Concrete
Detection Source: Downloads and attachments
User: GORDON-30421596\Administrator
Process Name: Unknown
Signature Version: AV: 1.167.573.0, AS: 1.167.573.0, NIS: 0.0.0.0
Engine Version: AM: 1.1.10302.0, NIS: 0.0.0.0

AdvancedSetup · April 5, 2014

Sorry for the delay. I did reply to you already but it looks like the board lost connection when I replied. Then when I closed my browser all was gone.

Anyway.... please run the following

Please Run TFC by OldTimer to clear temporary files:

Download TFC from here and save it to your desktop.
http://oldtimer.geekstogo.com/TFC.exe
Close any open programs and Internet browsers.
Double click TFC.exe to run it on XP (for Vista and Windows 7 right click and choose "Run as administrator") and once it opens click on the Start button on the lower left of the program to allow it to begin cleaning.
Please be patient as clearing out temp files may take a while.
Once it completes you may be prompted to restart your computer, please do so.
Once it's finished you may delete TFC.exe from your desktop or save it for later use for the cleaning of temporary files.

Then restart the computer and run the following and post back the logs

Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system.
You can check here if you're not sure if your computer is 32-bit or 64-bit

Double-click to run it. When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it also makes another log (Addition.txt). Please copy and paste it to your reply as well.

numoupower · April 5, 2014

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 13-03-2014 01

Ran by Administrator (administrator) on GORDON-30421596 on 04-04-2014 22:55:24

Running from C:\Documents and Settings\Administrator\Desktop

Microsoft Windows XP Professional Service Pack 3 (X86) OS Language: English(US)

Internet Explorer Version 8

Boot Mode: Normal

The only official download link for FRST:

Download link for 32-Bit version:

Download link for 64-Bit Version:

Download link from any site other than Bleeping Computer is unpermitted or outdated.

See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(Microsoft Corporation) C:\WINXP\System32\smss.exe

(Microsoft Corporation) C:\WINXP\system32\csrss.exe

(Microsoft Corporation) C:\WINXP\system32\winlogon.exe

(Microsoft Corporation) C:\WINXP\system32\services.exe

(Microsoft Corporation) C:\WINXP\system32\lsass.exe

(Microsoft Corporation) C:\WINXP\system32\svchost.exe

(Microsoft Corporation) c:\Program Files\Microsoft Security Client\MsMpEng.exe

(Microsoft Corporation) C:\WINXP\System32\svchost.exe

(Microsoft Corporation) C:\WINXP\system32\svchost.exe

(Microsoft Corporation) C:\WINXP\system32\spoolsv.exe

(Microsoft Corporation) C:\WINXP\system32\svchost.exe

(Microsoft Corporation) C:\WINXP\Explorer.EXE

(SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCORE.EXE

(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Microsoft Corporation) C:\WINXP\system32\svchost.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Oracle Corporation) C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jqs.exe

() C:\Program Files\CDBurnerXP\NMSAccessU.exe

(Smart Link) C:\WINXP\system32\slserv.exe

(Analog Devices, Inc.) C:\Program Files\Analog Devices\Core\smax4pnp.exe

(Microsoft Corporation) C:\WINXP\system32\svchost.exe

(Intel Corporation) C:\WINXP\system32\hkcmd.exe

(Intel Corporation) C:\WINXP\system32\igfxpers.exe

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe

(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe

(Sun Microsystems, Inc.) C:\Program Files\Common Files\Java\Java Update\jusched.exe

(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Kies\KiesTrayAgent.exe

(SEIKO EPSON CORPORATION) C:\WINXP\System32\spool\DRIVERS\W32X86\3\E_FATIADA.EXE

(Microsoft Corporation) C:\WINXP\system32\wuauclt.exe

(SUPERAntiSpyware) C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

(Samsung) C:\Program Files\Samsung\Kies\Kies.exe

(Google Inc.) C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe

() C:\Program Files\Content Manager\CmTray.exe

(Microsoft Corporation) C:\WINXP\system32\wbem\wmiprvse.exe

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

(Microsoft Corporation) C:\WINXP\System32\alg.exe

(Microsoft Corporation) C:\WINXP\System32\svchost.exe

(Google Inc.) C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [soundMAXPnP] - C:\Program Files\Analog Devices\Core\smax4pnp.exe [1404928 2004-10-14] (Analog Devices, Inc.)

HKLM\...\Run: [igfxtray] - C:\WINXP\system32\igfxtray.exe [94208 2005-09-20] (Intel Corporation)

HKLM\...\Run: [igfxhkcmd] - C:\WINXP\system32\hkcmd.exe [77824 2005-09-20] (Intel Corporation)

HKLM\...\Run: [igfxpers] - C:\WINXP\system32\igfxpers.exe [114688 2005-09-20] (Intel Corporation)

HKLM\...\Run: [EPSON Stylus CX4800 Series] - C:\WINXP\System32\spool\DRIVERS\W32X86\3\E_FATIADA.EXE [98304 2005-02-02] (SEIKO EPSON CORPORATION)

HKLM\...\Run: [MSC] - c:\Program Files\Microsoft Security Client\msseces.exe [951576 2014-03-11] (Microsoft Corporation)

HKLM\...\Run: [APSDaemon] - C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-05-30] (Apple Inc.)

HKLM\...\Run: [iTunesHelper] - C:\Program Files\iTunes\iTunesHelper.exe [421776 2012-06-07] (Apple Inc.)

HKLM\...\Run: [sunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [252296 2012-01-17] (Sun Microsystems, Inc.)

HKLM\...\Run: [KiesTrayAgent] - C:\Program Files\Samsung\Kies\KiesTrayAgent.exe [310280 2012-12-20] (Samsung Electronics Co., Ltd.)

HKLM\...\Winlogon: [userinit] C:\WINXP\system32\userinit.exe,

HKLM\...\Winlogon: [shell] Explorer.exe [x ] ()

HKLM\...\Winlogon: [uIHost] logonui.exe [x ] ()

Winlogon\Notify\crypt32chain: C:\WINXP\system32\crypt32.dll (Microsoft Corporation)

Winlogon\Notify\cryptnet: C:\WINXP\system32\cryptnet.dll (Microsoft Corporation)

Winlogon\Notify\cscdll: C:\WINXP\system32\cscdll.dll (Microsoft Corporation)

Winlogon\Notify\dimsntfy: C:\WINXP\System32\dimsntfy.dll (Microsoft Corporation)

Winlogon\Notify\igfxcui: C:\WINXP\system32\igfxdev.dll (Intel Corporation)

Winlogon\Notify\ScCertProp: C:\WINXP\system32\wlnotify.dll (Microsoft Corporation)

Winlogon\Notify\Schedule: C:\WINXP\system32\wlnotify.dll (Microsoft Corporation)

Winlogon\Notify\sclgntfy: C:\WINXP\system32\sclgntfy.dll (Microsoft Corporation)

Winlogon\Notify\SensLogn: C:\WINXP\system32\WlNotify.dll (Microsoft Corporation)

Winlogon\Notify\termsrv: C:\WINXP\system32\wlnotify.dll (Microsoft Corporation)

Winlogon\Notify\WgaLogon: C:\WINXP\system32\WgaLogon.dll (Microsoft Corporation)

Winlogon\Notify\wlballoon: C:\WINXP\system32\wlnotify.dll (Microsoft Corporation)

HKU\.DEFAULT\...\Run: [DWQueuedReporting] - C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE [520424 2013-03-06] (Microsoft Corporation)

HKU\S-1-5-21-1085031214-1972579041-1177238915-500\...\Run: [swg] - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2010-10-26] (Google Inc.)

HKU\S-1-5-21-1085031214-1972579041-1177238915-500\...\Run: [cdloader] - C:\Documents and Settings\Administrator\Application Data\mjusbsp\cdloader2.exe [50592 2012-02-01] (magicJack L.P.)

HKU\S-1-5-21-1085031214-1972579041-1177238915-500\...\Run: [EPSON Stylus CX4800 Series] - C:\WINXP\System32\spool\DRIVERS\W32X86\3\E_FATIADA.EXE [98304 2005-02-02] (SEIKO EPSON CORPORATION)

HKU\S-1-5-21-1085031214-1972579041-1177238915-500\...\Run: [sUPERAntiSpyware] - C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [5717272 2013-12-15] (SUPERAntiSpyware)

HKU\S-1-5-21-1085031214-1972579041-1177238915-500\...\Run: [KiesPreload] - C:\Program Files\Samsung\Kies\Kies.exe [1476104 2012-12-20] (Samsung)

HKU\S-1-5-21-1085031214-1972579041-1177238915-500\...\Run: [A24802D8E0033B87C7A71FBB6D39DEF74469BA10._service_run] - C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe [859976 2014-03-14] (Google Inc.)

HKU\S-1-5-21-1085031214-1972579041-1177238915-500\...\Run: [CmTray] - C:\Program Files\Content Manager\launchCM.exe [94208 2011-12-28] ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINXP\system32\blank.htm

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.ca/

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xF3A86FAA785BCB01

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us

HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINXP\system32\blank.htm

SearchScopes: HKCU - {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} URL =

SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}

BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)

BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)

BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.9012.1008\swg.dll (Google Inc.)

BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)

Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

Handler: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\WINXP\system32\urlmon.dll (Microsoft Corporation)

Handler: wia - {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINXP\system32\wiascr.dll (Microsoft Corporation)

Filter: text/webviewhtml - {733AC4CB-F1A4-11d0-B951-00A0C90312E1} - C:\WINXP\system32\SHELL32.dll (Microsoft Corporation)

ShellExecuteHooks: SABShellExecuteHook Class - {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [113024 2011-07-18] (SuperAdBlocker.com)

ShellExecuteHooks: - {AEB6717E-7E19-11d0-97EE-00C04FD91972} - No File [ ]

Winsock: Catalog5 04 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

Chrome:

=======

CHR Extension: (Google Wallet) - C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-12-21]

CHR StartMenuInternet: Google Chrome - C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe

========================== Services (Whitelisted) =================

R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE.EXE [116608 2012-07-11] (SUPERAntiSpyware.com)

S3 AdobeFlashPlayerUpdateSvc; C:\WINXP\system32\Macromed\Flash\FlashPlayerUpdateService.exe [257928 2014-03-11] (Adobe Systems Incorporated)

S4 Alerter; C:\WINXP\system32\alrsvc.dll [17408 2008-04-14] (Microsoft Corporation)

R3 ALG; C:\WINXP\System32\alg.exe [44544 2008-04-14] (Microsoft Corporation)

S3 AppMgmt; C:\WINXP\System32\appmgmts.dll [167936 2008-04-14] (Microsoft Corporation)

S3 aspnet_state; C:\WINXP\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe [35160 2010-03-18] (Microsoft Corporation)

R2 AudioSrv; C:\WINXP\System32\audiosrv.dll [42496 2008-04-14] (Microsoft Corporation)

R2 BITS; C:\WINXP\system32\qmgr.dll [409088 2008-04-14] (Microsoft Corporation)

R2 Browser; C:\WINXP\System32\browser.dll [78336 2012-07-06] (Microsoft Corporation)

S3 CiSvc; C:\WINXP\system32\cisvc.exe [5632 2008-04-14] (Microsoft Corporation)

S3 ClipSrv; C:\WINXP\system32\clipsrv.exe [33280 2008-04-14] (Microsoft Corporation)

S4 clr_optimization_v2.0.50727_32; C:\WINXP\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [69632 2008-07-25] (Microsoft Corporation)

S2 clr_optimization_v4.0.30319_32; C:\WINXP\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [130384 2010-03-18] (Microsoft Corporation)

S3 COMSysApp; C:\WINXP\system32\dllhost.exe [5120 2008-04-14] (Microsoft Corporation)

R2 CryptSvc; C:\WINXP\System32\cryptsvc.dll [62464 2008-04-14] (Microsoft Corporation)

R2 DcomLaunch; C:\WINXP\system32\rpcss.dll [401408 2010-09-16] (Microsoft Corporation)

R2 Dhcp; C:\WINXP\System32\dhcpcsvc.dll [126976 2008-04-14] (Microsoft Corporation)

S3 dmadmin; C:\WINXP\System32\dmadmin.exe [224768 2008-04-14] (Microsoft Corp., Veritas Software)

R2 dmserver; C:\WINXP\System32\dmserver.dll [23552 2008-04-14] (Microsoft Corp.)

R2 Dnscache; C:\WINXP\System32\dnsrslvr.dll [45568 2009-04-20] (Microsoft Corporation)

S3 Dot3svc; C:\WINXP\System32\dot3svc.dll [132096 2008-04-14] (Microsoft Corporation)

S3 EapHost; C:\WINXP\System32\eapsvc.dll [33792 2008-04-14] (Microsoft Corporation)

R2 ERSvc; C:\WINXP\System32\ersvc.dll [23040 2008-04-14] (Microsoft Corporation)

R2 Eventlog; C:\WINXP\system32\services.exe [110592 2010-09-16] (Microsoft Corporation)

R3 EventSystem; C:\WINXP\system32\es.dll [253952 2010-09-16] (Microsoft Corporation)

R3 FastUserSwitchingCompatibility; C:\WINXP\System32\shsvcs.dll [135168 2009-07-27] (Microsoft Corporation)

S3 FontCache3.0.0.0; c:\WINXP\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [46104 2008-07-29] (Microsoft Corporation)

R2 helpsvc; C:\WINXP\PCHealth\HelpCtr\Binaries\pchsvc.dll [38400 2008-04-14] (Microsoft Corporation)

R2 HidServ; C:\WINXP\System32\hidserv.dll [21504 2008-04-14] (Microsoft Corporation)

S3 hkmsvc; C:\WINXP\System32\kmsvc.dll [61440 2008-04-14] (Microsoft Corporation)

R3 HTTPFilter; C:\WINXP\System32\w3ssl.dll [15872 2008-04-14] (Microsoft Corporation)

S3 idsvc; c:\WINXP\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [881664 2008-07-29] (Microsoft Corporation)

S3 ImapiService; C:\WINXP\system32\imapi.exe [150528 2008-04-14] (Microsoft Corporation)

R2 JavaQuickStarterService; C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jqs.exe [161704 2012-07-05] (Oracle Corporation)

S2 KMService; C:\WINXP\system32\srvany.exe [8192 2012-08-03] ()

R2 LanmanServer; C:\WINXP\System32\srvsvc.dll [99840 2010-08-27] (Microsoft Corporation)

R2 lanmanworkstation; C:\WINXP\System32\wkssvc.dll [134144 2010-09-16] (Microsoft Corporation)

R2 LmHosts; C:\WINXP\System32\lmhsvc.dll [13824 2008-04-14] (Microsoft Corporation)

S4 Messenger; C:\WINXP\System32\msgsvc.dll [33792 2008-04-14] (Microsoft Corporation)

S3 mnmsrvc; C:\WINXP\system32\mnmsrvc.exe [32768 2008-04-14] (Microsoft Corporation)

S3 MSDTC; C:\WINXP\system32\msdtc.exe [6144 2008-04-14] (Microsoft Corporation)

S3 MSIServer; C:\WINXP\System32\msiexec.exe [78848 2008-04-14] (Microsoft Corporation)

R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [22216 2014-03-11] (Microsoft Corporation)

S3 napagent; C:\WINXP\System32\qagentrt.dll [291328 2008-04-14] (Microsoft Corporation)

S4 NetDDE; C:\WINXP\system32\netdde.exe [111104 2008-04-14] (Microsoft Corporation)

S4 NetDDEdsdm; C:\WINXP\system32\netdde.exe [111104 2008-04-14] (Microsoft Corporation)

S3 Netlogon; C:\WINXP\system32\lsass.exe [13312 2008-04-14] (Microsoft Corporation)

R3 Netman; C:\WINXP\System32\netman.dll [198144 2008-04-14] (Microsoft Corporation)

S4 NetTcpPortSharing; c:\WINXP\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe [124240 2010-03-18] (Microsoft Corporation)

R3 Nla; C:\WINXP\System32\mswsock.dll [245248 2010-09-16] (Microsoft Corporation)

R2 NMSAccess; C:\Program Files\CDBurnerXP\NMSAccessU.exe [71096 2010-03-04] ()

S3 NtLmSsp; C:\WINXP\system32\lsass.exe [13312 2008-04-14] (Microsoft Corporation)

S3 NtmsSvc; C:\WINXP\system32\ntmssvc.dll [435200 2008-04-14] (Microsoft Corporation)

R2 PlugPlay; C:\WINXP\system32\services.exe [110592 2010-09-16] (Microsoft Corporation)

R2 PolicyAgent; C:\WINXP\system32\lsass.exe [13312 2008-04-14] (Microsoft Corporation)

R2 ProtectedStorage; C:\WINXP\system32\lsass.exe [13312 2008-04-14] (Microsoft Corporation)

S3 RasAuto; C:\WINXP\System32\rasauto.dll [88576 2008-04-14] (Microsoft Corporation)

R3 RasMan; C:\WINXP\System32\rasmans.dll [186368 2008-04-14] (Microsoft Corporation)

S3 RDSessMgr; C:\WINXP\system32\sessmgr.exe [141312 2008-04-14] (Microsoft Corporation)

S4 RemoteAccess; C:\WINXP\System32\mprdim.dll [53248 2008-04-14] (Microsoft Corporation)

R2 RemoteRegistry; C:\WINXP\system32\regsvc.dll [59904 2008-04-14] (Microsoft Corporation)

S3 RpcLocator; C:\WINXP\system32\locator.exe [75264 2008-04-14] (Microsoft Corporation)

R2 RpcSs; C:\WINXP\System32\rpcss.dll [401408 2010-09-16] (Microsoft Corporation)

S3 RSVP; C:\WINXP\system32\rsvp.exe [132608 2008-04-14] (Microsoft Corporation)

R2 SamSs; C:\WINXP\system32\lsass.exe [13312 2008-04-14] (Microsoft Corporation)

S3 SCardSvr; C:\WINXP\System32\SCardSvr.exe [95744 2008-04-14] (Microsoft Corporation)

R2 Schedule; C:\WINXP\system32\schedsvc.dll [192512 2008-04-14] (Microsoft Corporation)

R2 seclogon; C:\WINXP\System32\seclogon.dll [18944 2008-04-14] (Microsoft Corporation)

R2 SENS; C:\WINXP\system32\sens.dll [39424 2008-04-14] (Microsoft Corporation)

R2 SharedAccess; C:\WINXP\System32\ipnathlp.dll [331264 2008-04-14] (Microsoft Corporation)

R2 ShellHWDetection; C:\WINXP\System32\shsvcs.dll [135168 2009-07-27] (Microsoft Corporation)

R2 SLService; C:\WINXP\system32\slserv.exe [73796 2008-04-14] (Smart Link)

R2 Spooler; C:\WINXP\system32\spoolsv.exe [58880 2010-09-16] (Microsoft Corporation)

R2 srservice; C:\WINXP\system32\srsvc.dll [171008 2008-04-14] (Microsoft Corporation)

R3 SSDPSRV; C:\WINXP\System32\ssdpsrv.dll [71680 2008-04-14] (Microsoft Corporation)

R2 stisvc; C:\WINXP\system32\wiaservc.dll [333824 2008-04-14] (Microsoft Corporation)

S3 SwPrv; C:\WINXP\system32\dllhost.exe [5120 2008-04-14] (Microsoft Corporation)

S3 SysmonLog; C:\WINXP\system32\smlogsvc.exe [89600 2008-04-14] (Microsoft Corporation)

R3 TapiSrv; C:\WINXP\System32\tapisrv.dll [249856 2008-04-14] (Microsoft Corporation)

R3 TermService; C:\WINXP\System32\termsrv.dll [295424 2008-04-14] (Microsoft Corporation)

R2 Themes; C:\WINXP\System32\shsvcs.dll [135168 2009-07-27] (Microsoft Corporation)

S3 TlntSvr; C:\WINXP\system32\tlntsvr.exe [73216 2008-04-14] (Microsoft Corporation)

R2 TrkWks; C:\WINXP\system32\trkwks.dll [90112 2008-04-14] (Microsoft Corporation)

R3 upnphost; C:\WINXP\System32\upnphost.dll [185856 2008-04-14] (Microsoft Corporation)

S3 UPS; C:\WINXP\System32\ups.exe [18432 2008-04-14] (Microsoft Corporation)

S3 VSS; C:\WINXP\System32\vssvc.exe [289792 2008-04-14] (Microsoft Corporation)

R2 W32Time; C:\WINXP\system32\w32time.dll [175104 2008-04-14] (Microsoft Corporation)

R2 WebClient; C:\WINXP\System32\webclnt.dll [68096 2008-04-14] (Microsoft Corporation)

R2 winmgmt; C:\WINXP\system32\wbem\WMIsvc.dll [144896 2008-04-14] (Microsoft Corporation)

S3 WmdmPmSN; C:\WINXP\system32\mspmsnsv.dll [27136 2010-09-16] (Microsoft Corporation)

S3 Wmi; C:\WINXP\System32\advapi32.dll [617472 2010-09-16] (Microsoft Corporation)

S3 WmiApSrv; C:\WINXP\system32\wbem\wmiapsrv.exe [126464 2008-04-14] (Microsoft Corporation)

S3 WPFFontCache_v0400; C:\WINXP\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [756392 2013-07-20] (Microsoft Corporation)

R2 wscsvc; C:\WINXP\system32\wscsvc.dll [80896 2008-04-14] (Microsoft Corporation)

R2 wuauserv; C:\WINXP\system32\wuauserv.dll [6656 2008-04-14] (Microsoft Corporation)

R2 WudfSvc; C:\WINXP\System32\WUDFSvc.dll [55808 2010-09-16] (Microsoft Corporation)

R2 WZCSVC; C:\WINXP\System32\wzcsvc.dll [483840 2010-09-16] (Microsoft Corporation)

S3 xmlprov; C:\WINXP\System32\xmlprov.dll [129024 2008-04-14] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

R0 ACPI; C:\WINXP\System32\DRIVERS\ACPI.sys [187776 2008-04-14] (Microsoft Corporation)

S4 ACPIEC; C:\WINXP\system32\Drivers\ACPIEC.sys [11648 2008-04-14] (Microsoft Corporation)

S3 aec; C:\WINXP\System32\drivers\aec.sys [142592 2008-04-13] (Microsoft Corporation)

R1 AFD; C:\WINXP\System32\drivers\afd.sys [138496 2011-08-17] (Microsoft Corporation)

S3 AsyncMac; C:\WINXP\System32\DRIVERS\asyncmac.sys [14336 2008-04-14] (Microsoft Corporation)

R0 atapi; C:\WINXP\System32\DRIVERS\atapi.sys [96512 2008-04-14] (Microsoft Corporation)

S3 Atmarpc; C:\WINXP\System32\DRIVERS\atmarpc.sys [59904 2008-04-14] (Microsoft Corporation)

R3 audstub; C:\WINXP\System32\DRIVERS\audstub.sys [3072 2001-08-17] (Microsoft Corporation)

R1 Beep; C:\WINXP\system32\Drivers\Beep.sys [4224 2008-04-14] (Microsoft Corporation)

S4 cbidf2k; C:\WINXP\system32\Drivers\cbidf2k.sys [13952 2008-04-14] (Microsoft Corporation)

S1 Cdaudio; C:\WINXP\system32\Drivers\Cdaudio.sys [18688 2010-09-16] (Microsoft Corporation)

R4 Cdfs; C:\WINXP\system32\Drivers\Cdfs.sys [63744 2008-04-14] (Microsoft Corporation)

R1 Cdrom; C:\WINXP\System32\DRIVERS\cdrom.sys [62976 2008-04-14] (Microsoft Corporation)

S3 dg_ssudbus; C:\WINXP\System32\DRIVERS\ssudbus.sys [83168 2012-09-20] (DEVGURU Co., LTD.(www.devguru.co.kr))

R0 Disk; C:\WINXP\System32\DRIVERS\disk.sys [36352 2008-04-14] (Microsoft Corporation)

S4 dmboot; C:\WINXP\System32\drivers\dmboot.sys [799744 2008-04-14] (Microsoft Corp., Veritas Software)

R0 dmio; C:\WINXP\System32\drivers\dmio.sys [153344 2008-04-14] (Microsoft Corp., Veritas Software)

R0 dmload; C:\WINXP\System32\drivers\dmload.sys [5888 2008-04-14] (Microsoft Corp., Veritas Software.)

S3 DMusic; C:\WINXP\System32\drivers\DMusic.sys [52864 2008-04-13] (Microsoft Corporation)

S3 drmkaud; C:\WINXP\System32\drivers\drmkaud.sys [2944 2008-04-13] (Microsoft Corporation)

R3 E100B; C:\WINXP\System32\DRIVERS\e100b325.sys [154112 2004-02-10] (Intel Corporation)

S4 Fastfat; C:\WINXP\system32\Drivers\Fastfat.sys [143744 2008-04-14] (Microsoft Corporation)

R3 Fdc; C:\WINXP\System32\DRIVERS\fdc.sys [27392 2008-04-14] (Microsoft Corporation)

R1 Fips; C:\WINXP\system32\Drivers\Fips.sys [44544 2008-04-14] (Microsoft Corporation)

R3 Flpydisk; C:\WINXP\System32\DRIVERS\flpydisk.sys [20480 2008-04-14] (Microsoft Corporation)

R0 FltMgr; C:\WINXP\System32\DRIVERS\fltMgr.sys [129792 2008-04-14] (Microsoft Corporation)

U1 Fs_Rec; C:\WINXP\system32\Drivers\Fs_Rec.sys [7936 2008-04-14] (Microsoft Corporation)

R0 Ftdisk; C:\WINXP\System32\DRIVERS\ftdisk.sys [125056 2008-04-14] (Microsoft Corporation)

R3 GEARAspiWDM; C:\WINXP\System32\DRIVERS\GEARAspiWDM.sys [26600 2009-05-18] (GEAR Software Inc.)

R3 Gpc; C:\WINXP\System32\DRIVERS\msgpc.sys [35072 2008-04-14] (Microsoft Corporation)

R3 hidusb; C:\WINXP\System32\DRIVERS\hidusb.sys [10368 2008-04-14] (Microsoft Corporation)

R3 HTTP; C:\WINXP\System32\Drivers\HTTP.sys [265728 2010-09-16] (Microsoft Corporation)

S1 i8042prt; C:\WINXP\system32\Drivers\i8042prt.sys [52480 2008-04-14] (Microsoft Corporation)

R3 ialm; C:\WINXP\System32\DRIVERS\ialmnt5.sys [1302332 2005-09-20] (Intel Corporation)

R1 Imapi; C:\WINXP\System32\DRIVERS\imapi.sys [42112 2008-04-14] (Microsoft Corporation)

R0 IntelIde; C:\WINXP\System32\DRIVERS\intelide.sys [5504 2008-04-13] (Microsoft Corporation)

R1 intelppm; C:\WINXP\System32\DRIVERS\intelppm.sys [36352 2008-04-14] (Microsoft Corporation)

S3 Ip6Fw; C:\WINXP\System32\DRIVERS\Ip6Fw.sys [36608 2008-04-14] (Microsoft Corporation)

S3 IpFilterDriver; C:\WINXP\System32\DRIVERS\ipfltdrv.sys [32896 2008-04-14] (Microsoft Corporation)

S3 IpInIp; C:\WINXP\System32\DRIVERS\ipinip.sys [20864 2008-04-14] (Microsoft Corporation)

R3 IpNat; C:\WINXP\System32\DRIVERS\ipnat.sys [152832 2008-04-14] (Microsoft Corporation)

R1 IPSec; C:\WINXP\System32\DRIVERS\ipsec.sys [75264 2008-04-14] (Microsoft Corporation)

S3 IRENUM; C:\WINXP\System32\DRIVERS\irenum.sys [11264 2008-04-14] (Microsoft Corporation)

R0 isapnp; C:\WINXP\System32\DRIVERS\isapnp.sys [37248 2008-04-14] (Microsoft Corporation)

R1 Kbdclass; C:\WINXP\System32\DRIVERS\kbdclass.sys [24576 2008-04-14] (Microsoft Corporation)

R1 kbdhid; C:\WINXP\System32\DRIVERS\kbdhid.sys [14592 2008-04-14] (Microsoft Corporation)

S3 kmixer; C:\WINXP\System32\drivers\kmixer.sys [172416 2008-04-13] (Microsoft Corporation)

R0 KSecDD; C:\WINXP\system32\Drivers\KSecDD.sys [92928 2009-06-24] (Microsoft Corporation)

S3 libusb0; C:\WINXP\System32\drivers\libusb0.sys [21504 2011-12-19] (http://libusb-win32.sourceforge.net)

R1 mnmdd; C:\WINXP\system32\Drivers\mnmdd.sys [4224 2008-04-14] (Microsoft Corporation)

R3 Modem; C:\WINXP\system32\Drivers\Modem.sys [30080 2010-09-16] (Microsoft Corporation)

R3 MODEMCSA; C:\WINXP\System32\drivers\MODEMCSA.sys [16128 2001-08-17] (Microsoft Corporation)

R1 Mouclass; C:\WINXP\System32\DRIVERS\mouclass.sys [23040 2010-09-16] (Microsoft Corporation)

R3 mouhid; C:\WINXP\System32\DRIVERS\mouhid.sys [12160 2010-09-16] (Microsoft Corporation)

R0 MountMgr; C:\WINXP\system32\Drivers\MountMgr.sys [42368 2008-04-14] (Microsoft Corporation)

R0 MpFilter; C:\WINXP\System32\DRIVERS\MpFilter.sys [231960 2014-01-25] (Microsoft Corporation)

R3 MRxDAV; C:\WINXP\System32\DRIVERS\mrxdav.sys [180608 2008-04-14] (Microsoft Corporation)

R1 MRxSmb; C:\WINXP\System32\DRIVERS\mrxsmb.sys [457856 2011-07-15] (Microsoft Corporation)

R1 Msfs; C:\WINXP\system32\Drivers\Msfs.sys [19072 2008-04-14] (Microsoft Corporation)

S3 MSKSSRV; C:\WINXP\System32\drivers\MSKSSRV.sys [7552 2008-04-13] (Microsoft Corporation)

S3 MSPCLOCK; C:\WINXP\System32\drivers\MSPCLOCK.sys [5376 2008-04-13] (Microsoft Corporation)

S3 MSPQM; C:\WINXP\System32\drivers\MSPQM.sys [4992 2008-04-13] (Microsoft Corporation)

R3 mssmbios; C:\WINXP\System32\DRIVERS\mssmbios.sys [15488 2010-09-16] (Microsoft Corporation)

R3 Mtlmnt5; C:\WINXP\System32\DRIVERS\Mtlmnt5.sys [126686 2008-04-13] (Smart Link)

S3 Mtlstrm; C:\WINXP\System32\DRIVERS\Mtlstrm.sys [1309184 2008-04-13] (Smart Link)

R0 Mup; C:\WINXP\system32\Drivers\Mup.sys [105472 2011-04-21] (Microsoft Corporation)

R0 NDIS; C:\WINXP\system32\Drivers\NDIS.sys [182656 2008-04-14] (Microsoft Corporation)

R3 NdisTapi; C:\WINXP\System32\DRIVERS\ndistapi.sys [10496 2011-07-08] (Microsoft Corporation)

R3 Ndisuio; C:\WINXP\System32\DRIVERS\ndisuio.sys [14592 2010-09-16] (Microsoft Corporation)

R3 NdisWan; C:\WINXP\System32\DRIVERS\ndiswan.sys [91520 2008-04-14] (Microsoft Corporation)

R3 NDProxy; C:\WINXP\system32\Drivers\NDProxy.sys [40960 2013-11-27] (Microsoft Corporation)

R1 NetBIOS; C:\WINXP\System32\DRIVERS\netbios.sys [34688 2008-04-14] (Microsoft Corporation)

R1 NetBT; C:\WINXP\System32\DRIVERS\netbt.sys [162816 2008-04-14] (Microsoft Corporation)

R1 Npfs; C:\WINXP\system32\Drivers\Npfs.sys [30848 2008-04-14] (Microsoft Corporation)

R4 Ntfs; C:\WINXP\system32\Drivers\Ntfs.sys [574976 2008-04-14] (Microsoft Corporation)

S3 NtMtlFax; C:\WINXP\System32\DRIVERS\NtMtlFax.sys [180360 2008-04-13] (Smart Link)

R1 Null; C:\WINXP\system32\Drivers\Null.sys [2944 2008-04-14] (Microsoft Corporation)

S3 NwlnkFlt; C:\WINXP\System32\DRIVERS\nwlnkflt.sys [12416 2008-04-14] (Microsoft Corporation)

S3 NwlnkFwd; C:\WINXP\System32\DRIVERS\nwlnkfwd.sys [32512 2008-04-14] (Microsoft Corporation)

R3 Parport; C:\WINXP\System32\DRIVERS\parport.sys [80128 2010-09-16] (Microsoft Corporation)

R0 PartMgr; C:\WINXP\system32\Drivers\PartMgr.sys [19712 2008-04-14] (Microsoft Corporation)

R2 ParVdm; C:\WINXP\system32\Drivers\ParVdm.sys [6784 2008-04-14] (Microsoft Corporation)

R0 PCI; C:\WINXP\System32\DRIVERS\pci.sys [68224 2008-04-14] (Microsoft Corporation)

R0 PCIIde; C:\WINXP\system32\Drivers\PCIIde.sys [3328 2008-04-14] (Microsoft Corporation)

S4 Pcmcia; C:\WINXP\system32\Drivers\Pcmcia.sys [120192 2008-04-14] (Microsoft Corporation)

R3 PptpMiniport; C:\WINXP\System32\DRIVERS\raspptp.sys [48384 2008-04-14] (Microsoft Corporation)

R3 PSched; C:\WINXP\System32\DRIVERS\psched.sys [69120 2008-04-14] (Microsoft Corporation)

R3 Ptilink; C:\WINXP\System32\DRIVERS\ptilink.sys [17792 2008-04-14] (Parallel Technologies, Inc.)

R1 RasAcd; C:\WINXP\System32\DRIVERS\rasacd.sys [8832 2008-04-14] (Microsoft Corporation)

R3 Rasl2tp; C:\WINXP\System32\DRIVERS\rasl2tp.sys [51328 2008-04-14] (Microsoft Corporation)

R3 RasPppoe; C:\WINXP\System32\DRIVERS\raspppoe.sys [41472 2008-04-14] (Microsoft Corporation)

R3 Raspti; C:\WINXP\System32\DRIVERS\raspti.sys [16512 2008-04-14] (Microsoft Corporation)

R1 Rdbss; C:\WINXP\System32\DRIVERS\rdbss.sys [175744 2008-04-14] (Microsoft Corporation)

R1 RDPCDD; C:\WINXP\System32\DRIVERS\RDPCDD.sys [4224 2008-04-14] (Microsoft Corporation)

R3 rdpdr; C:\WINXP\System32\DRIVERS\rdpdr.sys [196224 2008-04-13] (Microsoft Corporation)

S3 RDPWD; C:\WINXP\system32\Drivers\RDPWD.sys [139784 2012-07-04] (Microsoft Corporation)

R0 RecAgent; C:\WINXP\System32\DRIVERS\RecAgent.sys [13776 2008-04-13] (Smart Link)

R1 redbook; C:\WINXP\System32\DRIVERS\redbook.sys [57600 2008-04-13] (Microsoft Corporation)

R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS [12880 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)

R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS [67664 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)

S3 Secdrv; C:\WINXP\System32\DRIVERS\secdrv.sys [20480 2008-04-14] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)

R3 senfilt; C:\WINXP\System32\drivers\senfilt.sys [732928 2004-09-17] (Creative Technology Ltd.)

R3 serenum; C:\WINXP\System32\DRIVERS\serenum.sys [15744 2008-04-14] (Microsoft Corporation)

R1 Serial; C:\WINXP\System32\DRIVERS\serial.sys [64512 2008-04-14] (Microsoft Corporation)

S1 Sfloppy; C:\WINXP\system32\Drivers\Sfloppy.sys [11392 2008-04-14] (Microsoft Corporation)

R3 Slntamr; C:\WINXP\System32\DRIVERS\slntamr.sys [404990 2008-04-13] (Smart Link)

S3 SlNtHal; C:\WINXP\System32\DRIVERS\Slnthal.sys [95424 2008-04-13] (Smart Link)

R3 SlWdmSup; C:\WINXP\System32\DRIVERS\SlWdmSup.sys [13240 2008-04-13] (Smart Link)

R3 smwdm; C:\WINXP\System32\drivers\smwdm.sys [260352 2005-01-27] (Analog Devices, Inc.)

S3 splitter; C:\WINXP\System32\drivers\splitter.sys [6272 2008-04-13] (Microsoft Corporation)

R0 sptd; C:\WINXP\System32\Drivers\sptd.sys [691696 2010-09-25] ()

R0 sr; C:\WINXP\System32\DRIVERS\sr.sys [73472 2008-04-14] (Microsoft Corporation)

R3 Srv; C:\WINXP\System32\DRIVERS\srv.sys [357888 2011-02-17] (Microsoft Corporation)

S3 ssudmdm; C:\WINXP\System32\DRIVERS\ssudmdm.sys [181344 2012-09-20] (DEVGURU Co., LTD.(www.devguru.co.kr))

R2 StarOpen; C:\WINXP\system32\Drivers\StarOpen.sys [5504 2012-06-03] ()

R3 swenum; C:\WINXP\System32\DRIVERS\swenum.sys [4352 2010-09-16] (Microsoft Corporation)

S3 swmidi; C:\WINXP\System32\drivers\swmidi.sys [56576 2008-04-13] (Microsoft Corporation)

R3 sysaudio; C:\WINXP\System32\drivers\sysaudio.sys [60800 2008-04-13] (Microsoft Corporation)

R1 Tcpip; C:\WINXP\System32\DRIVERS\tcpip.sys [361600 2010-09-16] (Microsoft Corporation)

S3 TDPIPE; C:\WINXP\system32\Drivers\TDPIPE.sys [12040 2008-04-14] (Microsoft Corporation)

S3 TDTCP; C:\WINXP\system32\Drivers\TDTCP.sys [21896 2008-04-14] (Microsoft Corporation)

R1 TermDD; C:\WINXP\System32\DRIVERS\termdd.sys [40840 2008-04-14] (Microsoft Corporation)

S4 Udfs; C:\WINXP\system32\Drivers\Udfs.sys [66048 2008-04-14] (Microsoft Corporation)

R3 Update; C:\WINXP\System32\DRIVERS\update.sys [384768 2008-04-14] (Microsoft Corporation)

S3 USBAAPL; C:\WINXP\System32\Drivers\usbaapl.sys [43520 2012-04-25] (Apple, Inc.)

S3 usbaudio; C:\WINXP\System32\drivers\usbaudio.sys [60160 2013-07-16] (Microsoft Corporation)

R3 usbccgp; C:\WINXP\System32\DRIVERS\usbccgp.sys [32384 2013-08-08] (Microsoft Corporation)

R3 usbehci; C:\WINXP\System32\DRIVERS\usbehci.sys [30336 2009-03-18] (Microsoft Corporation)

R3 usbhub; C:\WINXP\System32\DRIVERS\usbhub.sys [59520 2008-04-14] (Microsoft Corporation)

R3 usbprint; C:\WINXP\System32\DRIVERS\usbprint.sys [25856 2008-04-13] (Microsoft Corporation)

R3 usbscan; C:\WINXP\System32\DRIVERS\usbscan.sys [14976 2013-07-02] (Microsoft Corporation)

R3 usbstor; C:\WINXP\System32\DRIVERS\USBSTOR.SYS [26368 2008-04-14] (Microsoft Corporation)

R3 usbuhci; C:\WINXP\System32\DRIVERS\usbuhci.sys [20608 2008-04-14] (Microsoft Corporation)

R1 VgaSave; C:\WINXP\System32\drivers\vga.sys [20992 2008-04-14] (Microsoft Corporation)

R0 VolSnap; C:\WINXP\system32\Drivers\VolSnap.sys [52352 2008-04-14] (Microsoft Corporation)

R3 Wanarp; C:\WINXP\System32\DRIVERS\wanarp.sys [34560 2008-04-14] (Microsoft Corporation)

S3 Wdf01000; C:\WINXP\System32\Drivers\wdf01000.sys [503008 2008-03-27] (Microsoft Corporation)

R3 wdmaud; C:\WINXP\System32\drivers\wdmaud.sys [83072 2008-04-13] (Microsoft Corporation)

S3 WinUSB; C:\WINXP\System32\DRIVERS\WinUSB.sys [39368 2006-11-02] (Microsoft Corporation)

S3 WpdUsb; C:\WINXP\System32\DRIVERS\wpdusb.sys [38528 2010-09-16] (Microsoft Corporation)

R1 WS2IFSL; C:\WINXP\System32\drivers\ws2ifsl.sys [12032 2008-04-14] (Microsoft Corporation)

R0 WudfPf; C:\WINXP\System32\DRIVERS\WudfPf.sys [77568 2010-09-16] (Microsoft Corporation)

S3 WudfRd; C:\WINXP\System32\DRIVERS\wudfrd.sys [82944 2010-09-16] (Microsoft Corporation)

U3 ac6gc95s; C:\WINXP\system32\Drivers\ac6gc95s.sys [0 ] (Microsoft Corporation)

S3 catchme; \??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2014-04-04 22:55 - 2014-04-04 22:55 - 00033563 _____ () C:\Documents and Settings\Administrator\Desktop\FRST.txt

2014-04-04 22:54 - 2014-04-04 22:55 - 00000000 ____D () C:\FRST

2014-04-04 22:49 - 2014-04-04 22:50 - 01145856 _____ (Farbar) C:\Documents and Settings\Administrator\Desktop\FRST.exe

2014-04-04 22:49 - 2014-04-04 22:49 - 00448512 _____ (OldTimer Tools) C:\Documents and Settings\Administrator\Desktop\TFC.exe

2014-04-01 12:53 - 2014-04-01 12:53 - 00012953 _____ () C:\ComboFix.txt

2014-04-01 12:37 - 2014-04-01 12:37 - 00000000 _RSHD () C:\cmdcons

2014-04-01 12:37 - 2010-09-23 20:08 - 00000207 _____ () C:\Boot.bak

2014-04-01 12:37 - 2004-08-03 23:00 - 00260272 __RSH () C:\cmldr

2014-04-01 12:33 - 2014-04-01 12:53 - 00000000 ____D () C:\Qoobox

2014-04-01 12:33 - 2014-04-01 12:52 - 00000000 ____D () C:\WINXP\erdnt

2014-04-01 12:33 - 2011-06-26 03:45 - 00256000 _____ () C:\WINXP\PEV.exe

2014-04-01 12:33 - 2010-11-07 14:20 - 00208896 _____ () C:\WINXP\MBR.exe

2014-04-01 12:33 - 2009-04-20 01:56 - 00060416 _____ (NirSoft) C:\WINXP\NIRCMD.exe

2014-04-01 12:33 - 2000-08-30 21:00 - 00518144 _____ (SteelWerX) C:\WINXP\SWREG.exe

2014-04-01 12:33 - 2000-08-30 21:00 - 00406528 _____ (SteelWerX) C:\WINXP\SWSC.exe

2014-04-01 12:33 - 2000-08-30 21:00 - 00212480 _____ (SteelWerX) C:\WINXP\SWXCACLS.exe

2014-04-01 12:33 - 2000-08-30 21:00 - 00098816 _____ () C:\WINXP\sed.exe

2014-04-01 12:33 - 2000-08-30 21:00 - 00080412 _____ () C:\WINXP\grep.exe

2014-04-01 12:33 - 2000-08-30 21:00 - 00068096 _____ () C:\WINXP\zip.exe

2014-04-01 12:32 - 2014-04-01 12:32 - 00000058 _____ () C:\Documents and Settings\Administrator\Desktop\mb1.txt

2014-04-01 12:29 - 2014-04-01 12:30 - 05192353 ____R (Swearware) C:\Documents and Settings\Administrator\Desktop\ComboFix.exe

2014-03-28 21:19 - 2014-03-28 21:19 - 00021526 _____ () C:\Documents and Settings\Administrator\Desktop\attach.txt

2014-03-28 21:19 - 2014-03-28 21:18 - 00010815 _____ () C:\Documents and Settings\Administrator\Desktop\dds.txt

2014-03-28 21:17 - 2014-04-04 22:52 - 00000234 _____ () C:\WINXP\Tasks\Microsoft Windows XP End of Service Notification Logon.job

2014-03-28 21:17 - 2014-04-01 12:26 - 00000228 _____ () C:\WINXP\Tasks\Microsoft Windows XP End of Service Notification Monthly.job

2014-03-28 19:49 - 2014-03-28 19:49 - 00014666 _____ () C:\Documents and Settings\Administrator\Desktop\mbam1.xml

2014-03-28 19:49 - 2014-03-28 19:49 - 00004969 _____ () C:\Documents and Settings\Administrator\Desktop\mbam1.txt

2014-03-28 18:58 - 2014-04-01 14:54 - 00107736 _____ (Malwarebytes Corporation) C:\WINXP\system32\Drivers\MBAMSwissArmy.sys

2014-03-28 18:58 - 2014-03-28 18:58 - 00000777 _____ () C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk

2014-03-28 18:58 - 2014-03-28 18:58 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware

2014-03-28 18:58 - 2014-03-28 18:58 - 00000000 ____D () C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes Anti-Malware

2014-03-28 18:58 - 2014-03-28 18:58 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\Malwarebytes

2014-03-28 18:58 - 2014-03-05 09:26 - 00050648 _____ (Malwarebytes Corporation) C:\WINXP\system32\Drivers\mbamchameleon.sys

2014-03-28 18:58 - 2014-03-05 09:26 - 00023256 _____ (Malwarebytes Corporation) C:\WINXP\system32\Drivers\mbam.sys

2014-03-28 16:31 - 2014-03-28 16:31 - 00011467 _____ () C:\WINXP\KB2934207.log

2014-03-28 16:31 - 2014-03-28 16:31 - 00000000 __HDC () C:\WINXP\$NtUninstallKB2934207$

2014-03-28 16:27 - 2014-03-28 16:31 - 00000000 ____D () C:\WINXP\system32\MRT

2014-03-28 16:10 - 2014-02-25 22:59 - 00013312 ____N (Microsoft Corporation) C:\WINXP\system32\xp_eos.exe

2014-03-28 16:10 - 2014-02-25 22:59 - 00013312 ____C (Microsoft Corporation) C:\WINXP\system32\dllcache\xp_eos.exe

2014-03-12 03:04 - 2014-03-12 03:04 - 00019695 _____ () C:\WINXP\KB2925418-IE8.log

2014-03-12 03:03 - 2014-03-12 03:03 - 00000000 __HDC () C:\WINXP\$NtUninstallKB2929961$

2014-03-12 03:02 - 2014-03-12 03:02 - 00000000 __HDC () C:\WINXP\$NtUninstallKB2930275$

2014-03-11 22:49 - 2014-03-12 03:03 - 00024160 _____ () C:\WINXP\KB2929961.log

2014-03-11 22:48 - 2014-03-12 03:02 - 00025476 _____ () C:\WINXP\KB2930275.log

==================== One Month Modified Files and Folders =======

2014-04-04 22:55 - 2014-04-04 22:55 - 00033563 _____ () C:\Documents and Settings\Administrator\Desktop\FRST.txt

2014-04-04 22:55 - 2014-04-04 22:54 - 00000000 ____D () C:\FRST

2014-04-04 22:53 - 2010-09-23 20:12 - 01932232 _____ () C:\WINXP\WindowsUpdate.log

2014-04-04 22:52 - 2014-03-28 21:17 - 00000234 _____ () C:\WINXP\Tasks\Microsoft Windows XP End of Service Notification Logon.job

2014-04-04 22:52 - 2010-10-26 19:12 - 00000896 _____ () C:\WINXP\Tasks\GoogleUpdateTaskMachineCore.job

2014-04-04 22:52 - 2010-09-23 20:18 - 00000006 ____H () C:\WINXP\Tasks\SA.DAT

2014-04-04 22:52 - 2010-09-23 17:04 - 00000159 _____ () C:\WINXP\wiadebug.log

2014-04-04 22:52 - 2010-09-23 17:04 - 00000048 _____ () C:\WINXP\wiaservc.log

2014-04-04 22:52 - 2008-04-14 09:00 - 00002206 _____ () C:\WINXP\system32\wpa.dbl

2014-04-04 22:51 - 2010-09-23 20:18 - 00032544 _____ () C:\WINXP\SchedLgU.Txt

2014-04-04 22:51 - 2010-09-23 20:18 - 00000178 ___SH () C:\Documents and Settings\Administrator\ntuser.ini

2014-04-04 22:50 - 2014-04-04 22:49 - 01145856 _____ (Farbar) C:\Documents and Settings\Administrator\Desktop\FRST.exe

2014-04-04 22:49 - 2014-04-04 22:49 - 00448512 _____ (OldTimer Tools) C:\Documents and Settings\Administrator\Desktop\TFC.exe

2014-04-04 22:44 - 2010-09-23 16:55 - 00000000 ____D () C:\WINXP

2014-04-04 22:36 - 2011-02-08 19:27 - 00001010 _____ () C:\WINXP\Tasks\GoogleUpdateTaskUserS-1-5-21-1085031214-1972579041-1177238915-500UA.job

2014-04-04 22:34 - 2010-10-26 19:12 - 00000900 _____ () C:\WINXP\Tasks\GoogleUpdateTaskMachineUA.job

2014-04-04 22:05 - 2012-04-08 13:25 - 00000826 _____ () C:\WINXP\Tasks\Adobe Flash Player Updater.job

2014-04-04 12:36 - 2011-02-08 19:27 - 00000958 _____ () C:\WINXP\Tasks\GoogleUpdateTaskUserS-1-5-21-1085031214-1972579041-1177238915-500Core.job

2014-04-04 06:16 - 2011-10-20 15:44 - 01088951 _____ () C:\WINXP\KB2481109.log

2014-04-03 10:31 - 2013-10-20 03:23 - 00000384 ____H () C:\WINXP\Tasks\Microsoft Antimalware Scheduled Scan.job

2014-04-02 23:50 - 2012-05-05 03:01 - 00001694 _____ () C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Security Essentials.lnk

2014-04-02 23:50 - 2011-02-06 16:42 - 00001945 _____ () C:\WINXP\epplauncher.mif

2014-04-02 23:50 - 2011-02-06 16:39 - 00000000 ____D () C:\Program Files\Microsoft Security Client

2014-04-01 14:54 - 2014-03-28 18:58 - 00107736 _____ (Malwarebytes Corporation) C:\WINXP\system32\Drivers\MBAMSwissArmy.sys

2014-04-01 12:53 - 2014-04-01 12:53 - 00012953 _____ () C:\ComboFix.txt

2014-04-01 12:53 - 2014-04-01 12:33 - 00000000 ____D () C:\Qoobox

2014-04-01 12:52 - 2014-04-01 12:33 - 00000000 ____D () C:\WINXP\erdnt

2014-04-01 12:51 - 2008-04-14 09:00 - 00000227 _____ () C:\WINXP\system.ini

2014-04-01 12:37 - 2014-04-01 12:37 - 00000000 _RSHD () C:\cmdcons

2014-04-01 12:37 - 2010-09-23 16:58 - 00000323 __RSH () C:\boot.ini

2014-04-01 12:32 - 2014-04-01 12:32 - 00000058 _____ () C:\Documents and Settings\Administrator\Desktop\mb1.txt

2014-04-01 12:30 - 2014-04-01 12:29 - 05192353 ____R (Swearware) C:\Documents and Settings\Administrator\Desktop\ComboFix.exe

2014-04-01 12:26 - 2014-03-28 21:17 - 00000228 _____ () C:\WINXP\Tasks\Microsoft Windows XP End of Service Notification Monthly.job

2014-03-28 21:19 - 2014-03-28 21:19 - 00021526 _____ () C:\Documents and Settings\Administrator\Desktop\attach.txt

2014-03-28 21:18 - 2014-03-28 21:19 - 00010815 _____ () C:\Documents and Settings\Administrator\Desktop\dds.txt

2014-03-28 21:16 - 2004-11-08 04:01 - 00000000 __HDC () C:\WINXP\$NtUninstallKB2646524$

2014-03-28 19:52 - 2014-03-01 22:18 - 00000000 ____D () C:\Program Files\Mozilla Thunderbird