Infected with Antivirus Live

Welcome to Bleeping Computer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.
Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Want a New HP LaserJet MFP? Trade in your old printer and receive $1,000 in savings!
Trade in your old printer and receive up to $1,000 in saving on a new HP LaserJet Multifunction Printer. Click here for savings!

BleepingComputer.com > Security > Virus, Trojan, Spyware, and Malware Removal Logs

Forum Guidelines

Read the following topic before creating a new topic in this forum. It contains instructions on the what we would like you to post, which will enable us to help you more quickly.

Preparation Guide For Use Before Using Malware Removal Tools and Requesting Help

DO NOT RUN ComboFix unless requested to.

Only members of the Malware Response Team or Moderators are allowed to help people with logs. Anyone else should refrain from posting to another user's log.

When posting a log please put the type of infection you have in the topic title. IE: Winfixer, Virtumonde, WinTools, WebSearch, Home Search Assistant, etc.

Do not bump your topic. We try to resolve logs on a first come/first served basis. By bumping your log you will be pushed back in line due to the new date of your bump.

5 Pages

« < 2 3 4 5 >

Infected with Antivirus Live, Don't Know how to remove it.

Options

thewall View Member Profile	Feb 7 2010, 03:47 PM Post #46
Forum Addict Group: Malware Response Team Posts: 6,383 Joined: 19-June 07 From: Florida Member No.: 137,685	OK, I'm back. We are looking this thing over and what we need right now is a fresh OTL log. I know it's a pain but it is all we have to work with at this time. -------------------- If I have helped you then please consider donating so I can continue the fight against malware All donations go directly to the helper Due to the large amount of backlogs we have I cannot respond to PMs for help unless I am already working with you

waffle46528 View Member Profile	Feb 7 2010, 05:55 PM Post #47
Member Group: Members Posts: 32 Joined: 22-January 10 Member No.: 440,080	I'm very sorry to here about your mother. Thats no fun to deal with that. Well, here is OTL log 1. It too exactly an hour to boot. ========== OTL ========== Service\Driver key 5Nh77j.sys not found. File C:\WINDOWS\system32\drivers\5Nh77j.sys not found. Service\Driver key 5Nh77j not found. File C:\WINDOWS\system32\drivers\5Nh77j.sys not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked not found. Registry value HKEY_USERS\Nanci_ON_C\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}\ not found. Registry value HKEY_USERS\Nanci_and_Shawn_ON_C\Software\Microsoft\Windows\CurrentVersion\Run\\Internet Security 2010 not found. Registry value HKEY_USERS\Nanci_and_Shawn_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoSetActiveDesktop not found. Registry value HKEY_USERS\Nanci_and_Shawn_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktopChanges not found. Registry value HKEY_USERS\Nanci_and_Shawn_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\NoDispBackgroundPage not found. Registry value HKEY_USERS\Nanci_and_Shawn_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\NoDispScrSavPage not found. Registry value HKEY_USERS\Nanci_and_Shawn_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\DisableTaskMgr not found. Registry value HKEY_USERS\Nanci_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\NoDispBackgroundPage not found. Registry value HKEY_USERS\Nanci_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\NoDispScrSavPage not found. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\UserInit:" deleted successfully. ========== FILES ========== File\Folder C:\WINDOWS\.tmp not found. File\Folder C:\WINDOWS\System32\.tmp not found. File\Folder C:\WINDOWS\system32\drivers\5Nh77j.sys not found. OTLPE by OldTimer - Version 3.1.27.0 log created on 02072010_173045

waffle46528 View Member Profile	Feb 7 2010, 06:14 PM Post #48
Member Group: Members Posts: 32 Joined: 22-January 10 Member No.: 440,080	Here's OTL log 2 OTL logfile created on: 2/7/2010 5:59:22 PM - Run OTLPE by OldTimer - Version 3.1.27.0 Folder = X:\Programs\OTLPE Microsoft Windows XP Service Pack 3 (Version = 5.1.2600) - Type = SYSTEM Internet Explorer (Version = 8.0.6001.18702) Locale: 00000409 \| Country: United States \| Language: ENU \| Date Format: M/d/yyyy 2.00 Gb Total Physical Memory \| 2.00 Gb Available Physical Memory \| 85.00% Memory free 2.00 Gb Paging File \| 2.00 Gb Available in Paging File \| 96.00% Paging File free Paging file location(s): C:\pagefile.sys 1920 3840 [binary data] %SystemDrive% = C: \| %SystemRoot% = C:\WINDOWS \| %ProgramFiles% = C:\Program Files Drive C: \| 279.47 Gb Total Space \| 30.27 Gb Free Space \| 10.83% Space Free \| Partition Type: NTFS Drive D: \| 111.79 Gb Total Space \| 19.68 Gb Free Space \| 17.61% Space Free \| Partition Type: NTFS Drive E: \| 487.16 Mb Total Space \| 483.13 Mb Free Space \| 99.17% Space Free \| Partition Type: FAT32 F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Drive X: \| 276.79 Mb Total Space \| 0.00 Mb Free Space \| 0.00% Space Free \| Partition Type: CDFS Computer Name: REATOGO Current User Name: SYSTEM Logged in as Administrator. Current Boot Mode: Normal Scan Mode: All users Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard using ControlSet: ControlSet001 ========== Win32 Services (SafeList) ========== SRV - [2009/11/12 16:33:00 \| 00,545,568 \| ---- \| M] (Apple Inc.) [On_Demand] -- C:\Program Files\iPod\bin\iPodService.exe -- (iPod Service) SRV - [2009/08/16 20:25:15 \| 00,908,056 \| ---- \| M] (AVG Technologies CZ, s.r.o.) [Auto] -- C:\Program Files\AVG\AVG8\avgemc.exe -- (avg8emc) SRV - [2009/08/16 20:25:08 \| 00,297,752 \| ---- \| M] (AVG Technologies CZ, s.r.o.) [Auto] -- C:\Program Files\AVG\AVG8\avgwdsvc.exe -- (avg8wd) SRV - [2009/06/30 10:03:25 \| 00,152,984 \| ---- \| M] (Sun Microsystems, Inc.) [Auto] -- C:\Program Files\Java\jre6\bin\jqs.exe -- (JavaQuickStarterService) SRV - [2009/05/29 12:41:26 \| 00,144,712 \| ---- \| M] (Apple Inc.) [Disabled] -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe -- (Apple Mobile Device) SRV - [2008/12/12 10:17:38 \| 00,238,888 \| ---- \| M] (Apple Inc.) [Auto] -- C:\Program Files\Bonjour\mDNSResponder.exe -- (Bonjour Service) SRV - [2008/12/01 15:38:42 \| 00,598,016 \| ---- \| M] (ATI Technologies Inc.) [Auto] -- C:\WINDOWS\system32\ati2evxx.exe -- (Ati HotKey Poller) SRV - [2008/12/01 14:35:00 \| 00,593,920 \| ---- \| M] () [Auto] -- C:\WINDOWS\system32\ati2sgag.exe -- (ATI Smart) SRV - [2008/04/08 15:02:58 \| 00,069,632 \| ---- \| M] () [Auto] -- C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe -- (DTSRVC) SRV - [2008/04/08 14:46:24 \| 00,090,112 \| ---- \| M] (Portrait Displays, Inc.) [Auto] -- C:\Program Files\Common Files\Portrait Displays\Drivers\pdisrvc.exe -- (PdiService) SRV - [2007/10/25 15:27:54 \| 00,266,240 \| ---- \| M] (Microsoft Corporation) [On_Demand] -- C:\Program Files\Windows Live\installer\WLSetupSvc.exe -- (WLSetupSvc) SRV - [2007/10/09 15:21:02 \| 00,124,280 \| ---- \| M] (Seagate Technology LLC) [Auto] -- C:\Program Files\Seagate\Basics\Service\SyncServicesBasics.exe -- (Basics Service) SRV - [2007/04/24 08:19:48 \| 00,138,168 \| ---- \| M] (Google) [Disabled] -- C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe -- (gusvc) SRV - [2006/11/03 18:19:58 \| 00,013,592 \| ---- \| M] (Microsoft Corporation) [Auto] -- C:\Program Files\Windows Defender\MsMpEng.exe -- (WinDefend) SRV - [2006/08/11 20:42:50 \| 00,155,715 \| ---- \| M] (NVIDIA Corporation) [Auto] -- C:\WINDOWS\system32\nvsvc32.exe -- (NVSvc) SRV - [2006/05/12 14:04:08 \| 00,439,248 \| ---- \| M] (RealVNC Ltd.) [Disabled] -- C:\Program Files\RealVNC\VNC4\WinVNC4.exe -- (WinVNC4) SRV - [2006/01/16 11:46:12 \| 00,878,592 \| ---- \| M] (Nero AG) [Auto] -- C:\Program Files\Ahead\InCD\InCDsrv.exe -- (InCDsrvR) InCD Helper (read only) SRV - [2005/11/14 01:06:04 \| 00,069,632 \| ---- \| M] (Macrovision Corporation) [On_Demand] -- C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe -- (IDriverT) SRV - [2005/04/05 11:17:22 \| 00,206,552 \| ---- \| M] (Symantec Corporation) [Disabled] -- C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe -- (SNDSrvc) SRV - [2002/05/03 12:36:24 \| 01,118,208 \| ---- \| M] (Intel Corporation) [Auto] -- C:\WINDOWS\system32\NMSSvc.Exe -- (NMSSvc) Intel® ========== Driver Services (All) ========== DRV - File not found [Kernel \| On_Demand] -- -- (WDICA) DRV - File not found [Kernel \| Disabled] -- -- (ViaIde) DRV - File not found [Kernel \| Disabled] -- -- (ultra) DRV - File not found [Kernel \| Disabled] -- -- (TosIde) DRV - File not found [Kernel \| Disabled] -- -- (symc8xx) DRV - File not found [Kernel \| Disabled] -- -- (symc810) DRV - File not found [Kernel \| Disabled] -- -- (sym_u3) DRV - File not found [Kernel \| Disabled] -- -- (sym_hi) DRV - File not found [Kernel \| On_Demand] -- -- (SUSTUCAP) DRV - File not found [Kernel \| On_Demand] -- -- (SUSTUCAM) DRV - File not found [Kernel \| Disabled] -- -- (Sparrow) DRV - File not found [Kernel \| Disabled] -- -- (Simbad) DRV - File not found [Kernel \| Disabled] -- -- (ql1280) DRV - File not found [Kernel \| Disabled] -- -- (ql1240) DRV - File not found [Kernel \| Disabled] -- -- (ql12160) DRV - File not found [Kernel \| Disabled] -- -- (Ql10wnt) DRV - File not found [Kernel \| Disabled] -- -- (ql1080) DRV - File not found [Kernel \| Disabled] -- -- (perc2hib) DRV - File not found [Kernel \| Disabled] -- -- (perc2) DRV - File not found [Kernel \| On_Demand] -- -- (PDRFRAME) DRV - File not found [Kernel \| On_Demand] -- -- (PDRELI) DRV - File not found [Kernel \| On_Demand] -- -- (PDFRAME) DRV - File not found [Kernel \| On_Demand] -- -- (PDCOMP) DRV - File not found [Kernel \| System] -- -- (PCIDump) DRV - File not found [Kernel \| Auto] -- -- (nvtvSND) DRV - File not found [Kernel \| Disabled] -- -- (mraid35x) DRV - File not found [Kernel \| On_Demand] -- -- (mqdmserd) DRV - File not found [Kernel \| On_Demand] -- -- (mqdmmdm) DRV - File not found [Kernel \| On_Demand] -- -- (mqdmmdfl) Motorola USB Modem (Filter) DRV - File not found [Kernel \| On_Demand] -- -- (mqdmbus) Motorola DM Composite Driver (WDM) DRV - File not found [Kernel \| Auto] -- -- (MCSTRM) DRV - File not found [Kernel \| System] -- -- (lbrtfdc) DRV - File not found [Kernel \| Disabled] -- -- (ini910u) DRV - File not found [Kernel \| Disabled] -- -- (i2omp) DRV - File not found [Kernel \| System] -- -- (i2omgmt) DRV - File not found [Kernel \| Disabled] -- -- (hpn) DRV - File not found [Kernel \| Disabled] -- -- (dpti2o) DRV - File not found [Kernel \| Disabled] -- -- (dac960nt) DRV - File not found [Kernel \| Disabled] -- -- (dac2w2k) DRV - File not found [Kernel \| Disabled] -- -- (Cpqarray) DRV - File not found [Kernel \| Disabled] -- -- (CmdIde) DRV - File not found [Kernel \| System] -- -- (Changer) DRV - File not found [Kernel \| Disabled] -- -- (cd20xrnt) DRV - File not found [Kernel \| Disabled] -- -- (Atdisk) DRV - File not found [Kernel \| Disabled] -- -- (asc3550) DRV - File not found [Kernel \| Disabled] -- -- (asc3350p) DRV - File not found [Kernel \| Disabled] -- -- (asc) DRV - File not found [Kernel \| Disabled] -- -- (amsint) DRV - File not found [Kernel \| Disabled] -- -- (AliIde) DRV - File not found [Kernel \| Disabled] -- -- (aic78xx) DRV - File not found [Kernel \| Disabled] -- -- (aic78u2) DRV - File not found [Kernel \| Disabled] -- -- (Aha154x) DRV - File not found [Kernel \| Disabled] -- -- (adpu160m) DRV - File not found [Kernel \| Disabled] -- -- (abp480n5) DRV - File not found [Kernel \| Disabled] -- -- (Abiosdsk) DRV - [2010/01/21 10:40:26 \| 00,108,552 \| ---- \| M] () [Kernel \| System] -- C:\WINDOWS\System32\Drivers\avgtdix.sys -- (AvgTdiX) DRV - [2009/10/20 11:20:16 \| 00,265,728 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\http.sys -- (HTTP) DRV - [2009/08/16 20:25:22 \| 00,335,240 \| ---- \| M] (AVG Technologies CZ, s.r.o.) [Kernel \| System] -- C:\WINDOWS\System32\Drivers\avgldx86.sys -- (AvgLdx86) DRV - [2009/08/16 20:25:22 \| 00,027,784 \| ---- \| M] (AVG Technologies CZ, s.r.o.) [File_System \| System] -- C:\WINDOWS\System32\Drivers\avgmfx86.sys -- (AvgMfx86) DRV - [2009/06/24 06:18:41 \| 00,092,928 \| ---- \| M] (Microsoft Corporation) [Kernel \| Boot] -- C:\WINDOWS\system32\drivers\ksecdd.sys -- (KSecDD) DRV - [2009/05/18 13:17:00 \| 00,026,600 \| ---- \| M] (GEAR Software Inc.) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\GEARAspiWDM.sys -- (GEARAspiWDM) DRV - [2008/12/11 05:57:09 \| 00,333,952 \| ---- \| M] (Microsoft Corporation) [File_System \| On_Demand] -- C:\WINDOWS\system32\drivers\srv.sys -- (Srv) DRV - [2008/12/01 17:13:40 \| 03,452,928 \| ---- \| M] (ATI Technologies Inc.) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag) DRV - [2008/10/24 06:21:09 \| 00,455,296 \| ---- \| M] (Microsoft Corporation) [File_System \| System] -- C:\WINDOWS\system32\drivers\mrxsmb.sys -- (MRxSmb) DRV - [2008/08/23 04:26:33 \| 00,083,536 \| ---- \| M] (PCTools Research Pty Ltd.) [Kernel \| System] -- C:\WINDOWS\system32\drivers\iksyssec.sys -- (IKSysSec) DRV - [2008/08/23 04:26:30 \| 00,059,984 \| ---- \| M] (PCTools Research Pty Ltd.) [Kernel \| System] -- C:\WINDOWS\system32\drivers\iksysflt.sys -- (IkSysFlt) DRV - [2008/08/23 04:26:08 \| 00,052,304 \| ---- \| M] (PCTools Research Pty Ltd.) [Kernel \| System] -- C:\WINDOWS\system32\drivers\ikfilesec.sys -- (IKFileSec) DRV - [2008/08/23 04:26:07 \| 00,039,248 \| ---- \| M] (PCTools Research Pty Ltd.) [File_System \| System] -- C:\WINDOWS\system32\drivers\ikfileflt.sys -- (IKFileFlt) DRV - [2008/08/14 05:04:36 \| 00,138,496 \| ---- \| M] (Microsoft Corporation) [Kernel \| System] -- C:\WINDOWS\System32\drivers\afd.sys -- (AFD) DRV - [2008/06/20 06:51:12 \| 00,361,600 \| ---- \| M] (Microsoft Corporation) [Kernel \| System] -- C:\WINDOWS\system32\drivers\tcpip.sys -- (Tcpip) DRV - [2008/04/13 19:13:22 \| 00,139,656 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\rdpwd.sys -- (RDPWD) DRV - [2008/04/13 19:13:21 \| 00,021,896 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\tdtcp.sys -- (TDTCP) DRV - [2008/04/13 19:13:20 \| 00,040,840 \| ---- \| M] (Microsoft Corporation) [Kernel \| System] -- C:\WINDOWS\system32\drivers\termdd.sys -- (TermDD) DRV - [2008/04/13 19:13:20 \| 00,012,040 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\tdpipe.sys -- (TDPIPE) DRV - [2008/04/13 14:28:39 \| 00,175,744 \| ---- \| M] (Microsoft Corporation) [File_System \| System] -- C:\WINDOWS\system32\drivers\rdbss.sys -- (Rdbss) DRV - [2008/04/13 14:21:00 \| 00,162,816 \| ---- \| M] (Microsoft Corporation) [Kernel \| System] -- C:\WINDOWS\system32\drivers\netbt.sys -- (NetBT) DRV - [2008/04/13 14:20:42 \| 00,091,520 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\ndiswan.sys -- (NdisWan) DRV - [2008/04/13 14:20:37 \| 00,182,656 \| ---- \| M] (Microsoft Corporation) [Kernel \| Boot] -- C:\WINDOWS\system32\drivers\ndis.sys -- (NDIS) DRV - [2008/04/13 14:19:48 \| 00,048,384 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\raspptp.sys -- (PptpMiniport) WAN Miniport (PPTP) DRV - [2008/04/13 14:19:43 \| 00,051,328 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\rasl2tp.sys -- (Rasl2tp) WAN Miniport (L2TP) DRV - [2008/04/13 14:19:42 \| 00,075,264 \| ---- \| M] (Microsoft Corporation) [Kernel \| System] -- C:\WINDOWS\system32\drivers\ipsec.sys -- (IPSec) DRV - [2008/04/13 14:18:00 \| 00,052,480 \| ---- \| M] (Microsoft Corporation) [Kernel \| System] -- C:\WINDOWS\system32\drivers\i8042prt.sys -- (i8042prt) DRV - [2008/04/13 14:17:18 \| 00,083,072 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\wdmaud.sys -- (wdmaud) DRV - [2008/04/13 14:17:05 \| 00,105,344 \| ---- \| M] (Microsoft Corporation) [File_System \| Boot] -- C:\WINDOWS\system32\drivers\mup.sys -- (Mup) DRV - [2008/04/13 14:15:55 \| 00,060,800 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\sysaudio.sys -- (sysaudio) DRV - [2008/04/13 14:15:53 \| 00,574,976 \| ---- \| M] (Microsoft Corporation) [File_System \| Disabled] -- C:\WINDOWS\system32\drivers\ntfs.sys -- (Ntfs) DRV - [2008/04/13 14:15:45 \| 00,064,512 \| ---- \| M] (Microsoft Corporation) [Kernel \| System] -- C:\WINDOWS\system32\drivers\serial.sys -- (Serial) DRV - [2008/04/13 14:14:29 \| 00,143,744 \| ---- \| M] (Microsoft Corporation) [File_System \| Disabled] -- C:\WINDOWS\system32\drivers\fastfat.sys -- (Fastfat) DRV - [2008/04/13 14:14:21 \| 00,063,744 \| ---- \| M] (Microsoft Corporation) [File_System \| Disabled] -- C:\WINDOWS\system32\drivers\cdfs.sys -- (Cdfs) DRV - [2008/04/13 14:00:19 \| 00,030,080 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\modem.sys -- (Modem) DRV - [2008/04/13 13:57:32 \| 00,041,472 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\raspppoe.sys -- (RasPppoe) DRV - [2008/04/13 13:57:29 \| 00,040,576 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\ndproxy.sys -- (NDProxy) DRV - [2008/04/13 13:57:27 \| 00,014,336 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\asyncmac.sys -- (AsyncMac) DRV - [2008/04/13 13:57:27 \| 00,010,112 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\ndistapi.sys -- (NdisTapi) DRV - [2008/04/13 13:57:21 \| 00,034,560 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\wanarp.sys -- (Wanarp) DRV - [2008/04/13 13:57:15 \| 00,152,832 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\ipnat.sys -- (IpNat) DRV - [2008/04/13 13:57:07 \| 00,020,864 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\ipinip.sys -- (IpInIp) DRV - [2008/04/13 13:56:38 \| 00,069,120 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\psched.sys -- (PSched) DRV - [2008/04/13 13:56:32 \| 00,035,072 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\msgpc.sys -- (Gpc) DRV - [2008/04/13 13:56:02 \| 00,034,688 \| ---- \| M] (Microsoft Corporation) [File_System \| System] -- C:\WINDOWS\system32\drivers\netbios.sys -- (NetBIOS) DRV - [2008/04/13 13:55:58 \| 00,014,592 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\ndisuio.sys -- (Ndisuio) DRV - [2008/04/13 13:54:28 \| 00,011,264 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\irenum.sys -- (IRENUM) DRV - [2008/04/13 13:53:34 \| 00,036,608 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\ip6fw.sys -- (ip6fw) DRV - [2008/04/13 13:51:25 \| 00,059,904 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\atmarpc.sys -- (Atmarpc) DRV - [2008/04/13 13:47:37 \| 00,025,856 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\usbprint.sys -- (usbprint) DRV - [2008/04/13 13:46:25 \| 00,085,248 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\nabtsfec.sys -- (NABTSFEC) DRV - [2008/04/13 13:46:24 \| 00,019,200 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\wstcodec.sys -- (WSTCODEC) DRV - [2008/04/13 13:46:23 \| 00,017,024 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\ccdecode.sys -- (CCDECODE) DRV - [2008/04/13 13:46:23 \| 00,011,136 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\slip.sys -- (SLIP) DRV - [2008/04/13 13:46:22 \| 00,010,880 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\ndisip.sys -- (NdisIP) DRV - [2008/04/13 13:46:21 \| 00,015,232 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\streamip.sys -- (streamip) DRV - [2008/04/13 13:45:39 \| 00,032,128 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\usbccgp.sys -- (usbccgp) DRV - [2008/04/13 13:45:38 \| 00,026,368 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\usbstor.sys -- (USBSTOR) DRV - [2008/04/13 13:45:37 \| 00,059,520 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\usbhub.sys -- (usbhub) DRV - [2008/04/13 13:45:36 \| 00,026,112 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\usbser.sys -- (usbser) DRV - [2008/04/13 13:45:35 \| 00,030,208 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\usbehci.sys -- (usbehci) DRV - [2008/04/13 13:45:35 \| 00,020,608 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\usbuhci.sys -- (usbuhci) DRV - [2008/04/13 13:45:35 \| 00,017,152 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\usbohci.sys -- (usbohci) DRV - [2008/04/13 13:45:34 \| 00,015,104 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\usbscan.sys -- (usbscan) DRV - [2008/04/13 13:45:29 \| 00,010,624 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\gameenum.sys -- (gameenum) DRV - [2008/04/13 13:45:27 \| 00,010,368 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\hidusb.sys -- (hidusb) DRV - [2008/04/13 13:45:13 \| 00,002,944 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\drmkaud.sys -- (drmkaud) DRV - [2008/04/13 13:45:12 \| 00,060,032 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\usbaudio.sys -- (usbaudio) USB Audio Driver (WDM) DRV - [2008/04/13 13:45:09 \| 00,172,416 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\kmixer.sys -- (kmixer) DRV - [2008/04/13 13:45:09 \| 00,056,576 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\swmidi.sys -- (swmidi) DRV - [2008/04/13 13:45:07 \| 00,006,272 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\splitter.sys -- (splitter) DRV - [2008/04/13 13:45:01 \| 00,052,864 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\dmusic.sys -- (DMusic) DRV - [2008/04/13 13:44:48 \| 00,799,744 \| ---- \| M] (Microsoft Corp., Veritas Software) [Kernel \| Disabled] -- C:\WINDOWS\system32\drivers\dmboot.sys -- (dmboot) DRV - [2008/04/13 13:44:46 \| 00,153,344 \| ---- \| M] (Microsoft Corp., Veritas Software) [Kernel \| Disabled] -- C:\WINDOWS\system32\drivers\dmio.sys -- (dmio) DRV - [2008/04/13 13:44:40 \| 00,020,992 \| ---- \| M] (Microsoft Corporation) [Kernel \| System] -- C:\WINDOWS\System32\drivers\vga.sys -- (VgaSave) DRV - [2008/04/13 13:41:01 \| 00,052,352 \| ---- \| M] (Microsoft Corporation) [Kernel \| Boot] -- C:\WINDOWS\system32\drivers\volsnap.sys -- (VolSnap) DRV - [2008/04/13 13:40:58 \| 00,042,112 \| ---- \| M] (Microsoft Corporation) [Kernel \| System] -- C:\WINDOWS\system32\drivers\imapi.sys -- (Imapi) DRV - [2008/04/13 13:40:49 \| 00,019,712 \| ---- \| M] (Microsoft Corporation) [Kernel \| Boot] -- C:\WINDOWS\system32\drivers\partmgr.sys -- (PartMgr) DRV - [2008/04/13 13:40:48 \| 00,011,392 \| ---- \| M] (Microsoft Corporation) [Kernel \| System] -- C:\WINDOWS\system32\drivers\sfloppy.sys -- (Sfloppy) DRV - [2008/04/13 13:40:47 \| 00,036,352 \| ---- \| M] (Microsoft Corporation) [Kernel \| Boot] -- C:\WINDOWS\system32\drivers\disk.sys -- (Disk) DRV - [2008/04/13 13:40:46 \| 00,062,976 \| ---- \| M] (Microsoft Corporation) [Kernel \| System] -- C:\WINDOWS\system32\drivers\cdrom.sys -- (Cdrom) DRV - [2008/04/13 13:40:30 \| 00,096,512 \| ---- \| M] (Microsoft Corporation) [Kernel \| Boot] -- C:\WINDOWS\system32\drivers\atapi.sys -- (atapi) DRV - [2008/04/13 13:40:29 \| 00,005,504 \| ---- \| M] (Microsoft Corporation) [Kernel \| Boot] -- C:\WINDOWS\system32\drivers\intelide.sys -- (IntelIde) DRV - [2008/04/13 13:40:27 \| 00,057,600 \| ---- \| M] (Microsoft Corporation) [Kernel \| System] -- C:\WINDOWS\system32\drivers\redbook.sys -- (redbook) DRV - [2008/04/13 13:40:25 \| 00,027,392 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\fdc.sys -- (Fdc) DRV - [2008/04/13 13:40:25 \| 00,020,480 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\flpydisk.sys -- (Flpydisk) DRV - [2008/04/13 13:40:12 \| 00,015,744 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\serenum.sys -- (serenum) DRV - [2008/04/13 13:40:10 \| 00,080,128 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\parport.sys -- (Parport) DRV - [2008/04/13 13:39:53 \| 00,004,352 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\swenum.sys -- (swenum) DRV - [2008/04/13 13:39:52 \| 00,007,552 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\mskssrv.sys -- (MSKSSRV) DRV - [2008/04/13 13:39:51 \| 00,004,992 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\mspqm.sys -- (MSPQM) DRV - [2008/04/13 13:39:50 \| 00,005,504 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\mstee.sys -- (MSTEE) DRV - [2008/04/13 13:39:50 \| 00,005,376 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\mspclock.sys -- (MSPCLOCK) DRV - [2008/04/13 13:39:47 \| 00,024,576 \| ---- \| M] (Microsoft Corporation) [Kernel \| System] -- C:\WINDOWS\system32\drivers\kbdclass.sys -- (Kbdclass) DRV - [2008/04/13 13:39:47 \| 00,023,040 \| ---- \| M] (Microsoft Corporation) [Kernel \| System] -- C:\WINDOWS\system32\drivers\mouclass.sys -- (Mouclass) DRV - [2008/04/13 13:39:46 \| 00,384,768 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\update.sys -- (Update) DRV - [2008/04/13 13:39:46 \| 00,042,368 \| ---- \| M] (Microsoft Corporation) [Kernel \| Boot] -- C:\WINDOWS\system32\drivers\mountmgr.sys -- (MountMgr) DRV - [2008/04/13 13:36:52 \| 00,073,472 \| ---- \| M] (Microsoft Corporation) [File_System \| Boot] -- C:\WINDOWS\system32\drivers\sr.sys -- (sr) DRV - [2008/04/13 13:36:46 \| 00,015,488 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\mssmbios.sys -- (mssmbios) DRV - [2008/04/13 13:36:44 \| 00,068,224 \| ---- \| M] (Microsoft Corporation) [Kernel \| Boot] -- C:\WINDOWS\system32\drivers\pci.sys -- (PCI) DRV - [2008/04/13 13:36:43 \| 00,120,192 \| ---- \| M] (Microsoft Corporation) [Kernel \| Disabled] -- C:\WINDOWS\system32\drivers\pcmcia.sys -- (Pcmcia) DRV - [2008/04/13 13:36:41 \| 00,037,248 \| ---- \| M] (Microsoft Corporation) [Kernel \| Boot] -- C:\WINDOWS\system32\drivers\isapnp.sys -- (isapnp) DRV - [2008/04/13 13:36:38 \| 00,042,368 \| ---- \| M] (Microsoft Corporation) [Kernel \| Boot] -- C:\WINDOWS\system32\drivers\agp440.sys -- (agp440) DRV - [2008/04/13 13:36:35 \| 00,187,776 \| ---- \| M] (Microsoft Corporation) [Kernel \| Boot] -- C:\WINDOWS\system32\drivers\acpi.sys -- (ACPI) DRV - [2008/04/13 13:33:28 \| 00,044,544 \| ---- \| M] (Microsoft Corporation) [Kernel \| System] -- C:\WINDOWS\system32\drivers\fips.sys -- (Fips) DRV - [2008/04/13 13:32:59 \| 00,129,792 \| ---- \| M] (Microsoft Corporation) [File_System \| Boot] -- C:\WINDOWS\system32\drivers\fltmgr.sys -- (FltMgr) DRV - [2008/04/13 13:32:44 \| 00,180,608 \| ---- \| M] (Microsoft Corporation) [File_System \| On_Demand] -- C:\WINDOWS\system32\drivers\mrxdav.sys -- (MRxDAV) DRV - [2008/04/13 13:32:39 \| 00,030,848 \| ---- \| M] (Microsoft Corporation) [File_System \| System] -- C:\WINDOWS\system32\drivers\npfs.sys -- (Npfs) DRV - [2008/04/13 13:32:39 \| 00,019,072 \| ---- \| M] (Microsoft Corporation) [File_System \| System] -- C:\WINDOWS\system32\drivers\msfs.sys -- (Msfs) DRV - [2008/04/13 13:32:36 \| 00,066,048 \| ---- \| M] (Microsoft Corporation) [File_System \| Disabled] -- C:\WINDOWS\system32\drivers\udfs.sys -- (Udfs) DRV - [2008/04/13 13:31:32 \| 00,036,352 \| ---- \| M] (Microsoft Corporation) [Kernel \| System] -- C:\WINDOWS\system32\drivers\intelppm.sys -- (intelppm) DRV - [2008/04/13 13:31:30 \| 00,035,840 \| ---- \| M] (Microsoft Corporation) [Kernel \| System] -- C:\WINDOWS\system32\drivers\processr.sys -- (Processor) DRV - [2008/04/13 11:39:23 \| 00,142,592 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\aec.sys -- (aec) DRV - [2008/04/08 14:46:48 \| 00,017,064 \| ---- \| M] (Portrait Displays, Inc.) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\PdiPorts.sys -- (PdiPorts) DRV - [2007/11/13 05:25:53 \| 00,020,480 \| ---- \| M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\secdrv.sys -- (Secdrv) DRV - [2007/11/06 11:07:07 \| 00,158,064 \| ---- \| M] (Symantec Corporation) [Kernel \| On_Demand] -- C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20080212.002\SymIDSco.sys -- (SYMIDSCO) DRV - [2007/04/04 18:56:22 \| 00,021,376 \| ---- \| M] (Susteen, Inc.) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\sustucau.sys -- (SUSTUCAU) DRV - [2007/03/16 18:02:46 \| 00,023,600 \| ---- \| M] (EnTech Taiwan) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\TVICHW32.SYS -- (TVICHW32) DRV - [2007/02/27 14:31:30 \| 00,021,504 \| ---- \| M] (Motorola) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\motport.sys -- (motport) DRV - [2007/02/27 14:31:28 \| 00,021,504 \| ---- \| M] (Motorola) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\motmodem.sys -- (motmodem) DRV - [2007/02/27 14:31:18 \| 00,017,792 \| ---- \| M] (Motorola) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\motccgp.sys -- (motccgp) DRV - [2007/02/09 11:17:18 \| 00,017,465 \| ---- \| M] (Portrait Displays, Inc.) [Kernel \| System] -- C:\WINDOWS\system32\drivers\pivot.sys -- (Pivot) DRV - [2007/02/09 11:17:16 \| 00,011,323 \| ---- \| M] (Portrait Displays, Inc.) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\pivotmou.sys -- (pivotmou) DRV - [2007/01/23 19:03:44 \| 00,007,680 \| ---- \| M] (Motorola) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\motccgpfl.sys -- (motccgpfl) DRV - [2006/12/30 20:53:47 \| 00,047,360 \| ---- \| M] (VSO Software) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\pcouffin.sys -- (Pcouffin) DRV - [2006/12/30 20:35:22 \| 00,068,960 \| ---- \| M] (VSO Software) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\Pcatip.sys -- (Pcatip) DRV - [2006/11/02 07:22:54 \| 00,492,000 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\wdf01000.sys -- (Wdf01000) DRV - [2006/10/18 20:00:00 \| 00,038,528 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\wpdusb.sys -- (WpdUsb) DRV - [2006/09/28 19:00:34 \| 00,082,944 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\WudfRd.sys -- (WudfRd) DRV - [2006/09/28 18:55:50 \| 00,077,568 \| ---- \| M] (Microsoft Corporation) [Kernel \| Boot] -- C:\WINDOWS\system32\drivers\WudfPf.sys -- (WudfPf) DRV - [2006/09/15 22:52:12 \| 00,124,016 \| ---- \| M] (Symantec Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\SYMEVENT.SYS -- (SymEvent) DRV - [2006/08/11 20:42:42 \| 03,958,496 \| ---- \| M] (NVIDIA Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv) DRV - [2006/01/17 11:09:34 \| 00,102,016 \| ---- \| M] (Nero AG) [File_System \| Disabled] -- C:\WINDOWS\system32\drivers\InCDfs.sys -- (InCDfs) DRV - [2006/01/17 11:09:28 \| 00,029,440 \| ---- \| M] (Nero AG) [Kernel \| System] -- C:\WINDOWS\system32\drivers\InCDpass.sys -- (InCDPass) DRV - [2006/01/17 04:09:26 \| 00,032,640 \| ---- \| M] (Nero AG) [Kernel \| System] -- C:\WINDOWS\system32\drivers\InCDrm.sys -- (incdrm) DRV - [2006/01/16 18:41:20 \| 00,008,704 \| ---- \| M] (Nero AG) [Recognizer \| System] -- C:\WINDOWS\system32\drivers\InCDrec.sys -- (InCDrec) DRV - [2005/11/17 12:48:30 \| 00,139,776 \| ---- \| M] (Intel Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\e100b325.sys -- (E100B) Intel® DRV - [2005/08/19 03:00:00 \| 00,046,080 \| ---- \| M] (Sonic Solutions) [Kernel \| Boot] -- C:\WINDOWS\system32\drivers\pxhelp20.sys -- (PxHelp20) DRV - [2005/04/14 19:42:00 \| 00,141,582 \| ---- \| M] (NVIDIA Corporation) [Kernel \| Auto] -- C:\WINDOWS\system32\drivers\NVCAP.SYS -- (nvcap) nVidia WDM Video Capture (universal) DRV - [2005/04/14 19:42:00 \| 00,016,496 \| ---- \| M] (NVIDIA Corporation) [Kernel \| Auto] -- C:\WINDOWS\system32\drivers\NVXBAR.SYS -- (NVXBAR) DRV - [2005/04/05 11:17:02 \| 00,267,192 \| ---- \| M] (Symantec Corporation) [Kernel \| System] -- C:\WINDOWS\System32\Drivers\SYMTDI.SYS -- (SYMTDI) DRV - [2005/04/05 11:17:00 \| 00,017,976 \| ---- \| M] (Symantec Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\System32\Drivers\SYMREDRV.SYS -- (SYMREDRV) DRV - [2005/04/05 11:16:58 \| 00,036,984 \| ---- \| M] (Symantec Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\System32\Drivers\SYMIDS.SYS -- (SYMIDS) DRV - [2005/04/05 11:16:56 \| 00,047,192 \| ---- \| M] (Symantec Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\System32\Drivers\SYMNDIS.SYS -- (SYMNDIS) DRV - [2005/04/05 11:16:54 \| 00,173,208 \| ---- \| M] (Symantec Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\System32\Drivers\SYMFW.SYS -- (SYMFW) DRV - [2005/04/05 11:16:52 \| 00,011,512 \| ---- \| M] (Symantec Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\System32\Drivers\SYMDNS.SYS -- (SYMDNS) DRV - [2004/10/21 13:31:14 \| 00,038,691 \| ---- \| M] (Logitech, Inc.) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\LHidUsbK.sys -- (LHidUsbK) DRV - [2004/10/21 13:31:06 \| 00,054,851 \| ---- \| M] (Logitech, Inc.) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\L8042MOU.SYS -- (L8042mou) DRV - [2004/10/21 13:30:56 \| 00,071,535 \| ---- \| M] (Logitech, Inc.) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\LMOUKE.sys -- (LMouKE) DRV - [2004/10/21 13:30:38 \| 00,024,671 \| ---- \| M] (Logitech, Inc.) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\LHidKE.Sys -- (LHidKe) DRV - [2004/08/04 00:31:32 \| 00,020,992 \| ---- \| M] (Realtek Semiconductor Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\rtl8139.sys -- (rtl8139) Realtek RTL8139(A/B/C) DRV - [2003/05/07 20:00:00 \| 00,090,357 \| R--- \| M] (Creative Technology Ltd.) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\P1130Vid.sys -- (P1130VID) DRV - [2002/09/03 08:00:00 \| 00,125,056 \| ---- \| M] (Microsoft Corporation) [Kernel \| Boot] -- C:\WINDOWS\system32\drivers\ftdisk.sys -- (Ftdisk) DRV - [2002/09/03 08:00:00 \| 00,032,896 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\ipfltdrv.sys -- (IpFilterDriver) DRV - [2002/09/03 08:00:00 \| 00,032,512 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\nwlnkfwd.sys -- (NwlnkFwd) DRV - [2002/09/03 08:00:00 \| 00,018,688 \| ---- \| M] (Microsoft Corporation) [Kernel \| System] -- C:\WINDOWS\system32\drivers\cdaudio.sys -- (Cdaudio) DRV - [2002/09/03 08:00:00 \| 00,017,792 \| ---- \| M] (Parallel Technologies, Inc.) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\ptilink.sys -- (Ptilink) DRV - [2002/09/03 08:00:00 \| 00,016,512 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\raspti.sys -- (Raspti) DRV - [2002/09/03 08:00:00 \| 00,013,952 \| ---- \| M] (Microsoft Corporation) [Kernel \| Disabled] -- C:\WINDOWS\system32\drivers\cbidf2k.sys -- (cbidf2k) DRV - [2002/09/03 08:00:00 \| 00,012,416 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\nwlnkflt.sys -- (NwlnkFlt) DRV - [2002/09/03 08:00:00 \| 00,012,160 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\mouhid.sys -- (mouhid) DRV - [2002/09/03 08:00:00 \| 00,012,032 \| ---- \| M] (Microsoft Corporation) [Kernel \| System] -- C:\WINDOWS\System32\drivers\ws2ifsl.sys -- (WS2IFSL) DRV - [2002/09/03 08:00:00 \| 00,011,648 \| ---- \| M] (Microsoft Corporation) [Kernel \| Disabled] -- C:\WINDOWS\system32\drivers\acpiec.sys -- (ACPIEC) DRV - [2002/09/03 08:00:00 \| 00,008,832 \| ---- \| M] (Microsoft Corporation) [Kernel \| System] -- C:\WINDOWS\system32\drivers\rasacd.sys -- (RasAcd) DRV - [2002/09/03 08:00:00 \| 00,007,936 \| ---- \| M] (Microsoft Corporation) [Recognizer \| System] -- C:\WINDOWS\system32\drivers\fs_rec.sys -- (Fs_Rec) DRV - [2002/09/03 08:00:00 \| 00,006,784 \| ---- \| M] (Microsoft Corporation) [Kernel \| Auto] -- C:\WINDOWS\system32\drivers\parvdm.sys -- (ParVdm) DRV - [2002/09/03 08:00:00 \| 00,005,888 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\rootmdm.sys -- (ROOTMODEM) DRV - [2002/09/03 08:00:00 \| 00,005,888 \| ---- \| M] (Microsoft Corp., Veritas Software.) [Kernel \| Disabled] -- C:\WINDOWS\system32\drivers\dmload.sys -- (dmload) DRV - [2002/09/03 08:00:00 \| 00,004,224 \| ---- \| M] (Microsoft Corporation) [Kernel \| System] -- C:\WINDOWS\system32\drivers\rdpcdd.sys -- (RDPCDD) DRV - [2002/09/03 08:00:00 \| 00,004,224 \| ---- \| M] (Microsoft Corporation) [Kernel \| System] -- C:\WINDOWS\system32\drivers\mnmdd.sys -- (mnmdd) DRV - [2002/09/03 08:00:00 \| 00,004,224 \| ---- \| M] (Microsoft Corporation) [Kernel \| System] -- C:\WINDOWS\system32\drivers\beep.sys -- (Beep) DRV - [2002/09/03 08:00:00 \| 00,003,328 \| ---- \| M] (Microsoft Corporation) [Kernel \| Boot] -- C:\WINDOWS\system32\drivers\pciide.sys -- (PCIIde) DRV - [2002/09/03 08:00:00 \| 00,002,944 \| ---- \| M] (Microsoft Corporation) [Kernel \| System] -- C:\WINDOWS\system32\drivers\null.sys -- (Null) DRV - [2002/09/03 08:00:00 \| 00,002,864 \| ---- \| M] (Microsoft Corporation) [Adapter \| On_Demand] -- C:\WINDOWS\system32\winsock.dll -- (Winsock) DRV - [2002/07/19 08:10:20 \| 00,006,656 \| ---- \| M] (Sonic Solutions) [Kernel \| System] -- C:\WINDOWS\system32\drivers\cinemsup.sys -- (Cinemsup) DRV - [2002/05/03 12:36:44 \| 00,009,868 \| ---- \| M] (Intel Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\NMSCFG.SYS -- (NMSCFG) DRV - [2001/08/23 14:00:00 \| 00,022,400 \| ---- \| M] () [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\SbcpHid.sys -- (SbcpHid) DRV - [2001/08/17 08:59:44 \| 00,003,072 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\audstub.sys -- (audstub) DRV - [2001/08/17 07:19:34 \| 00,040,704 \| ---- \| M] (Creative Technology Ltd.) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\es1371mp.sys -- (es1371) Creative AudioPCI (ES1371,ES1373) (WDM) ========== Standard Registry (All) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm IE - HKU\Administrator.NANCISHAWN_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\LocalService_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\Nanci_and_Shawn_ON_C\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm IE - HKU\Nanci_and_Shawn_ON_C\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1 IE - HKU\Nanci_and_Shawn_ON_C\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?p...amp;ar=iesearch IE - HKU\Nanci_and_Shawn_ON_C\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google IE - HKU\Nanci_and_Shawn_ON_C\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerm...tf8&oe=utf8 IE - HKU\Nanci_and_Shawn_ON_C\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://erc2.nscorp.com/TesseractWebServicesWeb/ IE - HKU\Nanci_and_Shawn_ON_C\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie IE - HKU\Nanci_and_Shawn_ON_C\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\WINDOWS\system32\ieframe.dll (Microsoft Corporation) IE - HKU\Nanci_and_Shawn_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\Nanci_and_Shawn_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:5555 IE - HKU\Nanci_ON_C\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKU\Nanci_ON_C\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.amazon.com/s/ref=nb_ss_m/104-11...p;x=18&y=20 IE - HKU\Nanci_ON_C\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\WINDOWS\system32\ieframe.dll (Microsoft Corporation) IE - HKU\Nanci_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\NetworkService_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\Shawn's_Music_-_Jazz_ON_C\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKU\Shawn's_Music_-_Jazz_ON_C\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 IE - HKU\Shawn's_Music_-_Jazz_ON_C\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\WINDOWS\system32\ieframe.dll (Microsoft Corporation) IE - HKU\Shawn's_Music_-_Jazz_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\Smooth_Restauran_ON_C\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKU\Smooth_Restauran_ON_C\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 IE - HKU\Smooth_Restauran_ON_C\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\WINDOWS\system32\ieframe.dll (Microsoft Corporation) IE - HKU\Smooth_Restauran_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 FF - HKLM\software\mozilla\Firefox\extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG8\Firefox [2009/12/22 14:36:23 \| 00,000,000 \| ---D \| M] FF - HKLM\software\mozilla\Firefox\extensions\\{22119944-ED35-4ab1-910B-E619EA06A115}: C:\Program Files\Siber Systems\AI RoboForm\Firefox [2008/11/24 17:10:17 \| 00,000,000 \| ---D \| M] FF - HKLM\software\mozilla\Firefox\extensions\\{20a82645-c095-46ed-80e3-08825760534b}: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [2009/09/02 07:51:32 \| 00,000,000 \| ---D \| M] FF - HKLM\software\mozilla\Firefox\extensions\\jqs@sun.com: C:\Program Files\Java\jre6\lib\deploy\jqs\ff [2008/12/24 05:14:32 \| 00,000,000 \| ---D \| M] FF - HKLM\software\mozilla\Mozilla Firefox 3.0.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/01/23 14:53:03 \| 00,000,000 \| ---D \| M] FF - HKLM\software\mozilla\Mozilla Firefox 3.0.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/01/23 14:49:41 \| 00,000,000 \| ---D \| M] [2010/01/23 14:50:16 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Mozilla Firefox\extensions [2010/01/23 14:49:41 \| 00,000,000 \| ---D \| M] (Default) -- C:\Program Files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [2008/12/24 05:01:56 \| 00,000,000 \| ---D \| M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA} [2009/06/30 10:03:46 \| 00,000,000 \| ---D \| M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} [2010/01/23 14:49:21 \| 00,023,040 \| ---- \| M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\browserdirprovider.dll [2010/01/23 14:49:21 \| 00,134,656 \| ---- \| M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\brwsrcmp.dll [2009/06/30 10:03:28 \| 00,410,984 \| ---- \| M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeploytk.dll [2008/12/20 14:49:26 \| 00,279,888 \| ---- \| M] (Musicnotes, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npmusicn.dll [2010/01/23 14:49:31 \| 00,065,536 \| ---- \| M] (mozilla.org) -- C:\Program Files\Mozilla Firefox\plugins\npnul32.dll [2009/11/23 21:37:15 \| 00,159,744 \| ---- \| M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll [2009/11/23 21:37:15 \| 00,159,744 \| ---- \| M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll [2009/11/23 21:37:15 \| 00,159,744 \| ---- \| M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll [2009/11/23 21:37:15 \| 00,159,744 \| ---- \| M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll [2009/11/23 21:37:15 \| 00,159,744 \| ---- \| M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll [2009/11/23 21:37:15 \| 00,159,744 \| ---- \| M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll [2009/11/23 21:37:15 \| 00,159,744 \| ---- \| M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll [2010/01/23 14:49:33 \| 00,001,394 \| ---- \| M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazondotcom.xml [2010/01/23 14:49:34 \| 00,002,193 \| ---- \| M] () -- C:\Program Files\Mozilla Firefox\searchplugins\answers.xml [2010/01/23 14:49:34 \| 00,001,534 \| ---- \| M] () -- C:\Program Files\Mozilla Firefox\searchplugins\creativecommons.xml [2010/01/23 14:49:34 \| 00,002,642 \| ---- \| M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay.xml [2010/01/23 14:49:34 \| 00,001,706 \| ---- \| M] () -- C:\Program Files\Mozilla Firefox\searchplugins\google.xml [2010/01/23 14:49:34 \| 00,001,178 \| ---- \| M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia.xml [2010/01/23 14:49:34 \| 00,000,792 \| ---- \| M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo.xml O1 HOSTS File: ([2009/03/04 12:41:33 \| 00,302,562 \| R--- \| M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: 127.0.0.1 www.007guard.com O1 - Hosts: 127.0.0.1 007guard.com O1 - Hosts: 127.0.0.1 008i.com O1 - Hosts: 127.0.0.1 www.008k.com O1 - Hosts: 127.0.0.1 008k.com O1 - Hosts: 127.0.0.1 www.00hq.com O1 - Hosts: 127.0.0.1 00hq.com O1 - Hosts: 127.0.0.1 010402.com O1 - Hosts: 127.0.0.1 www.032439.com O1 - Hosts: 127.0.0.1 032439.com O1 - Hosts: 127.0.0.1 www.0scan.com O1 - Hosts: 127.0.0.1 0scan.com O1 - Hosts: 127.0.0.1 www.1000gratisproben.com O1 - Hosts: 127.0.0.1 1000gratisproben.com O1 - Hosts: 127.0.0.1 www.1001namen.com O1 - Hosts: 127.0.0.1 1001namen.com O1 - Hosts: 127.0.0.1 100888290cs.com O1 - Hosts: 127.0.0.1 www.100888290cs.com O1 - Hosts: 127.0.0.1 100sexlinks.com O1 - Hosts: 127.0.0.1 www.100sexlinks.com O1 - Hosts: 127.0.0.1 10sek.com O1 - Hosts: 127.0.0.1 www.10sek.com O1 - Hosts: 127.0.0.1 www.1-2005-search.com O1 - Hosts: 127.0.0.1 1-2005-search.com O1 - Hosts: 10430 more lines... O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (AVG Technologies CZ, s.r.o.) O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.) O2 - BHO: (Windows Live Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\Program Files\Google\GoogleToolbar4.dll (Google Inc.) O2 - BHO: (TBSB01478 Class) - {AC002F1A-6C85-477B-8D1F-F17B72BE7C34} - C:\Program Files\Registered Coupons Toolbar\registered_coupons.dll () O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll (Google Inc.) O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.) O3 - HKLM\..\Toolbar: (&Google) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar4.dll (Google Inc.) O3 - HKLM\..\Toolbar: (&RoboForm) - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.) O3 - HKLM\..\Toolbar: (Registered Coupons) - {84A6AEA7-C34B-4246-9A00-05AD7A36BF00} - C:\Program Files\Registered Coupons Toolbar\registered_coupons.dll () O3 - HKU\Nanci_and_Shawn_ON_C\..\Toolbar\ShellBrowser: (&Address) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation) O3 - HKU\Nanci_and_Shawn_ON_C\..\Toolbar\ShellBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar4.dll (Google Inc.) O3 - HKU\Nanci_and_Shawn_ON_C\..\Toolbar\WebBrowser: (&Address) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation) O3 - HKU\Nanci_and_Shawn_ON_C\..\Toolbar\WebBrowser: (&Links) - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation) O3 - HKU\Nanci_and_Shawn_ON_C\..\Toolbar\WebBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar4.dll (Google Inc.) O3 - HKU\Nanci_and_Shawn_ON_C\..\Toolbar\WebBrowser: (Verizon Broadband Toolbar) - {4E7BD74F-2B8D-469E-D0FC-E57AF4D5FA7D} - Reg Error: Value error. File not found O3 - HKU\Nanci_and_Shawn_ON_C\..\Toolbar\WebBrowser: (&RoboForm) - {724D43A0-0D85-11D4-9908-00400523E39A} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.) O3 - HKU\Nanci_and_Shawn_ON_C\..\Toolbar\WebBrowser: (Registered Coupons) - {84A6AEA7-C34B-4246-9A00-05AD7A36BF00} - C:\Program Files\Registered Coupons Toolbar\registered_coupons.dll () O3 - HKU\Nanci_ON_C\..\Toolbar\WebBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar4.dll (Google Inc.) O3 - HKU\Nanci_ON_C\..\Toolbar\WebBrowser: (Verizon Broadband Toolbar) - {4E7BD74F-2B8D-469E-D0FC-E57AF4D5FA7D} - Reg Error: Value error. File not found O3 - HKU\Nanci_ON_C\..\Toolbar\WebBrowser: (&RoboForm) - {724D43A0-0D85-11D4-9908-00400523E39A} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.) O3 - HKU\Smooth_Restauran_ON_C\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found. O4 - HKLM..\Run: [AVG8_TRAY] C:\Program Files\AVG\AVG8\avgtray.exe (AVG Technologies CZ, s.r.o.) O4 - HKLM..\Run: [basicsmssmenu] C:\Program Files\Seagate\Basics\Basics Status\MaxMenuMgrBasics.exe (Maxtor Corporation) O4 - HKLM..\Run: [Logitech Hardware Abstraction Layer] C:\WINDOWS\KHALMNPR.Exe (Logitech Inc.) O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation) O4 - HKLM..\Run: [SDTray] C:\Program Files\Spyware Doctor\SDTrayApp.exe (PC Tools) O4 - HKU\Nanci_and_Shawn_ON_C..\Run: [$Volumouse$] C:\Program Files\Volumouse\volumouse.exe (NirSoft) O4 - HKU\Nanci_and_Shawn_ON_C..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (Microsoft Corporation) O4 - HKU\Nanci_ON_C..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (Microsoft Corporation) O4 - HKU\Nanci_ON_C..\Run: [MSMSGS] C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) O4 - HKU\Shawn's_Music_-_Jazz_ON_C..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (Microsoft Corporation) O4 - HKU\Shawn's_Music_-_Jazz_ON_C..\Run: [MSMSGS] C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) O4 - HKU\Smooth_Restauran_ON_C..\Run: [MSMSGS] C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1 O7 - HKU\Administrator.NANCISHAWN_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\Nanci_and_Shawn_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 181 O7 - HKU\Nanci_and_Shawn_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0 O7 - HKU\Nanci_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\NetworkService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\Shawn's_Music_-_Jazz_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\Smooth_Restauran_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O9 - Extra Button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation) O9 - Extra Button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html () O9 - Extra 'Tools' menuitem : Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html () O9 - Extra Button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html () O9 - Extra 'Tools' menuitem : Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html () O9 - Extra Button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html () O9 - Extra 'Tools' menuitem : RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html () O9 - Extra Button: Registered Coupons - {84A6AEA7-C34B-4246-9A00-05AD7A36BF00} - C:\Program Files\Registered Coupons Toolbar\registered_coupons.dll () O9 - Extra 'Tools' menuitem : Registered Coupons - {84A6AEA7-C34B-4246-9A00-05AD7A36BF00} - C:\Program Files\Registered Coupons Toolbar\registered_coupons.dll () O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe (Microsoft Corporation) O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - C:\WINDOWS\system32\winrnr.dll (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\WINDOWS\System32\helper32.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\WINDOWS\system32\rsvpsp.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\WINDOWS\system32\rsvpsp.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\WINDOWS\System32\helper32.dll File not found O15 - HKU\Administrator.NANCISHAWN_ON_C\..Trusted Domains: 48 domain(s) and sub-domain(s) not assigned to a zone. O15 - HKU\LocalService_ON_C\..Trusted Domains: 65 domain(s) and sub-domain(s) not assigned to a zone. O15 - HKU\Nanci_and_Shawn_ON_C\..Trusted Domains: hotmail.com ([]* in Trusted sites) O15 - HKU\Nanci_and_Shawn_ON_C\..Trusted Domains: hypertext%20transfer%20protocol ([]* in Trusted sites) O15 - HKU\Nanci_and_Shawn_ON_C\..Trusted Domains: microsoft.com ([]http in Trusted sites) O15 - HKU\Nanci_and_Shawn_ON_C\..Trusted Domains: msn.com ([by106fd.bay106.hotmail] http in Trusted sites) O15 - HKU\Nanci_and_Shawn_ON_C\..Trusted Domains: myfreepaysite.com ([www] http in Trusted sites) O15 - HKU\Nanci_and_Shawn_ON_C\..Trusted Domains: pornmovies.ws ([www] http in Trusted sites) O15 - HKU\Nanci_and_Shawn_ON_C\..Trusted Domains: 57 domain(s) and sub-domain(s) not assigned to a zone. O15 - HKU\Nanci_ON_C\..Trusted Domains: 48 domain(s) and sub-domain(s) not assigned to a zone. O15 - HKU\NetworkService_ON_C\..Trusted Domains: 65 domain(s) and sub-domain(s) not assigned to a zone. O15 - HKU\Shawn's_Music_-_Jazz_ON_C\..Trusted Domains: 48 domain(s) and sub-domain(s) not assigned to a zone. O15 - HKU\Smooth_Restauran_ON_C\..Trusted Domains: 48 domain(s) and sub-domain(s) not assigned to a zone. O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://fpdownload.macromedia.com/get/shock...director/sw.cab (Reg Error: Key error.) O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/...b?1132251339906 (WUWebControl Class) O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdat...b?1135029776156 (MUWebControl Class) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-...indows-i586.cab (Java Plug-in 1.5.0_09) O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab (Shockwave Flash Object) O16 - DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} http://utilities.pcpitstop.com/optimize2/pcpitstop2.dll (PCPitstop Exam) O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.) O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 68.238.0.12 68.237.161.12 O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation) O18 - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\WINDOWS\system32\msvidctl.dll (Microsoft Corporation) O18 - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\gopher {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\ipp - No CLSID value found O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll (Microsoft Corporation) O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation) O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll (AVG Technologies CZ, s.r.o.) O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation) O18 - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation) O18 - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\WINDOWS\system32\inetcomm.dll (Microsoft Corporation) O18 - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp - No CLSID value found O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation) O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Handler\sysimage {76E67A63-06E9-11D2-A840-006008059382} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation) O18 - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\WINDOWS\system32\msvidctl.dll (Microsoft Corporation) O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation) O18 - Protocol\Handler\wia {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINDOWS\system32\wiascr.dll (Microsoft Corporation) O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation) O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\System32\mscoree.dll (Microsoft Corporation) O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\System32\mscoree.dll (Microsoft Corporation) O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\System32\mscoree.dll (Microsoft Corporation) O18 - Protocol\Filter\Class Install Handler {32B533BB-EDAE-11d0-BD5A-00AA00B92AF1} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Filter\deflate {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Filter\gzip {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Filter\lzdhtml {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Filter\text/webviewhtml {733AC4CB-F1A4-11d0-B951-00A0C90312E1} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (c:\windows\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: UIHost - (logonui.exe) - C:\WINDOWS\System32\logonui.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (rundll32 shell32) - C:\WINDOWS\System32\shell32.dll (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (Control_RunDLL "sysdm.cpl") - C:\WINDOWS\System32\sysdm.cpl (Microsoft Corporation) O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.) O20 - Winlogon\Notify\avgrsstarter: DllName - avgrsstx.dll - C:\WINDOWS\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.) O20 - Winlogon\Notify\crypt32chain: DllName - crypt32.dll - C:\WINDOWS\System32\crypt32.dll (Microsoft Corporation) O20 - Winlogon\Notify\cryptnet: DllName - cryptnet.dll - C:\WINDOWS\System32\cryptnet.dll (Microsoft Corporation) O20 - Winlogon\Notify\cscdll: DllName - cscdll.dll - C:\WINDOWS\System32\cscdll.dll (Microsoft Corporation) O20 - Winlogon\Notify\dimsntfy: DllName - %SystemRoot%\System32\dimsntfy.dll - C:\WINDOWS\system32\dimsntfy.dll (Microsoft Corporation) O20 - Winlogon\Notify\ScCertProp: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation) O20 - Winlogon\Notify\Schedule: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation) O20 - Winlogon\Notify\sclgntfy: DllName - sclgntfy.dll - C:\WINDOWS\System32\sclgntfy.dll (Microsoft Corporation) O20 - Winlogon\Notify\SensLogn: DllName - WlNotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation) O20 - Winlogon\Notify\termsrv: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation) O20 - Winlogon\Notify\WgaLogon: DllName - WgaLogon.dll - C:\WINDOWS\System32\WgaLogon.dll (Microsoft Corporation) O20 - Winlogon\Notify\wlballoon: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation) O21 - SSODL: CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation) O21 - SSODL: PostBootReminder - {7849596a-48ea-486e-8937-a2a3009f31a9} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation) O21 - SSODL: SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} - C:\WINDOWS\system32\stobject.dll (Microsoft Corporation) O21 - SSODL: UPnPMonitor - {e57ce738-33e8-4c51-8354-bb4de9d215d1} - C:\WINDOWS\system32\upnpui.dll (Microsoft Corporation) O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\WINDOWS\system32\webcheck.dll (Microsoft Corporation) O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\wpdshserviceobj.dll (Microsoft Corporation) O22 - SharedTaskScheduler: {438755C2-A8BA-11D1-B96B-00A0C90312E1} - Browseui preloader - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation) O22 - SharedTaskScheduler: {8C7461EF-2B13-11d2-BE35-3078302C2030} - Component Categories cache daemon - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation) O28 - HKLM ShellExecuteHooks: {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - C:\Program Files\Windows Defender\MpShHook.dll (Microsoft Corporation) O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - C:\WINDOWS\System32\shell32.dll (Microsoft Corporation) O29 - HKLM SecurityProviders - (msapsspc.dll) - C:\WINDOWS\System32\msapsspc.dll (Microsoft Corporation) O29 - HKLM SecurityProviders - (schannel.dll) - C:\WINDOWS\System32\schannel.dll (Microsoft Corporation) O29 - HKLM SecurityProviders - (digest.dll) - C:\WINDOWS\System32\digest.dll (Microsoft Corporation) O29 - HKLM SecurityProviders - (msnsspc.dll) - C:\WINDOWS\System32\msnsspc.dll (Microsoft Corporation) O30 - LSA: Authentication Packages - (msv1_0) - C:\WINDOWS\System32\msv1_0.dll (Microsoft Corporation) O30 - LSA: Security Packages - (kerberos) - C:\WINDOWS\System32\kerberos.dll (Microsoft Corporation) O30 - LSA: Security Packages - (msv1_0) - C:\WINDOWS\System32\msv1_0.dll (Microsoft Corporation) O30 - LSA: Security Packages - (schannel) - C:\WINDOWS\System32\schannel.dll (Microsoft Corporation) O30 - LSA: Security Packages - (wdigest) - C:\WINDOWS\System32\wdigest.dll (Microsoft Corporation) O31 - SafeBoot: AlternateShell - cmd.exe O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2005/11/17 12:32:58 \| 00,000,000 \| ---- \| M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O32 - AutoRun File - [2006/03/24 06:06:41 \| 00,000,053 \| R--- \| M] () - X:\AUTORUN.INF -- [ CDFS ] O34 - HKLM BootExecute: (autocheck autochk ) - File not found O35 - comfile [open] -- "%1" % O35 - exefile [open] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2010/02/04 13:19:05 \| 00,000,000 \| ---D \| C] -- C:\Documents and Settings\Nanci and Shawn\Desktop\New Folder (3) [2010/02/03 12:25:54 \| 00,000,000 \| ---D \| C] -- C:\_OTL [2010/02/01 18:25:56 \| 00,000,000 \| --SD \| C] -- C:\Documents and Settings\Administrator.NANCISHAWN\IETldCache [2010/01/26 11:04:53 \| 00,000,000 \| ---D \| C] -- C:\Documents and Settings\Nanci and Shawn\Desktop\New Folder (2) [2010/01/26 11:02:17 \| 00,000,000 \| ---D \| C] -- C:\Documents and Settings\Nanci and Shawn\Desktop\New Folder [2010/01/26 10:41:03 \| 01,117,184 \| ---- \| C] (Internet Security) -- C:\WINDOWS\System32\IS15.exe [2010/01/23 20:24:55 \| 00,000,000 \| ---D \| C] -- C:\Program Files\InternetSecurity2010 [2010/01/23 20:11:52 \| 00,020,480 \| ---- \| C] (IpVOPqgs) -- C:\WINDOWS\System32\winlogon32.exe [2010/01/22 12:39:42 \| 00,472,064 \| ---- \| C] ( ) -- C:\Documents and Settings\Nanci and Shawn\Desktop\RootRepeal.exe [2010/01/19 12:03:46 \| 00,000,000 \| ---D \| C] -- C:\Documents and Settings\Nanci and Shawn\Desktop\WRBR_FM - Powered by StreamAudio_files [2010/01/12 15:39:34 \| 00,471,552 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\aclayers.dll [2008/12/20 14:48:07 \| 00,279,888 \| ---- \| C] (Musicnotes, Inc.) -- C:\Program Files\npmusicn.dll [2006/12/30 20:53:46 \| 00,047,360 \| ---- \| C] (VSO Software) -- C:\Documents and Settings\Nanci and Shawn\Application Data\pcouffin.sys ========== Files - Modified Within 30 Days ========== [2010/02/05 00:09:50 \| 03,670,016 \| ---- \| M] () -- C:\Documents and Settings\Administrator.NANCISHAWN\NTUSER.DAT [2010/02/04 19:29:53 \| 13,631,488 \| ---- \| M] () -- C:\Documents and Settings\Nanci and Shawn\ntuser.dat [2010/02/04 19:29:53 \| 04,718,592 \| ---- \| M] () -- C:\Documents and Settings\Nanci\NTUSER.DAT [2010/02/04 13:22:00 \| 00,000,432 \| ---- \| M] () -- C:\WINDOWS\tasks\Symantec NetDetect.job [2010/02/04 13:20:07 \| 00,000,442 \| -H-- \| M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{52BC6A6C-AF56-4669-B607-0BA8B1419E53}.job [2010/02/04 12:53:14 \| 00,001,018 \| ---- \| M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1214440339-113007714-839522115-1004UA.job [2010/02/04 10:34:08 \| 00,002,206 \| ---- \| M] () -- C:\WINDOWS\System32\wpa.dbl [2010/02/04 10:33:30 \| 00,000,006 \| -H-- \| M] () -- C:\WINDOWS\tasks\SA.DAT [2010/02/04 10:33:24 \| 00,002,048 \| --S- \| M] () -- C:\WINDOWS\bootstat.dat [2010/02/04 10:33:17 \| 21,462,91712 \| -HS- \| M] () -- C:\hiberfil.sys [2010/02/03 21:15:50 \| 00,479,232 \| ---- \| M] () -- C:\Documents and Settings\NetworkService\NTUSER.DAT [2010/02/03 21:15:50 \| 00,458,752 \| ---- \| M] () -- C:\Documents and Settings\LocalService\NTUSER.DAT [2010/02/03 21:15:37 \| 00,000,178 \| -HS- \| M] () -- C:\Documents and Settings\Nanci and Shawn\ntuser.ini [2010/01/27 13:28:54 \| 54,743,474 \| ---- \| M] () -- C:\WINDOWS\System32\drivers\Avg\incavi.avm [2010/01/26 10:41:09 \| 01,117,184 \| ---- \| M] (Internet Security) -- C:\WINDOWS\System32\IS15.exe [2010/01/25 18:30:01 \| 00,000,284 \| ---- \| M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job [2010/01/24 12:53:27 \| 03,932,160 \| ---- \| M] () -- C:\Documents and Settings\Smooth Restauran\NTUSER.DAT [2010/01/24 12:53:27 \| 03,932,160 \| ---- \| M] () -- C:\Documents and Settings\Shawn's Music - Jazz\NTUSER.DAT [2010/01/23 20:27:12 \| 05,939,006 \| -H-- \| M] () -- C:\Documents and Settings\Nanci and Shawn\Local Settings\Application Data\IconCache.db [2010/01/23 20:11:48 \| 00,020,480 \| ---- \| M] (IpVOPqgs) -- C:\WINDOWS\System32\winlogon32.exe [2010/01/22 15:38:10 \| 06,428,005 \| ---- \| M] () -- C:\Documents and Settings\Nanci and Shawn\Desktop\Screen shot - Antivirus.rtf [2010/01/22 13:18:36 \| 00,000,000 \| ---- \| M] () -- C:\Documents and Settings\Nanci and Shawn\Desktop\settings.dat [2010/01/22 12:41:16 \| 00,000,000 \| ---- \| M] () -- C:\Documents and Settings\Nanci and Shawn\Desktop\rkill.reg [2010/01/22 12:34:30 \| 00,472,064 \| ---- \| M] ( ) -- C:\Documents and Settings\Nanci and Shawn\Desktop\RootRepeal.exe [2010/01/22 12:33:18 \| 00,524,288 \| ---- \| M] () -- C:\Documents and Settings\Nanci and Shawn\Desktop\dds.scr [2010/01/22 09:15:30 \| 06,428,005 \| ---- \| M] () -- C:\Documents and Settings\Nanci and Shawn\Desktop\Chrome problems.rtf [2010/01/21 23:53:04 \| 00,000,966 \| ---- \| M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1214440339-113007714-839522115-1004Core.job [2010/01/21 11:18:53 \| 00,000,664 \| ---- \| M] () -- C:\WINDOWS\System32\d3d9caps.dat [2010/01/21 11:18:53 \| 00,000,552 \| ---- \| M] () -- C:\WINDOWS\System32\d3d8caps.dat [2010/01/21 10:40:26 \| 00,108,552 \| ---- \| M] () -- C:\WINDOWS\System32\drivers\avgtdix.sys [2010/01/20 16:56:59 \| 00,096,512 \| ---- \| M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\atapi.sys [2010/01/20 02:46:40 \| 00,142,495 \| ---- \| M] () -- C:\WINDOWS\System32\drivers\Avg\microavi.avg [2010/01/19 18:43:32 \| 00,163,328 \| ---- \| M] () -- C:\Documents and Settings\Nanci and Shawn\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2010/01/19 12:03:46 \| 00,032,218 \| ---- \| M] () -- C:\Documents and Settings\Nanci and Shawn\Desktop\WRBR_FM - Powered by StreamAudio.htm [2010/01/19 10:59:53 \| 00,000,116 \| ---- \| M] () -- C:\WINDOWS\NeroDigital.ini [2010/01/18 12:46:49 \| 00,000,591 \| ---- \| M] () -- C:\WINDOWS\win.ini [2010/01/18 12:46:49 \| 00,000,227 \| ---- \| M] () -- C:\WINDOWS\system.ini [2010/01/18 12:46:49 \| 00,000,211 \| RHS- \| M] () -- C:\boot.ini [2010/01/15 20:00:00 \| 00,000,484 \| ---- \| M] () -- C:\WINDOWS\tasks\Norton AntiVirus - Scan my computer.job [2010/01/14 11:12:06 \| 00,181,120 \| ---- \| M] (Microsoft Corporation) -- C:\WINDOWS\System32\MpSigStub.exe [2010/01/12 17:44:57 \| 00,001,374 \| ---- \| M] () -- C:\WINDOWS\imsins.BAK [2010/01/09 11:19:01 \| 00,002,892 \| ---- \| M] () -- C:\WINDOWS\EaseAudioConverter.ini ========== Files Created - No Company Name ========== [2010/01/26 15:14:29 \| 21,462,91712 \| -HS- \| C] () -- C:\hiberfil.sys [2010/01/22 15:38:09 \| 06,428,005 \| ---- \| C] () -- C:\Documents and Settings\Nanci and Shawn\Desktop\Screen shot - Antivirus.rtf [2010/01/22 13:18:36 \| 00,000,000 \| ---- \| C] () -- C:\Documents and Settings\Nanci and Shawn\Desktop\settings.dat [2010/01/22 12:41:29 \| 00,000,000 \| ---- \| C] () -- C:\Documents and Settings\Nanci and Shawn\Desktop\rkill.reg [2010/01/22 12:39:36 \| 00,524,288 \| ---- \| C] () -- C:\Documents and Settings\Nanci and Shawn\Desktop\dds.scr [2010/01/22 09:15:23 \| 06,428,005 \| ---- \| C] () -- C:\Documents and Settings\Nanci and Shawn\Desktop\Chrome problems.rtf [2010/01/21 11:18:53 \| 00,000,664 \| ---- \| C] () -- C:\WINDOWS\System32\d3d9caps.dat [2010/01/21 11:18:53 \| 00,000,552 \| ---- \| C] () -- C:\WINDOWS\System32\d3d8caps.dat [2010/01/19 12:03:44 \| 00,032,218 \| ---- \| C] () -- C:\Documents and Settings\Nanci and Shawn\Desktop\WRBR_FM - Powered by StreamAudio.htm [2009/12/10 11:50:25 \| 00,000,038 \| ---- \| C] () -- C:\WINDOWS\avisplitter.ini [2009/12/10 11:50:24 \| 00,881,664 \| ---- \| C] () -- C:\WINDOWS\System32\xvidcore.dll [2009/12/10 11:50:24 \| 00,205,824 \| ---- \| C] () -- C:\WINDOWS\System32\xvidvfw.dll [2009/12/10 11:50:21 \| 00,085,504 \| ---- \| C] () -- C:\WINDOWS\System32\ff_vfw.dll [2009/12/10 11:50:21 \| 00,000,547 \| ---- \| C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest [2009/04/09 17:14:09 \| 00,002,304 \| ---- \| C] () -- C:\WINDOWS\System32\Machnm32.sys [2009/01/07 11:52:50 \| 00,870,128 \| ---- \| C] () -- C:\Documents and Settings\Nanci and Shawn\Application Data\mcs.rma [2009/01/07 11:52:50 \| 00,000,004 \| ---- \| C] () -- C:\Documents and Settings\Nanci and Shawn\Application Data\3F5E20 [2009/01/03 08:52:15 \| 00,354,816 \| ---- \| C] () -- C:\WINDOWS\System32\psisdecd.dll [2008/08/26 11:38:20 \| 00,034,308 \| ---- \| C] () -- C:\WINDOWS\System32\Chip.dll [2008/05/25 04:38:31 \| 00,108,552 \| ---- \| C] () -- C:\WINDOWS\System32\drivers\avgtdix.sys [2007/01/31 17:22:13 \| 00,001,548 \| ---- \| C] () -- C:\Documents and Settings\Nanci and Shawn\Application Data\HPCOM_48BitScanUpdate.log [2007/01/31 17:22:13 \| 00,000,214 \| ---- \| C] () -- C:\WINDOWS\HP_48BitScanUpdatePatch.ini [2007/01/30 19:31:46 \| 00,002,892 \| ---- \| C] () -- C:\WINDOWS\EaseAudioConverter.ini [2007/01/24 11:43:19 \| 00,000,026 \| ---- \| C] () -- C:\WINDOWS\dvdSanta.INI [2007/01/13 14:27:52 \| 00,000,059 \| ---- \| C] () -- C:\WINDOWS\LTDLG13N.INI [2007/01/08 05:47:08 \| 00,178,176 \| ---- \| C] () -- C:\WINDOWS\System32\unrar.dll [2006/12/31 14:08:11 \| 00,000,116 \| ---- \| C] () -- C:\WINDOWS\NeroDigital.ini [2006/12/30 20:53:47 \| 00,087,608 \| ---- \| C] () -- C:\Documents and Settings\Nanci and Shawn\Application Data\ezpinst.exe [2006/12/30 20:53:47 \| 00,007,824 \| ---- \| C] () -- C:\Documents and Settings\Nanci and Shawn\Application Data\pcouffin.cat [2006/12/30 20:53:47 \| 00,000,034 \| ---- \| C] () -- C:\Documents and Settings\Nanci and Shawn\Application Data\pcouffin.log [2006/12/30 20:53:46 \| 00,001,144 \| ---- \| C] () -- C:\Documents and Settings\Nanci and Shawn\Application Data\pcouffin.inf [2006/12/24 12:28:53 \| 00,000,043 \| ---- \| C] () -- C:\WINDOWS\hpfccopy.INI [2006/11/03 09:15:57 \| 00,000,128 \| ---- \| C] () -- C:\Documents and Settings\Nanci\Local Settings\Application Data\fusioncache.dat [2006/11/01 13:00:34 \| 00,000,138 \| ---- \| C] () -- C:\Documents and Settings\Nanci and Shawn\Local Settings\Application Data\fusioncache.dat [2006/09/12 11:12:54 \| 00,106,496 \| ---- \| C] () -- C:\WINDOWS\System32\APmpg4v1.dll [2006/09/11 08:47:53 \| 00,000,000 \| ---- \| C] () -- C:\WINDOWS\Topo.INI [2006/08/11 20:45:20 \| 00,581,632 \| ---- \| C] () -- C:\WINDOWS\System32\nvhwvid.dll [2006/08/11 20:43:10 \| 00,196,608 \| ---- \| C] () -- C:\WINDOWS\System32\nvapi.dll [2006/08/11 20:43:00 \| 01,662,976 \| ---- \| C] () -- C:\WINDOWS\System32\nvwdmcpl.dll [2006/08/11 20:43:00 \| 01,470,464 \| ---- \| C] () -- C:\WINDOWS\System32\nview.dll [2006/08/11 20:43:00 \| 01,019,904 \| ---- \| C] () -- C:\WINDOWS\System32\nvwimg.dll [2006/08/11 20:43:00 \| 00,466,944 \| ---- \| C] () -- C:\WINDOWS\System32\nvshell.dll [2006/08/11 20:43:00 \| 00,286,720 \| ---- \| C] () -- C:\WINDOWS\System32\nvnt4cpl.dll [2006/04/14 10:37:26 \| 00,000,037 \| ---- \| C] () -- C:\WINDOWS\aceg.ini [2006/01/01 16:25:21 \| 00,000,028 \| ---- \| C] () -- C:\WINDOWS\Systems.ini [2005/12/07 17:36:39 \| 00,000,062 \| ---- \| C] () -- C:\WINDOWS\DpxCalendar.INI [2005/11/30 10:48:10 \| 00,000,301 \| ---- \| C] () -- C:\WINDOWS\hpqcopy.INI [2005/11/30 03:08:47 \| 00,000,059 \| ---- \| C] () -- C:\WINDOWS\WININIT.INI [2005/11/25 12:28:14 \| 00,000,093 \| ---- \| C] () -- C:\WINDOWS\R300.ini [2005/11/18 16:53:15 \| 00,163,328 \| ---- \| C] () -- C:\Documents and Settings\Nanci and Shawn\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2005/11/18 16:41:29 \| 00,000,754 \| ---- \| C] () -- C:\WINDOWS\WORDPAD.INI [2005/07/25 10:25:52 \| 00,000,000 \| ---- \| C] () -- C:\WINDOWS\System32\px.ini [2004/01/30 09:37:50 \| 00,000,092 \| R--- \| C] () -- C:\WINDOWS\System32\FTDIUN2K.INI [2002/03/26 09:36:48 \| 00,069,632 \| ---- \| C] () -- C:\WINDOWS\System32\PROInst.dll [2002/03/01 14:43:34 \| 00,028,008 \| ---- \| C] () -- C:\WINDOWS\System32\SUSUSB.SYS [2002/02/06 09:04:14 \| 00,065,536 \| ---- \| C] () -- C:\WINDOWS\System32\NMSInst.dll [2001/12/03 16:50:58 \| 00,147,456 \| R--- \| C] () -- C:\WINDOWS\System32\LTTLS13N.DLL [2001/12/03 16:50:20 \| 00,708,608 \| R--- \| C] () -- C:\WINDOWS\System32\LTCRY13N.DLL [2001/08/23 14:00:00 \| 00,022,400 \| ---- \| C] () -- C:\WINDOWS\System32\drivers\SbcpHid.sys [2000/07/07 06:49:30 \| 00,069,120 \| R--- \| C] () -- C:\WINDOWS\System32\LTDLL.DLL [2000/04/12 16:28:12 \| 00,118,784 \| R--- \| C] () -- C:\WINDOWS\System32\LFKODAK.DLL [2000/04/12 16:24:10 \| 00,338,944 \| R--- \| C] () -- C:\WINDOWS\System32\LFFPX7.DLL [1999/09/20 10:05:32 \| 00,013,387 \| ---- \| C] () -- C:\WINDOWS\System32\CinemSup.sys ========== LOP Check ========== [2006/08/28 02:44:25 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Nanci and Shawn\Application Data\.BitTornado [2007/12/31 17:33:13 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Nanci and Shawn\Application Data\Audacity [2006/12/31 13:58:57 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Nanci and Shawn\Application Data\CopyToDvd [2009/01/27 18:02:58 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Nanci and Shawn\Application Data\Digitope [2009/04/09 17:17:52 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Nanci and Shawn\Application Data\DisplayTune [2009/01/27 18:06:07 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Nanci and Shawn\Application Data\DPA [2009/01/28 08:36:11 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Nanci and Shawn\Application Data\GoodSync [2005/12/02 18:18:30 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Nanci and Shawn\Application Data\iMesh [2005/11/25 11:03:15 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Nanci and Shawn\Application Data\InterTrust [2005/11/18 14:19:43 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Nanci and Shawn\Application Data\Kazaa Lite [2005/11/25 12:30:14 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Nanci and Shawn\Application Data\Leadertech [2008/05/20 00:32:26 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Nanci and Shawn\Application Data\MSNInstaller [2006/09/02 13:16:14 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Nanci and Shawn\Application Data\NCH Swift Sound [2009/07/15 19:17:42 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Nanci and Shawn\Application Data\OpenOffice.org [2006/12/30 21:27:33 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Nanci and Shawn\Application Data\Simple Star [2007/12/02 20:02:03 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Nanci and Shawn\Application Data\Snapfish [2010/01/21 10:31:10 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Nanci and Shawn\Application Data\uTorrent [2009/09/23 18:26:11 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Nanci and Shawn\Application Data\Vso [2007/12/02 16:51:50 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Nanci and Shawn\Application Data\Windows Live Writer [2006/11/03 15:41:04 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Nanci\Application Data\MSNInstaller [2010/02/04 13:20:07 \| 00,000,442 \| -H-- \| M] () -- C:\WINDOWS\Tasks\User_Feed_Synchronization-{52BC6A6C-AF56-4669-B607-0BA8B1419E53}.job ========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\.exe > < MD5 for: AGP440.SYS > [2007/12/21 15:28:01 \| 22,245,337 \| ---- \| M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys [2008/08/28 06:55:25 \| 23,852,652 \| ---- \| M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys [2007/12/21 15:28:01 \| 22,245,337 \| ---- \| M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp2.cab:AGP440.sys [2008/08/28 06:55:25 \| 23,852,652 \| ---- \| M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys [2008/08/28 06:55:25 \| 23,852,652 \| ---- \| M] () .cab file -- C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\sp3.cab:AGP440.sys [2008/04/13 13:36:38 \| 00,042,368 \| ---- \| M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys [2008/04/13 13:36:38 \| 00,042,368 \| ---- \| M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\agp440.sys [2008/04/13 13:36:38 \| 00,042,368 \| ---- \| M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys [2004/08/04 01:07:41 \| 00,042,368 \| ---- \| M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB -- C:\WINDOWS\$NtServicePackUninstall$\agp440.sys [2004/08/04 01:07:41 \| 00,042,368 \| ---- \| M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB -- C:\WINDOWS\system32\ReinstallBackups\0009\DriverFiles\i386\AGP440.SYS < MD5 for: ATAPI.SYS > [2002/09/03 08:00:00 \| 10,158,890 \| ---- \| M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp1.cab:atapi.sys [2007/12/21 15:28:01 \| 22,245,337 \| ---- \| M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys [2008/08/28 06:55:25 \| 23,852,652 \| ---- \| M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys [2007/12/21 15:28:01 \| 22,245,337 \| ---- \| M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp2.cab:atapi.sys [2008/08/28 06:55:25 \| 23,852,652 \| ---- \| M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys [2008/08/28 06:55:25 \| 23,852,652 \| ---- \| M] () .cab file -- C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\sp3.cab:atapi.sys [2008/04/13 13:40:30 \| 00,096,512 \| ---- \| M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys [2008/04/13 13:40:30 \| 00,096,512 \| ---- \| M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\atapi.sys [2010/01/20 16:56:59 \| 00,096,512 \| ---- \| M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\dllcache\atapi.sys [2008/04/13 13:40:30 \| 00,096,512 \| ---- \| M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys [2004/08/04 00:59:42 \| 00,095,360 \| ---- \| M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys < MD5 for: EVENTLOG.DLL > [2008/04/13 19:11:53 \| 00,056,320 \| ---- \| M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll [2008/04/13 19:11:53 \| 00,056,320 \| ---- \| M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\eventlog.dll [2008/04/13 19:11:53 \| 00,056,320 \| ---- \| M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\system32\eventlog.dll [2004/08/04 02:56:42 \| 00,055,808 \| ---- \| M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll < MD5 for: NETLOGON.DLL > [2008/04/13 19:12:01 \| 00,407,040 \| ---- \| M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll [2008/04/13 19:12:01 \| 00,407,040 \| ---- \| M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\netlogon.dll [2008/04/13 19:12:01 \| 00,407,040 \| ---- \| M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\system32\netlogon.dll [2004/08/04 02:56:44 \| 00,407,040 \| ---- \| M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll < MD5 for: SCECLI.DLL > [2004/08/04 02:56:44 \| 00,180,224 \| ---- \| M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll [2008/04/13 19:12:05 \| 00,181,248 \| ---- \| M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll [2008/04/13 19:12:05 \| 00,181,248 \| ---- \| M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\scecli.dll [2008/04/13 19:12:05 \| 00,181,248 \| ---- \| M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\system32\scecli.dll < %systemroot%\System32\config\.sav > [2007/12/21 07:01:44 \| 01,048,576 \| ---- \| M] () -- C:\WINDOWS\system32\config\default.sav [2007/12/21 11:44:50 \| 00,049,152 \| ---- \| M] () -- C:\WINDOWS\system32\config\security.sav [2007/12/21 07:01:44 \| 31,158,272 \| ---- \| M] () -- C:\WINDOWS\system32\config\software.sav [2007/12/21 07:01:44 \| 05,242,880 \| ---- \| M] () -- C:\WINDOWS\system32\config\system.sav < End of report >

thewall View Member Profile	Feb 7 2010, 10:54 PM Post #49
Forum Addict Group: Malware Response Team Posts: 6,383 Joined: 19-June 07 From: Florida Member No.: 137,685	We're going to try another script. After you run it go ahead and try to boot up normally once again. If it won't do so and you get any kind of error messages let me know what they are. Boot to the OTLPE CD Please double-click OTLPE.exe to run it as you did before. Copy the lines in the quote below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy): QUOTE :OTL IE - HKU\Nanci_and_Shawn_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:5555 O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\WINDOWS\System32\helper32.dll () O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\WINDOWS\System32\helper32.dll () O15 - HKU\Administrator.NANCISHAWN_ON_C\..Trusted Domains: 48 domain(s) and sub-domain(s) not assigned to a zone. O15 - HKU\LocalService_ON_C\..Trusted Domains: 65 domain(s) and sub-domain(s) not assigned to a zone. O15 - HKU\Nanci_and_Shawn_ON_C\..Trusted Domains: hotmail.com ([]* in Trusted sites) O15 - HKU\Nanci_and_Shawn_ON_C\..Trusted Domains: hypertext%20transfer%20protocol ([]* in Trusted sites) O15 - HKU\Nanci_and_Shawn_ON_C\..Trusted Domains: microsoft.com ([]http in Trusted sites) O15 - HKU\Nanci_and_Shawn_ON_C\..Trusted Domains: msn.com ([by106fd.bay106.hotmail] http in Trusted sites) O15 - HKU\Nanci_and_Shawn_ON_C\..Trusted Domains: myfreepaysite.com ([www] http in Trusted sites) O15 - HKU\Nanci_and_Shawn_ON_C\..Trusted Domains: pornmovies.ws ([www] http in Trusted sites) O15 - HKU\Nanci_and_Shawn_ON_C\..Trusted Domains: 57 domain(s) and sub-domain(s) not assigned to a zone. O15 - HKU\Nanci_ON_C\..Trusted Domains: 48 domain(s) and sub-domain(s) not assigned to a zone. O15 - HKU\NetworkService_ON_C\..Trusted Domains: 65 domain(s) and sub-domain(s) not assigned to a zone. O15 - HKU\Shawn's_Music_-_Jazz_ON_C\..Trusted Domains: 48 domain(s) and sub-domain(s) not assigned to a zone. O15 - HKU\Smooth_Restauran_ON_C\..Trusted Domains: 48 domain(s) and sub-domain(s) not assigned to a zone. :Files C:\WINDOWS\System32\drivers\atapi.sys\|C:\WINDOWS\system32\dllcache\atapi.sys /replace C:\WINDOWS\System32\IS15.exe C:\Program Files\InternetSecurity2010 C:\WINDOWS\System32\winlogon32.exe Return to OTLPE, right click in the "Custom Scans/Fixes" window and choose Paste. Click the red Run Fix button. The computer will restart A report will be produced and saved in the C:\_OTL\MovedFiles folder in the form of Date_Time.log. Open that report and post its contents in a reply. Restart the computer back to the OTLPE CD. Double-click on the OTLPE icon. When asked "Do you wish to load the remote registry", select Yes When asked "Do you wish to load remote user profile(s) for scanning", select Yes Ensure the box "Automatically Load All Remaining Users" is checked and press OK OTL should now start. Change the following settings Change Drivers to All Change Registry to All Under the Custom Scan box paste this in %SYSTEMDRIVE%\.exe /md5start eventlog.dll scecli.dll netlogon.dll cngaudit.dll sceclt.dll ntelogon.dll logevent.dll iaStor.sys nvstor.sys atapi.sys IdeChnDr.sys viasraid.sys AGP440.sys vaxscsi.sys nvatabus.sys viamraid.sys nvata.sys nvgts.sys iastorv.sys ViPrt.sys eNetHook.dll ahcix86.sys KR10N.sys nvstor32.sys ahcix86s.sys nvrd32.sys /md5stop %systemroot%\System32\config\.sav Press Run Scan to start the scan. When finished, the file will be saved in drive C:\OTL.txt Copy this file to your USB drive. Please post the contents of the C:\OTL.txt file in your reply also This post has been edited by thewall: Feb 8 2010, 01:38 AM -------------------- If I have helped you then please consider donating so I can continue the fight against malware All donations go directly to the helper Due to the large amount of backlogs we have I cannot respond to PMs for help unless I am already working with you

waffle46528 View Member Profile	Feb 8 2010, 02:05 AM Post #50
Member Group: Members Posts: 32 Joined: 22-January 10 Member No.: 440,080	Here's OTL log 1 and 2. I'm going to wait until tomorrow to try to boot. If it does should I try to run ComboFix. I've got it on my USB drive ready to go,I renamed it like you said. Here's OTL log 1 and 2 ========== OTL ========== Registry key HKEY_USERS\Nanci_and_Shawn_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\hotmail.com\ deleted successfully. Registry key HKEY_USERS\Nanci_and_Shawn_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\hypertext%20transfer%20protocol\ deleted successfully. Registry key HKEY_USERS\Nanci_and_Shawn_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\microsoft.com\ deleted successfully. Registry key HKEY_USERS\Nanci_and_Shawn_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\msn.com\by106fd.bay106.hotmail\ deleted successfully. Registry key HKEY_USERS\Nanci_and_Shawn_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\myfreepaysite.com\www\ deleted successfully. Registry key HKEY_USERS\Nanci_and_Shawn_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\pornmovies.ws\www\ deleted successfully. Registry key HKEY_USERS\Nanci_and_Shawn_ON_C\\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\msn.com\ deleted successfully. Registry key HKEY_USERS\Nanci_and_Shawn_ON_C\\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\myfreepaysite.com\ deleted successfully. Registry key HKEY_USERS\Nanci_and_Shawn_ON_C\\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\pornmovies.ws\ deleted successfully. ========== FILES ========== C:\WINDOWS\System32\IS15.exe moved successfully. C:\Program Files\InternetSecurity2010 folder moved successfully. C:\WINDOWS\System32\winlogon32.exe moved successfully. OTLPE by OldTimer - Version 3.1.27.0 log created on 02082010_013121 OTL log 2 OTL logfile created on: 2/8/2010 1:41:27 AM - Run OTLPE by OldTimer - Version 3.1.27.0 Folder = X:\Programs\OTLPE Microsoft Windows XP Service Pack 3 (Version = 5.1.2600) - Type = SYSTEM Internet Explorer (Version = 8.0.6001.18702) Locale: 00000409 \| Country: United States \| Language: ENU \| Date Format: M/d/yyyy 2.00 Gb Total Physical Memory \| 2.00 Gb Available Physical Memory \| 85.00% Memory free 2.00 Gb Paging File \| 2.00 Gb Available in Paging File \| 96.00% Paging File free Paging file location(s): C:\pagefile.sys 1920 3840 [binary data] %SystemDrive% = C: \| %SystemRoot% = C:\WINDOWS \| %ProgramFiles% = C:\Program Files Drive C: \| 279.47 Gb Total Space \| 30.27 Gb Free Space \| 10.83% Space Free \| Partition Type: NTFS Drive D: \| 111.79 Gb Total Space \| 19.68 Gb Free Space \| 17.61% Space Free \| Partition Type: NTFS Drive E: \| 487.16 Mb Total Space \| 483.13 Mb Free Space \| 99.17% Space Free \| Partition Type: FAT32 F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Drive X: \| 276.79 Mb Total Space \| 0.00 Mb Free Space \| 0.00% Space Free \| Partition Type: CDFS Computer Name: REATOGO Current User Name: SYSTEM Logged in as Administrator. Current Boot Mode: Normal Scan Mode: All users Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard using ControlSet: ControlSet001 ========== Win32 Services (SafeList) ========== SRV - [2009/11/12 16:33:00 \| 00,545,568 \| ---- \| M] (Apple Inc.) [On_Demand] -- C:\Program Files\iPod\bin\iPodService.exe -- (iPod Service) SRV - [2009/08/16 20:25:15 \| 00,908,056 \| ---- \| M] (AVG Technologies CZ, s.r.o.) [Auto] -- C:\Program Files\AVG\AVG8\avgemc.exe -- (avg8emc) SRV - [2009/08/16 20:25:08 \| 00,297,752 \| ---- \| M] (AVG Technologies CZ, s.r.o.) [Auto] -- C:\Program Files\AVG\AVG8\avgwdsvc.exe -- (avg8wd) SRV - [2009/06/30 10:03:25 \| 00,152,984 \| ---- \| M] (Sun Microsystems, Inc.) [Auto] -- C:\Program Files\Java\jre6\bin\jqs.exe -- (JavaQuickStarterService) SRV - [2009/05/29 12:41:26 \| 00,144,712 \| ---- \| M] (Apple Inc.) [Disabled] -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe -- (Apple Mobile Device) SRV - [2008/12/12 10:17:38 \| 00,238,888 \| ---- \| M] (Apple Inc.) [Auto] -- C:\Program Files\Bonjour\mDNSResponder.exe -- (Bonjour Service) SRV - [2008/12/01 15:38:42 \| 00,598,016 \| ---- \| M] (ATI Technologies Inc.) [Auto] -- C:\WINDOWS\system32\ati2evxx.exe -- (Ati HotKey Poller) SRV - [2008/12/01 14:35:00 \| 00,593,920 \| ---- \| M] () [Auto] -- C:\WINDOWS\system32\ati2sgag.exe -- (ATI Smart) SRV - [2008/04/08 15:02:58 \| 00,069,632 \| ---- \| M] () [Auto] -- C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe -- (DTSRVC) SRV - [2008/04/08 14:46:24 \| 00,090,112 \| ---- \| M] (Portrait Displays, Inc.) [Auto] -- C:\Program Files\Common Files\Portrait Displays\Drivers\pdisrvc.exe -- (PdiService) SRV - [2007/10/25 15:27:54 \| 00,266,240 \| ---- \| M] (Microsoft Corporation) [On_Demand] -- C:\Program Files\Windows Live\installer\WLSetupSvc.exe -- (WLSetupSvc) SRV - [2007/10/09 15:21:02 \| 00,124,280 \| ---- \| M] (Seagate Technology LLC) [Auto] -- C:\Program Files\Seagate\Basics\Service\SyncServicesBasics.exe -- (Basics Service) SRV - [2007/04/24 08:19:48 \| 00,138,168 \| ---- \| M] (Google) [Disabled] -- C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe -- (gusvc) SRV - [2006/11/03 18:19:58 \| 00,013,592 \| ---- \| M] (Microsoft Corporation) [Auto] -- C:\Program Files\Windows Defender\MsMpEng.exe -- (WinDefend) SRV - [2006/08/11 20:42:50 \| 00,155,715 \| ---- \| M] (NVIDIA Corporation) [Auto] -- C:\WINDOWS\system32\nvsvc32.exe -- (NVSvc) SRV - [2006/05/12 14:04:08 \| 00,439,248 \| ---- \| M] (RealVNC Ltd.) [Disabled] -- C:\Program Files\RealVNC\VNC4\WinVNC4.exe -- (WinVNC4) SRV - [2006/01/16 11:46:12 \| 00,878,592 \| ---- \| M] (Nero AG) [Auto] -- C:\Program Files\Ahead\InCD\InCDsrv.exe -- (InCDsrvR) InCD Helper (read only) SRV - [2005/11/14 01:06:04 \| 00,069,632 \| ---- \| M] (Macrovision Corporation) [On_Demand] -- C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe -- (IDriverT) SRV - [2005/04/05 11:17:22 \| 00,206,552 \| ---- \| M] (Symantec Corporation) [Disabled] -- C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe -- (SNDSrvc) SRV - [2002/05/03 12:36:24 \| 01,118,208 \| ---- \| M] (Intel Corporation) [Auto] -- C:\WINDOWS\system32\NMSSvc.Exe -- (NMSSvc) Intel® ========== Driver Services (All) ========== DRV - File not found [Kernel \| On_Demand] -- -- (WDICA) DRV - File not found [Kernel \| Disabled] -- -- (ViaIde) DRV - File not found [Kernel \| Disabled] -- -- (ultra) DRV - File not found [Kernel \| Disabled] -- -- (TosIde) DRV - File not found [Kernel \| Disabled] -- -- (symc8xx) DRV - File not found [Kernel \| Disabled] -- -- (symc810) DRV - File not found [Kernel \| Disabled] -- -- (sym_u3) DRV - File not found [Kernel \| Disabled] -- -- (sym_hi) DRV - File not found [Kernel \| On_Demand] -- -- (SUSTUCAP) DRV - File not found [Kernel \| On_Demand] -- -- (SUSTUCAM) DRV - File not found [Kernel \| Disabled] -- -- (Sparrow) DRV - File not found [Kernel \| Disabled] -- -- (Simbad) DRV - File not found [Kernel \| Disabled] -- -- (ql1280) DRV - File not found [Kernel \| Disabled] -- -- (ql1240) DRV - File not found [Kernel \| Disabled] -- -- (ql12160) DRV - File not found [Kernel \| Disabled] -- -- (Ql10wnt) DRV - File not found [Kernel \| Disabled] -- -- (ql1080) DRV - File not found [Kernel \| Disabled] -- -- (perc2hib) DRV - File not found [Kernel \| Disabled] -- -- (perc2) DRV - File not found [Kernel \| On_Demand] -- -- (PDRFRAME) DRV - File not found [Kernel \| On_Demand] -- -- (PDRELI) DRV - File not found [Kernel \| On_Demand] -- -- (PDFRAME) DRV - File not found [Kernel \| On_Demand] -- -- (PDCOMP) DRV - File not found [Kernel \| System] -- -- (PCIDump) DRV - File not found [Kernel \| Auto] -- -- (nvtvSND) DRV - File not found [Kernel \| Disabled] -- -- (mraid35x) DRV - File not found [Kernel \| On_Demand] -- -- (mqdmserd) DRV - File not found [Kernel \| On_Demand] -- -- (mqdmmdm) DRV - File not found [Kernel \| On_Demand] -- -- (mqdmmdfl) Motorola USB Modem (Filter) DRV - File not found [Kernel \| On_Demand] -- -- (mqdmbus) Motorola DM Composite Driver (WDM) DRV - File not found [Kernel \| Auto] -- -- (MCSTRM) DRV - File not found [Kernel \| System] -- -- (lbrtfdc) DRV - File not found [Kernel \| Disabled] -- -- (ini910u) DRV - File not found [Kernel \| Disabled] -- -- (i2omp) DRV - File not found [Kernel \| System] -- -- (i2omgmt) DRV - File not found [Kernel \| Disabled] -- -- (hpn) DRV - File not found [Kernel \| Disabled] -- -- (dpti2o) DRV - File not found [Kernel \| Disabled] -- -- (dac960nt) DRV - File not found [Kernel \| Disabled] -- -- (dac2w2k) DRV - File not found [Kernel \| Disabled] -- -- (Cpqarray) DRV - File not found [Kernel \| Disabled] -- -- (CmdIde) DRV - File not found [Kernel \| System] -- -- (Changer) DRV - File not found [Kernel \| Disabled] -- -- (cd20xrnt) DRV - File not found [Kernel \| Disabled] -- -- (Atdisk) DRV - File not found [Kernel \| Disabled] -- -- (asc3550) DRV - File not found [Kernel \| Disabled] -- -- (asc3350p) DRV - File not found [Kernel \| Disabled] -- -- (asc) DRV - File not found [Kernel \| Disabled] -- -- (amsint) DRV - File not found [Kernel \| Disabled] -- -- (AliIde) DRV - File not found [Kernel \| Disabled] -- -- (aic78xx) DRV - File not found [Kernel \| Disabled] -- -- (aic78u2) DRV - File not found [Kernel \| Disabled] -- -- (Aha154x) DRV - File not found [Kernel \| Disabled] -- -- (adpu160m) DRV - File not found [Kernel \| Disabled] -- -- (abp480n5) DRV - File not found [Kernel \| Disabled] -- -- (Abiosdsk) DRV - [2010/01/21 10:40:26 \| 00,108,552 \| ---- \| M] () [Kernel \| System] -- C:\WINDOWS\System32\Drivers\avgtdix.sys -- (AvgTdiX) DRV - [2009/10/20 11:20:16 \| 00,265,728 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\http.sys -- (HTTP) DRV - [2009/08/16 20:25:22 \| 00,335,240 \| ---- \| M] (AVG Technologies CZ, s.r.o.) [Kernel \| System] -- C:\WINDOWS\System32\Drivers\avgldx86.sys -- (AvgLdx86) DRV - [2009/08/16 20:25:22 \| 00,027,784 \| ---- \| M] (AVG Technologies CZ, s.r.o.) [File_System \| System] -- C:\WINDOWS\System32\Drivers\avgmfx86.sys -- (AvgMfx86) DRV - [2009/06/24 06:18:41 \| 00,092,928 \| ---- \| M] (Microsoft Corporation) [Kernel \| Boot] -- C:\WINDOWS\system32\drivers\ksecdd.sys -- (KSecDD) DRV - [2009/05/18 13:17:00 \| 00,026,600 \| ---- \| M] (GEAR Software Inc.) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\GEARAspiWDM.sys -- (GEARAspiWDM) DRV - [2008/12/11 05:57:09 \| 00,333,952 \| ---- \| M] (Microsoft Corporation) [File_System \| On_Demand] -- C:\WINDOWS\system32\drivers\srv.sys -- (Srv) DRV - [2008/12/01 17:13:40 \| 03,452,928 \| ---- \| M] (ATI Technologies Inc.) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag) DRV - [2008/10/24 06:21:09 \| 00,455,296 \| ---- \| M] (Microsoft Corporation) [File_System \| System] -- C:\WINDOWS\system32\drivers\mrxsmb.sys -- (MRxSmb) DRV - [2008/08/23 04:26:33 \| 00,083,536 \| ---- \| M] (PCTools Research Pty Ltd.) [Kernel \| System] -- C:\WINDOWS\system32\drivers\iksyssec.sys -- (IKSysSec) DRV - [2008/08/23 04:26:30 \| 00,059,984 \| ---- \| M] (PCTools Research Pty Ltd.) [Kernel \| System] -- C:\WINDOWS\system32\drivers\iksysflt.sys -- (IkSysFlt) DRV - [2008/08/23 04:26:08 \| 00,052,304 \| ---- \| M] (PCTools Research Pty Ltd.) [Kernel \| System] -- C:\WINDOWS\system32\drivers\ikfilesec.sys -- (IKFileSec) DRV - [2008/08/23 04:26:07 \| 00,039,248 \| ---- \| M] (PCTools Research Pty Ltd.) [File_System \| System] -- C:\WINDOWS\system32\drivers\ikfileflt.sys -- (IKFileFlt) DRV - [2008/08/14 05:04:36 \| 00,138,496 \| ---- \| M] (Microsoft Corporation) [Kernel \| System] -- C:\WINDOWS\System32\drivers\afd.sys -- (AFD) DRV - [2008/06/20 06:51:12 \| 00,361,600 \| ---- \| M] (Microsoft Corporation) [Kernel \| System] -- C:\WINDOWS\system32\drivers\tcpip.sys -- (Tcpip) DRV - [2008/04/13 19:13:22 \| 00,139,656 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\rdpwd.sys -- (RDPWD) DRV - [2008/04/13 19:13:21 \| 00,021,896 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\tdtcp.sys -- (TDTCP) DRV - [2008/04/13 19:13:20 \| 00,040,840 \| ---- \| M] (Microsoft Corporation) [Kernel \| System] -- C:\WINDOWS\system32\drivers\termdd.sys -- (TermDD) DRV - [2008/04/13 19:13:20 \| 00,012,040 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\tdpipe.sys -- (TDPIPE) DRV - [2008/04/13 14:28:39 \| 00,175,744 \| ---- \| M] (Microsoft Corporation) [File_System \| System] -- C:\WINDOWS\system32\drivers\rdbss.sys -- (Rdbss) DRV - [2008/04/13 14:21:00 \| 00,162,816 \| ---- \| M] (Microsoft Corporation) [Kernel \| System] -- C:\WINDOWS\system32\drivers\netbt.sys -- (NetBT) DRV - [2008/04/13 14:20:42 \| 00,091,520 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\ndiswan.sys -- (NdisWan) DRV - [2008/04/13 14:20:37 \| 00,182,656 \| ---- \| M] (Microsoft Corporation) [Kernel \| Boot] -- C:\WINDOWS\system32\drivers\ndis.sys -- (NDIS) DRV - [2008/04/13 14:19:48 \| 00,048,384 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\raspptp.sys -- (PptpMiniport) WAN Miniport (PPTP) DRV - [2008/04/13 14:19:43 \| 00,051,328 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\rasl2tp.sys -- (Rasl2tp) WAN Miniport (L2TP) DRV - [2008/04/13 14:19:42 \| 00,075,264 \| ---- \| M] (Microsoft Corporation) [Kernel \| System] -- C:\WINDOWS\system32\drivers\ipsec.sys -- (IPSec) DRV - [2008/04/13 14:18:00 \| 00,052,480 \| ---- \| M] (Microsoft Corporation) [Kernel \| System] -- C:\WINDOWS\system32\drivers\i8042prt.sys -- (i8042prt) DRV - [2008/04/13 14:17:18 \| 00,083,072 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\wdmaud.sys -- (wdmaud) DRV - [2008/04/13 14:17:05 \| 00,105,344 \| ---- \| M] (Microsoft Corporation) [File_System \| Boot] -- C:\WINDOWS\system32\drivers\mup.sys -- (Mup) DRV - [2008/04/13 14:15:55 \| 00,060,800 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\sysaudio.sys -- (sysaudio) DRV - [2008/04/13 14:15:53 \| 00,574,976 \| ---- \| M] (Microsoft Corporation) [File_System \| Disabled] -- C:\WINDOWS\system32\drivers\ntfs.sys -- (Ntfs) DRV - [2008/04/13 14:15:45 \| 00,064,512 \| ---- \| M] (Microsoft Corporation) [Kernel \| System] -- C:\WINDOWS\system32\drivers\serial.sys -- (Serial) DRV - [2008/04/13 14:14:29 \| 00,143,744 \| ---- \| M] (Microsoft Corporation) [File_System \| Disabled] -- C:\WINDOWS\system32\drivers\fastfat.sys -- (Fastfat) DRV - [2008/04/13 14:14:21 \| 00,063,744 \| ---- \| M] (Microsoft Corporation) [File_System \| Disabled] -- C:\WINDOWS\system32\drivers\cdfs.sys -- (Cdfs) DRV - [2008/04/13 14:00:19 \| 00,030,080 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\modem.sys -- (Modem) DRV - [2008/04/13 13:57:32 \| 00,041,472 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\raspppoe.sys -- (RasPppoe) DRV - [2008/04/13 13:57:29 \| 00,040,576 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\ndproxy.sys -- (NDProxy) DRV - [2008/04/13 13:57:27 \| 00,014,336 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\asyncmac.sys -- (AsyncMac) DRV - [2008/04/13 13:57:27 \| 00,010,112 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\ndistapi.sys -- (NdisTapi) DRV - [2008/04/13 13:57:21 \| 00,034,560 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\wanarp.sys -- (Wanarp) DRV - [2008/04/13 13:57:15 \| 00,152,832 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\ipnat.sys -- (IpNat) DRV - [2008/04/13 13:57:07 \| 00,020,864 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\ipinip.sys -- (IpInIp) DRV - [2008/04/13 13:56:38 \| 00,069,120 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\psched.sys -- (PSched) DRV - [2008/04/13 13:56:32 \| 00,035,072 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\msgpc.sys -- (Gpc) DRV - [2008/04/13 13:56:02 \| 00,034,688 \| ---- \| M] (Microsoft Corporation) [File_System \| System] -- C:\WINDOWS\system32\drivers\netbios.sys -- (NetBIOS) DRV - [2008/04/13 13:55:58 \| 00,014,592 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\ndisuio.sys -- (Ndisuio) DRV - [2008/04/13 13:54:28 \| 00,011,264 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\irenum.sys -- (IRENUM) DRV - [2008/04/13 13:53:34 \| 00,036,608 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\ip6fw.sys -- (ip6fw) DRV - [2008/04/13 13:51:25 \| 00,059,904 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\atmarpc.sys -- (Atmarpc) DRV - [2008/04/13 13:47:37 \| 00,025,856 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\usbprint.sys -- (usbprint) DRV - [2008/04/13 13:46:25 \| 00,085,248 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\nabtsfec.sys -- (NABTSFEC) DRV - [2008/04/13 13:46:24 \| 00,019,200 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\wstcodec.sys -- (WSTCODEC) DRV - [2008/04/13 13:46:23 \| 00,017,024 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\ccdecode.sys -- (CCDECODE) DRV - [2008/04/13 13:46:23 \| 00,011,136 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\slip.sys -- (SLIP) DRV - [2008/04/13 13:46:22 \| 00,010,880 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\ndisip.sys -- (NdisIP) DRV - [2008/04/13 13:46:21 \| 00,015,232 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\streamip.sys -- (streamip) DRV - [2008/04/13 13:45:39 \| 00,032,128 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\usbccgp.sys -- (usbccgp) DRV - [2008/04/13 13:45:38 \| 00,026,368 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\usbstor.sys -- (USBSTOR) DRV - [2008/04/13 13:45:37 \| 00,059,520 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\usbhub.sys -- (usbhub) DRV - [2008/04/13 13:45:36 \| 00,026,112 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\usbser.sys -- (usbser) DRV - [2008/04/13 13:45:35 \| 00,030,208 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\usbehci.sys -- (usbehci) DRV - [2008/04/13 13:45:35 \| 00,020,608 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\usbuhci.sys -- (usbuhci) DRV - [2008/04/13 13:45:35 \| 00,017,152 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\usbohci.sys -- (usbohci) DRV - [2008/04/13 13:45:34 \| 00,015,104 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\usbscan.sys -- (usbscan) DRV - [2008/04/13 13:45:29 \| 00,010,624 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\gameenum.sys -- (gameenum) DRV - [2008/04/13 13:45:27 \| 00,010,368 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\hidusb.sys -- (hidusb) DRV - [2008/04/13 13:45:13 \| 00,002,944 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\drmkaud.sys -- (drmkaud) DRV - [2008/04/13 13:45:12 \| 00,060,032 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\usbaudio.sys -- (usbaudio) USB Audio Driver (WDM) DRV - [2008/04/13 13:45:09 \| 00,172,416 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\kmixer.sys -- (kmixer) DRV - [2008/04/13 13:45:09 \| 00,056,576 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\swmidi.sys -- (swmidi) DRV - [2008/04/13 13:45:07 \| 00,006,272 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\splitter.sys -- (splitter) DRV - [2008/04/13 13:45:01 \| 00,052,864 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\dmusic.sys -- (DMusic) DRV - [2008/04/13 13:44:48 \| 00,799,744 \| ---- \| M] (Microsoft Corp., Veritas Software) [Kernel \| Disabled] -- C:\WINDOWS\system32\drivers\dmboot.sys -- (dmboot) DRV - [2008/04/13 13:44:46 \| 00,153,344 \| ---- \| M] (Microsoft Corp., Veritas Software) [Kernel \| Disabled] -- C:\WINDOWS\system32\drivers\dmio.sys -- (dmio) DRV - [2008/04/13 13:44:40 \| 00,020,992 \| ---- \| M] (Microsoft Corporation) [Kernel \| System] -- C:\WINDOWS\System32\drivers\vga.sys -- (VgaSave) DRV - [2008/04/13 13:41:01 \| 00,052,352 \| ---- \| M] (Microsoft Corporation) [Kernel \| Boot] -- C:\WINDOWS\system32\drivers\volsnap.sys -- (VolSnap) DRV - [2008/04/13 13:40:58 \| 00,042,112 \| ---- \| M] (Microsoft Corporation) [Kernel \| System] -- C:\WINDOWS\system32\drivers\imapi.sys -- (Imapi) DRV - [2008/04/13 13:40:49 \| 00,019,712 \| ---- \| M] (Microsoft Corporation) [Kernel \| Boot] -- C:\WINDOWS\system32\drivers\partmgr.sys -- (PartMgr) DRV - [2008/04/13 13:40:48 \| 00,011,392 \| ---- \| M] (Microsoft Corporation) [Kernel \| System] -- C:\WINDOWS\system32\drivers\sfloppy.sys -- (Sfloppy) DRV - [2008/04/13 13:40:47 \| 00,036,352 \| ---- \| M] (Microsoft Corporation) [Kernel \| Boot] -- C:\WINDOWS\system32\drivers\disk.sys -- (Disk) DRV - [2008/04/13 13:40:46 \| 00,062,976 \| ---- \| M] (Microsoft Corporation) [Kernel \| System] -- C:\WINDOWS\system32\drivers\cdrom.sys -- (Cdrom) DRV - [2008/04/13 13:40:30 \| 00,096,512 \| ---- \| M] (Microsoft Corporation) [Kernel \| Boot] -- C:\WINDOWS\system32\drivers\atapi.sys -- (atapi) DRV - [2008/04/13 13:40:29 \| 00,005,504 \| ---- \| M] (Microsoft Corporation) [Kernel \| Boot] -- C:\WINDOWS\system32\drivers\intelide.sys -- (IntelIde) DRV - [2008/04/13 13:40:27 \| 00,057,600 \| ---- \| M] (Microsoft Corporation) [Kernel \| System] -- C:\WINDOWS\system32\drivers\redbook.sys -- (redbook) DRV - [2008/04/13 13:40:25 \| 00,027,392 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\fdc.sys -- (Fdc) DRV - [2008/04/13 13:40:25 \| 00,020,480 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\flpydisk.sys -- (Flpydisk) DRV - [2008/04/13 13:40:12 \| 00,015,744 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\serenum.sys -- (serenum) DRV - [2008/04/13 13:40:10 \| 00,080,128 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\parport.sys -- (Parport) DRV - [2008/04/13 13:39:53 \| 00,004,352 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\swenum.sys -- (swenum) DRV - [2008/04/13 13:39:52 \| 00,007,552 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\mskssrv.sys -- (MSKSSRV) DRV - [2008/04/13 13:39:51 \| 00,004,992 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\mspqm.sys -- (MSPQM) DRV - [2008/04/13 13:39:50 \| 00,005,504 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\mstee.sys -- (MSTEE) DRV - [2008/04/13 13:39:50 \| 00,005,376 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\mspclock.sys -- (MSPCLOCK) DRV - [2008/04/13 13:39:47 \| 00,024,576 \| ---- \| M] (Microsoft Corporation) [Kernel \| System] -- C:\WINDOWS\system32\drivers\kbdclass.sys -- (Kbdclass) DRV - [2008/04/13 13:39:47 \| 00,023,040 \| ---- \| M] (Microsoft Corporation) [Kernel \| System] -- C:\WINDOWS\system32\drivers\mouclass.sys -- (Mouclass) DRV - [2008/04/13 13:39:46 \| 00,384,768 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\update.sys -- (Update) DRV - [2008/04/13 13:39:46 \| 00,042,368 \| ---- \| M] (Microsoft Corporation) [Kernel \| Boot] -- C:\WINDOWS\system32\drivers\mountmgr.sys -- (MountMgr) DRV - [2008/04/13 13:36:52 \| 00,073,472 \| ---- \| M] (Microsoft Corporation) [File_System \| Boot] -- C:\WINDOWS\system32\drivers\sr.sys -- (sr) DRV - [2008/04/13 13:36:46 \| 00,015,488 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\mssmbios.sys -- (mssmbios) DRV - [2008/04/13 13:36:44 \| 00,068,224 \| ---- \| M] (Microsoft Corporation) [Kernel \| Boot] -- C:\WINDOWS\system32\drivers\pci.sys -- (PCI) DRV - [2008/04/13 13:36:43 \| 00,120,192 \| ---- \| M] (Microsoft Corporation) [Kernel \| Disabled] -- C:\WINDOWS\system32\drivers\pcmcia.sys -- (Pcmcia) DRV - [2008/04/13 13:36:41 \| 00,037,248 \| ---- \| M] (Microsoft Corporation) [Kernel \| Boot] -- C:\WINDOWS\system32\drivers\isapnp.sys -- (isapnp) DRV - [2008/04/13 13:36:38 \| 00,042,368 \| ---- \| M] (Microsoft Corporation) [Kernel \| Boot] -- C:\WINDOWS\system32\drivers\agp440.sys -- (agp440) DRV - [2008/04/13 13:36:35 \| 00,187,776 \| ---- \| M] (Microsoft Corporation) [Kernel \| Boot] -- C:\WINDOWS\system32\drivers\acpi.sys -- (ACPI) DRV - [2008/04/13 13:33:28 \| 00,044,544 \| ---- \| M] (Microsoft Corporation) [Kernel \| System] -- C:\WINDOWS\system32\drivers\fips.sys -- (Fips) DRV - [2008/04/13 13:32:59 \| 00,129,792 \| ---- \| M] (Microsoft Corporation) [File_System \| Boot] -- C:\WINDOWS\system32\drivers\fltmgr.sys -- (FltMgr) DRV - [2008/04/13 13:32:44 \| 00,180,608 \| ---- \| M] (Microsoft Corporation) [File_System \| On_Demand] -- C:\WINDOWS\system32\drivers\mrxdav.sys -- (MRxDAV) DRV - [2008/04/13 13:32:39 \| 00,030,848 \| ---- \| M] (Microsoft Corporation) [File_System \| System] -- C:\WINDOWS\system32\drivers\npfs.sys -- (Npfs) DRV - [2008/04/13 13:32:39 \| 00,019,072 \| ---- \| M] (Microsoft Corporation) [File_System \| System] -- C:\WINDOWS\system32\drivers\msfs.sys -- (Msfs) DRV - [2008/04/13 13:32:36 \| 00,066,048 \| ---- \| M] (Microsoft Corporation) [File_System \| Disabled] -- C:\WINDOWS\system32\drivers\udfs.sys -- (Udfs) DRV - [2008/04/13 13:31:32 \| 00,036,352 \| ---- \| M] (Microsoft Corporation) [Kernel \| System] -- C:\WINDOWS\system32\drivers\intelppm.sys -- (intelppm) DRV - [2008/04/13 13:31:30 \| 00,035,840 \| ---- \| M] (Microsoft Corporation) [Kernel \| System] -- C:\WINDOWS\system32\drivers\processr.sys -- (Processor) DRV - [2008/04/13 11:39:23 \| 00,142,592 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\aec.sys -- (aec) DRV - [2008/04/08 14:46:48 \| 00,017,064 \| ---- \| M] (Portrait Displays, Inc.) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\PdiPorts.sys -- (PdiPorts) DRV - [2007/11/13 05:25:53 \| 00,020,480 \| ---- \| M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\secdrv.sys -- (Secdrv) DRV - [2007/11/06 11:07:07 \| 00,158,064 \| ---- \| M] (Symantec Corporation) [Kernel \| On_Demand] -- C:\Program Files\Common Files\Symantec Shared\SymcData\idsdefs\20080212.002\SymIDSco.sys -- (SYMIDSCO) DRV - [2007/04/04 18:56:22 \| 00,021,376 \| ---- \| M] (Susteen, Inc.) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\sustucau.sys -- (SUSTUCAU) DRV - [2007/03/16 18:02:46 \| 00,023,600 \| ---- \| M] (EnTech Taiwan) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\TVICHW32.SYS -- (TVICHW32) DRV - [2007/02/27 14:31:30 \| 00,021,504 \| ---- \| M] (Motorola) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\motport.sys -- (motport) DRV - [2007/02/27 14:31:28 \| 00,021,504 \| ---- \| M] (Motorola) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\motmodem.sys -- (motmodem) DRV - [2007/02/27 14:31:18 \| 00,017,792 \| ---- \| M] (Motorola) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\motccgp.sys -- (motccgp) DRV - [2007/02/09 11:17:18 \| 00,017,465 \| ---- \| M] (Portrait Displays, Inc.) [Kernel \| System] -- C:\WINDOWS\system32\drivers\pivot.sys -- (Pivot) DRV - [2007/02/09 11:17:16 \| 00,011,323 \| ---- \| M] (Portrait Displays, Inc.) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\pivotmou.sys -- (pivotmou) DRV - [2007/01/23 19:03:44 \| 00,007,680 \| ---- \| M] (Motorola) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\motccgpfl.sys -- (motccgpfl) DRV - [2006/12/30 20:53:47 \| 00,047,360 \| ---- \| M] (VSO Software) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\pcouffin.sys -- (Pcouffin) DRV - [2006/12/30 20:35:22 \| 00,068,960 \| ---- \| M] (VSO Software) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\Pcatip.sys -- (Pcatip) DRV - [2006/11/02 07:22:54 \| 00,492,000 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\wdf01000.sys -- (Wdf01000) DRV - [2006/10/18 20:00:00 \| 00,038,528 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\wpdusb.sys -- (WpdUsb) DRV - [2006/09/28 19:00:34 \| 00,082,944 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\WudfRd.sys -- (WudfRd) DRV - [2006/09/28 18:55:50 \| 00,077,568 \| ---- \| M] (Microsoft Corporation) [Kernel \| Boot] -- C:\WINDOWS\system32\drivers\WudfPf.sys -- (WudfPf) DRV - [2006/09/15 22:52:12 \| 00,124,016 \| ---- \| M] (Symantec Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\SYMEVENT.SYS -- (SymEvent) DRV - [2006/08/11 20:42:42 \| 03,958,496 \| ---- \| M] (NVIDIA Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv) DRV - [2006/01/17 11:09:34 \| 00,102,016 \| ---- \| M] (Nero AG) [File_System \| Disabled] -- C:\WINDOWS\system32\drivers\InCDfs.sys -- (InCDfs) DRV - [2006/01/17 11:09:28 \| 00,029,440 \| ---- \| M] (Nero AG) [Kernel \| System] -- C:\WINDOWS\system32\drivers\InCDpass.sys -- (InCDPass) DRV - [2006/01/17 04:09:26 \| 00,032,640 \| ---- \| M] (Nero AG) [Kernel \| System] -- C:\WINDOWS\system32\drivers\InCDrm.sys -- (incdrm) DRV - [2006/01/16 18:41:20 \| 00,008,704 \| ---- \| M] (Nero AG) [Recognizer \| System] -- C:\WINDOWS\system32\drivers\InCDrec.sys -- (InCDrec) DRV - [2005/11/17 12:48:30 \| 00,139,776 \| ---- \| M] (Intel Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\e100b325.sys -- (E100B) Intel® DRV - [2005/08/19 03:00:00 \| 00,046,080 \| ---- \| M] (Sonic Solutions) [Kernel \| Boot] -- C:\WINDOWS\system32\drivers\pxhelp20.sys -- (PxHelp20) DRV - [2005/04/14 19:42:00 \| 00,141,582 \| ---- \| M] (NVIDIA Corporation) [Kernel \| Auto] -- C:\WINDOWS\system32\drivers\NVCAP.SYS -- (nvcap) nVidia WDM Video Capture (universal) DRV - [2005/04/14 19:42:00 \| 00,016,496 \| ---- \| M] (NVIDIA Corporation) [Kernel \| Auto] -- C:\WINDOWS\system32\drivers\NVXBAR.SYS -- (NVXBAR) DRV - [2005/04/05 11:17:02 \| 00,267,192 \| ---- \| M] (Symantec Corporation) [Kernel \| System] -- C:\WINDOWS\System32\Drivers\SYMTDI.SYS -- (SYMTDI) DRV - [2005/04/05 11:17:00 \| 00,017,976 \| ---- \| M] (Symantec Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\System32\Drivers\SYMREDRV.SYS -- (SYMREDRV) DRV - [2005/04/05 11:16:58 \| 00,036,984 \| ---- \| M] (Symantec Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\System32\Drivers\SYMIDS.SYS -- (SYMIDS) DRV - [2005/04/05 11:16:56 \| 00,047,192 \| ---- \| M] (Symantec Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\System32\Drivers\SYMNDIS.SYS -- (SYMNDIS) DRV - [2005/04/05 11:16:54 \| 00,173,208 \| ---- \| M] (Symantec Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\System32\Drivers\SYMFW.SYS -- (SYMFW) DRV - [2005/04/05 11:16:52 \| 00,011,512 \| ---- \| M] (Symantec Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\System32\Drivers\SYMDNS.SYS -- (SYMDNS) DRV - [2004/10/21 13:31:14 \| 00,038,691 \| ---- \| M] (Logitech, Inc.) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\LHidUsbK.sys -- (LHidUsbK) DRV - [2004/10/21 13:31:06 \| 00,054,851 \| ---- \| M] (Logitech, Inc.) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\L8042MOU.SYS -- (L8042mou) DRV - [2004/10/21 13:30:56 \| 00,071,535 \| ---- \| M] (Logitech, Inc.) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\LMOUKE.sys -- (LMouKE) DRV - [2004/10/21 13:30:38 \| 00,024,671 \| ---- \| M] (Logitech, Inc.) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\LHidKE.Sys -- (LHidKe) DRV - [2004/08/04 00:31:32 \| 00,020,992 \| ---- \| M] (Realtek Semiconductor Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\rtl8139.sys -- (rtl8139) Realtek RTL8139(A/B/C) DRV - [2003/05/07 20:00:00 \| 00,090,357 \| R--- \| M] (Creative Technology Ltd.) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\P1130Vid.sys -- (P1130VID) DRV - [2002/09/03 08:00:00 \| 00,125,056 \| ---- \| M] (Microsoft Corporation) [Kernel \| Boot] -- C:\WINDOWS\system32\drivers\ftdisk.sys -- (Ftdisk) DRV - [2002/09/03 08:00:00 \| 00,032,896 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\ipfltdrv.sys -- (IpFilterDriver) DRV - [2002/09/03 08:00:00 \| 00,032,512 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\nwlnkfwd.sys -- (NwlnkFwd) DRV - [2002/09/03 08:00:00 \| 00,018,688 \| ---- \| M] (Microsoft Corporation) [Kernel \| System] -- C:\WINDOWS\system32\drivers\cdaudio.sys -- (Cdaudio) DRV - [2002/09/03 08:00:00 \| 00,017,792 \| ---- \| M] (Parallel Technologies, Inc.) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\ptilink.sys -- (Ptilink) DRV - [2002/09/03 08:00:00 \| 00,016,512 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\raspti.sys -- (Raspti) DRV - [2002/09/03 08:00:00 \| 00,013,952 \| ---- \| M] (Microsoft Corporation) [Kernel \| Disabled] -- C:\WINDOWS\system32\drivers\cbidf2k.sys -- (cbidf2k) DRV - [2002/09/03 08:00:00 \| 00,012,416 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\nwlnkflt.sys -- (NwlnkFlt) DRV - [2002/09/03 08:00:00 \| 00,012,160 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\mouhid.sys -- (mouhid) DRV - [2002/09/03 08:00:00 \| 00,012,032 \| ---- \| M] (Microsoft Corporation) [Kernel \| System] -- C:\WINDOWS\System32\drivers\ws2ifsl.sys -- (WS2IFSL) DRV - [2002/09/03 08:00:00 \| 00,011,648 \| ---- \| M] (Microsoft Corporation) [Kernel \| Disabled] -- C:\WINDOWS\system32\drivers\acpiec.sys -- (ACPIEC) DRV - [2002/09/03 08:00:00 \| 00,008,832 \| ---- \| M] (Microsoft Corporation) [Kernel \| System] -- C:\WINDOWS\system32\drivers\rasacd.sys -- (RasAcd) DRV - [2002/09/03 08:00:00 \| 00,007,936 \| ---- \| M] (Microsoft Corporation) [Recognizer \| System] -- C:\WINDOWS\system32\drivers\fs_rec.sys -- (Fs_Rec) DRV - [2002/09/03 08:00:00 \| 00,006,784 \| ---- \| M] (Microsoft Corporation) [Kernel \| Auto] -- C:\WINDOWS\system32\drivers\parvdm.sys -- (ParVdm) DRV - [2002/09/03 08:00:00 \| 00,005,888 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\rootmdm.sys -- (ROOTMODEM) DRV - [2002/09/03 08:00:00 \| 00,005,888 \| ---- \| M] (Microsoft Corp., Veritas Software.) [Kernel \| Disabled] -- C:\WINDOWS\system32\drivers\dmload.sys -- (dmload) DRV - [2002/09/03 08:00:00 \| 00,004,224 \| ---- \| M] (Microsoft Corporation) [Kernel \| System] -- C:\WINDOWS\system32\drivers\rdpcdd.sys -- (RDPCDD) DRV - [2002/09/03 08:00:00 \| 00,004,224 \| ---- \| M] (Microsoft Corporation) [Kernel \| System] -- C:\WINDOWS\system32\drivers\mnmdd.sys -- (mnmdd) DRV - [2002/09/03 08:00:00 \| 00,004,224 \| ---- \| M] (Microsoft Corporation) [Kernel \| System] -- C:\WINDOWS\system32\drivers\beep.sys -- (Beep) DRV - [2002/09/03 08:00:00 \| 00,003,328 \| ---- \| M] (Microsoft Corporation) [Kernel \| Boot] -- C:\WINDOWS\system32\drivers\pciide.sys -- (PCIIde) DRV - [2002/09/03 08:00:00 \| 00,002,944 \| ---- \| M] (Microsoft Corporation) [Kernel \| System] -- C:\WINDOWS\system32\drivers\null.sys -- (Null) DRV - [2002/09/03 08:00:00 \| 00,002,864 \| ---- \| M] (Microsoft Corporation) [Adapter \| On_Demand] -- C:\WINDOWS\system32\winsock.dll -- (Winsock) DRV - [2002/07/19 08:10:20 \| 00,006,656 \| ---- \| M] (Sonic Solutions) [Kernel \| System] -- C:\WINDOWS\system32\drivers\cinemsup.sys -- (Cinemsup) DRV - [2002/05/03 12:36:44 \| 00,009,868 \| ---- \| M] (Intel Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\NMSCFG.SYS -- (NMSCFG) DRV - [2001/08/23 14:00:00 \| 00,022,400 \| ---- \| M] () [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\SbcpHid.sys -- (SbcpHid) DRV - [2001/08/17 08:59:44 \| 00,003,072 \| ---- \| M] (Microsoft Corporation) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\audstub.sys -- (audstub) DRV - [2001/08/17 07:19:34 \| 00,040,704 \| ---- \| M] (Creative Technology Ltd.) [Kernel \| On_Demand] -- C:\WINDOWS\system32\drivers\es1371mp.sys -- (es1371) Creative AudioPCI (ES1371,ES1373) (WDM) ========== Standard Registry (All) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm IE - HKU\Administrator.NANCISHAWN_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\LocalService_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\Nanci_and_Shawn_ON_C\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm IE - HKU\Nanci_and_Shawn_ON_C\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1 IE - HKU\Nanci_and_Shawn_ON_C\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?p...amp;ar=iesearch IE - HKU\Nanci_and_Shawn_ON_C\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google IE - HKU\Nanci_and_Shawn_ON_C\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerm...tf8&oe=utf8 IE - HKU\Nanci_and_Shawn_ON_C\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://erc2.nscorp.com/TesseractWebServicesWeb/ IE - HKU\Nanci_and_Shawn_ON_C\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie IE - HKU\Nanci_and_Shawn_ON_C\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\WINDOWS\system32\ieframe.dll (Microsoft Corporation) IE - HKU\Nanci_and_Shawn_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\Nanci_and_Shawn_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:5555 IE - HKU\Nanci_ON_C\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKU\Nanci_ON_C\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.amazon.com/s/ref=nb_ss_m/104-11...p;x=18&y=20 IE - HKU\Nanci_ON_C\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\WINDOWS\system32\ieframe.dll (Microsoft Corporation) IE - HKU\Nanci_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\NetworkService_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\Shawn's_Music_-_Jazz_ON_C\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKU\Shawn's_Music_-_Jazz_ON_C\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 IE - HKU\Shawn's_Music_-_Jazz_ON_C\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\WINDOWS\system32\ieframe.dll (Microsoft Corporation) IE - HKU\Shawn's_Music_-_Jazz_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\Smooth_Restauran_ON_C\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKU\Smooth_Restauran_ON_C\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 IE - HKU\Smooth_Restauran_ON_C\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\WINDOWS\system32\ieframe.dll (Microsoft Corporation) IE - HKU\Smooth_Restauran_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 FF - HKLM\software\mozilla\Firefox\extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG8\Firefox [2009/12/22 14:36:23 \| 00,000,000 \| ---D \| M] FF - HKLM\software\mozilla\Firefox\extensions\\{22119944-ED35-4ab1-910B-E619EA06A115}: C:\Program Files\Siber Systems\AI RoboForm\Firefox [2008/11/24 17:10:17 \| 00,000,000 \| ---D \| M] FF - HKLM\software\mozilla\Firefox\extensions\\{20a82645-c095-46ed-80e3-08825760534b}: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [2009/09/02 07:51:32 \| 00,000,000 \| ---D \| M] FF - HKLM\software\mozilla\Firefox\extensions\\jqs@sun.com: C:\Program Files\Java\jre6\lib\deploy\jqs\ff [2008/12/24 05:14:32 \| 00,000,000 \| ---D \| M] FF - HKLM\software\mozilla\Mozilla Firefox 3.0.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/01/23 14:53:03 \| 00,000,000 \| ---D \| M] FF - HKLM\software\mozilla\Mozilla Firefox 3.0.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/01/23 14:49:41 \| 00,000,000 \| ---D \| M] [2010/01/23 14:50:16 \| 00,000,000 \| ---D \| M] -- C:\Program Files\Mozilla Firefox\extensions [2010/01/23 14:49:41 \| 00,000,000 \| ---D \| M] (Default) -- C:\Program Files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [2008/12/24 05:01:56 \| 00,000,000 \| ---D \| M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA} [2009/06/30 10:03:46 \| 00,000,000 \| ---D \| M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} [2010/01/23 14:49:21 \| 00,023,040 \| ---- \| M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\browserdirprovider.dll [2010/01/23 14:49:21 \| 00,134,656 \| ---- \| M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\brwsrcmp.dll [2009/06/30 10:03:28 \| 00,410,984 \| ---- \| M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeploytk.dll [2008/12/20 14:49:26 \| 00,279,888 \| ---- \| M] (Musicnotes, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npmusicn.dll [2010/01/23 14:49:31 \| 00,065,536 \| ---- \| M] (mozilla.org) -- C:\Program Files\Mozilla Firefox\plugins\npnul32.dll [2009/11/23 21:37:15 \| 00,159,744 \| ---- \| M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll [2009/11/23 21:37:15 \| 00,159,744 \| ---- \| M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll [2009/11/23 21:37:15 \| 00,159,744 \| ---- \| M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll [2009/11/23 21:37:15 \| 00,159,744 \| ---- \| M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll [2009/11/23 21:37:15 \| 00,159,744 \| ---- \| M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll [2009/11/23 21:37:15 \| 00,159,744 \| ---- \| M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll [2009/11/23 21:37:15 \| 00,159,744 \| ---- \| M] (Apple Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll [2010/01/23 14:49:33 \| 00,001,394 \| ---- \| M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazondotcom.xml [2010/01/23 14:49:34 \| 00,002,193 \| ---- \| M] () -- C:\Program Files\Mozilla Firefox\searchplugins\answers.xml [2010/01/23 14:49:34 \| 00,001,534 \| ---- \| M] () -- C:\Program Files\Mozilla Firefox\searchplugins\creativecommons.xml [2010/01/23 14:49:34 \| 00,002,642 \| ---- \| M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay.xml [2010/01/23 14:49:34 \| 00,001,706 \| ---- \| M] () -- C:\Program Files\Mozilla Firefox\searchplugins\google.xml [2010/01/23 14:49:34 \| 00,001,178 \| ---- \| M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia.xml [2010/01/23 14:49:34 \| 00,000,792 \| ---- \| M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo.xml O1 HOSTS File: ([2009/03/04 12:41:33 \| 00,302,562 \| R--- \| M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: 127.0.0.1 www.007guard.com O1 - Hosts: 127.0.0.1 007guard.com O1 - Hosts: 127.0.0.1 008i.com O1 - Hosts: 127.0.0.1 www.008k.com O1 - Hosts: 127.0.0.1 008k.com O1 - Hosts: 127.0.0.1 www.00hq.com O1 - Hosts: 127.0.0.1 00hq.com O1 - Hosts: 127.0.0.1 010402.com O1 - Hosts: 127.0.0.1 www.032439.com O1 - Hosts: 127.0.0.1 032439.com O1 - Hosts: 127.0.0.1 www.0scan.com O1 - Hosts: 127.0.0.1 0scan.com O1 - Hosts: 127.0.0.1 www.1000gratisproben.com O1 - Hosts: 127.0.0.1 1000gratisproben.com O1 - Hosts: 127.0.0.1 www.1001namen.com O1 - Hosts: 127.0.0.1 1001namen.com O1 - Hosts: 127.0.0.1 100888290cs.com O1 - Hosts: 127.0.0.1 www.100888290cs.com O1 - Hosts: 127.0.0.1 100sexlinks.com O1 - Hosts: 127.0.0.1 www.100sexlinks.com O1 - Hosts: 127.0.0.1 10sek.com O1 - Hosts: 127.0.0.1 www.10sek.com O1 - Hosts: 127.0.0.1 www.1-2005-search.com O1 - Hosts: 127.0.0.1 1-2005-search.com O1 - Hosts: 10430 more lines... O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (AVG Technologies CZ, s.r.o.) O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.) O2 - BHO: (Windows Live Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\Program Files\Google\GoogleToolbar4.dll (Google Inc.) O2 - BHO: (TBSB01478 Class) - {AC002F1A-6C85-477B-8D1F-F17B72BE7C34} - C:\Program Files\Registered Coupons Toolbar\registered_coupons.dll () O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll (Google Inc.) O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.) O3 - HKLM\..\Toolbar: (&Google) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar4.dll (Google Inc.) O3 - HKLM\..\Toolbar: (&RoboForm) - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.) O3 - HKLM\..\Toolbar: (Registered Coupons) - {84A6AEA7-C34B-4246-9A00-05AD7A36BF00} - C:\Program Files\Registered Coupons Toolbar\registered_coupons.dll () O3 - HKU\Nanci_and_Shawn_ON_C\..\Toolbar\ShellBrowser: (&Address) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation) O3 - HKU\Nanci_and_Shawn_ON_C\..\Toolbar\ShellBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar4.dll (Google Inc.) O3 - HKU\Nanci_and_Shawn_ON_C\..\Toolbar\WebBrowser: (&Address) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation) O3 - HKU\Nanci_and_Shawn_ON_C\..\Toolbar\WebBrowser: (&Links) - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation) O3 - HKU\Nanci_and_Shawn_ON_C\..\Toolbar\WebBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar4.dll (Google Inc.) O3 - HKU\Nanci_and_Shawn_ON_C\..\Toolbar\WebBrowser: (Verizon Broadband Toolbar) - {4E7BD74F-2B8D-469E-D0FC-E57AF4D5FA7D} - Reg Error: Value error. File not found O3 - HKU\Nanci_and_Shawn_ON_C\..\Toolbar\WebBrowser: (&RoboForm) - {724D43A0-0D85-11D4-9908-00400523E39A} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.) O3 - HKU\Nanci_and_Shawn_ON_C\..\Toolbar\WebBrowser: (Registered Coupons) - {84A6AEA7-C34B-4246-9A00-05AD7A36BF00} - C:\Program Files\Registered Coupons Toolbar\registered_coupons.dll () O3 - HKU\Nanci_ON_C\..\Toolbar\WebBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar4.dll (Google Inc.) O3 - HKU\Nanci_ON_C\..\Toolbar\WebBrowser: (Verizon Broadband Toolbar) - {4E7BD74F-2B8D-469E-D0FC-E57AF4D5FA7D} - Reg Error: Value error. File not found O3 - HKU\Nanci_ON_C\..\Toolbar\WebBrowser: (&RoboForm) - {724D43A0-0D85-11D4-9908-00400523E39A} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.) O3 - HKU\Smooth_Restauran_ON_C\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found. O4 - HKLM..\Run: [AVG8_TRAY] C:\Program Files\AVG\AVG8\avgtray.exe (AVG Technologies CZ, s.r.o.) O4 - HKLM..\Run: [basicsmssmenu] C:\Program Files\Seagate\Basics\Basics Status\MaxMenuMgrBasics.exe (Maxtor Corporation) O4 - HKLM..\Run: [Logitech Hardware Abstraction Layer] C:\WINDOWS\KHALMNPR.Exe (Logitech Inc.) O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation) O4 - HKLM..\Run: [SDTray] C:\Program Files\Spyware Doctor\SDTrayApp.exe (PC Tools) O4 - HKU\Nanci_and_Shawn_ON_C..\Run: [$Volumouse$] C:\Program Files\Volumouse\volumouse.exe (NirSoft) O4 - HKU\Nanci_and_Shawn_ON_C..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (Microsoft Corporation) O4 - HKU\Nanci_ON_C..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (Microsoft Corporation) O4 - HKU\Nanci_ON_C..\Run: [MSMSGS] C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) O4 - HKU\Shawn's_Music_-_Jazz_ON_C..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (Microsoft Corporation) O4 - HKU\Shawn's_Music_-_Jazz_ON_C..\Run: [MSMSGS] C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) O4 - HKU\Smooth_Restauran_ON_C..\Run: [MSMSGS] C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1 O7 - HKU\Administrator.NANCISHAWN_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\Nanci_and_Shawn_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 181 O7 - HKU\Nanci_and_Shawn_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0 O7 - HKU\Nanci_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\NetworkService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\Shawn's_Music_-_Jazz_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\Smooth_Restauran_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O9 - Extra Button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation) O9 - Extra Button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html () O9 - Extra 'Tools' menuitem : Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html () O9 - Extra Button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html () O9 - Extra 'Tools' menuitem : Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html () O9 - Extra Button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html () O9 - Extra 'Tools' menuitem : RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html () O9 - Extra Button: Registered Coupons - {84A6AEA7-C34B-4246-9A00-05AD7A36BF00} - C:\Program Files\Registered Coupons Toolbar\registered_coupons.dll () O9 - Extra 'Tools' menuitem : Registered Coupons - {84A6AEA7-C34B-4246-9A00-05AD7A36BF00} - C:\Program Files\Registered Coupons Toolbar\registered_coupons.dll () O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe (Microsoft Corporation) O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - C:\WINDOWS\system32\winrnr.dll (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\WINDOWS\System32\helper32.dll File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\WINDOWS\system32\rsvpsp.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\WINDOWS\system32\rsvpsp.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\WINDOWS\System32\helper32.dll File not found O15 - HKU\Administrator.NANCISHAWN_ON_C\..Trusted Domains: 48 domain(s) and sub-domain(s) not assigned to a zone. O15 - HKU\LocalService_ON_C\..Trusted Domains: 65 domain(s) and sub-domain(s) not assigned to a zone. O15 - HKU\Nanci_and_Shawn_ON_C\..Trusted Domains: 54 domain(s) and sub-domain(s) not assigned to a zone. O15 - HKU\Nanci_ON_C\..Trusted Domains: 48 domain(s) and sub-domain(s) not assigned to a zone. O15 - HKU\NetworkService_ON_C\..Trusted Domains: 65 domain(s) and sub-domain(s) not assigned to a zone. O15 - HKU\Shawn's_Music_-_Jazz_ON_C\..Trusted Domains: 48 domain(s) and sub-domain(s) not assigned to a zone. O15 - HKU\Smooth_Restauran_ON_C\..Trusted Domains: 48 domain(s) and sub-domain(s) not assigned to a zone. O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://fpdownload.macromedia.com/get/shock...director/sw.cab (Reg Error: Key error.) O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/...b?1132251339906 (WUWebControl Class) O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdat...b?1135029776156 (MUWebControl Class) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-...indows-i586.cab (Java Plug-in 1.5.0_09) O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab (Shockwave Flash Object) O16 - DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} http://utilities.pcpitstop.com/optimize2/pcpitstop2.dll (PCPitstop Exam) O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.) O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 68.238.0.12 68.237.161.12 O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation) O18 - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\WINDOWS\system32\msvidctl.dll (Microsoft Corporation) O18 - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\gopher {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\ipp - No CLSID value found O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll (Microsoft Corporation) O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation) O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll (AVG Technologies CZ, s.r.o.) O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation) O18 - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation) O18 - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\WINDOWS\system32\inetcomm.dll (Microsoft Corporation) O18 - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp - No CLSID value found O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation) O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Handler\sysimage {76E67A63-06E9-11D2-A840-006008059382} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation) O18 - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\WINDOWS\system32\msvidctl.dll (Microsoft Corporation) O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation) O18 - Protocol\Handler\wia {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINDOWS\system32\wiascr.dll (Microsoft Corporation) O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation) O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\System32\mscoree.dll (Microsoft Corporation) O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\System32\mscoree.dll (Microsoft Corporation) O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\System32\mscoree.dll (Microsoft Corporation) O18 - Protocol\Filter\Class Install Handler {32B533BB-EDAE-11d0-BD5A-00AA00B92AF1} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Filter\deflate {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Filter\gzip {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Filter\lzdhtml {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Filter\text/webviewhtml {733AC4CB-F1A4-11d0-B951-00A0C90312E1} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (c:\windows\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: UIHost - (logonui.exe) - C:\WINDOWS\System32\logonui.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (rundll32 shell32) - C:\WINDOWS\System32\shell32.dll (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (Control_RunDLL "sysdm.cpl") - C:\WINDOWS\System32\sysdm.cpl (Microsoft Corporation) O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.) O20 - Winlogon\Notify\avgrsstarter: DllName - avgrsstx.dll - C:\WINDOWS\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.) O20 - Winlogon\Notify\crypt32chain: DllName - crypt32.dll - C:\WINDOWS\System32\crypt32.dll (Microsoft Corporation) O20 - Winlogon\Notify\cryptnet: DllName - cryptnet.dll - C:\WINDOWS\System32\cryptnet.dll (Microsoft Corporation) O20 - Winlogon\Notify\cscdll: DllName - cscdll.dll - C:\WINDOWS\System32\cscdll.dll (Microsoft Corporation) O20 - Winlogon\Notify\dimsntfy: DllName - %SystemRoot%\System32\dimsntfy.dll - C:\WINDOWS\system32\dimsntfy.dll (Microsoft Corporation) O20 - Winlogon\Notify\ScCertProp: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation) O20 - Winlogon\Notify\Schedule: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation) O20 - Winlogon\Notify\sclgntfy: DllName - sclgntfy.dll - C:\WINDOWS\System32\sclgntfy.dll (Microsoft Corporation) O20 - Winlogon\Notify\SensLogn: DllName - WlNotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation) O20 - Winlogon\Notify\termsrv: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation) O20 - Winlogon\Notify\WgaLogon: DllName - WgaLogon.dll - C:\WINDOWS\System32\WgaLogon.dll (Microsoft Corporation) O20 - Winlogon\Notify\wlballoon: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation) O21 - SSODL: CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation) O21 - SSODL: PostBootReminder - {7849596a-48ea-486e-8937-a2a3009f31a9} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation) O21 - SSODL: SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} - C:\WINDOWS\system32\stobject.dll (Microsoft Corporation) O21 - SSODL: UPnPMonitor - {e57ce738-33e8-4c51-8354-bb4de9d215d1} - C:\WINDOWS\system32\upnpui.dll (Microsoft Corporation) O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\WINDOWS\system32\webcheck.dll (Microsoft Corporation) O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\wpdshserviceobj.dll (Microsoft Corporation) O22 - SharedTaskScheduler: {438755C2-A8BA-11D1-B96B-00A0C90312E1} - Browseui preloader - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation) O22 - SharedTaskScheduler: {8C7461EF-2B13-11d2-BE35-3078302C2030} - Component Categories cache daemon - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation) O28 - HKLM ShellExecuteHooks: {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - C:\Program Files\Windows Defender\MpShHook.dll (Microsoft Corporation) O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - C:\WINDOWS\System32\shell32.dll (Microsoft Corporation) O29 - HKLM SecurityProviders - (msapsspc.dll) - C:\WINDOWS\System32\msapsspc.dll (Microsoft Corporation) O29 - HKLM SecurityProviders - (schannel.dll) - C:\WINDOWS\System32\schannel.dll (Microsoft Corporation) O29 - HKLM SecurityProviders - (digest.dll) - C:\WINDOWS\System32\digest.dll (Microsoft Corporation) O29 - HKLM SecurityProviders - (msnsspc.dll) - C:\WINDOWS\System32\msnsspc.dll (Microsoft Corporation) O30 - LSA: Authentication Packages - (msv1_0) - C:\WINDOWS\System32\msv1_0.dll (Microsoft Corporation) O30 - LSA: Security Packages - (kerberos) - C:\WINDOWS\System32\kerberos.dll (Microsoft Corporation) O30 - LSA: Security Packages - (msv1_0) - C:\WINDOWS\System32\msv1_0.dll (Microsoft Corporation) O30 - LSA: Security Packages - (schannel) - C:\WINDOWS\System32\schannel.dll (Microsoft Corporation) O30 - LSA: Security Packages - (wdigest) - C:\WINDOWS\System32\wdigest.dll (Microsoft Corporation) O31 - SafeBoot: AlternateShell - cmd.exe O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2005/11/17 12:32:58 \| 00,000,000 \| ---- \| M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O32 - AutoRun File - [2006/03/24 06:06:41 \| 00,000,053 \| R--- \| M] () - X:\AUTORUN.INF -- [ CDFS ] O34 - HKLM BootExecute: (autocheck autochk ) - File not found O35 - comfile [open] -- "%1" % O35 - exefile [open] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2010/02/04 13:19:05 \| 00,000,000 \| ---D \| C] -- C:\Documents and Settings\Nanci and Shawn\Desktop\New Folder (3) [2010/02/03 12:25:54 \| 00,000,000 \| ---D \| C] -- C:\_OTL [2010/02/01 18:25:56 \| 00,000,000 \| --SD \| C] -- C:\Documents and Settings\Administrator.NANCISHAWN\IETldCache [2010/01/26 11:04:53 \| 00,000,000 \| ---D \| C] -- C:\Documents and Settings\Nanci and Shawn\Desktop\New Folder (2) [2010/01/26 11:02:17 \| 00,000,000 \| ---D \| C] -- C:\Documents and Settings\Nanci and Shawn\Desktop\New Folder [2010/01/22 12:39:42 \| 00,472,064 \| ---- \| C] ( ) -- C:\Documents and Settings\Nanci and Shawn\Desktop\RootRepeal.exe [2010/01/19 12:03:46 \| 00,000,000 \| ---D \| C] -- C:\Documents and Settings\Nanci and Shawn\Desktop\WRBR_FM - Powered by StreamAudio_files [2010/01/12 15:39:34 \| 00,471,552 \| ---- \| C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\aclayers.dll [2008/12/20 14:48:07 \| 00,279,888 \| ---- \| C] (Musicnotes, Inc.) -- C:\Program Files\npmusicn.dll [2006/12/30 20:53:46 \| 00,047,360 \| ---- \| C] (VSO Software) -- C:\Documents and Settings\Nanci and Shawn\Application Data\pcouffin.sys ========== Files - Modified Within 30 Days ========== [2010/02/08 01:33:14 \| 13,631,488 \| ---- \| M] () -- C:\Documents and Settings\Nanci and Shawn\ntuser.dat [2010/02/07 18:11:57 \| 03,670,016 \| ---- \| M] () -- C:\Documents and Settings\Administrator.NANCISHAWN\NTUSER.DAT [2010/02/04 19:29:53 \| 04,718,592 \| ---- \| M] () -- C:\Documents and Settings\Nanci\NTUSER.DAT [2010/02/04 13:22:00 \| 00,000,432 \| ---- \| M] () -- C:\WINDOWS\tasks\Symantec NetDetect.job [2010/02/04 13:20:07 \| 00,000,442 \| -H-- \| M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{52BC6A6C-AF56-4669-B607-0BA8B1419E53}.job [2010/02/04 12:53:14 \| 00,001,018 \| ---- \| M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1214440339-113007714-839522115-1004UA.job [2010/02/04 10:34:08 \| 00,002,206 \| ---- \| M] () -- C:\WINDOWS\System32\wpa.dbl [2010/02/04 10:33:30 \| 00,000,006 \| -H-- \| M] () -- C:\WINDOWS\tasks\SA.DAT [2010/02/04 10:33:24 \| 00,002,048 \| --S- \| M] () -- C:\WINDOWS\bootstat.dat [2010/02/04 10:33:17 \| 21,462,91712 \| -HS- \| M] () -- C:\hiberfil.sys [2010/02/03 21:15:50 \| 00,479,232 \| ---- \| M] () -- C:\Documents and Settings\NetworkService\NTUSER.DAT [2010/02/03 21:15:50 \| 00,458,752 \| ---- \| M] () -- C:\Documents and Settings\LocalService\NTUSER.DAT [2010/02/03 21:15:37 \| 00,000,178 \| -HS- \| M] () -- C:\Documents and Settings\Nanci and Shawn\ntuser.ini [2010/01/27 13:28:54 \| 54,743,474 \| ---- \| M] () -- C:\WINDOWS\System32\drivers\Avg\incavi.avm [2010/01/25 18:30:01 \| 00,000,284 \| ---- \| M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job [2010/01/24 12:53:27 \| 03,932,160 \| ---- \| M] () -- C:\Documents and Settings\Smooth Restauran\NTUSER.DAT [2010/01/24 12:53:27 \| 03,932,160 \| ---- \| M] () -- C:\Documents and Settings\Shawn's Music - Jazz\NTUSER.DAT [2010/01/23 20:27:12 \| 05,939,006 \| -H-- \| M] () -- C:\Documents and Settings\Nanci and Shawn\Local Settings\Application Data\IconCache.db [2010/01/22 15:38:10 \| 06,428,005 \| ---- \| M] () -- C:\Documents and Settings\Nanci and Shawn\Desktop\Screen shot - Antivirus.rtf [2010/01/22 13:18:36 \| 00,000,000 \| ---- \| M] () -- C:\Documents and Settings\Nanci and Shawn\Desktop\settings.dat [2010/01/22 12:41:16 \| 00,000,000 \| ---- \| M] () -- C:\Documents and Settings\Nanci and Shawn\Desktop\rkill.reg [2010/01/22 12:34:30 \| 00,472,064 \| ---- \| M] ( ) -- C:\Documents and Settings\Nanci and Shawn\Desktop\RootRepeal.exe [2010/01/22 12:33:18 \| 00,524,288 \| ---- \| M] () -- C:\Documents and Settings\Nanci and Shawn\Desktop\dds.scr [2010/01/22 09:15:30 \| 06,428,005 \| ---- \| M] () -- C:\Documents and Settings\Nanci and Shawn\Desktop\Chrome problems.rtf [2010/01/21 23:53:04 \| 00,000,966 \| ---- \| M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1214440339-113007714-839522115-1004Core.job [2010/01/21 11:18:53 \| 00,000,664 \| ---- \| M] () -- C:\WINDOWS\System32\d3d9caps.dat [2010/01/21 11:18:53 \| 00,000,552 \| ---- \| M] () -- C:\WINDOWS\System32\d3d8caps.dat [2010/01/21 10:40:26 \| 00,108,552 \| ---- \| M] () -- C:\WINDOWS\System32\drivers\avgtdix.sys [2010/01/20 16:56:59 \| 00,096,512 \| ---- \| M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\atapi.sys [2010/01/20 02:46:40 \| 00,142,495 \| ---- \| M] () -- C:\WINDOWS\System32\drivers\Avg\microavi.avg [2010/01/19 18:43:32 \| 00,163,328 \| ---- \| M] () -- C:\Documents and Settings\Nanci and Shawn\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2010/01/19 12:03:46 \| 00,032,218 \| ---- \| M] () -- C:\Documents and Settings\Nanci and Shawn\Desktop\WRBR_FM - Powered by StreamAudio.htm [2010/01/19 10:59:53 \| 00,000,116 \| ---- \| M] () -- C:\WINDOWS\NeroDigital.ini [2010/01/18 12:46:49 \| 00,000,591 \| ---- \| M] () -- C:\WINDOWS\win.ini [2010/01/18 12:46:49 \| 00,000,227 \| ---- \| M] () -- C:\WINDOWS\system.ini [2010/01/18 12:46:49 \| 00,000,211 \| RHS- \| M] () -- C:\boot.ini [2010/01/15 20:00:00 \| 00,000,484 \| ---- \| M] () -- C:\WINDOWS\tasks\Norton AntiVirus - Scan my computer.job [2010/01/14 11:12:06 \| 00,181,120 \| ---- \| M] (Microsoft Corporation) -- C:\WINDOWS\System32\MpSigStub.exe [2010/01/12 17:44:57 \| 00,001,374 \| ---- \| M] () -- C:\WINDOWS\imsins.BAK [2010/01/09 11:19:01 \| 00,002,892 \| ---- \| M] () -- C:\WINDOWS\EaseAudioConverter.ini ========== Files Created - No Company Name ========== [2010/01/26 15:14:29 \| 21,462,91712 \| -HS- \| C] () -- C:\hiberfil.sys [2010/01/22 15:38:09 \| 06,428,005 \| ---- \| C] () -- C:\Documents and Settings\Nanci and Shawn\Desktop\Screen shot - Antivirus.rtf [2010/01/22 13:18:36 \| 00,000,000 \| ---- \| C] () -- C:\Documents and Settings\Nanci and Shawn\Desktop\settings.dat [2010/01/22 12:41:29 \| 00,000,000 \| ---- \| C] () -- C:\Documents and Settings\Nanci and Shawn\Desktop\rkill.reg [2010/01/22 12:39:36 \| 00,524,288 \| ---- \| C] () -- C:\Documents and Settings\Nanci and Shawn\Desktop\dds.scr [2010/01/22 09:15:23 \| 06,428,005 \| ---- \| C] () -- C:\Documents and Settings\Nanci and Shawn\Desktop\Chrome problems.rtf [2010/01/21 11:18:53 \| 00,000,664 \| ---- \| C] () -- C:\WINDOWS\System32\d3d9caps.dat [2010/01/21 11:18:53 \| 00,000,552 \| ---- \| C] () -- C:\WINDOWS\System32\d3d8caps.dat [2010/01/19 12:03:44 \| 00,032,218 \| ---- \| C] () -- C:\Documents and Settings\Nanci and Shawn\Desktop\WRBR_FM - Powered by StreamAudio.htm [2009/12/10 11:50:25 \| 00,000,038 \| ---- \| C] () -- C:\WINDOWS\avisplitter.ini [2009/12/10 11:50:24 \| 00,881,664 \| ---- \| C] () -- C:\WINDOWS\System32\xvidcore.dll [2009/12/10 11:50:24 \| 00,205,824 \| ---- \| C] () -- C:\WINDOWS\System32\xvidvfw.dll [2009/12/10 11:50:21 \| 00,085,504 \| ---- \| C] () -- C:\WINDOWS\System32\ff_vfw.dll [2009/12/10 11:50:21 \| 00,000,547 \| ---- \| C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest [2009/04/09 17:14:09 \| 00,002,304 \| ---- \| C] () -- C:\WINDOWS\System32\Machnm32.sys [2009/01/07 11:52:50 \| 00,870,128 \| ---- \| C] () -- C:\Documents and Settings\Nanci and Shawn\Application Data\mcs.rma [2009/01/07 11:52:50 \| 00,000,004 \| ---- \| C] () -- C:\Documents and Settings\Nanci and Shawn\Application Data\3F5E20 [2009/01/03 08:52:15 \| 00,354,816 \| ---- \| C] () -- C:\WINDOWS\System32\psisdecd.dll [2008/08/26 11:38:20 \| 00,034,308 \| ---- \| C] () -- C:\WINDOWS\System32\Chip.dll [2008/05/25 04:38:31 \| 00,108,552 \| ---- \| C] () -- C:\WINDOWS\System32\drivers\avgtdix.sys [2007/01/31 17:22:13 \| 00,001,548 \| ---- \| C] () -- C:\Documents and Settings\Nanci and Shawn\Application Data\HPCOM_48BitScanUpdate.log [2007/01/31 17:22:13 \| 00,000,214 \| ---- \| C] () -- C:\WINDOWS\HP_48BitScanUpdatePatch.ini [2007/01/30 19:31:46 \| 00,002,892 \| ---- \| C] () -- C:\WINDOWS\EaseAudioConverter.ini [2007/01/24 11:43:19 \| 00,000,026 \| ---- \| C] () -- C:\WINDOWS\dvdSanta.INI [2007/01/13 14:27:52 \| 00,000,059 \| ---- \| C] () -- C:\WINDOWS\LTDLG13N.INI [2007/01/08 05:47:08 \| 00,178,176 \| ---- \| C] () -- C:\WINDOWS\System32\unrar.dll [2006/12/31 14:08:11 \| 00,000,116 \| ---- \| C] () -- C:\WINDOWS\NeroDigital.ini [2006/12/30 20:53:47 \| 00,087,608 \| ---- \| C] () -- C:\Documents and Settings\Nanci and Shawn\Application Data\ezpinst.exe [2006/12/30 20:53:47 \| 00,007,824 \| ---- \| C] () -- C:\Documents and Settings\Nanci and Shawn\Application Data\pcouffin.cat [2006/12/30 20:53:47 \| 00,000,034 \| ---- \| C] () -- C:\Documents and Settings\Nanci and Shawn\Application Data\pcouffin.log [2006/12/30 20:53:46 \| 00,001,144 \| ---- \| C] () -- C:\Documents and Settings\Nanci and Shawn\Application Data\pcouffin.inf [2006/12/24 12:28:53 \| 00,000,043 \| ---- \| C] () -- C:\WINDOWS\hpfccopy.INI [2006/11/03 09:15:57 \| 00,000,128 \| ---- \| C] () -- C:\Documents and Settings\Nanci\Local Settings\Application Data\fusioncache.dat [2006/11/01 13:00:34 \| 00,000,138 \| ---- \| C] () -- C:\Documents and Settings\Nanci and Shawn\Local Settings\Application Data\fusioncache.dat [2006/09/12 11:12:54 \| 00,106,496 \| ---- \| C] () -- C:\WINDOWS\System32\APmpg4v1.dll [2006/09/11 08:47:53 \| 00,000,000 \| ---- \| C] () -- C:\WINDOWS\Topo.INI [2006/08/11 20:45:20 \| 00,581,632 \| ---- \| C] () -- C:\WINDOWS\System32\nvhwvid.dll [2006/08/11 20:43:10 \| 00,196,608 \| ---- \| C] () -- C:\WINDOWS\System32\nvapi.dll [2006/08/11 20:43:00 \| 01,662,976 \| ---- \| C] () -- C:\WINDOWS\System32\nvwdmcpl.dll [2006/08/11 20:43:00 \| 01,470,464 \| ---- \| C] () -- C:\WINDOWS\System32\nview.dll [2006/08/11 20:43:00 \| 01,019,904 \| ---- \| C] () -- C:\WINDOWS\System32\nvwimg.dll [2006/08/11 20:43:00 \| 00,466,944 \| ---- \| C] () -- C:\WINDOWS\System32\nvshell.dll [2006/08/11 20:43:00 \| 00,286,720 \| ---- \| C] () -- C:\WINDOWS\System32\nvnt4cpl.dll [2006/04/14 10:37:26 \| 00,000,037 \| ---- \| C] () -- C:\WINDOWS\aceg.ini [2006/01/01 16:25:21 \| 00,000,028 \| ---- \| C] () -- C:\WINDOWS\Systems.ini [2005/12/07 17:36:39 \| 00,000,062 \| ---- \| C] () -- C:\WINDOWS\DpxCalendar.INI [2005/11/30 10:48:10 \| 00,000,301 \| ---- \| C] () -- C:\WINDOWS\hpqcopy.INI [2005/11/30 03:08:47 \| 00,000,059 \| ---- \| C] () -- C:\WINDOWS\WININIT.INI [2005/11/25 12:28:14 \| 00,000,093 \| ---- \| C] () -- C:\WINDOWS\R300.ini [2005/11/18 16:53:15 \| 00,163,328 \| ---- \| C] () -- C:\Documents and Settings\Nanci and Shawn\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2005/11/18 16:41:29 \| 00,000,754 \| ---- \| C] () -- C:\WINDOWS\WORDPAD.INI [2005/07/25 10:25:52 \| 00,000,000 \| ---- \| C] () -- C:\WINDOWS\System32\px.ini [2004/01/30 09:37:50 \| 00,000,092 \| R--- \| C] () -- C:\WINDOWS\System32\FTDIUN2K.INI [2002/03/26 09:36:48 \| 00,069,632 \| ---- \| C] () -- C:\WINDOWS\System32\PROInst.dll [2002/03/01 14:43:34 \| 00,028,008 \| ---- \| C] () -- C:\WINDOWS\System32\SUSUSB.SYS [2002/02/06 09:04:14 \| 00,065,536 \| ---- \| C] () -- C:\WINDOWS\System32\NMSInst.dll [2001/12/03 16:50:58 \| 00,147,456 \| R--- \| C] () -- C:\WINDOWS\System32\LTTLS13N.DLL [2001/12/03 16:50:20 \| 00,708,608 \| R--- \| C] () -- C:\WINDOWS\System32\LTCRY13N.DLL [2001/08/23 14:00:00 \| 00,022,400 \| ---- \| C] () -- C:\WINDOWS\System32\drivers\SbcpHid.sys [2000/07/07 06:49:30 \| 00,069,120 \| R--- \| C] () -- C:\WINDOWS\System32\LTDLL.DLL [2000/04/12 16:28:12 \| 00,118,784 \| R--- \| C] () -- C:\WINDOWS\System32\LFKODAK.DLL [2000/04/12 16:24:10 \| 00,338,944 \| R--- \| C] () -- C:\WINDOWS\System32\LFFPX7.DLL [1999/09/20 10:05:32 \| 00,013,387 \| ---- \| C] () -- C:\WINDOWS\System32\CinemSup.sys ========== LOP Check ========== [2006/08/28 02:44:25 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Nanci and Shawn\Application Data\.BitTornado [2007/12/31 17:33:13 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Nanci and Shawn\Application Data\Audacity [2006/12/31 13:58:57 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Nanci and Shawn\Application Data\CopyToDvd [2009/01/27 18:02:58 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Nanci and Shawn\Application Data\Digitope [2009/04/09 17:17:52 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Nanci and Shawn\Application Data\DisplayTune [2009/01/27 18:06:07 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Nanci and Shawn\Application Data\DPA [2009/01/28 08:36:11 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Nanci and Shawn\Application Data\GoodSync [2005/12/02 18:18:30 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Nanci and Shawn\Application Data\iMesh [2005/11/25 11:03:15 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Nanci and Shawn\Application Data\InterTrust [2005/11/18 14:19:43 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Nanci and Shawn\Application Data\Kazaa Lite [2005/11/25 12:30:14 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Nanci and Shawn\Application Data\Leadertech [2008/05/20 00:32:26 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Nanci and Shawn\Application Data\MSNInstaller [2006/09/02 13:16:14 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Nanci and Shawn\Application Data\NCH Swift Sound [2009/07/15 19:17:42 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Nanci and Shawn\Application Data\OpenOffice.org [2006/12/30 21:27:33 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Nanci and Shawn\Application Data\Simple Star [2007/12/02 20:02:03 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Nanci and Shawn\Application Data\Snapfish [2010/01/21 10:31:10 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Nanci and Shawn\Application Data\uTorrent [2009/09/23 18:26:11 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Nanci and Shawn\Application Data\Vso [2007/12/02 16:51:50 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Nanci and Shawn\Application Data\Windows Live Writer [2006/11/03 15:41:04 \| 00,000,000 \| ---D \| M] -- C:\Documents and Settings\Nanci\Application Data\MSNInstaller [2010/02/04 13:20:07 \| 00,000,442 \| -H-- \| M] () -- C:\WINDOWS\Tasks\User_Feed_Synchronization-{52BC6A6C-AF56-4669-B607-0BA8B1419E53}.job ========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\.exe > < MD5 for: AGP440.SYS > [2007/12/21 15:28:01 \| 22,245,337 \| ---- \| M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys [2008/08/28 06:55:25 \| 23,852,652 \| ---- \| M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys [2007/12/21 15:28:01 \| 22,245,337 \| ---- \| M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp2.cab:AGP440.sys [2008/08/28 06:55:25 \| 23,852,652 \| ---- \| M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys [2008/08/28 06:55:25 \| 23,852,652 \| ---- \| M] () .cab file -- C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\sp3.cab:AGP440.sys [2008/04/13 13:36:38 \| 00,042,368 \| ---- \| M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys [2008/04/13 13:36:38 \| 00,042,368 \| ---- \| M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\agp440.sys [2008/04/13 13:36:38 \| 00,042,368 \| ---- \| M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys [2004/08/04 01:07:41 \| 00,042,368 \| ---- \| M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB -- C:\WINDOWS\$NtServicePackUninstall$\agp440.sys [2004/08/04 01:07:41 \| 00,042,368 \| ---- \| M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB -- C:\WINDOWS\system32\ReinstallBackups\0009\DriverFiles\i386\AGP440.SYS < MD5 for: ATAPI.SYS > [2002/09/03 08:00:00 \| 10,158,890 \| ---- \| M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp1.cab:atapi.sys [2007/12/21 15:28:01 \| 22,245,337 \| ---- \| M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys [2008/08/28 06:55:25 \| 23,852,652 \| ---- \| M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys [2007/12/21 15:28:01 \| 22,245,337 \| ---- \| M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp2.cab:atapi.sys [2008/08/28 06:55:25 \| 23,852,652 \| ---- \| M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys [2008/08/28 06:55:25 \| 23,852,652 \| ---- \| M] () .cab file -- C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\sp3.cab:atapi.sys [2008/04/13 13:40:30 \| 00,096,512 \| ---- \| M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys [2008/04/13 13:40:30 \| 00,096,512 \| ---- \| M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\atapi.sys [2010/01/20 16:56:59 \| 00,096,512 \| ---- \| M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\dllcache\atapi.sys [2008/04/13 13:40:30 \| 00,096,512 \| ---- \| M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys [2004/08/04 00:59:42 \| 00,095,360 \| ---- \| M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys < MD5 for: EVENTLOG.DLL > [2008/04/13 19:11:53 \| 00,056,320 \| ---- \| M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll [2008/04/13 19:11:53 \| 00,056,320 \| ---- \| M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\eventlog.dll [2008/04/13 19:11:53 \| 00,056,320 \| ---- \| M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\system32\eventlog.dll [2004/08/04 02:56:42 \| 00,055,808 \| ---- \| M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll < MD5 for: NETLOGON.DLL > [2008/04/13 19:12:01 \| 00,407,040 \| ---- \| M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll [2008/04/13 19:12:01 \| 00,407,040 \| ---- \| M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\netlogon.dll [2008/04/13 19:12:01 \| 00,407,040 \| ---- \| M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\system32\netlogon.dll [2004/08/04 02:56:44 \| 00,407,040 \| ---- \| M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll < MD5 for: SCECLI.DLL > [2004/08/04 02:56:44 \| 00,180,224 \| ---- \| M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll [2008/04/13 19:12:05 \| 00,181,248 \| ---- \| M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll [2008/04/13 19:12:05 \| 00,181,248 \| ---- \| M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\scecli.dll [2008/04/13 19:12:05 \| 00,181,248 \| ---- \| M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\system32\scecli.dll < %systemroot%\System32\config\.sav > [2007/12/21 07:01:44 \| 01,048,576 \| ---- \| M] () -- C:\WINDOWS\system32\config\default.sav [2007/12/21 11:44:50 \| 00,049,152 \| ---- \| M] () -- C:\WINDOWS\system32\config\security.sav [2007/12/21 07:01:44 \| 31,158,272 \| ---- \| M] () -- C:\WINDOWS\system32\config\software.sav [2007/12/21 07:01:44 \| 05,242,880 \| ---- \| M] () -- C:\WINDOWS\system32\config\system.sav < End of report >

thewall View Member Profile	Feb 8 2010, 11:52 AM Post #51
Forum Addict Group: Malware Response Team Posts: 6,383 Joined: 19-June 07 From: Florida Member No.: 137,685	Yes, if you have a successful boot go ahead with ComboFix. -------------------- If I have helped you then please consider donating so I can continue the fight against malware All donations go directly to the helper Due to the large amount of backlogs we have I cannot respond to PMs for help unless I am already working with you

waffle46528 View Member Profile	Feb 8 2010, 01:08 PM Post #52
Member Group: Members Posts: 32 Joined: 22-January 10 Member No.: 440,080	I've gotten to the desktop and immediately opened the task manager and it opened.Then right away tried to open my USB drive,but no luck. I can't seem to see a process associated with antivirus live. No SysGuard.exe there. Do you know of another process it might be operating under. I've got the search opened too. rkill is on my desktop,but doesn't seem to work. I'm about ready to just write this thing off,buy a bigger hard drive,reinstall windows,and maybe hookup my drive as a slave drive and try to get my files back that way.

thewall View Member Profile	Feb 8 2010, 01:44 PM Post #53
Forum Addict Group: Malware Response Team Posts: 6,383 Joined: 19-June 07 From: Florida Member No.: 137,685	I totally understand your frustration, this has been a hard egg to crack. I doubt you are going to just stop this by disabling processes. More than likely a rootkit has the system hooked and that is what we need to get at. I have several people looking at this and we do have a new suggestion if you would like to give it a try. I need to get a clarification on something first and will return when I get it. -------------------- If I have helped you then please consider donating so I can continue the fight against malware All donations go directly to the helper Due to the large amount of backlogs we have I cannot respond to PMs for help unless I am already working with you

waffle46528 View Member Profile	Feb 8 2010, 02:01 PM Post #54
Member Group: Members Posts: 32 Joined: 22-January 10 Member No.: 440,080	Well I thought of something else to try. I've been using the same USB port everytime, and it never lets me open it,wkich is where I have that Combofix program located. So instead of in front,I reached around in the back,and used a USB opening back there. Well it worked.I opened my drive and installed Combofix,and ran it. so here's the COMBOfix lof file.I hope this helps. ComboFix 10-02-03.06 - Nanci and Shawn 02/08/2010 13:42:42.1.1 - x86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2047.1467 [GMT -5:00] Running from: F:\waffle.exe.exe AV: AVG Anti-Virus Free On-access scanning disabled (Outdated) {17DDD097-36FF-435F-9E1B-52D74245D6BF} WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\program files\Mozilla Firefox\plc4.dll c:\windows\EventSystem.log c:\windows\system32\Chip.dll c:\windows\system32\dumphive.exe c:\windows\system32\Process.exe c:\windows\system32\reboot.txt c:\windows\system32\spool\prtprocs\w32x86\3.tmp c:\windows\system32\spool\prtprocs\w32x86\8.tmp c:\windows\system32\spool\prtprocs\w32x86\F.tmp c:\windows\system32\SrchSTS.exe c:\windows\system32\tmp.reg . ((((((((((((((((((((((((( Files Created from 2010-01-08 to 2010-02-08 ))))))))))))))))))))))))))))))) . 2010-02-03 17:25 . 2010-02-03 17:25 -------- d-----w- C:\_OTL 2010-02-01 23:25 . 2010-02-01 23:25 -------- d-s---w- c:\documents and settings\Administrator.NANCISHAWN\IETldCache 2010-01-21 16:18 . 2010-01-21 16:18 664 ----a-w- c:\windows\system32\d3d9caps.dat 2010-01-21 16:18 . 2010-01-21 16:18 552 ----a-w- c:\windows\system32\d3d8caps.dat 2010-01-16 21:22 . 2010-01-16 21:22 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache 2010-01-12 20:39 . 2009-11-21 15:51 471552 -c----w- c:\windows\system32\dllcache\aclayers.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-01-23 15:42 . 2008-11-21 00:52 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2010-01-23 15:42 . 2009-11-01 20:13 5115824 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe 2010-01-21 22:03 . 2008-02-18 21:02 -------- d-----w- c:\program files\Microsoft Silverlight 2010-01-21 15:40 . 2008-05-25 09:38 108552 ----a-w- c:\windows\system32\drivers\avgtdix.sys 2010-01-21 15:31 . 2006-03-09 21:48 -------- d-----w- c:\documents and settings\Nanci and Shawn\Application Data\uTorrent 2010-01-14 16:12 . 2009-10-13 14:54 181120 ------w- c:\windows\system32\MpSigStub.exe 2010-01-07 21:07 . 2008-11-21 00:52 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-01-07 21:07 . 2008-11-21 00:52 19160 ----a-w- c:\windows\system32\drivers\mbam.sys 2009-12-21 19:14 . 2006-06-23 16:33 916480 ----a-w- c:\windows\system32\wininet.dll 2009-12-18 00:51 . 2009-12-18 00:51 -------- d-----w- c:\program files\Veoh Networks 2009-12-11 16:01 . 2009-07-16 00:18 1 ----a-w- c:\documents and settings\Nanci and Shawn\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys 2009-11-24 02:29 . 2009-11-24 02:29 79144 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.2.25\SetupAdmin.exe 2009-11-21 15:51 . 2002-09-03 13:00 471552 ----a-w- c:\windows\AppPatch\aclayers.dll 2008-12-20 19:48 . 2008-12-20 19:48 279888 ----a-w- c:\program files\npmusicn.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . Note empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AC002F1A-6C85-477B-8D1F-F17B72BE7C34}] 2007-10-18 19:51 2265088 ----a-w- c:\program files\Registered Coupons Toolbar\registered_coupons.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{84A6AEA7-C34B-4246-9A00-05AD7A36BF00}"= "c:\program files\Registered Coupons Toolbar\registered_coupons.dll" [2007-10-18 2265088] [HKEY_CLASSES_ROOT\clsid\{84a6aea7-c34b-4246-9a00-05ad7a36bf00}] [HKEY_CLASSES_ROOT\TBSB01478.TBSB01478.3] [HKEY_CLASSES_ROOT\TypeLib\{77AA25E8-6083-4949-A831-9CB11861DC10}] [HKEY_CLASSES_ROOT\TBSB01478.TBSB01478] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] "{84A6AEA7-C34B-4246-9A00-05AD7A36BF00}"= "c:\program files\Registered Coupons Toolbar\registered_coupons.dll" [2007-10-18 2265088] [HKEY_CLASSES_ROOT\clsid\{84a6aea7-c34b-4246-9a00-05ad7a36bf00}] [HKEY_CLASSES_ROOT\TBSB01478.TBSB01478.3] [HKEY_CLASSES_ROOT\TypeLib\{77AA25E8-6083-4949-A831-9CB11861DC10}] [HKEY_CLASSES_ROOT\TBSB01478.TBSB01478] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "$Volumouse$"="c:\program files\Volumouse\volumouse.exe" [2008-11-10 31744] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-12-13 2043160] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-08-12 7630848] "Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2004-10-21 29696] "basicsmssmenu"="c:\program files\Seagate\Basics\Basics Status\MaxMenuMgrBasics.exe" [2007-10-09 169328] "SDTray"="c:\program files\Spyware Doctor\SDTrayApp.exe" [2008-08-23 810576] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160] "RoboForm"="c:\program files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2008-11-24 160592] c:\documents and settings\Nanci and Shawn\Start Menu\Programs\Startup\ Yahoo! Widget Engine.lnk - c:\program files\Yahoo!\WidgetEngine\YahooWidgetEngine.exe [2007-7-20 2913584] [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoSetActiveDesktop"= 1 (0x1) "NoActiveDesktopChanges"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter] 2009-08-17 01:25 11952 ----a-w- c:\windows\system32\avgrsstx.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend] @="Service" [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Sonic CinePlayer Quick Launch.lnk] backup=c:\windows\pss\Sonic CinePlayer Quick Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^Nanci and Shawn^Start Menu^Programs^Startup^OpenOffice.org 3.1.lnk] path=c:\documents and settings\Nanci and Shawn\Start Menu\Programs\Startup\OpenOffice.org 3.1.lnk backup=c:\windows\pss\OpenOffice.org 3.1.lnkStartup [HKLM\~\startupfolder\C:^Documents and Settings^Nanci and Shawn^Start Menu^Programs^Startup^SDK Tray Menu.lnk] path=c:\documents and settings\Nanci and Shawn\Start Menu\Programs\Startup\SDK Tray Menu.lnk backup=c:\windows\pss\SDK Tray Menu.lnkStartup HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DW4 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck] c:\windows\system32\dumprep 0 -k [X] HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WatchDog [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\A Verizon App] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader] 2005-06-07 04:46 57344 ----a-w- c:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe] 2008-04-14 00:12 15360 ------w- c:\windows\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DT GWY] 2008-04-08 20:02 81920 ----a-w- c:\program files\Common Files\Portrait Displays\Shared\DT_Startup.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus Photo R300 Series] 2003-06-04 03:00 99840 ----a-w- c:\windows\system32\spool\drivers\w32x86\3\E_S4I2F1.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update] 2008-09-05 13:16 133104 ----atw- c:\documents and settings\Nanci and Shawn\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup] 2004-07-27 21:50 221184 ----a-w- c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler] 2005-06-10 15:44 81920 ----a-w- c:\program files\Common Files\InstallShield\UpdateService\issch.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] 2009-11-12 21:33 141600 ----a-w- c:\program files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes Anti-Malware (reboot)] 2010-01-07 21:07 1394000 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbam.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Merriam-Webster 6] 2007-07-19 20:04 610304 ----a-w- c:\program files\Paragon Software\Merriam-Webster 6\run.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Motive SmartBridge] 2005-04-14 00:51 385024 ----a-w- c:\progra~1\VERIZO~1\HELPSU~1\SMARTB~1\MotiveSB.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] 2008-04-14 00:12 1695232 ------w- c:\program files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] 2006-01-12 21:40 155648 ----a-w- c:\windows\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PhotoShow Deluxe Media Manager] 2005-02-26 00:28 212992 ----a-w- c:\progra~1\Nero\data\Xtras\mssysmgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PivotSoftware] 2007-02-09 16:17 694008 ----a-w- c:\program files\Portrait Displays\Pivot Software\wpCtrl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] 2009-11-11 04:08 417792 ----a-w- c:\program files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoboForm] 2008-11-24 22:09 160592 ----a-w- c:\program files\Siber Systems\AI RoboForm\robotaskbaricon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SDTray] 2008-08-23 09:26 810576 ----a-w- c:\program files\Spyware Doctor\SDTrayApp.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Share-to-Web Namespace Daemon] 2002-04-17 15:42 69632 ----a-w- c:\program files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] 2007-08-17 07:45 23120680 ----a-r- c:\program files\Skype\Phone\Skype.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer] 2009-03-05 20:07 2260480 --sha-r- c:\program files\Spybot - Search & Destroy\TeaTimer.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] 2009-06-30 15:03 148888 ----a-w- c:\program files\Java\jre6\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] 2007-08-12 23:05 68856 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VeohPlugin] 2009-11-20 18:57 2590456 ----a-w- c:\program files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender] 2006-11-03 23:20 866584 ----a-w- c:\program files\Windows Defender\MSASCui.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WxEx] 2003-06-04 03:00 99840 ----a-w- c:\windows\system32\spool\drivers\w32x86\3\E_S4I2F1.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "WinVNC4"=2 (0x2) "WMPNetworkSvc"=3 (0x3) "SNDSrvc"=3 (0x3) "iPod Service"=3 (0x3) "helpsvc"=2 (0x2) "gusvc"=3 (0x3) "Apple Mobile Device"=2 (0x2) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\LimeWire\\LimeWire.exe"= "c:\\Program Files\\utorrent\\utorrent.exe"= "c:\\Program Files\\AVG\\AVG8\\avgupd.exe"= "c:\\Program Files\\AVG\\AVG8\\avgemc.exe"= "c:\\Program Files\\TorrenTopia\\btdl\\downloader.tt"= "c:\\Program Files\\Joost\\xulrunner\\tvprunner.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Filetopia3\\Filetopia.exe"= "c:\\Sun\\SDK\\jdk\\bin\\java.exe"= "c:\\Program Files\\RealVNC\\VNC4\\winvnc4.exe"= "c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"= "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\Veoh Networks\\VeohWebPlayer\\veohwebplayer.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "32117:TCP"= 32117:TCP:limewire "6346:TCP"= 6346:TCP:limewire "47911:TCP"= 47911:TCP:utorrent R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [5/25/2008 4:38 AM 335240] R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [11/15/2008 3:42 PM 908056] R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [7/3/2008 1:23 PM 297752] R2 PdiService;Portrait Displays SDK Service;c:\program files\Common Files\Portrait Displays\Drivers\pdisrvc.exe [4/9/2009 5:13 PM 90112] R3 P1130VID;Creative WebCam NX Pro;c:\windows\system32\drivers\P1130Vid.sys [11/25/2005 11:08 AM 90357] S1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [5/25/2008 4:38 AM 108552] S2 nvtvSND;nVidia WDM TVAudio Crossbar;c:\windows\system32\DRIVERS\nvtvsnd.sys --> c:\windows\system32\DRIVERS\nvtvsnd.sys [?] S2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 6:19 PM 13592] S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys [12/30/2007 2:28 PM 17792] S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys [12/30/2007 2:28 PM 7680] S3 motport;Motorola USB Diagnostic Port;c:\windows\system32\drivers\motport.sys [12/30/2007 2:28 PM 21504] S3 SUSTUCAM;Susteen USB Cable Modem Driver;c:\windows\system32\DRIVERS\sustucam.sys --> c:\windows\system32\DRIVERS\sustucam.sys [?] S3 SUSTUCAP;Susteen USB Cable Port Driver;c:\windows\system32\DRIVERS\sustucap.sys --> c:\windows\system32\DRIVERS\sustucap.sys [?] S3 SUSTUCAU;Susteen USB Cable USB Driver;c:\windows\system32\drivers\sustucau.sys [4/12/2006 10:24 AM 21376] . Contents of the 'Scheduled Tasks' folder 2010-01-25 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34] 2010-01-22 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1214440339-113007714-839522115-1004Core.job - c:\documents and settings\Nanci and Shawn\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-05 13:16] 2010-02-08 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1214440339-113007714-839522115-1004UA.job - c:\documents and settings\Nanci and Shawn\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-05 13:16] 2010-02-08 c:\windows\Tasks\User_Feed_Synchronization-{52BC6A6C-AF56-4669-B607-0BA8B1419E53}.job - c:\windows\system32\msfeedssync.exe [2006-10-17 08:31] . . ------- Supplementary Scan ------- . uStart Page = https://erc2.nscorp.com/TesseractWebServicesWeb/ uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 uInternet Settings,ProxyServer = http=127.0.0.1:5555 uSearchAssistant = hxxp://www.google.com/ie IE: {{84A6AEA7-C34B-4246-9A00-05AD7A36BF00} - {84A6AEA7-C34B-4246-9A00-05AD7A36BF00} - c:\program files\Registered Coupons Toolbar\registered_coupons.dll DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab FF - ProfilePath - c:\documents and settings\Nanci and Shawn\Application Data\Mozilla\Firefox\Profiles\t1knkzob.default\ FF - prefs.js: browser.startup.homepage - hxxp://google.com FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll FF - plugin: c:\documents and settings\Nanci and Shawn\Local Settings\Application Data\Google\Update\1.2.183.13\npGoogleOneClick8.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npmusicn.dll FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll . - - - - ORPHANS REMOVED - - - - HKU-Default-Run-Symantec NetDriver Warning - c:\progra~1\SYMNET~1\SNDWarn.exe HKU-Default-Run-Internet Security 2010 - c:\program files\InternetSecurity2010\IS2010.exe SafeBoot-5Nh77j SafeBoot-5Nh77j.sys MSConfigStartUp-MsnMsgr - c:\program files\MSN Messenger\msnmsgr.exe MSConfigStartUp-Symantec NetDriver Monitor - c:\progra~1\SYMNET~1\SNDMon.exe ************************************************************************ catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2010-02-08 13:49 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************ . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_LOCAL_MACHINE\System\ControlSet001\Enum\ACPI\PNP0F03\4&23229fba&0\LogConf] @DACL=(02 0000) "BasicConfigVector"=hex(a):48,00,00,00,0f,00,00,00,00,00,00,00,00,00,00,00,00, 00,00,00,00,00,00,00,00,00,00,00,01,00,00,00,01,00,01,00,01,00,00,00,00,02,\ "BootConfig"=hex(8):01,00,00,00,0f,00,00,00,00,00,00,00,01,00,01,00,01,00,00, 00,02,01,01,00,0c,00,00,00,0c,00,00,00,ff,ff,ff,ff . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(540) c:\windows\system32\Ati2evxx.dll . Completion time: 2010-02-08 13:52:42 ComboFix-quarantined-files.txt 2010-02-08 18:52 Pre-Run: 33,293,680,640 bytes free Post-Run: 33,314,521,088 bytes free - - End Of File - - 0F830A83ED0C02BCF92B27AE22EA0591

thewall View Member Profile	Feb 8 2010, 02:10 PM Post #55
Forum Addict Group: Malware Response Team Posts: 6,383 Joined: 19-June 07 From: Florida Member No.: 137,685	That was smart, maybe we are making some headway now. Let's see if we can get a GMER scan if you can access it. You may have to use your USB stick again. One word of caution just to be on the safe side if you use the same USB stick hold down the shift key on your other computer as you insert it. This disables the autorun feature so if anything tries to move from the stick onto the clean computer it won't work. I'll provide the instructions again in case you need to download it. Download GMER Rootkit Scanner from here to your desktop. Double click the exe file. If it gives you a warning about rootkit activity and asks if you want to run scan...click on NO, then use the following settings for a more complete scan. Click the image to enlarge it In the right panel, you will see several boxes that have been checked. Uncheck the following ... Sections IAT/EAT Drives/Partition other than Systemdrive (typically C:\) Show All (don't miss this one) Then click the Scan button & wait for it to finish. Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post. Save it where you can easily find it, such as your desktop, and post it in reply. Caution Rootkit scans often produce false positives. Do NOT take any action on any "<--- ROOKIT" entries If GMER does not want to run add the following to those that you unchecked and try it again: Registry Files -------------------- If I have helped you then please consider donating so I can continue the fight against malware All donations go directly to the helper Due to the large amount of backlogs we have I cannot respond to PMs for help unless I am already working with you

thewall View Member Profile	Feb 8 2010, 02:57 PM Post #56
Forum Addict Group: Malware Response Team Posts: 6,383 Joined: 19-June 07 From: Florida Member No.: 137,685	Something I would like to add which another team member brought to my attention is you are running AVG, Symantec and PC Tools on your computer. This could be putting quite a bit of strain on it due to the resources they are pulling. You might want to think about disabling the others and keep AVG running until we can get the computer straightened out. -------------------- If I have helped you then please consider donating so I can continue the fight against malware All donations go directly to the helper Due to the large amount of backlogs we have I cannot respond to PMs for help unless I am already working with you

waffle46528 View Member Profile	Feb 9 2010, 03:16 AM Post #57
Member Group: Members Posts: 32 Joined: 22-January 10 Member No.: 440,080	Here's the Gmer.txt log. I used to have Norton antivirus,I believe thats the same thing as Symantec,but when I went with AVG I tried two uninstall and delete every bit of Norton I could find. And I remember there was a lot of it. I've always heard that you can't have two antivirus programs running at the same time. I tried to run PC tools Spyware Doctor,Spybot Search and Destroy when I started to have problems,but they wouldn't run. Now running Combofix and Gmer, I see them on in the system tray.I just start and run them once in a while to clean up things. AVG email scanner still isn't working. Thats the first problem I noticed before this Antivirus Live started taking over. I'll bet thats how it infected my computer,through email. Gmer.txt log GMER 1.0.15.15281 - http://www.gmer.net Rootkit scan 2010-02-09 02:45:33 Windows 5.1.2600 Service Pack 3 Running: vti67mgg.exe; Driver: C:\DOCUME~1\NANCIA~1\LOCALS~1\Temp\pwlyipog.sys ---- System - GMER 1.0.15 ---- SSDT \SystemRoot\system32\drivers\iksysflt.sys (System Filter Device Driver/PCTools Research Pty Ltd.) ZwCreateKey [0xB18E78F4] SSDT \SystemRoot\system32\drivers\iksysflt.sys (System Filter Device Driver/PCTools Research Pty Ltd.) ZwCreateProcess [0xB18E58A2] SSDT \SystemRoot\system32\drivers\iksysflt.sys (System Filter Device Driver/PCTools Research Pty Ltd.) ZwCreateProcessEx [0xB18E5E88] SSDT \SystemRoot\system32\drivers\iksysflt.sys (System Filter Device Driver/PCTools Research Pty Ltd.) ZwDeleteKey [0xB18E814C] SSDT \SystemRoot\system32\drivers\iksysflt.sys (System Filter Device Driver/PCTools Research Pty Ltd.) ZwDeleteValueKey [0xB18E83B0] SSDT \SystemRoot\system32\drivers\iksysflt.sys (System Filter Device Driver/PCTools Research Pty Ltd.) ZwSetValueKey [0xB18E86D8] SSDT \SystemRoot\system32\drivers\iksysflt.sys (System Filter Device Driver/PCTools Research Pty Ltd.) ZwTerminateProcess [0xB18E4DB4] SSDT \SystemRoot\system32\drivers\iksysflt.sys (System Filter Device Driver/PCTools Research Pty Ltd.) ZwWriteVirtualMemory [0xB18E4420] Code \??\C:\DOCUME~1\NANCIA~1\LOCALS~1\Temp\catchme.sys pIofCallDriver ---- Devices - GMER 1.0.15 ---- AttachedDevice \FileSystem\Ntfs \Ntfs ikfileflt.sys (PCTools Research Pty Ltd.) AttachedDevice \Driver\Tcpip \Device\Ip SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation) AttachedDevice \Driver\Tcpip \Device\Tcp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation) Device ACPI.sys (ACPI Driver for NT/Microsoft Corporation) AttachedDevice \Driver\Tcpip \Device\Udp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation) AttachedDevice \Driver\Tcpip \Device\RawIp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation) AttachedDevice \FileSystem\Fastfat \Fat ikfileflt.sys (PCTools Research Pty Ltd.) AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation) AttachedDevice \FileSystem\Fastfat \Fat InCDrec.SYS (InCD File System Recognizer/Nero AG) ---- EOF - GMER 1.0.15 ----

thewall View Member Profile	Feb 9 2010, 02:41 PM Post #58
Forum Addict Group: Malware Response Team Posts: 6,383 Joined: 19-June 07 From: Florida Member No.: 137,685	That doesn't look bad. Since you ran ComboFix have you had any improvements in the overall performance of the machine? -------------------- If I have helped you then please consider donating so I can continue the fight against malware All donations go directly to the helper Due to the large amount of backlogs we have I cannot respond to PMs for help unless I am already working with you

waffle46528 View Member Profile	Feb 11 2010, 06:35 PM Post #59
Member Group: Members Posts: 32 Joined: 22-January 10 Member No.: 440,080	Hello again: I've been stuck in Cleveland,Oh because of the snow. I just have got back to my computer,which is working perfectly. That Combofix did it. If I had tried putting that USB drive in a different USB port,or maybe just renaming it,like you told me to do with Combofix (waffle.exe),I'd probably solved this a week ago. Plus all the other fixes that you had me run. Thankyou very much for sticking with me. You hav been a tremendous help. I ran the search on my computer foe Symantec and found a few things that I deleted. That PC Tools(Spyware Doctor), I dont leave it run. I just use it like a broom and just clean things up once in a while. Same with Antimalwarebytes and Spybot Search and Destroy. They all have helped me in the past. I might keep Combofix in my armory as well. Well thanks again.

thewall View Member Profile	Feb 11 2010, 07:23 PM Post #60
Forum Addict Group: Malware Response Team Posts: 6,383 Joined: 19-June 07 From: Florida Member No.: 137,685	You're more than welcome but we do have some cleaning up to do if you will stay with me and I really would like to run another scan in case there is something lurking we didn't get. It's important to run this online scan to search for any remnants. It can take some time, so please be patient and allow it to run it's full course: Please do a scan with Kaspersky Online Scanner. Please note: Kaspersky requires Java Runtime Environment (JRE) be installed before scanning for malware, as ActiveX is no longer being used.) If you are using Windows Vista, open your browser by right-clicking on its icon and select 'Run as administrator' to perform this scan. Open the Kaspersky WebScanner page. Click on the button on the main page. The program will launch and fill in the Information section on the left. Read the "Requirements and Limitations" then press the button. The program will begin downloading the latest program and definition files. It may take a while so please be patient and let it finish. Once the files have been downloaded, click on the ...button. In the scan settings make sure the following are selected: Detect malicious programs of the following categories: Viruses, Worms, Trojan Horses, Rootkits Spyware, Adware, Dialers and other potentially dangerous programs Scan compound files (doesn't apply to the File scan area): Archives Mail databases By default the above items should already be checked. Click the button, if you made any changes. Now under the Scan section on the left: Select My Computer The program will now start and scan your system. This will run for a while, be patient and let it finish. Once the scan is complete, click on View scan report Now, click on the Save Report as button. In the drop down box labeled Files of type change the type to Text file. Save the file to your desktop. Copy and paste that information in your next post. You can refer to this animation by sundavis if needed. -------------------- If I have helped you then please consider donating so I can continue the fight against malware All donations go directly to the helper Due to the large amount of backlogs we have I cannot respond to PMs for help unless I am already working with you

« Next Oldest · Virus, Trojan, Spyware, and Malware Removal Logs · Next Newest »

5 Pages

« < 2 3 4 5 >

1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)

0 Members:

Display Mode: Standard · Switch to: Linear+ · Switch to: Outline

Track this topic · Email this topic · Print this topic · Subscribe to this forum

Lo-Fi Version

Time is now: 6th September 2010 - 03:27 AM

Advertise \| About Us \| Terms of Use \| Privacy Policy \| Contact Us \| Site Map \| Chat \| Tutorials \| Uninstall List
Discussion Forums \| The Computer Glossary \| Resources \| RSS Feeds \| Startups \| The File Database \| Virus Removal Guides