Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Browser redirects, system shutdowns and more ...


  • This topic is locked This topic is locked
15 replies to this topic

#1 oatmeal2348

oatmeal2348

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:08:16 AM

Posted 24 January 2010 - 07:27 PM

Sometime last November I started having problems. The biggest symptom was browser redirects (trying to click on any search results from Yahoo or Google on both Firefox and IE sent me to the wrong places.) I also had trouble using Malwarebytes, and my S&D, AdAware and McAfee weren't finding anything (at least nothing useful.)
I actually got so frustrated that I rebooted the hard drive twice, once in early November, and again later that month, so I'm wondering if maybe the problem is still buried in one of my backups that I haven't cleared out yet. I have been getting errors about Generic Host System 32 (about three times every time I start the computer) and still have trouble with search results. the NT System Authority also randomly pops up to shut down my system (but I make it stop by running the 'shutdown -a' command.)

I am running XP Professional SP3, and have HijackThis, Spybot, AdAware, CCleaner, Malwarebytes and McAfee all at the ready.

Here's the info from the DDS report, and I'll attach the 'attach' and 'ark' reports as specified in the preparation guide. I look forward to hearing from you guys!



DDS (Ver_09-12-01.01) - NTFSx86
Run by Owner at 17:37:20.29 on Sun 01/24/2010
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1207 [GMT -6:00]

AV: McAfee VirusScan *On-access scanning enabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}

============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\Program Files\Webroot\WebrootSecurity\SpySweeper.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\zHotkey.exe
C:\Program Files\Digital Media Reader\shwiconem.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\PROGRA~1\Pinnacle\SHARED~1\Programs\USBTip\USBTip.exe
C:\Program Files\Lexmark 7100 Series\lxbxmon.exe
C:\Program Files\Lexmark 7100 Series\ezprint.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\lxbxcoms.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Owner\Desktop\dds.scr

============== Pseudo HJT Report ===============

uSearch Bar = hxxp://www.google.com/ie
uStart Page = hxxp://www.emachines.com/
mSearchAssistant = hxxp://www.google.com/ie
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program files\spybot - search & destroy\SDHelper.dll
BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\mcafee\virusscan\scriptsn.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\googletoolbar1.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: {4982D40A-C53B-4615-B15B-B5B5E98D167C} - No File
TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar1.dll
TB: {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No File
EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
mRun: [ehTray] c:\windows\ehome\ehtray.exe
mRun: [CHotkey] zHotkey.exe
mRun: [ShowWnd] ShowWnd.exe
mRun: [SunKistEM] c:\program files\digital media reader\shwiconem.exe
mRun: [<NO NAME>]
mRun: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE
mRun: [mcagent_exe] "c:\program files\mcafee.com\agent\mcagent.exe" /runkey
mRun: [USBToolTip] c:\progra~1\pinnacle\shared~1\programs\usbtip\USBTip.exe
mRun: [LXBXCATS] rundll32 c:\windows\system32\spool\drivers\w32x86\3\LXBXtime.dll,_RunDLLEntry@16
mRun: [lxbxmon.exe] "c:\program files\lexmark 7100 series\lxbxmon.exe"
mRun: [FaxCenterServer4_in_1] "c:\program files\lexmark 7100 series\fm3032.exe" /s
mRun: [EzPrint] "c:\program files\lexmark 7100 series\ezprint.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {4982D40A-C53B-4615-B15B-B5B5E98D167C} - {4982D40A-C53B-4615-B15B-B5B5E98D167C}
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll
DPF: {40F576AD-8680-4F9E-9490-99D069CD665F} - hxxp://srtest-cdn.systemrequirementslab.com.s3.amazonaws.com/bin/sysreqlabdetect.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_02-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
Notify: AtiExtEvent - Ati2evxx.dll
SSODL: lababaniz - {06e07889-8486-4206-96a8-542a6cefddfd} - No File
STS: {06e07889-8486-4206-96a8-542a6cefddfd} - No File
mASetup: {DDE03EA1-6BE6-4388-9045-F4C090909B3E} - rundll32 bzhcwcio2.dll,laspi
Hosts: 193.169.12.8 nosd.info
================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\owner\applic~1\mozilla\firefox\profiles\15zauzuh.default\
FF - prefs.js: browser.startup.homepage - hxxp://m.www.yahoo.com/
FF - plugin: c:\documents and settings\owner\application data\mozilla\firefox\profiles\15zauzuh.default\extensions\oberongamehost@oberongames.com\platform\winnt_x86-msvc\plugins\npOberonGameHost.dll
FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: XULRunner: {DA2E8CDE-D256-4AAB-8E40-C6162166DA75} - c:\documents and settings\owner\local settings\application data\{da2e8cde-d256-4aab-8e40-c6162166da75}\
FF - HiddenExtension: XULRunner: {CB2E7386-AF9F-4055-9497-688B16170F39} - c:\windows\system32\config\systemprofile\local settings\application data\{cb2e7386-af9f-4055-9497-688b16170f39}\
FF - HiddenExtension: XULRunner: {188BEA00-1742-4A64-BA60-6ECA4F6F7FEA} - c:\documents and settings\owner\local settings\application data\{188bea00-1742-4a64-ba60-6eca4f6f7fea}\
FF - HiddenExtension: XULRunner: {FA568719-2949-4A7A-B98E-D50BF89CE949} - c:\documents and settings\owner\local settings\application data\{fa568719-2949-4a7a-b98e-d50bf89ce949}\
FF - HiddenExtension: XULRunner: {2CF8BFD5-40E8-4616-854F-E5EBC37F190B} - c:\documents and settings\owner\local settings\application data\{2cf8bfd5-40e8-4616-854f-e5ebc37f190b}\
FF - HiddenExtension: XULRunner: {AE8248A7-FC41-4253-9D44-3E5A5EF92690} - c:\documents and settings\owner\local settings\application data\{ae8248a7-fc41-4253-9d44-3e5a5ef92690}\
FF - HiddenExtension: XULRunner: {0461C247-BF31-46C0-9CCC-347849BEE6E6} - c:\documents and settings\owner\local settings\application data\{0461c247-bf31-46c0-9ccc-347849bee6e6}\
FF - HiddenExtension: XULRunner: {445D22E3-14E7-4BC6-815C-518660622C88} - c:\documents and settings\owner\local settings\application data\{445d22e3-14e7-4bc6-815c-518660622c88}\
FF - HiddenExtension: XULRunner: {226C2AEF-DAB4-4F21-9711-23F067040145} - c:\documents and settings\owner\local settings\application data\{226c2aef-dab4-4f21-9711-23f067040145}\
FF - HiddenExtension: XULRunner: {2BE7BAD2-4747-461F-9870-1513CCC3BF86} - c:\documents and settings\owner\local settings\application data\{2be7bad2-4747-461f-9870-1513ccc3bf86}\

---- FIREFOX POLICIES ----
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

============= SERVICES / DRIVERS ===============

R0 ssfs0bbc;ssfs0bbc;c:\windows\system32\drivers\ssfs0bbc.sys [2009-11-6 29808]
R1 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2009-9-16 214664]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-12-2 1181328]
R2 McProxy;McAfee Proxy Service;c:\progra~1\common~1\mcafee\mcproxy\mcproxy.exe [2009-11-13 359952]
R2 McShield;McAfee Real-time Scanner;c:\progra~1\mcafee\viruss~1\mcshield.exe [2009-11-13 144704]
R2 WebrootSpySweeperService;Webroot Spy Sweeper Engine;c:\program files\webroot\webrootsecurity\SpySweeper.exe [2009-11-6 4048240]
R3 ATICXCAP;ATI TV Wonder Pro A/V Capture;c:\windows\system32\drivers\aticxcap.sys [2005-3-30 173824]
R3 ATICXTUN;ATI TV Wonder Pro Tuner (Philips 1236 MK3);c:\windows\system32\drivers\aticxtun.sys [2005-3-30 29184]
R3 ATICXXBR;ATI TV Wonder Pro A/V Crossbar;c:\windows\system32\drivers\aticxxbr.sys [2005-3-30 9088]
R3 McSysmon;McAfee SystemGuards;c:\progra~1\mcafee\viruss~1\mcsysmon.exe [2009-11-13 606736]
R3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2009-11-13 79816]
R3 mfebopk;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2009-11-13 35272]
R3 mfesmfk;McAfee Inc. mfesmfk;c:\windows\system32\drivers\mfesmfk.sys [2009-11-13 40552]
S0 ktlzm;ktlzm; [x]
S3 mferkdk;McAfee Inc. mferkdk;c:\windows\system32\drivers\mferkdk.sys [2009-11-13 34248]

=============== Created Last 30 ================

2010-01-24 22:15:11 94 ----a-w- c:\windows\wininit.ini
2010-01-14 18:34:29 7030 ----a-w- c:\windows\system32\qlwvvi
2010-01-13 04:34:03 471552 -c----w- c:\windows\system32\dllcache\aclayers.dll
2010-01-10 07:01:58 2 ----a-w- c:\windows\msoffice.ini
2010-01-10 01:04:40 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-10 01:04:38 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-01-10 00:36:27 0 d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-01-09 21:32:53 0 ----a-w- c:\windows\system32\26962.exe
2010-01-09 21:12:53 0 ----a-w- c:\windows\system32\29358.exe
2010-01-09 20:52:52 0 ----a-w- c:\windows\system32\11478.exe
2010-01-09 20:32:52 0 ----a-w- c:\windows\system32\15724.exe
2010-01-09 20:12:51 0 ----a-w- c:\windows\system32\19169.exe
2010-01-09 19:52:51 0 ----a-w- c:\windows\system32\26500.exe
2010-01-09 19:32:50 0 ----a-w- c:\windows\system32\6334.exe
2010-01-09 18:21:55 0 ----a-w- c:\windows\system32\18467.exe
2010-01-09 18:01:23 8192 -c--a-w- c:\windows\system32\dllcache\changer.sys
2010-01-09 18:01:23 8192 ----a-w- c:\windows\system32\drivers\changer.sys
2010-01-07 12:48:21 48128 ----a-w- c:\windows\system32\drivers\61883.sys
2010-01-04 00:59:44 15880 ----a-w- c:\windows\system32\lsdelete.exe
2010-01-04 00:30:42 1 ----a-w- C:\s
2010-01-02 06:24:27 0 ----a-w- c:\windows\Jfafa.bin
2010-01-02 06:24:26 120 ----a-w- c:\windows\Thofirogodinire.dat

==================== Find3M ====================

2009-12-28 20:20:52 286 ----a-w- c:\docume~1\owner\applic~1\wklnhst.dat
2009-12-23 03:45:45 96512 ----a-w- c:\windows\system32\drivers\atapi.sys
2009-12-21 19:14:05 916480 ----a-w- c:\windows\system32\wininet.dll
2009-11-18 04:10:06 22328 ----a-w- c:\docume~1\owner\applic~1\PnkBstrK.sys
2009-11-18 04:09:56 103736 ------w- c:\windows\system32\PnkBstrB.exe
2009-11-18 04:09:47 66872 ------w- c:\windows\system32\PnkBstrA.exe
2009-11-13 14:19:09 411368 ------w- c:\windows\system32\deploytk.dll
2009-11-06 21:19:42 1563008 ----a-w- c:\windows\WRSetup.dll

============= FINISH: 17:39:42.89 ===============

Attached Files



BC AdBot (Login to Remove)

 


#2 Buckeye_Sam

Buckeye_Sam

    Malware Expert


  • Members
  • 17,382 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Pickerington, Ohio
  • Local time:09:16 AM

Posted 25 January 2010 - 09:17 AM

Hello! smile.gif
My name is Sam and I will be helping you.

In order to see what's going on with your computer I'll ask for you to post various logs from the tools that we will use to resolve your issue. Please also share with me any information about how your computer is reacting and behaving each step of the way as we work through this process.


We need to create an OTL Report
  • Please download OTL from here
  • Save it to your desktop.
  • Double click on the icon on your desktop.
  • Click the "Scan All Users" checkbox.
  • Under the Custom Scan box paste this in

    netsvcs
    %SYSTEMDRIVE%\*.exe
    /md5start
    eventlog.dll
    scecli.dll
    netlogon.dll
    cngaudit.dll
    sceclt.dll
    ntelogon.dll
    logevent.dll
    iaStor.sys
    nvstor.sys
    atapi.sys
    IdeChnDr.sys
    viasraid.sys
    AGP440.sys
    vaxscsi.sys
    nvatabus.sys
    viamraid.sys
    nvata.sys
    nvgts.sys
    iastorv.sys
    ViPrt.sys
    eNetHook.dll
    ahcix86.sys
    KR10N.sys
    /md5stop
    %systemroot%\*. /mp /s
    %systemroot%\system32\*.dll /lockedfiles
    CREATERESTOREPOINT

  • Click the "Run Scan" button.
  • The scan should take just a few minutes.
  • Please copy and paste both logs back here in your next reply.

Posted Image If I have helped you in any way, please consider a donation to help me continue the fight against malware.


Failing to respond back to the person that is giving up their own time to help you not only is insensitive and disrespectful, but it guarantees that you will never receive help from me again. Please thank your helpers and there will always be help here when you need it!


========================================================

#3 oatmeal2348

oatmeal2348
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:08:16 AM

Posted 25 January 2010 - 11:43 PM

Hey there, Sam!
Running the OTL now ... it seems stuck on the 'Manual File Scan - Getting folder structure ... ' portion. I'll have the results as soon as they come in.


#4 oatmeal2348

oatmeal2348
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:08:16 AM

Posted 25 January 2010 - 11:50 PM

All done.

Here's what the scan found: (thanks in advance)

OTL logfile created on: 1/25/2010 10:34:46 PM - Run 1
OTL by OldTimer - Version 3.1.27.0 Folder = C:\Documents and Settings\Owner\Desktop
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 60.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 81.00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 182.10 Gb Total Space | 29.51 Gb Free Space | 16.21% Space Free | Partition Type: NTFS
Drive D: | 465.76 Gb Total Space | 325.68 Gb Free Space | 69.92% Space Free | Partition Type: NTFS
Drive E: | 4.20 Gb Total Space | 0.69 Gb Free Space | 16.35% Space Free | Partition Type: FAT32
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: HOME
Current User Name: Owner
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Processes (SafeList) ==========

PRC - [2010/01/25 22:33:32 | 00,548,352 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Owner\Desktop\OTL.exe
PRC - [2010/01/07 06:49:32 | 00,908,248 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2009/12/20 01:27:17 | 00,788,880 | ---- | M] (Lavasoft) -- C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
PRC - [2009/12/20 01:27:16 | 01,181,328 | ---- | M] (Lavasoft) -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
PRC - [2009/11/17 22:09:56 | 00,103,736 | ---- | M] () -- C:\WINDOWS\system32\PnkBstrB.exe
PRC - [2009/11/17 22:09:47 | 00,066,872 | ---- | M] () -- C:\WINDOWS\system32\PnkBstrA.exe
PRC - [2009/11/13 08:19:10 | 00,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe
PRC - [2009/11/12 21:47:28 | 00,172,032 | ---- | M] (New Boundary Technologies, Inc.) -- C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
PRC - [2009/11/10 23:08:18 | 00,417,792 | ---- | M] (Apple Inc.) -- C:\Program Files\QuickTime\QTTask.exe
PRC - [2009/11/06 12:00:22 | 04,048,240 | ---- | M] (Webroot Software, Inc. (www.webroot.com)) -- C:\Program Files\Webroot\WebrootSecurity\SpySweeper.exe
PRC - [2009/10/29 06:54:44 | 01,218,008 | ---- | M] (McAfee, Inc.) -- c:\Program Files\McAfee.com\Agent\mcagent.exe
PRC - [2009/10/27 11:19:46 | 00,895,696 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\MPF\MpfSrv.exe
PRC - [2009/09/17 14:29:04 | 00,865,832 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\MSC\mcmscsvc.exe
PRC - [2009/09/17 14:29:04 | 00,806,008 | ---- | M] (McAfee, Inc.) -- c:\Program Files\McAfee\MSC\mcupdmgr.exe
PRC - [2009/09/16 10:22:08 | 00,144,704 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\VirusScan\Mcshield.exe
PRC - [2009/09/16 09:28:38 | 00,606,736 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\VirusScan\mcsysmon.exe
PRC - [2009/07/08 11:54:34 | 00,359,952 | ---- | M] (McAfee, Inc.) -- c:\Program Files\Common Files\McAfee\McProxy\McProxy.exe
PRC - [2009/07/07 19:10:02 | 02,482,848 | ---- | M] (McAfee, Inc.) -- c:\Program Files\Common Files\McAfee\MNA\McNASvc.exe
PRC - [2009/03/05 16:07:20 | 02,260,480 | RHS- | M] (Safer-Networking Ltd.) -- C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
PRC - [2008/04/13 18:12:19 | 01,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2008/04/07 21:45:10 | 00,241,734 | R--- | M] () -- C:\Program Files\CyberLink\Shared files\RichVideo.exe
PRC - [2007/02/20 11:07:40 | 00,199,752 | ---- | M] (Pinnacle Systems GmbH) -- C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe
PRC - [2006/01/24 21:45:24 | 00,405,504 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\system32\ati2evxx.exe
PRC - [2005/01/18 03:43:04 | 00,196,608 | ---- | M] (Lexmark International, Inc.) -- C:\Program Files\Lexmark 7100 Series\lxbxmon.exE
PRC - [2005/01/06 11:41:22 | 00,462,848 | ---- | M] (Lexmark International, Inc.) -- C:\WINDOWS\system32\lxbxcoms.exe
PRC - [2004/11/15 17:04:32 | 00,135,168 | ---- | M] (Alcor Micro, Corp.) -- C:\Program Files\Digital Media Reader\shwiconEM.exe
PRC - [2004/09/17 07:24:02 | 00,061,440 | ---- | M] () -- C:\Program Files\Lexmark 7100 Series\ezprint.exe
PRC - [2004/08/10 13:00:00 | 00,016,896 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wbem\unsecapp.exe
PRC - [2004/05/17 20:30:04 | 00,543,232 | ---- | M] () -- C:\WINDOWS\zHotkey.exe


========== Modules (SafeList) ==========

MOD - [2010/01/25 22:33:32 | 00,548,352 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Owner\Desktop\OTL.exe
MOD - [2001/07/02 22:36:30 | 00,024,576 | ---- | M] () -- C:\WINDOWS\HKNTDLL.dll


========== Win32 Services (SafeList) ==========

SRV - [2009/12/20 01:27:16 | 01,181,328 | ---- | M] (Lavasoft) [Auto | Running] -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe -- (Lavasoft Ad-Aware Service)
SRV - [2009/11/17 22:09:56 | 00,103,736 | ---- | M] () [Auto | Running] -- C:\WINDOWS\system32\PnkBstrB.exe -- (PnkBstrB)
SRV - [2009/11/17 22:09:47 | 00,066,872 | ---- | M] () [Auto | Running] -- C:\WINDOWS\system32\PnkBstrA.exe -- (PnkBstrA)
SRV - [2009/11/13 08:19:10 | 00,153,376 | ---- | M] (Sun Microsystems, Inc.) [Auto | Running] -- C:\Program Files\Java\jre6\bin\jqs.exe -- (JavaQuickStarterService)
SRV - [2009/11/12 21:47:28 | 00,172,032 | ---- | M] (New Boundary Technologies, Inc.) [Auto | Running] -- C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS -- (PrismXL)
SRV - [2009/11/06 12:00:22 | 04,048,240 | ---- | M] (Webroot Software, Inc. (www.webroot.com)) [Auto | Running] -- C:\Program Files\Webroot\WebrootSecurity\SpySweeper.exe -- (WebrootSpySweeperService)
SRV - [2009/10/27 11:19:46 | 00,895,696 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\McAfee\MPF\MPFSrv.exe -- (MpfService)
SRV - [2009/09/17 14:29:04 | 00,865,832 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\McAfee\MSC\mcmscsvc.exe -- (mcmscsvc)
SRV - [2009/09/16 11:23:32 | 00,365,072 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files\McAfee\VirusScan\mcods.exe -- (McODS)
SRV - [2009/09/16 10:22:08 | 00,144,704 | ---- | M] (McAfee, Inc.) [Unknown | Running] -- C:\Program Files\McAfee\VirusScan\Mcshield.exe -- (McShield)
SRV - [2009/09/16 09:28:38 | 00,606,736 | ---- | M] (McAfee, Inc.) [On_Demand | Running] -- C:\Program Files\McAfee\VirusScan\mcsysmon.exe -- (McSysmon)
SRV - [2009/07/08 20:22:22 | 00,068,112 | ---- | M] (McAfee) [On_Demand | Stopped] -- C:\Program Files\McAfee\MBK\MBackMonitor.exe -- (MBackMonitor)
SRV - [2009/07/08 11:54:34 | 00,359,952 | ---- | M] (McAfee, Inc.) [Auto | Running] -- c:\Program Files\Common Files\McAfee\McProxy\McProxy.exe -- (McProxy)
SRV - [2009/07/07 19:10:02 | 02,482,848 | ---- | M] (McAfee, Inc.) [Auto | Running] -- c:\Program Files\Common Files\McAfee\MNA\McNASvc.exe -- (McNASvc)
SRV - [2008/04/07 21:45:10 | 00,241,734 | R--- | M] () [Auto | Running] -- C:\Program Files\CyberLink\Shared files\RichVideo.exe -- (RichVideo) Cyberlink RichVideo Service(CRVS)
SRV - [2006/01/26 08:57:00 | 00,520,192 | ---- | M] () [Auto | Stopped] -- C:\WINDOWS\system32\ati2sgag.exe -- (ATI Smart)
SRV - [2006/01/24 21:45:24 | 00,405,504 | ---- | M] (ATI Technologies Inc.) [Auto | Running] -- C:\WINDOWS\system32\ati2evxx.exe -- (Ati HotKey Poller)
SRV - [2005/04/04 00:41:10 | 00,069,632 | ---- | M] (Macrovision Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe -- (IDriverT)
SRV - [2005/01/06 11:41:22 | 00,462,848 | ---- | M] (Lexmark International, Inc.) [On_Demand | Running] -- C:\WINDOWS\System32\lxbxcoms.exe -- (lxbx_device)


========== Driver Services (SafeList) ==========

DRV - [2009/11/12 22:02:47 | 00,008,552 | ---- | M] (Windows ® 2000 DDK provider) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\asctrm.sys -- (ASCTRM)
DRV - [2009/11/06 12:00:36 | 00,176,752 | ---- | M] (Webroot Software, Inc. (www.webroot.com)) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\ssidrv.sys -- (ssidrv)
DRV - [2009/11/06 12:00:36 | 00,023,152 | ---- | M] (Webroot Software, Inc. (www.webroot.com)) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\sshrmd.sys -- (sshrmd)
DRV - [2009/11/06 12:00:34 | 00,029,808 | ---- | M] (Webroot Software, Inc. (www.webroot.com)) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\ssfs0bbc.sys -- (ssfs0bbc)
DRV - [2009/09/16 10:22:48 | 00,214,664 | ---- | M] (McAfee, Inc.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\mfehidk.sys -- (mfehidk)
DRV - [2009/09/16 10:22:48 | 00,079,816 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mfeavfk.sys -- (mfeavfk)
DRV - [2009/09/16 10:22:48 | 00,040,552 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mfesmfk.sys -- (mfesmfk)
DRV - [2009/09/16 10:22:48 | 00,035,272 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mfebopk.sys -- (mfebopk)
DRV - [2009/09/16 10:22:14 | 00,034,248 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mferkdk.sys -- (mferkdk)
DRV - [2009/07/16 12:32:26 | 00,120,136 | ---- | M] (McAfee, Inc.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\Mpfp.sys -- (MPFP)
DRV - [2008/04/13 12:46:20 | 00,048,128 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\61883.sys -- (61883)
DRV - [2008/04/13 12:46:20 | 00,038,912 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\avc.sys -- (Avc)
DRV - [2008/04/13 12:46:08 | 00,049,024 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mstape.sys -- (MSTAPE)
DRV - [2008/04/13 12:46:08 | 00,013,696 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\avcstrm.sys -- (AVCSTRM)
DRV - [2008/04/13 12:40:58 | 00,008,192 | ---- | M] (Microsoft Corporation) [Kernel | System | Stopped] -- C:\WINDOWS\system32\drivers\changer.sys -- (Changer)
DRV - [2008/04/13 12:36:39 | 00,043,008 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\amdagp.sys -- (amdagp)
DRV - [2008/04/13 12:36:39 | 00,040,960 | ---- | M] (Silicon Integrated Systems Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\sisagp.sys -- (sisagp)
DRV - [2007/11/13 04:25:53 | 00,020,480 | ---- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\secdrv.sys -- (Secdrv)
DRV - [2006/01/24 21:52:31 | 01,478,656 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2005/09/23 22:18:32 | 00,171,520 | ---- | M] (Pinnacle Systems GmbH) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\MarvinBus.sys -- (MarvinBus)
DRV - [2005/03/30 11:22:38 | 00,009,088 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\aticxxbr.sys -- (ATICXXBR)
DRV - [2005/03/30 11:22:36 | 00,173,824 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\aticxcap.sys -- (ATICXCAP)
DRV - [2005/03/30 11:22:36 | 00,029,184 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\aticxtun.sys -- (ATICXTUN) ATI TV Wonder Pro Tuner (Philips 1236 MK3)
DRV - [2004/12/01 23:40:08 | 02,300,928 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS -- (ALCXWDM) Service for Realtek AC97 Audio (WDM)
DRV - [2004/11/15 19:41:54 | 00,036,804 | ---- | M] (Alcor Micro Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Sunkfilt.sys -- (SunkFilt)
DRV - [2004/11/10 19:30:18 | 00,024,832 | ---- | M] (Roxio) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\cdralw2k.sys -- (Cdralw2k)
DRV - [2004/11/10 19:27:34 | 00,044,288 | ---- | M] (Roxio) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\cdr4_xp.sys -- (Cdr4_xp)
DRV - [2004/08/10 13:00:00 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ptilink.sys -- (Ptilink)
DRV - [2004/08/10 11:39:56 | 00,019,840 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\PxHelp20.sys -- (PxHelp20)
DRV - [2004/08/03 23:29:56 | 01,897,408 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv)
DRV - [2004/06/17 16:56:22 | 00,220,032 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSFHWBS2.sys -- (HSFHWBS2)
DRV - [2004/06/17 16:55:38 | 00,685,056 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf)
DRV - [2004/06/17 16:55:04 | 01,041,536 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_DP.sys -- (HSF_DP)
DRV - [2004/04/13 22:14:12 | 00,070,144 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtlnicxp.sys -- (RTL8023xp)
DRV - [2004/03/17 13:04:14 | 00,013,059 | ---- | M] (Conexant) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\mdmxsdk.sys -- (mdmxsdk)
DRV - [2001/08/17 22:07:44 | 00,019,072 | ---- | M] (Adaptec, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\sparrow.sys -- (Sparrow)
DRV - [2001/08/17 22:07:42 | 00,030,688 | ---- | M] (LSI Logic) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\sym_u3.sys -- (sym_u3)
DRV - [2001/08/17 22:07:40 | 00,028,384 | ---- | M] (LSI Logic) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\sym_hi.sys -- (sym_hi)
DRV - [2001/08/17 22:07:36 | 00,032,640 | ---- | M] (LSI Logic) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\symc8xx.sys -- (symc8xx)
DRV - [2001/08/17 22:07:34 | 00,016,256 | ---- | M] (Symbios Logic Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\symc810.sys -- (symc810)
DRV - [2001/08/17 21:52:22 | 00,036,736 | ---- | M] (Promise Technology, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\ultra.sys -- (ultra)
DRV - [2001/08/17 21:52:20 | 00,045,312 | ---- | M] (QLogic Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\ql12160.sys -- (ql12160)
DRV - [2001/08/17 21:52:20 | 00,040,320 | ---- | M] (QLogic Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\ql1080.sys -- (ql1080)
DRV - [2001/08/17 21:52:18 | 00,049,024 | ---- | M] (QLogic Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\ql1280.sys -- (ql1280)
DRV - [2001/08/17 21:52:16 | 00,179,584 | ---- | M] (Mylex Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\dac2w2k.sys -- (dac2w2k)
DRV - [2001/08/17 21:52:12 | 00,017,280 | ---- | M] (American Megatrends Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\mraid35x.sys -- (mraid35x)
DRV - [2001/08/17 21:52:00 | 00,026,496 | ---- | M] (Advanced System Products, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\asc.sys -- (asc)
DRV - [2001/08/17 21:51:58 | 00,014,848 | ---- | M] (Advanced System Products, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\asc3550.sys -- (asc3550)
DRV - [2001/08/17 21:51:56 | 00,005,248 | ---- | M] (Acer Laboratories Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\aliide.sys -- (AliIde)
DRV - [2001/08/17 21:51:54 | 00,006,656 | ---- | M] (CMD Technology, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\cmdide.sys -- (CmdIde)
DRV - [2001/08/17 14:49:32 | 00,019,968 | ---- | M] (Macronix International Co., Ltd. ) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mxnic.sys -- (mxnic)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie


IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKU\.DEFAULT\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKU\S-1-5-18\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-3967926464-2608887106-2790676712-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.emachines.com/
IE - HKU\S-1-5-21-3967926464-2608887106-2790676712-1006\S-1-5-21-3967926464-2608887106-2790676712-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://m.www.yahoo.com/"
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: OberonGameHost@OberonGames.com:1.0.5.1344
FF - prefs.js..extensions.enabledItems: {CB2E7386-AF9F-4055-9497-688B16170F39}:1.9.1

FF - HKLM\software\mozilla\Firefox\extensions\\{DA2E8CDE-D256-4AAB-8E40-C6162166DA75}: C:\Documents and Settings\Owner\Local Settings\Application Data\{DA2E8CDE-D256-4AAB-8E40-C6162166DA75}\ [2010/01/02 00:24:22 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\extensions\\{CB2E7386-AF9F-4055-9497-688B16170F39}: C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\{CB2E7386-AF9F-4055-9497-688B16170F39}\ [2010/01/03 18:36:53 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\extensions\\{188BEA00-1742-4A64-BA60-6ECA4F6F7FEA}: C:\Documents and Settings\Owner\Local Settings\Application Data\{188BEA00-1742-4A64-BA60-6ECA4F6F7FEA}\ [2010/01/04 19:26:14 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\extensions\\{FA568719-2949-4A7A-B98E-D50BF89CE949}: C:\Documents and Settings\Owner\Local Settings\Application Data\{FA568719-2949-4A7A-B98E-D50BF89CE949}\ [2010/01/05 07:53:45 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\extensions\\{2CF8BFD5-40E8-4616-854F-E5EBC37F190B}: C:\Documents and Settings\Owner\Local Settings\Application Data\{2CF8BFD5-40E8-4616-854F-E5EBC37F190B}\ [2010/01/09 12:42:53 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\extensions\\{AE8248A7-FC41-4253-9D44-3E5A5EF92690}: C:\Documents and Settings\Owner\Local Settings\Application Data\{AE8248A7-FC41-4253-9D44-3E5A5EF92690}\ [2010/01/09 18:55:49 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\extensions\\{0461C247-BF31-46C0-9CCC-347849BEE6E6}: C:\Documents and Settings\Owner\Local Settings\Application Data\{0461C247-BF31-46C0-9CCC-347849BEE6E6}\ [2010/01/16 19:37:21 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\extensions\\{445D22E3-14E7-4BC6-815C-518660622C88}: C:\Documents and Settings\Owner\Local Settings\Application Data\{445D22E3-14E7-4BC6-815C-518660622C88}\ [2010/01/18 20:58:50 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\extensions\\{226C2AEF-DAB4-4F21-9711-23F067040145}: C:\Documents and Settings\Owner\Local Settings\Application Data\{226C2AEF-DAB4-4F21-9711-23F067040145}\ [2010/01/22 05:47:01 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\extensions\\{2BE7BAD2-4747-461F-9870-1513CCC3BF86}: C:\Documents and Settings\Owner\Local Settings\Application Data\{2BE7BAD2-4747-461F-9870-1513CCC3BF86}\ [2010/01/22 05:58:26 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.7\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/01/07 06:49:41 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.7\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/01/07 06:49:41 | 00,000,000 | ---D | M]

[2009/11/14 02:23:58 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Mozilla\Extensions
[2010/01/21 23:11:09 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\15zauzuh.default\extensions
[2009/12/07 22:44:26 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\15zauzuh.default\extensions\OberonGameHost@OberonGames.com
[2009/11/14 02:23:28 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions

O1 HOSTS File: ([2010/01/16 01:02:43 | 00,000,769 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 193.169.12.8 nosd.info
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll (McAfee, Inc.)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O3 - HKLM\..\Toolbar: (&Google) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (no name) - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - No CLSID value found.
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (no name) - {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No CLSID value found.
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (no name) - {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No CLSID value found.
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O3 - HKU\S-1-5-21-3967926464-2608887106-2790676712-1006\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O3 - HKU\S-1-5-21-3967926464-2608887106-2790676712-1006\..\Toolbar\WebBrowser: (no name) - {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No CLSID value found.
O3 - HKU\S-1-5-21-3967926464-2608887106-2790676712-1006\..\Toolbar\WebBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [CHotkey] C:\WINDOWS\zHotkey.exe ()
O4 - HKLM..\Run: [EzPrint] C:\Program Files\Lexmark 7100 Series\ezprint.exe ()
O4 - HKLM..\Run: [FaxCenterServer4_in_1] C:\Program Files\Lexmark 7100 Series\fm3032.exe ()
O4 - HKLM..\Run: [LXBXCATS] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXBXtime.DLL ()
O4 - HKLM..\Run: [lxbxmon.exe] C:\Program Files\Lexmark 7100 Series\lxbxmon.exe (Lexmark International, Inc.)
O4 - HKLM..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\qttask.exe (Apple Inc.)
O4 - HKLM..\Run: [Recguard] C:\WINDOWS\SMINST\Recguard.exe ()
O4 - HKLM..\Run: [ShowWnd] C:\WINDOWS\ShowWnd.exe ()
O4 - HKLM..\Run: [SunKistEM] C:\Program Files\Digital Media Reader\shwiconEM.exe (Alcor Micro, Corp.)
O4 - HKLM..\Run: [USBToolTip] C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe (Pinnacle Systems GmbH)
O4 - HKU\S-1-5-21-3967926464-2608887106-2790676712-1006..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Main present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme ()
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: CDRAutoRun = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: CDRAutoRun = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-3967926464-2608887106-2790676712-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra Button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - Reg Error: Key error. File not found
O9 - Extra 'Tools' menuitem : AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - Reg Error: Value error. File not found
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {40F576AD-8680-4F9E-9490-99D069CD665F} http://srtest-cdn.systemrequirementslab.co...eqlabdetect.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-...indows-i586.cab (Java Plug-in 1.5.0_02)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_17)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O21 - SSODL: lababaniz - {06e07889-8486-4206-96a8-542a6cefddfd} - CLSID or File not found.
O22 - SharedTaskScheduler: {06e07889-8486-4206-96a8-542a6cefddfd} - tokatiluy - Reg Error: Key error. File not found
O24 - Desktop WallPaper: C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005/04/13 11:20:25 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2004/09/13 12:15:24 | 00,000,053 | -HS- | M] () - E:\Autorun.inf -- [ FAT32 ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (lsdelete) - C:\WINDOWS\System32\lsdelete.exe ()
O35 - comfile [open] -- "%1" %*
O35 - exefile [open] -- "%1" %*
O36 - AppCertDlls: diskrcp - (C:\WINDOWS\system32\attrhost.dll) - C:\WINDOWS\System32\attrhost.dll File not found

NetSvcs: 6to4 - File not found
NetSvcs: Ias - C:\WINDOWS\system32\ias [2005/04/13 11:19:19 | 00,000,000 | ---D | M]
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: SSHNAS - File not found

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (49542988925239296)

========== Files/Folders - Created Within 30 Days ==========

[2010/01/25 22:33:28 | 00,548,352 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Owner\Desktop\OTL.exe
[2010/01/24 17:41:01 | 00,472,064 | ---- | C] ( ) -- C:\Documents and Settings\Owner\Desktop\RootRepeal.exe
[2010/01/23 21:16:21 | 00,000,000 | -HSD | C] -- C:\Config.Msi
[2010/01/23 12:20:36 | 00,000,000 | RH-D | C] -- C:\Documents and Settings\Owner\Recent
[2010/01/22 05:58:25 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Local Settings\Application Data\{2BE7BAD2-4747-461F-9870-1513CCC3BF86}
[2010/01/22 05:47:01 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Local Settings\Application Data\{226C2AEF-DAB4-4F21-9711-23F067040145}
[2010/01/18 20:58:50 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Local Settings\Application Data\{445D22E3-14E7-4BC6-815C-518660622C88}
[2010/01/16 19:37:20 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Local Settings\Application Data\{0461C247-BF31-46C0-9CCC-347849BEE6E6}
[2010/01/12 22:34:03 | 00,471,552 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\aclayers.dll
[2010/01/10 01:01:58 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Desktop\AOL Saved PFC
[2010/01/09 19:04:40 | 00,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/01/09 19:04:38 | 00,019,160 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010/01/09 19:03:31 | 05,115,824 | ---- | C] (Malwarebytes Corporation ) -- C:\Documents and Settings\Owner\Desktop\mbam-setup.exe
[2010/01/09 18:55:49 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Local Settings\Application Data\{AE8248A7-FC41-4253-9D44-3E5A5EF92690}
[2010/01/09 18:36:27 | 00,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010/01/09 13:58:40 | 00,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2010/01/09 13:58:40 | 00,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Application Data\Adobe
[2010/01/09 12:42:53 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Local Settings\Application Data\{2CF8BFD5-40E8-4616-854F-E5EBC37F190B}
[2010/01/09 12:01:23 | 00,008,192 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\changer.sys
[2010/01/09 12:01:23 | 00,008,192 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\changer.sys
[2010/01/07 06:48:21 | 00,048,128 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\61883.sys
[2010/01/05 07:53:45 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Local Settings\Application Data\{FA568719-2949-4A7A-B98E-D50BF89CE949}
[2010/01/04 19:26:13 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Local Settings\Application Data\{188BEA00-1742-4A64-BA60-6ECA4F6F7FEA}
[2010/01/02 00:24:22 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Local Settings\Application Data\{DA2E8CDE-D256-4AAB-8E40-C6162166DA75}
[2009/12/21 07:18:02 | 00,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Apple
[2009/11/15 10:50:09 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[2009/11/13 22:36:29 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\CyberLink
[2005/04/13 11:26:13 | 00,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Application Data\Microsoft
[2005/04/13 11:26:12 | 00,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2005/04/13 11:26:11 | 00,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/01/25 22:33:32 | 00,548,352 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Owner\Desktop\OTL.exe
[2010/01/25 22:29:07 | 00,000,472 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2010/01/25 22:29:07 | 00,000,472 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Daily 4).job
[2010/01/25 22:29:06 | 00,000,472 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Daily 3).job
[2010/01/25 22:29:05 | 00,000,472 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Daily 2).job
[2010/01/25 22:29:05 | 00,000,472 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Daily 1).job
[2010/01/25 22:27:48 | 00,017,153 | ---- | M] () -- C:\WINDOWS\System32\Config.MPF
[2010/01/25 22:26:08 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010/01/25 22:26:05 | 00,001,170 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/01/25 22:26:02 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/01/25 22:25:59 | 21,459,64032 | -HS- | M] () -- C:\hiberfil.sys
[2010/01/24 18:35:06 | 03,670,016 | -H-- | M] () -- C:\Documents and Settings\Owner\NTUSER.DAT
[2010/01/24 18:35:06 | 00,000,178 | -HS- | M] () -- C:\Documents and Settings\Owner\ntuser.ini
[2010/01/24 17:41:57 | 00,000,000 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\settings.dat
[2010/01/24 17:40:58 | 00,472,064 | ---- | M] ( ) -- C:\Documents and Settings\Owner\Desktop\RootRepeal.exe
[2010/01/24 17:34:48 | 00,524,288 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\dds.scr
[2010/01/24 16:17:12 | 00,422,224 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010/01/24 16:15:11 | 00,000,094 | ---- | M] () -- C:\WINDOWS\wininit.ini
[2010/01/24 15:58:00 | 00,000,120 | ---- | M] () -- C:\WINDOWS\Thofirogodinire.dat
[2010/01/24 15:58:00 | 00,000,000 | ---- | M] () -- C:\WINDOWS\Jfafa.bin
[2010/01/23 22:24:20 | 00,149,136 | ---- | M] () -- C:\Documents and Settings\Owner\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2010/01/18 07:18:03 | 00,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/01/17 10:03:06 | 00,000,349 | ---- | M] () -- C:\Documents and Settings\All Users\Documents\PCLECHAL.INI
[2010/01/16 12:45:21 | 00,038,912 | ---- | M] () -- C:\Documents and Settings\Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/01/15 18:37:31 | 00,001,688 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\CyberLink PowerDirector.lnk
[2010/01/15 07:26:02 | 13,238,272 | ---- | M] () -- C:\Documents and Settings\Owner\My Documents\mike money.mny
[2010/01/15 07:25:56 | 16,458,030 | R--- | M] () -- C:\Documents and Settings\Owner\My Documents\mike money Backup 0.mbf
[2010/01/14 12:34:40 | 00,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010/01/14 12:34:29 | 00,007,030 | ---- | M] () -- C:\WINDOWS\System32\qlwvvi
[2010/01/12 22:44:01 | 07,453,408 | -H-- | M] () -- C:\Documents and Settings\Owner\Local Settings\Application Data\IconCache.db
[2010/01/10 01:02:24 | 00,000,486 | ---- | M] () -- C:\WINDOWS\win.ini
[2010/01/10 01:01:58 | 00,000,002 | ---- | M] () -- C:\WINDOWS\msoffice.ini
[2010/01/09 19:20:22 | 00,000,725 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/01/09 19:03:35 | 05,115,824 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\Owner\Desktop\mbam-setup.exe
[2010/01/09 15:32:53 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\26962.exe
[2010/01/09 15:12:53 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\29358.exe
[2010/01/09 14:52:52 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\11478.exe
[2010/01/09 14:32:52 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\15724.exe
[2010/01/09 14:12:51 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\19169.exe
[2010/01/09 13:52:51 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\26500.exe
[2010/01/09 13:32:50 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\6334.exe
[2010/01/09 13:12:50 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\18467.exe
[2010/01/09 13:07:40 | 00,000,049 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2010/01/09 13:00:50 | 00,111,754 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\JAN_coupon_BOGO.pdf
[2010/01/07 16:07:14 | 00,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/01/07 16:07:04 | 00,019,160 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010/01/05 06:43:55 | 00,487,119 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\pinnacle rebate form.pdf
[2010/01/03 18:30:42 | 00,000,001 | ---- | M] () -- C:\s
[2010/01/01 19:41:51 | 00,001,868 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\PowerDirector.lnk
[2010/01/01 01:00:15 | 00,000,318 | ---- | M] () -- C:\WINDOWS\tasks\McQcTask.job
[2009/12/30 06:54:09 | 00,001,548 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\CCleaner.lnk
[2009/12/28 14:20:52 | 00,051,200 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\AMAZON BOOKS.xlr
[2009/12/28 14:20:52 | 00,000,286 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\wklnhst.dat
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/01/24 17:41:57 | 00,000,000 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\settings.dat
[2010/01/24 17:34:51 | 00,524,288 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\dds.scr
[2010/01/24 16:15:11 | 00,000,094 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2010/01/14 12:34:29 | 00,007,030 | ---- | C] () -- C:\WINDOWS\System32\qlwvvi
[2010/01/10 01:01:58 | 00,000,002 | ---- | C] () -- C:\WINDOWS\msoffice.ini
[2010/01/09 19:04:43 | 00,000,725 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/01/09 15:32:53 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\26962.exe
[2010/01/09 15:12:53 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\29358.exe
[2010/01/09 14:52:52 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\11478.exe
[2010/01/09 14:32:52 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\15724.exe
[2010/01/09 14:12:51 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\19169.exe
[2010/01/09 13:52:51 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\26500.exe
[2010/01/09 13:32:50 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\6334.exe
[2010/01/09 13:00:50 | 00,111,754 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\JAN_coupon_BOGO.pdf
[2010/01/09 12:21:55 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\18467.exe
[2010/01/05 06:43:54 | 00,487,119 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\pinnacle rebate form.pdf
[2010/01/04 07:55:14 | 21,459,64032 | -HS- | C] () -- C:\hiberfil.sys
[2010/01/03 18:59:44 | 00,015,880 | ---- | C] () -- C:\WINDOWS\System32\lsdelete.exe
[2010/01/03 18:30:42 | 00,000,001 | ---- | C] () -- C:\s
[2010/01/02 00:24:27 | 00,000,000 | ---- | C] () -- C:\WINDOWS\Jfafa.bin
[2010/01/02 00:24:26 | 00,000,120 | ---- | C] () -- C:\WINDOWS\Thofirogodinire.dat
[2009/11/23 20:25:00 | 00,001,157 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\__FileUploader.log
[2009/11/21 17:27:36 | 00,070,656 | ---- | C] () -- C:\WINDOWS\System32\simple.dll
[2009/11/21 17:27:35 | 00,306,688 | ---- | C] () -- C:\WINDOWS\System32\LFFPX7.DLL
[2009/11/21 17:27:35 | 00,302,592 | ---- | C] () -- C:\WINDOWS\System32\pgp.dll
[2009/11/21 17:27:35 | 00,095,232 | ---- | C] () -- C:\WINDOWS\System32\LFKODAK.DLL
[2009/11/21 17:27:35 | 00,093,184 | ---- | C] () -- C:\WINDOWS\System32\keydb.dll
[2009/11/21 17:27:35 | 00,065,024 | ---- | C] () -- C:\WINDOWS\System32\bn.dll
[2009/11/17 22:10:06 | 00,022,328 | ---- | C] () -- C:\WINDOWS\System32\drivers\PnkBstrK.sys
[2009/11/17 22:10:06 | 00,022,328 | ---- | C] () -- C:\Documents and Settings\Owner\Application Data\PnkBstrK.sys
[2009/11/17 22:09:44 | 00,000,287 | ---- | C] () -- C:\WINDOWS\game.ini
[2009/11/16 08:31:58 | 00,000,286 | ---- | C] () -- C:\Documents and Settings\Owner\Application Data\wklnhst.dat
[2009/11/15 18:37:19 | 00,032,768 | ---- | C] () -- C:\WINDOWS\System32\LXBXPMON.DLL
[2009/11/15 18:37:19 | 00,020,480 | ---- | C] () -- C:\WINDOWS\System32\LXBXFXPU.DLL
[2009/11/15 01:53:54 | 00,821,208 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2009/11/13 09:32:18 | 00,000,049 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2009/11/13 09:28:10 | 00,000,128 | ---- | C] () -- C:\Documents and Settings\Owner\Local Settings\Application Data\fusioncache.dat
[2009/11/12 22:37:52 | 00,038,912 | ---- | C] () -- C:\Documents and Settings\Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/11/12 22:15:13 | 00,156,672 | ---- | C] () -- C:\WINDOWS\System32\RTLCPAPI.dll
[2009/11/12 22:09:49 | 00,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2009/11/12 21:49:31 | 00,532,544 | ---- | C] () -- C:\WINDOWS\PIC.dll
[2009/11/12 21:49:31 | 00,024,576 | ---- | C] () -- C:\WINDOWS\HKNTDLL.dll
[2005/04/13 13:02:03 | 00,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2005/04/13 10:57:05 | 00,001,436 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2005/04/13 10:57:05 | 00,000,495 | ---- | C] () -- C:\WINDOWS\System32\emver.ini
[2003/09/29 09:27:12 | 00,040,960 | ---- | C] () -- C:\WINDOWS\System32\lxbxvs.dll

========== Custom Scans ==========


< %SYSTEMDRIVE%\*.exe >


< MD5 for: AGP440.SYS >
[2004/08/10 13:00:00 | 16,971,599 | ---- | M] () .cab file -- C:\My Backup -- 06-11-09 1958\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2009/04/09 05:29:55 | 23,852,652 | ---- | M] () .cab file -- C:\My Backup -- 06-11-09 1958\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2004/08/10 13:00:00 | 16,971,599 | ---- | M] () .cab file -- C:\My Backup -- 06-11-09 1958\WINDOWS\I386\sp2.cab:AGP440.sys
[2009/04/09 05:29:55 | 23,852,652 | ---- | M] () .cab file -- C:\My Backup -- 06-11-09 1958\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
[2004/08/10 13:00:00 | 16,971,599 | ---- | M] () .cab file -- C:\My Backup -- 12-11-09 2024\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2009/11/09 08:56:48 | 23,852,652 | ---- | M] () .cab file -- C:\My Backup -- 12-11-09 2024\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2004/08/10 13:00:00 | 16,971,599 | ---- | M] () .cab file -- C:\My Backup -- 12-11-09 2024\WINDOWS\I386\sp2.cab:AGP440.sys
[2009/11/09 08:56:48 | 23,852,652 | ---- | M] () .cab file -- C:\My Backup -- 12-11-09 2024\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
[2009/11/09 08:56:48 | 23,852,652 | ---- | M] () .cab file -- C:\My Backup -- 12-11-09 2024\WINDOWS\SoftwareDistribution\Download\9866fb57abdc0ea2f5d4e132d055ba4e\sp3.cab:AGP440.sys
[2004/08/10 13:00:00 | 16,971,599 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2009/11/15 10:18:44 | 23,852,652 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2004/08/10 13:00:00 | 16,971,599 | ---- | M] () .cab file -- C:\WINDOWS\I386\sp2.cab:AGP440.sys
[2009/11/15 10:18:44 | 23,852,652 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
[2008/04/13 12:36:38 | 00,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\My Backup -- 06-11-09 1958\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008/04/13 12:36:38 | 00,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\My Backup -- 06-11-09 1958\WINDOWS\system32\dllcache\agp440.sys
[2008/04/13 12:36:38 | 00,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\My Backup -- 06-11-09 1958\WINDOWS\system32\drivers\agp440.sys
[2008/04/13 12:36:38 | 00,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\My Backup -- 12-11-09 2024\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008/04/13 12:36:38 | 00,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\My Backup -- 12-11-09 2024\WINDOWS\SoftwareDistribution\Download\9866fb57abdc0ea2f5d4e132d055ba4e\agp440.sys
[2008/04/13 12:36:38 | 00,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\My Backup -- 12-11-09 2024\WINDOWS\system32\drivers\agp440.sys
[2008/04/13 12:36:38 | 00,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008/04/13 12:36:38 | 00,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys
[2004/08/04 07:07:42 | 00,042,368 | ---- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB -- C:\My Backup -- 06-11-09 1958\WINDOWS\$NtServicePackUninstall$\agp440.sys
[2004/08/04 07:07:42 | 00,042,368 | ---- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB -- C:\My Backup -- 12-11-09 2024\WINDOWS\$NtServicePackUninstall$\agp440.sys
[2004/08/04 07:07:42 | 00,042,368 | ---- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB -- C:\WINDOWS\$NtServicePackUninstall$\agp440.sys

< MD5 for: AHCIX86.SYS >
[2008/03/07 19:24:52 | 00,176,136 | ---- | M] (AMD Technologies Inc.) MD5=B6E729A575F84938A08D367E8352EB86 -- C:\My Backup -- 12-11-09 2024\ATI\SUPPORT\8-5_xp32_dd_ccc_wdm_enu_63030\SBDrv\RAID7xx\x86\ahcix86.sys

< MD5 for: ATAPI.SYS >
[2004/08/10 13:00:00 | 16,971,599 | ---- | M] () .cab file -- C:\My Backup -- 06-11-09 1958\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2009/04/09 05:29:55 | 23,852,652 | ---- | M] () .cab file -- C:\My Backup -- 06-11-09 1958\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2004/08/10 13:00:00 | 16,971,599 | ---- | M] () .cab file -- C:\My Backup -- 06-11-09 1958\WINDOWS\I386\sp2.cab:atapi.sys
[2009/04/09 05:29:55 | 23,852,652 | ---- | M] () .cab file -- C:\My Backup -- 06-11-09 1958\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2004/08/10 13:00:00 | 16,971,599 | ---- | M] () .cab file -- C:\My Backup -- 12-11-09 2024\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2009/11/09 08:56:48 | 23,852,652 | ---- | M] () .cab file -- C:\My Backup -- 12-11-09 2024\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2004/08/10 13:00:00 | 16,971,599 | ---- | M] () .cab file -- C:\My Backup -- 12-11-09 2024\WINDOWS\I386\sp2.cab:atapi.sys
[2009/11/09 08:56:48 | 23,852,652 | ---- | M] () .cab file -- C:\My Backup -- 12-11-09 2024\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2009/11/09 08:56:48 | 23,852,652 | ---- | M] () .cab file -- C:\My Backup -- 12-11-09 2024\WINDOWS\SoftwareDistribution\Download\9866fb57abdc0ea2f5d4e132d055ba4e\sp3.cab:atapi.sys
[2004/08/10 13:00:00 | 16,971,599 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2009/11/15 10:18:44 | 23,852,652 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2004/08/10 13:00:00 | 16,971,599 | ---- | M] () .cab file -- C:\WINDOWS\I386\sp2.cab:atapi.sys
[2009/11/15 10:18:44 | 23,852,652 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2008/04/13 12:40:30 | 00,096,512 | ---- | M] () MD5=98B6D2F981F5DFBB4F731E200DAD34AD -- C:\My Backup -- 06-11-09 1958\WINDOWS\system32\drivers\atapi.sys
[2008/04/13 12:40:30 | 00,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\My Backup -- 06-11-09 1958\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008/04/13 12:40:30 | 00,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\My Backup -- 12-11-09 2024\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008/04/13 12:40:30 | 00,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\My Backup -- 12-11-09 2024\WINDOWS\SoftwareDistribution\Download\9866fb57abdc0ea2f5d4e132d055ba4e\atapi.sys
[2008/04/13 12:40:30 | 00,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2009/12/22 21:45:45 | 00,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\dllcache\atapi.sys
[2009/12/22 21:45:45 | 00,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
[2004/08/03 21:59:44 | 00,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\My Backup -- 06-11-09 1958\WINDOWS\$NtServicePackUninstall$\atapi.sys
[2004/08/04 06:59:44 | 00,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\My Backup -- 06-11-09 1958\WINDOWS\system32\ReinstallBackups\0001\DriverFiles\i386\atapi.sys
[2004/08/03 22:59:44 | 00,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\My Backup -- 06-11-09 1958\WINDOWS\system32\ReinstallBackups\0005\DriverFiles\i386\atapi.sys
[2004/08/04 00:59:44 | 00,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\My Backup -- 12-11-09 2024\WINDOWS\$NtServicePackUninstall$\atapi.sys
[2004/08/04 06:59:44 | 00,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\My Backup -- 12-11-09 2024\WINDOWS\system32\ReinstallBackups\0001\DriverFiles\i386\atapi.sys
[2004/08/04 00:59:44 | 00,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
[2004/08/04 06:59:44 | 00,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\ReinstallBackups\0001\DriverFiles\i386\atapi.sys

< MD5 for: EVENTLOG.DLL >
[2008/04/13 18:11:53 | 00,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\My Backup -- 06-11-09 1958\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008/04/13 18:11:53 | 00,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\My Backup -- 06-11-09 1958\WINDOWS\system32\dllcache\eventlog.dll
[2008/04/13 18:11:53 | 00,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\My Backup -- 12-11-09 2024\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008/04/13 18:11:53 | 00,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\My Backup -- 12-11-09 2024\WINDOWS\SoftwareDistribution\Download\9866fb57abdc0ea2f5d4e132d055ba4e\eventlog.dll
[2008/04/13 18:11:53 | 00,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\My Backup -- 12-11-09 2024\WINDOWS\system32\eventlog.dll
[2008/04/13 18:11:53 | 00,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008/04/13 18:11:53 | 00,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\system32\eventlog.dll
[2004/08/10 13:00:00 | 00,055,808 | ---- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 -- C:\My Backup -- 06-11-09 1958\WINDOWS\$NtServicePackUninstall$\eventlog.dll
[2004/08/10 13:00:00 | 00,055,808 | ---- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 -- C:\My Backup -- 12-11-09 2024\WINDOWS\$NtServicePackUninstall$\eventlog.dll
[2004/08/10 13:00:00 | 00,055,808 | ---- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll
[2007/05/17 21:34:04 | 00,007,216 | ---- | M] () MD5=C2A279A458A06DE2C83D842AA042B5A8 -- C:\Documents and Settings\Owner\My Documents\Program Files\CyberLink\PowerDirector\EventLog.dll
[2007/05/17 20:34:04 | 00,007,216 | ---- | M] () MD5=C2A279A458A06DE2C83D842AA042B5A8 -- C:\My Backup -- 06-11-09 1958\Program Files\CyberLink\PowerDirector\EventLog.dll
[2007/05/17 21:34:04 | 00,007,216 | ---- | M] () MD5=C2A279A458A06DE2C83D842AA042B5A8 -- C:\Program Files\CyberLink\PowerDirector\EventLog.dll

< MD5 for: LOGEVENT.DLL >
[2008/04/13 18:11:53 | 00,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\My Backup -- 06-11-09 1958\WINDOWS\system32\logevent.dll

< MD5 for: NETLOGON.DLL >
[2008/04/13 18:12:01 | 00,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\My Backup -- 06-11-09 1958\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008/04/13 18:12:01 | 00,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\My Backup -- 06-11-09 1958\WINDOWS\system32\dllcache\netlogon.dll
[2008/04/13 18:12:01 | 00,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\My Backup -- 06-11-09 1958\WINDOWS\system32\netlogon.dll
[2008/04/13 18:12:01 | 00,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\My Backup -- 12-11-09 2024\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008/04/13 18:12:01 | 00,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\My Backup -- 12-11-09 2024\WINDOWS\SoftwareDistribution\Download\9866fb57abdc0ea2f5d4e132d055ba4e\netlogon.dll
[2008/04/13 18:12:01 | 00,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\My Backup -- 12-11-09 2024\WINDOWS\system32\netlogon.dll
[2008/04/13 18:12:01 | 00,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008/04/13 18:12:01 | 00,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\system32\netlogon.dll
[2009/02/06 12:46:09 | 00,408,064 | ---- | M] (Microsoft Corporation) MD5=6C476D33D82F1054849790181E8F7772 -- C:\My Backup -- 12-11-09 2024\WINDOWS\$hf_mig$\KB968389\SP2QFE\netlogon.dll
[2009/02/06 12:46:09 | 00,408,064 | ---- | M] (Microsoft Corporation) MD5=6C476D33D82F1054849790181E8F7772 -- C:\My Backup -- 12-11-09 2024\WINDOWS\$hf_mig$\KB975467\SP2QFE\netlogon.dll
[2009/02/06 12:46:09 | 00,408,064 | ---- | M] (Microsoft Corporation) MD5=6C476D33D82F1054849790181E8F7772 -- C:\My Backup -- 12-11-09 2024\WINDOWS\SoftwareDistribution\Download\78cf8552430e25a8f24bc1e4dfb1970e\SP2QFE\netlogon.dll
[2009/02/06 12:46:09 | 00,408,064 | ---- | M] (Microsoft Corporation) MD5=6C476D33D82F1054849790181E8F7772 -- C:\My Backup -- 12-11-09 2024\WINDOWS\SoftwareDistribution\Download\de81b460c3abcfc5b8494c785a5f3944\SP2QFE\netlogon.dll
[2009/02/06 12:46:09 | 00,408,064 | ---- | M] (Microsoft Corporation) MD5=6C476D33D82F1054849790181E8F7772 -- C:\WINDOWS\$hf_mig$\KB968389\SP2QFE\netlogon.dll
[2009/02/06 12:46:09 | 00,408,064 | ---- | M] (Microsoft Corporation) MD5=6C476D33D82F1054849790181E8F7772 -- C:\WINDOWS\$hf_mig$\KB975467\SP2QFE\netlogon.dll
[2004/08/10 13:00:00 | 00,407,040 | ---- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A -- C:\My Backup -- 06-11-09 1958\WINDOWS\$NtServicePackUninstall$\netlogon.dll
[2004/08/10 13:00:00 | 00,407,040 | ---- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A -- C:\My Backup -- 12-11-09 2024\WINDOWS\$NtServicePackUninstall$\netlogon.dll
[2004/08/10 13:00:00 | 00,407,040 | ---- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll

< MD5 for: SCECLI.DLL >
[2004/08/10 13:00:00 | 00,180,224 | ---- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A -- C:\My Backup -- 06-11-09 1958\WINDOWS\$NtServicePackUninstall$\scecli.dll
[2004/08/10 13:00:00 | 00,180,224 | ---- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A -- C:\My Backup -- 12-11-09 2024\WINDOWS\$NtServicePackUninstall$\scecli.dll
[2004/08/10 13:00:00 | 00,180,224 | ---- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
[2008/04/13 18:12:05 | 00,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\My Backup -- 06-11-09 1958\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008/04/13 18:12:05 | 00,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\My Backup -- 06-11-09 1958\WINDOWS\system32\dllcache\scecli.dll
[2008/04/13 18:12:05 | 00,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\My Backup -- 06-11-09 1958\WINDOWS\system32\scecli.dll
[2008/04/13 18:12:05 | 00,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\My Backup -- 12-11-09 2024\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008/04/13 18:12:05 | 00,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\My Backup -- 12-11-09 2024\WINDOWS\SoftwareDistribution\Download\9866fb57abdc0ea2f5d4e132d055ba4e\scecli.dll
[2008/04/13 18:12:05 | 00,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\My Backup -- 12-11-09 2024\WINDOWS\system32\scecli.dll
[2008/04/13 18:12:05 | 00,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008/04/13 18:12:05 | 00,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\system32\scecli.dll

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[2008/04/13 18:11:51 | 01,267,200 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\comsvcs.dll
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

========== Alternate Data Streams ==========

@Alternate Data Stream - 145 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:68C4BECC
< End of report >


#5 oatmeal2348

oatmeal2348
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:08:16 AM

Posted 25 January 2010 - 11:52 PM

Ooops! I forgot the info from the Extras report:

OTL Extras logfile created on: 1/25/2010 10:34:46 PM - Run 1
OTL by OldTimer - Version 3.1.27.0 Folder = C:\Documents and Settings\Owner\Desktop
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 60.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 81.00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 182.10 Gb Total Space | 29.51 Gb Free Space | 16.21% Space Free | Partition Type: NTFS
Drive D: | 465.76 Gb Total Space | 325.68 Gb Free Space | 69.92% Space Free | Partition Type: NTFS
Drive E: | 4.20 Gb Total Space | 0.69 Gb Free Space | 16.35% Space Free | Partition Type: FAT32
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: HOME
Current User Name: Owner
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\IEXPLORE.EXE (Microsoft Corporation)

[HKEY_USERS\S-1-5-21-3967926464-2608887106-2790676712-1006\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation)
htmlfile [print] -- Reg Error: Key error.
http [open] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome (Microsoft Corporation)
https [open] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" = C:\Program Files\Common Files\AOL\ACS\AOLDial.exe:*:Enabled:AOL -- File not found
"C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe" = C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe:*:Enabled:AOL -- File not found
"C:\Program Files\America Online 9.0\waol.exe" = C:\Program Files\America Online 9.0\waol.exe:*:Enabled:America Online 9.0 -- File not found

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" = C:\Program Files\Common Files\AOL\ACS\AOLDial.exe:*:Enabled:AOL -- File not found
"C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe" = C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe:*:Enabled:AOL -- File not found
"C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe" = C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe:*:Enabled:McAfee Network Agent -- (McAfee, Inc.)
"C:\Program Files\CyberLink\PowerDirector\PDR.exe" = C:\Program Files\CyberLink\PowerDirector\PDR.exe:*:Enabled:CyberLink PowerDirector -- (CyberLink Corp.)
"C:\Program Files\Pinnacle\Studio 14\Programs\RM.exe" = C:\Program Files\Pinnacle\Studio 14\Programs\RM.exe:*:Enabled:Render Manager -- (Pinnacle Systems)
"C:\Program Files\Pinnacle\Studio 14\Programs\Studio.exe" = C:\Program Files\Pinnacle\Studio 14\Programs\Studio.exe:*:Enabled:Studio -- (Pinnacle Systems)
"C:\Program Files\Pinnacle\Studio 14\Programs\umi.exe" = C:\Program Files\Pinnacle\Studio 14\Programs\umi.exe:*:Enabled:umi -- (Pinnacle Systems)
"C:\WINDOWS\system32\PnkBstrA.exe" = C:\WINDOWS\system32\PnkBstrA.exe:*:Enabled:PnkBstrA -- ()
"C:\WINDOWS\system32\PnkBstrB.exe" = C:\WINDOWS\system32\PnkBstrB.exe:*:Enabled:PnkBstrB -- ()
"C:\Program Files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe" = C:\Program Files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:*:Enabled:Call of Duty® 4 - Modern Warfare™ -- ()
"C:\Program Files\America Online 9.0\waol.exe" = C:\Program Files\America Online 9.0\waol.exe:*:Enabled:America Online 9.0 -- File not found
"C:\Program Files\Ubisoft\Crytek\Far Cry\Bin32\FarCry.exe" = C:\Program Files\Ubisoft\Crytek\Far Cry\Bin32\FarCry.exe:*:Enabled:Far Cry -- (Crytek)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{083F79E4-6FE9-46FB-A6C6-4F8862742947}" = ATI HYDRAVISION
"{1451DE6B-ABE1-4F62-BE9A-B363A17588A2}" = QuickTime
"{15377C3E-9655-400F-B441-E69F0A6BEAFE}" = Recovery Software Suite eMachines
"{1E99F5D7-4262-4C7C-9135-F066E7485811}" = System Requirements Lab
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{26A24AE4-039D-4CA4-87B4-2F83216017FF}" = Java™ 6 Update 17
"{316A75E3-039D-4BF4-AC29-3FF91E8555CD}" = Lexmark Fax Solutions
"{32343DB6-9A52-40C9-87E4-5E7C79791C87}" = MSXML 4.0 SP2 and SOAP Toolkit 3.0
"{3248F0A8-6813-11D6-A77B-00B0D0150020}" = J2SE Runtime Environment 5.0 Update 2
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3F262ADC-5AD2-48E5-A586-44315E04A9E2}" = Microsoft Picture It! Library 10
"{3F5B6210-0903-4DC6-8034-8F488AA3A782}" = Spy Sweeper Core
"{3FA365DF-2D68-45ED-8F83-8C8A33E65143}" = Apple Application Support
"{416D80BA-6F6D-4672-B7CF-F54DA2F80B44}" = Microsoft Works
"{42756145-9997-4D28-809B-8756BFD00106}" = Microsoft Picture It! Premium 10
"{4A7FDA4D-F4D7-4A49-934A-066D59A43C7E}" = SmartSound Quicktracks Plugin
"{5DA6F06A-B389-407B-BF8C-1548767914D8}" = ATI Problem Report Wizard
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6DE721A5-5E89-4D74-994C-652BB3C0672E}" = Pinnacle Video Driver
"{79E147E8-2113-4BE0-9AB4-360B85CC3051}" = GameShadow
"{7EF15AAF-42AC-4CF6-B4B4-C4F0D1D92122}" = Far Cry (Patch 1.4)
"{81EED1A1-AE78-4B11-BE47-C6AE9F5E87F1}" = Digital Media Reader
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8DCE550C-CA43-4E82-92DF-FFC4A48F5BE1}" = Napster Burn Engine
"{9862B19F-4CAD-4EED-920F-2F378D84393F}" = ATI Parental Control & Encoder
"{9941F0AA-B903-4AF4-A055-83A9815CC011}" = Sonic Encoders
"{9F7FC79B-3059-4264-9450-39EB368E3225}" = Microsoft Digital Image Library 9 - Blocker
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{AADD1C8F-D59F-4D55-A726-768C71A205A8}" = Pinnacle Studio 14
"{AC76BA86-7AD7-1033-7646-A70000000000}" = Adobe Reader 7.0
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{BBBCAE4B-B416-4182-A6F2-438180894A81}" = Napster
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = CyberLink PowerDirector
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D0A05794-48C2-4424-A15A-9F20FCFDD374}" = Call of Duty® 2
"{D36DD326-7280-11D8-97C8-000129760CBE}" = CyberLink PhotoNow
"{D6DBDC2A-E72C-4284-B6AD-6B3B61B4DABC}" = Far Cry
"{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}" = Ad-Aware
"{E48469CC-635E-4FD5-A122-1497C286D217}" = Call of Duty® 4 - Modern Warfare™
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"{F39A74A0-FAE2-401C-AED1-1C941AA28EA8}" = McAfee AntiSpyware
"{FB08F381-6533-4108-B7DD-039E11FBC27E}" = Realtek AC'97 Audio
"{FF262740-C85A-11D5-BBEC-00D0B740900A}" = Multimedia Keyboard Driver
"Ad-Aware" = Ad-Aware
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"All ATI Software" = ATI - Software Uninstall Utility
"AOL Toolbar" = AOL Toolbar
"AOL YGP Screensaver" = AOL You've Got Pictures Screensaver
"ATI Display Driver" = ATI Display Driver
"BigFix" = BigFix
"CCleaner" = CCleaner
"CNXT_MODEM_PCI_VEN_14F1&DEV_2F20&SUBSYS_200014F1" = SoftV92 Data Fax Modem with SmartCP
"CreataCard Gold 3" = CreataCard Gold 3
"DVD Shrink_is1" = DVD Shrink 3.2
"HijackThis" = HijackThis 2.0.2
"ie8" = Windows Internet Explorer 8
"InstallShield_{316A75E3-039D-4BF4-AC29-3FF91E8555CD}" = Lexmark 7100 Series Fax Solutions
"InstallShield_{4A7FDA4D-F4D7-4A49-934A-066D59A43C7E}" = SmartSound Quicktracks Plugin
"InstallShield_{81EED1A1-AE78-4B11-BE47-C6AE9F5E87F1}" = Digital Media Reader
"InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = CyberLink PowerDirector
"InstallShield_{D0A05794-48C2-4424-A15A-9F20FCFDD374}" = Call of Duty® 2
"InstallShield_{D36DD326-7280-11D8-97C8-000129760CBE}" = CyberLink PhotoNow
"InstallShield_{D6DBDC2A-E72C-4284-B6AD-6B3B61B4DABC}" = Far Cry
"InstallShield_{E48469CC-635E-4FD5-A122-1497C286D217}" = Call of Duty® 4 - Modern Warfare™
"Lexmark 7100 Series" = Lexmark 7100 Series
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Money2005b" = Microsoft Money 2005
"Mozilla Firefox (3.5.7)" = Mozilla Firefox (3.5.7)
"MSC" = McAfee SecurityCenter
"Nero - Burning Rom!UninstallKey" = Nero OEM
"Nero BurnRights!UninstallKey" = Nero BurnRights
"PictureItPrem_v10" = Microsoft Picture It! Premium 10
"RealPlayer 6.0" = RealPlayer Basic
"StreetPlugin" = Learn2 Player (Uninstall Only)
"SystemRequirementsLab" = System Requirements Lab
"ViewpointMediaPlayer" = Viewpoint Media Player
"WIC" = Windows Imaging Component
"Windows XP Service Pack" = Windows XP Service Pack 3

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 1/21/2010 12:22:34 AM | Computer Name = HOME | Source = Application Error | ID = 1000
Description = Faulting application rundll32.exe, version 5.1.2600.5512, faulting
module unknown, version 0.0.0.0, fault address 0x715b9e59.

Error - 1/21/2010 9:29:49 PM | Computer Name = HOME | Source = Media Center Receiver | ID = 4
Description = TV tuner malfunction. (0x8000ffff) ATI TV Wonder Pro Tuner

Error - 1/21/2010 10:54:12 PM | Computer Name = HOME | Source = Media Center Receiver | ID = 4
Description = TV tuner malfunction. (0x8000ffff) ATI TV Wonder Pro Tuner

Error - 1/21/2010 11:06:54 PM | Computer Name = HOME | Source = Application Error | ID = 1000
Description = Faulting application rundll32.exe, version 5.1.2600.5512, faulting
module unknown, version 0.0.0.0, fault address 0x715b9e59.

Error - 1/21/2010 11:17:28 PM | Computer Name = HOME | Source = Application Error | ID = 1000
Description = Faulting application rundll32.exe, version 5.1.2600.5512, faulting
module unknown, version 0.0.0.0, fault address 0x715b9e59.

Error - 1/22/2010 12:56:39 AM | Computer Name = HOME | Source = Media Center Receiver | ID = 4
Description = TV tuner malfunction. (0x8000ffff) ATI TV Wonder Pro Tuner

Error - 1/22/2010 7:46:05 AM | Computer Name = HOME | Source = Media Center Receiver | ID = 4
Description = TV tuner malfunction. (0x8000ffff) ATI TV Wonder Pro Tuner

Error - 1/22/2010 7:54:44 AM | Computer Name = HOME | Source = Application Error | ID = 1000
Description = Faulting application svchost.exe, version 5.1.2600.5512, faulting
module unknown, version 0.0.0.0, fault address 0x02a5f7a0.

Error - 1/22/2010 7:57:44 AM | Computer Name = HOME | Source = Media Center Receiver | ID = 4
Description = TV tuner malfunction. (0x8000ffff) ATI TV Wonder Pro Tuner

Error - 1/22/2010 7:58:27 AM | Computer Name = HOME | Source = Application Error | ID = 1004
Description = Faulting application svchost.exe, version 5.1.2600.5512, faulting
module unknown, version 0.0.0.0, fault address 0x02a5f7a0.

[ System Events ]
Error - 1/24/2010 7:10:39 PM | Computer Name = HOME | Source = Service Control Manager | ID = 7034
Description = The Terminal Services service terminated unexpectedly. It has done
this 1 time(s).

Error - 1/24/2010 7:37:38 PM | Computer Name = HOME | Source = Service Control Manager | ID = 7031
Description = The DCOM Server Process Launcher service terminated unexpectedly.
It has done this 1 time(s). The following corrective action will be taken in 60000
milliseconds: Reboot the machine.

Error - 1/24/2010 7:37:38 PM | Computer Name = HOME | Source = Service Control Manager | ID = 7034
Description = The Terminal Services service terminated unexpectedly. It has done
this 1 time(s).

Error - 1/24/2010 11:03:42 PM | Computer Name = HOME | Source = Service Control Manager | ID = 7031
Description = The DCOM Server Process Launcher service terminated unexpectedly.
It has done this 1 time(s). The following corrective action will be taken in 60000
milliseconds: Reboot the machine.

Error - 1/24/2010 11:03:42 PM | Computer Name = HOME | Source = Service Control Manager | ID = 7034
Description = The Terminal Services service terminated unexpectedly. It has done
this 1 time(s).

Error - 1/24/2010 11:39:13 PM | Computer Name = HOME | Source = Service Control Manager | ID = 7011
Description = Timeout (30000 milliseconds) waiting for a transaction response from
the ehRecvr service.

Error - 1/26/2010 12:28:05 AM | Computer Name = HOME | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the IMAPI CD-Burning COM
Service service to connect.

Error - 1/26/2010 12:28:05 AM | Computer Name = HOME | Source = Service Control Manager | ID = 7000
Description = The IMAPI CD-Burning COM Service service failed to start due to the
following error: %%1053

Error - 1/26/2010 12:31:51 AM | Computer Name = HOME | Source = Service Control Manager | ID = 7031
Description = The DCOM Server Process Launcher service terminated unexpectedly.
It has done this 1 time(s). The following corrective action will be taken in 60000
milliseconds: Reboot the machine.

Error - 1/26/2010 12:31:51 AM | Computer Name = HOME | Source = Service Control Manager | ID = 7034
Description = The Terminal Services service terminated unexpectedly. It has done
this 1 time(s).


< End of report >


#6 Buckeye_Sam

Buckeye_Sam

    Malware Expert


  • Members
  • 17,382 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Pickerington, Ohio
  • Local time:09:16 AM

Posted 26 January 2010 - 08:22 AM

Please download ComboFix from one of these locations:

Link 1
Link 2
Link 3

Important!
You should NOT use Combofix unless you have been instructed to do so by a Malware Removal Expert.
It is intended by its creator to be used under the guidance and supervision of an Malware Removal Expert, not for private use.
Using this tool incorrectly could lead to disastrous problems with your operating system such as preventing it from ever starting again.



Make sure that you save ComboFix.exe to your Desktop
  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools

  • Double click on ComboFix.exe & follow the prompts.

  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.





Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:




Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please copy and paste the contents of C:\ComboFix.txt in your next reply.


Posted Image If I have helped you in any way, please consider a donation to help me continue the fight against malware.


Failing to respond back to the person that is giving up their own time to help you not only is insensitive and disrespectful, but it guarantees that you will never receive help from me again. Please thank your helpers and there will always be help here when you need it!


========================================================

#7 oatmeal2348

oatmeal2348
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:08:16 AM

Posted 26 January 2010 - 08:44 AM

I'm having trouble downloading ComboFix. I tried a couple of times (it was sending it right to my download file) but kept getting an error that the program could not overwrite combofix.exe (even though I can't see it in the folder.)

So I tried to right click and 'save link as ...' and send it directly to my desktop. It looked like it was downloading but said it could not be saved because 'an unknown error occurred. Try saving to a different location.'

I tried different locations ... no luck. I tried renaming it Combo-Fix as i had seen in a different forum, but got the same result.

I'm heading to work and won't be back until after 6pmCT. I look forward to hearing from you.

Thanks for your help!
MikeO

PS. Now when I just try a regular left-click, I get a 'File Not Found' error.

Edited by oatmeal2348, 26 January 2010 - 08:46 AM.


#8 Buckeye_Sam

Buckeye_Sam

    Malware Expert


  • Members
  • 17,382 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Pickerington, Ohio
  • Local time:09:16 AM

Posted 26 January 2010 - 06:20 PM

Let's see what we can get done without Combofix and then we'll come back to it later.


Run OTL.exe
  • Under the Custom Scans/Fixes box at the bottom, paste in the following

    CODE
    :OTL
    O3 - HKLM\..\Toolbar: (no name) - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - No CLSID value found.
    O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (no name) - {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No CLSID value found.
    O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (no name) - {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No CLSID value found.
    O3 - HKU\S-1-5-21-3967926464-2608887106-2790676712-1006\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
    O3 - HKU\S-1-5-21-3967926464-2608887106-2790676712-1006\..\Toolbar\WebBrowser: (no name) - {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No CLSID value found.
    O21 - SSODL: lababaniz - {06e07889-8486-4206-96a8-542a6cefddfd} - CLSID or File not found.
    O22 - SharedTaskScheduler: {06e07889-8486-4206-96a8-542a6cefddfd} - tokatiluy - Reg Error: Key error. File not found
    [2010/01/09 15:32:53 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\26962.exe
    [2010/01/09 15:12:53 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\29358.exe
    [2010/01/09 14:52:52 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\11478.exe
    [2010/01/09 14:32:52 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\15724.exe
    [2010/01/09 14:12:51 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\19169.exe
    [2010/01/09 13:52:51 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\26500.exe
    [2010/01/09 13:32:50 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\6334.exe
    [2010/01/09 13:12:50 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\18467.exe
    [2010/01/02 00:24:27 | 00,000,000 | ---- | C] () -- C:\WINDOWS\Jfafa.bin
    [2010/01/02 00:24:26 | 00,000,120 | ---- | C] () -- C:\WINDOWS\Thofirogodinire.dat

    :Commands
    [purity]
    [emptytemp]
    [Reboot]

  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot when it is done
  • You will get a log that shows the results of the fix. Please post it.
  • Then also run and post a new OTL log.



======================


We need to run this special tool.
  • Download TDSSKiller and save it to your Desktop.
  • Extract its contents to your desktop and make sure TDSSKiller.exe (the contents of the zipped file) is on the Desktop itself, not within a folder on the desktop.
  • Go to Start > Run (Or you can hold down your Windows key and press R) and copy and paste the following into the text field. (make sure you include the quote marks) Then press OK.

    "%userprofile%\Desktop\TDSSKiller.exe" -l TDSSKiller.txt -v

  • If it says "Hidden service detected" DO NOT type anything in. Just press Enter on your keyboard to not do anything to the file.
  • If prompted to reboot, please do so.
  • When it is done, a log file should be created on your C: drive called "TDSSKiller.txt" please copy and paste the contents of that file here.

Posted Image If I have helped you in any way, please consider a donation to help me continue the fight against malware.


Failing to respond back to the person that is giving up their own time to help you not only is insensitive and disrespectful, but it guarantees that you will never receive help from me again. Please thank your helpers and there will always be help here when you need it!


========================================================

#9 oatmeal2348

oatmeal2348
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:08:16 AM

Posted 26 January 2010 - 07:15 PM

I'm running a new OTL scan now.
Here's the 'fix' log results: (the computer is rebooting really fast already.)

All processes killed
========== OTL ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{4982D40A-C53B-4615-B15B-B5B5E98D167C} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4982D40A-C53B-4615-B15B-B5B5E98D167C}\ not found.
Registry value HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7}\ not found.
Registry value HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7}\ not found.
Registry value HKEY_USERS\S-1-5-21-3967926464-2608887106-2790676712-1006\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}\ not found.
Registry value HKEY_USERS\S-1-5-21-3967926464-2608887106-2790676712-1006\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\lababaniz deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{06e07889-8486-4206-96a8-542a6cefddfd}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\\{06e07889-8486-4206-96a8-542a6cefddfd} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{06e07889-8486-4206-96a8-542a6cefddfd}\ not found.
C:\WINDOWS\system32\26962.exe moved successfully.
C:\WINDOWS\system32\29358.exe moved successfully.
C:\WINDOWS\system32\11478.exe moved successfully.
C:\WINDOWS\system32\15724.exe moved successfully.
C:\WINDOWS\system32\19169.exe moved successfully.
C:\WINDOWS\system32\26500.exe moved successfully.
C:\WINDOWS\system32\6334.exe moved successfully.
C:\WINDOWS\system32\18467.exe moved successfully.
C:\WINDOWS\Jfafa.bin moved successfully.
C:\WINDOWS\Thofirogodinire.dat moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 49152 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 49286 bytes

User: LocalService
->Temp folder emptied: 65716 bytes
->Temporary Internet Files folder emptied: 90592 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 1105636 bytes

User: Owner
->Temp folder emptied: 50825475 bytes
->Temporary Internet Files folder emptied: 7062253 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 102198767 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 19569 bytes
%systemroot%\System32 .tmp files removed: 2577 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 17408 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 28584842 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 229869804 bytes
RecycleBin emptied: 12528640 bytes

Total Files Cleaned = 412.00 mb


OTL by OldTimer - Version 3.1.27.0 log created on 01262010_180749

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...


#10 oatmeal2348

oatmeal2348
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:08:16 AM

Posted 26 January 2010 - 07:17 PM

Here's the results of the second OTL scan:

OTL logfile created on: 1/26/2010 6:13:49 PM - Run 2
OTL by OldTimer - Version 3.1.27.0 Folder = C:\Documents and Settings\Owner\Desktop
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 62.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 82.00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 182.10 Gb Total Space | 29.83 Gb Free Space | 16.38% Space Free | Partition Type: NTFS
Drive D: | 465.76 Gb Total Space | 325.68 Gb Free Space | 69.92% Space Free | Partition Type: NTFS
Drive E: | 4.20 Gb Total Space | 0.69 Gb Free Space | 16.35% Space Free | Partition Type: FAT32
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: HOME
Current User Name: Owner
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Processes (SafeList) ==========

PRC - [2010/01/25 22:33:32 | 00,548,352 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Owner\Desktop\OTL.exe
PRC - [2010/01/07 06:49:32 | 00,908,248 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2009/12/20 01:27:17 | 00,788,880 | ---- | M] (Lavasoft) -- C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
PRC - [2009/12/20 01:27:16 | 01,181,328 | ---- | M] (Lavasoft) -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
PRC - [2009/11/17 22:09:56 | 00,103,736 | ---- | M] () -- C:\WINDOWS\system32\PnkBstrB.exe
PRC - [2009/11/17 22:09:47 | 00,066,872 | ---- | M] () -- C:\WINDOWS\system32\PnkBstrA.exe
PRC - [2009/11/13 08:19:10 | 00,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe
PRC - [2009/11/12 21:47:28 | 00,172,032 | ---- | M] (New Boundary Technologies, Inc.) -- C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
PRC - [2009/11/10 23:08:18 | 00,417,792 | ---- | M] (Apple Inc.) -- C:\Program Files\QuickTime\QTTask.exe
PRC - [2009/11/06 12:00:22 | 04,048,240 | ---- | M] (Webroot Software, Inc. (www.webroot.com)) -- C:\Program Files\Webroot\WebrootSecurity\SpySweeper.exe
PRC - [2009/10/29 06:54:44 | 01,218,008 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee.com\Agent\mcagent.exe
PRC - [2009/10/27 11:19:46 | 00,895,696 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\MPF\MpfSrv.exe
PRC - [2009/09/17 14:29:04 | 00,865,832 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\MSC\mcmscsvc.exe
PRC - [2009/09/16 10:22:08 | 00,144,704 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\VirusScan\Mcshield.exe
PRC - [2009/09/16 09:28:38 | 00,606,736 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\VirusScan\mcsysmon.exe
PRC - [2009/07/08 11:54:34 | 00,359,952 | ---- | M] (McAfee, Inc.) -- c:\Program Files\Common Files\McAfee\McProxy\McProxy.exe
PRC - [2009/07/07 19:10:02 | 02,482,848 | ---- | M] (McAfee, Inc.) -- c:\Program Files\Common Files\McAfee\MNA\McNASvc.exe
PRC - [2009/03/05 16:07:20 | 02,260,480 | RHS- | M] (Safer-Networking Ltd.) -- C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
PRC - [2008/04/13 18:12:19 | 01,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2008/04/07 21:45:10 | 00,241,734 | R--- | M] () -- C:\Program Files\CyberLink\Shared files\RichVideo.exe
PRC - [2007/02/20 11:07:40 | 00,199,752 | ---- | M] (Pinnacle Systems GmbH) -- C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe
PRC - [2006/01/24 21:45:24 | 00,405,504 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\system32\ati2evxx.exe
PRC - [2005/01/18 03:43:04 | 00,196,608 | ---- | M] (Lexmark International, Inc.) -- C:\Program Files\Lexmark 7100 Series\lxbxmon.exE
PRC - [2005/01/06 11:41:22 | 00,462,848 | ---- | M] (Lexmark International, Inc.) -- C:\WINDOWS\system32\lxbxcoms.exe
PRC - [2004/11/15 17:04:32 | 00,135,168 | ---- | M] (Alcor Micro, Corp.) -- C:\Program Files\Digital Media Reader\shwiconEM.exe
PRC - [2004/09/17 07:24:02 | 00,061,440 | ---- | M] () -- C:\Program Files\Lexmark 7100 Series\ezprint.exe
PRC - [2004/08/10 13:00:00 | 00,016,896 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wbem\unsecapp.exe
PRC - [2004/05/17 20:30:04 | 00,543,232 | ---- | M] () -- C:\WINDOWS\zHotkey.exe


========== Modules (SafeList) ==========

MOD - [2010/01/25 22:33:32 | 00,548,352 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Owner\Desktop\OTL.exe


========== Win32 Services (SafeList) ==========

SRV - [2009/12/20 01:27:16 | 01,181,328 | ---- | M] (Lavasoft) [Auto | Running] -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe -- (Lavasoft Ad-Aware Service)
SRV - [2009/11/17 22:09:56 | 00,103,736 | ---- | M] () [Auto | Running] -- C:\WINDOWS\system32\PnkBstrB.exe -- (PnkBstrB)
SRV - [2009/11/17 22:09:47 | 00,066,872 | ---- | M] () [Auto | Running] -- C:\WINDOWS\system32\PnkBstrA.exe -- (PnkBstrA)
SRV - [2009/11/13 08:19:10 | 00,153,376 | ---- | M] (Sun Microsystems, Inc.) [Auto | Running] -- C:\Program Files\Java\jre6\bin\jqs.exe -- (JavaQuickStarterService)
SRV - [2009/11/12 21:47:28 | 00,172,032 | ---- | M] (New Boundary Technologies, Inc.) [Auto | Running] -- C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS -- (PrismXL)
SRV - [2009/11/06 12:00:22 | 04,048,240 | ---- | M] (Webroot Software, Inc. (www.webroot.com)) [Auto | Running] -- C:\Program Files\Webroot\WebrootSecurity\SpySweeper.exe -- (WebrootSpySweeperService)
SRV - [2009/10/27 11:19:46 | 00,895,696 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\McAfee\MPF\MPFSrv.exe -- (MpfService)
SRV - [2009/09/17 14:29:04 | 00,865,832 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\McAfee\MSC\mcmscsvc.exe -- (mcmscsvc)
SRV - [2009/09/16 11:23:32 | 00,365,072 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files\McAfee\VirusScan\mcods.exe -- (McODS)
SRV - [2009/09/16 10:22:08 | 00,144,704 | ---- | M] (McAfee, Inc.) [Unknown | Running] -- C:\Program Files\McAfee\VirusScan\Mcshield.exe -- (McShield)
SRV - [2009/09/16 09:28:38 | 00,606,736 | ---- | M] (McAfee, Inc.) [On_Demand | Running] -- C:\Program Files\McAfee\VirusScan\mcsysmon.exe -- (McSysmon)
SRV - [2009/07/08 20:22:22 | 00,068,112 | ---- | M] (McAfee) [On_Demand | Stopped] -- C:\Program Files\McAfee\MBK\MBackMonitor.exe -- (MBackMonitor)
SRV - [2009/07/08 11:54:34 | 00,359,952 | ---- | M] (McAfee, Inc.) [Auto | Running] -- c:\Program Files\Common Files\McAfee\McProxy\McProxy.exe -- (McProxy)
SRV - [2009/07/07 19:10:02 | 02,482,848 | ---- | M] (McAfee, Inc.) [Auto | Running] -- c:\Program Files\Common Files\McAfee\MNA\McNASvc.exe -- (McNASvc)
SRV - [2008/04/07 21:45:10 | 00,241,734 | R--- | M] () [Auto | Running] -- C:\Program Files\CyberLink\Shared files\RichVideo.exe -- (RichVideo) Cyberlink RichVideo Service(CRVS)
SRV - [2006/01/26 08:57:00 | 00,520,192 | ---- | M] () [Auto | Stopped] -- C:\WINDOWS\system32\ati2sgag.exe -- (ATI Smart)
SRV - [2006/01/24 21:45:24 | 00,405,504 | ---- | M] (ATI Technologies Inc.) [Auto | Running] -- C:\WINDOWS\system32\ati2evxx.exe -- (Ati HotKey Poller)
SRV - [2005/04/04 00:41:10 | 00,069,632 | ---- | M] (Macrovision Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe -- (IDriverT)
SRV - [2005/01/06 11:41:22 | 00,462,848 | ---- | M] (Lexmark International, Inc.) [On_Demand | Running] -- C:\WINDOWS\System32\lxbxcoms.exe -- (lxbx_device)


========== Driver Services (SafeList) ==========

DRV - [2009/11/12 22:02:47 | 00,008,552 | ---- | M] (Windows ® 2000 DDK provider) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\asctrm.sys -- (ASCTRM)
DRV - [2009/11/06 12:00:36 | 00,176,752 | ---- | M] (Webroot Software, Inc. (www.webroot.com)) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\ssidrv.sys -- (ssidrv)
DRV - [2009/11/06 12:00:36 | 00,023,152 | ---- | M] (Webroot Software, Inc. (www.webroot.com)) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\sshrmd.sys -- (sshrmd)
DRV - [2009/11/06 12:00:34 | 00,029,808 | ---- | M] (Webroot Software, Inc. (www.webroot.com)) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\ssfs0bbc.sys -- (ssfs0bbc)
DRV - [2009/09/16 10:22:48 | 00,214,664 | ---- | M] (McAfee, Inc.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\mfehidk.sys -- (mfehidk)
DRV - [2009/09/16 10:22:48 | 00,079,816 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mfeavfk.sys -- (mfeavfk)
DRV - [2009/09/16 10:22:48 | 00,040,552 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mfesmfk.sys -- (mfesmfk)
DRV - [2009/09/16 10:22:48 | 00,035,272 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mfebopk.sys -- (mfebopk)
DRV - [2009/09/16 10:22:14 | 00,034,248 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mferkdk.sys -- (mferkdk)
DRV - [2009/07/16 12:32:26 | 00,120,136 | ---- | M] (McAfee, Inc.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\Mpfp.sys -- (MPFP)
DRV - [2008/04/13 12:46:20 | 00,048,128 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\61883.sys -- (61883)
DRV - [2008/04/13 12:46:20 | 00,038,912 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\avc.sys -- (Avc)
DRV - [2008/04/13 12:46:08 | 00,049,024 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mstape.sys -- (MSTAPE)
DRV - [2008/04/13 12:46:08 | 00,013,696 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\avcstrm.sys -- (AVCSTRM)
DRV - [2008/04/13 12:40:58 | 00,008,192 | ---- | M] (Microsoft Corporation) [Kernel | System | Stopped] -- C:\WINDOWS\system32\drivers\changer.sys -- (Changer)
DRV - [2008/04/13 12:36:39 | 00,043,008 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\amdagp.sys -- (amdagp)
DRV - [2008/04/13 12:36:39 | 00,040,960 | ---- | M] (Silicon Integrated Systems Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\sisagp.sys -- (sisagp)
DRV - [2007/11/13 04:25:53 | 00,020,480 | ---- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\secdrv.sys -- (Secdrv)
DRV - [2006/01/24 21:52:31 | 01,478,656 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2005/09/23 22:18:32 | 00,171,520 | ---- | M] (Pinnacle Systems GmbH) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\MarvinBus.sys -- (MarvinBus)
DRV - [2005/03/30 11:22:38 | 00,009,088 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\aticxxbr.sys -- (ATICXXBR)
DRV - [2005/03/30 11:22:36 | 00,173,824 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\aticxcap.sys -- (ATICXCAP)
DRV - [2005/03/30 11:22:36 | 00,029,184 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\aticxtun.sys -- (ATICXTUN) ATI TV Wonder Pro Tuner (Philips 1236 MK3)
DRV - [2004/12/01 23:40:08 | 02,300,928 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS -- (ALCXWDM) Service for Realtek AC97 Audio (WDM)
DRV - [2004/11/15 19:41:54 | 00,036,804 | ---- | M] (Alcor Micro Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Sunkfilt.sys -- (SunkFilt)
DRV - [2004/11/10 19:30:18 | 00,024,832 | ---- | M] (Roxio) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\cdralw2k.sys -- (Cdralw2k)
DRV - [2004/11/10 19:27:34 | 00,044,288 | ---- | M] (Roxio) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\cdr4_xp.sys -- (Cdr4_xp)
DRV - [2004/08/10 13:00:00 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ptilink.sys -- (Ptilink)
DRV - [2004/08/10 11:39:56 | 00,019,840 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\PxHelp20.sys -- (PxHelp20)
DRV - [2004/08/03 23:29:56 | 01,897,408 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv)
DRV - [2004/06/17 16:56:22 | 00,220,032 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSFHWBS2.sys -- (HSFHWBS2)
DRV - [2004/06/17 16:55:38 | 00,685,056 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf)
DRV - [2004/06/17 16:55:04 | 01,041,536 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_DP.sys -- (HSF_DP)
DRV - [2004/04/13 22:14:12 | 00,070,144 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtlnicxp.sys -- (RTL8023xp)
DRV - [2004/03/17 13:04:14 | 00,013,059 | ---- | M] (Conexant) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\mdmxsdk.sys -- (mdmxsdk)
DRV - [2001/08/17 22:07:44 | 00,019,072 | ---- | M] (Adaptec, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\sparrow.sys -- (Sparrow)
DRV - [2001/08/17 22:07:42 | 00,030,688 | ---- | M] (LSI Logic) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\sym_u3.sys -- (sym_u3)
DRV - [2001/08/17 22:07:40 | 00,028,384 | ---- | M] (LSI Logic) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\sym_hi.sys -- (sym_hi)
DRV - [2001/08/17 22:07:36 | 00,032,640 | ---- | M] (LSI Logic) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\symc8xx.sys -- (symc8xx)
DRV - [2001/08/17 22:07:34 | 00,016,256 | ---- | M] (Symbios Logic Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\symc810.sys -- (symc810)
DRV - [2001/08/17 21:52:22 | 00,036,736 | ---- | M] (Promise Technology, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\ultra.sys -- (ultra)
DRV - [2001/08/17 21:52:20 | 00,045,312 | ---- | M] (QLogic Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\ql12160.sys -- (ql12160)
DRV - [2001/08/17 21:52:20 | 00,040,320 | ---- | M] (QLogic Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\ql1080.sys -- (ql1080)
DRV - [2001/08/17 21:52:18 | 00,049,024 | ---- | M] (QLogic Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\ql1280.sys -- (ql1280)
DRV - [2001/08/17 21:52:16 | 00,179,584 | ---- | M] (Mylex Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\dac2w2k.sys -- (dac2w2k)
DRV - [2001/08/17 21:52:12 | 00,017,280 | ---- | M] (American Megatrends Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\mraid35x.sys -- (mraid35x)
DRV - [2001/08/17 21:52:00 | 00,026,496 | ---- | M] (Advanced System Products, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\asc.sys -- (asc)
DRV - [2001/08/17 21:51:58 | 00,014,848 | ---- | M] (Advanced System Products, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\asc3550.sys -- (asc3550)
DRV - [2001/08/17 21:51:56 | 00,005,248 | ---- | M] (Acer Laboratories Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\aliide.sys -- (AliIde)
DRV - [2001/08/17 21:51:54 | 00,006,656 | ---- | M] (CMD Technology, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\cmdide.sys -- (CmdIde)
DRV - [2001/08/17 14:49:32 | 00,019,968 | ---- | M] (Macronix International Co., Ltd. ) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mxnic.sys -- (mxnic)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie


IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKU\.DEFAULT\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKU\S-1-5-18\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-3967926464-2608887106-2790676712-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.emachines.com/
IE - HKU\S-1-5-21-3967926464-2608887106-2790676712-1006\S-1-5-21-3967926464-2608887106-2790676712-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://m.www.yahoo.com/"
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: OberonGameHost@OberonGames.com:1.0.5.1344
FF - prefs.js..extensions.enabledItems: {CB2E7386-AF9F-4055-9497-688B16170F39}:1.9.1

FF - HKLM\software\mozilla\Firefox\extensions\\{DA2E8CDE-D256-4AAB-8E40-C6162166DA75}: C:\Documents and Settings\Owner\Local Settings\Application Data\{DA2E8CDE-D256-4AAB-8E40-C6162166DA75}\ [2010/01/02 00:24:22 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\extensions\\{CB2E7386-AF9F-4055-9497-688B16170F39}: C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\{CB2E7386-AF9F-4055-9497-688B16170F39}\ [2010/01/03 18:36:53 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\extensions\\{188BEA00-1742-4A64-BA60-6ECA4F6F7FEA}: C:\Documents and Settings\Owner\Local Settings\Application Data\{188BEA00-1742-4A64-BA60-6ECA4F6F7FEA}\ [2010/01/04 19:26:14 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\extensions\\{FA568719-2949-4A7A-B98E-D50BF89CE949}: C:\Documents and Settings\Owner\Local Settings\Application Data\{FA568719-2949-4A7A-B98E-D50BF89CE949}\ [2010/01/05 07:53:45 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\extensions\\{2CF8BFD5-40E8-4616-854F-E5EBC37F190B}: C:\Documents and Settings\Owner\Local Settings\Application Data\{2CF8BFD5-40E8-4616-854F-E5EBC37F190B}\ [2010/01/09 12:42:53 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\extensions\\{AE8248A7-FC41-4253-9D44-3E5A5EF92690}: C:\Documents and Settings\Owner\Local Settings\Application Data\{AE8248A7-FC41-4253-9D44-3E5A5EF92690}\ [2010/01/09 18:55:49 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\extensions\\{0461C247-BF31-46C0-9CCC-347849BEE6E6}: C:\Documents and Settings\Owner\Local Settings\Application Data\{0461C247-BF31-46C0-9CCC-347849BEE6E6}\ [2010/01/16 19:37:21 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\extensions\\{445D22E3-14E7-4BC6-815C-518660622C88}: C:\Documents and Settings\Owner\Local Settings\Application Data\{445D22E3-14E7-4BC6-815C-518660622C88}\ [2010/01/18 20:58:50 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\extensions\\{226C2AEF-DAB4-4F21-9711-23F067040145}: C:\Documents and Settings\Owner\Local Settings\Application Data\{226C2AEF-DAB4-4F21-9711-23F067040145}\ [2010/01/22 05:47:01 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\extensions\\{2BE7BAD2-4747-461F-9870-1513CCC3BF86}: C:\Documents and Settings\Owner\Local Settings\Application Data\{2BE7BAD2-4747-461F-9870-1513CCC3BF86}\ [2010/01/22 05:58:26 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.7\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/01/07 06:49:41 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.7\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/01/07 06:49:41 | 00,000,000 | ---D | M]

[2009/11/14 02:23:58 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Mozilla\Extensions
[2010/01/25 22:42:18 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\15zauzuh.default\extensions
[2009/12/07 22:44:26 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\15zauzuh.default\extensions\OberonGameHost@OberonGames.com
[2009/11/14 02:23:28 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions

O1 HOSTS File: ([2010/01/16 01:02:43 | 00,000,769 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 193.169.12.8 nosd.info
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll (McAfee, Inc.)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O3 - HKLM\..\Toolbar: (&Google) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O3 - HKU\S-1-5-21-3967926464-2608887106-2790676712-1006\..\Toolbar\WebBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [CHotkey] C:\WINDOWS\zHotkey.exe ()
O4 - HKLM..\Run: [EzPrint] C:\Program Files\Lexmark 7100 Series\ezprint.exe ()
O4 - HKLM..\Run: [FaxCenterServer4_in_1] C:\Program Files\Lexmark 7100 Series\fm3032.exe ()
O4 - HKLM..\Run: [LXBXCATS] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXBXtime.DLL ()
O4 - HKLM..\Run: [lxbxmon.exe] C:\Program Files\Lexmark 7100 Series\lxbxmon.exe (Lexmark International, Inc.)
O4 - HKLM..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\qttask.exe (Apple Inc.)
O4 - HKLM..\Run: [Recguard] C:\WINDOWS\SMINST\Recguard.exe ()
O4 - HKLM..\Run: [ShowWnd] C:\WINDOWS\ShowWnd.exe ()
O4 - HKLM..\Run: [SunKistEM] C:\Program Files\Digital Media Reader\shwiconEM.exe (Alcor Micro, Corp.)
O4 - HKLM..\Run: [USBToolTip] C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe (Pinnacle Systems GmbH)
O4 - HKU\S-1-5-21-3967926464-2608887106-2790676712-1006..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Main present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme ()
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: CDRAutoRun = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: CDRAutoRun = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-3967926464-2608887106-2790676712-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra Button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - Reg Error: Key error. File not found
O9 - Extra 'Tools' menuitem : AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - Reg Error: Value error. File not found
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {40F576AD-8680-4F9E-9490-99D069CD665F} http://srtest-cdn.systemrequirementslab.co...eqlabdetect.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-...indows-i586.cab (Java Plug-in 1.5.0_02)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_17)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop WallPaper: C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005/04/13 11:20:25 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2004/09/13 12:15:24 | 00,000,053 | -HS- | M] () - E:\Autorun.inf -- [ FAT32 ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (lsdelete) - C:\WINDOWS\System32\lsdelete.exe ()
O35 - comfile [open] -- "%1" %*
O35 - exefile [open] -- "%1" %*
O36 - AppCertDlls: diskrcp - (C:\WINDOWS\system32\attrhost.dll) - C:\WINDOWS\System32\attrhost.dll File not found

========== Files/Folders - Created Within 30 Days ==========

[2010/01/26 18:07:49 | 00,000,000 | ---D | C] -- C:\_OTL
[2010/01/25 22:33:28 | 00,548,352 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Owner\Desktop\OTL.exe
[2010/01/24 17:41:01 | 00,472,064 | ---- | C] ( ) -- C:\Documents and Settings\Owner\Desktop\RootRepeal.exe
[2010/01/23 21:16:21 | 00,000,000 | -HSD | C] -- C:\Config.Msi
[2010/01/23 12:20:36 | 00,000,000 | RH-D | C] -- C:\Documents and Settings\Owner\Recent
[2010/01/22 05:58:25 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Local Settings\Application Data\{2BE7BAD2-4747-461F-9870-1513CCC3BF86}
[2010/01/22 05:47:01 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Local Settings\Application Data\{226C2AEF-DAB4-4F21-9711-23F067040145}
[2010/01/18 20:58:50 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Local Settings\Application Data\{445D22E3-14E7-4BC6-815C-518660622C88}
[2010/01/16 19:37:20 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Local Settings\Application Data\{0461C247-BF31-46C0-9CCC-347849BEE6E6}
[2010/01/12 22:34:03 | 00,471,552 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\aclayers.dll
[2010/01/10 01:01:58 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Desktop\AOL Saved PFC
[2010/01/09 19:04:40 | 00,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/01/09 19:04:38 | 00,019,160 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010/01/09 19:03:31 | 05,115,824 | ---- | C] (Malwarebytes Corporation ) -- C:\Documents and Settings\Owner\Desktop\mbam-setup.exe
[2010/01/09 18:55:49 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Local Settings\Application Data\{AE8248A7-FC41-4253-9D44-3E5A5EF92690}
[2010/01/09 18:36:27 | 00,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010/01/09 13:58:40 | 00,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2010/01/09 13:58:40 | 00,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Application Data\Adobe
[2010/01/09 12:42:53 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Local Settings\Application Data\{2CF8BFD5-40E8-4616-854F-E5EBC37F190B}
[2010/01/09 12:01:23 | 00,008,192 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\changer.sys
[2010/01/09 12:01:23 | 00,008,192 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\changer.sys
[2010/01/07 06:48:21 | 00,048,128 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\61883.sys
[2010/01/05 07:53:45 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Local Settings\Application Data\{FA568719-2949-4A7A-B98E-D50BF89CE949}
[2010/01/04 19:26:13 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Local Settings\Application Data\{188BEA00-1742-4A64-BA60-6ECA4F6F7FEA}
[2010/01/02 00:24:22 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Local Settings\Application Data\{DA2E8CDE-D256-4AAB-8E40-C6162166DA75}
[2009/12/21 07:18:02 | 00,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Apple
[2009/11/15 10:50:09 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[2009/11/13 22:36:29 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\CyberLink
[2005/04/13 11:26:13 | 00,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Application Data\Microsoft
[2005/04/13 11:26:12 | 00,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2005/04/13 11:26:11 | 00,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft

========== Files - Modified Within 30 Days ==========

[2010/01/26 18:13:06 | 00,000,472 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2010/01/26 18:13:06 | 00,000,472 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Daily 4).job
[2010/01/26 18:13:05 | 00,000,472 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Daily 3).job
[2010/01/26 18:13:05 | 00,000,472 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Daily 2).job
[2010/01/26 18:13:04 | 00,000,472 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Daily 1).job
[2010/01/26 18:11:41 | 00,017,153 | ---- | M] () -- C:\WINDOWS\System32\Config.MPF
[2010/01/26 18:10:09 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010/01/26 18:10:04 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/01/26 18:10:01 | 21,459,64032 | -HS- | M] () -- C:\hiberfil.sys
[2010/01/26 18:08:34 | 03,670,016 | -H-- | M] () -- C:\Documents and Settings\Owner\NTUSER.DAT
[2010/01/26 18:08:34 | 00,000,178 | -HS- | M] () -- C:\Documents and Settings\Owner\ntuser.ini
[2010/01/25 22:33:32 | 00,548,352 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Owner\Desktop\OTL.exe
[2010/01/25 22:26:05 | 00,001,170 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/01/24 17:41:57 | 00,000,000 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\settings.dat
[2010/01/24 17:40:58 | 00,472,064 | ---- | M] ( ) -- C:\Documents and Settings\Owner\Desktop\RootRepeal.exe
[2010/01/24 17:34:48 | 00,524,288 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\dds.scr
[2010/01/24 16:17:12 | 00,422,224 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010/01/24 16:15:11 | 00,000,094 | ---- | M] () -- C:\WINDOWS\wininit.ini
[2010/01/23 22:24:20 | 00,149,136 | ---- | M] () -- C:\Documents and Settings\Owner\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2010/01/18 07:18:03 | 00,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/01/17 10:03:06 | 00,000,349 | ---- | M] () -- C:\Documents and Settings\All Users\Documents\PCLECHAL.INI
[2010/01/16 12:45:21 | 00,038,912 | ---- | M] () -- C:\Documents and Settings\Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/01/15 18:37:31 | 00,001,688 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\CyberLink PowerDirector.lnk
[2010/01/15 07:26:02 | 13,238,272 | ---- | M] () -- C:\Documents and Settings\Owner\My Documents\mike money.mny
[2010/01/15 07:25:56 | 16,458,030 | R--- | M] () -- C:\Documents and Settings\Owner\My Documents\mike money Backup 0.mbf
[2010/01/14 12:34:40 | 00,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010/01/14 12:34:29 | 00,007,030 | ---- | M] () -- C:\WINDOWS\System32\qlwvvi
[2010/01/12 22:44:01 | 07,453,408 | -H-- | M] () -- C:\Documents and Settings\Owner\Local Settings\Application Data\IconCache.db
[2010/01/10 01:02:24 | 00,000,486 | ---- | M] () -- C:\WINDOWS\win.ini
[2010/01/10 01:01:58 | 00,000,002 | ---- | M] () -- C:\WINDOWS\msoffice.ini
[2010/01/09 19:20:22 | 00,000,725 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/01/09 19:03:35 | 05,115,824 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\Owner\Desktop\mbam-setup.exe
[2010/01/09 13:07:40 | 00,000,049 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2010/01/09 13:00:50 | 00,111,754 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\JAN_coupon_BOGO.pdf
[2010/01/07 16:07:14 | 00,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/01/07 16:07:04 | 00,019,160 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010/01/05 06:43:55 | 00,487,119 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\pinnacle rebate form.pdf
[2010/01/03 18:30:42 | 00,000,001 | ---- | M] () -- C:\s
[2010/01/01 19:41:51 | 00,001,868 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\PowerDirector.lnk
[2010/01/01 01:00:15 | 00,000,318 | ---- | M] () -- C:\WINDOWS\tasks\McQcTask.job
[2009/12/30 06:54:09 | 00,001,548 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\CCleaner.lnk
[2009/12/28 14:20:52 | 00,051,200 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\AMAZON BOOKS.xlr
[2009/12/28 14:20:52 | 00,000,286 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\wklnhst.dat

========== Files Created - No Company Name ==========

[2010/01/24 17:41:57 | 00,000,000 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\settings.dat
[2010/01/24 17:34:51 | 00,524,288 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\dds.scr
[2010/01/24 16:15:11 | 00,000,094 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2010/01/14 12:34:29 | 00,007,030 | ---- | C] () -- C:\WINDOWS\System32\qlwvvi
[2010/01/10 01:01:58 | 00,000,002 | ---- | C] () -- C:\WINDOWS\msoffice.ini
[2010/01/09 19:04:43 | 00,000,725 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/01/09 13:00:50 | 00,111,754 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\JAN_coupon_BOGO.pdf
[2010/01/05 06:43:54 | 00,487,119 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\pinnacle rebate form.pdf
[2010/01/04 07:55:14 | 21,459,64032 | -HS- | C] () -- C:\hiberfil.sys
[2010/01/03 18:59:44 | 00,015,880 | ---- | C] () -- C:\WINDOWS\System32\lsdelete.exe
[2010/01/03 18:30:42 | 00,000,001 | ---- | C] () -- C:\s
[2009/11/23 20:25:00 | 00,001,157 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\__FileUploader.log
[2009/11/21 17:27:36 | 00,070,656 | ---- | C] () -- C:\WINDOWS\System32\simple.dll
[2009/11/21 17:27:35 | 00,306,688 | ---- | C] () -- C:\WINDOWS\System32\LFFPX7.DLL
[2009/11/21 17:27:35 | 00,302,592 | ---- | C] () -- C:\WINDOWS\System32\pgp.dll
[2009/11/21 17:27:35 | 00,095,232 | ---- | C] () -- C:\WINDOWS\System32\LFKODAK.DLL
[2009/11/21 17:27:35 | 00,093,184 | ---- | C] () -- C:\WINDOWS\System32\keydb.dll
[2009/11/21 17:27:35 | 00,065,024 | ---- | C] () -- C:\WINDOWS\System32\bn.dll
[2009/11/17 22:10:06 | 00,022,328 | ---- | C] () -- C:\WINDOWS\System32\drivers\PnkBstrK.sys
[2009/11/17 22:10:06 | 00,022,328 | ---- | C] () -- C:\Documents and Settings\Owner\Application Data\PnkBstrK.sys
[2009/11/17 22:09:44 | 00,000,287 | ---- | C] () -- C:\WINDOWS\game.ini
[2009/11/16 08:31:58 | 00,000,286 | ---- | C] () -- C:\Documents and Settings\Owner\Application Data\wklnhst.dat
[2009/11/15 18:37:19 | 00,032,768 | ---- | C] () -- C:\WINDOWS\System32\LXBXPMON.DLL
[2009/11/15 18:37:19 | 00,020,480 | ---- | C] () -- C:\WINDOWS\System32\LXBXFXPU.DLL
[2009/11/15 01:53:54 | 00,821,208 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2009/11/13 09:32:18 | 00,000,049 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2009/11/13 09:28:10 | 00,000,128 | ---- | C] () -- C:\Documents and Settings\Owner\Local Settings\Application Data\fusioncache.dat
[2009/11/12 22:37:52 | 00,038,912 | ---- | C] () -- C:\Documents and Settings\Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/11/12 22:15:13 | 00,156,672 | ---- | C] () -- C:\WINDOWS\System32\RTLCPAPI.dll
[2009/11/12 22:09:49 | 00,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2009/11/12 21:49:31 | 00,532,544 | ---- | C] () -- C:\WINDOWS\PIC.dll
[2009/11/12 21:49:31 | 00,024,576 | ---- | C] () -- C:\WINDOWS\HKNTDLL.dll
[2005/04/13 13:02:03 | 00,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2005/04/13 10:57:05 | 00,001,436 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2005/04/13 10:57:05 | 00,000,495 | ---- | C] () -- C:\WINDOWS\System32\emver.ini
[2003/09/29 09:27:12 | 00,040,960 | ---- | C] () -- C:\WINDOWS\System32\lxbxvs.dll

========== Alternate Data Streams ==========

@Alternate Data Stream - 145 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:68C4BECC
< End of report >


#11 oatmeal2348

oatmeal2348
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:08:16 AM

Posted 26 January 2010 - 07:25 PM

And finally here's the TDSSKiller results:

18:20:50:140 3784 TDSS rootkit removing tool 2.2.2 Jan 13 2010 08:42:25
18:20:50:140 3784 ================================================================================
18:20:50:140 3784 SystemInfo:

18:20:50:140 3784 OS Version: 5.1.2600 ServicePack: 3.0
18:20:50:140 3784 Product type: Workstation
18:20:50:140 3784 ComputerName: HOME
18:20:50:140 3784 UserName: Owner
18:20:50:140 3784 Windows directory: C:\WINDOWS
18:20:50:140 3784 Processor architecture: Intel x86
18:20:50:140 3784 Number of processors: 1
18:20:50:140 3784 Page size: 0x1000
18:20:50:140 3784 Boot type: Normal boot
18:20:50:140 3784 ================================================================================
18:20:50:156 3784 UnloadDriverW: NtUnloadDriver error 2
18:20:50:156 3784 ForceUnloadDriverW: UnloadDriverW(klmd21) error 2
18:20:50:156 3784 MyNtCreateFileW: NtCreateFile(\??\C:\WINDOWS\system32\drivers\klmd.sys) returned status 00000000
18:20:50:234 3784 UtilityInit: KLMD drop and load success
18:20:50:234 3784 KLMD_OpenDevice: Trying to open KLMD Device(KLMD201000)
18:20:50:234 3784 UtilityInit: KLMD open success
18:20:50:234 3784 UtilityInit: Initialize success
18:20:50:234 3784
18:20:50:234 3784 Scanning Services ...
18:20:50:234 3784 CreateRegParser: Registry parser init started
18:20:50:234 3784 DisableWow64Redirection: GetProcAddress(Wow64DisableWow64FsRedirection) error 127
18:20:50:234 3784 CreateRegParser: DisableWow64Redirection error
18:20:50:234 3784 wfopen_ex: Trying to open file C:\WINDOWS\system32\config\system
18:20:50:234 3784 MyNtCreateFileW: NtCreateFile(\??\C:\WINDOWS\system32\config\system) returned status C0000043
18:20:50:234 3784 wfopen_ex: MyNtCreateFileW error 32 (C0000043)
18:20:50:234 3784 wfopen_ex: Trying to KLMD file open
18:20:50:234 3784 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\config\system
18:20:50:234 3784 wfopen_ex: File opened ok (Flags 2)
18:20:50:234 3784 CreateRegParser: HIVE_ADAPTER(C:\WINDOWS\system32\config\system) init success: 274928
18:20:50:234 3784 wfopen_ex: Trying to open file C:\WINDOWS\system32\config\software
18:20:50:234 3784 MyNtCreateFileW: NtCreateFile(\??\C:\WINDOWS\system32\config\software) returned status C0000043
18:20:50:234 3784 wfopen_ex: MyNtCreateFileW error 32 (C0000043)
18:20:50:234 3784 wfopen_ex: Trying to KLMD file open
18:20:50:234 3784 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\config\software
18:20:50:234 3784 wfopen_ex: File opened ok (Flags 2)
18:20:50:234 3784 CreateRegParser: HIVE_ADAPTER(C:\WINDOWS\system32\config\software) init success: 2749D0
18:20:50:234 3784 EnableWow64Redirection: GetProcAddress(Wow64RevertWow64FsRedirection) error 127
18:20:50:234 3784 CreateRegParser: EnableWow64Redirection error
18:20:50:234 3784 CreateRegParser: RegParser init completed
18:20:50:609 3784 GetAdvancedServicesInfo: Raw services enum returned 366 services
18:20:50:609 3784 fclose_ex: Trying to close file C:\WINDOWS\system32\config\system
18:20:50:609 3784 fclose_ex: Trying to close file C:\WINDOWS\system32\config\software
18:20:50:609 3784
18:20:50:609 3784 Scanning Kernel memory ...
18:20:50:609 3784 KLMD_GetSystemObjectAddressByNameW: Trying to get system object address by name \Driver\Disk
18:20:50:609 3784 DetectCureTDL3: \Driver\Disk PDRIVER_OBJECT: 8A5C5C08
18:20:50:609 3784 DetectCureTDL3: KLMD_GetDeviceObjectList returned 13 DevObjects
18:20:50:609 3784
18:20:50:609 3784 DetectCureTDL3: DEVICE_OBJECT: 89B26C68
18:20:50:609 3784 KLMD_GetLowerDeviceObject: Trying to get lower device object for 89B26C68
18:20:50:609 3784 KLMD_ReadMem: Trying to ReadMemory 0x89B26C68[0x38]
18:20:50:609 3784 DetectCureTDL3: DRIVER_OBJECT: 8A5C5C08
18:20:50:609 3784 KLMD_ReadMem: Trying to ReadMemory 0x8A5C5C08[0xA8]
18:20:50:609 3784 KLMD_ReadMem: Trying to ReadMemory 0xE18714B0[0x18]
18:20:50:609 3784 DetectCureTDL3: DRIVER_OBJECT name: \Driver\Disk, Driver Name: Disk
18:20:50:609 3784 DetectCureTDL3: IrpHandler (0) addr: BA18EBB0
18:20:50:609 3784 DetectCureTDL3: IrpHandler (1) addr: 804F355A
18:20:50:609 3784 DetectCureTDL3: IrpHandler (2) addr: BA18EBB0
18:20:50:609 3784 DetectCureTDL3: IrpHandler (3) addr: BA188D1F
18:20:50:609 3784 DetectCureTDL3: IrpHandler (4) addr: BA188D1F
18:20:50:609 3784 DetectCureTDL3: IrpHandler (5) addr: 804F355A
18:20:50:609 3784 DetectCureTDL3: IrpHandler (6) addr: 804F355A
18:20:50:609 3784 DetectCureTDL3: IrpHandler (7) addr: 804F355A
18:20:50:609 3784 DetectCureTDL3: IrpHandler (8) addr: 804F355A
18:20:50:609 3784 DetectCureTDL3: IrpHandler (9) addr: BA1892E2
18:20:50:609 3784 DetectCureTDL3: IrpHandler (10) addr: 804F355A
18:20:50:609 3784 DetectCureTDL3: IrpHandler (11) addr: 804F355A
18:20:50:609 3784 DetectCureTDL3: IrpHandler (12) addr: 804F355A
18:20:50:609 3784 DetectCureTDL3: IrpHandler (13) addr: 804F355A
18:20:50:609 3784 DetectCureTDL3: IrpHandler (14) addr: BA1893BB
18:20:50:609 3784 DetectCureTDL3: IrpHandler (15) addr: BA18CF28
18:20:50:609 3784 DetectCureTDL3: IrpHandler (16) addr: BA1892E2
18:20:50:609 3784 DetectCureTDL3: IrpHandler (17) addr: 804F355A
18:20:50:609 3784 DetectCureTDL3: IrpHandler (18) addr: 804F355A
18:20:50:609 3784 DetectCureTDL3: IrpHandler (19) addr: 804F355A
18:20:50:609 3784 DetectCureTDL3: IrpHandler (20) addr: 804F355A
18:20:50:609 3784 DetectCureTDL3: IrpHandler (21) addr: 804F355A
18:20:50:609 3784 DetectCureTDL3: IrpHandler (22) addr: BA18AC82
18:20:50:609 3784 DetectCureTDL3: IrpHandler (23) addr: BA18F99E
18:20:50:609 3784 DetectCureTDL3: IrpHandler (24) addr: 804F355A
18:20:50:609 3784 DetectCureTDL3: IrpHandler (25) addr: 804F355A
18:20:50:609 3784 DetectCureTDL3: IrpHandler (26) addr: 804F355A
18:20:50:609 3784 TDL3_FileDetect: Processing driver: Disk
18:20:50:609 3784 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\DRIVERS\disk.sys
18:20:50:609 3784 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\DRIVERS\disk.sys
18:20:50:625 3784 TDL3_FileDetect: C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: Clean
18:20:50:625 3784
18:20:50:625 3784 DetectCureTDL3: DEVICE_OBJECT: 89B2DC68
18:20:50:625 3784 KLMD_GetLowerDeviceObject: Trying to get lower device object for 89B2DC68
18:20:50:625 3784 KLMD_ReadMem: Trying to ReadMemory 0x89B2DC68[0x38]
18:20:50:625 3784 DetectCureTDL3: DRIVER_OBJECT: 8A5C5C08
18:20:50:625 3784 KLMD_ReadMem: Trying to ReadMemory 0x8A5C5C08[0xA8]
18:20:50:625 3784 KLMD_ReadMem: Trying to ReadMemory 0xE18714B0[0x18]
18:20:50:625 3784 DetectCureTDL3: DRIVER_OBJECT name: \Driver\Disk, Driver Name: Disk
18:20:50:625 3784 DetectCureTDL3: IrpHandler (0) addr: BA18EBB0
18:20:50:625 3784 DetectCureTDL3: IrpHandler (1) addr: 804F355A
18:20:50:625 3784 DetectCureTDL3: IrpHandler (2) addr: BA18EBB0
18:20:50:625 3784 DetectCureTDL3: IrpHandler (3) addr: BA188D1F
18:20:50:625 3784 DetectCureTDL3: IrpHandler (4) addr: BA188D1F
18:20:50:625 3784 DetectCureTDL3: IrpHandler (5) addr: 804F355A
18:20:50:625 3784 DetectCureTDL3: IrpHandler (6) addr: 804F355A
18:20:50:625 3784 DetectCureTDL3: IrpHandler (7) addr: 804F355A
18:20:50:625 3784 DetectCureTDL3: IrpHandler (8) addr: 804F355A
18:20:50:625 3784 DetectCureTDL3: IrpHandler (9) addr: BA1892E2
18:20:50:625 3784 DetectCureTDL3: IrpHandler (10) addr: 804F355A
18:20:50:625 3784 DetectCureTDL3: IrpHandler (11) addr: 804F355A
18:20:50:625 3784 DetectCureTDL3: IrpHandler (12) addr: 804F355A
18:20:50:625 3784 DetectCureTDL3: IrpHandler (13) addr: 804F355A
18:20:50:625 3784 DetectCureTDL3: IrpHandler (14) addr: BA1893BB
18:20:50:625 3784 DetectCureTDL3: IrpHandler (15) addr: BA18CF28
18:20:50:625 3784 DetectCureTDL3: IrpHandler (16) addr: BA1892E2
18:20:50:625 3784 DetectCureTDL3: IrpHandler (17) addr: 804F355A
18:20:50:625 3784 DetectCureTDL3: IrpHandler (18) addr: 804F355A
18:20:50:625 3784 DetectCureTDL3: IrpHandler (19) addr: 804F355A
18:20:50:625 3784 DetectCureTDL3: IrpHandler (20) addr: 804F355A
18:20:50:625 3784 DetectCureTDL3: IrpHandler (21) addr: 804F355A
18:20:50:625 3784 DetectCureTDL3: IrpHandler (22) addr: BA18AC82
18:20:50:625 3784 DetectCureTDL3: IrpHandler (23) addr: BA18F99E
18:20:50:625 3784 DetectCureTDL3: IrpHandler (24) addr: 804F355A
18:20:50:625 3784 DetectCureTDL3: IrpHandler (25) addr: 804F355A
18:20:50:625 3784 DetectCureTDL3: IrpHandler (26) addr: 804F355A
18:20:50:625 3784 TDL3_FileDetect: Processing driver: Disk
18:20:50:625 3784 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\DRIVERS\disk.sys
18:20:50:625 3784 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\DRIVERS\disk.sys
18:20:50:625 3784 TDL3_FileDetect: C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: Clean
18:20:50:625 3784
18:20:50:625 3784 DetectCureTDL3: DEVICE_OBJECT: 8998EAB0
18:20:50:625 3784 KLMD_GetLowerDeviceObject: Trying to get lower device object for 8998EAB0
18:20:50:625 3784 KLMD_ReadMem: Trying to ReadMemory 0x8998EAB0[0x38]
18:20:50:625 3784 DetectCureTDL3: DRIVER_OBJECT: 8A5C5C08
18:20:50:625 3784 KLMD_ReadMem: Trying to ReadMemory 0x8A5C5C08[0xA8]
18:20:50:625 3784 KLMD_ReadMem: Trying to ReadMemory 0xE18714B0[0x18]
18:20:50:625 3784 DetectCureTDL3: DRIVER_OBJECT name: \Driver\Disk, Driver Name: Disk
18:20:50:625 3784 DetectCureTDL3: IrpHandler (0) addr: BA18EBB0
18:20:50:625 3784 DetectCureTDL3: IrpHandler (1) addr: 804F355A
18:20:50:625 3784 DetectCureTDL3: IrpHandler (2) addr: BA18EBB0
18:20:50:625 3784 DetectCureTDL3: IrpHandler (3) addr: BA188D1F
18:20:50:625 3784 DetectCureTDL3: IrpHandler (4) addr: BA188D1F
18:20:50:625 3784 DetectCureTDL3: IrpHandler (5) addr: 804F355A
18:20:50:625 3784 DetectCureTDL3: IrpHandler (6) addr: 804F355A
18:20:50:625 3784 DetectCureTDL3: IrpHandler (7) addr: 804F355A
18:20:50:625 3784 DetectCureTDL3: IrpHandler (8) addr: 804F355A
18:20:50:625 3784 DetectCureTDL3: IrpHandler (9) addr: BA1892E2
18:20:50:625 3784 DetectCureTDL3: IrpHandler (10) addr: 804F355A
18:20:50:625 3784 DetectCureTDL3: IrpHandler (11) addr: 804F355A
18:20:50:625 3784 DetectCureTDL3: IrpHandler (12) addr: 804F355A
18:20:50:625 3784 DetectCureTDL3: IrpHandler (13) addr: 804F355A
18:20:50:625 3784 DetectCureTDL3: IrpHandler (14) addr: BA1893BB
18:20:50:625 3784 DetectCureTDL3: IrpHandler (15) addr: BA18CF28
18:20:50:625 3784 DetectCureTDL3: IrpHandler (16) addr: BA1892E2
18:20:50:625 3784 DetectCureTDL3: IrpHandler (17) addr: 804F355A
18:20:50:625 3784 DetectCureTDL3: IrpHandler (18) addr: 804F355A
18:20:50:625 3784 DetectCureTDL3: IrpHandler (19) addr: 804F355A
18:20:50:625 3784 DetectCureTDL3: IrpHandler (20) addr: 804F355A
18:20:50:625 3784 DetectCureTDL3: IrpHandler (21) addr: 804F355A
18:20:50:625 3784 DetectCureTDL3: IrpHandler (22) addr: BA18AC82
18:20:50:625 3784 DetectCureTDL3: IrpHandler (23) addr: BA18F99E
18:20:50:625 3784 DetectCureTDL3: IrpHandler (24) addr: 804F355A
18:20:50:625 3784 DetectCureTDL3: IrpHandler (25) addr: 804F355A
18:20:50:625 3784 DetectCureTDL3: IrpHandler (26) addr: 804F355A
18:20:50:625 3784 TDL3_FileDetect: Processing driver: Disk
18:20:50:625 3784 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\DRIVERS\disk.sys
18:20:50:625 3784 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\DRIVERS\disk.sys
18:20:50:625 3784 TDL3_FileDetect: C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: Clean
18:20:50:625 3784
18:20:50:625 3784 DetectCureTDL3: DEVICE_OBJECT: 899856F0
18:20:50:625 3784 KLMD_GetLowerDeviceObject: Trying to get lower device object for 899856F0
18:20:50:625 3784 KLMD_ReadMem: Trying to ReadMemory 0x899856F0[0x38]
18:20:50:625 3784 DetectCureTDL3: DRIVER_OBJECT: 8A5C5C08
18:20:50:625 3784 KLMD_ReadMem: Trying to ReadMemory 0x8A5C5C08[0xA8]
18:20:50:625 3784 KLMD_ReadMem: Trying to ReadMemory 0xE18714B0[0x18]
18:20:50:625 3784 DetectCureTDL3: DRIVER_OBJECT name: \Driver\Disk, Driver Name: Disk
18:20:50:625 3784 DetectCureTDL3: IrpHandler (0) addr: BA18EBB0
18:20:50:625 3784 DetectCureTDL3: IrpHandler (1) addr: 804F355A
18:20:50:625 3784 DetectCureTDL3: IrpHandler (2) addr: BA18EBB0
18:20:50:625 3784 DetectCureTDL3: IrpHandler (3) addr: BA188D1F
18:20:50:625 3784 DetectCureTDL3: IrpHandler (4) addr: BA188D1F
18:20:50:625 3784 DetectCureTDL3: IrpHandler (5) addr: 804F355A
18:20:50:625 3784 DetectCureTDL3: IrpHandler (6) addr: 804F355A
18:20:50:625 3784 DetectCureTDL3: IrpHandler (7) addr: 804F355A
18:20:50:625 3784 DetectCureTDL3: IrpHandler (8) addr: 804F355A
18:20:50:625 3784 DetectCureTDL3: IrpHandler (9) addr: BA1892E2
18:20:50:625 3784 DetectCureTDL3: IrpHandler (10) addr: 804F355A
18:20:50:625 3784 DetectCureTDL3: IrpHandler (11) addr: 804F355A
18:20:50:625 3784 DetectCureTDL3: IrpHandler (12) addr: 804F355A
18:20:50:625 3784 DetectCureTDL3: IrpHandler (13) addr: 804F355A
18:20:50:625 3784 DetectCureTDL3: IrpHandler (14) addr: BA1893BB
18:20:50:625 3784 DetectCureTDL3: IrpHandler (15) addr: BA18CF28
18:20:50:625 3784 DetectCureTDL3: IrpHandler (16) addr: BA1892E2
18:20:50:625 3784 DetectCureTDL3: IrpHandler (17) addr: 804F355A
18:20:50:625 3784 DetectCureTDL3: IrpHandler (18) addr: 804F355A
18:20:50:625 3784 DetectCureTDL3: IrpHandler (19) addr: 804F355A
18:20:50:625 3784 DetectCureTDL3: IrpHandler (20) addr: 804F355A
18:20:50:625 3784 DetectCureTDL3: IrpHandler (21) addr: 804F355A
18:20:50:625 3784 DetectCureTDL3: IrpHandler (22) addr: BA18AC82
18:20:50:625 3784 DetectCureTDL3: IrpHandler (23) addr: BA18F99E
18:20:50:625 3784 DetectCureTDL3: IrpHandler (24) addr: 804F355A
18:20:50:625 3784 DetectCureTDL3: IrpHandler (25) addr: 804F355A
18:20:50:625 3784 DetectCureTDL3: IrpHandler (26) addr: 804F355A
18:20:50:625 3784 TDL3_FileDetect: Processing driver: Disk
18:20:50:625 3784 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\DRIVERS\disk.sys
18:20:50:625 3784 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\DRIVERS\disk.sys
18:20:50:625 3784 TDL3_FileDetect: C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: Clean
18:20:50:625 3784
18:20:50:625 3784 DetectCureTDL3: DEVICE_OBJECT: 89979AB8
18:20:50:625 3784 KLMD_GetLowerDeviceObject: Trying to get lower device object for 89979AB8
18:20:50:625 3784 DetectCureTDL3: DEVICE_OBJECT: 89B83D08
18:20:50:625 3784 KLMD_GetLowerDeviceObject: Trying to get lower device object for 89B83D08
18:20:50:625 3784 KLMD_ReadMem: Trying to ReadMemory 0x89B83D08[0x38]
18:20:50:625 3784 DetectCureTDL3: DRIVER_OBJECT: 89997F38
18:20:50:625 3784 KLMD_ReadMem: Trying to ReadMemory 0x89997F38[0xA8]
18:20:50:625 3784 KLMD_ReadMem: Trying to ReadMemory 0xE1C999D0[0x1E]
18:20:50:625 3784 DetectCureTDL3: DRIVER_OBJECT name: \Driver\USBSTOR, Driver Name: USBSTOR
18:20:50:625 3784 DetectCureTDL3: IrpHandler (0) addr: A5218218
18:20:50:625 3784 DetectCureTDL3: IrpHandler (1) addr: 804F355A
18:20:50:625 3784 DetectCureTDL3: IrpHandler (2) addr: A5218218
18:20:50:625 3784 DetectCureTDL3: IrpHandler (3) addr: A521823C
18:20:50:625 3784 DetectCureTDL3: IrpHandler (4) addr: A521823C
18:20:50:625 3784 DetectCureTDL3: IrpHandler (5) addr: 804F355A
18:20:50:625 3784 DetectCureTDL3: IrpHandler (6) addr: 804F355A
18:20:50:625 3784 DetectCureTDL3: IrpHandler (7) addr: 804F355A
18:20:50:625 3784 DetectCureTDL3: IrpHandler (8) addr: 804F355A
18:20:50:625 3784 DetectCureTDL3: IrpHandler (9) addr: 804F355A
18:20:50:625 3784 DetectCureTDL3: IrpHandler (10) addr: 804F355A
18:20:50:625 3784 DetectCureTDL3: IrpHandler (11) addr: 804F355A
18:20:50:625 3784 DetectCureTDL3: IrpHandler (12) addr: 804F355A
18:20:50:625 3784 DetectCureTDL3: IrpHandler (13) addr: 804F355A
18:20:50:625 3784 DetectCureTDL3: IrpHandler (14) addr: A5218180
18:20:50:625 3784 DetectCureTDL3: IrpHandler (15) addr: A52139E6
18:20:50:625 3784 DetectCureTDL3: IrpHandler (16) addr: 804F355A
18:20:50:625 3784 DetectCureTDL3: IrpHandler (17) addr: 804F355A
18:20:50:625 3784 DetectCureTDL3: IrpHandler (18) addr: 804F355A
18:20:50:625 3784 DetectCureTDL3: IrpHandler (19) addr: 804F355A
18:20:50:625 3784 DetectCureTDL3: IrpHandler (20) addr: 804F355A
18:20:50:625 3784 DetectCureTDL3: IrpHandler (21) addr: 804F355A
18:20:50:625 3784 DetectCureTDL3: IrpHandler (22) addr: A52175F0
18:20:50:625 3784 DetectCureTDL3: IrpHandler (23) addr: A5215A6E
18:20:50:625 3784 DetectCureTDL3: IrpHandler (24) addr: 804F355A
18:20:50:625 3784 DetectCureTDL3: IrpHandler (25) addr: 804F355A
18:20:50:625 3784 DetectCureTDL3: IrpHandler (26) addr: 804F355A
18:20:50:625 3784 KLMD_ReadMem: Trying to ReadMemory 0xA5214F26[0x400]
18:20:50:625 3784 TDL3_StartIoHookDetect: CheckParameters: 0, 00000000, 0
18:20:50:625 3784 TDL3_FileDetect: Processing driver: USBSTOR
18:20:50:625 3784 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
18:20:50:625 3784 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
18:20:50:640 3784 TDL3_FileDetect: C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS - Verdict: Clean
18:20:50:640 3784
18:20:50:640 3784 DetectCureTDL3: DEVICE_OBJECT: 8997D518
18:20:50:640 3784 KLMD_GetLowerDeviceObject: Trying to get lower device object for 8997D518
18:20:50:640 3784 DetectCureTDL3: DEVICE_OBJECT: 89B5C6F0
18:20:50:640 3784 KLMD_GetLowerDeviceObject: Trying to get lower device object for 89B5C6F0
18:20:50:640 3784 KLMD_ReadMem: Trying to ReadMemory 0x89B5C6F0[0x38]
18:20:50:640 3784 DetectCureTDL3: DRIVER_OBJECT: 89997F38
18:20:50:640 3784 KLMD_ReadMem: Trying to ReadMemory 0x89997F38[0xA8]
18:20:50:640 3784 KLMD_ReadMem: Trying to ReadMemory 0xE1C999D0[0x1E]
18:20:50:640 3784 DetectCureTDL3: DRIVER_OBJECT name: \Driver\USBSTOR, Driver Name: USBSTOR
18:20:50:640 3784 DetectCureTDL3: IrpHandler (0) addr: A5218218
18:20:50:640 3784 DetectCureTDL3: IrpHandler (1) addr: 804F355A
18:20:50:640 3784 DetectCureTDL3: IrpHandler (2) addr: A5218218
18:20:50:640 3784 DetectCureTDL3: IrpHandler (3) addr: A521823C
18:20:50:640 3784 DetectCureTDL3: IrpHandler (4) addr: A521823C
18:20:50:640 3784 DetectCureTDL3: IrpHandler (5) addr: 804F355A
18:20:50:640 3784 DetectCureTDL3: IrpHandler (6) addr: 804F355A
18:20:50:640 3784 DetectCureTDL3: IrpHandler (7) addr: 804F355A
18:20:50:640 3784 DetectCureTDL3: IrpHandler (8) addr: 804F355A
18:20:50:640 3784 DetectCureTDL3: IrpHandler (9) addr: 804F355A
18:20:50:640 3784 DetectCureTDL3: IrpHandler (10) addr: 804F355A
18:20:50:640 3784 DetectCureTDL3: IrpHandler (11) addr: 804F355A
18:20:50:640 3784 DetectCureTDL3: IrpHandler (12) addr: 804F355A
18:20:50:640 3784 DetectCureTDL3: IrpHandler (13) addr: 804F355A
18:20:50:640 3784 DetectCureTDL3: IrpHandler (14) addr: A5218180
18:20:50:640 3784 DetectCureTDL3: IrpHandler (15) addr: A52139E6
18:20:50:640 3784 DetectCureTDL3: IrpHandler (16) addr: 804F355A
18:20:50:640 3784 DetectCureTDL3: IrpHandler (17) addr: 804F355A
18:20:50:640 3784 DetectCureTDL3: IrpHandler (18) addr: 804F355A
18:20:50:640 3784 DetectCureTDL3: IrpHandler (19) addr: 804F355A
18:20:50:640 3784 DetectCureTDL3: IrpHandler (20) addr: 804F355A
18:20:50:640 3784 DetectCureTDL3: IrpHandler (21) addr: 804F355A
18:20:50:640 3784 DetectCureTDL3: IrpHandler (22) addr: A52175F0
18:20:50:640 3784 DetectCureTDL3: IrpHandler (23) addr: A5215A6E
18:20:50:640 3784 DetectCureTDL3: IrpHandler (24) addr: 804F355A
18:20:50:640 3784 DetectCureTDL3: IrpHandler (25) addr: 804F355A
18:20:50:640 3784 DetectCureTDL3: IrpHandler (26) addr: 804F355A
18:20:50:640 3784 KLMD_ReadMem: Trying to ReadMemory 0xA5214F26[0x400]
18:20:50:640 3784 TDL3_StartIoHookDetect: CheckParameters: 0, 00000000, 0
18:20:50:640 3784 TDL3_FileDetect: Processing driver: USBSTOR
18:20:50:640 3784 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
18:20:50:640 3784 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
18:20:50:640 3784 TDL3_FileDetect: C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS - Verdict: Clean
18:20:50:640 3784
18:20:50:640 3784 DetectCureTDL3: DEVICE_OBJECT: 89985AB8
18:20:50:640 3784 KLMD_GetLowerDeviceObject: Trying to get lower device object for 89985AB8
18:20:50:640 3784 DetectCureTDL3: DEVICE_OBJECT: 89B64800
18:20:50:640 3784 KLMD_GetLowerDeviceObject: Trying to get lower device object for 89B64800
18:20:50:640 3784 KLMD_ReadMem: Trying to ReadMemory 0x89B64800[0x38]
18:20:50:640 3784 DetectCureTDL3: DRIVER_OBJECT: 89997F38
18:20:50:640 3784 KLMD_ReadMem: Trying to ReadMemory 0x89997F38[0xA8]
18:20:50:640 3784 KLMD_ReadMem: Trying to ReadMemory 0xE1C999D0[0x1E]
18:20:50:640 3784 DetectCureTDL3: DRIVER_OBJECT name: \Driver\USBSTOR, Driver Name: USBSTOR
18:20:50:640 3784 DetectCureTDL3: IrpHandler (0) addr: A5218218
18:20:50:640 3784 DetectCureTDL3: IrpHandler (1) addr: 804F355A
18:20:50:640 3784 DetectCureTDL3: IrpHandler (2) addr: A5218218
18:20:50:640 3784 DetectCureTDL3: IrpHandler (3) addr: A521823C
18:20:50:640 3784 DetectCureTDL3: IrpHandler (4) addr: A521823C
18:20:50:640 3784 DetectCureTDL3: IrpHandler (5) addr: 804F355A
18:20:50:640 3784 DetectCureTDL3: IrpHandler (6) addr: 804F355A
18:20:50:640 3784 DetectCureTDL3: IrpHandler (7) addr: 804F355A
18:20:50:640 3784 DetectCureTDL3: IrpHandler (8) addr: 804F355A
18:20:50:640 3784 DetectCureTDL3: IrpHandler (9) addr: 804F355A
18:20:50:640 3784 DetectCureTDL3: IrpHandler (10) addr: 804F355A
18:20:50:640 3784 DetectCureTDL3: IrpHandler (11) addr: 804F355A
18:20:50:640 3784 DetectCureTDL3: IrpHandler (12) addr: 804F355A
18:20:50:640 3784 DetectCureTDL3: IrpHandler (13) addr: 804F355A
18:20:50:640 3784 DetectCureTDL3: IrpHandler (14) addr: A5218180
18:20:50:640 3784 DetectCureTDL3: IrpHandler (15) addr: A52139E6
18:20:50:640 3784 DetectCureTDL3: IrpHandler (16) addr: 804F355A
18:20:50:640 3784 DetectCureTDL3: IrpHandler (17) addr: 804F355A
18:20:50:640 3784 DetectCureTDL3: IrpHandler (18) addr: 804F355A
18:20:50:640 3784 DetectCureTDL3: IrpHandler (19) addr: 804F355A
18:20:50:640 3784 DetectCureTDL3: IrpHandler (20) addr: 804F355A
18:20:50:640 3784 DetectCureTDL3: IrpHandler (21) addr: 804F355A
18:20:50:640 3784 DetectCureTDL3: IrpHandler (22) addr: A52175F0
18:20:50:640 3784 DetectCureTDL3: IrpHandler (23) addr: A5215A6E
18:20:50:640 3784 DetectCureTDL3: IrpHandler (24) addr: 804F355A
18:20:50:640 3784 DetectCureTDL3: IrpHandler (25) addr: 804F355A
18:20:50:640 3784 DetectCureTDL3: IrpHandler (26) addr: 804F355A
18:20:50:640 3784 KLMD_ReadMem: Trying to ReadMemory 0xA5214F26[0x400]
18:20:50:640 3784 TDL3_StartIoHookDetect: CheckParameters: 0, 00000000, 0
18:20:50:640 3784 TDL3_FileDetect: Processing driver: USBSTOR
18:20:50:640 3784 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
18:20:50:640 3784 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
18:20:50:656 3784 TDL3_FileDetect: C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS - Verdict: Clean
18:20:50:656 3784
18:20:50:656 3784 DetectCureTDL3: DEVICE_OBJECT: 8997BAB8
18:20:50:656 3784 KLMD_GetLowerDeviceObject: Trying to get lower device object for 8997BAB8
18:20:50:656 3784 DetectCureTDL3: DEVICE_OBJECT: 899902F8
18:20:50:656 3784 KLMD_GetLowerDeviceObject: Trying to get lower device object for 899902F8
18:20:50:656 3784 KLMD_ReadMem: Trying to ReadMemory 0x899902F8[0x38]
18:20:50:656 3784 DetectCureTDL3: DRIVER_OBJECT: 89997F38
18:20:50:656 3784 KLMD_ReadMem: Trying to ReadMemory 0x89997F38[0xA8]
18:20:50:656 3784 KLMD_ReadMem: Trying to ReadMemory 0xE1C999D0[0x1E]
18:20:50:656 3784 DetectCureTDL3: DRIVER_OBJECT name: \Driver\USBSTOR, Driver Name: USBSTOR
18:20:50:656 3784 DetectCureTDL3: IrpHandler (0) addr: A5218218
18:20:50:656 3784 DetectCureTDL3: IrpHandler (1) addr: 804F355A
18:20:50:656 3784 DetectCureTDL3: IrpHandler (2) addr: A5218218
18:20:50:656 3784 DetectCureTDL3: IrpHandler (3) addr: A521823C
18:20:50:656 3784 DetectCureTDL3: IrpHandler (4) addr: A521823C
18:20:50:656 3784 DetectCureTDL3: IrpHandler (5) addr: 804F355A
18:20:50:656 3784 DetectCureTDL3: IrpHandler (6) addr: 804F355A
18:20:50:656 3784 DetectCureTDL3: IrpHandler (7) addr: 804F355A
18:20:50:656 3784 DetectCureTDL3: IrpHandler (8) addr: 804F355A
18:20:50:656 3784 DetectCureTDL3: IrpHandler (9) addr: 804F355A
18:20:50:656 3784 DetectCureTDL3: IrpHandler (10) addr: 804F355A
18:20:50:656 3784 DetectCureTDL3: IrpHandler (11) addr: 804F355A
18:20:50:656 3784 DetectCureTDL3: IrpHandler (12) addr: 804F355A
18:20:50:656 3784 DetectCureTDL3: IrpHandler (13) addr: 804F355A
18:20:50:656 3784 DetectCureTDL3: IrpHandler (14) addr: A5218180
18:20:50:656 3784 DetectCureTDL3: IrpHandler (15) addr: A52139E6
18:20:50:656 3784 DetectCureTDL3: IrpHandler (16) addr: 804F355A
18:20:50:656 3784 DetectCureTDL3: IrpHandler (17) addr: 804F355A
18:20:50:656 3784 DetectCureTDL3: IrpHandler (18) addr: 804F355A
18:20:50:656 3784 DetectCureTDL3: IrpHandler (19) addr: 804F355A
18:20:50:656 3784 DetectCureTDL3: IrpHandler (20) addr: 804F355A
18:20:50:656 3784 DetectCureTDL3: IrpHandler (21) addr: 804F355A
18:20:50:656 3784 DetectCureTDL3: IrpHandler (22) addr: A52175F0
18:20:50:656 3784 DetectCureTDL3: IrpHandler (23) addr: A5215A6E
18:20:50:656 3784 DetectCureTDL3: IrpHandler (24) addr: 804F355A
18:20:50:656 3784 DetectCureTDL3: IrpHandler (25) addr: 804F355A
18:20:50:656 3784 DetectCureTDL3: IrpHandler (26) addr: 804F355A
18:20:50:656 3784 KLMD_ReadMem: Trying to ReadMemory 0xA5214F26[0x400]
18:20:50:656 3784 TDL3_StartIoHookDetect: CheckParameters: 0, 00000000, 0
18:20:50:656 3784 TDL3_FileDetect: Processing driver: USBSTOR
18:20:50:656 3784 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
18:20:50:656 3784 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
18:20:50:656 3784 TDL3_FileDetect: C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS - Verdict: Clean
18:20:50:656 3784
18:20:50:656 3784 DetectCureTDL3: DEVICE_OBJECT: 8A4F62B8
18:20:50:656 3784 KLMD_GetLowerDeviceObject: Trying to get lower device object for 8A4F62B8
18:20:50:656 3784 KLMD_ReadMem: Trying to ReadMemory 0x8A4F62B8[0x38]
18:20:50:656 3784 DetectCureTDL3: DRIVER_OBJECT: 8A5C5C08
18:20:50:656 3784 KLMD_ReadMem: Trying to ReadMemory 0x8A5C5C08[0xA8]
18:20:50:656 3784 KLMD_ReadMem: Trying to ReadMemory 0xE18714B0[0x18]
18:20:50:656 3784 DetectCureTDL3: DRIVER_OBJECT name: \Driver\Disk, Driver Name: Disk
18:20:50:656 3784 DetectCureTDL3: IrpHandler (0) addr: BA18EBB0
18:20:50:656 3784 DetectCureTDL3: IrpHandler (1) addr: 804F355A
18:20:50:656 3784 DetectCureTDL3: IrpHandler (2) addr: BA18EBB0
18:20:50:656 3784 DetectCureTDL3: IrpHandler (3) addr: BA188D1F
18:20:50:656 3784 DetectCureTDL3: IrpHandler (4) addr: BA188D1F
18:20:50:656 3784 DetectCureTDL3: IrpHandler (5) addr: 804F355A
18:20:50:656 3784 DetectCureTDL3: IrpHandler (6) addr: 804F355A
18:20:50:656 3784 DetectCureTDL3: IrpHandler (7) addr: 804F355A
18:20:50:656 3784 DetectCureTDL3: IrpHandler (8) addr: 804F355A
18:20:50:656 3784 DetectCureTDL3: IrpHandler (9) addr: BA1892E2
18:20:50:656 3784 DetectCureTDL3: IrpHandler (10) addr: 804F355A
18:20:50:656 3784 DetectCureTDL3: IrpHandler (11) addr: 804F355A
18:20:50:656 3784 DetectCureTDL3: IrpHandler (12) addr: 804F355A
18:20:50:656 3784 DetectCureTDL3: IrpHandler (13) addr: 804F355A
18:20:50:656 3784 DetectCureTDL3: IrpHandler (14) addr: BA1893BB
18:20:50:656 3784 DetectCureTDL3: IrpHandler (15) addr: BA18CF28
18:20:50:656 3784 DetectCureTDL3: IrpHandler (16) addr: BA1892E2
18:20:50:656 3784 DetectCureTDL3: IrpHandler (17) addr: 804F355A
18:20:50:656 3784 DetectCureTDL3: IrpHandler (18) addr: 804F355A
18:20:50:656 3784 DetectCureTDL3: IrpHandler (19) addr: 804F355A
18:20:50:656 3784 DetectCureTDL3: IrpHandler (20) addr: 804F355A
18:20:50:656 3784 DetectCureTDL3: IrpHandler (21) addr: 804F355A
18:20:50:656 3784 DetectCureTDL3: IrpHandler (22) addr: BA18AC82
18:20:50:656 3784 DetectCureTDL3: IrpHandler (23) addr: BA18F99E
18:20:50:656 3784 DetectCureTDL3: IrpHandler (24) addr: 804F355A
18:20:50:656 3784 DetectCureTDL3: IrpHandler (25) addr: 804F355A
18:20:50:656 3784 DetectCureTDL3: IrpHandler (26) addr: 804F355A
18:20:50:656 3784 TDL3_FileDetect: Processing driver: Disk
18:20:50:656 3784 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\DRIVERS\disk.sys
18:20:50:656 3784 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\DRIVERS\disk.sys
18:20:50:656 3784 TDL3_FileDetect: C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: Clean
18:20:50:656 3784
18:20:50:656 3784 DetectCureTDL3: DEVICE_OBJECT: 8A4FD030
18:20:50:656 3784 KLMD_GetLowerDeviceObject: Trying to get lower device object for 8A4FD030
18:20:50:656 3784 DetectCureTDL3: DEVICE_OBJECT: 8A509AC8
18:20:50:656 3784 KLMD_GetLowerDeviceObject: Trying to get lower device object for 8A509AC8
18:20:50:656 3784 KLMD_ReadMem: Trying to ReadMemory 0x8A509AC8[0x38]
18:20:50:656 3784 DetectCureTDL3: DRIVER_OBJECT: 8A58D448
18:20:50:656 3784 KLMD_ReadMem: Trying to ReadMemory 0x8A58D448[0xA8]
18:20:50:656 3784 KLMD_ReadMem: Trying to ReadMemory 0xE1880220[0x20]
18:20:50:656 3784 DetectCureTDL3: DRIVER_OBJECT name: \Driver\sbp2port, Driver Name: sbp2port
18:20:50:656 3784 DetectCureTDL3: IrpHandler (0) addr: BA1C06F0
18:20:50:656 3784 DetectCureTDL3: IrpHandler (1) addr: 804F355A
18:20:50:656 3784 DetectCureTDL3: IrpHandler (2) addr: BA1C06F0
18:20:50:656 3784 DetectCureTDL3: IrpHandler (3) addr: 804F355A
18:20:50:656 3784 DetectCureTDL3: IrpHandler (4) addr: 804F355A
18:20:50:656 3784 DetectCureTDL3: IrpHandler (5) addr: 804F355A
18:20:50:656 3784 DetectCureTDL3: IrpHandler (6) addr: 804F355A
18:20:50:656 3784 DetectCureTDL3: IrpHandler (7) addr: 804F355A
18:20:50:656 3784 DetectCureTDL3: IrpHandler (8) addr: 804F355A
18:20:50:656 3784 DetectCureTDL3: IrpHandler (9) addr: 804F355A
18:20:50:656 3784 DetectCureTDL3: IrpHandler (10) addr: 804F355A
18:20:50:656 3784 DetectCureTDL3: IrpHandler (11) addr: 804F355A
18:20:50:656 3784 DetectCureTDL3: IrpHandler (12) addr: 804F355A
18:20:50:656 3784 DetectCureTDL3: IrpHandler (13) addr: 804F355A
18:20:50:656 3784 DetectCureTDL3: IrpHandler (14) addr: BA1C0950
18:20:50:656 3784 DetectCureTDL3: IrpHandler (15) addr: BA1BF72A
18:20:50:656 3784 DetectCureTDL3: IrpHandler (16) addr: 804F355A
18:20:50:656 3784 DetectCureTDL3: IrpHandler (17) addr: 804F355A
18:20:50:656 3784 DetectCureTDL3: IrpHandler (18) addr: 804F355A
18:20:50:656 3784 DetectCureTDL3: IrpHandler (19) addr: 804F355A
18:20:50:656 3784 DetectCureTDL3: IrpHandler (20) addr: 804F355A
18:20:50:656 3784 DetectCureTDL3: IrpHandler (21) addr: 804F355A
18:20:50:656 3784 DetectCureTDL3: IrpHandler (22) addr: BA1BA074
18:20:50:656 3784 DetectCureTDL3: IrpHandler (23) addr: BA1C08EE
18:20:50:656 3784 DetectCureTDL3: IrpHandler (24) addr: 804F355A
18:20:50:656 3784 DetectCureTDL3: IrpHandler (25) addr: 804F355A
18:20:50:656 3784 DetectCureTDL3: IrpHandler (26) addr: 804F355A
18:20:50:656 3784 KLMD_ReadMem: Trying to ReadMemory 0xBA1BF490[0x400]
18:20:50:656 3784 TDL3_StartIoHookDetect: CheckParameters: 0, 00000000, 0
18:20:50:656 3784 TDL3_FileDetect: Processing driver: sbp2port
18:20:50:656 3784 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\DRIVERS\sbp2port.sys
18:20:50:656 3784 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\DRIVERS\sbp2port.sys
18:20:50:671 3784 TDL3_FileDetect: C:\WINDOWS\system32\DRIVERS\sbp2port.sys - Verdict: Clean
18:20:50:671 3784
18:20:50:671 3784 DetectCureTDL3: DEVICE_OBJECT: 8A5C5030
18:20:50:671 3784 KLMD_GetLowerDeviceObject: Trying to get lower device object for 8A5C5030
18:20:50:671 3784 KLMD_ReadMem: Trying to ReadMemory 0x8A5C5030[0x38]
18:20:50:671 3784 DetectCureTDL3: DRIVER_OBJECT: 8A5C5C08
18:20:50:671 3784 KLMD_ReadMem: Trying to ReadMemory 0x8A5C5C08[0xA8]
18:20:50:671 3784 KLMD_ReadMem: Trying to ReadMemory 0xE18714B0[0x18]
18:20:50:671 3784 DetectCureTDL3: DRIVER_OBJECT name: \Driver\Disk, Driver Name: Disk
18:20:50:671 3784 DetectCureTDL3: IrpHandler (0) addr: BA18EBB0
18:20:50:671 3784 DetectCureTDL3: IrpHandler (1) addr: 804F355A
18:20:50:671 3784 DetectCureTDL3: IrpHandler (2) addr: BA18EBB0
18:20:50:671 3784 DetectCureTDL3: IrpHandler (3) addr: BA188D1F
18:20:50:671 3784 DetectCureTDL3: IrpHandler (4) addr: BA188D1F
18:20:50:671 3784 DetectCureTDL3: IrpHandler (5) addr: 804F355A
18:20:50:671 3784 DetectCureTDL3: IrpHandler (6) addr: 804F355A
18:20:50:671 3784 DetectCureTDL3: IrpHandler (7) addr: 804F355A
18:20:50:671 3784 DetectCureTDL3: IrpHandler (8) addr: 804F355A
18:20:50:671 3784 DetectCureTDL3: IrpHandler (9) addr: BA1892E2
18:20:50:671 3784 DetectCureTDL3: IrpHandler (10) addr: 804F355A
18:20:50:671 3784 DetectCureTDL3: IrpHandler (11) addr: 804F355A
18:20:50:671 3784 DetectCureTDL3: IrpHandler (12) addr: 804F355A
18:20:50:671 3784 DetectCureTDL3: IrpHandler (13) addr: 804F355A
18:20:50:671 3784 DetectCureTDL3: IrpHandler (14) addr: BA1893BB
18:20:50:671 3784 DetectCureTDL3: IrpHandler (15) addr: BA18CF28
18:20:50:671 3784 DetectCureTDL3: IrpHandler (16) addr: BA1892E2
18:20:50:671 3784 DetectCureTDL3: IrpHandler (17) addr: 804F355A
18:20:50:671 3784 DetectCureTDL3: IrpHandler (18) addr: 804F355A
18:20:50:671 3784 DetectCureTDL3: IrpHandler (19) addr: 804F355A
18:20:50:671 3784 DetectCureTDL3: IrpHandler (20) addr: 804F355A
18:20:50:671 3784 DetectCureTDL3: IrpHandler (21) addr: 804F355A
18:20:50:671 3784 DetectCureTDL3: IrpHandler (22) addr: BA18AC82
18:20:50:671 3784 DetectCureTDL3: IrpHandler (23) addr: BA18F99E
18:20:50:671 3784 DetectCureTDL3: IrpHandler (24) addr: 804F355A
18:20:50:671 3784 DetectCureTDL3: IrpHandler (25) addr: 804F355A
18:20:50:671 3784 DetectCureTDL3: IrpHandler (26) addr: 804F355A
18:20:50:671 3784 TDL3_FileDetect: Processing driver: Disk
18:20:50:671 3784 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\DRIVERS\disk.sys
18:20:50:671 3784 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\DRIVERS\disk.sys
18:20:50:671 3784 TDL3_FileDetect: C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: Clean
18:20:50:671 3784
18:20:50:671 3784 DetectCureTDL3: DEVICE_OBJECT: 8A5C6538
18:20:50:671 3784 KLMD_GetLowerDeviceObject: Trying to get lower device object for 8A5C6538
18:20:50:671 3784 KLMD_ReadMem: Trying to ReadMemory 0x8A5C6538[0x38]
18:20:50:671 3784 DetectCureTDL3: DRIVER_OBJECT: 8A5C5C08
18:20:50:671 3784 KLMD_ReadMem: Trying to ReadMemory 0x8A5C5C08[0xA8]
18:20:50:671 3784 KLMD_ReadMem: Trying to ReadMemory 0xE18714B0[0x18]
18:20:50:671 3784 DetectCureTDL3: DRIVER_OBJECT name: \Driver\Disk, Driver Name: Disk
18:20:50:671 3784 DetectCureTDL3: IrpHandler (0) addr: BA18EBB0
18:20:50:671 3784 DetectCureTDL3: IrpHandler (1) addr: 804F355A
18:20:50:671 3784 DetectCureTDL3: IrpHandler (2) addr: BA18EBB0
18:20:50:671 3784 DetectCureTDL3: IrpHandler (3) addr: BA188D1F
18:20:50:671 3784 DetectCureTDL3: IrpHandler (4) addr: BA188D1F
18:20:50:671 3784 DetectCureTDL3: IrpHandler (5) addr: 804F355A
18:20:50:671 3784 DetectCureTDL3: IrpHandler (6) addr: 804F355A
18:20:50:671 3784 DetectCureTDL3: IrpHandler (7) addr: 804F355A
18:20:50:671 3784 DetectCureTDL3: IrpHandler (8) addr: 804F355A
18:20:50:671 3784 DetectCureTDL3: IrpHandler (9) addr: BA1892E2
18:20:50:671 3784 DetectCureTDL3: IrpHandler (10) addr: 804F355A
18:20:50:671 3784 DetectCureTDL3: IrpHandler (11) addr: 804F355A
18:20:50:671 3784 DetectCureTDL3: IrpHandler (12) addr: 804F355A
18:20:50:671 3784 DetectCureTDL3: IrpHandler (13) addr: 804F355A
18:20:50:671 3784 DetectCureTDL3: IrpHandler (14) addr: BA1893BB
18:20:50:671 3784 DetectCureTDL3: IrpHandler (15) addr: BA18CF28
18:20:50:671 3784 DetectCureTDL3: IrpHandler (16) addr: BA1892E2
18:20:50:671 3784 DetectCureTDL3: IrpHandler (17) addr: 804F355A
18:20:50:671 3784 DetectCureTDL3: IrpHandler (18) addr: 804F355A
18:20:50:671 3784 DetectCureTDL3: IrpHandler (19) addr: 804F355A
18:20:50:671 3784 DetectCureTDL3: IrpHandler (20) addr: 804F355A
18:20:50:671 3784 DetectCureTDL3: IrpHandler (21) addr: 804F355A
18:20:50:671 3784 DetectCureTDL3: IrpHandler (22) addr: BA18AC82
18:20:50:671 3784 DetectCureTDL3: IrpHandler (23) addr: BA18F99E
18:20:50:671 3784 DetectCureTDL3: IrpHandler (24) addr: 804F355A
18:20:50:671 3784 DetectCureTDL3: IrpHandler (25) addr: 804F355A
18:20:50:671 3784 DetectCureTDL3: IrpHandler (26) addr: 804F355A
18:20:50:671 3784 TDL3_FileDetect: Processing driver: Disk
18:20:50:671 3784 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\DRIVERS\disk.sys
18:20:50:671 3784 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\DRIVERS\disk.sys
18:20:50:671 3784 TDL3_FileDetect: C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: Clean
18:20:50:671 3784
18:20:50:671 3784 DetectCureTDL3: DEVICE_OBJECT: 8A5A2AB8
18:20:50:671 3784 KLMD_GetLowerDeviceObject: Trying to get lower device object for 8A5A2AB8
18:20:50:671 3784 DetectCureTDL3: DEVICE_OBJECT: 8A5C79E8
18:20:50:671 3784 KLMD_GetLowerDeviceObject: Trying to get lower device object for 8A5C79E8
18:20:50:671 3784 DetectCureTDL3: DEVICE_OBJECT: 8A60A940
18:20:50:671 3784 KLMD_GetLowerDeviceObject: Trying to get lower device object for 8A60A940
18:20:50:671 3784 KLMD_ReadMem: Trying to ReadMemory 0x8A60A940[0x38]
18:20:50:671 3784 DetectCureTDL3: DRIVER_OBJECT: 8A4F85F8
18:20:50:671 3784 KLMD_ReadMem: Trying to ReadMemory 0x8A4F85F8[0xA8]
18:20:50:671 3784 KLMD_ReadMem: Trying to ReadMemory 0x8A5A3D98[0x38]
18:20:50:671 3784 KLMD_ReadMem: Trying to ReadMemory 0x8A5CA030[0xA8]
18:20:50:671 3784 KLMD_ReadMem: Trying to ReadMemory 0xE180BB30[0x1A]
18:20:50:671 3784 DetectCureTDL3: DRIVER_OBJECT name: \Driver\atapi, Driver Name: atapi
18:20:50:671 3784 DetectCureTDL3: IrpHandler (0) addr: 8A562618
18:20:50:671 3784 DetectCureTDL3: IrpHandler (1) addr: 8A562618
18:20:50:671 3784 DetectCureTDL3: IrpHandler (2) addr: 8A562618
18:20:50:671 3784 DetectCureTDL3: IrpHandler (3) addr: 8A562618
18:20:50:671 3784 DetectCureTDL3: IrpHandler (4) addr: 8A562618
18:20:50:671 3784 DetectCureTDL3: IrpHandler (5) addr: 8A562618
18:20:50:671 3784 DetectCureTDL3: IrpHandler (6) addr: 8A562618
18:20:50:671 3784 DetectCureTDL3: IrpHandler (7) addr: 8A562618
18:20:50:671 3784 DetectCureTDL3: IrpHandler (8) addr: 8A562618
18:20:50:671 3784 DetectCureTDL3: IrpHandler (9) addr: 8A562618
18:20:50:671 3784 DetectCureTDL3: IrpHandler (10) addr: 8A562618
18:20:50:671 3784 DetectCureTDL3: IrpHandler (11) addr: 8A562618
18:20:50:671 3784 DetectCureTDL3: IrpHandler (12) addr: 8A562618
18:20:50:671 3784 DetectCureTDL3: IrpHandler (13) addr: 8A562618
18:20:50:671 3784 DetectCureTDL3: IrpHandler (14) addr: 8A562618
18:20:50:671 3784 DetectCureTDL3: IrpHandler (15) addr: 8A562618
18:20:50:671 3784 DetectCureTDL3: IrpHandler (16) addr: 8A562618
18:20:50:671 3784 DetectCureTDL3: IrpHandler (17) addr: 8A562618
18:20:50:671 3784 DetectCureTDL3: IrpHandler (18) addr: 8A562618
18:20:50:671 3784 DetectCureTDL3: IrpHandler (19) addr: 8A562618
18:20:50:671 3784 DetectCureTDL3: IrpHandler (20) addr: 8A562618
18:20:50:671 3784 DetectCureTDL3: IrpHandler (21) addr: 8A562618
18:20:50:671 3784 DetectCureTDL3: IrpHandler (22) addr: 8A562618
18:20:50:671 3784 DetectCureTDL3: IrpHandler (23) addr: 8A562618
18:20:50:671 3784 DetectCureTDL3: IrpHandler (24) addr: 8A562618
18:20:50:671 3784 DetectCureTDL3: IrpHandler (25) addr: 8A562618
18:20:50:671 3784 DetectCureTDL3: IrpHandler (26) addr: 8A562618
18:20:50:671 3784 DetectCureTDL3: All IRP handlers pointed to one addr: 8A562618
18:20:50:671 3784 KLMD_ReadMem: Trying to ReadMemory 0x8A562618[0x400]
18:20:50:671 3784 TDL3_IrpHookDetect: CheckParameters: 4, FFDF0308, 313, 101, 3, 89
18:20:50:671 3784 Driver "atapi" Irp handler infected by TDSS rootkit ... 18:20:50:671 3784 KLMD_WriteMem: Trying to WriteMemory 0x8A56267D[0xD]
18:20:50:671 3784 cured
18:20:50:671 3784 KLMD_ReadMem: Trying to ReadMemory 0x8A5624BF[0x400]
18:20:50:671 3784 TDL3_StartIoHookDetect: CheckParameters: 9, FFDF0308, 1
18:20:50:671 3784 Driver "atapi" StartIo handler infected by TDSS rootkit ... 18:20:50:671 3784 TDL3_StartIoHookCure: Number of patches 1
18:20:50:671 3784 KLMD_WriteMem: Trying to WriteMemory 0x8A5625B6[0x6]
18:20:50:671 3784 cured
18:20:50:671 3784 TDL3_FileDetect: Processing driver: atapi
18:20:50:671 3784 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\DRIVERS\atapi.sys
18:20:50:671 3784 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\DRIVERS\atapi.sys
18:20:50:687 3784 TDL3_FileDetect: C:\WINDOWS\system32\DRIVERS\atapi.sys - Verdict: Infected
18:20:50:687 3784 File C:\WINDOWS\system32\DRIVERS\atapi.sys infected by TDSS rootkit ... 18:20:50:687 3784 TDL3_FileCure: Processing driver file: C:\WINDOWS\system32\DRIVERS\atapi.sys
18:20:50:687 3784 ProcessDirEnumEx: FindFirstFile(C:\WINDOWS\system32\DriverStore\FileRepository\*) error 3
18:20:50:718 3784 CABFileCallback: Processing cab-file: C:\WINDOWS\Driver Cache\i386\driver.cab
18:20:50:781 3784 CABFileCallback: Processing cab-file: C:\WINDOWS\Driver Cache\i386\sp2.cab
18:20:50:796 3784 CABFileCallback: Processing cab-file: C:\WINDOWS\Driver Cache\i386\sp3.cab
18:20:50:812 3784 CabinetCallback: Backup candidate found: atapi.sys:96512, extracting..
18:20:50:843 3784 CabinetCallback: File extracted successfully: C:\DOCUME~1\Owner\LOCALS~1\Temp\bck12.tmp
18:20:50:843 3784 ValidateDriverFile: Stage 1 passed
18:20:50:843 3784 ValidateDriverFile: Stage 2 passed
18:20:50:937 3784 DigitalSignVerifyByHandle: Embedded DS result: 800B0100
18:20:52:109 3784 DigitalSignVerifyByHandle: Cat DS result: 00000000
18:20:52:109 3784 ValidateDriverFile: Stage 3 passed
18:20:52:109 3784 CabinetCallback: File validated successfully, restore information prepared
18:20:52:109 3784 FindDriverFileBackup: Backup copy found in cab-file
18:20:52:109 3784 TDL3_FileCure: Backup copy found, using it..
18:20:52:109 3784 TDL3_FileCure: Dumping cured buffer to file C:\WINDOWS\system32\drivers\tsk13.tmp
18:20:52:140 3784 TDL3_FileCure: New / Old Image paths: (system32\drivers\tsk13.tmp, system32\drivers\atapi.sys)
18:20:52:140 3784 TDL3_FileCure: KLMD jobs schedule success
18:20:52:140 3784 will be cured on next reboot
18:20:52:140 3784 UtilityBootReinit: Reboot required for cure complete..
18:20:52:140 3784 MyNtCreateFileW: NtCreateFile(\??\C:\WINDOWS\system32\drivers\klmdb.sys) returned status 00000000
18:20:52:218 3784 UtilityBootReinit: KLMD drop success
18:20:52:218 3784 KLMD_ApplyPendList: Pending buffer(5D85_52FC, 608) dropped successfully
18:20:52:218 3784 UtilityBootReinit: Cure on reboot scheduled successfully
18:20:52:218 3784
18:20:52:218 3784 Completed
18:20:52:218 3784
18:20:52:218 3784 Results:
18:20:52:234 3784 Memory objects infected / cured / cured on reboot: 2 / 2 / 0
18:20:52:234 3784 Registry objects infected / cured / cured on reboot: 0 / 0 / 0
18:20:52:234 3784 File objects infected / cured / cured on reboot: 1 / 0 / 1
18:20:52:234 3784
18:20:52:234 3784 UnloadDriverW: NtUnloadDriver error 1
18:20:52:234 3784 KLMD_Unload: UnloadDriverW(klmd21) error 1
18:20:52:234 3784 MyNtCreateFileW: NtCreateFile(\??\C:\WINDOWS\system32\drivers\klmd.sys) returned status 00000000
18:20:52:234 3784 UtilityDeinit: KLMD(ARK) unloaded successfully


#12 oatmeal2348

oatmeal2348
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:08:16 AM

Posted 26 January 2010 - 07:29 PM

It looks like there was a lot of crap on my computer. I hope you are able to interpret what you find. The computer seems to be rebooting pretty quick already and ... let me see ... MY BROWSER ISN'T REDIRECTING! WOO HOO!

Let me know if I need to do anything else to this stupid computer.

Thanks!
MikeO

#13 Buckeye_Sam

Buckeye_Sam

    Malware Expert


  • Members
  • 17,382 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Pickerington, Ohio
  • Local time:09:16 AM

Posted 26 January 2010 - 08:18 PM

We are making progress. How is your computer behaving now?
What issues are you still having?
Posted Image If I have helped you in any way, please consider a donation to help me continue the fight against malware.


Failing to respond back to the person that is giving up their own time to help you not only is insensitive and disrespectful, but it guarantees that you will never receive help from me again. Please thank your helpers and there will always be help here when you need it!


========================================================

#14 oatmeal2348

oatmeal2348
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:08:16 AM

Posted 26 January 2010 - 08:29 PM

So far everything is working smoothly. No more shutdowns, no more Generic System process problems, no more browser redirects ... and I can hibernate my computer for the first time in months.

I think it's clean, but I've been waiting to run any new scans (with S&D or AdAware) until I heard from you. Are there any final things I should do? Were you able to tell where I went wrong in the first place?



#15 Buckeye_Sam

Buckeye_Sam

    Malware Expert


  • Members
  • 17,382 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Pickerington, Ohio
  • Local time:09:16 AM

Posted 26 January 2010 - 08:35 PM

You had multiple infections, including a nasty rootkit. Hard to say where you might have picked it up. This particular rootkit is very prevalent right now so it probably spreads in numerous ways. Here are some final steps and recommendations for you.

Now we'll remove OTL and some of the other tools we've used.
  • Double-click OTL.exe to run it.
  • Click on the CleanUp! button
  • You will be asked to reboot the machine to finish the Cleanup process. If you are asked to reboot the machine choose Yes.



================




Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:
  1. Disable and Enable System Restore. - You should disable and reenable system restore to make sure there are no infected files found in a restore point left over from what we have just cleaned.

    You can find instructions on how to enable and reenable system restore here:

    Windows XP System Restore Guide

    Renable system restore with instructions from tutorial above

  2. Use an AntiVirus Software - It is very important that your computer has an anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future.

    See this link for a listing of some online & their stand-alone antivirus programs:

    Virus, Spyware, and Malware Protection and Removal Resources

  3. Update your AntiVirus Software - It is imperitive that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.

  4. Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is succeptible to being hacked and taken over. I am very serious about this and see it happen almost every day with my clients. Simply using a Firewall in its default configuration can lower your risk greatly.

    For a tutorial on Firewalls and a listing of some available ones see the link below:

    Understanding and Using Firewalls

  5. Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.

  6. Install Spybot - Search and Destroy - Install and download Spybot - Search and Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with program on a regular basis just as you would an antivirus software.

    A tutorial on installing & using this product can be found here:

    Using Spybot - Search & Destroy to remove Spyware , Malware, and Hijackers

  7. Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.

    A tutorial on installing & using this product can be found here:

    Using SpywareBlaster to protect your computer from Spyware and Malware

  8. Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.
Follow this list and your potential for being infected again will reduce dramatically.

thumbup.gif smile.gif








Posted Image If I have helped you in any way, please consider a donation to help me continue the fight against malware.


Failing to respond back to the person that is giving up their own time to help you not only is insensitive and disrespectful, but it guarantees that you will never receive help from me again. Please thank your helpers and there will always be help here when you need it!


========================================================




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users