System Check Virus - OTL Part 1

Hi,

It seems my PC has gotten hit with the "System Check" malware/Virus (not sure which one)

In any case, OTL, aswMBR and Security Check logs are posted below.

Thanks!



OTL logfile created on: 2/10/2012 1:17:51 PM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.12 Gb Available Physical Memory | 56.09% Memory free
2.60 Gb Paging File | 2.04 Gb Available in Paging File | 78.28% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 111.80 Gb Total Space | 43.19 Gb Free Space | 38.63% Space Free | Partition Type: NTFS

Computer Name: FLABUSKIXP | User Name: flabuski | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/02/10 13:16:38 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\OTL.com
PRC - [2011/12/21 02:24:51 | 000,924,632 | -H-- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2011/03/30 17:46:06 | 001,721,192 | -H-- | M] (Hewlett-Packard Co.) -- C:\Program Files\HP\HP Deskjet 3050A J611 series\Bin\ScanToPCActivationApp.exe
PRC - [2011/03/30 17:43:14 | 000,636,776 | -H-- | M] (Hewlett-Packard Co.) -- C:\Program Files\HP\HP Deskjet 3050A J611 series\Bin\HPNetworkCommunicator.exe
PRC - [2010/09/14 14:45:30 | 000,045,056 | -H-- | M] (Intuit) -- C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
PRC - [2010/08/23 19:21:40 | 000,013,672 | -H-- | M] (Intuit Inc.) -- C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
PRC - [2008/09/29 07:07:00 | 000,143,088 | -H-- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\VirusScan Enterprise\mcshield.exe
PRC - [2008/09/29 07:07:00 | 000,124,240 | -H-- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\VirusScan Enterprise\shstat.exe
PRC - [2008/09/29 07:07:00 | 000,067,904 | -H-- | M] (McAfee, Inc.) -- C:\WINDOWS\system32\mfevtps.exe
PRC - [2008/09/29 07:07:00 | 000,062,800 | -H-- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exe
PRC - [2008/09/29 07:07:00 | 000,026,672 | -H-- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\VirusScan Enterprise\mfeann.exe
PRC - [2008/09/29 07:07:00 | 000,019,456 | -H-- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\VirusScan Enterprise\engineserver.exe
PRC - [2008/05/13 14:05:40 | 000,136,512 | -H-- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\Common Framework\UdaterUI.exe
PRC - [2008/05/13 14:05:38 | 000,136,512 | -H-- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\Common Framework\naPrdMgr.exe
PRC - [2008/05/13 14:05:38 | 000,103,744 | -H-- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\Common Framework\FrameworkService.exe
PRC - [2008/05/13 14:05:38 | 000,086,016 | -H-- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\Common Framework\Mctray.exe
PRC - [2008/04/13 19:12:19 | 001,033,728 | -H-- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2008/04/13 19:12:14 | 000,389,120 | -H-- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\cmd.exe
PRC - [2005/05/25 02:40:00 | 000,450,560 | -H-- | M] (Logitech Inc.) -- C:\Program Files\Logitech\SetPoint\SetPoint.exe
PRC - [2005/05/25 02:40:00 | 000,028,160 | -H-- | M] (Logitech Inc.) -- C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
PRC - [2003/09/01 08:32:36 | 001,200,178 | -H-- | M] (Ahead Software AG) -- C:\Program Files\Ahead\InCD\InCD.exe
PRC - [2003/09/01 08:32:08 | 000,798,772 | -H-- | M] (AHEAD Software) -- C:\Program Files\Ahead\InCD\incdsrv.exe
PRC - [2002/01/10 11:44:28 | 000,036,864 | -H-- | M] (Intuit) -- C:\Program Files\QUICKENW\QWDLLS.EXE


========== Modules (No Company Name) ==========

MOD - [2012/01/24 04:38:03 | 006,276,768 | -H-- | M] () -- C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll
MOD - [2012/01/20 11:37:12 | 003,182,592 | -H-- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll
MOD - [2012/01/20 11:37:10 | 002,933,248 | -H-- | M] () -- C:\WINDOWS\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
MOD - [2012/01/20 11:37:09 | 000,425,984 | -H-- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.dll
MOD - [2012/01/20 11:37:00 | 000,626,688 | -H-- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
MOD - [2012/01/20 11:37:00 | 000,303,104 | -H-- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
MOD - [2012/01/20 11:36:57 | 000,258,048 | -H-- | M] () -- C:\WINDOWS\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll
MOD - [2012/01/20 11:36:56 | 000,261,632 | -H-- | M] () -- C:\WINDOWS\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
MOD - [2012/01/20 11:36:55 | 002,048,000 | -H-- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.Xml.dll
MOD - [2012/01/20 11:36:51 | 000,114,688 | -H-- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll
MOD - [2012/01/20 11:36:42 | 005,025,792 | -H-- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
MOD - [2011/12/21 02:24:51 | 002,124,760 | -H-- | M] () -- C:\Program Files\Mozilla Firefox\mozjs.dll
MOD - [2011/10/19 16:39:51 | 000,212,992 | -H-- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\abef85f2fb8ba830eda73e2d12e8d41e\System.ServiceProcess.ni.dll
MOD - [2011/10/19 16:23:09 | 007,950,848 | -H-- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\af39f6e644af02873b9bae319f2bfb13\System.ni.dll
MOD - [2011/10/19 16:21:09 | 011,490,816 | -H-- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\ca87ba84221991839abbe7d4bc9c6721\mscorlib.ni.dll
MOD - [2011/04/15 16:10:33 | 000,854,016 | -H-- | M] () -- C:\WINDOWS\assembly\GAC_32\System.Data.SQLite\1.0.61.0__db937bc2d44ff139\System.Data.SQLite.dll
MOD - [2011/04/15 16:10:30 | 000,270,336 | -H-- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\log4net\1.2.10.0__1b44e1d426115821\log4net.dll
MOD - [2011/04/15 16:10:28 | 000,409,960 | -H-- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\Intuit.Spc.Map.WindowsFirewallUtilities\5.0.136.0__7ce6deabcb36a8ea\Intuit.Spc.Map.WindowsFirewallUtilities.dll
MOD - [2011/04/15 16:10:27 | 000,476,520 | -H-- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\Intuit.Spc.Map.Reporter\5.0.136.0__7ce6deabcb36a8ea\Intuit.Spc.Map.Reporter.dll
MOD - [2011/04/15 16:10:20 | 000,046,952 | -H-- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\Intuit.Spc.Esd.WinClient.Application.UpdateServicePlugin\3.1.31.0__540d4816ead86321\Intuit.Spc.Esd.WinClient.Application.UpdateServicePlugin.dll
MOD - [2011/04/15 16:10:20 | 000,023,912 | -H-- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\Intuit.Spc.Esd.WinClient.Application.UpdateService\1.0.0.0__540d4816ead86321\Intuit.Spc.Esd.WinClient.Application.UpdateService.dll
MOD - [2011/04/15 16:10:20 | 000,018,792 | -H-- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\Intuit.Spc.Esd.WinClient.Ipc.Remoting.UpdateServiceWorker\3.1.31.0__540d4816ead86321\Intuit.Spc.Esd.WinClient.Ipc.Remoting.UpdateServiceWorker.dll
MOD - [2011/04/15 16:10:20 | 000,012,136 | -H-- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\Intuit.Spc.Esd.WinClient.Application.UpdateService.PluginContract\1.0.0.0__540d4816ead86321\Intuit.Spc.Esd.WinClient.Application.UpdateService.PluginContract.dll
MOD - [2011/04/15 16:10:19 | 000,421,224 | -H-- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\Intuit.Spc.Esd.WinClient.Api.Net\3.1.31.0__540d4816ead86321\Intuit.Spc.Esd.WinClient.Api.Net.dll
MOD - [2011/04/15 16:10:18 | 000,269,672 | -H-- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\Intuit.Spc.Esd.Core\3.1.26.0__540d4816ead86321\Intuit.Spc.Esd.Core.dll
MOD - [2011/04/15 16:10:17 | 000,121,704 | -H-- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\Intuit.Spc.Esd.Client.BusinessLogic\3.1.31.0__540d4816ead86321\Intuit.Spc.Esd.Client.BusinessLogic.dll
MOD - [2011/04/15 16:10:17 | 000,120,168 | -H-- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\Intuit.Spc.Esd.Client.DataAccess\3.1.31.0__540d4816ead86321\Intuit.Spc.Esd.Client.DataAccess.dll
MOD - [2011/04/15 16:10:17 | 000,070,504 | -H-- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\Intuit.Spc.Esd.Client.Common\3.1.31.0__540d4816ead86321\Intuit.Spc.Esd.Client.Common.dll
MOD - [2011/03/30 16:19:19 | 001,841,000 | -H-- | M] () -- C:\WINDOWS\system32\HPScanTRDrv_DJ3050A_J611.dll
MOD - [2008/09/29 07:07:00 | 000,148,816 | -H-- | M] () -- C:\Program Files\McAfee\VirusScan Enterprise\vsevntui.dll
MOD - [2008/05/13 14:05:38 | 000,156,992 | -H-- | M] () -- C:\Program Files\McAfee\Common Framework\naisign2.dll
MOD - [2008/05/13 14:05:38 | 000,120,128 | -H-- | M] () -- C:\Program Files\McAfee\Common Framework\naXML2_71.dll
MOD - [2005/10/07 14:05:32 | 000,125,440 | -H-- | M] () -- C:\Program Files\WinRAR\RarExt.dll
MOD - [2002/01/10 11:44:30 | 000,172,032 | -H-- | M] () -- C:\Program Files\QUICKENW\qwapp.dll
MOD - [2002/01/10 11:44:26 | 000,484,864 | -H-- | M] () -- C:\Program Files\QUICKENW\alrtint8.dll
MOD - [2002/01/10 11:44:24 | 000,102,400 | -H-- | M] () -- C:\Program Files\QUICKENW\qcomutil.dll


========== Win32 Services (SafeList) ==========

SRV - [2010/09/14 14:45:30 | 000,045,056 | -H-- | M] (Intuit) [Auto | Running] -- C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe -- (QBCFMonitorService)
SRV - [2010/08/23 19:21:40 | 000,013,672 | -H-- | M] (Intuit Inc.) [Auto | Running] -- C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe -- (IntuitUpdateService)
SRV - [2008/11/18 15:45:28 | 000,061,440 | -H-- | M] (Intuit Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe -- (QBFCService)
SRV - [2008/09/29 07:07:00 | 000,143,088 | -H-- | M] (McAfee, Inc.) [Unknown | Running] -- C:\Program Files\McAfee\VirusScan Enterprise\mcshield.exe -- (McShield)
SRV - [2008/09/29 07:07:00 | 000,067,904 | -H-- | M] (McAfee, Inc.) [Unknown | Running] -- C:\WINDOWS\system32\mfevtps.exe -- (mfevtp)
SRV - [2008/09/29 07:07:00 | 000,062,800 | -H-- | M] (McAfee, Inc.) [Unknown | Running] -- C:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exe -- (McTaskManager)
SRV - [2008/09/29 07:07:00 | 000,019,456 | -H-- | M] (McAfee, Inc.) [Unknown | Running] -- C:\Program Files\McAfee\VirusScan Enterprise\engineserver.exe -- (McAfeeEngineService)
SRV - [2008/05/13 14:05:38 | 000,103,744 | -H-- | M] (McAfee, Inc.) [Unknown | Running] -- C:\Program Files\McAfee\Common Framework\FrameworkService.exe -- (McAfeeFramework)
SRV - [2008/03/05 20:18:46 | 002,789,376 | -H-- | M] (BigFix Inc.) [Auto | Stopped] -- C:\Program Files\BigFix Enterprise\BES Client\BESClient.exe -- (BESClient)
SRV - [2007/04/03 08:29:56 | 000,079,360 | -H-- | M] (SolidWorks) [On_Demand | Stopped] -- C:\Program Files\Common Files\SolidWorks Shared\Service\SolidWorksLicensing.exe -- (SolidWorks Licensing Service)
SRV - [2006/09/02 16:36:33 | 002,528,960 | -H-- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Program Files\Symantec\LiveUpdate\LuComServer_3_1.EXE -- (LiveUpdate)
SRV - [2005/09/23 06:01:16 | 002,799,808 | -H-- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe -- (msvsmon80)
SRV - [2003/09/01 08:32:08 | 000,798,772 | -H-- | M] (AHEAD Software) [Auto | Running] -- C:\Program Files\Ahead\InCD\incdsrv.exe -- (InCDsrv)
SRV - [2003/08/11 03:07:38 | 000,065,795 | -H-- | M] (HP) [On_Demand | Stopped] -- C:\WINDOWS\system32\hpzipm12.exe -- (Pml Driver HPZ12)


========== Driver Services (SafeList) ==========

DRV - [2008/09/29 07:07:00 | 000,340,592 | -H-- | M] (McAfee, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\mfehidk.sys -- (mfehidk)
DRV - [2008/09/29 07:07:00 | 000,090,360 | -H-- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mfeavfk.sys -- (mfeavfk)
DRV - [2008/09/29 07:07:00 | 000,074,648 | -H-- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mfeapfk.sys -- (mfeapfk)
DRV - [2008/09/29 07:07:00 | 000,064,432 | -H-- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mferkdet.sys -- (mferkdet)
DRV - [2008/09/29 07:07:00 | 000,062,704 | -H-- | M] (McAfee, Inc.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\mfetdik.sys -- (mfetdik)
DRV - [2008/09/29 07:07:00 | 000,042,424 | -H-- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mfebopk.sys -- (mfebopk)
DRV - [2006/11/16 12:47:34 | 000,047,616 | -H-- | M] (Aladdin Knowledge Systems) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\Haspnt.sys -- (Haspnt)
DRV - [2006/02/13 14:21:32 | 000,043,672 | -H-- | M] (Oak Technology Inc.) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\AFS2K.SYS -- (AFS2K)
DRV - [2005/08/18 19:22:30 | 000,110,080 | -H-- | M] (Deterministic Networks, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\dne2000.sys -- (DNE)
DRV - [2005/07/28 07:18:40 | 000,685,056 | -H-- | M] (Aladdin Knowledge Systems Ltd.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\hardlock.sys -- (Hardlock)
DRV - [2005/07/20 17:08:28 | 000,100,096 | -H-- | M] (Aladdin Knowledge Systems Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\aksusb.sys -- (aksusb)
DRV - [2005/07/20 17:08:26 | 000,327,808 | -H-- | M] (Aladdin Knowledge Systems Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\akshasp.sys -- (akshasp)
DRV - [2005/05/20 15:01:32 | 000,025,600 | -H-- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LHidKE.Sys -- (LHidKe)
DRV - [2005/05/20 15:01:26 | 000,068,352 | -H-- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LMouKE.Sys -- (LMouKE)
DRV - [2005/05/20 15:01:00 | 000,036,480 | -H-- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\LHidUsbK.sys -- (LHidUsbK)
DRV - [2005/05/20 15:00:48 | 000,054,528 | -H-- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\L8042mou.Sys -- (L8042mou)
DRV - [2005/05/20 15:00:36 | 000,013,056 | -H-- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\L8042Kbd.sys -- (L8042Kbd)
DRV - [2005/05/17 04:51:34 | 000,005,315 | -H-- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\CVirtA.sys -- (CVirtA)
DRV - [2004/10/01 10:24:02 | 002,279,424 | -H-- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS -- (ALCXWDM) Service for Realtek AC97 Audio (WDM)
DRV - [2004/08/04 00:31:32 | 000,020,992 | -H-- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\rtl8139.sys -- (rtl8139) Realtek RTL8139(A/B/C)
DRV - [2004/06/21 16:03:22 | 000,078,976 | -H-- | M] (Pinnacle Systems GmbH) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\MarvinBus.sys -- (MarvinBus)
DRV - [2004/03/25 19:37:08 | 000,052,384 | -H-- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\slabbus.sys -- (slabbus) CP2101 USB Composite Device driver (WDM)
DRV - [2004/03/25 19:36:48 | 000,084,512 | -H-- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\slabser.sys -- (slabser)
DRV - [2004/03/03 09:50:00 | 000,037,887 | -H-- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Lhidusb.sys -- (LHidUsb)
DRV - [2003/09/01 08:36:06 | 000,028,528 | -H-- | M] (Ahead Software) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\incdpass.sys -- (InCDPass)
DRV - [2003/09/01 08:34:32 | 000,088,800 | -H-- | M] (Ahead Software) [File_System | Disabled | Running] -- C:\WINDOWS\System32\drivers\incdfs.sys -- (InCDfs)
DRV - [2003/08/29 11:26:50 | 000,046,397 | -H-- | M] (Pinnacle Systems) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\DVXUSBKS.sys -- (DVXUSBKS)
DRV - [2003/08/28 12:34:58 | 000,065,241 | -H-- | M] (Pinnacle Systems) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\DVXUSBLD.SYS -- (DVXUSBLD)
DRV - [2003/06/23 11:33:02 | 000,022,848 | -H-- | M] (Ahead Software AG) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\incdrm.sys -- (incdrm)
DRV - [2003/03/31 13:29:00 | 000,625,537 | -H-- | M] (LT) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ltmdmnt.sys -- (ltmodem5)
DRV - [2002/11/08 04:50:00 | 000,070,238 | -H-- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\LMouFlt2.Sys -- (LMouFlt2)
DRV - [2002/11/08 04:50:00 | 000,052,238 | -H-- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\L8042pr2.Sys -- (L8042pr2)
DRV - [2002/06/13 15:08:46 | 000,014,604 | -H-- | M] (Padus, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\pfc.sys -- (pfc)
DRV - [2002/03/19 08:29:16 | 000,014,165 | -H-- | M] (Pinnacle Systems GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\Pclepci.sys -- (PCLEPCI)
DRV - [2001/08/17 11:11:02 | 000,153,631 | -H-- | M] (3Com Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\el90xnd5.sys -- (EL90X)
DRV - [1999/07/20 03:38:00 | 000,073,216 | -H-- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\System32\Drivers\SENTINEL.SYS -- (Sentinel)
DRV - [1997/06/17 03:00:00 | 000,004,064 | -H-- | M] (Adobe Systems Incorporated) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\ATMHELPR.SYS -- (ATMhelpr)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.cnn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = 127.0.0.1;*.local

========== FireFox ==========

FF - prefs.js..browser.search.openintab: true
FF - prefs.js..browser.startup.homepage: "http://www.drudgereport.com/"
FF - prefs.js..extensions.enabledItems: ietab@ip.cn:1.98.20110322
FF - prefs.js..extensions.enabledItems: {dc572301-7619-498c-a57d-39143191b318}:0.3.8.7

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\yaxmpb@yahoo.com/YahooActiveXPluginBridge;version=1.0.0.1: C:\Program Files\Mozilla Firefox\plugins\npyaxmpb.dll (Yahoo! Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/01/27 18:42:26 | 000,000,000 | -H-D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/01/27 18:42:18 | 000,000,000 | -H-D | M]

[2009/09/24 06:12:16 | 000,000,000 | -H-D | M] (No name found) -- C:\Documents and Settings\flabuski\Application Data\Mozilla\Extensions
[2012/02/10 13:11:36 | 000,000,000 | -H-D | M] (No name found) -- C:\Documents and Settings\flabuski\Application Data\Mozilla\Firefox\Profiles\89ohh2zp.default\extensions
[2010/06/18 07:13:05 | 000,000,000 | -H-D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\flabuski\Application Data\Mozilla\Firefox\Profiles\89ohh2zp.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2009/09/24 06:14:28 | 000,000,000 | -H-D | M] (IE Tab) -- C:\Documents and Settings\flabuski\Application Data\Mozilla\Firefox\Profiles\89ohh2zp.default\extensions\{77b819fa-95ad-4f2c-ac7c-486b356188a9}
[2011/12/02 15:27:39 | 000,000,000 | -H-D | M] (No name found) -- C:\Documents and Settings\flabuski\Application Data\Mozilla\Firefox\Profiles\89ohh2zp.default\extensions\{dc572301-7619-498c-a57d-39143191b318}
[2006/11/15 10:32:20 | 000,000,000 | -H-D | M] (Pinball) -- C:\Documents and Settings\flabuski\Application Data\Mozilla\Firefox\Profiles\89ohh2zp.default\extensions\{fb0cbf5b-695b-4322-8b49-5dedbfb946fc}
[2011/03/28 17:06:03 | 000,000,000 | -H-D | M] (IE Tab Plus) -- C:\Documents and Settings\flabuski\Application Data\Mozilla\Firefox\Profiles\89ohh2zp.default\extensions\ietab@ip.cn
[2012/02/10 13:11:36 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\flabuski\Application Data\Mozilla\Firefox\Profiles\89ohh2zp.default\extensions\staged
[2011/12/02 15:27:36 | 000,000,000 | -H-D | M] (No name found) -- C:\Documents and Settings\flabuski\Application Data\Mozilla\Firefox\Profiles\89ohh2zp.default\extensions\{dc572301-7619-498c-a57d-39143191b318}\chrome\content\extensions
[2011/12/02 15:27:35 | 000,000,000 | -H-D | M] (No name found) -- C:\Documents and Settings\flabuski\Application Data\Mozilla\Firefox\Profiles\89ohh2zp.default\extensions\{dc572301-7619-498c-a57d-39143191b318}\modules\extensions
[2012/01/27 18:42:26 | 000,000,000 | -H-D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2011/12/21 02:24:52 | 000,121,816 | -H-- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2008/09/29 07:07:00 | 000,022,576 | -H-- | M] (McAfee, Inc.) -- C:\Program Files\mozilla firefox\components\Scriptff.dll
[2007/03/09 18:16:44 | 000,189,496 | -H-- | M] (Yahoo! Inc.) -- C:\Program Files\mozilla firefox\plugins\npyaxmpb.dll
[2011/12/20 23:30:41 | 000,002,252 | -H-- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2011/12/20 23:30:41 | 000,002,040 | -H-- | M] () -- C:\Program Files\mozilla firefox\searchplugins\twitter.xml

O1 HOSTS File: ([2008/12/06 11:57:30 | 000,289,675 | RH-- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 9978 more lines...
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {AE6F2894-AF10-4C9C-B16E-1DFC6FF8C0C6} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found.
O4 - HKLM..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe (Ahead Software AG)
O4 - HKLM..\Run: [Intuit SyncManager] C:\Program Files\Common Files\Intuit\Sync\IntuitSyncManager.exe (Intuit Inc. All rights reserved.)
O4 - HKLM..\Run: [JbXDITATnUG.exe] C:\Documents and Settings\All Users\Application Data\JbXDITATnUG.exe ()
O4 - HKLM..\Run: [Logitech Hardware Abstraction Layer] C:\WINDOWS\KHALMNPR.Exe (Logitech Inc.)
O4 - HKLM..\Run: [McAfeeUpdaterUI] C:\Program Files\McAfee\Common Framework\UdaterUI.exe (McAfee, Inc.)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [ShStatEXE] C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE (McAfee, Inc.)
O4 - HKLM..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u File not found
O4 - HKCU..\Run: [HP Deskjet 3050A J611 series (NET)] C:\Program Files\HP\HP Deskjet 3050A J611 series\Bin\ScanToPCActivationApp.exe (Hewlett-Packard Co.)
O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSaveSettings = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: ClassicShell = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoThemesTab = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispAppearancePage = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoColorChoice = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoSizeChoice = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispBackgroundPage = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispScrSavPage = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispCPL = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoVisualStyleChoice = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispSettingsPage = 0
O8 - Extra context menu item: Append Link Target to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKLM\..Trusted Domains: polycom.com ([sololearning] * in Trusted sites)
O15 - HKCU\..Trusted Domains: ([]msn in My Computer)
O15 - HKCU\..Trusted Domains: intuit.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: intuit.com ([ttlc] https in Trusted sites)
O15 - HKCU\..Trusted Domains: polycom.com ([sololearning] * in Trusted sites)
O15 - HKCU\..Trusted Domains: turbotax.com ([]http in Trusted sites)
O15 - HKCU\..Trusted Domains: turbotax.com ([]https in Trusted sites)
O16 - DPF: {00000075-9980-0010-8000-00AA00389B71} http://codecs.microsoft.com/codecs/i386/voxacm.CAB (Reg Error: Key error.)
O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} http://components.metastream.com/MTSInstallers/MetaStream3.cab (Reg Error: Key error.)
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} http://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab (System Requirements Lab Class)
O16 - DPF: {1ED48504-8834-11D5-AC75-0008C73FD642} file://C:\Program Files\proeWildfire 2.0\i486_nt\obj\pvx_install.exe (Reg Error: Key error.)
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} http://software-dl.real.com/229e9dd730d4373b4218/netzip/RdxIE601.cab (Reg Error: Key error.)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1127918593153 (WUWebControl Class)
O16 - DPF: {74F5614A-8A8C-43B4-8CC2-4B4EFAF4A6C5} http://www.techsmith.com/codec/tsccinst.cab (TSCCInstall Class)
O16 - DPF: {9B17FE0E-51F2-4692-8B32-8EFB805FC0E7} http://h30155.www3.hp.com/ediags/gs/install/guidedsolutions.cab (Reg Error: Key error.)
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38142.310162037 (Reg Error: Key error.)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} https://useast.vpn.polycom.com/dana-cached/setup/JuniperSetupSP1.cab (JuniperSetupControlXP Class)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = andover.polycom.com
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{787DD999-424D-414C-A52C-C0FDEF49D59E}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{787DD999-424D-414C-A52C-C0FDEF49D59E}: Domain = andover.polycom.com
O18 - Protocol\Handler\intu-help-qb2 {84D77A00-41B5-4b8b-8ADF-86486D72E749} - C:\Program Files\Intuit\QuickBooks 2009\HelpAsyncPluggableProtocol.dll (Intuit, Inc.)
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\NavLogon: DllName - (Reg Error: Value error.) - Reg Error: Value error. File not found
O24 - Desktop Components:0 () - http://fivecent.com/Kittery%20Point/fog.JPG
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/06/04 07:55:22 | 000,000,000 | -H-- | M] () - C:\AUTOEXEC.AD3 -- [ NTFS ]
O32 - AutoRun File - [2009/02/22 12:26:02 | 000,000,001 | -H-- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2009/02/22 12:26:00 | 000,000,001 | -H-- | M] () - C:\AUTOEXEC.ZYX -- [ NTFS ]
O33 - MountPoints2\##Flabuskixpdell#D\Shell - "" = AutoRun
O33 - MountPoints2\##Flabuskixpdell#D\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\##Flabuskixpdell#D\Shell\AutoRun\command - "" = W:\loader.exe
O33 - MountPoints2\##Flabuskixpdell#D\Shell\langenglish\command - "" = W:\setup\i386\msetup.exe lang:english
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: Ip6FwHlp - File not found

MsConfig - Services: "Netlogon"
MsConfig - State: "system.ini" - 0
MsConfig - State: "win.ini" - 0
MsConfig - State: "bootini" - 0
MsConfig - State: "services" - 0
MsConfig - State: "startup" - 0

SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: McAfeeEngineService - C:\Program Files\McAfee\VirusScan Enterprise\engineserver.exe (McAfee, Inc.)
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: sermouse.sys - Driver
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vds - Service
SafeBootMin: vga.sys - Driver
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: nm - File not found
SafeBootNet: nm.sys - File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: sermouse.sys - Driver
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: UploadMgr - Service
SafeBootNet: vga.sys - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

ActiveX: {0291E591-EA41-4c82-8106-3DC6CE7F7664} - Reg Error: Value error.
ActiveX: {03F998B2-0E00-11D3-A498-00104B6EB52E} - Viewpoint Media Player
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Microsoft VM
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vector Graphics Rendering (VML)
ActiveX: {166B1BCA-3F9C-11CF-8075-444553540000} - Macromedia Shockwave Director 10.1
ActiveX: {1B00725B-C455-4DE6-BFB6-AD540AD427CD} - Viewpoint Media Player
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {2298d453-bcae-4519-bf33-1cbf3faf1524} - Q867801
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {2791EDB8-E7E8-5C3B-5E38-8EC20A54C65C} - Outlook Express
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2A202491-F00D-11cf-87CC-0020AFEECF20} - Macromedia Shockwave Director 10.1
ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906)
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {2cc9d512-6db6-4f1c-8979-9a41fae88de0} - Q837009
ActiveX: {2eac6a2d-57a8-44d4-96f7-e32bab40ca5f} - Windows Update
ActiveX: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} - Reg Error: Value error.
ActiveX: {347B0667-C7ED-429B-BDE3-CC8D3BACAA31} - Reg Error: Value error.
ActiveX: {36772A4B-4B55-B289-06C1-B1B6B023F6CC} - Vector Graphics Rendering (VML)
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML Data Binding for Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Advanced Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015C} - Microsoft DirectX
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {46B4E50E-588A-34A6-0B23-2A38A306DB4E} - Microsoft Windows Media Player 6.4
ActiveX: {4E9E44F1-3246-30D3-5B30-A684E7201CE1} - DirectAnimation
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5DC6D147-9D41-B295-9C0A-F5FD88C4F517} - Outlook Express
ActiveX: {5f3c70b3-ac2f-432c-8f9c-1624df61f54f} - Microsoft Data Access Components KB870669
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6B5DBCFC-3EB1-AF7B-80B0-A3166568756A} - Microsoft Windows Media Player 6.4
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Web Folders
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {795d0712-722c-43ec-906a-fc5e678eada9} - Q831167
ActiveX: {839117ee-2132-4bae-a56a-42b50204c9b9} - KB889293
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install
ActiveX: {9046251B-E0FE-2E07-BB71-3D9322D83DD0} - Internet Explorer Version Update
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {A0739DE2-571F-11D2-A031-0060977F760C} - InterActual PCFriendly ActiveX Control
ActiveX: {abcdf74f-9a64-4e6e-b8eb-6e5a41de6550} -
ActiveX: {AE96E699-7A24-6AAE-66C3-82B01DF0B855} - Microsoft VM
ActiveX: {B508B3F1-A24A-32C0-B310-85786919EF28} - .NET Framework
ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Task Scheduler
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {DF3D4489-A5E6-EFE6-E0AE-81A261859E1A} - NetShow
ActiveX: {E76C8A2D-3322-6892-B739-E8CB86C26C8F} - Viewpoint Media Player
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {eddbec60-89cb-44ef-8291-0850fd28ff6a} - Q832894
ActiveX: {EFCE7BE0-510E-4932-9475-F44CD90DE16A} - Microsoft .NET Framework 1.1 Security Update (KB2572067)
ActiveX: {f5173cf0-1dfb-4978-8e50-a90169ee7ca9} - Q823353
ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.PLCMg722 - C:\WINDOWS\System32\PLCMg722.acm (Polycom, Inc)
Drivers32: msacm.PLCMg728 - C:\WINDOWS\System32\PLCMg728.acm (Polycom, Inc)
Drivers32: msacm.PLCMg729A - C:\WINDOWS\System32\PLCMg729A.acm (Polycom, Inc)
Drivers32: msacm.PLCMsiren - C:\WINDOWS\System32\PLCMsiren.acm (Polycom, Inc)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: msacm.voxacm160 - C:\WINDOWS\System32\vct3216.acm (Voxware, Inc.)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: SENTINEL - C:\WINDOWS\System32\SNTI386.DLL ()
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.I420 - lvcodec2.dll File not found
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: vidc.LEAD - LCODCCMP.DLL File not found
Drivers32: vidc.tscc - C:\WINDOWS\System32\tsccvid.dll (TechSmith Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2012/02/10 13:16:57 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\OTL.com
[2012/02/10 13:08:14 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\flabuski\Recent
[2012/02/10 09:41:11 | 000,000,000 | ---D | C] -- C:\Documents and Settings\flabuski\Start Menu\Programs\System Check
[2012/01/24 04:38:03 | 000,404,640 | -H-- | C] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2012/01/20 18:59:01 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\flabuski\Local Settings\Application Data\Temp
[2012/01/20 18:59:00 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Google
[2012/01/20 18:55:16 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Defraggler
[2012/01/20 18:55:15 | 000,000,000 | -H-D | C] -- C:\Program Files\Defraggler
[2012/01/20 18:54:58 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Google
[2012/01/20 11:57:09 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\flabuski\Local Settings\Application Data\PCHealth
[8 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[6 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/02/10 13:16:38 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\OTL.com
[2012/02/10 13:13:01 | 000,000,890 | -H-- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2012/02/10 10:44:01 | 000,000,466 | -H-- | M] () -- C:\WINDOWS\tasks\At3.job
[2012/02/10 10:13:15 | 000,000,886 | -H-- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2012/02/10 10:10:02 | 000,000,466 | -H-- | M] () -- C:\WINDOWS\tasks\At1.job
[2012/02/10 09:41:12 | 000,000,853 | ---- | M] () -- C:\Documents and Settings\flabuski\Application Data\Microsoft\Internet Explorer\Quick Launch\System Check.lnk
[2012/02/10 09:41:12 | 000,000,835 | ---- | M] () -- C:\Documents and Settings\flabuski\Desktop\System Check.lnk
[2012/02/10 09:41:01 | 000,350,208 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\YBVnqA2N9ixpKP.exe
[2012/02/10 09:30:44 | 000,001,687 | -H-- | M] () -- C:\Documents and Settings\flabuski\Start Menu\Programs\Startup\Monitor Ink Alerts - HP Deskjet 3050A J611 series (Network).lnk
[2012/02/10 09:28:39 | 000,002,206 | -H-- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012/02/10 09:24:09 | 008,405,015 | -H-- | M] () -- C:\WINDOWS\TempFile
[2012/02/10 09:23:55 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012/02/10 09:00:54 | 000,441,344 | -H-- | M] () -- C:\Documents and Settings\All Users\Application Data\JbXDITATnUG.exe
[2012/02/04 12:23:14 | 000,000,960 | -H-- | M] () -- C:\WINDOWS\QUICKEN.INI
[2012/01/28 20:40:00 | 000,000,466 | -H-- | M] () -- C:\WINDOWS\tasks\At2.job
[2012/01/28 19:05:02 | 000,000,284 | -H-- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2012/01/28 14:00:00 | 000,000,466 | -H-- | M] () -- C:\WINDOWS\tasks\At4.job
[2012/01/27 09:51:22 | 000,001,960 | -H-- | M] () -- C:\Documents and Settings\flabuski\plugin131.trace
[2012/01/24 04:38:03 | 000,404,640 | -H-- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2012/01/20 19:00:54 | 000,001,592 | -H-- | M] () -- C:\WINDOWS\VPNUnInstall.MIF
[2012/01/20 11:43:57 | 000,001,374 | -H-- | M] () -- C:\WINDOWS\imsins.BAK
[2012/01/20 11:37:35 | 000,441,890 | -H-- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2012/01/20 11:37:35 | 000,071,700 | -H-- | M] () -- C:\WINDOWS\System32\perfc009.dat
[8 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[6 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/02/10 09:41:12 | 000,000,853 | ---- | C] () -- C:\Documents and Settings\flabuski\Application Data\Microsoft\Internet Explorer\Quick Launch\System Check.lnk
[2012/02/10 09:41:12 | 000,000,835 | ---- | C] () -- C:\Documents and Settings\flabuski\Desktop\System Check.lnk
[2012/02/10 09:41:01 | 000,350,208 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\YBVnqA2N9ixpKP.exe
[2012/02/10 09:04:08 | 000,441,344 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\JbXDITATnUG.exe
[2012/01/20 18:58:26 | 000,001,592 | -H-- | C] () -- C:\WINDOWS\VPNUnInstall.MIF
[2012/01/20 18:54:52 | 000,000,890 | -H-- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2012/01/20 18:54:52 | 000,000,886 | -H-- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/08/12 09:44:17 | 001,841,000 | -H-- | C] () -- C:\WINDOWS\System32\HPScanTRDrv_DJ3050A_J611.dll
[2011/08/12 09:43:11 | 000,000,057 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\Ament.ini
[2011/03/01 21:13:42 | 001,348,024 | -H-- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2010/03/22 21:50:26 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat
[2009/05/15 15:44:25 | 000,000,090 | -H-- | C] () -- C:\WINDOWS\QBChanUtil_Trigger.ini
[2009/03/15 08:24:24 | 000,000,008 | -H-- | C] () -- C:\WINDOWS\System32\nvModes.dat
[2008/06/06 08:57:52 | 000,000,280 | -H-- | C] () -- C:\WINDOWS\System32\epoPGPsdk.dll.sig
[2008/04/30 16:18:05 | 000,016,384 | -H-- | C] () -- C:\WINDOWS\System32\FileOps.exe
[2008/03/21 12:40:47 | 000,063,730 | -H-- | C] () -- C:\Program Files\viewsonicinstruct_xp.pdf
[2008/03/21 12:39:50 | 000,000,088 | -H-- | C] () -- C:\WINDOWS\VSWizard.ini
[2007/11/30 11:32:38 | 000,561,152 | RH-- | C] () -- C:\WINDOWS\System32\hpotscl.dll
[2007/11/21 14:45:28 | 000,000,022 | -H-- | C] () -- C:\WINDOWS\INTUSB.DAT
[2007/11/21 12:17:51 | 000,000,185 | -H-- | C] () -- C:\WINDOWS\intuprof.ini
[2007/11/21 12:17:50 | 000,000,960 | -H-- | C] () -- C:\WINDOWS\QUICKEN.INI
[2007/11/21 12:17:49 | 000,007,406 | -H-- | C] () -- C:\WINDOWS\ICOADB32.DAT
[2007/10/29 14:57:00 | 001,018,772 | -H-- | C] () -- C:\WINDOWS\System32\nvucode.bin
[2007/10/29 14:57:00 | 000,286,720 | -H-- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll
[2007/03/19 07:37:15 | 000,000,214 | -H-- | C] () -- C:\WINDOWS\HP_48BitScanUpdatePatch.ini
[2007/01/19 14:29:42 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\VPC32.INI
[2006/11/15 13:27:40 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\eDrawingOfficeAutomator.INI
[2006/06/15 06:48:54 | 000,000,206 | -H-- | C] () -- C:\WINDOWS\HPGdiPlus.ini
[2006/06/13 16:35:32 | 000,053,760 | -H-- | C] () -- C:\WINDOWS\System32\zlib.dll
[2006/02/28 14:57:38 | 000,000,131 | -H-- | C] () -- C:\Documents and Settings\flabuski\Local Settings\Application Data\fusioncache.dat
[2005/11/04 10:21:24 | 000,189,480 | -H-- | C] () -- C:\WINDOWS\System32\CSGina.dll
[2005/10/11 06:53:49 | 000,000,048 | -H-- | C] () -- C:\WINDOWS\avwin.ini
[2005/10/05 10:00:36 | 000,000,165 | -H-- | C] () -- C:\WINDOWS\KPCMS.INI
[2005/09/28 10:26:02 | 000,004,569 | -H-- | C] () -- C:\WINDOWS\System32\secupd.dat
[2005/07/01 07:01:04 | 000,000,617 | -H-- | C] () -- C:\WINDOWS\System32\NTS5CSET.INI
[2005/05/25 13:55:12 | 000,000,383 | -H-- | C] () -- C:\WINDOWS\System32\haspdos.sys
[2005/05/25 13:55:10 | 000,073,216 | -H-- | C] () -- C:\WINDOWS\System32\drivers\SENTINEL.SYS
[2005/05/25 13:55:10 | 000,047,616 | -H-- | C] () -- C:\WINDOWS\System32\SNTI386.DLL
[2005/05/25 13:55:10 | 000,017,920 | -H-- | C] () -- C:\WINDOWS\System32\RNBOVDD.DLL
[2005/05/18 10:14:18 | 000,363,520 | -H-- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2005/05/18 10:12:00 | 000,003,972 | -H-- | C] () -- C:\WINDOWS\System32\drivers\PciBus.sys
[2005/05/17 13:46:03 | 000,000,011 | -H-- | C] () -- C:\WINDOWS\avx.ini
[2005/05/16 07:37:11 | 000,012,062 | -H-- | C] () -- C:\WINDOWS\System32\drivers\MTictwl.sys
[2005/04/27 23:22:38 | 003,596,288 | -H-- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2005/04/27 23:22:34 | 000,831,488 | -H-- | C] () -- C:\WINDOWS\System32\libeay32.dll
[2005/04/27 23:22:34 | 000,159,744 | -H-- | C] () -- C:\WINDOWS\System32\ssleay32.dll
[2005/03/14 13:25:20 | 000,000,360 | -H-- | C] () -- C:\WINDOWS\modelcheck.INI
[2005/02/23 09:05:02 | 000,000,200 | -H-- | C] () -- C:\WINDOWS\usta33.ini
[2005/01/27 07:24:18 | 000,000,045 | -H-- | C] () -- C:\WINDOWS\GJEGJOIQ.ini
[2005/01/26 22:59:32 | 000,000,017 | -H-- | C] () -- C:\WINDOWS\wininit.ini
[2005/01/24 13:57:10 | 000,000,025 | -H-- | C] () -- C:\WINDOWS\cdplayer.ini
[2005/01/13 08:10:55 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\OPPRIN~1.INI
[2004/11/12 09:34:50 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\pcfriend.INI
[2004/11/10 15:07:45 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\nsreg.dat
[2004/11/10 15:06:49 | 000,004,526 | -H-- | C] () -- C:\WINDOWS\mozver.dat
[2004/10/26 08:39:26 | 000,020,549 | -H-- | C] () -- C:\WINDOWS\System32\javaw.exe
[2004/10/26 08:39:26 | 000,020,547 | -H-- | C] () -- C:\WINDOWS\System32\java.exe
[2004/10/26 08:38:54 | 000,000,011 | -H-- | C] () -- C:\WINDOWS\System32\Pctl.ini
[2004/10/26 08:38:36 | 000,659,507 | -H-- | C] () -- C:\WINDOWS\System32\RedlineCtrl.dll
[2004/10/26 08:38:36 | 000,041,027 | -H-- | C] () -- C:\WINDOWS\System32\reportmanager.dll
[2004/10/26 08:38:34 | 001,351,745 | -H-- | C] () -- C:\WINDOWS\System32\agileobjects.dll
[2004/10/26 08:38:34 | 000,770,111 | -H-- | C] () -- C:\WINDOWS\System32\agilereport.dll
[2004/10/26 08:38:34 | 000,282,669 | -H-- | C] () -- C:\WINDOWS\System32\AgPCS.dll
[2004/10/06 07:10:28 | 000,058,880 | -H-- | C] () -- C:\WINDOWS\UnInstallX.exe
[2004/09/29 12:40:10 | 000,528,384 | -H-- | C] () -- C:\WINDOWS\System32\BladeEnc.dll
[2004/09/29 12:40:10 | 000,120,832 | -H-- | C] () -- C:\WINDOWS\System32\ShnDll32.dll
[2004/08/24 12:27:02 | 000,000,049 | -H-- | C] () -- C:\WINDOWS\NeroDigital.ini
[2004/08/02 19:03:00 | 001,703,936 | -H-- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
[2004/08/02 19:03:00 | 001,630,208 | -H-- | C] () -- C:\WINDOWS\System32\nwiz.exe
[2004/08/02 19:03:00 | 001,486,848 | -H-- | C] () -- C:\WINDOWS\System32\nview.dll
[2004/08/02 19:03:00 | 001,339,392 | -H-- | C] () -- C:\WINDOWS\System32\nvdspsch.exe
[2004/08/02 19:03:00 | 001,019,904 | -H-- | C] () -- C:\WINDOWS\System32\nvwimg.dll
[2004/08/02 19:03:00 | 000,466,944 | -H-- | C] () -- C:\WINDOWS\System32\nvshell.dll
[2004/08/02 19:03:00 | 000,442,368 | -H-- | C] () -- C:\WINDOWS\System32\nvappbar.exe
[2004/08/02 19:03:00 | 000,425,984 | -H-- | C] () -- C:\WINDOWS\System32\keystone.exe
[2004/08/02 19:03:00 | 000,102,441 | -H-- | C] () -- C:\WINDOWS\System32\getvpd.dll
[2004/08/02 19:03:00 | 000,061,440 | -H-- | C] () -- C:\WINDOWS\System32\getvpdc.exe
[2004/08/02 19:03:00 | 000,028,672 | -H-- | C] () -- C:\WINDOWS\System32\pmemw.dll
[2004/07/14 14:48:21 | 000,034,845 | -H-- | C] () -- C:\Program Files\SolidWorksswxJRNL.BAK
[2004/07/09 13:42:12 | 000,001,112 | -H-- | C] () -- C:\WINDOWS\System32\vh.dat
[2004/07/06 07:00:04 | 000,210,944 | -H-- | C] () -- C:\WINDOWS\System32\MSVCRT10.DLL
[2004/06/29 14:48:31 | 000,000,643 | -H-- | C] () -- C:\WINDOWS\dmw.ini
[2004/06/29 10:44:18 | 000,000,552 | -H-- | C] () -- C:\WINDOWS\System32\d3d8caps.dat
[2004/06/23 14:43:25 | 000,006,592 | -H-- | C] () -- C:\WINDOWS\gwpreset.ini
[2004/06/23 14:43:25 | 000,001,741 | -H-- | C] () -- C:\WINDOWS\goldwave.ini
[2004/06/08 13:08:57 | 000,184,832 | -H-- | C] () -- C:\Documents and Settings\flabuski\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2004/06/08 09:15:44 | 000,000,060 | -H-- | C] () -- C:\WINDOWS\wpd99.drv
[2004/06/08 09:15:23 | 000,000,028 | -H-- | C] () -- C:\WINDOWS\pdf995.ini
[2004/06/08 08:12:54 | 000,006,550 | -H-- | C] () -- C:\WINDOWS\jautoexp.dat
[2004/06/07 07:59:28 | 000,374,784 | -H-- | C] () -- C:\WINDOWS\3DG32.DLL
[2004/06/07 07:59:28 | 000,000,250 | -H-- | C] () -- C:\WINDOWS\3DR.INI
[2004/06/07 07:40:06 | 000,000,009 | -H-- | C] () -- C:\WINDOWS\winhelp.ini
[2004/06/04 15:30:20 | 000,051,716 | -H-- | C] () -- C:\WINDOWS\System32\pdf995mon.dll
[2004/06/04 15:23:08 | 000,000,147 | -H-- | C] () -- C:\WINDOWS\RtlRack.ini
[2004/06/04 15:15:52 | 000,000,164 | -H-- | C] () -- C:\WINDOWS\avrack.ini
[2004/06/04 13:53:06 | 000,000,065 | -H-- | C] () -- C:\WINDOWS\iTouch.ini
[2004/06/04 13:51:42 | 000,081,920 | RH-- | C] () -- C:\WINDOWS\bwUnin-6.1.4.36-8876480L.exe
[2004/06/04 12:39:39 | 000,000,376 | -H-- | C] () -- C:\WINDOWS\ODBC.INI
[2004/06/04 10:37:42 | 000,001,804 | -H-- | C] () -- C:\WINDOWS\System32\dcache.bin
[2004/06/04 07:57:48 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2004/06/04 07:52:28 | 000,021,640 | -H-- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2004/06/04 03:41:52 | 000,004,161 | -H-- | C] () -- C:\WINDOWS\ODBCINST.INI
[2004/06/04 03:40:55 | 000,333,288 | -H-- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2004/04/23 14:17:02 | 000,000,061 | -H-- | C] () -- C:\WINDOWS\System32\uninstall.ini
[2004/03/18 08:44:29 | 001,663,068 | -H-- | C] () -- C:\WINDOWS\System32\libmmd.dll
[2002/03/28 03:26:00 | 000,060,416 | -H-- | C] () -- C:\WINDOWS\sxstall2.exe
[2001/08/23 07:00:00 | 013,107,200 | -H-- | C] () -- C:\WINDOWS\System32\oembios.bin
[2001/08/23 07:00:00 | 000,673,088 | -H-- | C] () -- C:\WINDOWS\System32\mlang.dat
[2001/08/23 07:00:00 | 000,441,890 | -H-- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2001/08/23 07:00:00 | 000,272,128 | -H-- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2001/08/23 07:00:00 | 000,218,003 | -H-- | C] () -- C:\WINDOWS\System32\dssec.dat
[2001/08/23 07:00:00 | 000,071,700 | -H-- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2001/08/23 07:00:00 | 000,046,258 | -H-- | C] () -- C:\WINDOWS\System32\mib.bin
[2001/08/23 07:00:00 | 000,028,626 | -H-- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2001/08/23 07:00:00 | 000,004,463 | -H-- | C] () -- C:\WINDOWS\System32\oembios.dat
[2001/08/23 07:00:00 | 000,000,741 | -H-- | C] () -- C:\WINDOWS\System32\noise.dat
[1999/01/27 12:39:06 | 000,065,024 | -H-- | C] () -- C:\WINDOWS\System32\indounin.dll
[1998/10/11 01:07:38 | 000,088,576 | -H-- | C] () -- C:\WINDOWS\System32\Iticheck.dll
[1997/06/13 06:56:08 | 000,056,832 | -H-- | C] () -- C:\WINDOWS\System32\Iyvu9_32.dll

========== Custom Scans ==========


< %APPDATA%\Microsoft\*.* >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %USERPROFILE%\Desktop\*.exe >
[1999/10/30 21:54:32 | 000,561,152 | -H-- | M] (Joshua F. Madison) -- C:\Documents and Settings\flabuski\Desktop\Convert.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\winn32\*.* >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.exe >
[2011/12/21 02:24:51 | 000,125,912 | -H-- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\crashreporter.exe
[2011/12/21 02:24:51 | 000,924,632 | -H-- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
[2011/12/21 02:24:51 | 000,016,856 | -H-- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\plugin-container.exe
[2011/12/21 02:24:51 | 000,269,272 | -H-- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\updater.exe

< %ProgramFiles%\TinyProxy. >

< %systemroot%\system32\*.* /lockedfiles >
[6 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.* /lockedfiles >

< %PROGRAMFILES%\*. >
[2004/06/09 14:02:58 | 000,000,000 | -H-D | M] -- C:\Program Files\3DLogix
[2005/05/16 07:41:32 | 000,000,000 | -H-D | M] -- C:\Program Files\Abrosoft FantaMorph
[2004/06/23 12:42:16 | 000,000,000 | -H-D | M] -- C:\Program Files\Actify
[2011/08/05 14:10:20 | 000,000,000 | -H-D | M] -- C:\Program Files\Adobe
[2005/08/19 07:00:21 | 000,000,000 | -H-D | M] -- C:\Program Files\Adobe Type Manager
[2007/12/02 09:37:16 | 000,000,000 | -H-D | M] -- C:\Program Files\Ahead
[2009/05/15 14:11:50 | 000,000,000 | -H-D | M] -- C:\Program Files\Akamai
[2010/12/24 13:50:15 | 000,000,000 | -H-D | M] -- C:\Program Files\Amazon
[2008/09/19 06:24:42 | 000,000,000 | -H-D | M] -- C:\Program Files\Apple Software Update
[2004/06/04 15:15:52 | 000,000,000 | -H-D | M] -- C:\Program Files\Avance Sound Manager
[2004/06/04 15:15:52 | 000,000,000 | -H-D | M] -- C:\Program Files\AvRack
[2006/12/13 11:06:47 | 000,000,000 | -H-D | M] -- C:\Program Files\BigFix Enterprise
[2009/04/11 18:57:28 | 000,000,000 | -H-D | M] -- C:\Program Files\Bonjour
[2011/07/26 09:54:12 | 000,000,000 | -H-D | M] -- C:\Program Files\CCleaner
[2007/11/15 15:04:55 | 000,000,000 | -H-D | M] -- C:\Program Files\Cisco Systems
[2012/01/20 19:00:49 | 000,000,000 | -H-D | M] -- C:\Program Files\Common Files
[2004/06/04 07:52:19 | 000,000,000 | -H-D | M] -- C:\Program Files\ComPlus Applications
[2004/10/25 13:17:56 | 000,000,000 | -H-D | M] -- C:\Program Files\crossrefdemo
[2012/01/20 18:55:17 | 000,000,000 | -H-D | M] -- C:\Program Files\Defraggler
[2004/06/04 14:47:59 | 000,000,000 | -H-D | M] -- C:\Program Files\DriverGuide Toolkit
[2005/10/07 07:15:12 | 000,000,000 | -H-D | M] -- C:\Program Files\Floating Point Solutions
[2004/08/10 06:51:50 | 000,000,000 | -H-D | M] -- C:\Program Files\GoldWave
[2012/01/21 11:56:59 | 000,000,000 | -H-D | M] -- C:\Program Files\Google
[2007/12/07 13:37:36 | 000,000,000 | -H-D | M] -- C:\Program Files\Hewlett-Packard
[2004/06/04 12:20:21 | 000,000,000 | -H-D | M] -- C:\Program Files\HighMAT CD Writing Wizard
[2011/08/12 09:43:21 | 000,000,000 | -H-D | M] -- C:\Program Files\HP
[2005/10/12 12:45:07 | 000,000,000 | -H-D | M] -- C:\Program Files\ImageServer
[2011/06/04 09:16:58 | 000,000,000 | -H-D | M] -- C:\Program Files\InstallShield Installation Information
[2006/02/28 14:57:15 | 000,000,000 | -H-D | M] -- C:\Program Files\Interactive Intelligence
[2011/12/20 19:09:22 | 000,000,000 | -H-D | M] -- C:\Program Files\Internet Explorer
[2009/05/15 15:46:48 | 000,000,000 | -H-D | M] -- C:\Program Files\Intuit
[2004/06/07 10:40:55 | 000,000,000 | -H-D | M] -- C:\Program Files\Java
[2004/10/26 08:39:16 | 000,000,000 | -H-D | M] -- C:\Program Files\JavaSoft
[2009/07/16 07:21:18 | 000,000,000 | -H-D | M] -- C:\Program Files\Juniper Networks
[2004/10/25 13:14:49 | 000,000,000 | -H-D | M] -- C:\Program Files\KtsPowerDemo
[2007/11/18 11:01:08 | 000,000,000 | -H-D | M] -- C:\Program Files\Logitech
[2012/02/10 09:44:43 | 000,000,000 | -H-D | M] -- C:\Program Files\Malwarebytes' Anti-Malware
[2004/11/18 09:43:41 | 000,000,000 | -H-D | M] -- C:\Program Files\Maxthon
[2008/06/06 09:14:39 | 000,000,000 | -H-D | M] -- C:\Program Files\McAfee
[2011/04/15 07:48:20 | 000,000,000 | -H-D | M] -- C:\Program Files\Messenger
[2004/09/29 12:40:10 | 000,000,000 | -H-D | M] -- C:\Program Files\Michael K. Weise
[2004/06/04 12:37:55 | 000,000,000 | -H-D | M] -- C:\Program Files\Microsoft ActiveSync
[2005/10/24 06:47:27 | 000,000,000 | -H-D | M] -- C:\Program Files\Microsoft AntiSpyware
[2004/06/04 07:55:45 | 000,000,000 | -H-D | M] -- C:\Program Files\microsoft frontpage
[2008/03/14 13:36:58 | 000,000,000 | -H-D | M] -- C:\Program Files\Microsoft Office
[2004/06/04 12:37:08 | 000,000,000 | -H-D | M] -- C:\Program Files\Microsoft Visual Studio
[2011/06/13 16:30:14 | 000,000,000 | -H-D | M] -- C:\Program Files\Microsoft Visual Studio 8
[2004/11/22 10:25:10 | 000,000,000 | -H-D | M] -- C:\Program Files\Microsoft.NET
[2011/04/15 12:39:00 | 000,000,000 | -H-D | M] -- C:\Program Files\Movie Maker
[2012/01/27 18:42:22 | 000,000,000 | -H-D | M] -- C:\Program Files\Mozilla Firefox
[2008/03/14 13:35:41 | 000,000,000 | -H-D | M] -- C:\Program Files\MSBuild
[2008/03/14 13:36:43 | 000,000,000 | -H-D | M] -- C:\Program Files\MSECache
[2004/06/04 07:52:05 | 000,000,000 | -H-D | M] -- C:\Program Files\MSN
[2004/06/04 07:51:51 | 000,000,000 | -H-D | M] -- C:\Program Files\MSN Gaming Zone
[2004/06/16 07:08:49 | 000,000,000 | -H-D | M] -- C:\Program Files\MSXML 4.0
[2008/03/15 22:29:24 | 000,000,000 | -H-D | M] -- C:\Program Files\MSXML 6.0
[2011/04/15 07:33:39 | 000,000,000 | -H-D | M] -- C:\Program Files\NetMeeting
[2006/03/07 14:45:45 | 000,000,000 | -H-D | M] -- C:\Program Files\NetworkStreaming
[2011/04/20 21:46:32 | 000,000,000 | -H-D | M] -- C:\Program Files\NVIDIA Corporation
[2004/06/04 07:54:03 | 000,000,000 | -H-D | M] -- C:\Program Files\Online Services
[2011/04/15 12:52:35 | 000,000,000 | -H-D | M] -- C:\Program Files\Outlook Express
[2006/02/13 16:45:45 | 000,000,000 | -H-D | M] -- C:\Program Files\Overland
[2004/11/12 10:20:27 | 000,000,000 | -H-D | M] -- C:\Program Files\PCFriendly
[2011/06/04 09:36:39 | 000,000,000 | -H-D | M] -- C:\Program Files\pdf995
[2005/10/05 10:01:18 | 000,000,000 | -H-D | M] -- C:\Program Files\PhotoDeluxe HE 3.1
[2005/05/16 07:49:00 | 000,000,000 | -H-D | M] -- C:\Program Files\Pinnacle
[2004/06/25 14:20:08 | 000,000,000 | -H-D | M] -- C:\Program Files\Portrait Displays
[2011/12/10 17:52:49 | 000,000,000 | -H-D | M] -- C:\Program Files\QUICKENW
[2004/06/22 13:44:00 | 000,000,000 | -H-D | M] -- C:\Program Files\Real
[2008/03/14 13:30:38 | 000,000,000 | -H-D | M] -- C:\Program Files\Reference Assemblies
[2004/06/04 12:08:59 | 000,000,000 | -H-D | M] -- C:\Program Files\Robocopy
[2005/05/16 08:09:31 | 000,000,000 | -H-D | M] -- C:\Program Files\SEC
[2009/09/23 20:07:59 | 000,000,000 | -H-D | M] -- C:\Program Files\SG2
[2009/01/07 14:38:47 | 000,000,000 | -H-D | M] -- C:\Program Files\SkyGolf
[2005/08/08 07:34:34 | 000,000,000 | -H-D | M] -- C:\Program Files\SmartFTP Client Setup Files
[2005/02/08 15:15:36 | 000,000,000 | -H-D | M] -- C:\Program Files\SmartFTP Setup Files
[2008/03/14 13:40:12 | 000,000,000 | -H-D | M] -- C:\Program Files\SolidWorks
[2005/10/07 07:15:31 | 000,000,000 | -H-D | M] -- C:\Program Files\SYCODE
[2008/06/06 09:14:12 | 000,000,000 | -H-D | M] -- C:\Program Files\Symantec
[2007/01/18 15:11:30 | 000,000,000 | -H-D | M] -- C:\Program Files\Symantec_Client_Security
[2008/03/21 12:55:32 | 000,000,000 | -H-D | M] -- C:\Program Files\SystemRequirementsLab
[2011/03/01 17:23:03 | 000,000,000 | -H-D | M] -- C:\Program Files\TurboTax
[2005/05/25 14:59:44 | 000,000,000 | -H-D | M] -- C:\Program Files\Uninstall Information
[2007/12/02 09:13:40 | 000,000,000 | -H-D | M] -- C:\Program Files\VideoLAN
[2008/03/21 12:50:50 | 000,000,000 | -H-D | M] -- C:\Program Files\viewsonic
[2009/05/01 11:33:58 | 000,000,000 | -H-D | M] -- C:\Program Files\vso
[2007/11/16 14:56:31 | 000,000,000 | -H-D | M] -- C:\Program Files\Windows Desktop Search
[2004/06/07 09:35:39 | 000,000,000 | -H-D | M] -- C:\Program Files\Windows Journal Viewer
[2010/03/29 17:28:52 | 000,000,000 | -H-D | M] -- C:\Program Files\Windows Media Connect 2
[2011/04/15 07:33:35 | 000,000,000 | -H-D | M] -- C:\Program Files\Windows Media Player
[2011/04/15 07:33:34 | 000,000,000 | -H-D | M] -- C:\Program Files\Windows NT
[2004/08/13 02:16:29 | 000,000,000 | -H-D | M] -- C:\Program Files\WindowsUpdate
[2006/06/11 01:18:37 | 000,000,000 | -H-D | M] -- C:\Program Files\WinRAR
[2004/08/26 14:33:41 | 000,000,000 | -H-D | M] -- C:\Program Files\WinZip
[2004/06/04 07:55:46 | 000,000,000 | -H-D | M] -- C:\Program Files\xerox
[2011/04/15 06:18:46 | 000,000,000 | -H-D | M] -- C:\Program Files\Yahoo!


< MD5 for: AGP440.SYS >
[2005/09/28 12:03:59 | 022,245,337 | -H-- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2011/04/15 07:19:47 | 023,852,652 | -H-- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2005/09/28 12:03:59 | 022,245,337 | -H-- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp2.cab:AGP440.sys
[2011/04/15 07:19:47 | 023,852,652 | -H-- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
[2008/04/13 13:36:38 | 000,042,368 | -H-- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008/04/13 13:36:38 | 000,042,368 | -H-- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys
[2004/08/04 01:07:41 | 000,042,368 | -H-- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB -- C:\WINDOWS\$NtServicePackUninstall$\agp440.sys
[2004/08/04 01:07:41 | 000,042,368 | -H-- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB -- C:\WINDOWS\system32\ReinstallBackups\0006\DriverFiles\i386\AGP440.SYS

< MD5 for: ATAPI.SYS >
[2002/08/29 02:50:10 | 010,158,890 | -H-- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp1.cab:atapi.sys
[2005/09/28 12:03:59 | 022,245,337 | -H-- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2011/04/15 07:19:47 | 023,852,652 | -H-- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2002/08/29 02:50:10 | 010,158,890 | -H-- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp1.cab:atapi.sys
[2005/09/28 12:03:59 | 022,245,337 | -H-- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp2.cab:atapi.sys
[2011/04/15 07:19:47 | 023,852,652 | -H-- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2008/04/13 13:40:30 | 000,096,512 | -H-- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008/04/13 13:40:30 | 000,096,512 | -H-- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
[2004/08/04 00:59:42 | 000,095,360 | -H-- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys

< MD5 for: DISK.SYS >
[2002/08/29 02:50:10 | 010,158,890 | -H-- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp1.cab:disk.sys
[2005/09/28 12:03:59 | 022,245,337 | -H-- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:disk.sys
[2011/04/15 07:19:47 | 023,852,652 | -H-- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:disk.sys
[2002/08/29 02:50:10 | 010,158,890 | -H-- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp1.cab:disk.sys
[2005/09/28 12:03:59 | 022,245,337 | -H-- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp2.cab:disk.sys
[2011/04/15 07:19:47 | 023,852,652 | -H-- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:disk.sys
[2004/08/04 00:59:54 | 000,036,352 | -H-- | M] (Microsoft Corporation) MD5=00CA44E4534865F8A3B64F7C0984BFF0 -- C:\WINDOWS\$NtServicePackUninstall$\disk.sys
[2008/04/13 13:40:47 | 000,036,352 | -H-- | M] (Microsoft Corporation) MD5=044452051F3E02E7963599FC8F4F3E25 -- C:\WINDOWS\ServicePackFiles\i386\disk.sys
[2008/04/13 13:40:47 | 000,036,352 | -H-- | M] (Microsoft Corporation) MD5=044452051F3E02E7963599FC8F4F3E25 -- C:\WINDOWS\system32\drivers\disk.sys

< MD5 for: NETLOGON.DLL >
[2008/04/13 19:12:01 | 000,407,040 | -H-- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008/04/13 19:12:01 | 000,407,040 | -H-- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\system32\netlogon.dll
[2009/02/06 13:46:09 | 000,408,064 | -H-- | M] (Microsoft Corporation) MD5=6C476D33D82F1054849790181E8F7772 -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll
[2004/08/04 02:56:44 | 000,407,040 | -H-- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A -- C:\WINDOWS\$NtUninstallKB968389_0$\netlogon.dll

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2012-02-04 17:25:21

< hklm\software\clients\startmenuinternet|command /rs >
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\firefox.exe\InstallInfo\\HideIconsCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /HideShortcuts [2011/12/21 02:24:52 | 000,715,216 | -H-- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\firefox.exe\InstallInfo\\ReinstallCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /SetAsDefaultAppGlobal [2011/12/21 02:24:52 | 000,715,216 | -H-- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\firefox.exe\InstallInfo\\ShowIconsCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /ShowShortcuts [2011/12/21 02:24:52 | 000,715,216 | -H-- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\firefox.exe\shell\open\command\\: C:\Program Files\Mozilla Firefox\firefox.exe [2011/12/21 02:24:51 | 000,924,632 | -H-- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\firefox.exe\shell\properties\command\\: "C:\Program Files\Mozilla Firefox\firefox.exe" -preferences [2011/12/21 02:24:51 | 000,924,632 | -H-- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\firefox.exe\shell\safemode\command\\: "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode [2011/12/21 02:24:51 | 000,924,632 | -H-- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ReinstallCommand: "C:\WINDOWS\system32\ie4uinit.exe" -reinstall [2011/11/04 06:24:17 | 000,174,080 | -H-- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\HideIconsCommand: "C:\WINDOWS\system32\ie4uinit.exe" -hide [2011/11/04 06:24:17 | 000,174,080 | -H-- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ShowIconsCommand: "C:\WINDOWS\system32\ie4uinit.exe" -show [2011/11/04 06:24:17 | 000,174,080 | -H-- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\naom\command\\: "C:\Program Files\Internet Explorer\iexplore.exe" -extoff [2009/03/08 13:09:26 | 000,638,816 | -H-- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\open\command\\: C:\Program Files\Internet Explorer\iexplore.exe [2009/03/08 13:09:26 | 000,638,816 | -H-- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\MSN Explorer\shell\open\command\\: "C:\Program Files\MSN\MSNCoreFiles\MSN6.EXE" [2002/06/27 18:38:40 | 000,094,208 | -H-- | M] (Microsoft Corporation)

< hklm\software\clients\startmenuinternet|command /64 /rs >
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\firefox.exe\InstallInfo\\HideIconsCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /HideShortcuts [2011/12/21 02:24:52 | 000,715,216 | -H-- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\firefox.exe\InstallInfo\\ReinstallCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /SetAsDefaultAppGlobal [2011/12/21 02:24:52 | 000,715,216 | -H-- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\firefox.exe\InstallInfo\\ShowIconsCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /ShowShortcuts [2011/12/21 02:24:52 | 000,715,216 | -H-- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\firefox.exe\shell\open\command\\: C:\Program Files\Mozilla Firefox\firefox.exe [2011/12/21 02:24:51 | 000,924,632 | -H-- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\firefox.exe\shell\properties\command\\: "C:\Program Files\Mozilla Firefox\firefox.exe" -preferences [2011/12/21 02:24:51 | 000,924,632 | -H-- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\firefox.exe\shell\safemode\command\\: "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode [2011/12/21 02:24:51 | 000,924,632 | -H-- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ReinstallCommand: "C:\WINDOWS\system32\ie4uinit.exe" -reinstall [2011/11/04 06:24:17 | 000,174,080 | -H-- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\HideIconsCommand: "C:\WINDOWS\system32\ie4uinit.exe" -hide [2011/11/04 06:24:17 | 000,174,080 | -H-- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ShowIconsCommand: "C:\WINDOWS\system32\ie4uinit.exe" -show [2011/11/04 06:24:17 | 000,174,080 | -H-- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\naom\command\\: "C:\Program Files\Internet Explorer\iexplore.exe" -extoff [2009/03/08 13:09:26 | 000,638,816 | -H-- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\open\command\\: C:\Program Files\Internet Explorer\iexplore.exe [2009/03/08 13:09:26 | 000,638,816 | -H-- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\MSN Explorer\shell\open\command\\: "C:\Program Files\MSN\MSNCoreFiles\MSN6.EXE" [2002/06/27 18:38:40 | 000,094,208 | -H-- | M] (Microsoft Corporation)

< End of report >

OTL Extras logfile created on: 2/10/2012 1:17:51 PM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.12 Gb Available Physical Memory | 56.09% Memory free
2.60 Gb Paging File | 2.04 Gb Available in Paging File | 78.28% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 111.80 Gb Total Space | 43.19 Gb Free Space | 38.63% Space Free | Partition Type: NTFS

Computer Name: FLABUSKIXP | User Name: flabuski | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.hta [@ = htafile] -- Reg Error: Key error. File not found
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
.url [@ = InternetShortcut] -- Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
http [open] -- Reg Error: Key error.
https [open] -- Reg Error: Key error.
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Generate MD5 Signatures] -- "C:\Program Files\Michael K. Weise\mkw Audio Compression Toolkit\mkwACT.exe" (Michael K. Weise)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
"25734:TCP" = 25734:TCP:*:Enabled:SNL Inbound
"25735:TCP" = 25735:TCP:*:Enabled:SNL Outbound
"32459:TCP" = 32459:TCP:*:Enabled:utorrent
"52311:UDP" = 52311:UDP:*:Enabled:BES Client

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"25374:TCP" = 25374:TCP:*:Enabled:SNL Inbound
"25375:TCP" = 25375:TCP:*:Enabled:SNL Outbound
"52311:UDP" = 52311:UDP:*:Enabled:BES Client

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\WINDOWS\system32\mmc.exe" = C:\WINDOWS\system32\mmc.exe:*:Enabled:Microsoft Management Console -- (Microsoft Corporation)
"C:\WINDOWS\explorer.exe" = C:\WINDOWS\explorer.exe:*:Enabled:Windows Explorer -- (Microsoft Corporation)
"C:\Program Files\proeWildfire 2.0\i486_nt\nms\nmsd.exe" = C:\Program Files\proeWildfire 2.0\i486_nt\nms\nmsd.exe:*:Enabled:nmsd
"C:\Program Files\proeWildfire 2.0\i486_nt\obj\xtop.exe" = C:\Program Files\proeWildfire 2.0\i486_nt\obj\xtop.exe:*:Enabled:xtop
"C:\Program Files\proeWildfire 2.0\i486_nt\obj\pro_comm_msg.exe" = C:\Program Files\proeWildfire 2.0\i486_nt\obj\pro_comm_msg.exe:*:Enabled:pro_comm_msg
"C:\Program Files\HP\HP Software Update\HPWUCli.exe" = C:\Program Files\HP\HP Software Update\HPWUCli.exe:*:Enabled:HP Software Update Client
"C:\Program Files\Intuit\QuickBooks 2006\QBDBMgrN.exe" = C:\Program Files\Intuit\QuickBooks 2006\QBDBMgrN.exe:*:Enabled:QuickBooks 2006 Data Manager
"C:\Program Files\TurboTax\Deluxe 2007\32bit\ttax.exe" = C:\Program Files\TurboTax\Deluxe 2007\32bit\ttax.exe:LocalSubNet:Enabled:TurboTax
"C:\Program Files\TurboTax\Deluxe 2007\32bit\updatemgr.exe" = C:\Program Files\TurboTax\Deluxe 2007\32bit\updatemgr.exe:LocalSubNet:Enabled:TurboTax Update Manager
"C:\Program Files\McAfee\Common Framework\FrameworkService.exe" = C:\Program Files\McAfee\Common Framework\FrameworkService.exe:*:Enabled:McAfee Framework Service -- (McAfee, Inc.)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\TurboTax\Deluxe 2007\32bit\ttax.exe" = C:\Program Files\TurboTax\Deluxe 2007\32bit\ttax.exe:LocalSubNet:Enabled:TurboTax
"C:\Program Files\TurboTax\Deluxe 2007\32bit\updatemgr.exe" = C:\Program Files\TurboTax\Deluxe 2007\32bit\updatemgr.exe:LocalSubNet:Enabled:TurboTax Update Manager
"C:\Program Files\Intuit\QuickBooks 2009\QBDBMgrN.exe" = C:\Program Files\Intuit\QuickBooks 2009\QBDBMgrN.exe:*:Enabled:QuickBooks 2009 Data Manager -- (Intuit, Inc.)
"C:\Program Files\SkyGolf\SkyCaddie Desktop\SkyCaddieDesktop.exe" = C:\Program Files\SkyGolf\SkyCaddie Desktop\SkyCaddieDesktop.exe:*:Enabled:SkyCaddie Desktop -- (Skyhawke Technologies)
"C:\Program Files\Skype\Plugin Manager\skypePM.exe" = C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager
"C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe" = C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe:LocalSubNet:Disabled:Intuit Update Shared Downloads Server -- (Intuit Inc.)
"C:\Program Files\HP\HP Deskjet 3050A J611 series\Bin\DeviceSetup.exe" = C:\Program Files\HP\HP Deskjet 3050A J611 series\Bin\DeviceSetup.exe:LocalSubNet:Enabled:HP Device Setup (HP Deskjet 3050A J611 series) -- (Hewlett-Packard Co.)
"C:\Program Files\HP\HP Deskjet 3050A J611 series\Bin\HPNetworkCommunicator.exe" = C:\Program Files\HP\HP Deskjet 3050A J611 series\Bin\HPNetworkCommunicator.exe:LocalSubNet:Enabled:HP Network Communicator (HP Deskjet 3050A J611 series) -- (Hewlett-Packard Co.)
"C:\Program Files\McAfee\Common Framework\FrameworkService.exe" = C:\Program Files\McAfee\Common Framework\FrameworkService.exe:*:Enabled:Framework Service -- (McAfee, Inc.)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{05BDC796-3451-4F81-B91D-E98F7ADA76C2}" = TurboTax 2010 WinPerTaxSupport
"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
"{147BCE03-C0F1-4C9F-8157-6A89B6D2D973}" = McAfee VirusScan Enterprise
"{2AEBE10C-D819-4EBF-BC60-03BF2327D340}" = Microsoft XML Parser and SDK
"{2E132061-C78A-48D4-A899-1D13B9D189FA}" = Memories Disc Creator 2.0
"{2E8EAC71-BFE4-417A-88F0-5A1BDFBCF5D3}" = Logitech SetPoint
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3782EC09-4000-475E-8A59-9CABD6F03B4C}" = TurboTax 2010 WinPerFedFormset
"{41844F24-9CA6-11D4-A74E-00D0B76FE248}" = VBA (2720)
"{43DCF766-6838-4F9A-8C91-D92DA586DFA7}" = Microsoft Windows Journal Viewer
"{4F2FCCCF-29F3-44B9-886F-6D16F8417522}" = TurboTax 2010 wrapper
"{5421155F-B033-49DB-9B33-8F80F233D4D5}" = GdiplusUpgrade
"{5545EEE1-FA36-4F76-B6BE-5696E7F4E2D6}" = VBA (2627.01)
"{5809E7CF-4DCF-11D4-9875-00105ACE7734}" = Logitech MouseWare 9.75
"{5A3F6A80-7913-475E-8B96-477A952CFA43}" = SupportSoft Assisted Service
"{63569CE9-FA00-469C-AF5C-E5D4D93ACF91}" = Windows Genuine Advantage v1.3.0254.0
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{7148F0A8-6813-11D6-A77B-00B0D0142040}" = Java 2 Runtime Environment, SE v1.4.2_04
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{71807498-D8E2-41C6-84CD-8ED7A076B6EC}" = NVIDIA Performance Drivers
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{766273C1-A39B-47EB-ACE8-DEBDD8094BCC}" = overland
"{7DD9A065-2C86-4A9F-A5FF-796EC1B99DCA}" = AnswerWorks 4.0 Runtime - English
"{854F7259-6FF4-445C-B322-1DBA16B567D2}" = TurboTax 2010 wmeiper
"{8F4507EF-C5F3-46CE-9718-9D3698821333}" = Motorola Driver Installation
"{90110409-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional
"{90120000-00A4-0409-0000-0000000FF1CE}" = Microsoft Office 2003 Web Components
"{90510409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Visio Professional 2003
"{97DDCAB8-B770-4089-A10F-67568069D78A}" = HP Deskjet 3050A J611 series Help
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9A2F0810-3622-4E86-9072-973FBE1679C5}" = QuickBooks Pro 2009
"{9A2F0810-369F-4E86-9072-973FBE1679C5}" = QuickBooks
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A4D7B764-4140-11D4-88EB-0050DA3579C0}" = Nero - Burning Rom
"{A525E00B-6609-442E-9DCD-64453C233E8D}" = TurboTax 2010 WinPerReleaseEngine
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AADEA55D-C834-4BCB-98A3-4B8D1C18F4EE}" = Apple Mobile Device Support
"{AB2228C5-EA86-44E1-AFF6-58B9CC260CE3}" = HP Deskjet 3050A J611 series Basic Device Software
"{AC76BA86-7AD7-1033-7B44-A91000000001}" = Adobe Reader 9.1
"{BAF78226-3200-4DB4-BE33-4D922A799840}" = Windows Presentation Foundation
"{BF7023BC-319B-4FE1-B569-C854A19F81F8}" = BigFix Enterprise Client
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C383CBAD-61FA-417E-B784-2E9F1E843DF2}" = TurboTax 2010 wmaiper
"{C40DCEE3-A564-4692-B1D5-DA1F252BA3BC}" = HP Deskjet 3050A J611 series Product Improvement Study
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D481EA96-2313-4A7C-98EE-710D1AF884AC}" = Microsoft Visual Studio 2005 Tools for Applications - ENU
"{E1B2DF7C-A176-4A1D-9D32-3CEC5037A524}" = Apple Application Support
"{FB08F381-6533-4108-B7DD-039E11FBC27E}" = Avance AC'97 Audio
"{FCE65C4E-B0E8-4FBD-AD16-EDCBE6CD591F}" = HighMAT Extension to Microsoft Windows XP CD Writing Wizard
"3DLogix" = 3DLogix
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe SVG Viewer" = Adobe SVG Viewer 3.0
"Adobe Type Manager 4.0" = Adobe Type Manager 4.0
"Amazon MP3 Downloader" = Amazon MP3 Downloader 1.0.10
"CCleaner" = CCleaner
"Defraggler" = Defraggler
"GoldWave v4.26" = GoldWave v4.26
"hp instant support" = hp instant support
"ie8" = Windows Internet Explorer 8
"InCD!UninstallKey" = Ahead InCD
"JRE 1.3.1" = Java 2 Runtime Environment Standard Edition v1.3.1
"LiveUpdate" = LiveUpdate 3.1 (Symantec Corporation)
"Logitech Print Service" = Logitech Print Service
"Macromedia Shockwave Player" = Macromedia Shockwave Player
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft Visual Studio 2005 Tools for Applications - ENU" = Microsoft Visual Studio 2005 Tools for Applications - ENU
"mkwACT" = mkw Audio Compression Toolkit
"Mozilla Firefox 9.0.1 (x86 en-US)" = Mozilla Firefox 9.0.1 (x86 en-US)
"MRW!UninstallKey" = Ahead InCD EasyWrite Reader
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NVIDIA Drivers" = NVIDIA Drivers
"Quicken 2002 Home & Business" = Quicken 2002 Home & Business
"Rainbow Sentinel Driver" = Sentinel System Driver
"ShockwaveFlash" = Macromedia Flash Player 8
"SkyCaddieDesktop" = SkyCaddie Desktop
"SLABCOMM" = CP2101 USB to UART Bridge Controller
"SystemRequirementsLab" = System Requirements Lab
"TurboTax 2010" = TurboTax 2010
"Tweak UI 2.10" = Tweak UI
"VLC media player" = VideoLAN VLC media player 0.8.6c
"WIC" = Windows Imaging Component
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinRAR archiver" = WinRAR archiver
"WinZip" = WinZip
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 2/10/2012 10:12:48 AM | Computer Name = FLABUSKIXP | Source = WinMgmt | ID = 10
Description = Event filter with query "SELECT * FROM __InstanceCreationEvent WITHIN
10 WHERE TargetInstance ISA 'Win32_Process' AND (TargetInstance.Caption LIKE 'acad.exe'
OR TargetInstance.Caption LIKE '3dsmax.exe')" could not be (re)activated in namespace
"//./root/CIMV2" because of error 0x80041003. Events may not be delivered through
this filter until the problem is corrected.

Error - 2/10/2012 10:14:11 AM | Computer Name = FLABUSKIXP | Source = UserInit | ID = 1000
Description = Could not execute the following script li1.cmd. The system cannot
find the file specified. .

Error - 2/10/2012 10:16:43 AM | Computer Name = FLABUSKIXP | Source = UserInit | ID = 1000
Description = Could not execute the following script lo1.cmd. The system cannot
find the file specified. .

Error - 2/10/2012 10:20:13 AM | Computer Name = FLABUSKIXP | Source = WinMgmt | ID = 10
Description = Event filter with query "SELECT * FROM __InstanceCreationEvent WITHIN
10 WHERE TargetInstance ISA 'Win32_Process' AND (TargetInstance.Caption LIKE 'acad.exe'
OR TargetInstance.Caption LIKE '3dsmax.exe')" could not be (re)activated in namespace
"//./root/CIMV2" because of error 0x80041003. Events may not be delivered through
this filter until the problem is corrected.

Error - 2/10/2012 10:24:13 AM | Computer Name = FLABUSKIXP | Source = BESClient | ID = 28
Description =

Error - 2/10/2012 10:24:31 AM | Computer Name = FLABUSKIXP | Source = Userenv | ID = 1054
Description = Windows cannot obtain the domain controller name for your computer
network. (The specified domain either does not exist or could not be contacted.
). Group Policy processing aborted.

Error - 2/10/2012 10:24:35 AM | Computer Name = FLABUSKIXP | Source = Userenv | ID = 1054
Description = Windows cannot obtain the domain controller name for your computer
network. (The specified domain either does not exist or could not be contacted.
). Group Policy processing aborted.

Error - 2/10/2012 10:24:47 AM | Computer Name = FLABUSKIXP | Source = AutoEnrollment | ID = 15
Description = Automatic certificate enrollment for local system failed to contact
the active directory (0x8007054b). The specified domain either does not exist
or could not be contacted. Enrollment will not be performed.

Error - 2/10/2012 10:25:39 AM | Computer Name = FLABUSKIXP | Source = WinMgmt | ID = 10
Description = Event filter with query "SELECT * FROM __InstanceCreationEvent WITHIN
10 WHERE TargetInstance ISA 'Win32_Process' AND (TargetInstance.Caption LIKE 'acad.exe'
OR TargetInstance.Caption LIKE '3dsmax.exe')" could not be (re)activated in namespace
"//./root/CIMV2" because of error 0x80041003. Events may not be delivered through
this filter until the problem is corrected.

Error - 2/10/2012 10:28:30 AM | Computer Name = FLABUSKIXP | Source = UserInit | ID = 1000
Description = Could not execute the following script li1.cmd. The system cannot
find the file specified. .

[ System Events ]
Error - 2/10/2012 10:20:14 AM | Computer Name = FLABUSKIXP | Source = Service Control Manager | ID = 7001
Description = The McAfee McShield service depends on the McAfee Validation Trust
Protection Service service which failed to start because of the following error:
%%1068

Error - 2/10/2012 10:20:14 AM | Computer Name = FLABUSKIXP | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
AFD ATMhelpr Fips intelppm IPSec mfehidk mfetdik MRxSmb NetBIOS NetBT PCLEPCI RasAcd Rdbss Tcpip
WS2IFSL

Error - 2/10/2012 10:24:42 AM | Computer Name = FLABUSKIXP | Source = W32Time | ID = 39452701
Description = The time provider NtpClient is configured to acquire time from one
or more time sources, however none of the sources are currently accessible. No attempt
to contact a source will be made for 14 minutes. NtpClient has no source of accurate
time.

Error - 2/10/2012 10:24:53 AM | Computer Name = FLABUSKIXP | Source = W32Time | ID = 39452701
Description = The time provider NtpClient is configured to acquire time from one
or more time sources, however none of the sources are currently accessible. No attempt
to contact a source will be made for 14 minutes. NtpClient has no source of accurate
time.

Error - 2/10/2012 10:25:42 AM | Computer Name = FLABUSKIXP | Source = Service Control Manager | ID = 7024
Description = The BES Client service terminated with service-specific error 28 (0x1C).

Error - 2/10/2012 10:26:29 AM | Computer Name = FLABUSKIXP | Source = Service Control Manager | ID = 7022
Description = The McAfee Framework Service service hung on starting.

Error - 2/10/2012 10:40:04 AM | Computer Name = FLABUSKIXP | Source = W32Time | ID = 39452701
Description = The time provider NtpClient is configured to acquire time from one
or more time sources, however none of the sources are currently accessible. No attempt
to contact a source will be made for 29 minutes. NtpClient has no source of accurate
time.

Error - 2/10/2012 11:10:07 AM | Computer Name = FLABUSKIXP | Source = W32Time | ID = 39452701
Description = The time provider NtpClient is configured to acquire time from one
or more time sources, however none of the sources are currently accessible. No attempt
to contact a source will be made for 59 minutes. NtpClient has no source of accurate
time.

Error - 2/10/2012 12:10:11 PM | Computer Name = FLABUSKIXP | Source = W32Time | ID = 39452701
Description = The time provider NtpClient is configured to acquire time from one
or more time sources, however none of the sources are currently accessible. No attempt
to contact a source will be made for 119 minutes. NtpClient has no source of accurate
time.

Error - 2/10/2012 2:10:21 PM | Computer Name = FLABUSKIXP | Source = W32Time | ID = 39452701
Description = The time provider NtpClient is configured to acquire time from one
or more time sources, however none of the sources are currently accessible. No attempt
to contact a source will be made for 239 minutes. NtpClient has no source of accurate
time.


< End of report >

aswMBR version 0.9.9.1532 Copyright(c) 2011 AVAST Software
Run date: 2012-02-10 13:35:48
-----------------------------
13:35:48.234 OS Version: Windows 5.1.2600 Service Pack 3
13:35:48.234 Number of processors: 1 586 0x207
13:35:48.234 ComputerName: FLABUSKIXP UserName: flabuski
13:35:50.015 Initialize success
13:36:09.328 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
13:36:09.328 Disk 0 Vendor: SAMSUNG_SV1204H RK100-09 Size: 114498MB BusType: 3
13:36:09.343 Disk 0 MBR read successfully
13:36:09.343 Disk 0 MBR scan
13:36:09.343 Disk 0 Windows XP default MBR code
13:36:09.343 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 114485 MB offset 63
13:36:09.343 Disk 0 scanning sectors +234465840
13:36:09.453 Disk 0 scanning C:\WINDOWS\system32\drivers
13:36:24.000 Service scanning
13:36:25.609 Modules scanning
13:36:58.406 Disk 0 trace - called modules:
13:36:58.437 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS
13:36:58.437 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8a9deab8]
13:36:58.437 3 CLASSPNP.SYS[f7657fd7] -> nt!IofCallDriver -> \Device\00000069[0x8aa37f18]
13:36:58.765 5 ACPI.sys[f75ae620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x8aa87d98]
13:36:58.765 Scan finished successfully
13:41:34.546 Disk 0 MBR has been saved successfully to "C:\MBR.dat"
13:41:34.593 The log file has been saved successfully to "C:\aswMBR.txt"

Results of screen317's Security Check version 0.99.31
Windows XP Service Pack 3 x86
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:
Windows Security Center service is not running! This report may not be accurate!
Windows Firewall Enabled!
McAfee VirusScan Enterprise
Antivirus up to date!
```````````````````````````````
Anti-malware/Other Utilities Check:
Malwarebytes' Anti-Malware
CCleaner
Java 2 Runtime Environment Standard Edition v1.3.1
Java 2 Runtime Environment, SE v1.4.2_04
Adobe Flash Player 10.3.183.11 Flash Player out of Date!
Adobe Reader 9 Adobe Reader out of date!
Mozilla Firefox (9.0.1)
````````````````````````````````
Process Check:
objlist.exe by Laurent
McAfee VirusScan Enterprise engineserver.exe
McAfee VirusScan Enterprise vstskmgr.exe
McAfee VirusScan Enterprise mcshield.exe
``````````End of Log````````````

Hello and welcome to GeekPolice.Net My name is Dave. I will be helping you out with your particular problem on your computer.

1. I will be working on your Malware issues. This may or may not solve other issues you have with your machine.
2. The fixes are specific to your problem and should only be used for this issue on this machine.
3. If you don't know or understand something, please don't hesitate to ask.
4. Please DO NOT run any other tools or scans while I am helping you.
5. It is important that you reply to this thread. Do not start a new topic.
6. Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
7. Absence of symptoms does not mean that everything is clear.

If you can't access the internet with your infected computer you will have to download and transfer any programs to the computer you're using now and transfer them to the infected computer with a CD-RW or a USB storage device. I prefer a CD because a storage device can get infected. If you use a storage device hold the shift key down while inserting the USB storage device for about 10 secs. You will also have to transfer the logs you receive back to the good computer using the same method until we can get the computer back on-line.
*****************************************************************
I will be back in few minutes after I have looked at the logs.

* Open OTL
* Copy and Paste the following text in the codebox into the Custom Scans/Fixes window.



* Click Run Fix
* OTLI2 may ask to reboot the machine. Please do so if asked.
* Click OK
* A report will open. Copy and Paste that report in your next reply.
***********************************************************

SUPERAntiSpyware

If you already have SUPERAntiSpyware be sure to check for updates before scanning!

Download SuperAntispyware Free Edition (SAS)
* Double-click the icon on your desktop to run the installer.
* When asked to Update the program definitions, click Yes
* If you encounter any problems while downloading the updates, manually download and unzip them from here
* Next click the Preferences button.

•Under Start-Up Options uncheck Start SUPERAntiSpyware when Windows starts
* Click the Scanning Control tab.
* Under Scanner Options make sure only the following are checked:

•Close browsers before scanning
•Scan for tracking cookies
•Terminate memory threats before quarantining
•Please leave the others unchecked

•Click the Close button to leave the control center screen.

* On the main screen click Scan your computer
* On the left check the box for the drive you are scanning.
* On the right choose Perform Complete Scan
* Click Next to start the scan. Please be patient while it scans your computer.
* After the scan is complete a summary box will appear. Click OK
* Make sure everything in the white box has a check next to it, then click Next
* It will quarantine what it found and if it asks if you want to reboot, click Yes

•To retrieve the removal information please do the following:
•After reboot, double-click the SUPERAntiSpyware icon on your desktop.
•Click Preferences. Click the Statistics/Logs tab.

•Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.

•It will open in your default text editor (preferably Notepad).
•Save the notepad file to your desktop by clicking (in notepad) File > Save As...

* Save the log somewhere you can easily find it. (normally the desktop)
* Click close and close again to exit the program.
*Copy and Paste the log in your post.
*************************************************
Please download Malwarebytes Anti-Malware from here.
Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes Anti-Malware, then click Finish.
  
• If an update is found, it will download and install the latest version.
  
• Once the program has loaded, select "Perform Full Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
  
• Please save the log to a location you will remember.
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  
• Copy and paste the entire report in your next reply.
  

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.

OTL log.......downloading superanti spyware now



========== OTL ==========
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{47833539-D0C5-4125-9FA8-0819E2EAAC93} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{47833539-D0C5-4125-9FA8-0819E2EAAC93}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{AE6F2894-AF10-4C9C-B16E-1DFC6FF8C0C6} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AE6F2894-AF10-4C9C-B16E-1DFC6FF8C0C6}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{EF99BD32-C1FB-11D2-892F-0090271D4F88} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\polycom.com\sololearning\ deleted successfully.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\intuit.com\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\intuit.com\ttlc\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\polycom.com\sololearning\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\turbotax.com\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\turbotax.com\ not found.
File sethosts] not found.
File rity] not found.
File art explorer] not found.

OTL by OldTimer - Version 3.2.31.0 log created on 02102012_144749

SuperAntiSpyware Log:

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 02/10/2012 at 04:52 PM

Application Version : 5.0.1144

Core Rules Database Version : 8228
Trace Rules Database Version: 6040

Scan type : Complete Scan
Total Scan Time : 01:53:53

Operating System Information
Windows XP Professional 32-bit, Service Pack 3 (Build 5.01.2600)
Administrator

Memory items scanned : 524
Memory threats detected : 0
Registry items scanned : 35692
Registry threats detected : 1
File items scanned : 114094
File threats detected : 64

Trojan.Malware
C:\asdf.txt

Trojan.Agent/Gen-FakeAlert[Local]
[JbXDITATnUG.exe] C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\JBXDITATNUG.EXE
C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\JBXDITATNUG.EXE
C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\YBVNQA2N9IXPKP.EXE

Adware.Tracking Cookie
C:\Documents and Settings\flabuski\Cookies\TH77MNFK.txt [ /doubleclick.net ]
.adserver.adtechus.com [ C:\DOCUMENTS AND SETTINGS\FLABUSKI\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\89OHH2ZP.DEFAULT\COOKIES.SQLITE ]
.media6degrees.com [ C:\DOCUMENTS AND SETTINGS\FLABUSKI\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\89OHH2ZP.DEFAULT\COOKIES.SQLITE ]
.adxpose.com [ C:\DOCUMENTS AND SETTINGS\FLABUSKI\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\89OHH2ZP.DEFAULT\COOKIES.SQLITE ]
.ru4.com [ C:\DOCUMENTS AND SETTINGS\FLABUSKI\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\89OHH2ZP.DEFAULT\COOKIES.SQLITE ]
.pro-market.net [ C:\DOCUMENTS AND SETTINGS\FLABUSKI\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\89OHH2ZP.DEFAULT\COOKIES.SQLITE ]
.lucidmedia.com [ C:\DOCUMENTS AND SETTINGS\FLABUSKI\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\89OHH2ZP.DEFAULT\COOKIES.SQLITE ]
.adbrite.com [ C:\DOCUMENTS AND SETTINGS\FLABUSKI\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\89OHH2ZP.DEFAULT\COOKIES.SQLITE ]
.collective-media.net [ C:\DOCUMENTS AND SETTINGS\FLABUSKI\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\89OHH2ZP.DEFAULT\COOKIES.SQLITE ]
.collective-media.net [ C:\DOCUMENTS AND SETTINGS\FLABUSKI\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\89OHH2ZP.DEFAULT\COOKIES.SQLITE ]
.collective-media.net [ C:\DOCUMENTS AND SETTINGS\FLABUSKI\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\89OHH2ZP.DEFAULT\COOKIES.SQLITE ]
.collective-media.net [ C:\DOCUMENTS AND SETTINGS\FLABUSKI\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\89OHH2ZP.DEFAULT\COOKIES.SQLITE ]
.collective-media.net [ C:\DOCUMENTS AND SETTINGS\FLABUSKI\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\89OHH2ZP.DEFAULT\COOKIES.SQLITE ]
.collective-media.net [ C:\DOCUMENTS AND SETTINGS\FLABUSKI\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\89OHH2ZP.DEFAULT\COOKIES.SQLITE ]
.collective-media.net [ C:\DOCUMENTS AND SETTINGS\FLABUSKI\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\89OHH2ZP.DEFAULT\COOKIES.SQLITE ]
.collective-media.net [ C:\DOCUMENTS AND SETTINGS\FLABUSKI\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\89OHH2ZP.DEFAULT\COOKIES.SQLITE ]
.collective-media.net [ C:\DOCUMENTS AND SETTINGS\FLABUSKI\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\89OHH2ZP.DEFAULT\COOKIES.SQLITE ]
.at.atwola.com [ C:\DOCUMENTS AND SETTINGS\FLABUSKI\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\89OHH2ZP.DEFAULT\COOKIES.SQLITE ]
.invitemedia.com [ C:\DOCUMENTS AND SETTINGS\FLABUSKI\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\89OHH2ZP.DEFAULT\COOKIES.SQLITE ]
.invitemedia.com [ C:\DOCUMENTS AND SETTINGS\FLABUSKI\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\89OHH2ZP.DEFAULT\COOKIES.SQLITE ]
.collective-media.net [ C:\DOCUMENTS AND SETTINGS\FLABUSKI\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\89OHH2ZP.DEFAULT\COOKIES.SQLITE ]
.collective-media.net [ C:\DOCUMENTS AND SETTINGS\FLABUSKI\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\89OHH2ZP.DEFAULT\COOKIES.SQLITE ]
.invitemedia.com [ C:\DOCUMENTS AND SETTINGS\FLABUSKI\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\89OHH2ZP.DEFAULT\COOKIES.SQLITE ]
.invitemedia.com [ C:\DOCUMENTS AND SETTINGS\FLABUSKI\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\89OHH2ZP.DEFAULT\COOKIES.SQLITE ]
.invitemedia.com [ C:\DOCUMENTS AND SETTINGS\FLABUSKI\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\89OHH2ZP.DEFAULT\COOKIES.SQLITE ]
.invitemedia.com [ C:\DOCUMENTS AND SETTINGS\FLABUSKI\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\89OHH2ZP.DEFAULT\COOKIES.SQLITE ]
.invitemedia.com [ C:\DOCUMENTS AND SETTINGS\FLABUSKI\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\89OHH2ZP.DEFAULT\COOKIES.SQLITE ]
.serving-sys.com [ C:\DOCUMENTS AND SETTINGS\FLABUSKI\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\89OHH2ZP.DEFAULT\COOKIES.SQLITE ]
.adbrite.com [ C:\DOCUMENTS AND SETTINGS\FLABUSKI\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\89OHH2ZP.DEFAULT\COOKIES.SQLITE ]
.revsci.net [ C:\DOCUMENTS AND SETTINGS\FLABUSKI\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\89OHH2ZP.DEFAULT\COOKIES.SQLITE ]
.interclick.com [ C:\DOCUMENTS AND SETTINGS\FLABUSKI\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\89OHH2ZP.DEFAULT\COOKIES.SQLITE ]
.interclick.com [ C:\DOCUMENTS AND SETTINGS\FLABUSKI\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\89OHH2ZP.DEFAULT\COOKIES.SQLITE ]
.revsci.net [ C:\DOCUMENTS AND SETTINGS\FLABUSKI\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\89OHH2ZP.DEFAULT\COOKIES.SQLITE ]
.revsci.net [ C:\DOCUMENTS AND SETTINGS\FLABUSKI\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\89OHH2ZP.DEFAULT\COOKIES.SQLITE ]
.revsci.net [ C:\DOCUMENTS AND SETTINGS\FLABUSKI\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\89OHH2ZP.DEFAULT\COOKIES.SQLITE ]
.invitemedia.com [ C:\DOCUMENTS AND SETTINGS\FLABUSKI\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\89OHH2ZP.DEFAULT\COOKIES.SQLITE ]
.collective-media.net [ C:\DOCUMENTS AND SETTINGS\FLABUSKI\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\89OHH2ZP.DEFAULT\COOKIES.SQLITE ]
.adbrite.com [ C:\DOCUMENTS AND SETTINGS\FLABUSKI\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\89OHH2ZP.DEFAULT\COOKIES.SQLITE ]
.media6degrees.com [ C:\DOCUMENTS AND SETTINGS\FLABUSKI\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\89OHH2ZP.DEFAULT\COOKIES.SQLITE ]
.media6degrees.com [ C:\DOCUMENTS AND SETTINGS\FLABUSKI\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\89OHH2ZP.DEFAULT\COOKIES.SQLITE ]
.amazon-adsystem.com [ C:\DOCUMENTS AND SETTINGS\FLABUSKI\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\89OHH2ZP.DEFAULT\COOKIES.SQLITE ]
.amazon-adsystem.com [ C:\DOCUMENTS AND SETTINGS\FLABUSKI\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\89OHH2ZP.DEFAULT\COOKIES.SQLITE ]
.ru4.com [ C:\DOCUMENTS AND SETTINGS\FLABUSKI\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\89OHH2ZP.DEFAULT\COOKIES.SQLITE ]
.adserver.adtechus.com [ C:\DOCUMENTS AND SETTINGS\FLABUSKI\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\89OHH2ZP.DEFAULT\COOKIES.SQLITE ]
.revsci.net [ C:\DOCUMENTS AND SETTINGS\FLABUSKI\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\89OHH2ZP.DEFAULT\COOKIES.SQLITE ]
.tribalfusion.com [ C:\DOCUMENTS AND SETTINGS\FLABUSKI\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\89OHH2ZP.DEFAULT\COOKIES.SQLITE ]
.serving-sys.com [ C:\DOCUMENTS AND SETTINGS\FLABUSKI\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\89OHH2ZP.DEFAULT\COOKIES.SQLITE ]
.serving-sys.com [ C:\DOCUMENTS AND SETTINGS\FLABUSKI\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\89OHH2ZP.DEFAULT\COOKIES.SQLITE ]
.serving-sys.com [ C:\DOCUMENTS AND SETTINGS\FLABUSKI\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\89OHH2ZP.DEFAULT\COOKIES.SQLITE ]
.realmedia.com [ C:\DOCUMENTS AND SETTINGS\FLABUSKI\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\89OHH2ZP.DEFAULT\COOKIES.SQLITE ]
.realmedia.com [ C:\DOCUMENTS AND SETTINGS\FLABUSKI\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\89OHH2ZP.DEFAULT\COOKIES.SQLITE ]
.realmedia.com [ C:\DOCUMENTS AND SETTINGS\FLABUSKI\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\89OHH2ZP.DEFAULT\COOKIES.SQLITE ]

EUniverse Wupdater
ZIP ARCHIVE( C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\SPYBOT - SEARCH & DESTROY\RECOVERY\KEENVALUEEUNIVERSEMYFREECURSORS2.ZIP )/WUPDATER.EXE
C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\SPYBOT - SEARCH & DESTROY\RECOVERY\KEENVALUEEUNIVERSEMYFREECURSORS2.ZIP

n-CASE (SongSpy)
ZIP ARCHIVE( C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\SPYBOT - SEARCH & DESTROY\RECOVERY\NCASE6.ZIP )/MSBB.EXE
C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\SPYBOT - SEARCH & DESTROY\RECOVERY\NCASE6.ZIP

Spyware.ShopAtHomeSelect
ZIP ARCHIVE( C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\SPYBOT - SEARCH & DESTROY\RECOVERY\SHOPATHOME4.ZIP )/SAHAGENT.EXE
C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\SPYBOT - SEARCH & DESTROY\RECOVERY\SHOPATHOME4.ZIP

Adware.SurfSideKick
ZIP ARCHIVE( C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\SPYBOT - SEARCH & DESTROY\RECOVERY\SURFSIDEKICK3.ZIP )/SSKKNWRD.DLL
C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\SPYBOT - SEARCH & DESTROY\RECOVERY\SURFSIDEKICK3.ZIP

Trojan.Agent/Gen-Rets
C:\DOCUMENTS AND SETTINGS\FLABUSKI\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\ISY6GCAL\INFO[1].EXE

Hi,

Thanks for the help so far.

I am unable to update/run/re-install Malware AntiMalwareBytes. It gets to the end and says "access is denied" "please correct problem and try again".

I guess that's as much as I can do for now.

-OD

ohdeucey wrote:

Hi,

Thanks for the help so far.

I am unable to update/run/re-install Malware AntiMalwareBytes. It gets to the end and says "access is denied" "please correct problem and try again".

I guess that's as much as I can do for now.

-OD

Please try running MBAM in Safe Mode.

Hi.

No Luck. Crashes at the end of the install when configuring the uninstall portion.

-

Hey Dave.....

Getting closer. Was able to get MBAM installed and updated. Log attached below.

Thanks!



Malwarebytes Anti-Malware 1.60.1.1000
www.malwarebytes.org

Database version: v2012.02.11.05

Windows XP Service Pack 3 x86 NTFS (Safe Mode/Networking)
Internet Explorer 8.0.6001.18702
flabuski :: FLABUSKIXP [administrator]

2/11/2012 11:05:26 AM
mbam-log-2012-02-11 (11-05-26).txt

Scan type: Full scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 295710
Time elapsed: 46 minute(s), 21 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|JbXDITATnUG.exe (Rogue.FakeHDD) -> Data: C:\Documents and Settings\All Users\Application Data\JbXDITATnUG.exe -> Quarantined and deleted successfully.

Registry Data Items Detected: 7
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowControlPanel (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and repaired successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowHelp (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and repaired successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowMyComputer (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and repaired successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowMyDocs (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and repaired successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowRun (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and repaired successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowSearch (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and repaired successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer|NoDesktop (PUM.Hidden.Desktop) -> Bad: (1) Good: (0) -> Quarantined and repaired successfully.

Folders Detected: 0
(No malicious items detected)

Files Detected: 2
C:\Documents and Settings\All Users\Application Data\JbXDITATnUG.exe (Rogue.FakeHDD) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\YBVnqA2N9ixpKP.exe (Rogue.FakeAlert) -> Quarantined and deleted successfully.

(end)

Download Security Check by screen317 from one of the following links and save it to your desktop.

Link 1
Link 2

* Double-click Security Check.bat
* Follow the on-screen instructions inside of the black box.
* A Notepad document should open automatically called checkup.txt
* Post the contents of that document in your next reply.

Note: If a security program requests permission from dig.exe to access the Internet, allow it to do so.
*****************************************************
Download Combofix from any of the links below, and save it to your desktop.

Link 1
Link 2
Link 3

To prevent your anti-virus application interfering with ComboFix we need to disable it. See [URL="http://www.pchelpforum.com/anti-virus/110194-how-disable-your-security-applications.html"]here[/URL] for a tutorial regarding how to do so if you are unsure.

• Close any open windows and double click ComboFix.exe to run it.
  
  You will see the following image:
  

Click I Agree to start the program.

ComboFix will then extract the necessary files and you will see this:



As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. This will not occur in Windows Vista and 7

It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

If you did not have it installed, you will see the prompt below. Choose YES.



Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:



Click on Yes, to continue scanning for malware.

When finished, it will produce a report for you. Please post the contents of the log (C:\ComboFix.txt).

Leave your computer alone while ComboFix is running. ComboFix will restart your computer if malware is found; allow it to do so.

Note: Please Do NOT mouseclick combofix's window while its running because it may call it to stall.

Security Check Log:

Results of screen317's Security Check version 0.99.31
Windows XP Service Pack 3 x86
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:
Windows Security Center service is not running! This report may not be accurate!
Windows Firewall Enabled!
McAfee VirusScan Enterprise
Antivirus up to date!
```````````````````````````````
Anti-malware/Other Utilities Check:
SUPERAntiSpyware
CCleaner
Java 2 Runtime Environment Standard Edition v1.3.1
Java 2 Runtime Environment, SE v1.4.2_04
Adobe Flash Player 10.3.183.11 Flash Player out of Date!
Adobe Reader 9 Adobe Reader out of date!
Mozilla Firefox (9.0.1)
````````````````````````````````
Process Check:
objlist.exe by Laurent
McAfee VirusScan Enterprise engineserver.exe
McAfee VirusScan Enterprise vstskmgr.exe
McAfee VirusScan Enterprise mcshield.exe
``````````End of Log````````````

ComboFix Log attached.......

ComboFix 12-02-11.02 - flabuski 02/11/2012 14:00:17.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1546 [GMT -5:00]
Running from: c:\documents and settings\flabuski\My Documents\Downloads\ComboFix.exe
AV: McAfee VirusScan Enterprise *Disabled/Updated* {918A2B0B-2C60-4016-A4AB-E868DEABF7F0}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\data
c:\data\flabuski.dat
c:\data\testflag.dat
c:\documents and settings\flabuski\Start Menu\Programs\System Check
c:\documents and settings\flabuski\Start Menu\Programs\System Check\System Check.lnk
c:\documents and settings\flabuski\Start Menu\Programs\System Check\Uninstall System Check.lnk
c:\documents and settings\flabuski\WINDOWS
c:\windows\_ds3162.tmp
c:\windows\bwUnin-6.1.4.36-8876480L.exe
c:\windows\system32\SET77.tmp
c:\windows\system32\SET7C.tmp
c:\windows\system32\SET83.tmp
c:\windows\system32\setb0.tmp
.
.
((((((((((((((((((((((((( Files Created from 2012-01-11 to 2012-02-11 )))))))))))))))))))))))))))))))
.
.
2012-02-11 15:32 . 2012-02-11 15:32 -------- d-----w- c:\documents and settings\flabuski\Application Data\Malwarebytes
2012-02-11 15:32 . 2012-02-11 15:32 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2012-02-11 15:32 . 2012-02-11 16:03 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2012-02-11 15:32 . 2011-12-10 20:24 20464 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-02-10 22:40 . 2012-02-10 22:40 9604712 ---ha-w- C:\mc.exe
2012-02-10 19:54 . 2012-02-10 19:54 -------- d--h--w- c:\documents and settings\flabuski\Application Data\SUPERAntiSpyware.com
2012-02-10 19:52 . 2012-02-10 19:54 -------- d--h--w- c:\program files\SUPERAntiSpyware
2012-02-10 19:52 . 2012-02-10 19:52 -------- d--h--w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2012-02-10 19:47 . 2012-02-10 19:47 -------- d-----w- C:\_OTL
2012-02-10 19:14 . 2012-02-10 22:46 -------- d--h--w- c:\documents and settings\Administrator
2012-02-10 18:44 . 2012-02-10 18:44 879700 ---ha-w- C:\SecurityCheck.exe
2012-02-10 18:34 . 2012-02-10 18:35 4733440 ---ha-w- C:\aswMBR.exe
2012-02-10 18:16 . 2012-02-10 18:16 584192 ---ha-w- C:\OTL.com
2012-01-27 23:42 . 2011-12-21 07:24 121816 ---ha-w- c:\program files\Mozilla Firefox\components\browsercomps.dll
2012-01-27 23:42 . 2011-12-21 07:24 97240 ---ha-w- c:\program files\Mozilla Firefox\libEGL.dll
2012-01-27 23:42 . 2011-12-21 07:24 814040 ---ha-w- c:\program files\Mozilla Firefox\mozsqlite3.dll
2012-01-27 23:42 . 2011-12-21 07:24 486360 ---ha-w- c:\program files\Mozilla Firefox\libGLESv2.dll
2012-01-27 23:42 . 2011-12-21 07:24 43992 ---ha-w- c:\program files\Mozilla Firefox\mozutils.dll
2012-01-27 23:42 . 2011-12-21 07:24 2124760 ---ha-w- c:\program files\Mozilla Firefox\mozjs.dll
2012-01-27 23:42 . 2011-12-21 07:24 15832 ---ha-w- c:\program files\Mozilla Firefox\mozalloc.dll
2012-01-27 23:42 . 2011-12-21 04:30 626688 ---ha-w- c:\program files\Mozilla Firefox\msvcr80.dll
2012-01-27 23:42 . 2011-12-21 04:30 548864 ---ha-w- c:\program files\Mozilla Firefox\msvcp80.dll
2012-01-27 23:42 . 2011-12-21 04:30 479232 ---ha-w- c:\program files\Mozilla Firefox\msvcm80.dll
2012-01-27 23:42 . 2011-12-21 04:30 2106216 ---ha-w- c:\program files\Mozilla Firefox\D3DCompiler_43.dll
2012-01-27 23:42 . 2011-12-21 04:30 1998168 ---ha-w- c:\program files\Mozilla Firefox\d3dx9_43.dll
2012-01-27 23:36 . 2011-12-21 07:24 16856 ---ha-w- c:\program files\Mozilla Firefox\plugin-container.exe
2012-01-24 09:38 . 2012-01-24 09:38 404640 ---ha-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-01-20 23:59 . 2012-01-20 23:59 -------- d--h--w- c:\documents and settings\flabuski\Local Settings\Application Data\Temp
2012-01-20 23:59 . 2012-01-20 23:59 -------- d--h--w- c:\documents and settings\NetworkService\Local Settings\Application Data\Google
2012-01-20 23:55 . 2012-01-20 23:55 -------- d--h--w- c:\program files\Defraggler
2012-01-20 23:54 . 2012-01-20 23:54 -------- d--h--w- c:\documents and settings\LocalService\Local Settings\Application Data\Google
2012-01-20 16:57 . 2012-01-20 16:57 -------- d--h--w- c:\documents and settings\flabuski\Local Settings\Application Data\PCHealth
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-25 21:57 . 2001-08-23 12:00 293376 ---ha-w- c:\windows\system32\winsrv.dll
2011-11-23 13:25 . 2001-08-23 12:00 1859584 ---ha-w- c:\windows\system32\win32k.sys
2011-11-18 12:35 . 2004-06-04 15:40 60416 ---ha-w- c:\windows\system32\packager.exe
2011-11-16 14:21 . 2004-07-14 11:44 354816 ---ha-w- c:\windows\system32\winhttp.dll
2011-11-16 14:21 . 2001-08-23 12:00 152064 ---ha-w- c:\windows\system32\schannel.dll
2011-12-21 07:24 . 2012-01-27 23:42 121816 ---ha-w- c:\program files\mozilla firefox\components\browsercomps.dll
2008-09-29 12:07 . 2009-05-04 11:44 22576 ---ha-w- c:\program files\mozilla firefox\components\Scriptff.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HP Deskjet 3050A J611 series (NET)"="c:\program files\HP\HP Deskjet 3050A J611 series\Bin\ScanToPCActivationApp.exe" [2011-03-30 1721192]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nwiz"="nwiz.exe" [2008-05-26 1630208]
"AlcxMonitor"="ALCXMNTR.EXE" [2004-09-07 57344]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-26 8523776]
"InCD"="c:\program files\Ahead\InCD\InCD.exe" [2003-09-01 1200178]
"McAfeeUpdaterUI"="c:\program files\McAfee\Common Framework\UdaterUI.exe" [2008-05-13 136512]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2005-05-20 28160]
"ShStatEXE"="c:\program files\McAfee\VirusScan Enterprise\SHSTAT.EXE" [2008-09-29 124240]
"Intuit SyncManager"="c:\program files\Common Files\Intuit\Sync\IntuitSyncManager.exe" [2009-12-22 1092872]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-26 81920]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
.
c:\documents and settings\flabuski\Start Menu\Programs\Startup\
Monitor Ink Alerts - HP Deskjet 3050A J611 series (Network).lnk - c:\windows\system32\RunDll32.exe [2001-8-23 33280]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2011-07-19 113024]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2011-05-04 17:54 551296 ---ha-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1004336348-2077806209-725345543-2924\Scripts\Logoff\0\0]
"Script"=lo1.cmd
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1004336348-2077806209-725345543-2924\Scripts\Logon\0\0]
"Script"=li1.cmd
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\McAfeeEngineService]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Netlogon"=2 (0x2)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Intuit\\QuickBooks 2009\\QBDBMgrN.exe"=
"c:\\Program Files\\SkyGolf\\SkyCaddie Desktop\\SkyCaddieDesktop.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\McAfee\\Common Framework\\FrameworkService.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"25374:TCP"= 25374:TCP:SNL Inbound
"25375:TCP"= 25375:TCP:SNL Outbound
"52311:UDP"= 52311:UDP:BES Client
.
R1 ATMhelpr;ATMhelpr;c:\windows\system32\drivers\ATMHELPR.SYS [8/19/2005 7:00 AM 4064]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [7/22/2011 11:27 AM 12880]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [7/12/2011 4:55 PM 67664]
R2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCore.exe [8/11/2011 6:38 PM 116608]
R2 McAfeeEngineService;McAfee Engine Service;c:\program files\McAfee\VirusScan Enterprise\engineserver.exe [9/29/2008 7:07 AM 19456]
R2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [5/4/2009 6:44 AM 67904]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [1/20/2012 6:54 PM 136176]
S3 DVXUSBKS;DVXCEL Streaming Class Driver;c:\windows\system32\drivers\DVXUSBKS.sys [8/29/2003 11:26 AM 46397]
S3 DVXUSBLD;DVXUSBLD;c:\windows\system32\drivers\DVXUSBLD.SYS [8/28/2003 12:34 PM 65241]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [1/20/2012 6:54 PM 136176]
S3 lredbooo;lredbooo;\??\c:\docume~1\flabuski\LOCALS~1\Temp\lredbooo.sys --> c:\docume~1\flabuski\LOCALS~1\Temp\lredbooo.sys [?]
S3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [5/4/2009 6:44 AM 64432]
S3 Pcouffin;Low level access layer for CD devices;c:\windows\system32\Drivers\Pcouffin.sys --> c:\windows\system32\Drivers\Pcouffin.sys [?]
S4 msvsmon80;Visual Studio 2005 Remote Debugger;c:\program files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe [9/23/2005 6:01 AM 2799808]
.
Contents of the 'Scheduled Tasks' folder
.
2012-01-29 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]
.
2012-02-10 c:\windows\Tasks\At1.job
- c:\program files\HP\HP Deskjet 3050A J611 series\Bin\HPCustPartic.exe [2011-03-30 22:48]
.
2012-02-11 c:\windows\Tasks\At2.job
- c:\program files\HP\HP Deskjet 3050A J611 series\Bin\HPCustPartic.exe [2011-03-30 22:48]
.
2012-02-10 c:\windows\Tasks\At3.job
- c:\program files\HP\HP Deskjet 3050A J611 series\Bin\HPCustPartic.exe [2011-03-30 22:48]
.
2012-02-10 c:\windows\Tasks\At4.job
- c:\program files\HP\HP Deskjet 3050A J611 series\Bin\HPCustPartic.exe [2011-03-30 22:48]
.
2012-02-11 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-01-20 23:54]
.
2012-02-11 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-01-20 23:54]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.cnn.com/
uInternet Settings,ProxyOverride = 127.0.0.1;*.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.2.1
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {1ED48504-8834-11D5-AC75-0008C73FD642} - file://c:\program files\proeWildfire 2.0\i486_nt\obj\pvx_install.exe
DPF: {74F5614A-8A8C-43B4-8CC2-4B4EFAF4A6C5} - hxxp://www.techsmith.com/codec/tsccinst.cab
FF - ProfilePath - c:\documents and settings\flabuski\Application Data\Mozilla\Firefox\Profiles\89ohh2zp.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.drudgereport.com/
.
- - - - ORPHANS REMOVED - - - -
.
Notify-NavLogon - (no file)
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-02-11 14:07
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F9E7FB8A-7FC0-F5C6-C2C005BCC6E52A75}\{38D64012-6403-EA81-41E60280EAB79558}\{8D4E630B-001F-4733-DF87B943421629E7}*]
"63AUOURV1X6YIYB2ELIFO4LTRC1"=hex:01,00,01,00,00,00,00,00,87,da,ad,38,2b,26,f8,
c3,35,81,92,71,e8,29,5a,84,14,35,16,70,d8,6e,ff,61
.
[HKEY_LOCAL_MACHINE\software\DeterministicNetworks\DNE\Parameters]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,79,00,73,00,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(612)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\WININET.dll
.
Completion time: 2012-02-11 14:14:21
ComboFix-quarantined-files.txt 2012-02-11 19:14
.
Pre-Run: 46,040,678,400 bytes free
Post-Run: 46,122,287,104 bytes free
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptOut
.
- - End Of File - - 267D1AA246F99546ED21017144D4A272

Please go to Jotti's malware scan
(If more than one file needs scanned they must be done separately and links posted for each one)

* Copy the file path in the below Code box:



* At the upload site, click once inside the window next to Browse.
* Press Ctrl+V on the keyboard (both at the same time) to paste the file path into the window.
* Next click Submit file
* Your file will possibly be entered into a queue which normally takes less than a minute to clear.
* This will perform a scan across multiple different virus scanning engines.
* Important: Wait for all of the scanning engines to complete.
* Once the scan is finished, Copy and then Paste the link in the address bar into your next reply.
**************************************************************************
Copy and paste the text in the code box below into Notepad.


Then click File > Save as
Save to the Desktop as blackpudding.bat
And Save as type: All Files.

Double-click on blackpudding.bat to run it.
*****************************************************
Go to Start > Run and type Notepad.exe then click OK.

Copy and paste the following text within the code box into the new Notepad file.



In Notepad select File and Save as
Choose the Save to location to be the Desktop and for the File name: type in fixme.bat making sure that the Save as type field says All files.
Next double click fixservice.bat to run it.
A black box should open and close after a short time, this is normal.
Do not continue until the black box has closed
Delete fixservice.bat from the Desktop.
***************************************************
ComboFix is running from the wrong location. Please delete it. Download a new version and save it to your desktop. Run another scan and post the log. There are some things we need to fix and I can't do it from where it is now.

Sorry....new Combofix log......

Thx!



ComboFix 12-02-11.03 - flabuski 02/11/2012 15:44:48.2.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1369 [GMT -5:00]
Running from: c:\documents and settings\flabuski\Desktop\ComboFix.exe
AV: McAfee VirusScan Enterprise *Disabled/Updated* {918A2B0B-2C60-4016-A4AB-E868DEABF7F0}
.
.
((((((((((((((((((((((((( Files Created from 2012-01-11 to 2012-02-11 )))))))))))))))))))))))))))))))
.
.
2012-02-11 15:32 . 2012-02-11 15:32 -------- d-----w- c:\documents and settings\flabuski\Application Data\Malwarebytes
2012-02-11 15:32 . 2012-02-11 15:32 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2012-02-11 15:32 . 2012-02-11 16:03 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2012-02-11 15:32 . 2011-12-10 20:24 20464 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-02-10 22:40 . 2012-02-10 22:40 9604712 ----a-w- C:\mc.exe
2012-02-10 19:54 . 2012-02-10 19:54 -------- d-----w- c:\documents and settings\flabuski\Application Data\SUPERAntiSpyware.com
2012-02-10 19:52 . 2012-02-10 19:54 -------- d-----w- c:\program files\SUPERAntiSpyware
2012-02-10 19:52 . 2012-02-10 19:52 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2012-02-10 19:47 . 2012-02-10 19:47 -------- d-----w- C:\_OTL
2012-02-10 19:14 . 2012-02-10 22:46 -------- d-----w- c:\documents and settings\Administrator
2012-02-10 18:44 . 2012-02-10 18:44 879700 ----a-w- C:\SecurityCheck.exe
2012-02-10 18:34 . 2012-02-10 18:35 4733440 ----a-w- C:\aswMBR.exe
2012-02-10 18:16 . 2012-02-10 18:16 584192 ----a-w- C:\OTL.com
2012-01-27 23:42 . 2011-12-21 07:24 121816 ----a-w- c:\program files\Mozilla Firefox\components\browsercomps.dll
2012-01-27 23:42 . 2011-12-21 07:24 97240 ----a-w- c:\program files\Mozilla Firefox\libEGL.dll
2012-01-27 23:42 . 2011-12-21 07:24 814040 ----a-w- c:\program files\Mozilla Firefox\mozsqlite3.dll
2012-01-27 23:42 . 2011-12-21 07:24 486360 ----a-w- c:\program files\Mozilla Firefox\libGLESv2.dll
2012-01-27 23:42 . 2011-12-21 07:24 43992 ----a-w- c:\program files\Mozilla Firefox\mozutils.dll
2012-01-27 23:42 . 2011-12-21 07:24 2124760 ----a-w- c:\program files\Mozilla Firefox\mozjs.dll
2012-01-27 23:42 . 2011-12-21 07:24 15832 ----a-w- c:\program files\Mozilla Firefox\mozalloc.dll
2012-01-27 23:42 . 2011-12-21 04:30 626688 ----a-w- c:\program files\Mozilla Firefox\msvcr80.dll
2012-01-27 23:42 . 2011-12-21 04:30 548864 ----a-w- c:\program files\Mozilla Firefox\msvcp80.dll
2012-01-27 23:42 . 2011-12-21 04:30 479232 ----a-w- c:\program files\Mozilla Firefox\msvcm80.dll
2012-01-27 23:42 . 2011-12-21 04:30 2106216 ----a-w- c:\program files\Mozilla Firefox\D3DCompiler_43.dll
2012-01-27 23:42 . 2011-12-21 04:30 1998168 ----a-w- c:\program files\Mozilla Firefox\d3dx9_43.dll
2012-01-27 23:36 . 2011-12-21 07:24 16856 ----a-w- c:\program files\Mozilla Firefox\plugin-container.exe
2012-01-24 09:38 . 2012-01-24 09:38 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-01-20 23:59 . 2012-01-20 23:59 -------- d-----w- c:\documents and settings\flabuski\Local Settings\Application Data\Temp
2012-01-20 23:59 . 2012-01-20 23:59 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Google
2012-01-20 23:55 . 2012-01-20 23:55 -------- d-----w- c:\program files\Defraggler
2012-01-20 23:54 . 2012-01-20 23:54 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Google
2012-01-20 16:57 . 2012-01-20 16:57 -------- d-----w- c:\documents and settings\flabuski\Local Settings\Application Data\PCHealth
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-25 21:57 . 2001-08-23 12:00 293376 ----a-w- c:\windows\system32\winsrv.dll
2011-11-23 13:25 . 2001-08-23 12:00 1859584 ----a-w- c:\windows\system32\win32k.sys
2011-11-18 12:35 . 2004-06-04 15:40 60416 ----a-w- c:\windows\system32\packager.exe
2011-11-16 14:21 . 2004-07-14 11:44 354816 ----a-w- c:\windows\system32\winhttp.dll
2011-11-16 14:21 . 2001-08-23 12:00 152064 ----a-w- c:\windows\system32\schannel.dll
2011-12-21 07:24 . 2012-01-27 23:42 121816 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
2008-09-29 12:07 . 2009-05-04 11:44 22576 ----a-w- c:\program files\mozilla firefox\components\Scriptff.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HP Deskjet 3050A J611 series (NET)"="c:\program files\HP\HP Deskjet 3050A J611 series\Bin\ScanToPCActivationApp.exe" [2011-03-30 1721192]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nwiz"="nwiz.exe" [2008-05-26 1630208]
"AlcxMonitor"="ALCXMNTR.EXE" [2004-09-07 57344]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-26 8523776]
"InCD"="c:\program files\Ahead\InCD\InCD.exe" [2003-09-01 1200178]
"McAfeeUpdaterUI"="c:\program files\McAfee\Common Framework\UdaterUI.exe" [2008-05-13 136512]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2005-05-20 28160]
"ShStatEXE"="c:\program files\McAfee\VirusScan Enterprise\SHSTAT.EXE" [2008-09-29 124240]
"Intuit SyncManager"="c:\program files\Common Files\Intuit\Sync\IntuitSyncManager.exe" [2009-12-22 1092872]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-26 81920]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
.
c:\documents and settings\flabuski\Start Menu\Programs\Startup\
Monitor Ink Alerts - HP Deskjet 3050A J611 series (Network).lnk - c:\windows\system32\RunDll32.exe [2001-8-23 33280]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2011-07-19 113024]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2011-05-04 17:54 551296 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1004336348-2077806209-725345543-2924\Scripts\Logoff\0\0]
"Script"=lo1.cmd
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1004336348-2077806209-725345543-2924\Scripts\Logon\0\0]
"Script"=li1.cmd
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\McAfeeEngineService]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Netlogon"=2 (0x2)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Intuit\\QuickBooks 2009\\QBDBMgrN.exe"=
"c:\\Program Files\\SkyGolf\\SkyCaddie Desktop\\SkyCaddieDesktop.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\McAfee\\Common Framework\\FrameworkService.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"25374:TCP"= 25374:TCP:SNL Inbound
"25375:TCP"= 25375:TCP:SNL Outbound
"52311:UDP"= 52311:UDP:BES Client
.
R1 ATMhelpr;ATMhelpr;c:\windows\system32\drivers\ATMHELPR.SYS [8/19/2005 7:00 AM 4064]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [7/22/2011 11:27 AM 12880]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [7/12/2011 4:55 PM 67664]
R2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCore.exe [8/11/2011 6:38 PM 116608]
R2 McAfeeEngineService;McAfee Engine Service;c:\program files\McAfee\VirusScan Enterprise\engineserver.exe [9/29/2008 7:07 AM 19456]
R2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [5/4/2009 6:44 AM 67904]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [1/20/2012 6:54 PM 136176]
S3 DVXUSBKS;DVXCEL Streaming Class Driver;c:\windows\system32\drivers\DVXUSBKS.sys [8/29/2003 11:26 AM 46397]
S3 DVXUSBLD;DVXUSBLD;c:\windows\system32\drivers\DVXUSBLD.SYS [8/28/2003 12:34 PM 65241]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [1/20/2012 6:54 PM 136176]
S3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [5/4/2009 6:44 AM 64432]
S3 Pcouffin;Low level access layer for CD devices;c:\windows\system32\Drivers\Pcouffin.sys --> c:\windows\system32\Drivers\Pcouffin.sys [?]
S4 msvsmon80;Visual Studio 2005 Remote Debugger;c:\program files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe [9/23/2005 6:01 AM 2799808]
.
Contents of the 'Scheduled Tasks' folder
.
2012-01-29 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]
.
2012-02-10 c:\windows\Tasks\At1.job
- c:\program files\HP\HP Deskjet 3050A J611 series\Bin\HPCustPartic.exe [2011-03-30 22:48]
.
2012-02-11 c:\windows\Tasks\At2.job
- c:\program files\HP\HP Deskjet 3050A J611 series\Bin\HPCustPartic.exe [2011-03-30 22:48]
.
2012-02-10 c:\windows\Tasks\At3.job
- c:\program files\HP\HP Deskjet 3050A J611 series\Bin\HPCustPartic.exe [2011-03-30 22:48]
.
2012-02-10 c:\windows\Tasks\At4.job
- c:\program files\HP\HP Deskjet 3050A J611 series\Bin\HPCustPartic.exe [2011-03-30 22:48]
.
2012-02-11 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-01-20 23:54]
.
2012-02-11 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-01-20 23:54]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.cnn.com/
uInternet Settings,ProxyOverride = 127.0.0.1;*.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.2.1
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {1ED48504-8834-11D5-AC75-0008C73FD642} - file://c:\program files\proeWildfire 2.0\i486_nt\obj\pvx_install.exe
DPF: {74F5614A-8A8C-43B4-8CC2-4B4EFAF4A6C5} - hxxp://www.techsmith.com/codec/tsccinst.cab
FF - ProfilePath - c:\documents and settings\flabuski\Application Data\Mozilla\Firefox\Profiles\89ohh2zp.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.drudgereport.com/
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-02-11 15:52
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F9E7FB8A-7FC0-F5C6-C2C005BCC6E52A75}\{38D64012-6403-EA81-41E60280EAB79558}\{8D4E630B-001F-4733-DF87B943421629E7}*]
"63AUOURV1X6YIYB2ELIFO4LTRC1"=hex:01,00,01,00,00,00,00,00,87,da,ad,38,2b,26,f8,
c3,35,81,92,71,e8,29,5a,84,14,35,16,70,d8,6e,ff,61
.
[HKEY_LOCAL_MACHINE\software\DeterministicNetworks\DNE\Parameters]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,79,00,73,00,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(612)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\WININET.dll
.
- - - - - - - > 'explorer.exe'(5824)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2012-02-11 15:57:28
ComboFix-quarantined-files.txt 2012-02-11 20:57
ComboFix2.txt 2012-02-11 19:14
.
Pre-Run: 46,027,227,136 bytes free
Post-Run: 45,993,226,240 bytes free
.
- - End Of File - - A99FEE8EAAE314BBB114A4ECECC42E72

Re-running ComboFix to remove infections:

• Close any open browsers.
  
• Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  
• Open notepad and copy/paste the text in the quotebox below into it:
  

  
  KillAll::
  
  2012-02-10 c:\windows\Tasks\At1.job
  - c:\program files\HP\HP Deskjet 3050A J611 series\Bin\HPCustPartic.exe [2011-03-30 22:48]
  .
  2012-02-11 c:\windows\Tasks\At2.job
  - c:\program files\HP\HP Deskjet 3050A J611 series\Bin\HPCustPartic.exe [2011-03-30 22:48]
  .
  2012-02-10 c:\windows\Tasks\At3.job
  - c:\program files\HP\HP Deskjet 3050A J611 series\Bin\HPCustPartic.exe [2011-03-30 22:48]
  .
  2012-02-10 c:\windows\Tasks\At4.job
  - c:\program files\HP\HP Deskjet 3050A J611 series\Bin\HPCustPartic.exe [2011-03-30 22:48]
  
  

  
  
• Save this as CFScript.txt, in the same location as ComboFix.exe
  
  
  
  
• Referring to the picture above, drag CFScript into ComboFix.exe
  
• When finished, it shall produce a log for you at C:\ComboFix.txt
  
• I don't need to see the log from the above script
  

***********************************************************
Download Security Check by screen317 from one of the following links and save it to your desktop.

Link 1
Link 2

* Double-click Security Check.bat
* Follow the on-screen instructions inside of the black box.
* A Notepad document should open automatically called checkup.txt
* Post the contents of that document in your next reply.

Note: If a security program requests permission from dig.exe to access the Internet, allow it to do so.
*******************************************************
AVENGER

• Download The Avenger by Swandog46 from here.
  
• Unzip/extract it to a folder on your desktop.
  
• Double click on avenger.exe to run The Avenger.
  
• Click OK.
  
• Make sure that the box next to Scan for rootkits has a tick in it and that the box next to Automatically disable any rootkits found does not have a tick in it.
  
• Click the Execute button.
  
• You will be asked No script has been entered. Do you want to execute a rootkit scan only?.
  
• Click Yes.
  
• You will now be asked First step completed --- The Avenger has been successfully set up to run on next boot. Reboot now?.
  
• Click Yes.
  
• Your PC will now be rebooted.
  
• After your PC has completed the necessary reboots, a log should automatically open. If it does not automatically open, then the log can be found at %systemdrive%\avenger.txt (typically C:\avenger.txt).
  
• Please post this log in your next reply.
  

Security Check


Results of screen317's Security Check version 0.99.31
Windows XP Service Pack 3 x86
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:
Windows Security Center service is not running! This report may not be accurate!
Windows Firewall Enabled!
McAfee VirusScan Enterprise
Antivirus up to date!
```````````````````````````````
Anti-malware/Other Utilities Check:
SUPERAntiSpyware
CCleaner
Java 2 Runtime Environment Standard Edition v1.3.1
Java 2 Runtime Environment, SE v1.4.2_04
Adobe Flash Player 10.3.183.11 Flash Player out of Date!
Adobe Reader 9 Adobe Reader out of date!
Mozilla Firefox (9.0.1)
````````````````````````````````
Process Check:
objlist.exe by Laurent
McAfee VirusScan Enterprise engineserver.exe
McAfee VirusScan Enterprise vstskmgr.exe
McAfee VirusScan Enterprise mcshield.exe
McAfee VirusScan Enterprise SHSTAT.EXE
``````````End of Log````````````

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!


Completed script processing.

*******************

Finished! Terminate.

I'd like to scan your machine with ESET OnlineScan

•Hold down Control and click on the following link to open ESET OnlineScan in a new window.
ESET OnlineScan
•Click the button.
•For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)

• Click on to download the ESET Smart Installer. Save it to your desktop.
  
• Double click on the icon on your desktop.
  

•Check
•Click the button.
•Accept any security warnings from your browser.
•Check
•Push the Start button.
•ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
•When the scan completes, push
•Push , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
•Push the button.
•Push
A log file will be saved here: C:\Program Files\ESET\ESET Online Scanner\log.txt

C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\SmitfraudCgp.zip Win32/Bagle.gen.zip worm cleaned by deleting - quarantined
C:\System Volume Information\_restore{2A4ADD1F-C42A-4C1D-8252-D1C8DF33E5D1}\RP2797\A0393981.exe a variant of Win32/Kryptik.AALR trojan cleaned by deleting - quarantined
C:\System Volume Information\_restore{2A4ADD1F-C42A-4C1D-8252-D1C8DF33E5D1}\RP2797\A0393982.exe a variant of Win32/Kryptik.AALR trojan cleaned by deleting - quarantined

Please give me an update on how your computer is running now.

Seems to be running ok however, when I do "start-programs" I get the list of programs but there is no content in any of them, although the programs are still installed an run fine.

Also, I can't install a windows update "Security Update for Microsoft .NET Framework 1.1 SP1 on Windows XP, Windows Vista, and Windows Server 2008 x86 (KB2656353)", either automatically or manually. Based on the history of updates, it's been failing to install for a while now.


Other than that, there appears to be no issues.


Thanks!

I get the list of programs but there is no content in any of them, although the programs are still installed an run fine.

Please try this to see if it helps.

• Please download Unhide by Grinler from here and save it to your desktop.
  
• Double click unhide.exe to run the tool.
  
• It will take some time to go through all your files, so please be patient.
  
• If this tool doesn´t fix the problem, please let me know.
  

*******************************************************

Also, I can't install a windows update "Security Update for Microsoft .NET Framework 1.1 SP1 on Windows XP, Windows Vista, and Windows Server 2008 x86 (KB2656353)", either automatically or manually. Based on the history of updates, it's been failing to install for a while now.

Go to Microsoft Windows Update and get all critical updates.
If you still have problems with Windows updates please let me know.
********************************************************
We should do some cleanup.

To uninstall ComboFix

• Click the Start button. Click Run. For Vista: type in Run in the Start search, and click on Run in the results pane.
  
• In the field, type in ComboFix /uninstall
  

(Note: Make sure there's a space between the word ComboFix and the forward-slash.)

• Then, press Enter, or click OK.
  
• This will uninstall ComboFix, delete its folders and files, hides System files and folders, and resets System Restore.
  

*******************************************************
To remove all of the tools we used and the files and folders they created do the following:
Double click OTL.exe.

• Click the CleanUp button.
  
• Select Yes when the "Begin cleanup Process?" prompt appears.
  
• If you are prompted to Reboot during the cleanup, select Yes.
  
• The tool will delete itself once it finishes.
  

Note: If any tool, file or folder (belonging to the program we have used) hasn't been deleted, please delete it manually.
*******************************************************
Clean out your temporary internet files and temp files.

Download TFC by OldTimer to your desktop.

Double-click TFC.exe to run it.

Note: If you are running on Vista, right-click on the file and choose Run As Administrator

TFC will close all programs when run, so make sure you have saved all your work before you begin.

* Click the Start button to begin the cleaning process.
* Depending on how often you clean temp files, execution time should be anywhere from a few seconds to a minute or two.
* Please let TFC run uninterrupted until it is finished.

Once TFC is finished it should restart your computer. If it does not, please manually restart the computer yourself to ensure a complete cleaning.
*******************************************************
Looking over your log it seems you don't have any evidence of a third party firewall.

Firewalls protect against hackers and malicious intruders. You need to download a free firewall from one of these reliable vendors.

Remember only install ONE firewall

1) Comodo Personal Firewall (Uncheck during installation "Install Comodo SafeSurf..", Make Comodo my default search provider" and "Make Comodo Search my homepage" and uncheck any HopSurf and/or Ask.com options if you choose this one)
2) Online Armor
3) Agnitum Outpost
4) PC Tools Firewall Plus

If you are using the built-in Windows XP firewall, it is not recommended as it does not block outgoing connections. This means that any malware on your computer is free to "phone home" for more instructions. Simply put, Windows XP contains a mediocre firewall. This firewall is NO replacement for a dedicated software solution. Remember to use only one firewall at the same time.
**************************************************************
I suggest using WOT - Web of Trust. WOT is a free Internet security addon for your browser. It will keep you safe from online scams, identity theft, spyware, spam, viruses and unreliable shopping sites. WOT warns you before you interact with a risky website. It's easy and it's free.

SpywareBlaster- Secure your Internet Explorer to make it harder for ActiveX programs to run on your computer. Also stop certain cookies from being added to your computer when running Mozilla based browsers like Firefox.
* Using SpywareBlaster to protect your computer from Spyware and Malware
* If you don't know what ActiveX controls are, see here

Protect yourself against spyware using the Immunize feature in Spybot - Search & Destroy. Guide: Use Spybot's Immunize Feature to prevent spyware infection in real-time. Note: To ensure you have the latest Immunizations always update Spybot - Search & Destroy before Immunizing. Spybot - Search & Destroy FAQ

Check out Keeping Yourself Safe On The Web for tips and free tools to help keep you safe in the future.

Also see Slow Computer? It may not be Malware for free cleaning/maintenance tools to help keep your computer running smoothly.
Safe Surfing!

all cleaned up, however the programs are still hidden in the start menu. Also, things like "administrative tools" in the control panel are empty as well.

finally, the windows update will not work. All update except for the high-priority one referenced above.

Do you have your OS disk?

•Please download Dial-A-Fix from one of the following mirrors:

Primary mirror
Secondary mirror

•Extract the zip file to your desktop.

•Double click Dial-a-Fix.exe to start the program. Dial-A-Fix might give you a lot errors, just ignore them and Click
to continue.

•Press the green double checkmark box (Looks like this:


UNcheck Empty Temp Folders, as well as Adjust Time/Date in the prep section. The prep section should then look like this:





•Click on Go

•Wait for Dial-A-Fix to finish (All the checks marks will be all gone)

•Close Dial-A-Fix

OK.....i got some errors during registration DLL section (ie/OE/etc.)

I do have an OS disk.

Thanks

Have you tried to get your updates?

Yeah....it still wasn't working. I did a search and it seems it isn't uncommon, but I have yet to see a resolution.

I was able to manually add the shortcuts for adimistrative tools and system accessories, but all of my Program folder content is still missing.

Thanks!

Boot with your OS disk in and choose Repair. You may have to change your boot order to boot from the disk. Instructions below.
If you do not know how to set your computer to boot from CD follow the steps here

Hi Dave,

I have tried to repair using the OS disc, however I am stuck with system not being able to find files and wanting the XP SP2 CD. In particular, it is saying
"the file asms on XP SP2 CD is needed"

It is kind of in limbo at this point, I can't reboot in safe mode as it is the middle of a repair. Is there a way to cancel or abort the repair process??

Thanks!

-OD

Here's something that may help.