Jump to content

slow(as pond water) PC, is it malware?

surfeit

By surfeit
in Resolved Malware Removal Logs

 Share

Recommended Posts

surfeit

surfeit

Posted
Posted

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4694

Windows 5.1.2600 Service Pack 3

Internet Explorer 7.0.5730.13

9/27/2010 7:43:38 AM

mbam-log-2010-09-27 (07-43-38).txt

Scan type: Quick scan

Objects scanned: 208239

Time elapsed: 36 minute(s), 0 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

DDS (Ver_10-03-17.01) - NTFSx86

Run by Ann at 14:06:15.06 on Sun 09/26/2010

Internet Explorer: 7.0.5730.13

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.224.30 [GMT -4:00]

AV: Microsoft Security Essentials *On-access scanning enabled* (Updated) {BCF43643-A118-4432-AEDE-D861FCBCFCDF}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\Program Files\Microsoft Security Essentials\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup

svchost.exe

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

svchost.exe

C:\WINDOWS\System32\cisvc.exe

C:\WINDOWS\system32\svchost.exe -k hpdevmgmt

C:\WINDOWS\System32\svchost.exe -k HPZ12

C:\WINDOWS\System32\nvsvc32.exe

C:\WINDOWS\System32\svchost.exe -k HPZ12

C:\WINDOWS\System32\svchost.exe -k imgsvc

C:\WINDOWS\system32\cidaemon.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\wuauclt.exe

C:\windows\system\hpsysdrv.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\WildTangent\DDC\DDCManager\DDCMan.exe

C:\WINDOWS\system32\ctfmon.exe

C:\PROGRA~1\ALLTEL~1\SMARTB~1\MotiveSB.exe

C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

C:\Program Files\Microsoft Security Essentials\msseces.exe

C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\Program Files\Linksys\WMP11 Config Utility\WMP11Cfg.exe

C:\Program Files\ALLTEL DSL Check-up Center\bin\mpbtn.exe

C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_clipbook.exe

C:\Documents and Settings\Ann\Desktop\dds.scr

============== Pseudo HJT Report ===============

uSearch Bar = hxxp://search.myidentitydefender.com/smallsearch.html

mSearch Bar = hxxp://srch-us4.hpwis.com/

uInternet Settings,ProxyOverride = localhost

mSearchAssistant = hxxp://srch-us4.hpwis.com/

mCustomizeSearch = hxxp://srch-us4.hpwis.com/

uURLSearchHooks: H - No File

uURLSearchHooks: H - No File

BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\program files\hp\digital imaging\smart web printing\hpswp_printenhancer.dll

BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 5.0\reader\activex\AcroIEHelper.ocx

BHO: {fdd3b846-8d59-4ffb-8758-209b6ad74acc} - c:\program files\microsoft money\system\mnyviewer.dll

BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll

TB: {A26503FE-B3B8-4910-A9DC-9CBD25C6B8D6} - No File

EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File

uRun: [CyberDefender Registry Cleaner] c:\program files\cyberdefender\registry cleaner\CDregclean.exe

uRun: [Microsoft Works Update Detection] c:\program files\microsoft works\WkDetect.exe

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

mRun: [hpsysdrv] c:\windows\system\hpsysdrv.exe

mRun: [DDCM] "c:\program files\wildtangent\ddc\ddcmanager\DDCMan.exe" -Background

mRun: [DDCActiveMenu] "c:\program files\wildtangent\ddc\activemenu\DDCActiveMenu.exe" -boot

mRun: [Recguard] c:\windows\sminst\RECGUARD.EXE

mRun: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize

mRun: [igfxTray] c:\windows\system32\igfxtray.exe

mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe

mRun: [PS2] c:\windows\system32\ps2.exe

mRun: [Motive SmartBridge] c:\progra~1\alltel~1\smartb~1\MotiveSB.exe

mRun: [hpqSRMon]

mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe

mRun: [MSSE] "c:\program files\microsoft security essentials\msseces.exe" -hide -runkey

dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\program files\microsoft activesync\INETREPL.DLL

IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\program files\microsoft activesync\INETREPL.DLL

IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll

IE: {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - {301DA1EE-F65C-4188-A417-9E915CC8FBFA} - c:\program files\microsoft money\system\mnyviewer.dll

Trusted Zone: alltel.com\care

DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab

DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204

DPF: {321FB770-1FBE-4BFE-BDC1-6F622D4FA499} - hxxps://activation.alltel.com/wizlet/ALLTEL/static/controls/WebflowActiveXInstaller_2-0-0.cab

DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1136830468775

DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1136830367806

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

Handler: mctp - {d7b95390-b1c5-11d0-b111-0080c712fe82} - c:\program files\microsoft activesync\AATP.DLL

WinCE Filter: image/bmp - {86F59FAE-FB3A-11D1-AA72-00C04FAE2D4B} - c:\program files\microsoft activesync\CENETFLT.DLL

WinCE Filter: image/gif - {86F59FAE-FB3A-11D1-AA72-00C04FAE2D4B} - c:\program files\microsoft activesync\CENETFLT.DLL

WinCE Filter: image/jpeg - {86F59FAE-FB3A-11D1-AA72-00C04FAE2D4B} - c:\program files\microsoft activesync\CENETFLT.DLL

WinCE Filter: image/xbm - {86F59FAE-FB3A-11D1-AA72-00C04FAE2D4B} - c:\program files\microsoft activesync\CENETFLT.DLL

WinCE Filter: text/asp - {6C5C3074-FFAB-11d1-8EC4-00C04F98D57A} - c:\program files\microsoft activesync\CENETFLT.DLL

WinCE Filter: text/html - {6C5C3074-FFAB-11d1-8EC4-00C04F98D57A} - c:\program files\microsoft activesync\CENETFLT.DLL

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

============= SERVICES / DRIVERS ===============

R? ISLP2;Intersil 802.11 Wireless LAN Driver

R? trid3d;trid3d

S? MpFilter;Microsoft Malware Protection Driver

S? SiS7012;Service for AC'97 Sample Driver (WDM)

=============== Created Last 30 ================

2010-09-26 17:55:19 0 ----a-w- c:\documents and settings\ann\defogger_reenable

2010-09-25 23:39:35 0 d-----w- c:\docume~1\ann\applic~1\Malwarebytes

2010-09-25 22:02:25 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-09-25 22:02:09 0 d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes

2010-09-25 22:02:04 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-09-25 22:02:03 0 d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-09-25 19:55:33 0 d-----w- c:\windows\PreviewSoft

2010-09-25 18:01:05 744448 ------w- c:\windows\system32\dllcache\helpsvc.exe

==================== Find3M ====================

2010-08-17 13:17:06 58880 ----a-w- c:\windows\system32\spoolsv.exe

2010-08-17 13:17:06 58880 ------w- c:\windows\system32\dllcache\spoolsv.exe

2010-07-27 06:30:35 8462336 ------w- c:\windows\system32\dllcache\shell32.dll

2010-07-22 15:49:15 590848 ----a-w- c:\windows\system32\rpcrt4.dll

2010-07-22 15:49:15 590848 ------w- c:\windows\system32\dllcache\rpcrt4.dll

2010-07-22 05:57:20 5120 ----a-w- c:\windows\system32\xpsp4res.dll

2010-06-30 12:31:35 149504 ----a-w- c:\windows\system32\schannel.dll

2010-06-30 12:31:35 149504 ------w- c:\windows\system32\dllcache\schannel.dll

2006-01-09 14:14:02 29528 ----a-w- c:\program files\QUICKENW.QIF

2010-03-21 18:22:57 32768 --sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012010032120100322\index.dat

2010-04-13 01:40:38 16384 --sha-w- c:\windows\temp\cookies\index.dat

2010-04-13 01:40:38 16384 --sha-w- c:\windows\temp\history\history.ie5\index.dat

2010-04-13 01:40:38 16384 --sha-w- c:\windows\temp\temporary internet files\content.ie5\index.dat

============= FINISH: 14:10:50.42 ===============

dds_Attach_log_2.zip

dds_log_1.txt

ark.zip

Link to post
Share on other sites
surfeit

surfeit

Posted
  • Author
Posted

This is computer #2. This one is my parents computer that they hardly used. I told them it might can be saved from the junkyard.

I've have just noticed today that after the computer has been on for about an hour, IE is fine. It is completely unusable until it sits for a very long time. Proccesses? Malware? I guess. I don't know what to do if it is. Thanks for your help.

Link to post
Share on other sites
Elise

Elise

Posted
Posted

Okay, if this is a different computer, lets run a few scans. :)

Please download Rootkit Unhooker and save it to your Desktop

  • Double-click on RKUnhookerLE to run it
  • Click the Report tab, then click Scan
  • Check Drivers, Stealth, and uncheck the rest
  • Click OK
  • Wait until it's finished and then go to File > Save Report
  • Save the report to your Desktop

Copy the entire contents of the report and paste it in a reply here.

Note** you may get this warning it is ok, just ignore

"Rootkit Unhooker has detected a parasite inside itself!

It is recommended to remove parasite, okay?"

OTL

-----

Please download OTL from one of the following mirrors:

[*]Save it to your desktop.

[*]Double click on the otlDesktopIcon.png icon on your desktop.

[*]Click the "Scan All Users" checkbox.

[*]Push the Quick Scan button.

[*]Two reports will open, copy and paste them in a reply here:

  • OTListIt.txt <-- Will be opened
  • Extra.txt <-- Will be minimized

Link to post
Share on other sites
surfeit

surfeit

Posted
  • Author
Posted

Ok, here's the three logs.

RkU Version: 3.8.388.590, Type LE (SR2)

==============================================

OS Name: Windows XP

Version 5.1.2600 (Service Pack 3)

Number of processors #1

==============================================

>Drivers

==============================================

0x804D7000 C:\WINDOWS\system32\ntoskrnl.exe 2189952 bytes (Microsoft Corporation, NT Kernel & System)

0x804D7000 PnpManager 2189952 bytes

0x804D7000 RAW 2189952 bytes

0x804D7000 WMIxWDM 2189952 bytes

0xF9ABF000 C:\WINDOWS\System32\DRIVERS\Intels51.sys 1863680 bytes (Intel Corporation, Intel V.92 Modem)

0xBF800000 Win32k 1855488 bytes

0xBF800000 C:\WINDOWS\System32\win32k.sys 1855488 bytes (Microsoft Corporation, Multi-User Win32 Driver)

0xBA680000 Ntfs.sys 577536 bytes (Microsoft Corporation, NT File System Driver)

0xF69D6000 C:\WINDOWS\System32\DRIVERS\mrxsmb.sys 458752 bytes (Microsoft Corporation, Windows NT SMB Minirdr)

0xBA44B000 C:\WINDOWS\System32\DRIVERS\update.sys 385024 bytes (Microsoft Corporation, Update Driver)

0xF6ABB000 C:\WINDOWS\System32\DRIVERS\tcpip.sys 364544 bytes (Microsoft Corporation, TCP/IP Protocol Driver)

0xF442E000 C:\WINDOWS\System32\DRIVERS\srv.sys 356352 bytes (Microsoft Corporation, Server driver)

0xBF012000 C:\WINDOWS\System32\SiSGRV.dll 303104 bytes (Silicon Integrated Systems Corporation, SiS Compatible Super VGA Driver)

0xF3D26000 C:\WINDOWS\System32\Drivers\HTTP.sys 266240 bytes (Microsoft Corporation, HTTP Protocol Stack)

0xBA7B1000 ACPI.sys 188416 bytes (Microsoft Corporation, ACPI Driver for NT)

0xF454D000 C:\WINDOWS\System32\DRIVERS\mrxdav.sys 184320 bytes (Microsoft Corporation, Windows NT WebDav Minirdr)

0xBA653000 NDIS.sys 184320 bytes (Microsoft Corporation, NDIS 5.1 wrapper driver)

0xF6A46000 C:\WINDOWS\System32\DRIVERS\rdbss.sys 176128 bytes (Microsoft Corporation, Redirected Drive Buffering SubSystem Driver)

0xBA4F9000 C:\WINDOWS\system32\drivers\sis7012.sys 167936 bytes (Silicon Integrated Systems Corporation, SiS 7012 Audio Device WDM Driver)

0xF6A93000 C:\WINDOWS\System32\DRIVERS\netbt.sys 163840 bytes (Microsoft Corporation, MBT Transport driver)

0xF69B0000 C:\WINDOWS\System32\DRIVERS\ipnat.sys 155648 bytes (Microsoft Corporation, IP Network Address Translator)

0xBA5B5000 C:\WINDOWS\System32\DRIVERS\sisgrp.sys 155648 bytes (Silicon Integrated Systems Corporation, SiS Compatible Super VGA Driver)

0xF3FFA000 C:\WINDOWS\System32\Drivers\Fastfat.SYS 147456 bytes (Microsoft Corporation, Fast FAT File System Driver)

0xBA569000 C:\WINDOWS\system32\drivers\portcls.sys 147456 bytes (Microsoft Corporation, Port Class (Class Driver for Port/Miniport Devices))

0xBA522000 C:\WINDOWS\System32\DRIVERS\USBPORT.SYS 147456 bytes (Microsoft Corporation, USB 1.1 & 2.0 Port Driver)

0xBA546000 C:\WINDOWS\system32\drivers\ks.sys 143360 bytes (Microsoft Corporation, Kernel CSA Library)

0xF6A71000 C:\WINDOWS\System32\drivers\afd.sys 139264 bytes (Microsoft Corporation, Ancillary Function Driver for WinSock)

0x806EE000 ACPI_HAL 131840 bytes

0x806EE000 C:\WINDOWS\system32\hal.dll 131840 bytes (Microsoft Corporation, Hardware Abstraction Layer DLL)

0xBA749000 fltmgr.sys 131072 bytes (Microsoft Corporation, Microsoft Filesystem Filter Manager)

0xBA781000 ftdisk.sys 126976 bytes (Microsoft Corporation, FT Disk Driver)

0xBA639000 Mup.sys 106496 bytes (Microsoft Corporation, Multiple UNC Provider driver)

0xBA769000 atapi.sys 98304 bytes (Microsoft Corporation, IDE/ATAPI Port Driver)

0xF6998000 C:\WINDOWS\System32\Drivers\dump_atapi.sys 98304 bytes

0xBA720000 KSecDD.sys 94208 bytes (Microsoft Corporation, Kernel Security Support Provider Interface)

0xBA4E2000 C:\WINDOWS\System32\DRIVERS\ndiswan.sys 94208 bytes (Microsoft Corporation, MS PPP Framing Driver (Strong Encryption))

0xF46E2000 C:\WINDOWS\System32\DRIVERS\nwlnkipx.sys 90112 bytes (Microsoft Corporation, NWLINK2 IPX Protocol Driver)

0xF3FE5000 C:\WINDOWS\system32\drivers\wdmaud.sys 86016 bytes (Microsoft Corporation, MMSYSTEM Wave/Midi API mapper)

0xBA58D000 C:\WINDOWS\System32\DRIVERS\parport.sys 81920 bytes (Microsoft Corporation, Parallel Port Driver)

0xBA5A1000 C:\WINDOWS\System32\DRIVERS\VIDEOPRT.SYS 81920 bytes (Microsoft Corporation, Video Port Driver)

0xF6B14000 C:\WINDOWS\System32\DRIVERS\ipsec.sys 77824 bytes (Microsoft Corporation, IPSec Driver)

0xBA70D000 WudfPf.sys 77824 bytes (Microsoft Corporation, Windows Driver Foundation - User-mode Driver Framework Platform Driver)

0xBF000000 C:\WINDOWS\System32\drivers\dxg.sys 73728 bytes (Microsoft Corporation, DirectX Graphics Driver)

0xBA737000 sr.sys 73728 bytes (Microsoft Corporation, System Restore Filesystem Filter Driver)

0xBA7A0000 pci.sys 69632 bytes (Microsoft Corporation, NT Plug and Play PCI Enumerator)

0xBA4D1000 C:\WINDOWS\System32\DRIVERS\psched.sys 69632 bytes (Microsoft Corporation, MS QoS Packet Scheduler)

0xFA04C000 C:\WINDOWS\System32\Drivers\Cdfs.SYS 65536 bytes (Microsoft Corporation, CD-ROM File System Driver)

0xFA10C000 C:\WINDOWS\System32\DRIVERS\cdrom.sys 65536 bytes (Microsoft Corporation, SCSI CD-ROM Driver)

0xF9FAC000 C:\WINDOWS\System32\DRIVERS\nic1394.sys 65536 bytes (Microsoft Corporation, IEEE1394 Ndis Miniport and Call Manager)

0xF6B87000 C:\WINDOWS\System32\DRIVERS\nwlnknb.sys 65536 bytes (Microsoft Corporation, NWLINK2 IPX Netbios Protocol Driver)

0xF9F0C000 ohci1394.sys 65536 bytes (Microsoft Corporation, 1394 OpenHCI Port Driver)

0xFA0CC000 C:\WINDOWS\System32\DRIVERS\serial.sys 65536 bytes (Microsoft Corporation, Serial Device Driver)

0xFA01C000 C:\WINDOWS\System32\DRIVERS\arp1394.sys 61440 bytes (Microsoft Corporation, IP/1394 Arp Client)

0xFA0EC000 C:\WINDOWS\system32\drivers\drmk.sys 61440 bytes (Microsoft Corporation, Microsoft Kernel DRM Descrambler Filter)

0xFA11C000 C:\WINDOWS\System32\DRIVERS\redbook.sys 61440 bytes (Microsoft Corporation, Redbook Audio Filter Driver)

0xF6BC7000 C:\WINDOWS\system32\drivers\sysaudio.sys 61440 bytes (Microsoft Corporation, System Audio WDM Filter)

0xF9CD6000 C:\WINDOWS\System32\DRIVERS\usbhub.sys 61440 bytes (Microsoft Corporation, Default Hub Driver for USB)

0xF9F1C000 C:\WINDOWS\System32\DRIVERS\1394BUS.SYS 57344 bytes (Microsoft Corporation, 1394 Bus Device Driver)

0xF47B0000 C:\WINDOWS\System32\DRIVERS\nwlnkspx.sys 57344 bytes (Microsoft Corporation, NWLINK2 SPX Protocol Driver)

0xF9EEC000 C:\WINDOWS\System32\DRIVERS\CLASSPNP.SYS 53248 bytes (Microsoft Corporation, SCSI Class System Dll)

0xFA0DC000 C:\WINDOWS\System32\DRIVERS\i8042prt.sys 53248 bytes (Microsoft Corporation, i8042 Port Driver)

0xF9F6C000 C:\WINDOWS\System32\DRIVERS\rasl2tp.sys 53248 bytes (Microsoft Corporation, RAS L2TP mini-port/call-manager driver)

0xF9ECC000 VolSnap.sys 53248 bytes (Microsoft Corporation, Volume Shadow Copy Driver)

0xF9F8C000 C:\WINDOWS\System32\DRIVERS\raspptp.sys 49152 bytes (Microsoft Corporation, Peer-to-Peer Tunneling Protocol)

0xF9F2C000 agp440.sys 45056 bytes (Microsoft Corporation, 440 NT AGP Filter)

0xF9F3C000 amdagp.sys 45056 bytes (Advanced Micro Devices, Inc., AMD Win2000 AGP Filter)

0xF9FFC000 C:\WINDOWS\System32\Drivers\Fips.SYS 45056 bytes (Microsoft Corporation, FIPS Crypto Driver)

0xFA0FC000 C:\WINDOWS\System32\Drivers\Imapi.SYS 45056 bytes (Microsoft Corporation, IMAPI Kernel Driver)

0xF9EBC000 MountMgr.sys 45056 bytes (Microsoft Corporation, Mount Manager)

0xF9F7C000 C:\WINDOWS\System32\DRIVERS\raspppoe.sys 45056 bytes (Microsoft Corporation, RAS PPPoE mini-port/call-manager driver)

0xF9EFC000 viaagp.sys 45056 bytes (Microsoft Corporation, VIA NT AGP Filter)

0xF9EAC000 isapnp.sys 40960 bytes (Microsoft Corporation, PNP ISA Bus Driver)

0xF9CF6000 C:\WINDOWS\System32\Drivers\NDProxy.SYS 40960 bytes (Microsoft Corporation, NDIS Proxy)

0xF9FBC000 C:\WINDOWS\System32\DRIVERS\termdd.sys 40960 bytes (Microsoft Corporation, Terminal Server Driver)

0xF9EDC000 disk.sys 36864 bytes (Microsoft Corporation, PnP Disk Driver)

0xF9CB6000 C:\WINDOWS\System32\DRIVERS\HIDCLASS.SYS 36864 bytes (Microsoft Corporation, Hid Class Library)

0xF9F9C000 C:\WINDOWS\System32\DRIVERS\msgpc.sys 36864 bytes (Microsoft Corporation, MS General Packet Classifier)

0xF9CA6000 C:\WINDOWS\System32\DRIVERS\netbios.sys 36864 bytes (Microsoft Corporation, NetBIOS interface driver)

0xF3E0F000 C:\WINDOWS\System32\Drivers\Normandy.SYS 36864 bytes (RKU Driver)

0xFA00C000 C:\WINDOWS\System32\DRIVERS\wanarp.sys 36864 bytes (Microsoft Corporation, MS Remote Access and Routing ARP Driver)

0xFA1D4000 C:\WINDOWS\System32\Drivers\Modem.SYS 32768 bytes (Microsoft Corporation, Modem Device Driver)

0xFA244000 C:\WINDOWS\System32\Drivers\Npfs.SYS 32768 bytes (Microsoft Corporation, NPFS Driver)

0xFA1CC000 C:\WINDOWS\System32\DRIVERS\sisnic.sys 32768 bytes (SiS Corporation, SiS PCI Fast Ethernet Adapter Driver)

0xFA1B4000 C:\WINDOWS\System32\DRIVERS\fdc.sys 28672 bytes (Microsoft Corporation, Floppy Disk Controller Driver)

0xFA224000 C:\WINDOWS\System32\DRIVERS\HIDPARSE.SYS 28672 bytes (Microsoft Corporation, Hid Parsing Library)

0xFA12C000 C:\WINDOWS\System32\DRIVERS\PCIIDEX.SYS 28672 bytes (Microsoft Corporation, PCI IDE Bus Driver Extension)

0xFA13C000 SISAGP.sys 28672 bytes (Silicon Integrated Systems Corporation, SiS NT AGP Filter)

0xFA1BC000 C:\WINDOWS\System32\DRIVERS\kbdclass.sys 24576 bytes (Microsoft Corporation, Keyboard Class Driver)

0xFA1F4000 C:\WINDOWS\System32\DRIVERS\mouclass.sys 24576 bytes (Microsoft Corporation, Mouse Class Driver)

0xFA234000 C:\WINDOWS\System32\drivers\vga.sys 24576 bytes (Microsoft Corporation, VGA/Super VGA Video Driver)

0xFA204000 C:\WINDOWS\System32\DRIVERS\flpydisk.sys 20480 bytes (Microsoft Corporation, Floppy Driver)

0xFA23C000 C:\WINDOWS\System32\Drivers\Msfs.SYS 20480 bytes (Microsoft Corporation, Mailslot driver)

0xFA134000 PartMgr.sys 20480 bytes (Microsoft Corporation, Partition Manager)

0xFA1E4000 C:\WINDOWS\System32\DRIVERS\ptilink.sys 20480 bytes (Parallel Technologies, Inc., Parallel Technologies DirectParallel IO Library)

0xFA1EC000 C:\WINDOWS\System32\DRIVERS\raspti.sys 20480 bytes (Microsoft Corporation, PTI DirectParallel® mini-port/call-manager driver)

0xFA1DC000 C:\WINDOWS\System32\DRIVERS\TDI.SYS 20480 bytes (Microsoft Corporation, TDI Wrapper)

0xFA1C4000 C:\WINDOWS\System32\DRIVERS\usbohci.sys 20480 bytes (Microsoft Corporation, OHCI USB Miniport Driver)

0xFA25C000 C:\WINDOWS\System32\watchdog.sys 20480 bytes (Microsoft Corporation, Watchdog Driver)

0xBA5F7000 C:\WINDOWS\system32\drivers\MODEMCSA.sys 16384 bytes (Microsoft Corporation, Unimodem CSA Filter)

0xFA394000 C:\WINDOWS\System32\DRIVERS\mssmbios.sys 16384 bytes (Microsoft Corporation, System Management BIOS Driver)

0xF47F0000 C:\WINDOWS\System32\DRIVERS\ndisuio.sys 16384 bytes (Microsoft Corporation, NDIS User mode I/O Driver)

0xF3D8B000 C:\WINDOWS\system32\PCANDIS5.SYS 16384 bytes (Printing Communications Assoc., Inc. (PCAUSA), PCAUSA NDIS 5.0 Protocol Driver)

0xFA370000 C:\WINDOWS\System32\DRIVERS\PS2.sys 16384 bytes (Hewlett-Packard Company, PS2 SYS)

0xFA2C0000 PxHelp20.sys 16384 bytes (VERITAS Software, Inc., PxHelper Device Driver for Windows 2000)

0xFA36C000 C:\WINDOWS\System32\DRIVERS\serenum.sys 16384 bytes (Microsoft Corporation, Serial Port Enumerator)

0xFA2BC000 C:\WINDOWS\system32\BOOTVID.dll 12288 bytes (Microsoft Corporation, VGA Boot Driver)

0xBA437000 C:\WINDOWS\System32\drivers\Dxapi.sys 12288 bytes (Microsoft Corporation, DirectX API Driver)

0xFA374000 C:\WINDOWS\System32\DRIVERS\gameenum.sys 12288 bytes (Microsoft Corporation, Game Port Enumerator)

0xFA35C000 C:\WINDOWS\System32\DRIVERS\hidusb.sys 12288 bytes (Microsoft Corporation, USB Miniport Driver for Input Devices)

0xBA4B5000 C:\WINDOWS\System32\DRIVERS\mouhid.sys 12288 bytes (Microsoft Corporation, HID Mouse Filter Driver)

0xFA384000 C:\WINDOWS\System32\DRIVERS\ndistapi.sys 12288 bytes (Microsoft Corporation, NDIS 3.0 connection wrapper driver)

0xFA378000 C:\WINDOWS\system32\drivers\pfc.sys 12288 bytes (Padus, Inc., Padus® ASPI Shell)

0xFA364000 C:\WINDOWS\System32\DRIVERS\rasacd.sys 12288 bytes (Microsoft Corporation, RAS Automatic Connection Driver)

0xFA368000 C:\WINDOWS\System32\drivers\ws2ifsl.sys 12288 bytes (Microsoft Corporation, Winsock2 IFS Layer)

0xFA3F0000 C:\WINDOWS\System32\Drivers\Beep.SYS 8192 bytes (Microsoft Corporation, BEEP Driver)

0xFA3F6000 C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS 8192 bytes

0xFA3EE000 C:\WINDOWS\System32\Drivers\Fs_Rec.SYS 8192 bytes (Microsoft Corporation, File System Recognizer Driver)

0xFA3B2000 intelide.sys 8192 bytes (Microsoft Corporation, Intel PCI IDE Driver)

0xFA3AC000 C:\WINDOWS\system32\KDCOM.DLL 8192 bytes (Microsoft Corporation, Kernel Debugger HW Extension DLL)

0xFA3F2000 C:\WINDOWS\System32\Drivers\mnmdd.SYS 8192 bytes (Microsoft Corporation, Frame buffer simulator)

0xFA462000 C:\WINDOWS\System32\Drivers\ParVdm.SYS 8192 bytes (Microsoft Corporation, VDM Parallel Driver)

0xFA3F4000 C:\WINDOWS\System32\DRIVERS\RDPCDD.sys 8192 bytes (Microsoft Corporation, RDP Miniport)

0xFA3C8000 C:\WINDOWS\System32\DRIVERS\swenum.sys 8192 bytes (Microsoft Corporation, Plug and Play Software Device Enumerator)

0xFA3CC000 C:\WINDOWS\System32\DRIVERS\USBD.SYS 8192 bytes (Microsoft Corporation, Universal Serial Bus Driver)

0xFA3B0000 viaide.sys 8192 bytes (Microsoft Corporation, Generic PCI IDE Bus Driver)

0xFA3AE000 C:\WINDOWS\System32\DRIVERS\WMILIB.SYS 8192 bytes (Microsoft Corporation, WMILIB WMI support library Dll)

0xFA575000 C:\WINDOWS\System32\DRIVERS\audstub.sys 4096 bytes (Microsoft Corporation, AudStub Driver)

0xFA54D000 C:\WINDOWS\System32\drivers\dxgthk.sys 4096 bytes (Microsoft Corporation, DirectX Graphics Driver Thunk)

0xFA56C000 C:\WINDOWS\system32\drivers\msmpu401.sys 4096 bytes (Microsoft Corporation, MPU401 Adapter Driver)

0xFA4C9000 C:\WINDOWS\System32\Drivers\Null.SYS 4096 bytes (Microsoft Corporation, NULL Driver)

0xFA474000 pciide.sys 4096 bytes (Microsoft Corporation, Generic PCI IDE Bus Driver)

==============================================

>Stealth

==============================================

OTL logfile created on: 9/28/2010 10:04:25 AM - Run 1

OTL by OldTimer - Version 3.2.14.1 Folder = C:\Documents and Settings\Ann\Desktop

Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 7.0.5730.13)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

224.00 Mb Total Physical Memory | 45.00 Mb Available Physical Memory | 20.00% Memory free

586.00 Mb Paging File | 373.00 Mb Available in Paging File | 64.00% Paging File free

Paging file location(s): C:\pagefile.sys 336 672 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 32.96 Gb Total Space | 16.94 Gb Free Space | 51.39% Space Free | Partition Type: NTFS

D: Drive not present or media not loaded

E: Drive not present or media not loaded

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

Computer Name: YOUR-W92P4BHLZG

Current User Name: Ann

Logged in as Administrator.

Current Boot Mode: Normal

Scan Mode: All users

Company Name Whitelist: On

Skip Microsoft Files: On

File Age = 90 Days

Output = Standard

Quick Scan

========== Processes (SafeList) ==========

PRC - [2010/09/28 10:03:06 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Ann\Desktop\OTL.exe

PRC - [2008/04/13 20:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe

PRC - [2004/11/09 10:32:44 | 000,393,216 | ---- | M] (Motive Communications, Inc.) -- C:\Program Files\ALLTEL DSL Check-up Center\SmartBridge\MotiveSB.exe

PRC - [2004/03/16 17:49:50 | 000,192,512 | ---- | M] () -- C:\Program Files\ALLTEL DSL Check-up Center\bin\mpbtn.exe

PRC - [2002/01/16 17:28:48 | 000,176,128 | ---- | M] (The Linksys Group, Inc.) -- C:\Program Files\Linksys\WMP11 Config Utility\WMP11Cfg.exe

PRC - [2001/10/03 06:21:34 | 000,155,648 | ---- | M] (WildTangent) -- C:\Program Files\WildTangent\DDC\DDCManager\DDCMan.exe

========== Modules (SafeList) ==========

MOD - [2010/09/28 10:03:06 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Ann\Desktop\OTL.exe

MOD - [2008/04/13 20:10:20 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\SYSTEM32\msscript.ocx

MOD - [2004/03/16 17:45:50 | 000,122,880 | ---- | M] (Motive Communications, Inc.) -- C:\Program Files\ALLTEL DSL Check-up Center\SmartBridge\SBHook.dll

========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] -- C:\WINDOWS\System32\appmgmts.dll -- (AppMgmt)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\FREEDOM.SYS -- (Freedom)

DRV - [2008/04/13 14:56:06 | 000,088,320 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\SYSTEM32\drivers\nwlnkipx.sys -- (NwlnkIpx)

DRV - [2008/04/13 14:45:29 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\drivers\gameenum.sys -- (gameenum)

DRV - [2008/04/13 14:36:39 | 000,043,008 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\amdagp.sys -- (amdagp)

DRV - [2004/12/23 17:52:56 | 001,903,370 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\drivers\IntelS51.sys -- (Intels51) Intel®

DRV - [2002/10/03 18:07:00 | 000,611,840 | ---- | M] (Intersil Americas Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\drivers\islp2nds.sys -- (ISLP2)

DRV - [2001/11/16 02:14:44 | 000,164,864 | ---- | M] (Silicon Integrated Systems Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\drivers\sis7012.sys -- (SiS7012) Service for AC'97 Sample Driver (WDM)

DRV - [2001/11/07 01:02:38 | 000,153,344 | ---- | M] (Silicon Integrated Systems Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\drivers\sisgrp.sys -- (SiS315)

DRV - [2001/10/12 22:44:12 | 000,114,816 | ---- | M] (S3 Graphics, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\drivers\s3gNBm.sys -- (S3SavageNB)

DRV - [2001/09/28 22:52:04 | 000,027,008 | ---- | M] (Silicon Integrated Systems Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\SISAGP.sys -- (SISAGP)

DRV - [2001/09/28 16:16:46 | 000,031,744 | ---- | M] (SiS Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\drivers\sisnic.sys -- (SISNIC)

DRV - [2001/09/28 03:49:00 | 000,702,777 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\drivers\nv4_mini.sys -- (nv)

DRV - [2001/09/16 21:45:04 | 000,013,716 | ---- | M] (Padus, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\drivers\pfc.sys -- (pfc)

DRV - [2001/08/18 01:00:04 | 000,002,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\drivers\msmpu401.sys -- (ms_mpu401)

DRV - [2001/08/17 16:54:20 | 000,063,232 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\SYSTEM32\drivers\nwlnknb.sys -- (NwlnkNb)

DRV - [2001/08/17 16:54:20 | 000,055,936 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\SYSTEM32\drivers\nwlnkspx.sys -- (NwlnkSpx)

DRV - [2001/08/17 15:50:26 | 000,731,648 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\drivers\nv4.sys -- (nv4)

DRV - [2001/08/17 13:57:38 | 000,016,128 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\drivers\MODEMCSA.sys -- (MODEMCSA)

DRV - [2001/08/08 17:13:36 | 000,158,140 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\drivers\i81xnt5.sys -- (i81x)

DRV - [2001/08/08 17:13:30 | 000,012,479 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\drivers\wADV01nt.sys -- (iAimFP0)

DRV - [2001/08/08 17:13:30 | 000,012,031 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\drivers\wADV02NT.sys -- (iAimFP1)

DRV - [2001/08/08 17:13:30 | 000,011,679 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\drivers\wADV05NT.sys -- (iAimFP2)

DRV - [2001/08/08 17:13:28 | 000,019,359 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\drivers\wVchNTxx.sys -- (iAimFP4)

DRV - [2001/08/08 17:13:28 | 000,011,999 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\drivers\wSiINTxx.sys -- (iAimFP3)

DRV - [2001/08/08 17:13:26 | 000,033,503 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\drivers\wATV04nt.sys -- (iAimTV3)

DRV - [2001/08/08 17:13:24 | 000,029,215 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\drivers\wATV01nt.sys -- (iAimTV0)

DRV - [2001/08/08 17:13:24 | 000,023,519 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\drivers\wCh7xxNT.sys -- (iAimTV4)

DRV - [2001/08/08 17:13:24 | 000,019,199 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\drivers\wATV02NT.sys -- (iAimTV1)

DRV - [2001/07/31 20:27:12 | 000,130,332 | ---- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\drivers\trid3dm.sys -- (trid3d)

DRV - [2001/06/04 18:00:00 | 000,014,112 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\drivers\PS2.sys -- (Ps2)

DRV - [2000/10/15 18:38:54 | 000,016,068 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\PCANDIS5.SYS -- (PCANDIS5)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://srch-us4.hpwis.com/

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://srch-us4.hpwis.com/

IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us4.hpwis.com/

IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us4.hpwis.com/

IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://srch-us4.hpwis.com/

IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://us4.hpwis.com/

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us4.hpwis.com/

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us4.hpwis.com/

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://srch-us4.hpwis.com/

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://us4.hpwis.com/

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-1106520001-2322712386-1997616605-1007\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/

IE - HKU\S-1-5-21-1106520001-2322712386-1997616605-1007\..\URLSearchHook: {A26503FE-B3B8-4910-A9DC-9CBD25C6B8D6} - Reg Error: Key error. File not found

IE - HKU\S-1-5-21-1106520001-2322712386-1997616605-1007\..\URLSearchHook: ~CFBFAE00-17A6-11D0-99CB-00C04FD64497} - Reg Error: Key error. File not found

IE - HKU\S-1-5-21-1106520001-2322712386-1997616605-1007\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-1106520001-2322712386-1997616605-1007\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = localhost

O1 HOSTS File: ([2010/02/04 00:05:52 | 000,000,822 | ---- | M]) - C:\WINDOWS\SYSTEM32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1 localhost

O1 - Hosts: ::1 localhost

O2 - BHO: (HP Print Enhancer) - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)

O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx ()

O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - c:\Program Files\Microsoft Money\System\mnyviewer.dll (Microsoft Corporation)

O2 - BHO: (HP Smart BHO Class) - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)

O3 - HKU\S-1-5-21-1106520001-2322712386-1997616605-1007\..\Toolbar\WebBrowser: (no name) - {A26503FE-B3B8-4910-A9DC-9CBD25C6B8D6} - No CLSID value found.

O4 - HKLM..\Run: [DDCActiveMenu] C:\Program Files\WildTangent\DDC\ActiveMenu\DDCActiveMenu.exe (WildTangent)

O4 - HKLM..\Run: [DDCM] C:\Program Files\WildTangent\DDC\DDCManager\DDCMan.exe (WildTangent)

O4 - HKLM..\Run: [hpqSRMon] File not found

O4 - HKLM..\Run: [Motive SmartBridge] C:\Program Files\ALLTEL DSL Check-up Center\SmartBridge\MotiveSB.exe (Motive Communications, Inc.)

O4 - HKLM..\Run: [PS2] C:\WINDOWS\System32\ps2.exe File not found

O4 - HKLM..\Run: [Recguard] C:\WINDOWS\SMINST\Recguard.exe ()

O4 - HKU\.DEFAULT..\Run: [DWQueuedReporting] c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe File not found

O4 - HKU\S-1-5-18..\Run: [DWQueuedReporting] c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe File not found

O4 - HKU\S-1-5-21-1106520001-2322712386-1997616605-1007..\Run: [CyberDefender Registry Cleaner] C:\Program Files\CyberDefender\Registry Cleaner\CDregclean.exe File not found

O4 - HKU\S-1-5-21-1106520001-2322712386-1997616605-1007..\Run: [Microsoft Works Update Detection] c:\Program Files\Microsoft Works\WkDetect.exe File not found

O4 - Startup: C:\Documents and Settings\Administrator.JARRELL\Start Menu\Programs\Startup\AutoPlay.exe ()

O4 - Startup: C:\Documents and Settings\Administrator.YOUR-W92P4BHLZG\Start Menu\Programs\Startup\AutoPlay.exe ()

O4 - Startup: C:\Documents and Settings\Administrator.YOUR-W92P4BHLZG.000\Start Menu\Programs\Startup\AutoPlay.exe ()

O4 - Startup: C:\Documents and Settings\Administrator.YOUR-W92P4BHLZG.001\Start Menu\Programs\Startup\AutoPlay.exe ()

O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ALLTEL DSL Check-up Center.lnk = C:\Program Files\ALLTEL DSL Check-up Center\bin\matcli.exe (Motive Communications, Inc.)

O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation)

O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Wireless PCI Card Configuration Utility.lnk = C:\Program Files\Linksys\WMP11 Config Utility\WMP11Cfg.exe (The Linksys Group, Inc.)

O4 - Startup: C:\Documents and Settings\Default User\Start Menu\Programs\Startup\AutoPlay.exe ()

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-21-1106520001-2322712386-1997616605-1007\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O9 - Extra Button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL (Microsoft Corporation)

O9 - Extra Button: HP Smart Select - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)

O9 - Extra Button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - c:\Program Files\Microsoft Money\System\mnyviewer.dll (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\SYSTEM32\nwprovau.dll (Microsoft Corporation)

O12 - Plugin for: .spop - C:\Program Files\Internet Explorer\PLUGINS\NPDocBox.dll (InterTrust Technologies Corporation, Inc.)

O15 - HKU\S-1-5-21-1106520001-2322712386-1997616605-1007\..Trusted Domains: alltel.com ([care] http in Trusted sites)

O15 - HKU\S-1-5-21-1106520001-2322712386-1997616605-1007\..Trusted Domains: alltel.com ([care] https in Trusted sites)

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool)

O16 - DPF: {321FB770-1FBE-4BFE-BDC1-6F622D4FA499} https://activation.alltel.com/wizlet/ALLTEL...aller_2-0-0.cab (Reg Error: Value error.)

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/microsoftupdat...b?1136830468775 (WUWebControl Class)

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdat...b?1136830367806 (MUWebControl Class)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/pub/shock...ash/swflash.cab (Shockwave Flash Object)

O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.254.254

O18 - Protocol\Handler\mctp {d7b95390-b1c5-11d0-b111-0080c712fe82} - C:\Program Files\Microsoft ActiveSync\AATP.DLL (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)

O24 - Desktop WallPaper: C:\WINDOWS\WEB\Wallpaper\Bliss.bmp

O24 - Desktop BackupWallPaper: C:\WINDOWS\WEB\Wallpaper\Bliss.bmp

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2001/11/07 00:36:00 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *) - File not found

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 90 Days ==========

[2010/09/28 10:03:05 | 000,575,488 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Ann\Desktop\OTL.exe

[2010/09/27 10:24:06 | 000,000,000 | ---D | C] -- C:\WINDOWS\LastGood

[2010/09/25 19:39:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Ann\Application Data\Malwarebytes

[2010/09/25 18:02:25 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys

[2010/09/25 18:02:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes

[2010/09/25 18:02:04 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys

[2010/09/25 18:02:03 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware

[2010/09/25 15:55:33 | 000,000,000 | ---D | C] -- C:\WINDOWS\PreviewSoft

[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 90 Days ==========

[2010/09/28 10:03:06 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Ann\Desktop\OTL.exe

[2010/09/28 10:00:24 | 000,028,176 | ---- | M] () -- C:\Documents and Settings\Ann\Desktop\RKunhookerLE report

[2010/09/28 09:45:34 | 000,133,632 | ---- | M] () -- C:\Documents and Settings\Ann\Desktop\RKUnhookerLE.EXE

[2010/09/27 15:43:40 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat

[2010/09/27 10:23:13 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl

[2010/09/26 22:01:51 | 000,000,247 | ---- | M] () -- C:\WINDOWS\System\hpsysdrv.dat

[2010/09/26 21:55:22 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT

[2010/09/26 21:55:14 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2010/09/26 21:55:13 | 234,459,136 | -HS- | M] () -- C:\hiberfil.sys

[2010/09/26 21:53:54 | 000,000,178 | -HS- | M] () -- C:\Documents and Settings\Ann\ntuser.ini

[2010/09/26 21:53:53 | 002,883,584 | -H-- | M] () -- C:\Documents and Settings\Ann\NTUSER.DAT

[2010/09/26 21:24:42 | 000,005,762 | ---- | M] () -- C:\Documents and Settings\Ann\Desktop\ark.zip

[2010/09/26 18:49:05 | 000,002,335 | ---- | M] () -- C:\Documents and Settings\Ann\Desktop\dds Attach log 2.zip

[2010/09/26 14:15:10 | 000,293,376 | ---- | M] () -- C:\Documents and Settings\Ann\Desktop\brkukggs.exe

[2010/09/26 14:01:53 | 000,525,824 | ---- | M] () -- C:\Documents and Settings\Ann\Desktop\dds.scr

[2010/09/26 13:55:19 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\Ann\defogger_reenable

[2010/09/26 13:54:32 | 000,050,477 | ---- | M] () -- C:\Documents and Settings\Ann\Desktop\Defogger.exe

[2010/09/26 11:10:50 | 000,165,120 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT

[2010/09/26 00:25:22 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK

[2010/09/25 22:54:34 | 000,000,761 | ---- | M] () -- C:\WINDOWS\win.ini

[2010/09/25 18:02:52 | 000,000,707 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk

[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/09/28 10:00:23 | 000,028,176 | ---- | C] () -- C:\Documents and Settings\Ann\Desktop\RKunhookerLE report

[2010/09/28 09:45:34 | 000,133,632 | ---- | C] () -- C:\Documents and Settings\Ann\Desktop\RKUnhookerLE.EXE

[2010/09/27 15:43:40 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat

[2010/09/26 21:24:41 | 000,005,762 | ---- | C] () -- C:\Documents and Settings\Ann\Desktop\ark.zip

[2010/09/26 18:49:04 | 000,002,335 | ---- | C] () -- C:\Documents and Settings\Ann\Desktop\dds Attach log 2.zip

[2010/09/26 14:14:50 | 000,293,376 | ---- | C] () -- C:\Documents and Settings\Ann\Desktop\brkukggs.exe

[2010/09/26 14:00:16 | 000,525,824 | ---- | C] () -- C:\Documents and Settings\Ann\Desktop\dds.scr

[2010/09/26 13:55:19 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Ann\defogger_reenable

[2010/09/26 13:53:39 | 000,050,477 | ---- | C] () -- C:\Documents and Settings\Ann\Desktop\Defogger.exe

[2010/09/25 18:02:52 | 000,000,707 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk

[2009/09/10 11:51:21 | 000,000,062 | ---- | C] () -- C:\WINDOWS\st_affiliate.ini

[2009/07/13 16:11:42 | 000,001,138 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\hpzinstall.log

[2007/03/28 11:21:57 | 000,011,882 | ---- | C] () -- C:\WINDOWS\HPSETUP.INI

[2007/02/11 13:02:06 | 000,003,584 | ---- | C] () -- C:\Documents and Settings\Ann\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2006/09/01 10:07:20 | 000,006,048 | ---- | C] () -- C:\WINDOWS\System32\MCC16.dll

[2006/01/09 10:14:01 | 000,029,528 | ---- | C] () -- C:\Program Files\QUICKENW.QIF

[2006/01/02 17:23:11 | 000,000,539 | ---- | C] () -- C:\WINDOWS\System32\nt68rrtc12.sys

[2006/01/02 15:32:51 | 000,000,238 | ---- | C] () -- C:\WINDOWS\elitemediagroup.ini

[2006/01/02 15:30:11 | 000,000,468 | ---- | C] () -- C:\WINDOWS\tupei.dll

[2006/01/02 15:29:49 | 000,081,977 | ---- | C] () -- C:\WINDOWS\System32\ngsh35.dll

[2006/01/01 18:08:22 | 000,000,000 | ---- | C] () -- C:\WINDOWS\dh.ini

[2005/12/29 18:11:04 | 000,000,000 | ---- | C] () -- C:\WINDOWS\MSINFO32.INI

[2005/12/07 17:36:03 | 000,001,145 | ---- | C] () -- C:\WINDOWS\System32\0ce89cm0.sys

[2005/10/27 09:43:50 | 000,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI

[2004/04/15 07:44:22 | 000,000,048 | ---- | C] () -- C:\WINDOWS\PerWin.ini

[2003/12/28 22:22:43 | 000,000,478 | ---- | C] () -- C:\WINDOWS\ODBC.INI

[2003/01/06 17:12:20 | 000,088,496 | ---- | C] () -- C:\WINDOWS\System32\drivers\CAUSB.SYS

[2002/12/26 11:07:08 | 000,000,329 | ---- | C] () -- C:\WINDOWS\PicView.INI

[2002/12/03 18:26:38 | 000,000,037 | ---- | C] () -- C:\WINDOWS\wwwbatch.ini

[2002/11/30 12:37:41 | 000,008,225 | ---- | C] () -- C:\WINDOWS\Weather.INI

[2002/11/29 12:55:06 | 000,016,540 | R--- | C] () -- C:\WINDOWS\System32\tlcsel17.dll

[2002/11/29 12:55:05 | 000,060,464 | R--- | C] () -- C:\WINDOWS\System32\tlcsel32.dll

[2002/08/18 13:47:03 | 000,000,028 | ---- | C] () -- C:\WINDOWS\ICOA.INI

[2002/08/18 13:38:45 | 000,000,000 | ---- | C] () -- C:\WINDOWS\QFN.ini

[2002/08/18 13:38:45 | 000,000,000 | ---- | C] () -- C:\WINDOWS\QDQICK.ini

[2002/08/18 13:34:13 | 000,000,170 | ---- | C] () -- C:\WINDOWS\INTUIT.INI

[2002/07/21 13:20:57 | 000,001,078 | ---- | C] () -- C:\WINDOWS\intuprof.ini

[2002/07/21 13:20:56 | 000,001,404 | ---- | C] () -- C:\WINDOWS\QUICKEN.INI

[2002/07/14 20:22:24 | 000,000,002 | ---- | C] () -- C:\WINDOWS\sj5s.ini

[2002/07/14 19:44:23 | 000,000,995 | ---- | C] () -- C:\WINDOWS\pixcache.ini

[2002/07/14 19:44:14 | 000,012,259 | ---- | C] () -- C:\WINDOWS\maxlink.ini

[2002/07/14 19:44:00 | 000,026,112 | ---- | C] () -- C:\WINDOWS\System32\PIXTHK32.DLL

[2002/07/14 19:44:00 | 000,012,126 | ---- | C] () -- C:\WINDOWS\System32\PIXPCZ.DLL

[2002/07/14 19:44:00 | 000,011,934 | ---- | C] () -- C:\WINDOWS\System32\PIXPNR.DLL

[2002/07/14 19:44:00 | 000,000,081 | ---- | C] () -- C:\WINDOWS\TB96.INI

[2002/07/14 19:31:32 | 000,000,872 | ---- | C] () -- C:\WINDOWS\wnsetup.ini

[2002/07/14 19:31:05 | 000,002,265 | ---- | C] () -- C:\WINDOWS\ACROREAD.INI

[2002/07/14 19:28:21 | 000,210,944 | ---- | C] () -- C:\WINDOWS\System32\MSVCRT10.DLL

[2002/07/14 19:27:55 | 000,000,032 | ---- | C] () -- C:\WINDOWS\KPCMS.INI

[2001/12/18 00:54:19 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini

[2001/12/05 05:26:46 | 000,000,562 | ---- | C] () -- C:\WINDOWS\System32\Px.ini

[2001/12/04 22:52:35 | 001,642,496 | ---- | C] () -- C:\WINDOWS\System32\mplva6.dll

[2001/12/04 22:52:35 | 001,576,960 | ---- | C] () -- C:\WINDOWS\System32\mplvw7.dll

[2001/12/04 22:52:35 | 001,548,288 | ---- | C] () -- C:\WINDOWS\System32\mplvm6.dll

[2001/12/04 22:52:35 | 001,118,208 | ---- | C] () -- C:\WINDOWS\System32\mplvpx.dll

[2001/12/04 22:52:35 | 000,073,728 | ---- | C] () -- C:\WINDOWS\System32\mplaw7.dll

[2001/12/04 22:52:35 | 000,061,440 | ---- | C] () -- C:\WINDOWS\System32\mplapx.dll

[2001/12/04 22:52:34 | 000,073,728 | ---- | C] () -- C:\WINDOWS\System32\mplaa6.dll

[2001/12/04 22:52:34 | 000,061,440 | ---- | C] () -- C:\WINDOWS\System32\mplam6.dll

[2001/11/07 05:45:01 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\hpREG.DLL

[2001/11/07 05:45:01 | 000,024,576 | ---- | C] () -- C:\WINDOWS\System32\syscontr.dll

[2001/11/07 05:37:54 | 000,009,876 | ---- | C] () -- C:\WINDOWS\System32\usbbc.sys

[2001/11/07 05:21:26 | 000,000,044 | ---- | C] () -- C:\WINDOWS\fantasy2.ini

[2001/11/07 05:21:26 | 000,000,011 | ---- | C] () -- C:\WINDOWS\album.ini

[2001/11/07 05:21:26 | 000,000,008 | ---- | C] () -- C:\WINDOWS\pstudio.ini

[2001/11/07 04:49:47 | 000,016,896 | ---- | C] () -- C:\WINDOWS\System32\bcbmm.dll

[2001/11/07 00:40:54 | 000,000,800 | ---- | C] () -- C:\WINDOWS\orun32.ini

[2001/11/07 00:31:15 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini

[2001/11/06 16:21:55 | 000,000,649 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini

[2001/08/08 17:13:22 | 000,012,351 | ---- | C] () -- C:\WINDOWS\System32\i81xcoin.dll

[2001/08/08 04:07:02 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\igfxdgps.dll

[2001/05/23 04:37:50 | 000,425,984 | ---- | C] () -- C:\WINDOWS\System32\VxDMDcDlg.dll

[2000/12/29 20:34:01 | 000,019,968 | ---- | C] () -- C:\WINDOWS\System32\cpuinf32.dll

========== LOP Check ==========

[2002/06/08 14:02:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator.JARRELL\Application Data\InterTrust

[2006/01/01 19:23:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator.YOUR-W92P4BHLZG\Application Data\InterTrust

[2006/01/01 19:23:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator.YOUR-W92P4BHLZG\Application Data\Template

[2006/01/01 19:23:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator.YOUR-W92P4BHLZG\Application Data\VERITAS

[2002/06/08 14:02:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator.YOUR-W92P4BHLZG.000\Application Data\InterTrust

[2002/07/09 21:06:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator.YOUR-W92P4BHLZG.000\Application Data\Template

[2002/07/27 13:18:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator.YOUR-W92P4BHLZG.000\Application Data\VERITAS

[2002/06/08 14:02:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator.YOUR-W92P4BHLZG.001\Application Data\InterTrust

[2002/07/09 21:06:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator.YOUR-W92P4BHLZG.001\Application Data\Template

[2002/07/27 13:18:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator.YOUR-W92P4BHLZG.001\Application Data\VERITAS

[2006/11/10 19:01:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\CarMD.com Corp

[2002/06/08 14:02:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ann\Application Data\InterTrust

[2002/07/09 21:06:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ann\Application Data\Template

[2002/07/27 13:18:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ann\Application Data\VERITAS

[2002/06/08 14:02:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Default User\Application Data\InterTrust

[2002/07/09 21:06:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Default User\Application Data\Template

[2002/07/27 13:18:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Default User\Application Data\VERITAS

[2004/06/13 22:15:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Freedom

[2002/06/08 14:02:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\InterTrust

[2003/12/28 22:41:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\InterVideo

[2009/01/22 16:11:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Sammsoft

[2002/07/09 21:06:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Template

[2002/07/27 13:18:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\VERITAS

[2006/01/09 16:03:51 | 000,000,258 | ---- | M] () -- C:\WINDOWS\Tasks\Registration reminder 3.job

========== Purity Check ==========

< End of report >

OTL Extras logfile created on: 9/28/2010 10:04:25 AM - Run 1

OTL by OldTimer - Version 3.2.14.1 Folder = C:\Documents and Settings\Ann\Desktop

Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 7.0.5730.13)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

224.00 Mb Total Physical Memory | 45.00 Mb Available Physical Memory | 20.00% Memory free

586.00 Mb Paging File | 373.00 Mb Available in Paging File | 64.00% Paging File free

Paging file location(s): C:\pagefile.sys 336 672 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 32.96 Gb Total Space | 16.94 Gb Free Space | 51.39% Space Free | Partition Type: NTFS

D: Drive not present or media not loaded

E: Drive not present or media not loaded

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

Computer Name: YOUR-W92P4BHLZG

Current User Name: Ann

Logged in as Administrator.

Current Boot Mode: Normal

Scan Mode: All users

Company Name Whitelist: On

Skip Microsoft Files: On

File Age = 90 Days

Output = Standard

Quick Scan

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

exefile [open] -- "%1" %*

htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office10\msohtmed.exe" %1 (Microsoft Corporation)

htmlfile [print] -- "C:\Program Files\Microsoft Office\Office10\msohtmed.exe" /p %1 (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)

Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"AntiVirusDisableNotify" = 0

"FirewallDisableNotify" = 0

"UpdatesDisableNotify" = 0

"AntiVirusOverride" = 0

"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]

"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]

"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]

"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]

"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004

"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005

"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001

"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"EnableFirewall" = 1

"DoNotAllowExceptions" = 0

"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007

"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008

"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004

"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005

"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001

"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

"C:\WINDOWS\SYSTEM32\fxsclnt.exe" = C:\WINDOWS\SYSTEM32\fxsclnt.exe:*:Enabled:Microsoft Fax Console -- (Microsoft Corporation)

"C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE" = C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE:*:Enabled:Connection Manager -- (Microsoft Corporation)

"C:\Program Files\Microsoft ActiveSync\WCESMGR.EXE" = C:\Program Files\Microsoft ActiveSync\WCESMGR.EXE:*:Enabled:ActiveSync Application -- (Microsoft Corporation)

"C:\Program Files\hp center\137903\Program\BackWeb-137903.exe" = C:\Program Files\hp center\137903\Program\BackWeb-137903.exe:*:Enabled:BackWeb-137903 -- File not found

"C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe" = C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe -- (Hewlett-Packard Co.)

"C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe" = C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe -- (Hewlett-Packard Co.)

"C:\Program Files\HP\Digital Imaging\bin\hposid01.exe" = C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe -- (Hewlett-Packard Co.)

"C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe" = C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe -- (Hewlett-Packard Co.)

"C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe" = C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe -- (Hewlett-Packard Co.)

"C:\Documents and Settings\Owner\Local Settings\Temp\7zS18.tmp\SymNRT.exe" = C:\Documents and Settings\Owner\Local Settings\Temp\7zS18.tmp\SymNRT.exe:*:Enabled:Norton Removal Tool -- File not found

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{0F7C2E47-089E-4d23-B9F7-39BE00100776}" = Toolbox

"{11B83AD3-7A46-4C2E-A568-9505981D4C6F}" = HP Update

"{18669FF9-C8FE-407a-9F70-E674896B1DB4}" = GPBaseService

"{195F2C6C-A343-4b10-B1A4-3F00AB9E9DD9}" = Fax

"{1FADC8AB-5575-4D87-8870-EE527D86163F}" = Wireless PCI Card Configuration Utility

"{279D3818-7287-4ab4-A927-542EBEA9E365}" = ProductContext

"{2B5DDB2C-0807-47FD-9C11-80EA761902C0}" = Easy Internet Sign-up

"{34BFB099-07B2-4E95-A673-7362D60866A2}" = PSSWCORE

"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP

"{36FDBE6E-6684-462b-AE98-9A39A1B200CC}" = HPProductAssistant

"{380CC749-8C28-4C74-BE01-45921D062302}" = BPDSoftware_Ini

"{41853D20-40CC-4266-978D-F128BB97CA96}" = 6400_Help

"{5109C064-813E-4e87-B0DE-C8AF7B5BC02B}" = SmartWebPrintingOC

"{52A69E11-7CEB-4a7d-9607-68BA4F39A89B}" = DeviceDiscovery

"{5ACE69F0-A3E8-44eb-88C1-0A841E700180}" = TrayApp

"{5BB4D7C1-52F2-4BFD-9E40-0D419E2E3021}" = bpd_scan

"{5D934326-165A-413b-B056-26BE1EC082AF}" = J6400

"{5E835305-63BB-4E55-BBB7-EEBBE67774DB}" = MyDVD

"{63569CE9-FA00-469C-AF5C-E5D4D93ACF91}" = Windows Genuine Advantage v1.3.0254.0

"{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder

"{679EC478-3FF9-4987-B2FF-C2C2B27532A2}" = DocProc

"{687FEF8A-8597-40b4-832C-297EA3F35817}" = BufferChm

"{7DCF7BBA-39A9-4e27-9154-F57BCED90CBF}" = HP Officejet J6400 Series

"{8214CC02-6271-4DC8-B8DD-779933450264}" = HP RecordNow

"{85C8D391-0EAE-4492-8A0A-2EE8B0B6DA03}" = BPDSoftware

"{87E2B986-07E8-477a-93DC-AF0B6758B192}" = DocProcQFolder

"{8A85DEAD-7C1F-4368-881C-72AC74CB2E91}" = UnloadSupport

"{911A0409-6000-11D3-8CFE-0050048383C9}" = Microsoft Outlook 2002

"{A0B9F8DF-C949-45ed-9808-7DC5C0C19C81}" = Status

"{A11409F1-CD33-4076-85CB-4EE4A8439BFE}" = Scan

"{A1B7B9B3-E1D2-41CA-9B4A-F18DC2710704}" = Microsoft Works 6.0

"{A5AB9D5E-52E2-440e-A3ED-9512E253C81A}" = SolutionCenter

"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder

"{BAD0FA60-09CF-4411-AE6A-C2844C8812FA}" = HP Photosmart Essential 2.5

"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1

"{CCB9B81A-167F-4832-B305-D2A0430840B3}" = WebReg

"{CF5193F7-6B37-11D5-B7D2-00AA00A204F1}" = Microsoft Money 2002 System Pack

"{D99A8E3A-AE5A-4692-8B19-6F16D454E240}" = Destination Component

"{DC19E750-988B-4005-A355-85EF66055EFE}" = Works Suite OS Pack

"{E08DC77E-D09A-4e36-8067-D6DBBCC5F8DC}" = VideoToolkit01

"{E7298FD5-1386-11D5-8D6C-0050DAD32D95}" = Microsoft Money 2002

"{F1E63043-54FC-429B-AB2C-31AF9FBA4BC7}" = 32 Bit HP CIO Components Installer

"Adobe Acrobat 5.0" = Adobe Acrobat 5.0

"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX

"Adobe Shockwave Player" = Adobe Shockwave Player

"ALLTEL.MCCInstall" = Windstream Broadband Check-up Center

"HP Imaging Device Functions" = HP Imaging Device Functions 10.0

"HP Instant Support" = HP Instant Support

"HP Photosmart Essential" = HP Photosmart Essential 2.5

"HP Smart Web Printing" = HP Smart Web Printing

"HP Solution Center & Imaging Support Tools" = HP Solution Center 10.0

"HPOCR" = OCR Software by I.R.I.S. 10.0

"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs

"ie7" = Windows Internet Explorer 7

"Intel® 536EP Modem" = Intel® 536EP Modem

"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware

"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1

"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP

"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs

"NVIDIA" = NVIDIA Windows 2000/XP Display Drivers

"Quicken Financial Center" = Quicken Financial Center

"SiS7012" = SiS Audio Driver

"SiSLan" = SiS 900 PCI Fast Ethernet Adapter Driver

"WildTangentDDC" = WildTangent Channel Manager

"Windows CE Services" = Microsoft ActiveSync 3.7

"Windows Media Format Runtime" = Windows Media Format 11 runtime

"Windows Media Player" = Windows Media Player 11

"Windows XP Service Pack" = Windows XP Service Pack 3

"WMFDist11" = Windows Media Format 11 runtime

"wmp11" = Windows Media Player 11

"Works2002Setup" = Microsoft Works and Money 2002 Setup Launcher

"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

========== Last 10 Event Log Errors ==========

[ Application Events ]

Error - 4/9/2007 12:05:21 PM | Computer Name = YOUR-W92P4BHLZG | Source = Application Error | ID = 1001

Description = Fault bucket 00848172.

Error - 6/25/2007 6:51:49 PM | Computer Name = YOUR-W92P4BHLZG | Source = Microsoft Fax | ID = 32092

Description = The Fax service failed to receive a fax. From: . CallerId: . To: Fax.

Pages:

0. Device Name: Intel® 536EP Modem.

Error - 6/25/2007 6:53:57 PM | Computer Name = YOUR-W92P4BHLZG | Source = Microsoft Fax | ID = 32092

Description = The Fax service failed to receive a fax. From: . CallerId: . To: Fax.

Pages:

0. Device Name: Intel® 536EP Modem.

Error - 7/18/2007 2:09:52 PM | Computer Name = YOUR-W92P4BHLZG | Source = Application Hang | ID = 1002

Description = Hanging application iexplore.exe, version 6.0.2900.2180, hang module

hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 7/20/2007 5:36:50 PM | Computer Name = YOUR-W92P4BHLZG | Source = Application Hang | ID = 1002

Description = Hanging application iexplore.exe, version 6.0.2900.2180, hang module

hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 7/20/2007 5:36:51 PM | Computer Name = YOUR-W92P4BHLZG | Source = Application Hang | ID = 1002

Description = Hanging application iexplore.exe, version 6.0.2900.2180, hang module

hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 8/15/2007 10:48:11 AM | Computer Name = YOUR-W92P4BHLZG | Source = EventSystem | ID = 4609

Description = The COM+ Event System detected a bad return code during its internal

processing. HRESULT was 8007041F from line 44 of d:\qxp_slp\com\com1x\src\events\tier1\eventsystemobj.cpp.

Please contact Microsoft Product Support Services to report this erro

Error - 8/15/2007 10:48:11 AM | Computer Name = YOUR-W92P4BHLZG | Source = VSS | ID = 8193

Description = Volume Shadow Copy Service error: Unexpected error calling routine

CoCreateInstance. hr = 0x80040206.

Error - 8/17/2007 1:46:32 PM | Computer Name = YOUR-W92P4BHLZG | Source = Application Hang | ID = 1002

Description = Hanging application iexplore.exe, version 6.0.2900.2180, hang module

hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 8/19/2007 4:10:14 PM | Computer Name = YOUR-W92P4BHLZG | Source = Application Hang | ID = 1002

Description = Hanging application iexplore.exe, version 6.0.2900.2180, hang module

hungapp, version 0.0.0.0, hang address 0x00000000.

[ System Events ]

Error - 9/26/2010 9:49:45 PM | Computer Name = YOUR-W92P4BHLZG | Source = Service Control Manager | ID = 7023

Description = The Network Connections service terminated with the following error:

%%1114

Error - 9/26/2010 9:50:14 PM | Computer Name = YOUR-W92P4BHLZG | Source = DCOM | ID = 10010

Description = The server {BA126AD8-2166-11D1-B1D0-00805FC1270E} did not register

with DCOM within the required timeout.

Error - 9/26/2010 9:50:23 PM | Computer Name = YOUR-W92P4BHLZG | Source = Service Control Manager | ID = 7023

Description = The Network Connections service terminated with the following error:

%%1114

Error - 9/26/2010 9:50:52 PM | Computer Name = YOUR-W92P4BHLZG | Source = DCOM | ID = 10010

Description = The server {BA126ADB-2166-11D1-B1D0-00805FC1270E} did not register

with DCOM within the required timeout.

Error - 9/26/2010 9:50:53 PM | Computer Name = YOUR-W92P4BHLZG | Source = Service Control Manager | ID = 7023

Description = The Network Connections service terminated with the following error:

%%1114

Error - 9/26/2010 9:51:22 PM | Computer Name = YOUR-W92P4BHLZG | Source = DCOM | ID = 10010

Description = The server {BA126ADB-2166-11D1-B1D0-00805FC1270E} did not register

with DCOM within the required timeout.

Error - 9/26/2010 9:51:23 PM | Computer Name = YOUR-W92P4BHLZG | Source = Service Control Manager | ID = 7023

Description = The Network Connections service terminated with the following error:

%%1114

Error - 9/26/2010 9:51:52 PM | Computer Name = YOUR-W92P4BHLZG | Source = DCOM | ID = 10010

Description = The server {BA126AD8-2166-11D1-B1D0-00805FC1270E} did not register

with DCOM within the required timeout.

Error - 9/26/2010 9:57:34 PM | Computer Name = YOUR-W92P4BHLZG | Source = Service Control Manager | ID = 7022

Description = The HP CUE DeviceDiscovery Service service hung on starting.

Error - 9/27/2010 10:37:33 AM | Computer Name = YOUR-W92P4BHLZG | Source = Windows Update Agent | ID = 20

Description = Installation Failure: Windows failed to install the following update

with error 0x80070643: Microsoft Security Essentials Client update package - KB2254596.

< End of report >

Link to post
Share on other sites
Elise

Elise

Posted
Posted

First of all, you have a small amount of RAM installed, For XP to run acceptable, you need at least 512 MB and even better is 1 GB.

COMBOFIX

---------------

Please download ComboFix from one of these locations:

Bleepingcomputer
ForoSpyware

  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. (Click on this link to see a list of programs that should be disabled. The list is not all inclusive.)
  • Double click on Combofix.exe and follow the prompts.
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, or if you are running Vista, ComboFix will continue it's malware removal procedures.

Query_RC.gif

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

RC_successful.gif

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Link to post
Share on other sites
surfeit

surfeit

Posted
  • Author
Posted

I've heard that before about this machine, but did'nt know the specifics. This PC came from the store like this, so I guess it was doomed from the start. Is there anything I could take off that would help? Or is it a matter of

ComboFix 10-09-27.05 - Ann 09/28/2010 19:17:27.1.1 - x86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.224.97 [GMT -4:00]

Running from: c:\documents and settings\Ann\Desktop\ComboFix.exe

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\Administrator.JARRELL\Start Menu\Programs\Startup\AutoPlay.exe

c:\documents and settings\Default User\Start Menu\Programs\Startup\AutoPlay.exe

c:\program files\Common Files\download

c:\program files\Common Files\rmkk

c:\program files\Common Files\rmkk\rmkka.lck

c:\program files\Common Files\rmkk\rmkkd\class-barrel

c:\program files\Common Files\rmkk\rmkkd\vocabulary

c:\program files\Common Files\rmkk\rmkkh

c:\program files\Common Files\rmkk\rmkkl.lck

c:\program files\Common Files\rmkk\rmkkm.lck

c:\program files\Common Files\rmkk\rmkkp.lck

c:\program files\Common Files\vcclient

c:\program files\Common Files\vcclient\ClientUpdater.bat

c:\program files\Common Files\vcclient\ICSharpCode.SharpZipLib.dll

c:\program files\Common Files\vcclient\temp.txt

c:\program files\Common Files\vcclient\VCClient.exe.config

c:\program files\Common Files\vcclient\VCUpdate.exe.config

c:\program files\Common Files\vcclient\Version.txt

c:\program files\Common Files\windows

c:\program files\Common Files\windows\psapi.dll

c:\windows\Debug\dcpromo.log

c:\windows\dh.ini

c:\windows\eliteunstall.exe

c:\windows\exefld

c:\windows\system\oeminfo.ini

c:\windows\system32\ban_list.txt

c:\windows\system32\nt68rrtc12.sys

c:\windows\tempf.txt

.

((((((((((((((((((((((((( Files Created from 2010-08-28 to 2010-09-28 )))))))))))))))))))))))))))))))

.

2010-09-27 19:43 . 2010-09-27 19:43 664 ----a-w- c:\windows\system32\d3d9caps.dat

2010-09-27 14:24 . 2010-09-27 14:24 -------- d-----w- c:\windows\LastGood

2010-09-26 03:12 . 2010-09-26 03:12 41992 ----a-w- c:\documents and settings\NetworkService\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2010-09-25 23:39 . 2010-09-25 23:39 -------- d-----w- c:\documents and settings\Ann\Application Data\Malwarebytes

2010-09-25 22:03 . 2010-09-25 22:03 -------- d-----w- c:\documents and settings\Owner\Application Data\Malwarebytes

2010-09-25 22:02 . 2010-04-29 19:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-09-25 22:02 . 2010-09-25 22:02 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2010-09-25 22:02 . 2010-04-29 19:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-09-25 22:02 . 2010-09-25 22:03 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-09-25 19:55 . 2010-09-25 19:55 -------- d-----w- c:\windows\PreviewSoft

2010-09-25 18:01 . 2010-06-14 14:31 744448 ------w- c:\windows\system32\dllcache\helpsvc.exe

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-09-28 01:12 . 2009-07-13 20:41 -------- d-----w- c:\documents and settings\Ann\Application Data\HPAppData

2010-09-27 14:36 . 2010-02-03 22:33 -------- d-----w- c:\program files\Microsoft Security Essentials

2010-09-26 22:57 . 2007-02-11 16:59 -------- d-----w- c:\documents and settings\Ann\Application Data\MSN6

2010-09-26 15:17 . 2009-10-09 16:13 -------- d-----w- c:\documents and settings\Owner\Application Data\HPAppData

2010-09-25 20:55 . 2010-09-25 20:54 2826192 ----a-w- c:\documents and settings\Ann\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe

2010-08-17 13:17 . 2002-06-08 18:17 58880 ----a-w- c:\windows\system32\spoolsv.exe

2010-07-22 15:49 . 2006-01-24 14:19 590848 ----a-w- c:\windows\system32\rpcrt4.dll

2010-07-22 05:57 . 2009-06-09 16:03 5120 ----a-w- c:\windows\system32\xpsp4res.dll

2006-01-09 14:14 . 2006-01-09 14:14 29528 ----a-w- c:\program files\QUICKENW.QIF

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"="NvQTwk" [X]

"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-08 52736]

"DDCM"="c:\program files\WildTangent\DDC\DDCManager\DDCMan.exe" [2001-10-03 155648]

"DDCActiveMenu"="c:\program files\WildTangent\DDC\ActiveMenu\DDCActiveMenu.exe" [2001-10-03 94208]

"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2001-06-16 212992]

"IgfxTray"="c:\windows\System32\igfxtray.exe" [2001-08-08 143360]

"HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2001-08-08 90112]

"Motive SmartBridge"="c:\progra~1\ALLTEL~1\SMARTB~1\MotiveSB.exe" [2004-11-09 393216]

"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-10-15 49152]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

ALLTEL DSL Check-up Center.lnk - c:\program files\ALLTEL DSL Check-up Center\bin\matcli.exe [2006-9-1 217088]

HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-10-14 214360]

Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

Wireless PCI Card Configuration Utility.lnk - c:\program files\Linksys\WMP11 Config Utility\WMP11Cfg.exe [2002-12-1 176128]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\WINDOWS\\SYSTEM32\\fxsclnt.exe"=

"c:\\Program Files\\Microsoft ActiveSync\\WCESCOMM.EXE"=

"c:\\Program Files\\Microsoft ActiveSync\\WCESMGR.EXE"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R3 SiS7012;Service for AC'97 Sample Driver (WDM);c:\windows\SYSTEM32\drivers\sis7012.sys [11/16/2001 2:14 AM 164864]

S3 ISLP2;Intersil 802.11 Wireless LAN Driver;c:\windows\SYSTEM32\drivers\islp2nds.sys [10/3/2002 6:07 PM 611840]

S3 trid3d;trid3d;c:\windows\SYSTEM32\drivers\trid3dm.sys [7/31/2001 8:27 PM 130332]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - NORMANDY

*Deregistered* - Normandy

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

.

Contents of the 'Scheduled Tasks' folder

2006-01-09 c:\windows\Tasks\Registration reminder 3.job

- c:\windows\System32\OOBE\oobebaln.exe [2002-06-08 00:12]

.

.

------- Supplementary Scan -------

.

mSearch Bar = hxxp://srch-us4.hpwis.com/

uInternet Settings,ProxyOverride = localhost

Trusted Zone: alltel.com\care

DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab

.

- - - - ORPHANS REMOVED - - - -

URLSearchHooks-~CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)

URLSearchHooks-{A26503FE-B3B8-4910-A9DC-9CBD25C6B8D6} - (no file)

WebBrowser-{A26503FE-B3B8-4910-A9DC-9CBD25C6B8D6} - (no file)

HKCU-Run-CyberDefender Registry Cleaner - c:\program files\CyberDefender\Registry Cleaner\CDregclean.exe

HKCU-Run-Microsoft Works Update Detection - c:\program files\Microsoft Works\WkDetect.exe

HKLM-Run-PS2 - c:\windows\system32\ps2.exe

HKLM-Run-hpqSRMon - (no file)

HKU-Default-Run-DWQueuedReporting - c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe

AddRemove-SiS7012 - c:\progra~1\SiS7012\Uninst\uninst2k.exe PCI\VEN_1039&DEV_7012

AddRemove-Works2002Setup - c:\program files\Microsoft Works and Money 2002\Setup\Launcher.exe \hp\tmp\src\

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-09-28 19:36

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

Completion time: 2010-09-28 19:46:38

ComboFix-quarantined-files.txt 2010-09-28 23:46

Pre-Run: 17,903,316,992 bytes free

Post-Run: 18,541,772,800 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe

[boot loader]

default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

UnsupportedDebug="do not select this" /debug

multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows Whistler Personal" /fastdetect /NoExecute=OptIn

- - End Of File - - 9AF467D5C2A969F4E328DD942FF10C16

Link to post
Share on other sites
Elise

Elise

Posted
Posted

Hi, we can try to speed up things as much as possible. If this is a desktop, you could think about buying some extra RAM (which is quite cheap these days). If it is a laptop, it is a bit more complicated though.

INSTALL ANTIVIRUS

---------------------------

I don't see an Anti Virus Program running on your machine

Download and install an antivirus program, and make sure that you keep it updated

New viruses come out every minute, so it is essential that you have the latest signatures for your antivirus program to provide you with the best possible protection from malicious software.

Three good antivirus programs free for non-commercial home use are Avast!, Antivir and Microsoft Security Essentials

Note: You should only have one antivirus installed at a time. Having more than one antivirus program installed at once is likely to cause conflicts and may well decrease your overall protection as well as impairing the performance of your PC.

MALWAREBYTES ANTIMALWARE

-------------------------------------------

Please launch MBAM and update the program before performing a scan.

  • If an update is found, the program will automatically update itself. Press the OK button to close that box and continue.
  • If you encounter any problems while downloading the definition updates, manually download them from here and just double-click on mbam-rules.exe to install.

On the Scanner tab:

  • Make sure the "Perform Full Scan" option is selected.
  • Then click on the Scan button.
  • If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  • The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  • When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  • Click OK to close the message box and continue with the removal process.

Back at the main Scanner screen:

  • Click on the Show Results button to see a list of any malware that was found.
  • Make sure that everything is checked, and click Remove Selected.
  • When removal is completed, a log report will open in Notepad.
  • The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  • Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.
  • Exit MBAM when done.

Note: If MBAM encounters a file that is difficult to remove, you will be asked to reboot your computer so MBAM can proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware.

Finally, we can disable some startup items with Startup Lite to speed things up a bit.

Link to post
Share on other sites
surfeit

surfeit

Posted
  • Author
Posted

Ok, I did download MS Essentials eventhough I did have this on the computer before we started.

I guess one of the scans must have removed it.

I also ran the Startup Lite.

The computer is much easier to live with now. Not ideal, but I understand the RAM issue has something to do with that. ( it used to really drag down at startup but no longer takes a century to come up...)

The only other thing I can see is the HP Solution Center that keeps trying to run without being prompted and ques for a CD to run. I may remove that if the scanner can operate w/o it.

Thanks so much for your help. If there's anything else I can do just let me know, other wise I want to thank you for your help. The process was very easy to follow and this computer will no longer be a dust collector.

Link to post
Share on other sites
Elise

Elise

Posted
Posted

Hi, best thing to do would be to open the HP solution Center and disable it from autostarting when windows start.

Did MBAM find anything?

Lets do one last scan before calling it clean. :welcome:

ESET ONLINE SCANNER

----------------------------

I'd like us to scan your machine with ESET OnlineScan

  1. Hold down Control and click on the following link to open ESET OnlineScan in a new window.
    ESET OnlineScan
  2. Click the esetOnline.png button.
  3. For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)

    2. Click on esetSmartInstall.png to download the ESET Smart Installer. Save it to your desktop.
    3. Double click on the esetSmartInstallDesktopIcon.png icon on your desktop.

    4. Check esetAcceptTerms.png
    5. Click the esetStart.png button.
    6. Accept any security warnings from your browser.
    7. Check esetScanArchives.png
    8. Push the Start button.
    9. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
    10. When the scan completes, push esetListThreats.png
    11. Push esetExport.png, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
      Note - when ESET doesn't find any threats, no report will be created.
    12. Push the esetBack.png button.
    13. Push esetFinish.png

Link to post
Share on other sites
surfeit

surfeit

Posted
  • Author
Posted

MBAM was clean- nothing found

ESET on the other hand...... all but one was quarantined it looks like.

C:\Documents and Settings\Administrator.YOUR-W92P4BHLZG\Start Menu\Programs\Startup\AutoPlay.exe Win32/Agent.NVP trojan cleaned by deleting - quarantined

C:\Documents and Settings\Administrator.YOUR-W92P4BHLZG.000\Start Menu\Programs\Startup\AutoPlay.exe Win32/Agent.NVP trojan cleaned by deleting - quarantined

C:\Documents and Settings\Administrator.YOUR-W92P4BHLZG.001\Start Menu\Programs\Startup\AutoPlay.exe Win32/Agent.NVP trojan cleaned by deleting - quarantined

C:\Documents and Settings\Owner\Local Settings\Application Data\Identities\{5692575C-2549-44B4-816F-D2676C27C45B}\Microsoft\Outlook Express\Deleted Items.dbx HTML/Phishing.gen trojan unable to clean

C:\hp\bin\AUTOPLAY.EXE Win32/Agent.NVP trojan cleaned by deleting - quarantined

C:\Qoobox\Quarantine\C\Documents and Settings\Administrator.JARRELL\Start Menu\Programs\Startup\AutoPlay.exe.vir Win32/Agent.NVP trojan cleaned by deleting - quarantined

C:\Qoobox\Quarantine\C\Documents and Settings\Default User\Start Menu\Programs\Startup\AutoPlay.exe.vir Win32/Agent.NVP trojan cleaned by deleting - quarantined

C:\Qoobox\Quarantine\C\Program Files\Common Files\rmkk\rmkkd\vocabulary.vir Win32/TrojanDownloader.TSUpdate.J trojan cleaned by deleting - quarantined

C:\System Volume Information\_restore{0A438C3B-A487-4C6D-850C-C76CC3327FD0}\RP257\A0103072.exe Win32/Agent.NVP trojan cleaned by deleting - quarantined

C:\System Volume Information\_restore{0A438C3B-A487-4C6D-850C-C76CC3327FD0}\RP257\A0103073.exe Win32/Agent.NVP trojan cleaned by deleting - quarantined

C:\System Volume Information\_restore{0A438C3B-A487-4C6D-850C-C76CC3327FD0}\RP262\A0103227.exe Win32/Agent.NVP trojan cleaned by deleting - quarantined

C:\System Volume Information\_restore{0A438C3B-A487-4C6D-850C-C76CC3327FD0}\RP262\A0103228.exe Win32/Agent.NVP trojan cleaned by deleting - quarantined

C:\System Volume Information\_restore{0A438C3B-A487-4C6D-850C-C76CC3327FD0}\RP262\A0103229.exe Win32/Agent.NVP trojan cleaned by deleting - quarantined

C:\System Volume Information\_restore{0A438C3B-A487-4C6D-850C-C76CC3327FD0}\RP262\A0103230.EXE Win32/Agent.NVP trojan cleaned by deleting - quarantined

C:\WINDOWS\Downloaded Program Files\elite.inf INF/Downloader.RK trojan cleaned by deleting - quarantined

C:\WINDOWS\SYSTEM\sngsh35.dll a variant of Win32/Adware.AdBlaster application cleaned by deleting - quarantined

C:\WINDOWS\SYSTEM32\ngsh35.dll a variant of Win32/Adware.AdBlaster application cleaned by deleting - quarantined

C:\WINDOWS\SYSTEM32\config\systemprofile\Start Menu\Programs\Startup\AutoPlay.exe Win32/Agent.NVP trojan cleaned by deleting - quarantined

Link to post
Share on other sites
Elise

Elise

Posted
Posted

That is not so bad as it looks. :welcome:

Infected Outlook Express

The online scan log indicates that there are infected emails in the Deleted Items folder in Outlook Express.

Please delete the emails in your Inbox folder - keep only the emails that are of extreme importance. After you finish deleting the emails, please right click on the Deleted Items folder and click Empty 'Deleted Items' Folder.

Having removed all your unwanted Emails completely it is now wise to Compact all your remaining Emails. Compacting makes the size of the folders smaller by compacting the files contained within them. All the Emails are still readable and still intact just smaller.

To do this click from the top toolbar File / Folder / Compact All Folders

ALL CLEAN

--------------

Your machine appears to be clean, please take the time to read below on how to secure the machine and take the necessary steps to keep it clean :lol:

Please do the following to remove the remaining programs from your PC:

  • Delete the tools used during the disinfection:
    • Click start > run and type combofix /uninstall, press enter. This will remove Combofix from your computer.
    • Delete DDS, Rootkit Unhooker, GMER (this is a random named file) and OTL.

Please read these advices, in order to prevent reinfecting your PC:

  1. Install and update the following programs regularly:
    • an outbound firewall. If you are connected to the internet through a router, you are already behind a hardware firewall and as such you do not need an extra software firewall.
      A comprehensive tutorial and a list of possible firewalls can be found here.
    • an AntiVirus Software
      It is imperative that you update your AntiVirus Software on regular basis.If you do not update your AntiVirus Software then it will not be able to catch the latest threats.
    • an Anti-Spyware program
      Malware Byte's Anti Malware is an excellent Anti-Spyware scanner. It's scan times are usually under ten minutes, and has excellent detection and removal rates.
      SUPERAntiSpyware is another good scanner with high detection and removal rates.
      Both programs are free for non commercial home use but provide a resident and do not nag if you purchase the paid versions.
    • Spyware Blaster
      A tutorial for Spywareblaster can be found here. If you wish, the commercial version provides automatic updating.
    • MVPs hosts file
      A tutorial for MVPs hosts file can be found here. If you would like automatic updates you might want to take a look at HostMan host file manager. For more information on thehosts file, and what it can do for you,please consult the Tutorial on the Hosts file

[*]Keep Windows (and your other Microsoft software) up to date!

I cannot stress how important this is enough. Often holes are found in Internet Explorer or Windows itself that require patching. Sometimes these holes will allow an attacker unrestricted access to your computer.

Therefore, please, visit the Microsoft Update Website and follow the on screen instructions to setup Microsoft Update. Also follow the instructions to update your system. Please REBOOT and repeat this process until there are no more updates to install!!

[*]Keep your other software up to date as well

Software does not need to be made by Microsoft to be insecure. You can use the Secunia Online Software occasionally to help you check for out of date software on yourmachine.

[*]Stay up to date!

The MOST IMPORTANT part of any security setup is keeping the software up to date. Malware writers release new variants every single day. If your software updates don't keep up, then the malware will always be one step ahead. Not a good thing.

Some more links you might find of interest:

Please reply to this topic if you have read the above information. If your computer is working fine, this topic will be closed afterwards.

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.