dlm415 Posted February 7, 2010 ID:195503 Share Posted February 7, 2010 Well, McAfee says I have the Vundo.W virus. I am not confident trying to identify what files might be the problem so I ran RootRepeal. This is the meager output I got.Drivers-------------------Name: dump_atapi.sysImage Path: C:\WINDOWS\System32\Drivers\dump_atapi.sysAddress: 0xF210C000 Size: 98304 File Visible: No Signed: -Status: -Name: dump_WMILIB.SYSImage Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYSAddress: 0xF79DC000 Size: 8192 File Visible: No Signed: -Status: -Name: rootrepeal.sysImage Path: C:\WINDOWS\system32\drivers\rootrepeal.sysAddress: 0xB770E000 Size: 49152 File Visible: No Signed: -Status: -Hidden/Locked Files-------------------Path: C:\hiberfil.sysStatus: Locked to the Windows API!I am guessing the first two drivers are the problem, what about C:\hiberfil.sys?If they are the problem what is the next step? Link to post Share on other sites More sharing options...
dlm415 Posted February 7, 2010 Author ID:195527 Share Posted February 7, 2010 Here is the hijack this log -Logfile of Trend Micro HijackThis v2.0.2Scan saved at 9:12:12 PM, on 2/6/2010Platform: Windows XP SP3 (WinNT 5.01.2600)MSIE: Internet Explorer v7.00 (7.00.6000.16981)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\System32\wltrysvc.exeC:\WINDOWS\System32\bcmwltry.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exeC:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeC:\Program Files\CyberLink\PowerDVD\PDVDServ.exeC:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeC:\Program Files\Synaptics\SynTP\SynTPLpr.exeC:\Program Files\Synaptics\SynTP\SynTPEnh.exeC:\Program Files\Digital Media Reader\shwicon2k.exeC:\Program Files\Bonjour\mDNSResponder.exeC:\Program Files\support.com\bin\tgcmd.exeC:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exeC:\WINDOWS\system32\bcmntray.exeC:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exeC:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exeC:\Program Files\iTunes\iTunesHelper.exeC:\Program Files\Java\jre6\bin\jusched.exeC:\WINDOWS\system32\InetCntrl\InetCntrl.exeC:\Program Files\Messenger\msmsgs.exeC:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exeC:\Program Files\Webroot\Washer\wwDisp.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\BigFix\BigFix.exeC:\Program Files\Java\jre6\bin\jqs.exeC:\Program Files\Linksys\Linksys Updater\bin\LinksysUpdater.exeC:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXEC:\WINDOWS\system32\java.exeC:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYSC:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Webroot\Washer\WasherSvc.exeC:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exeC:\Program Files\iPod\bin\iPodService.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\MSN\Toolbar\3.0.1125.0\msntask.exeC:\Program Files\WinZip\WZQKPICK.EXEC:\Documents and Settings\Owner\Desktop\RootRepeal.exeC:\Documents and Settings\Owner\Desktop\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.gatewaybiz.comR0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.comcast.net/R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by ComcastR1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.localR3 - URLSearchHook: (no name) - {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLLO2 - BHO: Ask Search Assistant BHO - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLLO2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dllO2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dllO2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dllO2 - BHO: MSN Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.1125.0\msneshellx.dllO2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dllO2 - BHO: Bsecure Popup Blocker - {E0019445-4C1F-414D-A70E-AD80F231C584} - C:\WINDOWS\system32\InetCntrl\PopupKil\BsafeBHO.dllO2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dllO2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLLO3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLLO3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.1125.0\msneshellx.dllO3 - Toolbar: Bsecure Popup Blocker - {E0019445-4C1F-414D-A70E-AD80F231C584} - C:\WINDOWS\system32\InetCntrl\PopupKil\BsafeBHO.dllO4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"O4 - HKLM\..\Run: [NeroFilterCheck] "C:\WINDOWS\system32\NeroCheck.exe"O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"O4 - HKLM\..\Run: [synTPLpr] "C:\Program Files\Synaptics\SynTP\SynTPLpr.exe"O4 - HKLM\..\Run: [synTPEnh] "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"O4 - HKLM\..\Run: [sunKist] "C:\Program Files\Digital Media Reader\shwicon2k.exe"O4 - HKLM\..\Run: [Recguard] "C:\WINDOWS\SMINST\RECGUARD.EXE"O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\support.com\bin\tgcmd.exe" /serverO4 - HKLM\..\Run: [iSUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -schedulerO4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"O4 - HKLM\..\Run: [broadcom Wireless Manager UI] "C:\WINDOWS\system32\bcmntray"O4 - HKLM\..\Run: [userFaultCheck] "C:\WINDOWS\system32\dumprep" 0 -uO4 - HKLM\..\Run: [AppleSyncNotifier] "C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe"O4 - HKLM\..\Run: [Microsoft Default Manager] "C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resumeO4 - HKLM\..\Run: [nmctxth] "C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe"O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottimeO4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"O4 - HKLM\..\Run: [inetCntrl] C:\WINDOWS\system32\InetCntrl\InetCntrl.exeO4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silentO4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /backgroundO4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"O4 - HKCU\..\Run: [Window Washer] "C:\Program Files\Webroot\Washer\wwDisp.exe"O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil10c.exeO4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\BigFix.exeO4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXEO8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000O9 - Extra button: ComcastHSI - {669B269B-0D4E-41FB-A3D8-FD67CA94F646} - http://www.comcast.net/ (file missing)O9 - Extra button: Support - {8828075D-D097-4055-AA02-2DBFA9D85E8A} - http://www.comcastsupport.com/ (file missing)O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLLO9 - Extra button: Help - {97809617-3937-4F84-B335-9BB05EF1A8D4} - http://online.comcast.net/help/ (file missing)O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dllO9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO10 - Unknown file in Winsock LSP: inetcntrl0014.dllO10 - Unknown file in Winsock LSP: inetcntrl0014.dllO10 - Unknown file in Winsock LSP: inetcntrl0014.dllO10 - Unknown file in Winsock LSP: inetcntrl0014.dllO10 - Unknown file in Winsock LSP: inetcntrl0014.dllO10 - Unknown file in Winsock LSP: inetcntrl0014.dllO10 - Unknown file in Winsock LSP: inetcntrl0014.dllO10 - Unknown file in Winsock LSP: inetcntrl0014.dllO10 - Unknown file in Winsock LSP: inetcntrl0014.dllO10 - Unknown file in Winsock LSP: inetcntrl0014.dllO10 - Unknown file in Winsock LSP: inetcntrl0014.dllO10 - Unknown file in Winsock LSP: inetcntrl0014.dllO10 - Unknown file in Winsock LSP: inetcntrl0014.dllO10 - Unknown file in Winsock LSP: inetcntrl0014.dllO10 - Unknown file in Winsock LSP: inetcntrl0014.dllO10 - Unknown file in Winsock LSP: inetcntrl0014.dllO16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photo1.walgreens.com/WalgreensActivia.cabO16 - DPF: {74C861A1-D548-4916-BC8A-FDE92EDFF62C} - http://mediaplayer.walmart.com/installer/install.cabO16 - DPF: {CB50428B-657F-47DF-9B32-671F82AA73F7} (Photodex Presenter AX control) - http://www.photodex.com/pxplay.cabO16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cabO16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} - O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cabO20 - AppInit_DLLs: fuhiheje.dllO23 - Service: Adobe Active File Monitor V7 (AdobeActiveFileMonitor7.0) - Adobe Systems Incorporated - C:\Program Files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exeO23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeO23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exeO23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exeO23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exeO23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exeO23 - Service: Intuit Update Service (IntuitUpdateService) - Intuit Inc. - C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exeO23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exeO23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exeO23 - Service: Linksys Updater (LinksysUpdater) - Unknown owner - C:\Program Files\Linksys\Linksys Updater\bin\LinksysUpdater.exeO23 - Service: Pure Networks Platform Service (nmservice) - Cisco Systems, Inc. - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exeO23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYSO23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exeO23 - Service: Window Washer Engine (wwEngineSvc) - Webroot Software, Inc. - C:\Program Files\Webroot\Washer\WasherSvc.exe--End of file - 11836 bytes Link to post Share on other sites More sharing options...
kahdah Posted February 7, 2010 ID:195722 Share Posted February 7, 2010 Hello dlm415Welcome to Malwarebytes.=====================Download OTL to your desktop.Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.When the window appears, underneath Output at the top change it to Minimal Output.Under the Standard Registry box change it to All.Under Custom scan's and fixes section paste in the below in bold%SYSTEMDRIVE%\*.* /md5starteventlog.dllscecli.dllnetlogon.dllcngaudit.dllsceclt.dllntelogon.dlllogevent.dlliaStor.sysnvstor.sysatapi.sysIdeChnDr.sysviasraid.sysAGP440.sysvaxscsi.sysnvatabus.sysviamraid.sysnvata.sysnvgts.sysiastorv.sysViPrt.syseNetHook.dllahcix86.sysKR10N.sysnvstor32.sysahcix86s.sysnvrd32.sys /md5stop%systemroot%\*. /mp /s%systemroot%\System32\config\*.savCREATERESTOREPOINT%systemroot%\system32\*.dll /lockedfiles%systemroot%\Tasks\*.job /lockedfilesCheck the boxes beside LOP Check and Purity Check.Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.====================Download the following GMER Rootkit Scanner from HereDownload the randomly named EXE file to your Desktop. Remember what its name is since it is randomly named.Double click on the new random named exe file you downloaded and run it. If prompted about the Security Warning and Unknown Publisher go ahead and click on RunIt may take a minute to load and become available.If it gives you a warning about rootkit activity and asks if you want to run a full scan...click on NO, then use the following settings for a more complete scan..In the right panel, you will see several boxes that have been checked. Ensure the following are UNCHECKEDSectionsIAT/EATDrives/Partition other than Systemdrive (typically only C:\ should be checked)Show All (don't miss this one)Then click the Scan button & wait for it to finish.Once done click on the [save..] button, and in the File name area, type in "ark.txt" or it will save as a .log file which cannot be uploaded to your post.Save it where you can easily find it, such as your desktop**Caution** Rootkit scans often produce false positives. Do NOT take any action on any "<--- ROOKIT" entriesClick OK and quit the GMER program.Note: On Firefox you need to go to Tools/Options/Main then under the Downloads section, click on Always ask me where to save files so that you can choose the name and where to save to, in this case your Desktop.Post that log in your next reply. Link to post Share on other sites More sharing options...
dlm415 Posted February 7, 2010 Author ID:195823 Share Posted February 7, 2010 OTL logfile created on: 2/7/2010 10:48:41 AM - Run 1OTL by OldTimer - Version 3.1.28.0 Folder = C:\Documents and Settings\Owner\DesktopWindows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstationInternet Explorer (Version = 7.0.5730.13)Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy1,022.00 Mb Total Physical Memory | 433.00 Mb Available Physical Memory | 42.00% Memory free2.00 Gb Paging File | 2.00 Gb Available in Paging File | 82.00% Paging File freePaging file location(s): C:\pagefile.sys 1536 3072 [binary data]%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program FilesDrive C: | 70.93 Gb Total Space | 34.86 Gb Free Space | 49.14% Space Free | Partition Type: NTFSDrive D: | 3.59 Gb Total Space | 0.83 Gb Free Space | 23.06% Space Free | Partition Type: FAT32E: Drive not present or media not loadedF: Drive not present or media not loadedG: Drive not present or media not loadedH: Drive not present or media not loadedI: Drive not present or media not loadedComputer Name: YOUR-FD0B5B70B8Current User Name: OwnerLogged in as Administrator.Current Boot Mode: NormalScan Mode: Current userCompany Name Whitelist: OffSkip Microsoft Files: OffFile Age = 30 DaysOutput = Minimal========== Processes (SafeList) ==========PRC - C:\Documents and Settings\Owner\Desktop\OTL.exe (OldTimer Tools)PRC - C:\Program Files\WinZip\WZQKPICK.EXE (WinZip Computing, S.L.)PRC - C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)PRC - C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)PRC - C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)PRC - C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)PRC - C:\WINDOWS\system32\java.exe (Sun Microsystems, Inc.)PRC - C:\WINDOWS\system32\InetCntrl\InetCntrl.exe (Bsafe Online, Inc.)PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)PRC - C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corporation)PRC - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe (Cisco Systems, Inc.)PRC - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe (Cisco Systems, Inc.)PRC - C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.)PRC - C:\Program Files\Linksys\Linksys Updater\bin\LinksysUpdater.exe ()PRC - C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe (Intuit Inc.)PRC - C:\Program Files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe (Adobe Systems Incorporated)PRC - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)PRC - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS (New Boundary Technologies, Inc.)PRC - C:\Program Files\Webroot\Washer\WasherSvc.exe (Webroot Software, Inc.)PRC - C:\Program Files\Webroot\Washer\wwDisp.exe (Webroot Software, Inc.)PRC - C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe (Macrovision Corporation)PRC - C:\WINDOWS\system32\ati2evxx.exe (ATI Technologies Inc.)PRC - C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe (ATI Technologies, Inc.)PRC - C:\WINDOWS\system32\BCMWLTRY.EXE (Broadcom Corporation)PRC - C:\WINDOWS\system32\WLTRYSVC.EXE ()PRC - C:\WINDOWS\system32\bcmntray.EXE (Broadcom Corporation)PRC - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics, Inc.)PRC - C:\Program Files\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.)PRC - C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe (Cyberlink Corp.)PRC - C:\Program Files\Digital Media Reader\shwicon2k.exe (Alcor Micro, Corp.)PRC - C:\Program Files\BigFix\BigFix.exe (BigFix Inc.)PRC - C:\Program Files\support.com\bin\tgcmd.exe (Support.com, Inc.)========== Modules (SafeList) ==========MOD - C:\Documents and Settings\Owner\Desktop\OTL.exe (OldTimer Tools)MOD - C:\WINDOWS\system32\linkinfo.dll (Microsoft Corporation)MOD - C:\WINDOWS\system32\InetCntrl\PopupKil\popuphuk.dll (Bsafe Online, Inc.)MOD - C:\WINDOWS\system32\SynTPFcs.dll (Synaptics, Inc.)========== Win32 Services (SafeList) ==========SRV - (iPod Service) -- C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)SRV - (JavaQuickStarterService) -- C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)SRV - (Apple Mobile Device) -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)SRV - (SeaPort) -- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corporation)SRV - (FLEXnet Licensing Service) -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.)SRV - (nmservice) -- C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe (Cisco Systems, Inc.)SRV - (Bonjour Service) -- C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.)SRV - (LinksysUpdater) -- C:\Program Files\Linksys\Linksys Updater\bin\LinksysUpdater.exe ()SRV - (IntuitUpdateService) -- C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe (Intuit Inc.)SRV - (AdobeActiveFileMonitor7.0) -- C:\Program Files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe (Adobe Systems Incorporated)SRV - (gusvc) -- C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (Google)SRV - (PrismXL) -- C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS (New Boundary Technologies, Inc.)SRV - (wwEngineSvc) -- C:\Program Files\Webroot\Washer\WasherSvc.exe (Webroot Software, Inc.)SRV - (Ati HotKey Poller) -- C:\WINDOWS\system32\ati2evxx.exe (ATI Technologies Inc.)SRV - (wltrysvc) -- C:\WINDOWS\System32\wltrysvc.exe ()SRV - (ose) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)========== Driver Services (SafeList) ==========DRV - (USBAAPL) -- C:\WINDOWS\system32\drivers\usbaapl.sys (Apple, Inc.)DRV - (GEARAspiWDM) -- C:\WINDOWS\system32\drivers\GEARAspiWDM.sys (GEAR Software Inc.)DRV - (PxHelp20) -- C:\WINDOWS\System32\Drivers\PxHelp20.sys (Sonic Solutions)DRV - (purendis) -- C:\WINDOWS\system32\drivers\purendis.sys (Cisco Systems, Inc.)DRV - (pnarp) -- C:\WINDOWS\system32\drivers\pnarp.sys (Cisco Systems, Inc.)DRV - (amdagp) -- C:\WINDOWS\system32\DRIVERS\amdagp.sys (Advanced Micro Devices, Inc.)DRV - (sisagp) -- C:\WINDOWS\system32\DRIVERS\sisagp.sys (Silicon Integrated Systems Corporation)DRV - (AegisP) AEGIS Protocol (IEEE 802.1x) -- C:\WINDOWS\system32\drivers\AegisP.sys (Meetinghouse Data Communications)DRV - (ASCTRM) -- C:\WINDOWS\system32\drivers\asctrm.sys (Windows ® 2000 DDK provider)DRV - (SSKBFD) -- C:\WINDOWS\system32\drivers\sskbfd.sys (Webroot Software Inc (www.webroot.com))DRV - (Secdrv) -- C:\WINDOWS\system32\drivers\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)DRV - (bsofrwl) -- C:\WINDOWS\system32\drivers\bsofrwl.sys (NT Kernel Resources)DRV - (ati2mtag) -- C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)DRV - (CAMCHALA) -- C:\WINDOWS\system32\drivers\camc6hal.sys (Conexant Systems Inc.)DRV - (CAMCAUD) -- C:\WINDOWS\system32\drivers\camc6aud.sys (Conexant Systems Inc.)DRV - (yukonwxp) -- C:\WINDOWS\system32\drivers\yk51x86.sys (Marvell)DRV - (BCM43XX) -- C:\WINDOWS\system32\drivers\BCMWL5.SYS (Broadcom Corporation)DRV - (BCM42RLY) -- C:\WINDOWS\system32\drivers\bcm42rly.sys (Broadcom Corporation)DRV - (HSFHWATI) -- C:\WINDOWS\system32\drivers\HSFHWATI.sys (Conexant Systems, Inc.)DRV - (winachsf) -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys (Conexant Systems, Inc.)DRV - (HSF_DP) -- C:\WINDOWS\system32\drivers\HSF_DP.sys (Conexant Systems, Inc.)DRV - (SynTP) -- C:\WINDOWS\system32\drivers\SynTP.sys (Synaptics, Inc.)DRV - (AmdK8) -- C:\WINDOWS\system32\drivers\AmdK8.sys (Advanced Micro Devices)DRV - (Ptilink) -- C:\WINDOWS\system32\drivers\ptilink.sys (Parallel Technologies, Inc.)DRV - (nv) -- C:\WINDOWS\system32\drivers\nv4_mini.sys (NVIDIA Corporation)DRV - (EMCFILT) -- C:\WINDOWS\system32\drivers\EMCfilt.sys (Alcor Micro Corp.)DRV - (mdmxsdk) -- C:\WINDOWS\system32\drivers\mdmxsdk.sys (Conexant)DRV - (Sparrow) -- C:\WINDOWS\system32\DRIVERS\sparrow.sys (Adaptec, Inc.)DRV - (sym_u3) -- C:\WINDOWS\system32\DRIVERS\sym_u3.sys (LSI Logic)DRV - (sym_hi) -- C:\WINDOWS\system32\DRIVERS\sym_hi.sys (LSI Logic)DRV - (symc8xx) -- C:\WINDOWS\system32\DRIVERS\symc8xx.sys (LSI Logic)DRV - (symc810) -- C:\WINDOWS\system32\DRIVERS\symc810.sys (Symbios Logic Inc.)DRV - (ultra) -- C:\WINDOWS\system32\DRIVERS\ultra.sys (Promise Technology, Inc.)DRV - (ql12160) -- C:\WINDOWS\system32\DRIVERS\ql12160.sys (QLogic Corporation)DRV - (ql1080) -- C:\WINDOWS\system32\DRIVERS\ql1080.sys (QLogic Corporation)DRV - (ql1280) -- C:\WINDOWS\system32\DRIVERS\ql1280.sys (QLogic Corporation)DRV - (dac2w2k) -- C:\WINDOWS\system32\DRIVERS\dac2w2k.sys (Mylex Corporation)DRV - (mraid35x) -- C:\WINDOWS\system32\DRIVERS\mraid35x.sys (American Megatrends Inc.)DRV - (asc) -- C:\WINDOWS\system32\DRIVERS\asc.sys (Advanced System Products, Inc.)DRV - (asc3550) -- C:\WINDOWS\system32\DRIVERS\asc3550.sys (Advanced System Products, Inc.)DRV - (AliIde) -- C:\WINDOWS\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.)DRV - (CmdIde) -- C:\WINDOWS\system32\DRIVERS\cmdide.sys (CMD Technology, Inc.)DRV - (mxnic) -- C:\WINDOWS\system32\drivers\mxnic.sys (Macronix International Co., Ltd. )========== Standard Registry (All) ==================== Internet Explorer ==========IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.gatewaybiz.comIE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?p...amp;ar=iesearchIE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-onsIE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htmIE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?p...amp;ar=iesearchIE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRiskIE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htmIE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ieIE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ieIE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htmIE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?p...amp;ar=iesearchIE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = GoogleIE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerm...tf8&oe=utf8IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ieIE - HKCU\..\URLSearchHook: {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL (Ask.com)IE - HKCU\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\WINDOWS\system32\ieframe.dll (Microsoft Corporation)IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.localFF - HKLM\software\mozilla\Firefox\extensions\\{20a82645-c095-46ed-80e3-08825760534b}: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [2009/08/22 09:10:09 | 000,000,000 | ---D | M]FF - HKLM\software\mozilla\Firefox\extensions\\jqs@sun.com: C:\Program Files\Java\jre6\lib\deploy\jqs\ff [2009/05/31 17:56:37 | 000,000,000 | ---D | M]O1 HOSTS File: ([2010/01/28 18:18:32 | 000,000,734 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hostsO1 - Hosts: 127.0.0.1 localhostO2 - BHO: (Ask Search Assistant BHO) - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL (Ask.com)O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll (Google Inc.)O2 - BHO: (MSN Toolbar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.1125.0\msneshellx.dll (Microsoft Corp.)O2 - BHO: (Java Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)O2 - BHO: (Bsecure Popup Blocker) - {E0019445-4C1F-414D-A70E-AD80F231C584} - C:\WINDOWS\system32\InetCntrl\PopupKil\BsafeBHO.dll (Bsecure Technologies, Inc.)O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)O2 - BHO: (Ask Toolbar BHO) - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL (Ask.com)O3 - HKLM\..\Toolbar: (MSN Toolbar) - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.1125.0\msneshellx.dll (Microsoft Corp.)O3 - HKLM\..\Toolbar: (Bsecure Popup Blocker) - {E0019445-4C1F-414D-A70E-AD80F231C584} - C:\WINDOWS\system32\InetCntrl\PopupKil\BsafeBHO.dll (Bsecure Technologies, Inc.)O3 - HKLM\..\Toolbar: (Ask Toolbar) - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL (Ask.com)O3 - HKCU\..\Toolbar\ShellBrowser: (&Address) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)O3 - HKCU\..\Toolbar\WebBrowser: (&Address) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)O3 - HKCU\..\Toolbar\WebBrowser: (&Links) - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)O3 - HKCU\..\Toolbar\WebBrowser: (&Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll ()O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL (Ask.com)O4 - HKLM..\Run: [] File not foundO4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)O4 - HKLM..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe (Apple Inc.)O4 - HKLM..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe (ATI Technologies, Inc.)O4 - HKLM..\Run: [broadcom Wireless Manager UI] C:\WINDOWS\System32\bcmntray.exe (Broadcom Corporation)O4 - HKLM..\Run: [inetCntrl] C:\WINDOWS\system32\InetCntrl\InetCntrl.exe (Bsafe Online, Inc.)O4 - HKLM..\Run: [iSUSPM] C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe (Macrovision Corporation)O4 - HKLM..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)O4 - HKLM..\Run: [Microsoft Default Manager] C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe (Microsoft Corp.)O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\System32\NeroCheck.exe (Ahead Software Gmbh)O4 - HKLM..\Run: [nmctxth] C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe (Cisco Systems, Inc.)O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\QTTask.exe (Apple Inc.)O4 - HKLM..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE ()O4 - HKLM..\Run: [RemoteControl] C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe (Cyberlink Corp.)O4 - HKLM..\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)O4 - HKLM..\Run: [sunKist] C:\Program Files\Digital Media Reader\shwicon2k.exe (Alcor Micro, Corp.)O4 - HKLM..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics, Inc.)O4 - HKLM..\Run: [synTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.)O4 - HKLM..\Run: [tgcmd] C:\Program Files\support.com\bin\tgcmd.exe (Support.com, Inc.)O4 - HKLM..\Run: [userFaultCheck] File not foundO4 - HKCU..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (Microsoft Corporation)O4 - HKCU..\Run: [MSMSGS] C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)O4 - HKCU..\Run: [Window Washer] C:\Program Files\Webroot\Washer\wwDisp.exe (Webroot Software, Inc.)O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)O4 - HKCU..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil10c.exe (Adobe Systems, Inc.)O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\BigFix.lnk = C:\Program Files\BigFix\BigFix.exe (BigFix Inc.)O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE (WinZip Computing, S.L.)O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Main presentO6 - HKLM\Software\Policies\Microsoft\Internet Explorer\PhishingFilter presentO6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation)O9 - Extra Button: ComcastHSI - {669B269B-0D4E-41FB-A3D8-FD67CA94F646} - File not foundO9 - Extra Button: Support - {8828075D-D097-4055-AA02-2DBFA9D85E8A} - File not foundO9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)O9 - Extra Button: Help - {97809617-3937-4F84-B335-9BB05EF1A8D4} - File not foundO9 - Extra Button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\shdocvw.dll (Microsoft Corporation)O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe (Microsoft Corporation)O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - C:\WINDOWS\system32\winrnr.dll (Microsoft Corporation)O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000002 - File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000003 - File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000004 - File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000005 - File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000006 - File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000007 - File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000008 - File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000009 - File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000010 - File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000011 - File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000012 - File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000013 - File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000014 - File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000015 - File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - C:\WINDOWS\system32\rsvpsp.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000020 - C:\WINDOWS\system32\rsvpsp.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000021 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000022 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000023 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000024 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000025 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000026 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000027 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000028 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000029 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000030 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000031 - File not foundO15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.O15 - HKCU\..Trusted Domains: turbotax.com ([]https in Trusted sites)O15 - HKCU\..Trusted Domains: 2 domain(s) and sub-domain(s) not assigned to a zone.O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} http://photo1.walgreens.com/WalgreensActivia.cab (Snapfish Activia)O16 - DPF: {74C861A1-D548-4916-BC8A-FDE92EDFF62C} http://mediaplayer.walmart.com/installer/install.cab (Reg Error: Key error.)O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_17)O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash...t/ultrashim.cab (Reg Error: Key error.)O16 - DPF: {CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-...indows-i586.cab (Reg Error: Key error.)O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Reg Error: Key error.)O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_17)O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_17)O16 - DPF: {CB50428B-657F-47DF-9B32-671F82AA73F7} http://www.photodex.com/pxplay.cab (Photodex Presenter AX control)O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} http://www.adobe.com/products/acrobat/nos/gp.cab (get_atlcom Class)O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (Reg Error: Value error.)O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 68.87.68.166 68.87.74.166 192.168.1.1 68.87.68.166 68.87.74.166O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)O18 - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)O18 - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\WINDOWS\system32\msvidctl.dll (Microsoft Corporation)O18 - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)O18 - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)O18 - Protocol\Handler\gopher {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)O18 - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)O18 - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)O18 - Protocol\Handler\ipp - No CLSID value foundO18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)O18 - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll (Microsoft Corporation)O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)O18 - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)O18 - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\WINDOWS\system32\inetcomm.dll (Microsoft Corporation)O18 - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)O18 - Protocol\Handler\msdaipp - No CLSID value foundO18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)O18 - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll (Microsoft Corporation)O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)O18 - Protocol\Handler\pure-go {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files\Common Files\Pure Networks Shared\Platform\puresp4.dll (Cisco Systems, Inc.)O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)O18 - Protocol\Handler\sysimage {76E67A63-06E9-11D2-A840-006008059382} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)O18 - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\WINDOWS\system32\msvidctl.dll (Microsoft Corporation)O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)O18 - Protocol\Handler\wia {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINDOWS\system32\wiascr.dll (Microsoft Corporation)O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\System32\mscoree.dll (Microsoft Corporation)O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\System32\mscoree.dll (Microsoft Corporation)O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\System32\mscoree.dll (Microsoft Corporation)O18 - Protocol\Filter\Class Install Handler {32B533BB-EDAE-11d0-BD5A-00AA00B92AF1} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)O18 - Protocol\Filter\deflate {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)O18 - Protocol\Filter\gzip {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)O18 - Protocol\Filter\lzdhtml {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)O18 - Protocol\Filter\text/webviewhtml {733AC4CB-F1A4-11d0-B951-00A0C90312E1} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)O20 - AppInit_DLLs: (fuhiheje.dll) - File not foundO20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)O20 - HKLM Winlogon: UIHost - (logonui.exe) - C:\WINDOWS\System32\logonui.exe (Microsoft Corporation)O20 - HKLM Winlogon: VMApplet - (rundll32 shell32) - C:\WINDOWS\System32\shell32.dll (Microsoft Corporation)O20 - HKLM Winlogon: VMApplet - (Control_RunDLL "sysdm.cpl") - C:\WINDOWS\System32\sysdm.cpl (Microsoft Corporation)O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)O20 - Winlogon\Notify\crypt32chain: DllName - crypt32.dll - C:\WINDOWS\System32\crypt32.dll (Microsoft Corporation)O20 - Winlogon\Notify\cryptnet: DllName - cryptnet.dll - C:\WINDOWS\System32\cryptnet.dll (Microsoft Corporation)O20 - Winlogon\Notify\cscdll: DllName - cscdll.dll - C:\WINDOWS\System32\cscdll.dll (Microsoft Corporation)O20 - Winlogon\Notify\dimsntfy: DllName - %SystemRoot%\System32\dimsntfy.dll - C:\WINDOWS\system32\dimsntfy.dll (Microsoft Corporation)O20 - Winlogon\Notify\ScCertProp: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)O20 - Winlogon\Notify\Schedule: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)O20 - Winlogon\Notify\sclgntfy: DllName - sclgntfy.dll - C:\WINDOWS\System32\sclgntfy.dll (Microsoft Corporation)O20 - Winlogon\Notify\SensLogn: DllName - WlNotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)O20 - Winlogon\Notify\termsrv: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)O20 - Winlogon\Notify\wlballoon: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)O21 - SSODL: CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)O21 - SSODL: PostBootReminder - {7849596a-48ea-486e-8937-a2a3009f31a9} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)O21 - SSODL: SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} - C:\WINDOWS\system32\stobject.dll (Microsoft Corporation)O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\WINDOWS\system32\webcheck.dll (Microsoft Corporation)O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll (Microsoft Corporation)O22 - SharedTaskScheduler: {438755C2-A8BA-11D1-B96B-00A0C90312E1} - Browseui preloader - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)O22 - SharedTaskScheduler: {8C7461EF-2B13-11d2-BE35-3078302C2030} - Component Categories cache daemon - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)O24 - Desktop Components:0 (My Current Home Page) - About:HomeO24 - Desktop WallPaper: C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmpO24 - Desktop BackupWallPaper: C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmpO28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - C:\WINDOWS\System32\shell32.dll (Microsoft Corporation)O29 - HKLM SecurityProviders - (msapsspc.dll) - C:\WINDOWS\System32\msapsspc.dll (Microsoft Corporation)O29 - HKLM SecurityProviders - (schannel.dll) - C:\WINDOWS\System32\schannel.dll (Microsoft Corporation)O29 - HKLM SecurityProviders - (digest.dll) - C:\WINDOWS\System32\digest.dll (Microsoft Corporation)O29 - HKLM SecurityProviders - (msnsspc.dll) - C:\WINDOWS\System32\msnsspc.dll (Microsoft Corporation)O30 - LSA: Authentication Packages - (msv1_0) - C:\WINDOWS\System32\msv1_0.dll (Microsoft Corporation)O30 - LSA: Security Packages - (kerberos) - C:\WINDOWS\System32\kerberos.dll (Microsoft Corporation)O30 - LSA: Security Packages - (msv1_0) - C:\WINDOWS\System32\msv1_0.dll (Microsoft Corporation)O30 - LSA: Security Packages - (schannel) - C:\WINDOWS\System32\schannel.dll (Microsoft Corporation)O30 - LSA: Security Packages - (wdigest) - C:\WINDOWS\System32\wdigest.dll (Microsoft Corporation)O31 - SafeBoot: AlternateShell - cmd.exeO32 - HKLM CDRom: AutoRun - 1O32 - AutoRun File - [2005/03/23 12:13:17 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]O32 - AutoRun File - [2004/09/13 12:15:24 | 000,000,053 | -HS- | M] () - D:\Autorun.inf -- [ FAT32 ]O33 - MountPoints2\{2e5e1444-d37d-11dc-a5b2-0014a50dcc0e}\Shell\AutoRun\command - "" = F:\setupSNK.exe -- File not foundO33 - MountPoints2\{784527b1-bb53-11dc-a571-806d6172696f}\Shell - "" = AutoRunO33 - MountPoints2\{784527b1-bb53-11dc-a571-806d6172696f}\Shell\AutoRun - "" = Auto&PlayO33 - MountPoints2\{784527b1-bb53-11dc-a571-806d6172696f}\Shell\AutoRun\command - "" = C:\WINDOWS\System32\shell32.dll -- [2008/06/17 13:02:19 | 008,461,312 | ---- | M] (Microsoft Corporation)O34 - HKLM BootExecute: (autocheck autochk *) - File not foundO35 - comfile [open] -- "%1" %*O35 - exefile [open] -- "%1" %*CREATERESTOREPOINTRestore point Set: OTL Restore Point (16891891626803200)========== Files/Folders - Created Within 30 Days ==========[2010/02/07 10:41:46 | 000,549,376 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Owner\Desktop\OTL.exe[2010/02/06 22:15:18 | 000,000,000 | ---D | C] -- C:\!KillBox[2010/02/06 22:15:01 | 000,092,672 | ---- | C] (Option^Explicit Software vbtechcd@gmail.com) -- C:\Documents and Settings\Owner\Desktop\KillBox.exe[2010/02/06 21:45:18 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Desktop\backups[2010/02/06 21:11:24 | 000,401,720 | ---- | C] (Trend Micro Inc.) -- C:\Documents and Settings\Owner\Desktop\HijackThis.exe[2010/02/06 20:48:16 | 000,008,192 | ---- | C] (Microsoft Corporation) -- C:\Documents and Settings\Owner\My Documents\dumped.sys[2010/02/06 20:21:31 | 003,550,592 | ---- | C] (Sysinternals - www.sysinternals.com) -- C:\Documents and Settings\Owner\Desktop\winlogon.exe[2010/02/06 16:21:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\WinZip[2010/02/06 16:21:43 | 000,000,000 | ---D | C] -- C:\Program Files\WinZip[2010/02/06 16:08:54 | 000,429,392 | ---- | C] (Malwarebytes Corporation) -- C:\Documents and Settings\Owner\Desktop\mbam2gui.exe[2010/02/06 16:08:31 | 000,236,368 | ---- | C] (Malwarebytes Corporation) -- C:\Documents and Settings\Owner\Desktop\mbamservice.exe[2010/02/06 16:06:12 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Application Data\Malwarebytes[2010/02/06 15:55:45 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys[2010/02/06 15:55:44 | 000,019,160 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys[2010/02/06 15:55:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes[2010/02/06 15:55:43 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware[2010/02/06 15:53:55 | 005,115,824 | ---- | C] (Malwarebytes Corporation ) -- C:\Documents and Settings\Owner\Desktop\mbam-setup.exe[2010/02/04 16:42:28 | 000,000,000 | ---D | C] -- C:\WINDOWS\pss[2010/01/28 18:18:07 | 000,000,000 | -HSD | C] -- C:\Config.Msi[2010/01/12 15:30:31 | 000,471,552 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\aclayers.dll[2010/01/11 19:27:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Desktop\Kinetics[2009/09/08 16:55:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft[2008/11/02 16:43:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft[2008/07/05 13:11:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Apple[2005/03/23 12:17:47 | 000,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Application Data\Microsoft[2005/03/23 12:17:45 | 000,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Application Data\Microsoft[5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ][1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]========== Files - Modified Within 30 Days ==========[2099/01/01 12:00:00 | 000,060,928 | -HS- | M] () -- C:\WINDOWS\System32\tijevufi.dll[2099/01/01 12:00:00 | 000,000,990 | -HS- | M] () -- C:\WINDOWS\System32\malaruwo.dll[2099/01/01 12:00:00 | 000,000,990 | -HS- | M] () -- C:\WINDOWS\System32\hebedogu.dll[2099/01/01 12:00:00 | 000,000,990 | -HS- | M] () -- C:\WINDOWS\System32\bahezido.dll[2099/01/01 12:00:00 | 000,000,986 | -HS- | M] () -- C:\WINDOWS\System32\suwofada.dll[2099/01/01 12:00:00 | 000,000,986 | -HS- | M] () -- C:\WINDOWS\System32\rehotiza.dll[2099/01/01 12:00:00 | 000,000,986 | -HS- | M] () -- C:\WINDOWS\System32\mepawadi.dll[2099/01/01 12:00:00 | 000,000,986 | -HS- | M] () -- C:\WINDOWS\System32\jivabefu.dll[2099/01/01 12:00:00 | 000,000,986 | -HS- | M] () -- C:\WINDOWS\System32\dofedaho.dll[2099/01/01 12:00:00 | 000,000,923 | -HS- | M] () -- C:\WINDOWS\System32\yuniyuzi.dll[2099/01/01 12:00:00 | 000,000,923 | -HS- | M] () -- C:\WINDOWS\System32\vasezanu.dll[2099/01/01 12:00:00 | 000,000,923 | -HS- | M] () -- C:\WINDOWS\System32\sumirimi.dll[2099/01/01 12:00:00 | 000,000,923 | -HS- | M] () -- C:\WINDOWS\System32\pufuyada.dll[2099/01/01 12:00:00 | 000,000,923 | -HS- | M] () -- C:\WINDOWS\System32\pohudodi.dll[2099/01/01 12:00:00 | 000,000,923 | -HS- | M] () -- C:\WINDOWS\System32\napokoku.dll[2099/01/01 12:00:00 | 000,000,923 | -HS- | M] () -- C:\WINDOWS\System32\jifibiti.dll[2099/01/01 12:00:00 | 000,000,923 | -HS- | M] () -- C:\WINDOWS\System32\jefizaya.dll[2099/01/01 12:00:00 | 000,000,923 | -HS- | M] () -- C:\WINDOWS\System32\gunowini.dll[2099/01/01 12:00:00 | 000,000,919 | -HS- | M] () -- C:\WINDOWS\System32\yunizapa.dll[2099/01/01 12:00:00 | 000,000,919 | -HS- | M] () -- C:\WINDOWS\System32\yefeluki.dll[2099/01/01 12:00:00 | 000,000,919 | -HS- | M] () -- C:\WINDOWS\System32\welolazu.dll[2099/01/01 12:00:00 | 000,000,919 | -HS- | M] () -- C:\WINDOWS\System32\sodiluha.dll[2099/01/01 12:00:00 | 000,000,919 | -HS- | M] () -- C:\WINDOWS\System32\sivagami.dll[2099/01/01 12:00:00 | 000,000,919 | -HS- | M] () -- C:\WINDOWS\System32\saliyono.dll[2099/01/01 12:00:00 | 000,000,919 | -HS- | M] () -- C:\WINDOWS\System32\pakiyavo.dll[2099/01/01 12:00:00 | 000,000,919 | -HS- | M] () -- C:\WINDOWS\System32\mamapome.dll[2099/01/01 12:00:00 | 000,000,919 | -HS- | M] () -- C:\WINDOWS\System32\junebenu.dll[2099/01/01 12:00:00 | 000,000,919 | -HS- | M] () -- C:\WINDOWS\System32\gumizoju.dll[2099/01/01 12:00:00 | 000,000,919 | -HS- | M] () -- C:\WINDOWS\System32\feretizi.dll[2099/01/01 12:00:00 | 000,000,911 | -HS- | M] () -- C:\WINDOWS\System32\surosubo.dll[2099/01/01 12:00:00 | 000,000,911 | -HS- | M] () -- C:\WINDOWS\System32\jamahesa.dll[2099/01/01 12:00:00 | 000,000,909 | -HS- | M] () -- C:\WINDOWS\System32\wofevebo.dll[2099/01/01 12:00:00 | 000,000,909 | -HS- | M] () -- C:\WINDOWS\System32\luwapeta.dll[2010/02/07 10:42:49 | 000,026,112 | ---- | M] () -- C:\Documents and Settings\Owner\My Documents\bsecure communication.doc[2010/02/07 10:41:49 | 000,549,376 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Owner\Desktop\OTL.exe[2010/02/07 01:24:41 | 000,006,456 | -H-- | M] () -- C:\WINDOWS\System32\lihowulu[2010/02/07 01:00:01 | 000,000,296 | ---- | M] () -- C:\WINDOWS\tasks\eqokhmcr.job[2010/02/06 22:15:03 | 000,092,672 | ---- | M] (Option^Explicit Software vbtechcd@gmail.com) -- C:\Documents and Settings\Owner\Desktop\KillBox.exe[2010/02/06 22:09:46 | 000,000,038 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\fuhihejeDELETE.bat[2010/02/06 21:38:01 | 003,407,872 | -H-- | M] () -- C:\Documents and Settings\Owner\NTUSER.DAT[2010/02/06 21:11:25 | 000,401,720 | ---- | M] (Trend Micro Inc.) -- C:\Documents and Settings\Owner\Desktop\HijackThis.exe[2010/02/06 20:48:16 | 000,008,192 | ---- | M] (Microsoft Corporation) -- C:\Documents and Settings\Owner\My Documents\dumped.sys[2010/02/06 20:21:31 | 003,550,592 | ---- | M] (Sysinternals - www.sysinternals.com) -- C:\Documents and Settings\Owner\Desktop\winlogon.exe[2010/02/06 17:50:57 | 000,000,015 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\settings.dat[2010/02/06 16:22:30 | 000,001,732 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\WinZip.lnk[2010/02/06 16:22:30 | 000,001,660 | ---- | M] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk[2010/02/06 16:17:15 | 000,465,298 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\RootRepeal.rar[2010/02/06 16:06:10 | 000,000,378 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk[2010/02/06 15:54:05 | 005,115,824 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\Owner\Desktop\mbam-setup.exe[2010/02/06 15:41:43 | 000,000,598 | ---- | M] () -- C:\WINDOWS\win.ini[2010/02/06 15:41:28 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT[2010/02/06 15:41:25 | 000,001,170 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl[2010/02/06 15:41:23 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat[2010/02/06 15:41:18 | 1071,824,896 | -HS- | M] () -- C:\hiberfil.sys[2010/02/04 22:16:36 | 000,000,278 | -HS- | M] () -- C:\Documents and Settings\Owner\ntuser.ini[2010/02/04 22:10:58 | 000,026,624 | ---- | M] () -- C:\Documents and Settings\Owner\My Documents\student sleep essay.doc[2010/02/04 20:15:49 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini[2010/02/04 20:15:49 | 000,000,211 | RHS- | M] () -- C:\boot.ini[2010/01/28 18:15:28 | 000,258,082 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\Recredentialing Quick Start Guide.pdf[2010/01/28 18:15:13 | 000,198,842 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\Credentialing of Health Care Professionals.pdf[2010/01/28 18:14:48 | 000,395,343 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\RELEASE OF INFORMATION 10-0459-fill.pdf[2010/01/28 18:14:15 | 000,797,055 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\attachments_2010_01_28.zip[2010/01/13 06:53:29 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK[5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ][1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]========== Files Created - No Company Name ==========[2099/01/01 12:00:00 | 000,060,928 | -HS- | C] () -- C:\WINDOWS\System32\tijevufi.dll[2099/01/01 12:00:00 | 000,006,456 | -H-- | C] () -- C:\WINDOWS\System32\lihowulu[2099/01/01 12:00:00 | 000,000,990 | -HS- | C] () -- C:\WINDOWS\System32\malaruwo.dll[2099/01/01 12:00:00 | 000,000,990 | -HS- | C] () -- C:\WINDOWS\System32\hebedogu.dll[2099/01/01 12:00:00 | 000,000,990 | -HS- | C] () -- C:\WINDOWS\System32\bahezido.dll[2099/01/01 12:00:00 | 000,000,986 | -HS- | C] () -- C:\WINDOWS\System32\suwofada.dll[2099/01/01 12:00:00 | 000,000,986 | -HS- | C] () -- C:\WINDOWS\System32\rehotiza.dll[2099/01/01 12:00:00 | 000,000,986 | -HS- | C] () -- C:\WINDOWS\System32\mepawadi.dll[2099/01/01 12:00:00 | 000,000,986 | -HS- | C] () -- C:\WINDOWS\System32\jivabefu.dll[2099/01/01 12:00:00 | 000,000,986 | -HS- | C] () -- C:\WINDOWS\System32\dofedaho.dll[2099/01/01 12:00:00 | 000,000,923 | -HS- | C] () -- C:\WINDOWS\System32\yuniyuzi.dll[2099/01/01 12:00:00 | 000,000,923 | -HS- | C] () -- C:\WINDOWS\System32\vasezanu.dll[2099/01/01 12:00:00 | 000,000,923 | -HS- | C] () -- C:\WINDOWS\System32\sumirimi.dll[2099/01/01 12:00:00 | 000,000,923 | -HS- | C] () -- C:\WINDOWS\System32\pufuyada.dll[2099/01/01 12:00:00 | 000,000,923 | -HS- | C] () -- C:\WINDOWS\System32\pohudodi.dll[2099/01/01 12:00:00 | 000,000,923 | -HS- | C] () -- C:\WINDOWS\System32\napokoku.dll[2099/01/01 12:00:00 | 000,000,923 | -HS- | C] () -- C:\WINDOWS\System32\jifibiti.dll[2099/01/01 12:00:00 | 000,000,923 | -HS- | C] () -- C:\WINDOWS\System32\jefizaya.dll[2099/01/01 12:00:00 | 000,000,923 | -HS- | C] () -- C:\WINDOWS\System32\gunowini.dll[2099/01/01 12:00:00 | 000,000,919 | -HS- | C] () -- C:\WINDOWS\System32\yunizapa.dll[2099/01/01 12:00:00 | 000,000,919 | -HS- | C] () -- C:\WINDOWS\System32\yefeluki.dll[2099/01/01 12:00:00 | 000,000,919 | -HS- | C] () -- C:\WINDOWS\System32\welolazu.dll[2099/01/01 12:00:00 | 000,000,919 | -HS- | C] () -- C:\WINDOWS\System32\sodiluha.dll[2099/01/01 12:00:00 | 000,000,919 | -HS- | C] () -- C:\WINDOWS\System32\sivagami.dll[2099/01/01 12:00:00 | 000,000,919 | -HS- | C] () -- C:\WINDOWS\System32\saliyono.dll[2099/01/01 12:00:00 | 000,000,919 | -HS- | C] () -- C:\WINDOWS\System32\pakiyavo.dll[2099/01/01 12:00:00 | 000,000,919 | -HS- | C] () -- C:\WINDOWS\System32\mamapome.dll[2099/01/01 12:00:00 | 000,000,919 | -HS- | C] () -- C:\WINDOWS\System32\junebenu.dll[2099/01/01 12:00:00 | 000,000,919 | -HS- | C] () -- C:\WINDOWS\System32\gumizoju.dll[2099/01/01 12:00:00 | 000,000,919 | -HS- | C] () -- C:\WINDOWS\System32\feretizi.dll[2099/01/01 12:00:00 | 000,000,911 | -HS- | C] () -- C:\WINDOWS\System32\surosubo.dll[2099/01/01 12:00:00 | 000,000,911 | -HS- | C] () -- C:\WINDOWS\System32\jamahesa.dll[2099/01/01 12:00:00 | 000,000,909 | -HS- | C] () -- C:\WINDOWS\System32\wofevebo.dll[2099/01/01 12:00:00 | 000,000,909 | -HS- | C] () -- C:\WINDOWS\System32\luwapeta.dll[2010/02/07 10:42:49 | 000,026,112 | ---- | C] () -- C:\Documents and Settings\Owner\My Documents\bsecure communication.doc[2010/02/06 22:04:31 | 000,000,038 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\fuhihejeDELETE.bat[2010/02/06 16:43:30 | 000,000,296 | ---- | C] () -- C:\WINDOWS\tasks\eqokhmcr.job[2010/02/06 16:24:15 | 000,000,015 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\settings.dat[2010/02/06 16:22:30 | 000,001,732 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\WinZip.lnk[2010/02/06 16:22:30 | 000,001,660 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk[2010/02/06 16:17:11 | 000,465,298 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\RootRepeal.rar[2010/02/06 15:55:48 | 000,000,378 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk[2010/02/04 20:11:36 | 1071,824,896 | -HS- | C] () -- C:\hiberfil.sys[2010/02/03 16:44:02 | 000,165,376 | ---- | C] () -- C:\WINDOWS\System32\InetCntrl0014.dll[2010/01/28 18:15:27 | 000,258,082 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\Recredentialing Quick Start Guide.pdf[2010/01/28 18:14:45 | 000,395,343 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\RELEASE OF INFORMATION 10-0459-fill.pdf[2010/01/28 18:14:12 | 000,797,055 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\attachments_2010_01_28.zip[2010/01/26 21:01:20 | 000,026,624 | ---- | C] () -- C:\Documents and Settings\Owner\My Documents\student sleep essay.doc[2009/11/09 21:35:56 | 000,000,005 | ---- | C] () -- C:\Program Files\eula.txt[2009/11/09 21:35:45 | 000,000,014 | ---- | C] () -- C:\Program Files\version.txt[2009/10/18 19:33:55 | 000,174,920 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat[2009/05/12 20:12:53 | 000,025,600 | ---- | C] () -- C:\Documents and Settings\Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini[2008/02/17 15:17:01 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\preflib.dll[2008/02/17 15:17:00 | 001,204,224 | ---- | C] () -- C:\WINDOWS\System32\bcmwcfg.dll[2008/02/17 15:16:59 | 000,909,312 | ---- | C] () -- C:\WINDOWS\System32\bcmctrls.dll[2008/02/17 15:16:58 | 000,946,176 | ---- | C] () -- C:\WINDOWS\System32\bcmacfg.dll[2008/02/12 20:03:48 | 000,000,049 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini[2008/01/07 16:14:55 | 000,000,268 | ---- | C] () -- C:\Documents and Settings\Owner\Application Data\wklnhst.dat[2008/01/05 00:07:40 | 000,000,002 | ---- | C] () -- C:\WINDOWS\msoffice.ini[2008/01/04 23:46:41 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI[2005/03/27 01:10:58 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini[2005/03/23 10:53:24 | 000,001,264 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini[2005/03/23 10:53:24 | 000,000,488 | ---- | C] () -- C:\WINDOWS\System32\emver.ini[2003/01/07 14:05:08 | 000,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI========== LOP Check ==========[2009/04/13 20:03:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\espionServerData[2009/05/16 20:23:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Linksys[2008/01/05 00:16:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Napster[2009/06/11 19:30:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SmartSound Software Inc[2008/01/04 23:39:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint[2010/02/06 16:22:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\WinZip[2009/11/09 21:49:56 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\{35ACA973-70F0-495F-9092-74A130711865}[2009/09/16 16:48:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}[2009/05/18 18:56:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}[2009/05/17 17:50:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Netscape[2008/02/17 16:12:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\SampleView[2008/10/13 14:38:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Snapfish[2008/01/07 16:14:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Template[2010/02/07 01:00:01 | 000,000,296 | ---- | M] () -- C:\WINDOWS\Tasks\eqokhmcr.job========== Purity Check ==================== Custom Scans ==========< %SYSTEMDRIVE%\*.* >[2009/04/13 20:03:20 | 000,000,000 | ---- | M] () -- C:\AdobeDebug.txt[2005/03/23 12:13:17 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT[2010/02/04 20:15:49 | 000,000,211 | RHS- | M] () -- C:\boot.ini[2005/03/23 12:13:17 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS[2010/02/06 15:41:18 | 1071,824,896 | -HS- | M] () -- C:\hiberfil.sys[2008/06/26 16:12:31 | 000,000,164 | ---- | M] () -- C:\install.dat[2005/03/23 12:13:17 | 000,000,000 | RHS- | M] () -- C:\IO.SYS[2008/01/04 23:39:40 | 000,000,857 | -H-- | M] () -- C:\IPH.PH[2005/03/23 12:13:17 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS[2008/01/04 23:49:51 | 000,000,160 | ---- | M] () -- C:\napster.log[2008/01/06 12:01:28 | 000,001,039 | ---- | M] () -- C:\net_save.dna[2004/08/04 13:00:00 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM[2008/12/19 17:22:19 | 000,250,048 | RHS- | M] () -- C:\ntldr[2010/02/06 15:41:16 | 1610,612,736 | -HS- | M] () -- C:\pagefile.sys[2009/05/17 17:50:32 | 000,001,833 | ---- | M] () -- C:\photodex-presenter-install.log[2010/02/06 16:40:25 | 000,002,640 | ---- | M] () -- C:\RootRepeal report 02-06-10 (16-40-25).txt[2010/02/06 18:02:56 | 000,001,672 | ---- | M] () -- C:\RootRepeal report 02-06-10 (18-02-56).txt[2010/02/06 19:53:44 | 000,001,672 | ---- | M] () -- C:\RootRepeal report 02-06-10 (18-02-56)a.txt[2005/06/12 09:34:01 | 000,000,256 | ---- | M] () -- C:\SmartInstaller.log[2009/11/09 21:39:16 | 000,000,032 | ---- | M] () -- C:\t.txt[2008/01/04 23:49:12 | 000,000,191 | ---- | M] () -- C:\touchpad.log[2008/01/04 23:36:48 | 000,000,002 | RHS- | M] () -- C:\USER< MD5 for: AGP440.SYS >[2004/08/04 13:00:00 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys[2008/12/19 16:50:05 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys[2004/08/04 13:00:00 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\I386\sp2.cab:AGP440.sys[2008/12/19 16:50:05 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys[2008/04/13 12:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys[2008/04/13 12:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys[2004/08/04 08:07:42 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB -- C:\WINDOWS\$NtServicePackUninstall$\agp440.sys< MD5 for: ATAPI.SYS >[2004/08/04 13:00:00 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys[2008/12/19 16:50:05 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys[2004/08/04 13:00:00 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\I386\sp2.cab:atapi.sys[2008/12/19 16:50:05 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys[2008/04/13 12:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys[2008/04/13 12:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys[2004/08/04 07:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys< MD5 for: EVENTLOG.DLL >[2008/04/13 18:11:53 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll[2008/04/13 18:11:53 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\system32\eventlog.dll[2004/08/04 13:00:00 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll< MD5 for: NETLOGON.DLL >[2008/04/13 18:12:01 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll[2008/04/13 18:12:01 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\system32\netlogon.dll[2004/08/04 13:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll< MD5 for: SCECLI.DLL >[2004/08/04 13:00:00 | 000,180,224 | ---- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll[2008/04/13 18:12:05 | 000,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll[2008/04/13 18:12:05 | 000,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\system32\scecli.dll< %systemroot%\*. /mp /s >< %systemroot%\System32\config\*.sav >[2005/03/23 04:02:03 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav[2005/03/23 04:02:03 | 000,634,880 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav[2005/03/23 04:02:03 | 000,851,968 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav< %systemroot%\system32\*.dll /lockedfiles >[5 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]< %systemroot%\Tasks\*.job /lockedfiles >< End of report >EXTRA FILE CONTENTS*****************************************************************************************************OTL Extras logfile created on: 2/7/2010 10:48:41 AM - Run 1OTL by OldTimer - Version 3.1.28.0 Folder = C:\Documents and Settings\Owner\DesktopWindows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstationInternet Explorer (Version = 7.0.5730.13)Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy1,022.00 Mb Total Physical Memory | 433.00 Mb Available Physical Memory | 42.00% Memory free2.00 Gb Paging File | 2.00 Gb Available in Paging File | 82.00% Paging File freePaging file location(s): C:\pagefile.sys 1536 3072 [binary data]%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program FilesDrive C: | 70.93 Gb Total Space | 34.86 Gb Free Space | 49.14% Space Free | Partition Type: NTFSDrive D: | 3.59 Gb Total Space | 0.83 Gb Free Space | 23.06% Space Free | Partition Type: FAT32E: Drive not present or media not loadedF: Drive not present or media not loadedG: Drive not present or media not loadedH: Drive not present or media not loadedI: Drive not present or media not loadedComputer Name: YOUR-FD0B5B70B8Current User Name: OwnerLogged in as Administrator.Current Boot Mode: NormalScan Mode: Current userCompany Name Whitelist: OffSkip Microsoft Files: OffFile Age = 30 DaysOutput = Minimal========== Extra Registry (SafeList) ==================== File Associations ==========[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>].html [@ = htmlfile] -- C:\Program Files\Internet Explorer\IEXPLORE.EXE (Microsoft Corporation)========== Shell Spawning ==========[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]batfile [open] -- "%1" %*cmdfile [open] -- "%1" %*comfile [open] -- "%1" %*exefile [open] -- "%1" %*htmlfile [edit] -- "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation)htmlfile [open] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome (Microsoft Corporation)htmlfile [opennew] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation)htmlfile [print] -- "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" /p %1 (Microsoft Corporation)http [open] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome (Microsoft Corporation)https [open] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome (Microsoft Corporation)piffile [open] -- "%1" %*regfile [merge] -- Reg Error: Key error.scrfile [config] -- "%1"scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)scrfile [open] -- "%1" /Stxtfile [edit] -- Reg Error: Key error.Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation)CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)========== Security Center Settings ==========[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]"FirstRunDisabled" = 1"AntiVirusDisableNotify" = 1"FirewallDisableNotify" = 1"UpdatesDisableNotify" = 1"AntiVirusOverride" = 0"FirewallOverride" = 0[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall][HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile][HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]"EnableFirewall" = 0[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008"67:UDP" = 67:UDP:*:Enabled:DHCP Discovery Service========== Authorized Applications List ==========[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)"C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe" = C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe:*:Enabled:AOL -- File not found"C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" = C:\Program Files\Common Files\AOL\ACS\AOLDial.exe:*:Enabled:AOL -- File not found"C:\Program Files\America Online 9.0\waol.exe" = C:\Program Files\America Online 9.0\waol.exe:*:Enabled:AOL -- File not found"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)"C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe" = C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe:*:Enabled:AOL -- File not found"C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" = C:\Program Files\Common Files\AOL\ACS\AOLDial.exe:*:Enabled:AOL -- File not found"C:\Program Files\America Online 9.0\waol.exe" = C:\Program Files\America Online 9.0\waol.exe:*:Enabled:AOL -- File not found"C:\Program Files\support.com\bin\tgcmd.exe" = C:\Program Files\support.com\bin\tgcmd.exe:*:Enabled:Support.com Scheduler and Command Dispatcher -- (Support.com, Inc.)"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)"C:\Program Files\TurboTax\Deluxe 2007\32bit\ttax.exe" = C:\Program Files\TurboTax\Deluxe 2007\32bit\ttax.exe:LocalSubNet:Enabled:TurboTax -- (Intuit, Inc.)"C:\Program Files\TurboTax\Deluxe 2007\32bit\updatemgr.exe" = C:\Program Files\TurboTax\Deluxe 2007\32bit\updatemgr.exe:LocalSubNet:Enabled:TurboTax Update Manager -- (Intuit, Inc.)"C:\Program Files\Bonjour\mDNSResponder.exe" = C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour -- (Apple Inc.)"C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe" = C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe:LocalSubNet:Disabled:Intuit Update Shared Downloads Server -- (Intuit Inc.)"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes -- (Apple Inc.)"C:\WINDOWS\system32\winlogon.exe" = C:\WINDOWS\system32\winlogon.exe:*:Enabled:winlogon -- (Microsoft Corporation)"C:\WINDOWS\system32\lsass.exe" = C:\WINDOWS\system32\lsass.exe:*:Enabled:lsass -- (Microsoft Corporation)"C:\WINDOWS\explorer.exe" = C:\WINDOWS\explorer.exe:*:Enabled:Explorer -- (Microsoft Corporation)"C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe" = C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe:*:Enabled:nmsrvc -- (Cisco Systems, Inc.)========== HKEY_LOCAL_MACHINE Uninstall List ==========[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour"{0AB76F69-E761-4CFA-B9B0-A1906B4E9E4B}" = WD Diagnostics"{0BEDBD4E-2D34-47B5-9973-57E62B29307C}" = ATI Control Panel"{1451DE6B-ABE1-4F62-BE9A-B363A17588A2}" = QuickTime"{15377C3E-9655-400F-B441-E69F0A6BEAFE}" = Recovery Software Suite Gateway"{197A3012-8C85-4FD3-AB66-9EC7E13DB92E}" = Adobe AIR"{1DB2FBA5-D57A-42A7-8E87-5B3EEBED8283}" = Wal-Mart Music Downloads Store"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer"{26A24AE4-039D-4CA4-87B4-2F83216013FF}" = Java 6 Update 17"{29521505-F489-4822-ADFA-32C6DEE4F114}" = TurboTax 2008 WinPerUserEducation"{32343DB6-9A52-40C9-87E4-5E7C79791C87}" = MSXML 4.0 SP2 and SOAP Toolkit 3.0"{3248F0A8-6813-11D6-A77B-00B0D0150020}" = J2SE Runtime Environment 5.0 Update 2"{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java 6 Update 3"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP"{3AC54383-31D1-4907-961B-B12CBB1D0AE8}" = MobileMe Control Panel"{3F262ADC-5AD2-48E5-A586-44315E04A9E2}" = Microsoft Picture It! Library 10"{3FA365DF-2D68-45ED-8F83-8C8A33E65143}" = Apple Application Support"{416D80BA-6F6D-4672-B7CF-F54DA2F80B44}" = Microsoft Works"{42756145-9997-4D28-809B-8756BFD00106}" = Microsoft Picture It! Premium 10"{4CBA3D4C-8F51-4D60-B27E-F6B641C571E7}" = Microsoft Search Enhancement Pack"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable"{7570F1CA-016D-46AC-B586-CD74645EFB52}" = TurboTax 2008 WinPerFedFormset"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053"{7DD9A065-2C86-4A9F-A5FF-796EC1B99DCA}" = AnswerWorks 4.0 Runtime - English"{85AF94EC-55DE-452A-8FD7-C34E598B3F1F}" = Adobe Premiere Elements 7.0 Templates"{88214092-836F-4E22-A5AC-569AC9EE6A0F}" = TurboTax 2008 WinPerReleaseEngine"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight"{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003"{98177940-C048-4831-A279-F3888B1E2C7F}" = InstallMgr"{9E5A03E3-6246-4920-9630-0527D5DA9B07}" = AnswerWorks 5.0 English Runtime"{9F7FC79B-3059-4264-9450-39EB368E3225}" = Microsoft Digital Image Library 9 - Blocker"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2"{A607AC66-0C76-4519-9751-E12A93BF8EB2}" = Digital Media Reader"{A6FDF86A-F541-4E7B-AEA0-8849A2A700D5}" = iTunes"{A8AC89BA-D8CB-4372-9743-1C54D23286B0}" = MSN Toolbar"{AADEA55D-C834-4BCB-98A3-4B8D1C18F4EE}" = Apple Mobile Device Support"{AC76BA86-7AD7-1033-7B44-A81200000003}" = Adobe Reader 8.1.2"{AEB9948B-4FF2-47C9-990E-47014492A0FE}" = MSXML 6.0 Parser"{AFBBF30D-ADA9-4313-464E-14458B6BE034}" = PhotoshopdotcomInspirationBrowser"{B1DB1AD8-C07E-4052-81A1-D2930232BA70}" = TurboTax 2008 wrapper"{B23726CF-68BF-41A6-A4EB-72F12F87FE05}" = TurboTax 2008 WinPerTaxSupport"{B6EF6DCE-078E-4952-A7FA-352A9C349EB0}" = MSN Toolbar"{B7148D71-0A8F-4501-96B4-4E1CC67F874E}" = Microsoft Default Manager"{BAF78226-3200-4DB4-BE33-4D922A799840}" = Windows Presentation Foundation"{BF2A74BF-8D12-47F1-8B19-22B30AF6B0D1}" = Linksys EasyLink Advisor"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2"{C151CE54-E7EA-4804-854B-F515368B0798}" = Athlon 64 Processor Driver"{C34FAEF3-4241-4C4E-9CFF-7BBD8BCEABE7}" = WebEx Support Manager for Internet Explorer"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1"{CB6075D9-F912-40AE-BEA6-E590DA24F16B}" = Adobe Photoshop Elements 7.0"{CD95F661-A5C4-44F5-A6AA-ECDD91C240BB}" = WinZip 14.0"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1"{D564B5E2-CCB5-4A5C-B35E-2FC30BBC9336}" = Adobe Premiere Elements 7.0"{E56D39F8-2A9F-44B4-B068-A72E45A073E6}" = Safari"{E6D9BC25-0DBC-4368-8E4A-7DEE80661CD9}" = TurboTax 2008 WinPerProgramHelp"{F6234880-85BE-4DCB-8A45-1FF85A1A8552}" = SmartSound Quicktracks for Premiere Elements"{FA54AFB1-5745-4389-B8C1-9F7509672ED1}" = iPhone Configuration Utility"{FBDBC490-089D-4476-BF72-1F7A6368200A}" = Pure Networks Platform"Adobe AIR" = Adobe AIR"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX"Adobe Photoshop Elements 7" = Adobe Photoshop Elements 7.0"All ATI Software" = ATI - Software Uninstall Utility"AskSBar Uninstall" = Ask Toolbar"ATI Display Driver" = ATI Display Driver"BigFix" = BigFix"Broadcom 802.11 Application" = Broadcom Wireless Utility"Broadcom 802.11b Network Adapter" = Broadcom 802.11 Wireless LAN Adapter"CNXT_AUDIO" = Conexant AC-Link Audio"CNXT_MODEM_PCI_VEN_1002&DEV_4378&SUBSYS_2045161F" = Soft Data Fax Modem with SmartCP"getPlus®_ocx" = getPlus®_ocx"HijackThis" = HijackThis 2.0.2"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs"ie7" = Windows Internet Explorer 7"InetCntrl" = Bsecure Internet Protection Services 5.5"InstallShield_{A607AC66-0C76-4519-9751-E12A93BF8EB2}" = Digital Media Reader"InstallShield_{F6234880-85BE-4DCB-8A45-1FF85A1A8552}" = SmartSound Quicktracks for Premiere Elements"Linksys EasyLink Advisor" = Linksys EasyLink Advisor"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1"Money2005b" = Microsoft Money 2005"Nero - Burning Rom!UninstallKey" = Nero OEM"Nero BurnRights!UninstallKey" = Nero BurnRights"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs"Photodex Presenter" = Photodex Presenter"PhotoshopdotcomInspirationBrowser.4C35C4D325D350FE0114230CBADCA2DDD0AC8D25.1" = Adobe Photoshop.com Inspiration Browser"PictureItPrem_v10" = Microsoft Picture It! Premium 10"PremElem70" = Adobe Premiere Elements 7.0"PremElem70Templates" = Adobe Premiere Elements 7.0 Templates"RealPlayer 6.0" = RealPlayer Basic"StreetPlugin" = Learn2 Player (Uninstall Only)"Support.com" = ComcastSUPPORT"SynTPDeinstKey" = Synaptics Pointing Device Driver"TurboTax 2008" = TurboTax 2008"TurboTax Deluxe 2007" = TurboTax Deluxe 2007"ViewpointMediaPlayer" = Viewpoint Media Player"Window Washer" = Window Washer"Windows Media Format Runtime" = Windows Media Format 11 runtime"Windows Media Player" = Windows Media Player 10"Windows XP Service Pack" = Windows XP Service Pack 3"WMFDist11" = Windows Media Format 11 runtime"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0========== Last 10 Event Log Errors ==========[ Application Events ]Error - 2/4/2010 9:14:09 AM | Computer Name = YOUR-FD0B5B70B8 | Source = Application Error | ID = 1000Description = Faulting application shwicon2k.exe, version 1.5.0.8, faulting module unknown, version 0.0.0.0, fault address 0x1000336d.Error - 2/4/2010 9:14:10 AM | Computer Name = YOUR-FD0B5B70B8 | Source = Application Error | ID = 1000Description = Faulting application isuspm.exe, version 5.1.100.47363, faulting module unknown, version 0.0.0.0, fault address 0x1000336d.Error - 2/4/2010 9:14:11 AM | Computer Name = YOUR-FD0B5B70B8 | Source = Application Error | ID = 1000Description = Faulting application msmsgs.exe, version 4.7.0.3001, faulting module unknown, version 0.0.0.0, fault address 0x1000336d.Error - 2/4/2010 9:14:17 AM | Computer Name = YOUR-FD0B5B70B8 | Source = Application Error | ID = 1000Description = Faulting application nmctxth.exe, version 11.0.8268.0, faulting module unknown, version 0.0.0.0, fault address 0x1000336d.Error - 2/4/2010 10:08:44 PM | Computer Name = YOUR-FD0B5B70B8 | Source = Application Error | ID = 1000Description = Faulting application inetcntrl.exe, version 5.0.0.0, faulting module unknown, version 0.0.0.0, fault address 0x1000336d.Error - 2/4/2010 10:08:46 PM | Computer Name = YOUR-FD0B5B70B8 | Source = Application Error | ID = 1000Description = Faulting application explorer.exe, version 6.0.2900.5512, faulting module , version 0.0.0.0, fault address 0x00000000.Error - 2/4/2010 10:09:10 PM | Computer Name = YOUR-FD0B5B70B8 | Source = Application Error | ID = 1000Description = Faulting application controlcenter.exe, version 5.0.0.0, faulting module unknown, version 0.0.0.0, fault address 0x1000336d.Error - 2/4/2010 10:11:55 PM | Computer Name = YOUR-FD0B5B70B8 | Source = crypt32 | ID = 131080Description = Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: The server name or address could not be resolved Error - 2/4/2010 10:17:16 PM | Computer Name = YOUR-FD0B5B70B8 | Source = crypt32 | ID = 131080Description = Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: The server name or address could not be resolved Error - 2/6/2010 5:41:36 PM | Computer Name = YOUR-FD0B5B70B8 | Source = crypt32 | ID = 131080Description = Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: The server name or address could not be resolved [ System Events ]Error - 2/4/2010 10:10:33 PM | Computer Name = YOUR-FD0B5B70B8 | Source = DCOM | ID = 10005Description = DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}Error - 2/4/2010 10:22:35 PM | Computer Name = YOUR-FD0B5B70B8 | Source = DCOM | ID = 10005Description = DCOM got error "%1058" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}Error - 2/4/2010 10:24:36 PM | Computer Name = YOUR-FD0B5B70B8 | Source = DCOM | ID = 10010Description = The server {6BA70EAF-D5FF-4687-829A-A646EEC622F8} did not register with DCOM within the required timeout.Error - 2/4/2010 11:24:43 PM | Computer Name = YOUR-FD0B5B70B8 | Source = DCOM | ID = 10010Description = The server {6BA70EAF-D5FF-4687-829A-A646EEC622F8} did not register with DCOM within the required timeout.Error - 2/4/2010 11:25:14 PM | Computer Name = YOUR-FD0B5B70B8 | Source = DCOM | ID = 10010Description = The server {6BA70EAF-D5FF-4687-829A-A646EEC622F8} did not register with DCOM within the required timeout.Error - 2/5/2010 12:12:37 AM | Computer Name = YOUR-FD0B5B70B8 | Source = AmdK8 | ID = 327682Description = The Acpi 2.0 _PCT object returned an invalid value of 5Error - 2/5/2010 12:12:37 AM | Computer Name = YOUR-FD0B5B70B8 | Source = AmdK8 | ID = 327682Description = The Acpi 2.0 _PCT object returned an invalid value of 5Error - 2/6/2010 5:47:24 PM | Computer Name = YOUR-FD0B5B70B8 | Source = DCOM | ID = 10005Description = DCOM got error "%1058" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}Error - 2/6/2010 6:42:52 PM | Computer Name = YOUR-FD0B5B70B8 | Source = DCOM | ID = 10010Description = The server {6BA70EAF-D5FF-4687-829A-A646EEC622F8} did not register with DCOM within the required timeout.Error - 2/6/2010 6:43:23 PM | Computer Name = YOUR-FD0B5B70B8 | Source = DCOM | ID = 10010Description = The server {6BA70EAF-D5FF-4687-829A-A646EEC622F8} did not register with DCOM within the required timeout.< End of report > Link to post Share on other sites More sharing options...
kahdah Posted February 7, 2010 ID:195839 Share Posted February 7, 2010 Run OTLUnder the Custom Scans/Fixes box at the bottom, paste in the following:OTL[2099/01/01 12:00:00 | 000,060,928 | -HS- | M] () -- C:\WINDOWS\System32\tijevufi.dll[2099/01/01 12:00:00 | 000,000,990 | -HS- | M] () -- C:\WINDOWS\System32\malaruwo.dll[2099/01/01 12:00:00 | 000,000,990 | -HS- | M] () -- C:\WINDOWS\System32\hebedogu.dll[2099/01/01 12:00:00 | 000,000,990 | -HS- | M] () -- C:\WINDOWS\System32\bahezido.dll[2099/01/01 12:00:00 | 000,000,986 | -HS- | M] () -- C:\WINDOWS\System32\suwofada.dll[2099/01/01 12:00:00 | 000,000,986 | -HS- | M] () -- C:\WINDOWS\System32\rehotiza.dll[2099/01/01 12:00:00 | 000,000,986 | -HS- | M] () -- C:\WINDOWS\System32\mepawadi.dll[2099/01/01 12:00:00 | 000,000,986 | -HS- | M] () -- C:\WINDOWS\System32\jivabefu.dll[2099/01/01 12:00:00 | 000,000,986 | -HS- | M] () -- C:\WINDOWS\System32\dofedaho.dll[2099/01/01 12:00:00 | 000,000,923 | -HS- | M] () -- C:\WINDOWS\System32\yuniyuzi.dll[2099/01/01 12:00:00 | 000,000,923 | -HS- | M] () -- C:\WINDOWS\System32\vasezanu.dll[2099/01/01 12:00:00 | 000,000,923 | -HS- | M] () -- C:\WINDOWS\System32\sumirimi.dll[2099/01/01 12:00:00 | 000,000,923 | -HS- | M] () -- C:\WINDOWS\System32\pufuyada.dll[2099/01/01 12:00:00 | 000,000,923 | -HS- | M] () -- C:\WINDOWS\System32\pohudodi.dll[2099/01/01 12:00:00 | 000,000,923 | -HS- | M] () -- C:\WINDOWS\System32\napokoku.dll[2099/01/01 12:00:00 | 000,000,923 | -HS- | M] () -- C:\WINDOWS\System32\jifibiti.dll[2099/01/01 12:00:00 | 000,000,923 | -HS- | M] () -- C:\WINDOWS\System32\jefizaya.dll[2099/01/01 12:00:00 | 000,000,923 | -HS- | M] () -- C:\WINDOWS\System32\gunowini.dll[2099/01/01 12:00:00 | 000,000,919 | -HS- | M] () -- C:\WINDOWS\System32\yunizapa.dll[2099/01/01 12:00:00 | 000,000,919 | -HS- | M] () -- C:\WINDOWS\System32\yefeluki.dll[2099/01/01 12:00:00 | 000,000,919 | -HS- | M] () -- C:\WINDOWS\System32\welolazu.dll[2099/01/01 12:00:00 | 000,000,919 | -HS- | M] () -- C:\WINDOWS\System32\sodiluha.dll[2099/01/01 12:00:00 | 000,000,919 | -HS- | M] () -- C:\WINDOWS\System32\sivagami.dll[2099/01/01 12:00:00 | 000,000,919 | -HS- | M] () -- C:\WINDOWS\System32\saliyono.dll[2099/01/01 12:00:00 | 000,000,919 | -HS- | M] () -- C:\WINDOWS\System32\pakiyavo.dll[2099/01/01 12:00:00 | 000,000,919 | -HS- | M] () -- C:\WINDOWS\System32\mamapome.dll[2099/01/01 12:00:00 | 000,000,919 | -HS- | M] () -- C:\WINDOWS\System32\junebenu.dll[2099/01/01 12:00:00 | 000,000,919 | -HS- | M] () -- C:\WINDOWS\System32\gumizoju.dll[2099/01/01 12:00:00 | 000,000,919 | -HS- | M] () -- C:\WINDOWS\System32\feretizi.dll[2099/01/01 12:00:00 | 000,000,911 | -HS- | M] () -- C:\WINDOWS\System32\surosubo.dll[2099/01/01 12:00:00 | 000,000,911 | -HS- | M] () -- C:\WINDOWS\System32\jamahesa.dll[2099/01/01 12:00:00 | 000,000,909 | -HS- | M] () -- C:\WINDOWS\System32\wofevebo.dll[2099/01/01 12:00:00 | 000,000,909 | -HS- | M] () -- C:\WINDOWS\System32\luwapeta.dll[2010/02/07 01:24:41 | 000,006,456 | -H-- | M] () -- C:\WINDOWS\System32\lihowulu[2010/02/07 01:00:01 | 000,000,296 | ---- | M] () -- C:\WINDOWS\tasks\eqokhmcr.job:Commands[emptytemp]Then click the Run Fix button at the topLet the program run unhindered, reboot when it is doneIt will produce a log for you on reboot, please post that log in your next reply.============Download ComboFix from one of these locations:Link 1Link 2* IMPORTANT !!! Save ComboFix.exe to your DesktopDisable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our toolsDouble click on ComboFix.exe & follow the prompts.As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware. Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console. **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:Click on Yes, to continue scanning for malware.When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply. Link to post Share on other sites More sharing options...
dlm415 Posted February 7, 2010 Author ID:195927 Share Posted February 7, 2010 GMER Rootkit Log File is attached.ark.txt Link to post Share on other sites More sharing options...
kahdah Posted February 7, 2010 ID:195931 Share Posted February 7, 2010 ok go ahead with the previous instructions please. Link to post Share on other sites More sharing options...
dlm415 Posted February 7, 2010 Author ID:195936 Share Posted February 7, 2010 OTL MOVED FILE OUTPUTAll processes killed========== OTL ==========C:\WINDOWS\system32\tijevufi.dll moved successfully.C:\WINDOWS\system32\malaruwo.dll moved successfully.C:\WINDOWS\system32\hebedogu.dll moved successfully.C:\WINDOWS\system32\bahezido.dll moved successfully.C:\WINDOWS\system32\suwofada.dll moved successfully.C:\WINDOWS\system32\rehotiza.dll moved successfully.C:\WINDOWS\system32\mepawadi.dll moved successfully.C:\WINDOWS\system32\jivabefu.dll moved successfully.C:\WINDOWS\system32\dofedaho.dll moved successfully.C:\WINDOWS\system32\yuniyuzi.dll moved successfully.C:\WINDOWS\system32\vasezanu.dll moved successfully.C:\WINDOWS\system32\sumirimi.dll moved successfully.C:\WINDOWS\system32\pufuyada.dll moved successfully.C:\WINDOWS\system32\pohudodi.dll moved successfully.C:\WINDOWS\system32\napokoku.dll moved successfully.C:\WINDOWS\system32\jifibiti.dll moved successfully.C:\WINDOWS\system32\jefizaya.dll moved successfully.C:\WINDOWS\system32\gunowini.dll moved successfully.C:\WINDOWS\system32\yunizapa.dll moved successfully.C:\WINDOWS\system32\yefeluki.dll moved successfully.C:\WINDOWS\system32\welolazu.dll moved successfully.C:\WINDOWS\system32\sodiluha.dll moved successfully.C:\WINDOWS\system32\sivagami.dll moved successfully.C:\WINDOWS\system32\saliyono.dll moved successfully.C:\WINDOWS\system32\pakiyavo.dll moved successfully.C:\WINDOWS\system32\mamapome.dll moved successfully.C:\WINDOWS\system32\junebenu.dll moved successfully.C:\WINDOWS\system32\gumizoju.dll moved successfully.C:\WINDOWS\system32\feretizi.dll moved successfully.C:\WINDOWS\system32\surosubo.dll moved successfully.C:\WINDOWS\system32\jamahesa.dll moved successfully.C:\WINDOWS\system32\wofevebo.dll moved successfully.C:\WINDOWS\system32\luwapeta.dll moved successfully.C:\WINDOWS\system32\lihowulu moved successfully.C:\WINDOWS\tasks\eqokhmcr.job moved successfully.========== COMMANDS ==========[EMPTYTEMP]User: AdministratorUser: Administrator.YOUR-FD0B5B70B8->Temp folder emptied: 0 bytes->Temporary Internet Files folder emptied: 57095 bytesUser: All UsersUser: Default User->Temp folder emptied: 0 bytes->Temporary Internet Files folder emptied: 32902 bytesUser: LocalService->Temp folder emptied: 65716 bytes Link to post Share on other sites More sharing options...
dlm415 Posted February 7, 2010 Author ID:195947 Share Posted February 7, 2010 COMBOFIX LOGComboFix 10-02-07.02 - Owner 02/07/2010 13:23:09.1.1 - x86Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1022.603 [GMT -6:00]Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe.((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))).c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.datc:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.datc:\program files\version.txtc:\recycler\S-1-5-21-1380814761-582880326-1904715986-1003D:\Autorun.inf----- BITS: Possible infected sites -----hxxp://77.74.48.111.((((((((((((((((((((((((( Files Created from 2010-01-07 to 2010-02-07 ))))))))))))))))))))))))))))))).2010-02-07 19:08 . 2010-02-07 19:08 -------- d-----w- C:\_OTL2010-02-07 04:15 . 2010-02-07 04:15 -------- d-----w- C:\!KillBox2010-02-06 22:21 . 2010-02-06 22:22 -------- d-----w- c:\documents and settings\All Users\Application Data\WinZip2010-02-06 22:06 . 2010-02-06 22:06 -------- d-----w- c:\documents and settings\Owner\Application Data\Malwarebytes2010-02-06 21:55 . 2010-01-07 22:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys2010-02-06 21:55 . 2010-02-06 21:55 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes2010-02-06 21:55 . 2010-01-07 22:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys2010-02-06 21:55 . 2010-02-06 22:04 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware2010-02-03 22:44 . 2009-07-08 18:01 165376 ----a-w- c:\windows\system32\InetCntrl0014.dll2010-01-12 21:30 . 2009-11-21 15:51 471552 -c----w- c:\windows\system32\dllcache\aclayers.dll.(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))).2010-01-29 16:24 . 2008-01-05 18:31 -------- d-----w- c:\program files\Webroot2010-01-29 00:18 . 2008-01-05 18:31 -------- d-----w- c:\documents and settings\Owner\Application Data\Webroot2010-01-29 00:18 . 2008-01-05 18:31 -------- d-----w- c:\documents and settings\All Users\Application Data\Webroot2010-01-20 22:17 . 2009-08-09 00:03 -------- d-----w- c:\program files\Microsoft Silverlight2010-01-05 10:00 . 2005-03-23 16:53 832512 ----a-w- c:\windows\system32\wininet.dll2010-01-05 10:00 . 2005-03-23 16:52 78336 ----a-w- c:\windows\system32\ieencode.dll2010-01-05 10:00 . 2005-03-23 16:52 17408 ------w- c:\windows\system32\corpol.dll2009-12-25 20:19 . 2009-12-25 20:19 8854 ----a-r- c:\documents and settings\Owner\Application Data\Microsoft\Installer\{0AB76F69-E761-4CFA-B9B0-A1906B4E9E4B}\Uninstall_WD_Diagnos_0AB76F69E7614CFAB9B0A1906B4E9E4B.exe2009-12-25 20:19 . 2009-12-25 20:19 40960 ----a-r- c:\documents and settings\Owner\Application Data\Microsoft\Installer\{0AB76F69-E761-4CFA-B9B0-A1906B4E9E4B}\WinDlg.exe_0AB76F69E7614CFAB9B0A1906B4E9E4B_3.exe2009-12-25 20:19 . 2009-12-25 20:19 10134 ----a-r- c:\documents and settings\Owner\Application Data\Microsoft\Installer\{0AB76F69-E761-4CFA-B9B0-A1906B4E9E4B}\ARPPRODUCTICON.exe2009-12-25 20:19 . 2009-12-25 20:19 -------- d-----w- c:\program files\Western Digital Technologies2009-12-08 01:30 . 2009-09-18 01:18 57988 ---ha-w- c:\windows\system32\mlfcache.dat2009-12-06 04:08 . 2008-01-06 18:17 77624 ----a-w- c:\documents and settings\Owner\Local Settings\Application Data\GDIPFONTCACHEV1.DAT2009-12-06 00:29 . 2009-12-06 00:29 152576 ----a-w- c:\documents and settings\Owner\Application Data\Sun\Java\jre1.6.0_17\lzma.dll2009-12-06 00:29 . 2009-11-28 15:20 79488 ----a-w- c:\documents and settings\Owner\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll2009-11-25 17:20 . 2009-11-25 17:20 79144 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.2.25\SetupAdmin.exe2009-11-21 15:51 . 2005-03-23 16:52 471552 ----a-w- c:\windows\AppPatch\aclayers.dll2009-11-10 03:35 . 2009-11-10 03:35 5 ----a-w- c:\program files\eula.txt.((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shown REGEDIT4[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]"{0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2}"= "c:\program files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL" [2008-06-26 66912][HKEY_CLASSES_ROOT\clsid\{0579b4b6-0293-4d73-b02d-5ebb0ba0f0a2}][HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2}]2008-06-26 22:12 66912 ----a-w- c:\program files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-05-24 68856]"Window Washer"="c:\program files\Webroot\Washer\wwDisp.exe" [2007-08-09 1261384][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"Broadcom Wireless Manager UI"="c:\windows\system32\bcmntray" [X]"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-04-15 344064]"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-03 32768]"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2004-11-05 98394]"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2004-11-05 688218]"SunKist"="c:\program files\Digital Media Reader\shwicon2k.exe" [2004-05-27 139264]"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2002-09-14 212992]"tgcmd"="c:\program files\support.com\bin\tgcmd.exe" [2002-04-25 1544192]"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-03-20 213936]"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792]"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-08-13 177440]"Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2009-02-03 233304]"nmctxth"="c:\program files\Common Files\Pure Networks Shared\Platform\nmctxth.exe" [2008-12-13 642856]"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-11 417792]"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-11-12 141600]"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]"InetCntrl"="c:\windows\system32\InetCntrl\InetCntrl.exe" [2009-06-10 840944]c:\documents and settings\All Users\Start Menu\Programs\Startup\BigFix.lnk - c:\program files\BigFix\BigFix.exe [2008-1-4 1742384]WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2009-11-18 495432][HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]"EnableFirewall"= 0 (0x0)[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]"%windir%\\system32\\sessmgr.exe"="c:\\Program Files\\support.com\\bin\\tgcmd.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe"="c:\\Program Files\\Bonjour\\mDNSResponder.exe"="c:\\Program Files\\iTunes\\iTunes.exe"="c:\\Program Files\\Common Files\\Pure Networks Shared\\Platform\\nmsrvc.exe"=[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]"67:UDP"= 67:UDP:DHCP Discovery ServiceR1 bsofrwl;bsofrwl;c:\windows\system32\drivers\bsofrwl.sys [1/5/2008 12:24 PM 29024]R2 AdobeActiveFileMonitor7.0;Adobe Active File Monitor V7;c:\program files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe [9/16/2008 12:03 PM 169312]R2 LinksysUpdater;Linksys Updater;c:\program files\Linksys\Linksys Updater\bin\LinksysUpdater.exe [11/13/2008 1:43 PM 204800]R2 wwEngineSvc;Window Washer Engine;c:\program files\Webroot\Washer\WasherSvc.exe [1/5/2008 12:58 PM 388936]R3 HSFHWATI;HSFHWATI;c:\windows\system32\drivers\HSFHWATI.sys [1/4/2008 10:32 PM 200192]S3 AMDMSRIO;AMDMSRIO;\??\c:\docume~1\Owner\LOCALS~1\Temp\Safe To Delete 3_0_4_8\AMDMSRIO.sys --> c:\docume~1\Owner\LOCALS~1\Temp\Safe To Delete 3_0_4_8\AMDMSRIO.sys [?]--- Other Services/Drivers In Memory ---*Deregistered* - BSafeFilter.Contents of the 'Scheduled Tasks' folder2009-12-30 c:\windows\Tasks\AppleSoftwareUpdate.job- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 17:34]..------- Supplementary Scan -------.uStart Page = hxxp://www.yahoo.com/uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8mStart Page = hxxp://www.comcast.net/mWindow Title = Microsoft Internet Explorer provided by ComcastuInternet Connection Wizard,ShellNext = hxxp://www.comcast.net/uInternet Settings,ProxyOverride = *.localuSearchAssistant = hxxp://www.google.com/ieuSearchURL,(Default) = hxxp://www.google.com/search?q=%sIE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000LSP: InetCntrl0014.dllTrusted Zone: turbotax.com.- - - - ORPHANS REMOVED - - - -WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file)AddRemove-Malwarebytes' Anti-Malware_is1 - f:\malwarebytes' anti-malware\unins000.exe**************************************************************************catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.netRootkit scan 2010-02-07 13:29Windows 5.1.2600 Service Pack 3 NTFSscanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfullyhidden files: 0**************************************************************************.--------------------- DLLs Loaded Under Running Processes ---------------------- - - - - - - > 'winlogon.exe'(888)c:\windows\system32\Ati2evxx.dllc:\windows\System32\BCMLogon.dll- - - - - - - > 'lsass.exe'(944)c:\windows\system32\InetCntrl0014.dll- - - - - - - > 'explorer.exe'(2464)c:\windows\system32\WININET.dllc:\windows\system32\InetCntrl\PopupKil\popuphuk.dllc:\windows\system32\ieframe.dllc:\program files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dllc:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dllc:\windows\system32\WPDShServiceObj.dllc:\windows\system32\PortableDeviceTypes.dllc:\windows\system32\PortableDeviceApi.dll.------------------------ Other Running Processes ------------------------.c:\windows\system32\Ati2evxx.exec:\windows\System32\wltrysvc.exec:\windows\System32\bcmwltry.exec:\windows\system32\Ati2evxx.exec:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exec:\program files\Bonjour\mDNSResponder.exec:\program files\Common Files\Intuit\Update Service\IntuitUpdateService.exec:\program files\Java\jre6\bin\jqs.exec:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXEc:\program files\Common Files\New Boundary\PrismXL\PRISMXL.SYSc:\windows\system32\java.exec:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exec:\program files\Common Files\Pure Networks Shared\Platform\nmsrvc.exec:\windows\system32\bcmntray.exec:\windows\system32\wscntfy.exec:\program files\iPod\bin\iPodService.exe.**************************************************************************.Completion time: 2010-02-07 13:36:52 - machine was rebootedComboFix-quarantined-files.txt 2010-02-07 19:36Pre-Run: 38,304,145,408 bytes freePost-Run: 38,239,916,032 bytes freeWindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe[boot loader]timeout=2default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS[operating systems]c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdconsmulti(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect- - End Of File - - D00B7577F6CAB709DCE067E3CC40B381 Link to post Share on other sites More sharing options...
kahdah Posted February 7, 2010 ID:195969 Share Posted February 7, 2010 Update Run MalwarebytesPlease update\run Malwarebytes' Anti-Malware.Double Click the Malwarebytes Anti-Malware icon to run the application.Click on the update tab then click on Check for updates.If an update is found, it will download and install the latest version.Once the update has loaded, go to the Scanner tab and select "Perform Quick Scan", then click Scan.The scan may take some time to finish,so please be patient.When the scan is complete, click OK, then Show Results to view the results.Make sure that everything is checked, and click Remove Selected.When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.Copy&Paste the entire report in your next reply.Extra Note:If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatley.=====Please do a scan with Kaspersky Online ScannerNote: If you are using Windows Vista, open your browser by right-clicking on its icon and select 'Run as administrator' to perform this scan.Click on the Accept button and install any components it needs.The program will install and then begin downloading the latest definition files.After the files have been downloaded on the left side of the page in the Scan section select My ComputerThis will start the program and scan your system.The scan will take a while, so be patient and let it run.Once the scan is complete, click on View scan reportNow, click on the Save Report as button.Save the file to your desktop.Copy and paste that information in your next post. Link to post Share on other sites More sharing options...
dlm415 Posted February 7, 2010 Author ID:195989 Share Posted February 7, 2010 Malwarebytes' Anti-Malware 1.44Database version: 3703Windows 5.1.2600 Service Pack 3Internet Explorer 7.0.5730.132/7/2010 2:25:30 PMmbam-log-2010-02-07 (14-25-30).txtScan type: Quick ScanObjects scanned: 122104Time elapsed: 5 minute(s), 37 second(s)Memory Processes Infected: 0Memory Modules Infected: 1Registry Keys Infected: 11Registry Values Infected: 2Registry Data Items Infected: 0Folders Infected: 0Files Infected: 2Memory Processes Infected:(No malicious items detected)Memory Modules Infected:C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL (Adware.AskSBAR) -> Delete on reboot.Registry Keys Infected:HKEY_CLASSES_ROOT\TypeLib\{f0d4b230-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> Quarantined and deleted successfully.HKEY_CLASSES_ROOT\Interface\{f0d4b23a-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> Quarantined and deleted successfully.HKEY_CLASSES_ROOT\Interface\{f0d4b23c-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> Quarantined and deleted successfully.HKEY_CLASSES_ROOT\CLSID\{b15fd82e-85bc-430d-90cb-65db1b030510} (Adware.AskSBAR) -> Quarantined and deleted successfully.HKEY_CLASSES_ROOT\CLSID\{f0d4b231-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> Quarantined and deleted successfully.HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{f0d4b231-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> Quarantined and deleted successfully.HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{f0d4b231-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> Quarantined and deleted successfully.HKEY_CLASSES_ROOT\CLSID\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> Quarantined and deleted successfully.HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> Quarantined and deleted successfully.HKEY_CLASSES_ROOT\CLSID\{f0d4b23b-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> Quarantined and deleted successfully.HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{f0d4b23b-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> Quarantined and deleted successfully.Registry Values Infected:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> Quarantined and deleted successfully.HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa} (Adware.AskSBAR) -> Quarantined and deleted successfully.Registry Data Items Infected:(No malicious items detected)Folders Infected:(No malicious items detected)Files Infected:C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL (Adware.AskSBAR) -> Delete on reboot.C:\Documents and Settings\Owner\Desktop\winlogon.exe (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.Scanning with Kaspersky now.Thanks DLM415 Link to post Share on other sites More sharing options...
kahdah Posted February 7, 2010 ID:195993 Share Posted February 7, 2010 Ok you are welcome. Link to post Share on other sites More sharing options...
dlm415 Posted February 7, 2010 Author ID:196059 Share Posted February 7, 2010 Here is the Kaspersky output file--------------------------------------------------------------------------------KASPERSKY ONLINE SCANNER 7.0: scan report Sunday, February 7, 2010 Operating system: Microsoft Windows XP Home Edition Service Pack 3 (build 2600) Kaspersky Online Scanner version: 7.0.26.13 Last database update: Sunday, February 07, 2010 19:51:35 Records in database: 3446911--------------------------------------------------------------------------------Scan settings: scan using the following database: extended Scan archives: yes Scan e-mail databases: yesScan area - My Computer: C:\ D:\ E:\Scan statistics: Objects scanned: 82354 Threats found: 0 Infected objects found: 0 Suspicious objects found: 0 Scan duration: 02:20:31No threats found. Scanned area is clean.Selected area has been scanned.It doesn't show anything. Computer seems to be performing better.What next? Link to post Share on other sites More sharing options...
kahdah Posted February 8, 2010 ID:196073 Share Posted February 8, 2010 Double click on OTL to run it. Make sure all other windows are closed and to let it run uninterrupted.When the window appears, underneath Output at the top change it to Minimal Output.Under the Standard Registry box change it to All.Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.When the scan completes, it will open one notepad window. OTL.Txt a This is saved in the same location as OTL.Please copy (Edit->Select All, Edit->Copy) the contents of this file and post it with your next reply. Link to post Share on other sites More sharing options...
dlm415 Posted February 8, 2010 Author ID:196091 Share Posted February 8, 2010 OTL.Txt - File outputOTL logfile created on: 2/7/2010 6:55:25 PM - Run 2OTL by OldTimer - Version 3.1.28.0 Folder = C:\Documents and Settings\Owner\DesktopWindows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstationInternet Explorer (Version = 7.0.5730.13)Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy1,022.00 Mb Total Physical Memory | 599.00 Mb Available Physical Memory | 59.00% Memory free2.00 Gb Paging File | 2.00 Gb Available in Paging File | 87.00% Paging File freePaging file location(s): C:\pagefile.sys 1536 3072 [binary data]%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program FilesDrive C: | 70.93 Gb Total Space | 35.52 Gb Free Space | 50.08% Space Free | Partition Type: NTFSDrive D: | 3.59 Gb Total Space | 0.83 Gb Free Space | 23.06% Space Free | Partition Type: FAT32E: Drive not present or media not loadedF: Drive not present or media not loadedG: Drive not present or media not loadedH: Drive not present or media not loadedI: Drive not present or media not loadedComputer Name: YOUR-FD0B5B70B8Current User Name: OwnerLogged in as Administrator.Current Boot Mode: NormalScan Mode: Current userCompany Name Whitelist: OffSkip Microsoft Files: OffFile Age = 30 DaysOutput = Minimal========== Processes (SafeList) ==========PRC - C:\Documents and Settings\Owner\Desktop\OTL.exe (OldTimer Tools)PRC - C:\Program Files\WinZip\WZQKPICK.EXE (WinZip Computing, S.L.)PRC - C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)PRC - C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)PRC - C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)PRC - C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)PRC - C:\WINDOWS\system32\java.exe (Sun Microsystems, Inc.)PRC - C:\WINDOWS\system32\InetCntrl\InetCntrl.exe (Bsafe Online, Inc.)PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)PRC - C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corporation)PRC - C:\Program Files\MSN\Toolbar\3.0.1125.0\msntask.exe (Microsoft Corp.)PRC - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe (Cisco Systems, Inc.)PRC - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe (Cisco Systems, Inc.)PRC - C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.)PRC - C:\Program Files\Linksys\Linksys Updater\bin\LinksysUpdater.exe ()PRC - C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe (Intuit Inc.)PRC - C:\Program Files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe (Adobe Systems Incorporated)PRC - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)PRC - C:\WINDOWS\system32\wscntfy.exe (Microsoft Corporation)PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)PRC - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS (New Boundary Technologies, Inc.)PRC - C:\Program Files\Webroot\Washer\WasherSvc.exe (Webroot Software, Inc.)PRC - C:\Program Files\Webroot\Washer\wwDisp.exe (Webroot Software, Inc.)PRC - C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe (Macrovision Corporation)PRC - C:\WINDOWS\system32\ati2evxx.exe (ATI Technologies Inc.)PRC - C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe (ATI Technologies, Inc.)PRC - C:\WINDOWS\system32\BCMWLTRY.EXE (Broadcom Corporation)PRC - C:\WINDOWS\system32\WLTRYSVC.EXE ()PRC - C:\WINDOWS\system32\bcmntray.EXE (Broadcom Corporation)PRC - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics, Inc.)PRC - C:\Program Files\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.)PRC - C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe (Cyberlink Corp.)PRC - C:\Program Files\Digital Media Reader\shwicon2k.exe (Alcor Micro, Corp.)PRC - C:\Program Files\BigFix\BigFix.exe (BigFix Inc.)PRC - C:\Program Files\support.com\bin\tgcmd.exe (Support.com, Inc.)========== Modules (SafeList) ==========MOD - C:\Documents and Settings\Owner\Desktop\OTL.exe (OldTimer Tools)MOD - C:\WINDOWS\system32\InetCntrl\PopupKil\popuphuk.dll (Bsafe Online, Inc.)MOD - C:\WINDOWS\system32\SynTPFcs.dll (Synaptics, Inc.)========== Win32 Services (SafeList) ==========SRV - (iPod Service) -- C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)SRV - (JavaQuickStarterService) -- C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)SRV - (Apple Mobile Device) -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)SRV - (SeaPort) -- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corporation)SRV - (FLEXnet Licensing Service) -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.)SRV - (nmservice) -- C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe (Cisco Systems, Inc.)SRV - (Bonjour Service) -- C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.)SRV - (LinksysUpdater) -- C:\Program Files\Linksys\Linksys Updater\bin\LinksysUpdater.exe ()SRV - (IntuitUpdateService) -- C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe (Intuit Inc.)SRV - (AdobeActiveFileMonitor7.0) -- C:\Program Files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe (Adobe Systems Incorporated)SRV - (gusvc) -- C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (Google)SRV - (PrismXL) -- C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS (New Boundary Technologies, Inc.)SRV - (wwEngineSvc) -- C:\Program Files\Webroot\Washer\WasherSvc.exe (Webroot Software, Inc.)SRV - (Ati HotKey Poller) -- C:\WINDOWS\system32\ati2evxx.exe (ATI Technologies Inc.)SRV - (wltrysvc) -- C:\WINDOWS\System32\wltrysvc.exe ()SRV - (ose) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)========== Driver Services (SafeList) ==========DRV - (USBAAPL) -- C:\WINDOWS\system32\drivers\usbaapl.sys (Apple, Inc.)DRV - (GEARAspiWDM) -- C:\WINDOWS\system32\drivers\GEARAspiWDM.sys (GEAR Software Inc.)DRV - (PxHelp20) -- C:\WINDOWS\System32\Drivers\PxHelp20.sys (Sonic Solutions)DRV - (purendis) -- C:\WINDOWS\system32\drivers\purendis.sys (Cisco Systems, Inc.)DRV - (pnarp) -- C:\WINDOWS\system32\drivers\pnarp.sys (Cisco Systems, Inc.)DRV - (amdagp) -- C:\WINDOWS\system32\DRIVERS\amdagp.sys (Advanced Micro Devices, Inc.)DRV - (sisagp) -- C:\WINDOWS\system32\DRIVERS\sisagp.sys (Silicon Integrated Systems Corporation)DRV - (AegisP) AEGIS Protocol (IEEE 802.1x) -- C:\WINDOWS\system32\drivers\AegisP.sys (Meetinghouse Data Communications)DRV - (ASCTRM) -- C:\WINDOWS\system32\drivers\asctrm.sys (Windows ® 2000 DDK provider)DRV - (SSKBFD) -- C:\WINDOWS\system32\drivers\sskbfd.sys (Webroot Software Inc (www.webroot.com))DRV - (Secdrv) -- C:\WINDOWS\system32\drivers\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)DRV - (bsofrwl) -- C:\WINDOWS\system32\drivers\bsofrwl.sys (NT Kernel Resources)DRV - (ati2mtag) -- C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)DRV - (CAMCHALA) -- C:\WINDOWS\system32\drivers\camc6hal.sys (Conexant Systems Inc.)DRV - (CAMCAUD) -- C:\WINDOWS\system32\drivers\camc6aud.sys (Conexant Systems Inc.)DRV - (yukonwxp) -- C:\WINDOWS\system32\drivers\yk51x86.sys (Marvell)DRV - (BCM43XX) -- C:\WINDOWS\system32\drivers\BCMWL5.SYS (Broadcom Corporation)DRV - (BCM42RLY) -- C:\WINDOWS\system32\drivers\bcm42rly.sys (Broadcom Corporation)DRV - (HSFHWATI) -- C:\WINDOWS\system32\drivers\HSFHWATI.sys (Conexant Systems, Inc.)DRV - (winachsf) -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys (Conexant Systems, Inc.)DRV - (HSF_DP) -- C:\WINDOWS\system32\drivers\HSF_DP.sys (Conexant Systems, Inc.)DRV - (SynTP) -- C:\WINDOWS\system32\drivers\SynTP.sys (Synaptics, Inc.)DRV - (AmdK8) -- C:\WINDOWS\system32\drivers\AmdK8.sys (Advanced Micro Devices)DRV - (Ptilink) -- C:\WINDOWS\system32\drivers\ptilink.sys (Parallel Technologies, Inc.)DRV - (nv) -- C:\WINDOWS\system32\drivers\nv4_mini.sys (NVIDIA Corporation)DRV - (EMCFILT) -- C:\WINDOWS\system32\drivers\EMCfilt.sys (Alcor Micro Corp.)DRV - (mdmxsdk) -- C:\WINDOWS\system32\drivers\mdmxsdk.sys (Conexant)DRV - (Sparrow) -- C:\WINDOWS\system32\DRIVERS\sparrow.sys (Adaptec, Inc.)DRV - (sym_u3) -- C:\WINDOWS\system32\DRIVERS\sym_u3.sys (LSI Logic)DRV - (sym_hi) -- C:\WINDOWS\system32\DRIVERS\sym_hi.sys (LSI Logic)DRV - (symc8xx) -- C:\WINDOWS\system32\DRIVERS\symc8xx.sys (LSI Logic)DRV - (symc810) -- C:\WINDOWS\system32\DRIVERS\symc810.sys (Symbios Logic Inc.)DRV - (ultra) -- C:\WINDOWS\system32\DRIVERS\ultra.sys (Promise Technology, Inc.)DRV - (ql12160) -- C:\WINDOWS\system32\DRIVERS\ql12160.sys (QLogic Corporation)DRV - (ql1080) -- C:\WINDOWS\system32\DRIVERS\ql1080.sys (QLogic Corporation)DRV - (ql1280) -- C:\WINDOWS\system32\DRIVERS\ql1280.sys (QLogic Corporation)DRV - (dac2w2k) -- C:\WINDOWS\system32\DRIVERS\dac2w2k.sys (Mylex Corporation)DRV - (mraid35x) -- C:\WINDOWS\system32\DRIVERS\mraid35x.sys (American Megatrends Inc.)DRV - (asc) -- C:\WINDOWS\system32\DRIVERS\asc.sys (Advanced System Products, Inc.)DRV - (asc3550) -- C:\WINDOWS\system32\DRIVERS\asc3550.sys (Advanced System Products, Inc.)DRV - (AliIde) -- C:\WINDOWS\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.)DRV - (CmdIde) -- C:\WINDOWS\system32\DRIVERS\cmdide.sys (CMD Technology, Inc.)DRV - (mxnic) -- C:\WINDOWS\system32\drivers\mxnic.sys (Macronix International Co., Ltd. )========== Standard Registry (All) ==================== Internet Explorer ==========IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-onsIE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htmIE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRiskIE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htmIE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ieIE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htmIE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htmIE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?p...amp;ar=iesearchIE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = GoogleIE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerm...tf8&oe=utf8IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ieIE - HKCU\..\URLSearchHook: {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL (Ask.com)IE - HKCU\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\WINDOWS\system32\ieframe.dll (Microsoft Corporation)IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.localFF - HKLM\software\mozilla\Firefox\extensions\\{20a82645-c095-46ed-80e3-08825760534b}: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [2009/08/22 09:10:09 | 000,000,000 | ---D | M]FF - HKLM\software\mozilla\Firefox\extensions\\jqs@sun.com: C:\Program Files\Java\jre6\lib\deploy\jqs\ff [2009/05/31 17:56:37 | 000,000,000 | ---D | M]O1 HOSTS File: ([2010/02/07 13:28:48 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hostsO1 - Hosts: 127.0.0.1 localhostO2 - BHO: (Ask Search Assistant BHO) - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL (Ask.com)O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll (Google Inc.)O2 - BHO: (MSN Toolbar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.1125.0\msneshellx.dll (Microsoft Corp.)O2 - BHO: (Java Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)O2 - BHO: (Bsecure Popup Blocker) - {E0019445-4C1F-414D-A70E-AD80F231C584} - C:\WINDOWS\system32\InetCntrl\PopupKil\BsafeBHO.dll (Bsecure Technologies, Inc.)O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)O3 - HKLM\..\Toolbar: (MSN Toolbar) - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.1125.0\msneshellx.dll (Microsoft Corp.)O3 - HKLM\..\Toolbar: (Bsecure Popup Blocker) - {E0019445-4C1F-414D-A70E-AD80F231C584} - C:\WINDOWS\system32\InetCntrl\PopupKil\BsafeBHO.dll (Bsecure Technologies, Inc.)O3 - HKCU\..\Toolbar\ShellBrowser: (&Address) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)O3 - HKCU\..\Toolbar\WebBrowser: (&Address) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)O3 - HKCU\..\Toolbar\WebBrowser: (&Links) - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)O3 - HKCU\..\Toolbar\WebBrowser: (&Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll ()O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)O4 - HKLM..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe (Apple Inc.)O4 - HKLM..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe (ATI Technologies, Inc.)O4 - HKLM..\Run: [broadcom Wireless Manager UI] C:\WINDOWS\System32\bcmntray.exe (Broadcom Corporation)O4 - HKLM..\Run: [inetCntrl] C:\WINDOWS\system32\InetCntrl\InetCntrl.exe (Bsafe Online, Inc.)O4 - HKLM..\Run: [iSUSPM] C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe (Macrovision Corporation)O4 - HKLM..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)O4 - HKLM..\Run: [Microsoft Default Manager] C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe (Microsoft Corp.)O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\System32\NeroCheck.exe (Ahead Software Gmbh)O4 - HKLM..\Run: [nmctxth] C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe (Cisco Systems, Inc.)O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\QTTask.exe (Apple Inc.)O4 - HKLM..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE ()O4 - HKLM..\Run: [RemoteControl] C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe (Cyberlink Corp.)O4 - HKLM..\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)O4 - HKLM..\Run: [sunKist] C:\Program Files\Digital Media Reader\shwicon2k.exe (Alcor Micro, Corp.)O4 - HKLM..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics, Inc.)O4 - HKLM..\Run: [synTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.)O4 - HKLM..\Run: [tgcmd] C:\Program Files\support.com\bin\tgcmd.exe (Support.com, Inc.)O4 - HKCU..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (Microsoft Corporation)O4 - HKCU..\Run: [MSMSGS] C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)O4 - HKCU..\Run: [Window Washer] C:\Program Files\Webroot\Washer\wwDisp.exe (Webroot Software, Inc.)O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\BigFix.lnk = C:\Program Files\BigFix\BigFix.exe (BigFix Inc.)O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE (WinZip Computing, S.L.)O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Main presentO6 - HKLM\Software\Policies\Microsoft\Internet Explorer\PhishingFilter presentO6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel presentO7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation)O9 - Extra Button: ComcastHSI - {669B269B-0D4E-41FB-A3D8-FD67CA94F646} - File not foundO9 - Extra Button: Support - {8828075D-D097-4055-AA02-2DBFA9D85E8A} - File not foundO9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)O9 - Extra Button: Help - {97809617-3937-4F84-B335-9BB05EF1A8D4} - File not foundO9 - Extra Button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\shdocvw.dll (Microsoft Corporation)O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe (Microsoft Corporation)O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - C:\WINDOWS\system32\winrnr.dll (Microsoft Corporation)O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000002 - File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000003 - File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000004 - File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000005 - File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000006 - File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000007 - File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000008 - File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000009 - File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000010 - File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000011 - File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000012 - File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000013 - File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000014 - File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000015 - File not foundO10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - C:\WINDOWS\system32\rsvpsp.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000020 - C:\WINDOWS\system32\rsvpsp.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000021 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000022 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000023 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000024 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000025 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000026 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000027 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000028 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000029 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000030 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)O10 - Protocol_Catalog9\Catalog_Entries\000000000031 - File not foundO15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.O15 - HKCU\..Trusted Domains: turbotax.com ([]https in Trusted sites)O15 - HKCU\..Trusted Domains: 2 domain(s) and sub-domain(s) not assigned to a zone.O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} http://photo1.walgreens.com/WalgreensActivia.cab (Snapfish Activia)O16 - DPF: {74C861A1-D548-4916-BC8A-FDE92EDFF62C} http://mediaplayer.walmart.com/installer/install.cab (Reg Error: Key error.)O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_17)O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash...t/ultrashim.cab (Reg Error: Key error.)O16 - DPF: {CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-...indows-i586.cab (Reg Error: Key error.)O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Reg Error: Key error.)O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_17)O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_17)O16 - DPF: {CB50428B-657F-47DF-9B32-671F82AA73F7} http://www.photodex.com/pxplay.cab (Photodex Presenter AX control)O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} http://www.adobe.com/products/acrobat/nos/gp.cab (get_atlcom Class)O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (Reg Error: Value error.)O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 68.87.68.166 68.87.74.166 192.168.1.1 68.87.68.166 68.87.74.166O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)O18 - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)O18 - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\WINDOWS\system32\msvidctl.dll (Microsoft Corporation)O18 - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)O18 - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)O18 - Protocol\Handler\gopher {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)O18 - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)O18 - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)O18 - Protocol\Handler\ipp - No CLSID value foundO18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)O18 - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll (Microsoft Corporation)O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)O18 - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)O18 - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\WINDOWS\system32\inetcomm.dll (Microsoft Corporation)O18 - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)O18 - Protocol\Handler\msdaipp - No CLSID value foundO18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)O18 - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll (Microsoft Corporation)O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)O18 - Protocol\Handler\pure-go {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files\Common Files\Pure Networks Shared\Platform\puresp4.dll (Cisco Systems, Inc.)O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)O18 - Protocol\Handler\sysimage {76E67A63-06E9-11D2-A840-006008059382} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)O18 - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\WINDOWS\system32\msvidctl.dll (Microsoft Corporation)O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)O18 - Protocol\Handler\wia {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINDOWS\system32\wiascr.dll (Microsoft Corporation)O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\System32\mscoree.dll (Microsoft Corporation)O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\System32\mscoree.dll (Microsoft Corporation)O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\System32\mscoree.dll (Microsoft Corporation)O18 - Protocol\Filter\Class Install Handler {32B533BB-EDAE-11d0-BD5A-00AA00B92AF1} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)O18 - Protocol\Filter\deflate {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)O18 - Protocol\Filter\gzip {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)O18 - Protocol\Filter\lzdhtml {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)O18 - Protocol\Filter\text/webviewhtml {733AC4CB-F1A4-11d0-B951-00A0C90312E1} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)O20 - HKLM Winlogon: UIHost - (logonui.exe) - C:\WINDOWS\System32\logonui.exe (Microsoft Corporation)O20 - HKLM Winlogon: VMApplet - (rundll32 shell32) - C:\WINDOWS\System32\shell32.dll (Microsoft Corporation)O20 - HKLM Winlogon: VMApplet - (Control_RunDLL "sysdm.cpl") - C:\WINDOWS\System32\sysdm.cpl (Microsoft Corporation)O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)O20 - Winlogon\Notify\crypt32chain: DllName - crypt32.dll - C:\WINDOWS\System32\crypt32.dll (Microsoft Corporation)O20 - Winlogon\Notify\cryptnet: DllName - cryptnet.dll - C:\WINDOWS\System32\cryptnet.dll (Microsoft Corporation)O20 - Winlogon\Notify\cscdll: DllName - cscdll.dll - C:\WINDOWS\System32\cscdll.dll (Microsoft Corporation)O20 - Winlogon\Notify\dimsntfy: DllName - %SystemRoot%\System32\dimsntfy.dll - C:\WINDOWS\system32\dimsntfy.dll (Microsoft Corporation)O20 - Winlogon\Notify\ScCertProp: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)O20 - Winlogon\Notify\Schedule: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)O20 - Winlogon\Notify\sclgntfy: DllName - sclgntfy.dll - C:\WINDOWS\System32\sclgntfy.dll (Microsoft Corporation)O20 - Winlogon\Notify\SensLogn: DllName - WlNotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)O20 - Winlogon\Notify\termsrv: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)O20 - Winlogon\Notify\wlballoon: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)O21 - SSODL: CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)O21 - SSODL: PostBootReminder - {7849596a-48ea-486e-8937-a2a3009f31a9} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)O21 - SSODL: SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} - C:\WINDOWS\system32\stobject.dll (Microsoft Corporation)O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\WINDOWS\system32\webcheck.dll (Microsoft Corporation)O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll (Microsoft Corporation)O22 - SharedTaskScheduler: {438755C2-A8BA-11D1-B96B-00A0C90312E1} - Browseui preloader - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)O22 - SharedTaskScheduler: {8C7461EF-2B13-11d2-BE35-3078302C2030} - Component Categories cache daemon - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)O24 - Desktop Components:0 (My Current Home Page) - About:HomeO24 - Desktop WallPaper: C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmpO24 - Desktop BackupWallPaper: C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmpO28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - C:\WINDOWS\System32\shell32.dll (Microsoft Corporation)O29 - HKLM SecurityProviders - (msapsspc.dll) - C:\WINDOWS\System32\msapsspc.dll (Microsoft Corporation)O29 - HKLM SecurityProviders - (schannel.dll) - C:\WINDOWS\System32\schannel.dll (Microsoft Corporation)O29 - HKLM SecurityProviders - (digest.dll) - C:\WINDOWS\System32\digest.dll (Microsoft Corporation)O29 - HKLM SecurityProviders - (msnsspc.dll) - C:\WINDOWS\System32\msnsspc.dll (Microsoft Corporation)O30 - LSA: Authentication Packages - (msv1_0) - C:\WINDOWS\System32\msv1_0.dll (Microsoft Corporation)O30 - LSA: Security Packages - (kerberos) - C:\WINDOWS\System32\kerberos.dll (Microsoft Corporation)O30 - LSA: Security Packages - (msv1_0) - C:\WINDOWS\System32\msv1_0.dll (Microsoft Corporation)O30 - LSA: Security Packages - (schannel) - C:\WINDOWS\System32\schannel.dll (Microsoft Corporation)O30 - LSA: Security Packages - (wdigest) - C:\WINDOWS\System32\wdigest.dll (Microsoft Corporation)O31 - SafeBoot: AlternateShell - cmd.exeO32 - HKLM CDRom: AutoRun - 1O32 - AutoRun File - [2005/03/23 12:13:17 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]O34 - HKLM BootExecute: (autocheck autochk *) - File not foundO35 - comfile [open] -- "%1" %*O35 - exefile [open] -- "%1" %*========== Files/Folders - Created Within 30 Days ==========[2010/02/07 13:21:14 | 000,000,000 | RHSD | C] -- C:\cmdcons[2010/02/07 13:18:53 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe[2010/02/07 13:18:53 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe[2010/02/07 13:18:53 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe[2010/02/07 13:18:53 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe[2010/02/07 13:18:45 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT[2010/02/07 13:17:52 | 000,000,000 | ---D | C] -- C:\Qoobox[2010/02/07 13:08:18 | 000,000,000 | ---D | C] -- C:\_OTL[2010/02/07 10:41:46 | 000,549,376 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Owner\Desktop\OTL.exe[2010/02/06 22:15:18 | 000,000,000 | ---D | C] -- C:\!KillBox[2010/02/06 22:15:01 | 000,092,672 | ---- | C] (Option^Explicit Software vbtechcd@gmail.com) -- C:\Documents and Settings\Owner\Desktop\KillBox.exe[2010/02/06 21:45:18 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Desktop\backups[2010/02/06 21:11:24 | 000,401,720 | ---- | C] (Trend Micro Inc.) -- C:\Documents and Settings\Owner\Desktop\HijackThis.exe[2010/02/06 20:48:16 | 000,008,192 | ---- | C] (Microsoft Corporation) -- C:\Documents and Settings\Owner\My Documents\dumped.sys[2010/02/06 16:21:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\WinZip[2010/02/06 16:21:43 | 000,000,000 | ---D | C] -- C:\Program Files\WinZip[2010/02/06 16:08:54 | 000,429,392 | ---- | C] (Malwarebytes Corporation) -- C:\Documents and Settings\Owner\Desktop\mbam2gui.exe[2010/02/06 16:08:31 | 000,236,368 | ---- | C] (Malwarebytes Corporation) -- C:\Documents and Settings\Owner\Desktop\mbamservice.exe[2010/02/06 16:06:12 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Application Data\Malwarebytes[2010/02/06 15:55:45 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys[2010/02/06 15:55:44 | 000,019,160 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys[2010/02/06 15:55:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes[2010/02/06 15:55:43 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware[2010/02/06 15:53:55 | 005,115,824 | ---- | C] (Malwarebytes Corporation ) -- C:\Documents and Settings\Owner\Desktop\mbam-setup.exe[2010/02/04 16:42:28 | 000,000,000 | ---D | C] -- C:\WINDOWS\pss[2010/01/28 18:18:07 | 000,000,000 | ---D | C] -- C:\Config.Msi[2010/01/12 15:30:31 | 000,471,552 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\aclayers.dll[2010/01/11 19:27:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Desktop\Kinetics[2009/09/08 16:55:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft[2008/11/02 16:43:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft[2008/07/05 13:11:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Apple[2005/03/23 12:17:47 | 000,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Application Data\Microsoft[2005/03/23 12:17:45 | 000,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Application Data\Microsoft========== Files - Modified Within 30 Days ==========[2010/02/07 17:48:37 | 000,000,598 | ---- | M] () -- C:\WINDOWS\win.ini[2010/02/07 17:48:19 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT[2010/02/07 17:48:14 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat[2010/02/07 17:48:08 | 1071,824,896 | -HS- | M] () -- C:\hiberfil.sys[2010/02/07 17:47:25 | 003,407,872 | -H-- | M] () -- C:\Documents and Settings\Owner\NTUSER.DAT[2010/02/07 17:47:04 | 000,000,278 | -HS- | M] () -- C:\Documents and Settings\Owner\ntuser.ini[2010/02/07 14:17:11 | 000,000,696 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk[2010/02/07 13:29:07 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini[2010/02/07 13:28:48 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts[2010/02/07 13:21:23 | 000,000,281 | RHS- | M] () -- C:\boot.ini[2010/02/07 13:02:04 | 003,850,297 | R--- | M] () -- C:\Documents and Settings\Owner\Desktop\ComboFix.exe[2010/02/07 10:59:21 | 000,293,376 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\2ffk4bxq.exe[2010/02/07 10:42:49 | 000,026,112 | ---- | M] () -- C:\Documents and Settings\Owner\My Documents\bsecure communication.doc[2010/02/07 10:41:49 | 000,549,376 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Owner\Desktop\OTL.exe[2010/02/06 22:15:03 | 000,092,672 | ---- | M] (Option^Explicit Software vbtechcd@gmail.com) -- C:\Documents and Settings\Owner\Desktop\KillBox.exe[2010/02/06 22:09:46 | 000,000,038 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\fuhihejeDELETE.bat[2010/02/06 21:11:25 | 000,401,720 | ---- | M] (Trend Micro Inc.) -- C:\Documents and Settings\Owner\Desktop\HijackThis.exe[2010/02/06 20:48:16 | 000,008,192 | ---- | M] (Microsoft Corporation) -- C:\Documents and Settings\Owner\My Documents\dumped.sys[2010/02/06 17:50:57 | 000,000,015 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\settings.dat[2010/02/06 16:22:30 | 000,001,732 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\WinZip.lnk[2010/02/06 16:22:30 | 000,001,660 | ---- | M] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk[2010/02/06 16:17:15 | 000,465,298 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\RootRepeal.rar[2010/02/06 15:54:05 | 005,115,824 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\Owner\Desktop\mbam-setup.exe[2010/02/06 15:41:25 | 000,001,170 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl[2010/02/04 22:10:58 | 000,026,624 | ---- | M] () -- C:\Documents and Settings\Owner\My Documents\student sleep essay.doc[2010/02/04 20:15:49 | 000,000,211 | ---- | M] () -- C:\Boot.bak[2010/01/28 18:15:28 | 000,258,082 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\Recredentialing Quick Start Guide.pdf[2010/01/28 18:15:13 | 000,198,842 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\Credentialing of Health Care Professionals.pdf[2010/01/28 18:14:48 | 000,395,343 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\RELEASE OF INFORMATION 10-0459-fill.pdf[2010/01/28 18:14:15 | 000,797,055 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\attachments_2010_01_28.zip[2010/01/13 06:53:29 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK========== Files Created - No Company Name ==========[2010/02/07 13:21:23 | 000,000,211 | ---- | C] () -- C:\Boot.bak[2010/02/07 13:21:18 | 000,260,272 | ---- | C] () -- C:\cmldr[2010/02/07 13:18:53 | 000,261,632 | ---- | C] () -- C:\WINDOWS\PEV.exe[2010/02/07 13:18:53 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe[2010/02/07 13:18:53 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe[2010/02/07 13:18:53 | 000,077,312 | ---- | C] () -- C:\WINDOWS\MBR.exe[2010/02/07 13:18:53 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe[2010/02/07 13:01:49 | 003,850,297 | R--- | C] () -- C:\Documents and Settings\Owner\Desktop\ComboFix.exe[2010/02/07 10:59:17 | 000,293,376 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\2ffk4bxq.exe[2010/02/07 10:42:49 | 000,026,112 | ---- | C] () -- C:\Documents and Settings\Owner\My Documents\bsecure communication.doc[2010/02/06 22:04:31 | 000,000,038 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\fuhihejeDELETE.bat[2010/02/06 16:24:15 | 000,000,015 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\settings.dat[2010/02/06 16:22:30 | 000,001,732 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\WinZip.lnk[2010/02/06 16:22:30 | 000,001,660 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk[2010/02/06 16:17:11 | 000,465,298 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\RootRepeal.rar[2010/02/06 15:55:48 | 000,000,696 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk[2010/02/04 20:11:36 | 1071,824,896 | -HS- | C] () -- C:\hiberfil.sys[2010/02/03 16:44:02 | 000,165,376 | ---- | C] () -- C:\WINDOWS\System32\InetCntrl0014.dll[2010/01/28 18:15:27 | 000,258,082 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\Recredentialing Quick Start Guide.pdf[2010/01/28 18:14:45 | 000,395,343 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\RELEASE OF INFORMATION 10-0459-fill.pdf[2010/01/28 18:14:12 | 000,797,055 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\attachments_2010_01_28.zip[2010/01/26 21:01:20 | 000,026,624 | ---- | C] () -- C:\Documents and Settings\Owner\My Documents\student sleep essay.doc[2009/11/09 21:35:56 | 000,000,005 | ---- | C] () -- C:\Program Files\eula.txt[2009/10/18 19:33:55 | 000,174,920 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat[2009/05/12 20:12:53 | 000,025,600 | ---- | C] () -- C:\Documents and Settings\Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini[2008/02/17 15:17:01 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\preflib.dll[2008/02/17 15:17:00 | 001,204,224 | ---- | C] () -- C:\WINDOWS\System32\bcmwcfg.dll[2008/02/17 15:16:59 | 000,909,312 | ---- | C] () -- C:\WINDOWS\System32\bcmctrls.dll[2008/02/17 15:16:58 | 000,946,176 | ---- | C] () -- C:\WINDOWS\System32\bcmacfg.dll[2008/02/12 20:03:48 | 000,000,049 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini[2008/01/07 16:14:55 | 000,000,268 | ---- | C] () -- C:\Documents and Settings\Owner\Application Data\wklnhst.dat[2008/01/05 00:07:40 | 000,000,002 | ---- | C] () -- C:\WINDOWS\msoffice.ini[2008/01/04 23:46:41 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI[2005/03/27 01:10:58 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini[2005/03/23 10:53:24 | 000,001,264 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini[2005/03/23 10:53:24 | 000,000,488 | ---- | C] () -- C:\WINDOWS\System32\emver.ini[2003/01/07 14:05:08 | 000,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI< End of report >Thanks DLM415 Link to post Share on other sites More sharing options...
kahdah Posted February 8, 2010 ID:196304 Share Posted February 8, 2010 =======Cleanup======= Click START then RUN Now type Combofix /uninstall in the runbox and click OK. Note the space between the X and the U, it needs to be there.======Next======Double click on OTL to run it.Click on the Cleanup button at the top.You will be asked to reboot the machine to finish the Cleanup process. Choose Yes.This will remove itself and other tools we may have used.===============Update Java===============Your Java is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system. Please follow these steps to remove older version Java components and update:Download the latest version of Java SE Runtime Environment (JRE) and save it to your desktop.Scroll down to where it says "Java SE Runtime Environment (JRE) 6 Update 18...allows end-users to run Java applications".Click the "Download" button to the right.Select your Platform: "Windows".Select your Language: "Multi-language".Read the License Agreement, and then check the box that says: "Accept License Agreement".Click Continue and the page will refresh.Click on the link to download Windows Offline Installation and save the file to your desktop.Close any programs you may have running - especially your web browser.Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.Click the Remove or Change/Remove button.Repeat as many times as necessary to remove each Java versions.Reboot your computer once all Java components are removed.Then from your desktop double-click on jre-6u18-windows-i586.exe to install the newest version.======================Clear out infected System Restore points======================Then we need to reset your System Restore points.The link below shows how to do this.How to Turn On and Turn Off System Restore in Windows XPhttp://support.microsoft.com/kb/310405/en-usIf you are using Vista then see this link: http://www.bleepingcomputer.com/tutorials/...143.html#manual Delete\uninstall anything else that we have used that is leftover.=====================================After that your all set. The following are some articles and a Windows Update link that I like to suggest to people to prevent malware and general PC maintenance. Windows Updates - It is very important to make sure that both Internet Explorer and Windows are kept current with the latest critical security patches from Microsoft. To do this just start Internet Explorer and select Tools > Windows Update, and follow the online instructions from there.Prevention article To find out more information about how you got infected in the first place and some great guidelines to follow to prevent future infections please read the Prevention artice by Miekiemoes. If your computer is slow Is a tutorial on what you can do if your computer is slow.File sharing program dangers Reasons to stay away from File sharing programs for ex: BitTorrent,Limewire,Kazaa,emule,Utorrent,Limewire etc... Link to post Share on other sites More sharing options...
dlm415 Posted February 8, 2010 Author ID:196338 Share Posted February 8, 2010 I am at work right now and will do this when I get home. I didn't want to wait to thank you for helping me out. I really appreciate it.Thanksdlm415 Link to post Share on other sites More sharing options...
kahdah Posted February 8, 2010 ID:196472 Share Posted February 8, 2010 You are welcome Safe surfing. Link to post Share on other sites More sharing options...
Maurice Naggar Posted February 13, 2010 ID:199410 Share Posted February 13, 2010 Since this issue is resolved I will close the thread to prevent others from posting here. If you need assistance please start your own topic and someone will be happy to assist you. Link to post Share on other sites More sharing options...
Recommended Posts