Antimalware Doctor Removal

***edit... don't know how to post the extras.txt. I'm pretty clueless right now.. Backdoor.bot is what Malwarebytes seems to have trouble getting rid of***

OK I tried to post this from my computer but wouldn't work! It would keep timing out. Hopefully this works form a different computer.

K here is my problem ! Two fake scanner programs popped up this morning while I was working and in a panic I tried to open task manager. Locked. Tried to open msconfig. Locked. Tried System Restore... Locked(WOULDNT LET me select diff date or time than present/recent. Ran Malwarebyte's Anti Malware in a panic, removed what it found, and rebooted only to return to the same problem... the virus (orwhatever) is quick so first time i rebooted I had the same problems of not being able to access anything i thought might help . Rebooted again and this time I was able to open task manager and closes processes I didn't recognize. Now i'm stuck on how to get rid of this thing! Found this site... followed directions and so here is my progress.

Please let me know if you need any other information or can help. THANKS

OTL logfile created on: 8/16/2010 11:19:38 AM - Run 1
OTL by OldTimer - Version 3.2.10.0 Folder = C:\Documents and Settings\User\My Documents\Downloads
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,022.00 Mb Total Physical Memory | 195.00 Mb Available Physical Memory | 19.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 72.00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 298.08 Gb Total Space | 262.68 Gb Free Space | 88.13% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
Drive E: | 7.47 Gb Total Space | 7.37 Gb Free Space | 98.67% Space Free | Partition Type: FAT32
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: PC-F8967CE0E5BF
Current User Name: User
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Processes (SafeList) ==========

PRC - [2010/08/16 11:18:07 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\User\My Documents\Downloads\OTL.com
PRC - [2010/01/15 20:09:37 | 000,910,296 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2009/04/06 15:32:44 | 001,277,584 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
PRC - [2005/03/22 18:20:44 | 000,339,968 | ---- | M] (SigmaTel, Inc.) -- C:\WINDOWS\stsystra.exe
PRC - [2004/08/03 17:07:00 | 001,032,192 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe


========== Modules (SafeList) ==========

MOD - [2010/08/16 11:18:07 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\User\My Documents\Downloads\OTL.com
MOD - [2010/08/16 11:02:09 | 000,083,968 | RHS- | M] () -- C:\Documents and Settings\User\Local Settings\Temp\dsoqq0.dll
MOD - [2004/08/03 17:07:00 | 001,050,624 | R--- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll
MOD - [2004/08/03 17:07:00 | 000,195,584 | ---- | M] () -- C:\WINDOWS\ixadiruvupo.dll
MOD - [2004/08/03 17:07:00 | 000,102,400 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msscript.ocx


========== Win32 Services (SafeList) ==========

SRV - File not found [Auto | Stopped] -- C:\DOCUME~1\User\LOCALS~1\Temp\DX9\SessionLauncher.exe -- (SessionLauncher)
SRV - [2010/07/10 20:25:17 | 000,068,096 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe -- (Macromedia Licensing Service)
SRV - [2007/08/24 16:53:16 | 000,362,992 | ---- | M] (Sonic Solutions) [Auto | Stopped] -- C:\Program Files\Roxio\Digital Home 10\RoxioUpnpService10.exe -- (Roxio Upnp Server 10)
SRV - [2007/08/24 16:53:14 | 000,072,176 | ---- | M] (Sonic Solutions) [On_Demand | Stopped] -- C:\Program Files\Roxio\Digital Home 10\RoxioUPnPRenderer10.exe -- (Roxio UPnP Renderer 10)
SRV - [2007/08/24 16:52:48 | 000,309,744 | ---- | M] (Sonic Solutions) [Auto | Stopped] -- C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxLiveShare10.exe -- (RoxLiveShare10)
SRV - [2007/08/24 16:52:46 | 000,166,384 | ---- | M] (Sonic Solutions) [Auto | Stopped] -- C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxWatch10.exe -- (RoxWatch10)
SRV - [2007/08/24 16:52:38 | 001,083,888 | ---- | M] (Sonic Solutions) [On_Demand | Stopped] -- C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe -- (RoxMediaDB10)


========== Driver Services (SafeList) ==========

DRV - [2009/04/06 15:32:54 | 000,038,496 | ---- | M] (Malwarebytes Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mbamswissarmy.sys -- (MBAMSwissArmy)
DRV - [2009/02/02 16:15:24 | 000,324,120 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\iaStor.sys -- (iaStor)
DRV - [2008/01/14 03:06:32 | 000,021,632 | ---- | M] (ManyCam LLC.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ManyCam.sys -- (ManyCam)
DRV - [2007/08/18 04:09:04 | 000,057,328 | ---- | M] (Sonic Solutions) [File_System | Disabled | Stopped] -- C:\WINDOWS\system32\drivers\RxFilter.sys -- (RxFilter)
DRV - [2006/02/09 21:57:46 | 001,502,208 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2005/11/16 16:36:00 | 001,047,816 | ---- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\sthda.sys -- (STHDA)
DRV - [2005/03/31 18:04:52 | 000,180,736 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\e1e5132.sys -- (e1express) Intel(R)
DRV - [2004/08/12 18:45:54 | 000,137,728 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Hdaudbus.sys -- (HDAudBus)
DRV - [2004/08/04 00:07:56 | 000,059,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\USBAUDIO.sys -- (usbaudio) USB Audio Driver (WDM)
DRV - [2003/11/17 16:59:20 | 000,212,224 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSFHWBS2.sys -- (HSFHWBS2)
DRV - [2003/11/17 16:58:02 | 000,680,704 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf)
DRV - [2003/11/17 16:56:26 | 001,042,432 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_DP.sys -- (HSF_DP)
DRV - [2001/08/17 14:57:38 | 000,016,128 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\MODEMCSA.sys -- (MODEMCSA)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.ask.com/?o=15438&l=dis
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:6522

========== FireFox ==========

FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.order.1: "Google"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.google.com/ig"
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}:20091028
FF - prefs.js..extensions.enabledItems: {66E978CD-981F-47DF-AC42-E3CF417C1467}:0.4.2
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:4.2.0.5198
FF - prefs.js..extensions.enabledItems: {AE93811A-5C9A-4d34-8462-F7B864FC4696}:3.64
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.2
FF - prefs.js..extensions.enabledItems: toolbar@ask.com:3.8.0.12304
FF - prefs.js..extensions.enabledItems: {7b13ec3e-999a-4b70-b9cb-2617b8323822}:2.7.1.3
FF - prefs.js..extensions.enabledItems: {477909D9-42CB-4FDB-B05C-B5D6151F9161}:1.9.1
FF - prefs.js..keyword.URL: "http://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q="

FF - user.js..browser.search.selectedEngine: "Google"
FF - user.js..browser.search.order.1: "Google"
FF - user.js..keyword.URL: "http://search.search-go.net/?sid=10101052100&s="

FF - HKLM\software\mozilla\Firefox\extensions\\{477909D9-42CB-4FDB-B05C-B5D6151F9161}: C:\Documents and Settings\User\Local Settings\Application Data\{477909D9-42CB-4FDB-B05C-B5D6151F9161} [2010/08/16 10:40:11 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/07/18 06:52:42 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/07/19 01:22:00 | 000,000,000 | ---D | M]

[2010/03/09 20:12:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\Mozilla\Extensions
[2010/03/09 20:12:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\Mozilla\Extensions\mozswing@mozswing.org
[2010/08/16 10:50:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\ofdqt1qy.default\extensions
[2010/03/04 22:52:51 | 000,000,000 | ---D | M] (New Tab Homepage) -- C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\ofdqt1qy.default\extensions\{66E978CD-981F-47DF-AC42-E3CF417C1467}
[2010/08/07 17:14:17 | 000,000,000 | ---D | M] (Zynga Toolbar) -- C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\ofdqt1qy.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}
[2010/03/04 22:48:50 | 000,000,000 | ---D | M] (WOT) -- C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\ofdqt1qy.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2010/06/16 16:07:27 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\ofdqt1qy.default\extensions\{AE93811A-5C9A-4d34-8462-F7B864FC4696}
[2010/06/17 23:31:15 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\ofdqt1qy.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010/07/14 20:06:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\ofdqt1qy.default\extensions\toolbar@ask.com
[2010/03/10 02:24:29 | 000,002,424 | ---- | M] () -- C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\ofdqt1qy.default\searchplugins\askcom.xml
[2010/08/16 10:50:26 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2010/03/22 18:43:44 | 000,000,000 | ---D | M] (Skype extension for Firefox) -- C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2010/08/10 06:34:02 | 000,002,074 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\google_search.xml

O1 HOSTS File: ([2004/08/03 17:07:00 | 000,000,734 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (moigh Object) - {8169F52C-E391-4CC2-B4E0-AD06D99A2F7A} - C:\WINDOWS\system32\vmdop.dll ()
O2 - BHO: (Dictionary.com Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O2 - BHO: (adShotHlpr Object) - {E918E972-EFC1-4B89-9FDD-216BFF80A277} - C:\WINDOWS\system32\zmdop.dll ()
O3 - HKLM\..\Toolbar: (Dictionary.com Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKCU\..\Toolbar\WebBrowser: (Dictionary.com Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [DMXLauncher] C:\Program Files\Roxio\CinePlayer\DMXLauncher.exe ()
O4 - HKLM..\Run: [ensielry] C:\Documents and Settings\User\Local Settings\Application Data\ataoxccle\bymscsjshdw.exe ()
O4 - HKLM..\Run: [MChk] C:\WINDOWS\system32\mmdop.exe ()
O4 - HKLM..\Run: [RoxWatchTray] C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxWatchTray10.exe (Sonic Solutions)
O4 - HKLM..\Run: [SigmatelSysTrayApp] C:\WINDOWS\stsystra.exe (SigmaTel, Inc.)
O4 - HKLM..\Run: [sta] C:\WINDOWS\System32\zmdop.dll ()
O4 - HKLM..\Run: [Urawixi] C:\WINDOWS\ixadiruvupo.DLL ()
O4 - HKLM..\Run: [UserFaultCheck] File not found
O4 - HKCU..\Run: [AIM (R)] C:\Program Files\AIM95\aim.exe -cnetwait.odl File not found
O4 - HKCU..\Run: [dso32] C:\Documents and Settings\User\Local Settings\Temp\dsoqq.exe ()
O4 - HKCU..\Run: [ensielry] C:\Documents and Settings\User\Local Settings\Application Data\ataoxccle\bymscsjshdw.exe ()
O4 - HKCU..\Run: [Messenger (Yahoo!)] C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O4 - HKCU..\Run: [newsecureapp70700.exe] C:\Documents and Settings\User\Application Data\7EF120ED14162BBE60BD1FB82E6F8DCC\newsecureapp70700.exe (MS)
O4 - HKCU..\Run: [Npixujikapaku] C:\WINDOWS\WMTWMPx.DLL (MaresWEB)
O4 - Startup: C:\Documents and Settings\User\Start Menu\Programs\Startup\Antimalware Doctor.lnk = C:\Documents and Settings\User\Application Data\7EF120ED14162BBE60BD1FB82E6F8DCC\newsecureapp70700.exe (MS)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = FF FF FF FF [binary data]
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\sdra64.exe) - C:\WINDOWS\System32\sdra64.exe File not found
O20 - HKLM Winlogon: TaskMan - (C:\RECYCLER\S-1-5-21-3010724255-3877766390-801949228-1359\wnzip32.exe) - C:\RECYCLER\S-1-5-21-3010724255-3877766390-801949228-1359\wnzip32.exe ()
O24 - Desktop WallPaper: C:\Documents and Settings\User\My Documents\My Pictures\bkgrndrainbowlady.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\User\My Documents\My Pictures\bkgrndrainbowlady.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/03/04 21:31:27 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2010/07/19 01:20:17 | 000,000,057 | RHS- | M] () - C:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2010/08/16 10:47:30 | 000,000,192 | ---- | M] () - E:\autorun.inf -- [ FAT32 ]
O32 - AutoRun File - [2009/10/13 02:53:24 | 000,000,057 | RHS- | M] () - E:\AUTORUN.FCB -- [ FAT32 ]
O33 - MountPoints2\{672e5f60-2dbf-11df-b3f0-00137213a8fe}\Shell\AutoRun\command - "" = E:\9g86.exe -- [2009/11/16 18:17:04 | 000,114,987 | RHS- | M] ()
O33 - MountPoints2\{672e5f60-2dbf-11df-b3f0-00137213a8fe}\Shell\open\Command - "" = E:\9g86.exe -- [2009/11/16 18:17:04 | 000,114,987 | RHS- | M] ()
O33 - MountPoints2\{8396a1c2-2a8f-11df-b3eb-00137213a8fe}\Shell\AutoRun\command - "" = E:\yqq8eqil.exe -- File not found
O33 - MountPoints2\{8396a1c2-2a8f-11df-b3eb-00137213a8fe}\Shell\open\Command - "" = E:\yqq8eqil.exe -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

MsConfig - StartUpReg: uTorrent - hkey= - key= - C:\Program Files\uTorrent\uTorrent.exe (BitTorrent, Inc.)
MsConfig - State: "system.ini" - 0
MsConfig - State: "win.ini" - 0
MsConfig - State: "bootini" - 0
MsConfig - State: "services" - 0
MsConfig - State: "startup" - 2

SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: sermouse.sys - Driver
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vga.sys - Driver
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: sermouse.sys - Driver
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vga.sys - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vector Graphics Rendering (VML)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML Data Binding for Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Advanced Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4b218e3e-bc98-4770-93d3-2731b9329278} - %SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection MarketplaceLinkInstall 896 %systemroot%\inf\ie.inf
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Web Folders
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - %SystemRoot%\system32\ie4uinit.exe
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {ACC563BC-4266-43f0-B6ED-9D38C4202C7E} -
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Task Scheduler
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - Reg Error: Value error.
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

Drivers32: msacm.ac3acm - C:\WINDOWS\System32\ac3acm.acm (fccHandler)
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.lameacm - C:\WINDOWS\System32\lameACM.acm (http://www.mp3dev.org/)
Drivers32: msacm.siren - C:\WINDOWS\System32\sirenacm.dll (Microsoft Corporation)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)
Drivers32: vidc.dvsd - C:\WINDOWS\System32\mcdvd_32.dll (MainConcept)
Drivers32: VIDC.FFDS - C:\WINDOWS\System32\ff_vfw.dll ()
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: vidc.mjpg - C:\WINDOWS\System32\mcmjpg32.dll (MainConcept)
Drivers32: VIDC.MP42 - C:\WINDOWS\System32\Mpg4c32.dll (Microsoft Corporation)
Drivers32: VIDC.MP43 - C:\WINDOWS\System32\Mpg4c32.dll (Microsoft Corporation)
Drivers32: VIDC.MPG4 - C:\WINDOWS\System32\Mpg4c32.dll (Microsoft Corporation)
Drivers32: VIDC.XVID - C:\WINDOWS\System32\xvidvfw.dll ()
Drivers32: vidc.yv12 - C:\WINDOWS\System32\yv12vfw.dll (www.helixcommunity.org)
Drivers32: wave - C:\WINDOWS\System32\serwvdrv.dll (Microsoft Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (17183528496136192)

========== Files/Folders - Created Within 30 Days ==========

[2010/08/16 11:13:16 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2010/08/16 11:13:11 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Adobe
[2010/08/16 10:57:12 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Mozilla
[2010/08/16 10:57:12 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Mozilla
[2010/08/16 10:40:11 | 000,000,000 | ---D | C] -- C:\Documents and Settings\User\Local Settings\Application Data\{477909D9-42CB-4FDB-B05C-B5D6151F9161}
[2010/08/16 10:39:34 | 000,000,000 | ---D | C] -- C:\Documents and Settings\User\Application Data\Sky-Banners
[2010/08/16 10:39:32 | 000,000,000 | ---D | C] -- C:\Documents and Settings\User\Application Data\Street-Ads
[2010/08/16 10:39:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\User\Local Settings\Application Data\ataoxccle
[2010/08/16 10:38:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Update
[2010/08/16 10:38:29 | 000,000,000 | ---D | C] -- C:\Documents and Settings\User\Local Settings\Application Data\Windows Server
[2010/08/16 10:38:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\User\Application Data\7EF120ED14162BBE60BD1FB82E6F8DCC
[2010/08/14 14:46:53 | 000,000,000 | ---D | C] -- C:\Documents and Settings\User\Application Data\foobar2000
[2010/08/14 14:46:45 | 000,000,000 | ---D | C] -- C:\Program Files\foobar2000
[2010/08/14 14:29:30 | 000,000,000 | ---D | C] -- C:\Documents and Settings\User\My Documents\Shared
[2010/08/14 14:26:08 | 000,000,000 | ---D | C] -- C:\Documents and Settings\User\My Documents\elannasPIXXXXXXXXXXXXXXXXXXXXXXXXX
[2010/08/13 19:44:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\User\My Documents\random mural art
[2010/08/13 11:48:19 | 000,000,000 | ---D | C] -- C:\PDSofTecData1
[2010/08/13 11:47:08 | 000,000,000 | ---D | C] -- C:\Program Files\MOTIONPRO
[2010/08/13 10:28:00 | 000,000,000 | ---D | C] -- C:\Program Files\PokerStars
[2010/08/13 07:28:33 | 000,000,000 | -HSD | C] -- C:\WINDOWS\ftpcache
[2010/07/24 04:01:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\User\Application Data\Apple Computer
[2010/03/12 18:51:19 | 000,061,440 | ---- | C] ( ) -- C:\WINDOWS\System32\csnpstd2.dll
[2010/03/12 18:51:19 | 000,040,960 | ---- | C] ( ) -- C:\WINDOWS\System32\rsnpstd2.dll
[2010/03/12 18:51:19 | 000,036,864 | ---- | C] ( ) -- C:\WINDOWS\System32\vsnpstd2.dll
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/08/16 11:21:19 | 000,785,920 | ---- | M] () -- C:\WINDOWS\System32\drivers\llzgks.sys
[2010/08/16 11:01:32 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\User\Application Data\bcrypt.html
[2010/08/16 11:01:28 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010/08/16 11:01:21 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/08/16 10:48:56 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/08/16 10:47:33 | 002,621,440 | ---- | M] () -- C:\Documents and Settings\User\ntuser.dat
[2010/08/16 10:47:33 | 000,000,278 | -HS- | M] () -- C:\Documents and Settings\User\ntuser.ini
[2010/08/16 10:40:11 | 000,000,120 | ---- | M] () -- C:\WINDOWS\Hqoqomukimu.dat
[2010/08/16 10:40:11 | 000,000,000 | ---- | M] () -- C:\WINDOWS\Qvinu.bin
[2010/08/16 10:39:02 | 000,001,204 | ---- | M] () -- C:\Documents and Settings\User\Start Menu\Programs\Startup\Antimalware Doctor.lnk
[2010/08/16 10:39:02 | 000,001,192 | ---- | M] () -- C:\Documents and Settings\User\Desktop\Antimalware Doctor.lnk
[2010/08/16 10:39:02 | 000,001,170 | ---- | M] () -- C:\Documents and Settings\User\Application Data\Microsoft\Internet Explorer\Quick Launch\Antimalware Doctor.lnk
[2010/08/16 10:39:02 | 000,000,005 | ---- | M] () -- C:\zrpt.xml
[2010/08/16 10:39:01 | 000,000,412 | ---- | M] () -- C:\WINDOWS\tasks\Updater.job
[2010/08/16 10:01:00 | 000,000,232 | ---- | M] () -- C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2010/08/16 02:52:35 | 000,035,328 | ---- | M] () -- C:\Documents and Settings\User\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/08/15 17:08:06 | 000,000,472 | -H-- | M] () -- C:\WINDOWS\tasks\Norton Security Scan for User.job
[2010/08/14 14:46:46 | 000,000,706 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\foobar2000.lnk
[2010/08/14 03:06:31 | 000,000,736 | ---- | M] () -- C:\Documents and Settings\User\Desktop\PokerStars.lnk
[2010/08/13 22:45:25 | 000,306,808 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010/08/13 11:48:08 | 000,017,336 | ---- | M] () -- C:\WINDOWS\Gone Fly Fishing.bmp
[2010/08/13 11:47:54 | 000,000,672 | ---- | M] () -- C:\WINDOWS\win.ini
[2010/08/13 11:47:14 | 000,001,564 | ---- | M] () -- C:\Documents and Settings\User\Desktop\MotionPro!.lnk
[2010/08/13 11:26:17 | 000,010,439 | ---- | M] () -- C:\Documents and Settings\User\My Documents\v1home_offline.mht
[2010/08/13 07:27:41 | 000,001,643 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Poker.lnk
[2010/08/13 05:26:22 | 000,062,170 | ---- | M] () -- C:\Documents and Settings\User\Desktop\tof.JPG
[2010/08/13 05:25:21 | 000,495,402 | ---- | M] () -- C:\Documents and Settings\User\Desktop\tof.png
[2010/08/13 05:18:12 | 000,014,848 | ---- | M] () -- C:\Documents and Settings\User\Desktop\sportsbuyupload.xls
[2010/08/12 23:18:35 | 000,000,204 | ---- | M] () -- C:\WINDOWS\struct~.ini
[2010/08/12 23:15:43 | 000,002,265 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Skype.lnk
[2010/08/08 05:05:16 | 000,032,064 | ---- | M] () -- C:\Documents and Settings\User\My Documents\massage.jpg
[2010/08/05 08:12:17 | 000,001,580 | ---- | M] () -- C:\Documents and Settings\User\Desktop\LimeWire 5.5.13.lnk
[2010/08/05 03:45:37 | 000,018,712 | ---- | M] () -- C:\Documents and Settings\User\My Documents\PayPal.MDI
[2010/08/05 02:32:58 | 000,206,703 | ---- | M] () -- C:\Documents and Settings\User\My Documents\worksheet-fail-my-penis-in-a-goat.jpg
[2010/08/01 11:13:47 | 000,022,972 | ---- | M] () -- C:\Documents and Settings\User\My Documents\cef4a80634d9__1280530118000.jpg
[2010/08/01 05:40:38 | 000,020,992 | ---- | M] () -- C:\Documents and Settings\User\My Documents\presalecalcs.xls
[2010/07/26 01:32:34 | 000,670,964 | ---- | M] () -- C:\Documents and Settings\User\My Documents\fitzlabel.MDI
[2010/07/22 23:29:37 | 000,078,400 | ---- | M] () -- C:\Documents and Settings\User\My Documents\paypal transactions.csv
[2010/07/22 15:38:02 | 000,054,615 | ---- | M] () -- C:\Documents and Settings\User\.recently-used.xbel
[2010/07/21 02:35:13 | 000,169,283 | ---- | M] () -- C:\Documents and Settings\User\My Documents\rtwg.xcf
[2010/07/20 23:27:31 | 000,201,849 | ---- | M] () -- C:\Documents and Settings\User\My Documents\pineappletrans.xcf
[2010/07/20 22:22:31 | 000,091,112 | ---- | M] () -- C:\Documents and Settings\User\My Documents\pineapple.png
[2010/07/19 01:20:17 | 000,000,057 | RHS- | M] () -- C:\autorun.inf
[2010/07/18 00:18:20 | 000,015,786 | ---- | M] () -- C:\Documents and Settings\User\My Documents\Photo-0320.jpg
[2010/07/18 00:15:06 | 000,040,074 | ---- | M] () -- C:\Documents and Settings\User\My Documents\IMG00590-20100716-1842.jpg
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/08/16 10:40:11 | 000,000,120 | ---- | C] () -- C:\WINDOWS\Hqoqomukimu.dat
[2010/08/16 10:40:11 | 000,000,000 | ---- | C] () -- C:\WINDOWS\Qvinu.bin
[2010/08/16 10:39:02 | 000,001,204 | ---- | C] () -- C:\Documents and Settings\User\Start Menu\Programs\Startup\Antimalware Doctor.lnk
[2010/08/16 10:39:02 | 000,001,192 | ---- | C] () -- C:\Documents and Settings\User\Desktop\Antimalware Doctor.lnk
[2010/08/16 10:39:02 | 000,001,170 | ---- | C] () -- C:\Documents and Settings\User\Application Data\Microsoft\Internet Explorer\Quick Launch\Antimalware Doctor.lnk
[2010/08/16 10:39:02 | 000,000,005 | ---- | C] () -- C:\zrpt.xml
[2010/08/16 10:39:00 | 000,000,412 | ---- | C] () -- C:\WINDOWS\tasks\Updater.job
[2010/08/16 10:38:56 | 000,785,920 | ---- | C] () -- C:\WINDOWS\System32\drivers\llzgks.sys
[2010/08/14 14:46:46 | 000,000,706 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\foobar2000.lnk
[2010/08/14 12:56:00 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\User\Application Data\bcrypt.html
[2010/08/14 03:06:31 | 000,000,736 | ---- | C] () -- C:\Documents and Settings\User\Desktop\PokerStars.lnk
[2010/08/13 11:47:14 | 000,001,564 | ---- | C] () -- C:\Documents and Settings\User\Desktop\MotionPro!.lnk
[2010/08/13 11:26:17 | 000,010,439 | ---- | C] () -- C:\Documents and Settings\User\My Documents\v1home_offline.mht
[2010/08/13 07:27:41 | 000,001,643 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Poker.lnk
[2010/08/13 05:26:22 | 000,062,170 | ---- | C] () -- C:\Documents and Settings\User\Desktop\tof.JPG
[2010/08/13 05:25:20 | 000,495,402 | ---- | C] () -- C:\Documents and Settings\User\Desktop\tof.png
[2010/08/13 05:18:12 | 000,014,848 | ---- | C] () -- C:\Documents and Settings\User\Desktop\sportsbuyupload.xls
[2010/08/08 05:05:16 | 000,032,064 | ---- | C] () -- C:\Documents and Settings\User\My Documents\massage.jpg
[2010/08/05 08:12:17 | 000,001,580 | ---- | C] () -- C:\Documents and Settings\User\Desktop\LimeWire 5.5.13.lnk
[2010/08/05 03:45:36 | 000,018,712 | ---- | C] () -- C:\Documents and Settings\User\My Documents\PayPal.MDI
[2010/08/05 02:32:57 | 000,206,703 | ---- | C] () -- C:\Documents and Settings\User\My Documents\worksheet-fail-my-penis-in-a-goat.jpg
[2010/08/01 11:13:46 | 000,022,972 | ---- | C] () -- C:\Documents and Settings\User\My Documents\cef4a80634d9__1280530118000.jpg
[2010/08/01 05:40:38 | 000,020,992 | ---- | C] () -- C:\Documents and Settings\User\My Documents\presalecalcs.xls
[2010/07/26 01:26:38 | 000,670,964 | ---- | C] () -- C:\Documents and Settings\User\My Documents\fitzlabel.MDI
[2010/07/22 23:29:19 | 000,078,400 | ---- | C] () -- C:\Documents and Settings\User\My Documents\paypal transactions.csv
[2010/07/22 15:38:02 | 000,054,615 | ---- | C] () -- C:\Documents and Settings\User\.recently-used.xbel
[2010/07/21 02:35:13 | 000,169,283 | ---- | C] () -- C:\Documents and Settings\User\My Documents\rtwg.xcf
[2010/07/20 23:27:31 | 000,201,849 | ---- | C] () -- C:\Documents and Settings\User\My Documents\pineappletrans.xcf
[2010/07/20 22:22:31 | 000,091,112 | ---- | C] () -- C:\Documents and Settings\User\My Documents\pineapple.png
[2010/07/18 00:18:20 | 000,015,786 | ---- | C] () -- C:\Documents and Settings\User\My Documents\Photo-0320.jpg
[2010/07/18 00:15:05 | 000,040,074 | ---- | C] () -- C:\Documents and Settings\User\My Documents\IMG00590-20100716-1842.jpg
[2010/07/15 21:18:18 | 000,246,784 | ---- | C] () -- C:\WINDOWS\System32\vmdop.dll
[2010/07/15 21:18:04 | 000,294,912 | ---- | C] () -- C:\WINDOWS\System32\zmdop.dll
[2010/06/23 16:53:45 | 000,000,204 | ---- | C] () -- C:\WINDOWS\struct~.ini
[2010/03/17 05:10:37 | 000,000,864 | ---- | C] () -- C:\Documents and Settings\User\Local Settings\Application Data\rx_image.Cache
[2010/03/12 18:51:24 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\dsnpstd2.dll
[2010/03/12 18:51:24 | 000,015,541 | ---- | C] () -- C:\WINDOWS\snpstd2.ini
[2010/03/12 18:51:22 | 000,302,720 | ---- | C] () -- C:\WINDOWS\System32\drivers\snpstd2.sys
[2010/03/08 02:19:55 | 000,178,176 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
[2010/03/08 02:19:55 | 000,000,038 | ---- | C] () -- C:\WINDOWS\avisplitter.ini
[2010/03/08 02:19:54 | 000,881,664 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2010/03/08 02:19:54 | 000,205,824 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2010/03/08 02:19:52 | 000,085,504 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2010/03/08 02:19:52 | 000,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest
[2010/03/08 01:50:10 | 000,035,328 | ---- | C] () -- C:\Documents and Settings\User\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/03/04 22:54:26 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2007/08/21 03:22:58 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini
[2004/08/03 17:07:00 | 000,195,584 | ---- | C] () -- C:\WINDOWS\ixadiruvupo.dll
[2004/08/03 17:07:00 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\ieencode.dll
[2004/08/03 17:07:00 | 000,027,440 | ---- | C] () -- C:\WINDOWS\System32\drivers\secdrv.sys
[2003/01/07 16:05:08 | 000,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI

========== Custom Scans ==========


< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[2004/08/03 17:07:00 | 000,357,888 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\dxtmsft.dll
[2004/08/03 17:07:00 | 000,201,728 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\dxtrans.dll
[2 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\system32\*.exe /lockedfiles >
[2 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >
[2010/08/16 11:22:09 | 000,785,920 | ---- | M] () Unable to obtain MD5 -- C:\WINDOWS\system32\drivers\llzgks.sys

< %systemroot%\System32\config\*.sav >
[2010/03/04 13:23:45 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
[2010/03/04 13:23:45 | 000,659,456 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
[2010/03/04 13:23:45 | 000,901,120 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav

< %systemroot%\system32\*.sys >
[2004/08/03 17:07:00 | 000,009,029 | ---- | M] () -- C:\WINDOWS\system32\ansi.sys
[2004/08/03 17:07:00 | 000,027,097 | ---- | M] () -- C:\WINDOWS\system32\country.sys
[2004/08/03 17:07:00 | 000,004,768 | ---- | M] () -- C:\WINDOWS\system32\himem.sys
[2004/08/03 17:07:00 | 000,042,809 | ---- | M] () -- C:\WINDOWS\system32\key01.sys
[2004/08/03 17:07:00 | 000,042,537 | ---- | M] () -- C:\WINDOWS\system32\keyboard.sys
[2004/08/03 17:07:00 | 000,027,866 | ---- | M] () -- C:\WINDOWS\system32\ntdos.sys
[2004/08/03 17:07:00 | 000,029,146 | ---- | M] () -- C:\WINDOWS\system32\ntdos404.sys
[2004/08/03 17:07:00 | 000,029,370 | ---- | M] () -- C:\WINDOWS\system32\ntdos411.sys
[2004/08/03 17:07:00 | 000,029,274 | ---- | M] () -- C:\WINDOWS\system32\ntdos412.sys
[2004/08/03 17:07:00 | 000,029,146 | ---- | M] () -- C:\WINDOWS\system32\ntdos804.sys
[2004/08/03 17:07:00 | 000,033,840 | ---- | M] () -- C:\WINDOWS\system32\ntio.sys
[2004/08/03 17:07:00 | 000,034,560 | ---- | M] () -- C:\WINDOWS\system32\ntio404.sys
[2004/08/03 17:07:00 | 000,035,648 | ---- | M] () -- C:\WINDOWS\system32\ntio411.sys
[2004/08/03 17:07:00 | 000,035,424 | ---- | M] () -- C:\WINDOWS\system32\ntio412.sys
[2004/08/03 17:07:00 | 000,034,560 | ---- | M] () -- C:\WINDOWS\system32\ntio804.sys
[2004/08/03 17:07:00 | 000,017,664 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\watchdog.sys
[2004/08/03 17:07:00 | 001,835,904 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\win32k.sys
[2 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\system32\drivers\*.dll >
[2006/02/09 21:26:38 | 000,040,960 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\system32\drivers\ati2erec.dll

< %systemroot%\system32\drivers\*.ini >

< %systemroot%\system32\drivers\*.exe >

< %SYSTEMDRIVE%\*.* >
[2010/06/23 03:48:12 | 000,117,248 | RHS- | M] () -- C:\09lf.exe
[2010/06/27 14:50:52 | 000,117,248 | -HS- | M] () -- C:\1j038ki.exe
[2010/06/14 13:23:44 | 000,115,712 | -HS- | M] () -- C:\2bbi1ax.exe
[2010/06/13 09:13:23 | 000,116,224 | RHS- | M] () -- C:\2ul.exe
[2010/05/23 23:18:28 | 000,114,688 | RHS- | M] () -- C:\33r.exe
[2009/11/16 18:17:04 | 000,114,987 | RHS- | M] () -- C:\9g86.exe
[2010/03/04 21:31:27 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT
[2010/07/19 01:20:17 | 000,000,057 | RHS- | M] () -- C:\autorun.inf
[2010/04/09 11:13:18 | 000,117,248 | -HS- | M] () -- C:\ba.exe
[2010/04/05 18:46:08 | 000,000,211 | -HS- | M] () -- C:\boot.ini
[2010/05/30 16:02:05 | 000,114,688 | RHS- | M] () -- C:\cgaqyi.exe
[2010/04/11 19:02:30 | 000,118,784 | RHS- | M] () -- C:\chxnxyx.exe
[2010/03/04 21:31:27 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
[2010/06/24 10:05:56 | 000,117,248 | RHS- | M] () -- C:\eyruu.exe
[2010/07/09 23:50:19 | 000,117,248 | RHS- | M] () -- C:\ggb6w.exe
[2010/03/04 21:31:27 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2010/04/05 14:22:17 | 000,001,145 | -H-- | M] () -- C:\IPH.PH
[2010/03/17 18:24:44 | 000,152,064 | RHS- | M] () -- C:\ji83j.exe
[2010/03/04 21:31:27 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2004/08/03 17:07:00 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
[2004/08/03 17:07:00 | 000,250,032 | RHS- | M] () -- C:\ntldr
[2010/05/14 04:16:02 | 000,112,640 | RHS- | M] () -- C:\p9rs.exe
[2010/08/16 11:01:13 | 1610,612,736 | -HS- | M] () -- C:\pagefile.sys
[2010/05/27 01:07:27 | 000,114,176 | RHS- | M] () -- C:\wa.exe
[2010/06/07 05:35:25 | 000,116,224 | RHS- | M] () -- C:\yqq8eqil.exe
[2010/08/16 10:39:02 | 000,000,005 | ---- | M] () -- C:\zrpt.xml

< %PROGRAMFILES%\*. >
[2010/03/05 03:15:57 | 000,000,000 | ---D | M] -- C:\Program Files\Adobe
[2010/04/05 16:39:06 | 000,000,000 | ---D | M] -- C:\Program Files\AIM
[2010/03/17 05:33:34 | 000,000,000 | ---D | M] -- C:\Program Files\AnvSoft
[2010/06/24 15:41:48 | 000,000,000 | ---D | M] -- C:\Program Files\Apple Software Update
[2010/07/14 20:01:05 | 000,000,000 | ---D | M] -- C:\Program Files\Ask.com
[2010/03/04 22:43:05 | 000,000,000 | ---D | M] -- C:\Program Files\ATI Technologies
[2010/04/13 17:56:57 | 000,000,000 | ---D | M] -- C:\Program Files\BitTorrent
[2010/05/15 17:15:29 | 000,000,000 | ---D | M] -- C:\Program Files\CardPlayer
[2010/07/10 20:25:17 | 000,000,000 | ---D | M] -- C:\Program Files\Common Files
[2010/03/04 21:28:53 | 000,000,000 | ---D | M] -- C:\Program Files\ComPlus Applications
[2010/03/04 22:35:34 | 000,000,000 | ---D | M] -- C:\Program Files\CONEXANT
[2010/03/05 00:10:09 | 000,000,000 | ---D | M] -- C:\Program Files\DivX
[2010/08/14 14:46:47 | 000,000,000 | ---D | M] -- C:\Program Files\foobar2000
[2010/06/23 12:31:53 | 000,000,000 | ---D | M] -- C:\Program Files\GIMP-2.0
[2010/08/13 11:47:55 | 000,000,000 | -H-D | M] -- C:\Program Files\InstallShield Installation Information
[2010/03/04 22:37:04 | 000,000,000 | ---D | M] -- C:\Program Files\Intel
[2010/03/04 23:10:32 | 000,000,000 | ---D | M] -- C:\Program Files\InterActual
[2010/03/04 22:57:24 | 000,000,000 | ---D | M] -- C:\Program Files\Internet Explorer
[2010/03/04 22:43:14 | 000,000,000 | ---D | M] -- C:\Program Files\Java
[2010/03/08 02:19:54 | 000,000,000 | ---D | M] -- C:\Program Files\K-Lite Codec Pack
[2010/08/05 08:12:21 | 000,000,000 | ---D | M] -- C:\Program Files\LimeWire
[2010/07/10 20:25:11 | 000,000,000 | ---D | M] -- C:\Program Files\Macromedia
[2010/04/05 16:39:08 | 000,000,000 | ---D | M] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010/06/19 05:27:31 | 000,000,000 | ---D | M] -- C:\Program Files\ManyCam 2.4
[2010/06/23 17:16:30 | 000,000,000 | ---D | M] -- C:\Program Files\MessageGroups 1.0
[2010/03/04 21:28:48 | 000,000,000 | ---D | M] -- C:\Program Files\Messenger
[2010/06/23 15:39:16 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft
[2010/03/04 22:53:38 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft ActiveSync
[2010/03/04 21:31:38 | 000,000,000 | ---D | M] -- C:\Program Files\microsoft frontpage
[2010/03/04 22:53:24 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Office
[2010/07/24 01:25:36 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Silverlight
[2010/03/04 22:53:19 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Visual Studio
[2010/03/04 22:53:23 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Works
[2010/03/04 22:53:45 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft.NET
[2010/08/13 11:48:12 | 000,000,000 | ---D | M] -- C:\Program Files\MOTIONPRO
[2010/03/04 21:29:39 | 000,000,000 | ---D | M] -- C:\Program Files\Movie Maker
[2010/07/26 01:24:01 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox
[2010/03/04 21:28:08 | 000,000,000 | ---D | M] -- C:\Program Files\MSN
[2010/03/04 21:28:44 | 000,000,000 | ---D | M] -- C:\Program Files\MSN Gaming Zone
[2010/03/04 21:29:53 | 000,000,000 | ---D | M] -- C:\Program Files\NetMeeting
[2010/07/15 01:03:09 | 000,000,000 | ---D | M] -- C:\Program Files\NetObjects
[2010/06/02 05:07:21 | 000,000,000 | ---D | M] -- C:\Program Files\Norton Security Scan
[2010/06/02 05:07:20 | 000,000,000 | ---D | M] -- C:\Program Files\NortonInstaller
[2010/03/04 22:34:33 | 000,000,000 | ---D | M] -- C:\Program Files\Online Services
[2010/03/04 21:29:49 | 000,000,000 | ---D | M] -- C:\Program Files\Outlook Express
[2010/08/14 03:06:38 | 000,000,000 | ---D | M] -- C:\Program Files\PokerStars
[2010/06/24 15:42:24 | 000,000,000 | ---D | M] -- C:\Program Files\QuickTime
[2010/03/04 23:03:25 | 000,000,000 | ---D | M] -- C:\Program Files\Roxio
[2010/03/04 22:36:16 | 000,000,000 | ---D | M] -- C:\Program Files\SigmaTel
[2010/03/22 18:43:44 | 000,000,000 | R--D | M] -- C:\Program Files\Skype
[2010/03/04 22:59:36 | 000,000,000 | ---D | M] -- C:\Program Files\SmartSound Software
[2010/03/04 21:35:20 | 000,000,000 | -H-D | M] -- C:\Program Files\Uninstall Information
[2010/04/05 18:45:53 | 000,000,000 | ---D | M] -- C:\Program Files\uTorrent
[2010/03/12 04:41:12 | 000,000,000 | ---D | M] -- C:\Program Files\VideoLAN
[2010/03/09 00:49:43 | 000,000,000 | ---D | M] -- C:\Program Files\Viewpoint
[2010/06/23 15:39:11 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Live
[2010/06/23 15:39:02 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Live SkyDrive
[2010/03/04 23:00:30 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Media Player
[2010/03/04 21:28:35 | 000,000,000 | ---D | M] -- C:\Program Files\Windows NT
[2010/03/04 21:30:35 | 000,000,000 | -H-D | M] -- C:\Program Files\WindowsUpdate
[2010/03/15 20:31:02 | 000,000,000 | ---D | M] -- C:\Program Files\WorldWinner.com, Inc
[2010/03/04 21:31:38 | 000,000,000 | ---D | M] -- C:\Program Files\xerox
[2010/03/08 02:04:40 | 000,000,000 | ---D | M] -- C:\Program Files\Yahoo!

< %appdata%\*.* >
[2010/08/16 11:01:32 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\User\Application Data\bcrypt.html
[2010/03/04 13:25:11 | 000,000,062 | -HS- | M] () -- C:\Documents and Settings\User\Application Data\desktop.ini


< MD5 for: AGP440.SYS >
[2004/08/03 17:07:00 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys

< MD5 for: ATAPI.SYS >
[2004/08/03 17:07:00 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2004/08/03 23:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\dllcache\atapi.sys
[2004/08/03 23:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\drivers\atapi.sys
[2004/08/03 15:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\ReinstallBackups\0006\DriverFiles\i386\atapi.sys

< MD5 for: DISK.SYS >
[2004/08/03 17:07:00 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:disk.sys
[2004/08/03 17:07:00 | 000,036,352 | ---- | M] (Microsoft Corporation) MD5=00CA44E4534865F8A3B64F7C0984BFF0 -- C:\WINDOWS\system32\drivers\disk.sys

< MD5 for: EVENTLOG.DLL >
[2004/08/03 17:07:00 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 -- C:\WINDOWS\system32\dllcache\eventlog.dll
[2004/08/03 17:07:00 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 -- C:\WINDOWS\system32\eventlog.dll

< MD5 for: IASTOR.SYS >
[2009/02/02 16:13:36 | 000,324,120 | ---- | M] (Intel Corporation) MD5=707C1692214B1C290271067197F075F6 -- C:\WINDOWS\NLDRV\001\iastor.sys
[2009/02/02 16:15:24 | 000,324,120 | ---- | M] (Intel Corporation) MD5=707C1692214B1C290271067197F075F6 -- C:\WINDOWS\NLDRV\002\iastor.sys
[2009/02/02 16:15:24 | 000,324,120 | ---- | M] (Intel Corporation) MD5=707C1692214B1C290271067197F075F6 -- C:\WINDOWS\system32\drivers\iaStor.sys

< MD5 for: NETLOGON.DLL >
[2004/08/03 17:07:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A -- C:\WINDOWS\system32\dllcache\netlogon.dll
[2004/08/03 17:07:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A -- C:\WINDOWS\system32\netlogon.dll

< MD5 for: SCECLI.DLL >
[2004/08/03 17:07:00 | 000,180,224 | ---- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A -- C:\WINDOWS\system32\dllcache\scecli.dll
[2004/08/03 17:07:00 | 000,180,224 | ---- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A -- C:\WINDOWS\system32\scecli.dll

< MD5 for: USBSTOR.SYS >
[2004/08/03 17:07:00 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:usbstor.sys
[2004/08/04 00:08:48 | 000,026,496 | ---- | M] (Microsoft Corporation) MD5=6CD7B22193718F1D17A47A1CD6D37E75 -- C:\WINDOWS\system32\dllcache\usbstor.sys
[2004/08/04 00:08:48 | 000,026,496 | ---- | M] (Microsoft Corporation) MD5=6CD7B22193718F1D17A47A1CD6D37E75 -- C:\WINDOWS\system32\drivers\USBSTOR.SYS

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >

========== Alternate Data Streams ==========

@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\User\My Documents\smiling-birthday-d_1600956i.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\User\My Documents\n519765172_6438479_70821.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\User\My Documents\iRobot-Roomba-530-Robotic-Vacuum-with-Virtual-Wall-and-Self-Charging-Home-Base.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\User\My Documents\funny-dog-pictures-segway-roomba-chihuahua.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\User\My Documents\c*** puncher.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\User\My Documents\AH_Timecard.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\User\Desktop\Captured Videos 00002.mpg:Roxio EMC Stream
< End of report >


Will post extras separately




Last edited by mrsnanaadkins on 16th August 2010, 7:42 pm; edited 1 time in total

OTL Extras logfile created on: 8/16/2010 11:19:38 AM - Run 1
OTL by OldTimer - Version 3.2.10.0 Folder = C:\Documents and Settings\User\My Documents\Downloads
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,022.00 Mb Total Physical Memory | 195.00 Mb Available Physical Memory | 19.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 72.00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 298.08 Gb Total Space | 262.68 Gb Free Space | 88.13% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
Drive E: | 7.47 Gb Total Space | 7.37 Gb Free Space | 98.67% Space Free | Partition Type: FAT32
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: PC-F8967CE0E5BF
Current User Name: User
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
http [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
https [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe" = C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call -- (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\uTorrent\uTorrent.exe" = C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent -- (BitTorrent, Inc.)
"C:\Program Files\AIM\aim.exe" = C:\Program Files\AIM\aim.exe:*:Enabled:AIM -- (AOL Inc.)
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" = C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger -- (Yahoo! Inc.)
"C:\Program Files\BitTorrent\bittorrent.exe" = C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent -- (BitTorrent, Inc.)
"C:\Program Files\LimeWire\LimeWire.exe" = C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire -- (Lime Wire, LLC)
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe" = C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call -- (Microsoft Corporation)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"$NtUninstallMTF1011$" = Street-Ads Browser Enhancer
"{08E81ABD-79F7-49C2-881F-FD6CB0975693}" = Roxio Central Data
"{098122AB-C605-4853-B441-C0A4EB359B75}" = DirectXInstallService
"{0BEDBD4E-2D34-47B5-9973-57E62B29307C}" = ATI Control Panel
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{1B683082-8791-4D00-8ADE-6C8986FCCC68}" = Roxio CinePlayer
"{1F54DAFA-9261-4A62-B59D-6C9F26B48FE4}" = Roxio Central Tools
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83216018FF}" = Java(TM) 6 Update 18
"{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}" = QuickTime
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Roxio Update Manager
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3E67A8DA-FE7B-4160-8465-F5571EA18753}" = Roxio Disc Gallery
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant
"{474F25F5-BDC9-40E5-B1B6-F6BF23FC106F}" = Windows Live Essentials
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A7FDA4D-F4D7-4A49-934A-066D59A43C7E}" = SmartSound Quicktracks Plugin
"{553255F3-78FD-40F1-A6F8-6882140265FE}" = Apple Application Support
"{5A06423A-210C-49FB-950E-CB0EB8C5CEC7}" = Roxio BackOnTrack
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{60B2315F-680F-4EB3-B8DD-CCDC86A7CCAB}" = Roxio File Backup
"{6421F085-1FAA-DE13-D02A-CFB412C522A4}" = Acrobat.com
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{73A4F29F-31AC-4EBD-AA1B-0CC5F18C8F83}" = Roxio Central Audio
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{7E20EFE6-E604-48C6-8B39-BA4742F2CDB4}" = Zune Desktop Theme
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{8D337F77-BE7F-41A2-A7CB-D5A63FD7049B}" = Roxio CinePlayer Decoder Pack
"{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars
"{9A9A1828-31D1-4590-A99F-022B7237AFAE}" = Roxio MediaShare
"{9B5F9478-8852-40B2-8BD6-4D9FC1EB8539}" = WorldWinner Games
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A462213D-EED4-42C2-9A60-7BDD4D4B0B17}" = SigmaTel Audio
"{A96E97134CA649888820BCDE5E300BBD}" = H.264 Decoder
"{AAC389499AEF40428987B3D30CFC76C9}" = MKV Splitter
"{AAF3BF6B-BFBB-430B-9B94-F1FB7D1E155B}" = SpadeClub Poker
"{AC76BA86-7AD7-1033-7B44-A93000000001}" = Adobe Reader 9.3.1
"{AEF9DC35ADDF4825B049ACBFD1C6EB37}" = AAC Decoder
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B57EAFF2-D6EE-4C6C-9175-ED9F17BFC1BC}" = Windows Live Messenger
"{B6A26DE5-F2B5-4D58-9570-4FC760E00FCD}" = Roxio Central Copy
"{BF83EFE2-C9F0-40D4-841C-2066668C1D7A}" = Roxio Easy Media Creator 10 Suite
"{C4124E95-5061-4776-8D5D-E3D931C778E1}" = Microsoft VC9 runtime libraries
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{E583ED6F-BD99-4066-A420-C815BF692B69}" = Macromedia Fireworks MX 2004
"{E6158D07-2637-4ECF-B576-37C489669174}" = Windows Live Call
"{EADAA6F7-991F-4CE9-B5CE-FCF3D81F7C7D}" = USB PC Camera (SN9C103)
"{EC877639-07AB-495C-BFD1-D63AF9140810}" = Roxio Activation Module
"{ED439A64-F018-4DD4-8BA5-328D85AB09AB}" = Roxio Central Core
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{FDB46DE7-9045-47BB-970A-3E4ED5369E03}" = EMC 10 Content
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"AIM_7" = AIM 7
"All ATI Software" = ATI - Software Uninstall Utility
"Any Video Converter_is1" = Any Video Converter 3.0.3
"ATI Display Driver" = ATI Display Driver
"BitTorrent" = BitTorrent
"CNXT_MODEM_PCI_VEN_14F1&DEV_2F20&SUBSYS_200F14F1" = Conexant D850 56K V.9x DFVc Modem
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"foobar2000" = foobar2000 v1.0.3
"HijackThis" = HijackThis 2.0.2
"InstallShield_{4A7FDA4D-F4D7-4A49-934A-066D59A43C7E}" = SmartSound Quicktracks Plugin
"KLiteCodecPack_is1" = K-Lite Codec Pack 5.7.0 (Full)
"LimeWire" = LimeWire 5.5.13
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"ManyCam" = ManyCam 2.4 (remove only)
"MessageGroups 1.0" = MessageGroups 1.0
"MOTIONPRO" = MotionPro! Video Analysis Software(remove only)
"Mozilla Firefox (3.6)" = Mozilla Firefox (3.6)
"NetObjects Fusion Essentials" = NetObjects Fusion Essentials
"NSS" = Norton Security Scan
"PokerStars" = PokerStars
"PROSet" = Intel(R) PRO Network Connections Drivers
"SoftwareUpdUtility" = Download Updater (AOL LLC)
"uTorrent" = µTorrent
"ViewpointMediaPlayer" = Viewpoint Media Player (Remove Only)
"VLC media player" = VLC media player 1.0.5
"Windows Media Format Runtime" = Windows Media Format Runtime
"WinGimp-2.0_is1" = GIMP 2.6.8
"WinLiveSuite_Wave3" = Windows Live Essentials
"Yahoo! Messenger" = Yahoo! Messenger

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Antimalware Doctor" = Antimalware Doctor
"UnityWebPlayer" = Unity Web Player

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 7/23/2010 9:50:31 PM | Computer Name = PC-F8967CE0E5BF | Source = Application Hang | ID = 1002
Description = Hanging application firefox.exe, version 1.9.2.3667, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 7/24/2010 4:25:55 AM | Computer Name = PC-F8967CE0E5BF | Source = Application Error | ID = 1000
Description = Faulting application svchost.exe, version 5.1.0.0, faulting module
svchost.exe, version 5.1.0.0, fault address 0x00001432.

Error - 7/24/2010 4:26:01 AM | Computer Name = PC-F8967CE0E5BF | Source = Application Error | ID = 1004
Description = Faulting application svchost.exe, version 5.1.0.0, faulting module
svchost.exe, version 5.1.0.0, fault address 0x00001432.

Error - 7/26/2010 4:26:50 AM | Computer Name = PC-F8967CE0E5BF | Source = Application Error | ID = 1000
Description = Faulting application svchost.exe, version 5.1.0.0, faulting module
svchost.exe, version 5.1.0.0, fault address 0x00001432.

Error - 7/31/2010 4:27:00 PM | Computer Name = PC-F8967CE0E5BF | Source = Application Error | ID = 1000
Description = Faulting application svchost.exe, version 5.1.0.0, faulting module
svchost.exe, version 5.1.0.0, fault address 0x00001432.

Error - 7/31/2010 4:32:39 PM | Computer Name = PC-F8967CE0E5BF | Source = Application Error | ID = 1004
Description = Faulting application svchost.exe, version 5.1.0.0, faulting module
svchost.exe, version 5.1.0.0, fault address 0x00001432.

Error - 8/5/2010 11:12:02 AM | Computer Name = PC-F8967CE0E5BF | Source = Application Error | ID = 1000
Description = Faulting application svchost.exe, version 5.1.0.0, faulting module
svchost.exe, version 5.1.0.0, fault address 0x00001432.

Error - 8/14/2010 1:45:38 AM | Computer Name = PC-F8967CE0E5BF | Source = Application Error | ID = 1000
Description = Faulting application svchost.exe, version 5.1.0.0, faulting module
svchost.exe, version 5.1.0.0, fault address 0x00001432.

Error - 8/14/2010 1:50:44 AM | Computer Name = PC-F8967CE0E5BF | Source = Application Error | ID = 1004
Description = Faulting application svchost.exe, version 5.1.0.0, faulting module
svchost.exe, version 5.1.0.0, fault address 0x00001432.

Error - 8/16/2010 9:26:58 AM | Computer Name = PC-F8967CE0E5BF | Source = Application Error | ID = 1000
Description = Faulting application svchost.exe, version 5.1.0.0, faulting module
svchost.exe, version 5.1.0.0, fault address 0x00001432.

[ System Events ]
Error - 8/14/2010 1:47:13 AM | Computer Name = PC-F8967CE0E5BF | Source = Service Control Manager | ID = 7000
Description = The SessionLauncher service failed to start due to the following error:
%%3

Error - 8/14/2010 1:49:50 AM | Computer Name = PC-F8967CE0E5BF | Source = Service Control Manager | ID = 7034
Description = The Power Manager service terminated unexpectedly. It has done this
1 time(s).

Error - 8/16/2010 9:27:01 AM | Computer Name = PC-F8967CE0E5BF | Source = Service Control Manager | ID = 7034
Description = The Power Manager service terminated unexpectedly. It has done this
1 time(s).

Error - 8/16/2010 1:38:57 PM | Computer Name = PC-F8967CE0E5BF | Source = Service Control Manager | ID = 7000
Description = The Microsoft Kernel Acoustic Echo Canceller service failed to start
due to the following error: %%31

Error - 8/16/2010 1:49:57 PM | Computer Name = PC-F8967CE0E5BF | Source = Service Control Manager | ID = 7000
Description = The SessionLauncher service failed to start due to the following error:
%%3

Error - 8/16/2010 1:55:48 PM | Computer Name = PC-F8967CE0E5BF | Source = Service Control Manager | ID = 7000
Description = The SessionLauncher service failed to start due to the following error:
%%3

Error - 8/16/2010 1:59:10 PM | Computer Name = PC-F8967CE0E5BF | Source = Service Control Manager | ID = 7031
Description = The Print Spooler service terminated unexpectedly. It has done this
1 time(s). The following corrective action will be taken in 60000 milliseconds:
Restart the service.

Error - 8/16/2010 1:59:12 PM | Computer Name = PC-F8967CE0E5BF | Source = Service Control Manager | ID = 7034
Description = The Machine Debug Manager service terminated unexpectedly. It has
done this 1 time(s).

Error - 8/16/2010 1:59:15 PM | Computer Name = PC-F8967CE0E5BF | Source = Service Control Manager | ID = 7034
Description = The Java Quick Starter service terminated unexpectedly. It has done
this 1 time(s).

Error - 8/16/2010 2:02:28 PM | Computer Name = PC-F8967CE0E5BF | Source = Service Control Manager | ID = 7000
Description = The SessionLauncher service failed to start due to the following error:
%%3


< End of report >

Hello.

You have an autorun worm, do you have any recently used removable media? cause that needs to be dis-infected first before anything else.

Actually I recently hooked up my oooold computer I retired over a year ago to finally get my old music, movies and pictures i neglected to retrieve when I upgraded desktops. I transferred around 30 gigs of media to this computer... didn't even think that the files would be infected with the same nasty bug that killed my old computer...
WHat is the best way to go about (or best program) to use to disinfect my files? And then what follow up can I do to ensure said virus is completely removed from my pooter?

Hello.
The files should be fine, it's the actual autorun that caused it, a malicious autorun.inf file is on the external drive.

Plug in whatever you used and we'll try to disinfect it.

• Download combofix from here
  Link 1
  Link 2
  
  1. If you are using Firefox, make sure that your download settings are as follows:
  
  * Tools->Options->Main tab
  * Set to "Always ask me where to Save the files".
  
  2. During the download, rename Combofix to Combo-Fix as follows:
  
  
  
  
  
  3. It is important you rename Combofix during the download, but not after.
  4. Please do not rename Combofix to other names, but only to the one indicated.
  5. Close any open browsers.
  6. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  
  
• We need to disable your local AV (Anti-virus) before running Combofix.
  
• See HERE for how to disable your AV.
  
• Double click on ComboFix.exe.
  
• Follow the prompts. NOTE:
  
• ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
  ***It's strongly recommended to have the Recovery Console installed before doing any malware removal.***
  
  **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will automatically proceed with its scan.
  
  
  
• The Recovery Console provides a recovery/repair mode should a problem occur during a Combofix run.
  
  
  
  
• Allow ComboFix to download the Recovery Console.
  
• Accept the End-User License Agreement.
  
• The Recovery Console will be installed.
  
• You will then get this next prompt that asks if you want to continue the malware scan, select yes
  
  
  
  
• Allow combofix to run
  
• Post C:\combofix.txt back here.
  
  Note:
  Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
  

OK... so I used a 16gb flash drive to transfer my files and you are saying the infected file is on that external flash drive? So when I download combo fix I save it to the flash drive vs my hard drive? THanks

Hello.
Not entirely, your files are fine, but the external has an autorun infection too, it's just a little script file that launches a malicious file. Plug the external in then run Combofix, CF will disinfect the infection.

ComboFix 10-08-16.03 - User 08/16/2010 18:23:05.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1022.758 [GMT -7:00]
Running from: c:\documents and settings\User\Desktop\Combo-Fix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\09lf.exe
C:\1j038ki.exe
C:\2bbi1ax.exe
C:\2ul.exe
C:\33r.exe
C:\9g86.exe
C:\autorun.inf
C:\ba.exe
C:\cgaqyi.exe
C:\chxnxyx.exe
c:\docume~1\User\LOCALS~1\Temp\cvasds0.dll
c:\docume~1\User\LOCALS~1\Temp\cvasds1.dll
c:\documents and settings\All Users\Application Data\Update\seupd.exe
c:\documents and settings\User\Application Data\7EF120ED14162BBE60BD1FB82E6F8DCC
c:\documents and settings\User\Application Data\7EF120ED14162BBE60BD1FB82E6F8DCC\enemies-names.txt
c:\documents and settings\User\Application Data\7EF120ED14162BBE60BD1FB82E6F8DCC\local.ini
c:\documents and settings\User\Application Data\7EF120ED14162BBE60BD1FB82E6F8DCC\newsecureapp70700.exe
c:\documents and settings\User\Application Data\bcrypt.html
c:\documents and settings\User\Application Data\Microsoft\Internet Explorer\Quick Launch\Antimalware Doctor.lnk
c:\documents and settings\User\Application Data\Sky-Banners
c:\documents and settings\User\Application Data\Street-Ads
c:\documents and settings\User\Desktop\Antimalware Doctor.lnk
c:\documents and settings\User\Local Settings\Application Data\{477909D9-42CB-4FDB-B05C-B5D6151F9161}
c:\documents and settings\User\Local Settings\Application Data\{477909D9-42CB-4FDB-B05C-B5D6151F9161}\chrome.manifest
c:\documents and settings\User\Local Settings\Application Data\{477909D9-42CB-4FDB-B05C-B5D6151F9161}\chrome\content\_cfg.js
c:\documents and settings\User\Local Settings\Application Data\{477909D9-42CB-4FDB-B05C-B5D6151F9161}\chrome\content\overlay.xul
c:\documents and settings\User\Local Settings\Application Data\{477909D9-42CB-4FDB-B05C-B5D6151F9161}\install.rdf
c:\documents and settings\User\Local Settings\Application Data\ataoxccle
c:\documents and settings\User\Local Settings\Application Data\ataoxccle\bymscsjshdw.exe
c:\documents and settings\User\Local Settings\Application Data\Windows Server
c:\documents and settings\User\Local Settings\Application Data\Windows Server\admin.txt
c:\documents and settings\User\Local Settings\Application Data\Windows Server\flags.ini
c:\documents and settings\User\Local Settings\Application Data\Windows Server\server.dat
c:\documents and settings\User\Local Settings\Application Data\Windows Server\uses32.dat
c:\documents and settings\User\Start Menu\Antimalware Doctor.lnk
c:\documents and settings\User\Start Menu\Programs\Antimalware Doctor
c:\documents and settings\User\Start Menu\Programs\Antimalware Doctor\Antimalware Doctor.lnk
c:\documents and settings\User\Start Menu\Programs\Antimalware Doctor\Uninstall.lnk
C:\eyruu.exe
C:\ggb6w.exe
C:\ji83j.exe
C:\p9rs.exe
c:\program files\Mozilla Firefox\searchplugins\google_search.xml
c:\recycler\S-1-5-21-3010724255-3877766390-801949228-1359\wnzip32.exe
C:\wa.exe
c:\windows\$NtUninstallMTF1011$
c:\windows\$NtUninstallMTF1011$\apUninstall.exe
c:\windows\$NtUninstallMTF1011$\zrpt.xml
c:\windows\ixadiruvupo.dll
c:\windows\struct~.ini
c:\windows\system32\mmdop.exe
c:\windows\system32\vmdop.dll
c:\windows\system32\zmdop.dll
c:\windows\WMTWMPx.dll
C:\yqq8eqil.exe

Infected copy of c:\windows\system32\drivers\dmio.sys was found and disinfected
Restored copy from - Kitty had a snack :p
c:\windows\system32\winlogon.exe . . . is infected!!

c:\windows\explorer.exe . . . is infected!!

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_POWERMANAGER


((((((((((((((((((((((((( Files Created from 2010-07-17 to 2010-08-17 )))))))))))))))))))))))))))))))
.

2010-08-17 00:12 . 2010-08-17 00:12 -------- d-s---w- c:\documents and settings\NetworkService\UserData
2010-08-16 18:00 . 2010-08-16 18:00 -------- d-----w- c:\windows\system32\wbem\Repository
2010-08-16 17:57 . 2010-08-16 17:57 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Mozilla
2010-08-16 17:40 . 2010-08-16 17:40 120 ----a-w- c:\windows\Hqoqomukimu.dat
2010-08-16 17:40 . 2010-08-16 17:40 0 ----a-w- c:\windows\Qvinu.bin
2010-08-16 17:38 . 2010-08-17 01:26 -------- d-----w- c:\documents and settings\All Users\Application Data\Update
2010-08-16 17:38 . 2010-08-17 01:29 785920 ----a-w- c:\windows\system32\drivers\llzgks.sys
2010-08-16 07:05 . 2010-08-16 07:05 27591840 ----a-w- c:\documents and settings\All Users\Application Data\Yahoo!\YUpdater\msgup1000_1270_us_u2.exe
2010-08-14 21:46 . 2010-08-16 23:59 -------- d-----w- c:\documents and settings\User\Application Data\foobar2000
2010-08-14 21:46 . 2010-08-14 21:46 -------- d-----w- c:\program files\foobar2000
2010-08-13 18:48 . 2010-08-13 18:48 -------- d-----w- C:\PDSofTecData1
2010-08-13 18:47 . 2010-08-13 18:48 -------- d-----w- c:\program files\MOTIONPRO
2010-08-13 17:28 . 2010-08-14 10:06 -------- d-----w- c:\program files\PokerStars
2010-08-13 14:28 . 2010-08-13 14:28 -------- d-sh--w- c:\windows\ftpcache
2010-08-08 00:14 . 2010-06-30 07:13 52224 ----a-w- c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\ofdqt1qy.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\FFExternalAlert.dll
2010-08-08 00:14 . 2010-06-30 07:13 101376 ----a-w- c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\ofdqt1qy.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\RadioWMPCore.dll
2010-07-24 11:01 . 2010-07-24 11:02 -------- d-----w- c:\documents and settings\User\Application Data\Apple Computer

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-16 23:10 . 2010-06-03 00:01 -------- d-----w- c:\program files\Common Files\Symantec Shared
2010-08-16 11:32 . 2010-03-12 11:41 -------- d-----w- c:\documents and settings\User\Application Data\vlc
2010-08-16 09:52 . 2010-04-14 00:57 -------- d-----w- c:\documents and settings\User\Application Data\BitTorrent
2010-08-13 18:47 . 2010-03-05 05:36 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-08-13 14:05 . 2010-03-23 01:44 -------- d-----w- c:\documents and settings\User\Application Data\Skype
2010-08-13 07:08 . 2010-03-23 01:45 -------- d-----w- c:\documents and settings\User\Application Data\skypePM
2010-08-05 15:14 . 2010-03-10 03:12 -------- d-----w- c:\documents and settings\User\Application Data\LimeWire
2010-08-05 15:12 . 2010-03-10 03:11 -------- d-----w- c:\program files\LimeWire
2010-07-24 08:25 . 2010-03-11 13:30 -------- d-----w- c:\program files\Microsoft Silverlight
2010-07-22 22:38 . 2010-04-07 05:58 -------- d-----w- c:\documents and settings\User\Application Data\gtk-2.0
2010-07-19 08:22 . 2010-03-05 05:41 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2010-07-15 08:03 . 2010-07-15 08:03 -------- d-----w- c:\program files\NetObjects
2010-07-15 03:01 . 2010-03-11 08:30 -------- d-----w- c:\program files\Ask.com
2010-07-13 09:18 . 2010-03-17 12:33 87432 ----a-w- c:\documents and settings\User\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-07-11 04:09 . 2010-07-11 04:09 -------- d-----w- c:\documents and settings\All Users\Application Data\Macrovision
2010-07-11 03:25 . 2010-07-11 03:25 -------- d-----w- c:\program files\Common Files\Macromedia Shared
2010-07-11 03:25 . 2010-07-11 03:25 -------- d-----w- c:\program files\Common Files\Macromedia
2010-07-11 03:25 . 2010-07-11 03:25 -------- d-----w- c:\program files\Macromedia
2010-07-10 20:08 . 2010-04-05 23:36 2754 ----a-w- c:\windows\system32\PerfStringBackup.TMP
2010-06-24 22:42 . 2010-06-24 22:42 -------- d-----w- c:\program files\QuickTime
2010-06-24 22:42 . 2010-06-24 22:42 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
2010-06-24 22:41 . 2010-06-24 22:41 -------- d-----w- c:\program files\Common Files\Apple
2010-06-24 22:41 . 2010-06-24 22:41 -------- d-----w- c:\program files\Apple Software Update
2010-06-24 22:41 . 2010-06-24 22:41 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple
2010-06-24 00:29 . 2010-06-24 00:29 -------- d-----w- c:\documents and settings\User\Application Data\MessageGroups
2010-06-24 00:16 . 2010-06-24 00:08 -------- d-----w- c:\program files\MessageGroups 1.0
2010-06-24 00:16 . 2010-03-23 01:43 -------- d-----w- c:\program files\Common Files\Skype
2010-06-24 00:07 . 2010-06-24 00:07 555520 ----a-w- c:\documents and settings\All Users\Application Data\Skype\Plugins\Plugins\07B9E799E57E446881426C489ED9764D\MessageGroups.exe
2010-06-23 23:53 . 2010-06-23 23:53 -------- d-----w- c:\documents and settings\All Users\Application Data\PrettyMay
2010-06-23 23:53 . 2010-06-23 23:53 940032 ----a-w- c:\documents and settings\All Users\Application Data\Skype\Plugins\Plugins\962C58B9C93944A28A0B82EF9F85A392\dbghelp.dll
2010-06-23 23:53 . 2010-06-23 23:53 53760 ----a-w- c:\documents and settings\All Users\Application Data\Skype\Plugins\Plugins\962C58B9C93944A28A0B82EF9F85A392\zlib.dll
2010-06-23 23:53 . 2010-06-23 23:53 42496 ----a-w- c:\documents and settings\All Users\Application Data\Skype\Plugins\Plugins\962C58B9C93944A28A0B82EF9F85A392\PrettyMayRemover.exe
2010-06-23 23:53 . 2010-06-23 23:53 40448 ----a-w- c:\documents and settings\All Users\Application Data\Skype\Plugins\Plugins\962C58B9C93944A28A0B82EF9F85A392\PrettyMayLoader.exe
2010-06-23 23:53 . 2010-06-23 23:53 3690496 ----a-w- c:\documents and settings\All Users\Application Data\Skype\Plugins\Plugins\962C58B9C93944A28A0B82EF9F85A392\PrettyMay.exe
2010-06-23 23:53 . 2010-06-23 23:53 325120 ----a-w- c:\documents and settings\All Users\Application Data\Skype\Plugins\Plugins\962C58B9C93944A28A0B82EF9F85A392\CrashRpt.dll
2010-06-23 23:53 . 2010-06-23 23:53 2273280 ----a-w- c:\documents and settings\All Users\Application Data\Skype\Plugins\Plugins\962C58B9C93944A28A0B82EF9F85A392\dsound.dll
2010-06-23 23:53 . 2010-06-23 23:53 2249728 ----a-w- c:\documents and settings\All Users\Application Data\Skype\Plugins\Plugins\962C58B9C93944A28A0B82EF9F85A392\audioses.dll
2010-06-23 23:52 . 2010-06-23 23:52 1585608 ----a-w- c:\documents and settings\All Users\Application Data\Skype\Plugins\Plugins\F35E193DC3E84933B83DE961D9AC33BF\SketchPad.exe
2010-06-23 22:39 . 2010-06-23 22:39 -------- d-----w- c:\program files\Microsoft
2010-06-23 22:39 . 2010-06-23 22:38 -------- d-----w- c:\program files\Windows Live
2010-06-23 22:39 . 2010-06-23 22:39 -------- d-----w- c:\program files\Windows Live SkyDrive
2010-06-23 22:35 . 2010-06-23 22:35 -------- d-----w- c:\program files\Common Files\Windows Live
2010-06-23 19:31 . 2010-04-07 05:52 -------- d-----w- c:\program files\GIMP-2.0
2010-06-19 12:27 . 2010-06-02 11:37 -------- d-----w- c:\program files\ManyCam 2.4
.

------- Sigcheck -------

[-] 2004-08-04 . DBA79205245A0928A3E96F076577832E . 502272 . . [5.1.2600.2180] . . c:\windows\system32\winlogon.exe

[-] 2004-08-04 . DA6F081D26408E1E10B3CC06D155B709 . 1032192 . . [6.00.2900.2180] . . c:\windows\explorer.exe

[-] 2009-02-02 . 32272BF10467C8ACF1F83138C61D541E . 1580544 . . [5.1.2600.2180] . . c:\windows\system32\sfcfiles.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2010-05-26 22:23 1385864 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-05-26 1385864]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-05-26 1385864]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SigmatelSysTrayApp"="stsystra.exe" [2005-03-23 339968]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-18 421888]

[HKLM\~\startupfolder\C:^Documents and Settings^User^Start Menu^Programs^Startup^Antimalware Doctor.lnk]
path=c:\documents and settings\User\Start Menu\Programs\Startup\Antimalware Doctor.lnk
backup=c:\windows\pss\Antimalware Doctor.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-06-09 08:06 976832 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-12-22 09:57 35760 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
2006-02-10 05:05 344064 ----a-w- c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DMXLauncher]
2007-08-14 11:44 113136 ----a-w- c:\program files\Roxio\CinePlayer\DMXLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)]
2010-02-17 10:30 5244216 ----a-w- c:\progra~1\Yahoo!\Messenger\YahooMessenger.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2010-04-17 05:12 3872080 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxWatchTray]
2007-08-24 23:52 240112 ----a-w- c:\program files\Common Files\Roxio Shared\10.0\SharedCOM\RoxWatchTray10.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent]
2010-04-06 01:45 355120 ----a-w- c:\program files\uTorrent\uTorrent.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\AIM\\aim.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;c:\windows\system32\drivers\ManyCam.sys [1/14/2008 3:06 AM 21632]
S2 Roxio Upnp Server 10;Roxio Upnp Server 10;c:\program files\Roxio\Digital Home 10\RoxioUpnpService10.exe [8/24/2007 4:53 PM 362992]
S2 RoxLiveShare10;LiveShare P2P Server 10;c:\program files\Common Files\Roxio Shared\10.0\SharedCOM\RoxLiveShare10.exe [8/24/2007 4:52 PM 309744]
S2 RoxWatch10;Roxio Hard Drive Watcher 10;c:\program files\Common Files\Roxio Shared\10.0\SharedCOM\RoxWatch10.exe [8/24/2007 4:52 PM 166384]
S2 SessionLauncher;SessionLauncher;c:\docume~1\User\LOCALS~1\Temp\DX9\SessionLauncher.exe --> c:\docume~1\User\LOCALS~1\Temp\DX9\SessionLauncher.exe [?]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [4/5/2010 1:44 PM 38496]
S3 Roxio UPnP Renderer 10;Roxio UPnP Renderer 10;c:\program files\Roxio\Digital Home 10\RoxioUPnPRenderer10.exe [8/24/2007 4:53 PM 72176]
S3 RoxMediaDB10;RoxMediaDB10;c:\program files\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe [8/24/2007 4:52 PM 1083888]

--- Other Services/Drivers In Memory ---

*Deregistered* - llzgks
.
Contents of the 'Scheduled Tasks' folder

2010-08-16 c:\windows\Tasks\Norton Security Scan for User.job
- c:\program files\Norton Security Scan\Engine\2.7.3.34\Nss.exe [2010-06-02 08:27]

2010-08-17 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
- c:\program files\Ask.com\UpdateTask.exe [2010-05-26 22:23]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.ask.com/?o=15438&l=dis
uInternet Settings,ProxyServer = http=127.0.0.1:6522
uInternet Settings,ProxyOverride =
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\ofdqt1qy.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
FF - component: c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\ofdqt1qy.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\FFExternalAlert.dll
FF - component: c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\ofdqt1qy.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\RadioWMPCore.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}\components\SkypeFfComponent.dll
FF - plugin: c:\documents and settings\User\Local Settings\Application Data\Unity\WebPlayer\loader\npUnity3D32.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npdnupdater2.dll
FF - plugin: c:\program files\WorldWinner.com, Inc\WorldWinner Games\npwwload.dll

---- FIREFOX POLICIES ----
FF - user.js: browser.search.selectedEngine - Google
FF - user.js: browser.search.order.1 - Google
FF - user.js: keyword.URL - hxxp://search.search-go.net/?sid=10101052100&s=c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-Npixujikapaku - c:\windows\WMTWMPx.dll
HKLM-Run-sta - zmdop.dll
HKLM-Run-Urawixi - c:\windows\ixadiruvupo.dll
MSConfigStartUp-AIM (R) - c:\program files\AIM95\aim.exe
MSConfigStartUp-dso32 - c:\docume~1\User\LOCALS~1\Temp\dsoqq.exe
MSConfigStartUp-ensielry - c:\documents and settings\User\Local Settings\Application Data\ataoxccle\bymscsjshdw.exe
MSConfigStartUp-MChk - c:\windows\system32\mmdop.exe
MSConfigStartUp-newsecureapp70700 - c:\documents and settings\User\Application Data\7EF120ED14162BBE60BD1FB82E6F8DCC\newsecureapp70700.exe
MSConfigStartUp-Npixujikapaku - c:\windows\WMTWMPx.dll
MSConfigStartUp-Urawixi - c:\windows\ixadiruvupo.dll
AddRemove-$NtUninstallMTF1011$ - c:\windows\$NtUninstallMTF1011$\apUninstall.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-08-16 18:29
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\llzgks]

.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\wdfmgr.exe
c:\windows\system32\wscntfy.exe
c:\windows\stsystra.exe
.
**************************************************************************
.
Completion time: 2010-08-16 18:31:29 - machine was rebooted
ComboFix-quarantined-files.txt 2010-08-17 01:31

Pre-Run: 282,079,195,136 bytes free
Post-Run: 282,590,199,808 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - A78DAD88E3D535445D4067FE55453151

Not good!..... before we can do anything else, I need you to do this.

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

• Double-click SystemLook.exe to run it.
  
• Copy the content of the following codebox into the main textfield:
  

  Code:

  
:filefind
winlogon.exe
explorer.exe
sfcfiles.dll

  
  
  
• Click the Look button to start the scan.
  
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
  

Note: The log can also be found on your Desktop entitled SystemLook.txt

SystemLook v1.0 by jpshortstuff (11.01.10)
Log created at 18:37 on 16/08/2010 by User (Administrator - Elevation successful)

========== filefind ==========

Searching for "winlogon.exe"
C:\WINDOWS\system32\winlogon.exe --a--- 502272 bytes [00:07 04/08/2004] [00:07 04/08/2004] DBA79205245A0928A3E96F076577832E

Searching for "explorer.exe"
C:\WINDOWS\explorer.exe --a--- 1032192 bytes [00:07 04/08/2004] [00:07 04/08/2004] DA6F081D26408E1E10B3CC06D155B709

Searching for "sfcfiles.dll"
C:\WINDOWS\system32\sfcfiles.dll --a--- 1580544 bytes [23:15 02/02/2009] [23:15 02/02/2009] 32272BF10467C8ACF1F83138C61D541E

-=End Of File=-

Hello.
Do you have your XP disc?

Please do the following:

Please run OTL.exe.

• Copy the commands with file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  
  /md5start
  winlogon.exe
  explorer.exe
  sfcfiles.dll
  /md5stop
  
  
  
• Return to OTL, right click in the "Custom Scans/Fixes" window (under the light green bar) and choose Paste.
  
  
• Click the red Run Fix button.
  
• A fix log in Notepad will appear. Copy the contents of the fix log to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  
• Close OTL.exe
  

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!
Error: Unable to interpret in the current context!

OTL by OldTimer - Version 3.2.10.0 log created on 08162010_184332




And I don't have an XP disc but my tech friend can bring one tomorrow if needed

am i totally effed?

Not if we can get your that XP disc.
Let me know when you get the CD of it.