 [Resolved] Your System is Infected (Green Screen, Red Letters, Black B |
Welcome! Register for a free account (or login) > How does it work?
|
|
  |
 Feb 1 2010, 09:49 PM
Post
#1
|
|
|
New Member  Group: Authentic Member Posts: 12 Joined: 1-February 10 Member No.: 90,456 Operating System: XP  |
Anyway I ran several virus checkers and spyware checkers as the site recommended (Avast, Kapersky, Malwarebytes, Nod32, Ad-Aware, Avira). Found several other viruses and removed them. However, I have a green main page with a black box in the middleand red lettered words saying "Your System is Infected". Other things to note: Kapersky wouldn't load until I renamed it. Last runs with Nod32 and Malwarebytes came up with no viruses. Kapersky mentioned something in a yellow pop-up window about a possible keylogger and some other files. This might have been a running list. I'm worried about rootkits. I worried about other stuff these virus checkers are not finding. How do I get my screen back? Help!!!! oldbear46 |
 |
 
|
|
Feb 2 2010, 07:38 AM
Post
#2
|
|
 SuperMember  Group: Senior Class Posts: 1,289 Joined: 8-August 08 From: Malaysia Member No.: 80,830 Operating System: Windows XP Professional SP3, Linux Ubuntu 9.10 |
Hello there, oldbear46
 I'm Conspire, I'll be glad to help you with your computer problems. Please observe these rules while we work:
Please be advised, as I am still in training, all my replies to you will be checked for accuracy by one of our experts to ensure that I am giving you the best possible advise. This may cause a delay, but I will do my best to keep it as short as possible. Please bear with me, I will post back to you as soon as I can. IMPORTANT NOTE : Please do not delete anything unless instructed to. |
|
|
|
|
Feb 2 2010, 08:47 AM
Post
#3
|
|
|
New Member Group: Authentic Member Posts: 12 Joined: 1-February 10 Member No.: 90,456 Operating System: XP |
Thank you Conspire. I'm at work so my actions will be delayed after this response to you. I eagerly await your instructions.
oldbear46 |
|
|
|
|
Feb 2 2010, 09:31 PM
Post
#4
|
|
|
SuperMember Group: Senior Class Posts: 1,289 Joined: 8-August 08 From: Malaysia Member No.: 80,830 Operating System: Windows XP Professional SP3, Linux Ubuntu 9.10 |
Hello,
Please download exeHelper to your desktop. Double-click on exeHelper.com to run the fix. A black window should pop up, press any key to close once the fix is completed. Post the contents of exehelperlog.txt (Will be created in the directory where you ran exeHelper.com, and should open at the end of the scan) ===================================================  Download GMER Rootkit Scanner from here or here.
**Caution** Rootkit scans often produce false positives. Do NOT take any action on any "<--- ROOKIT" entries ===================================================
=================================================== On your next reply please post : exeHelper log GMER log OTL log Good Day! |
|
|
|
|
Feb 3 2010, 11:46 AM
Post
#5
|
|
|
New Member Group: Authentic Member Posts: 12 Joined: 1-February 10 Member No.: 90,456 Operating System: XP |
Here's the results of those runs of Malwarebytes, GMER and OTL in that order. Malwarebytes' Anti-Malware 1.44 Database version: 3510 Windows 5.1.2600 Service Pack 2 Internet Explorer 7.0.5730.11 2/2/2010 6:11:11 PM mbam-log-2010-02-02 (18-11-11).txt Scan type: Quick Scan Objects scanned: 120721 Time elapsed: 4 minute(s), 50 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) GMER 1.0.15.15281 - http://www.gmer.net Rootkit scan 2010-02-02 20:13:05 Windows 5.1.2600 Service Pack 2 Running: gmer.exe; Driver: C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\pxddypob.sys ---- System - GMER 1.0.15 ---- SSDT 8964EA70 ZwAssignProcessToJobObject SSDT 8964F5F0 ZwDebugActiveProcess SSDT 8964F020 ZwDuplicateObject SSDT 8964E1B0 ZwOpenProcess SSDT 8964E4B0 ZwOpenThread SSDT 8964EEB0 ZwProtectVirtualMemory SSDT 8964ED50 ZwSetContextThread SSDT 8964EBD0 ZwSetInformationThread SSDT 8964BA90 ZwSetSecurityObject SSDT 8964E910 ZwSuspendProcess SSDT 8964E7B0 ZwSuspendThread SSDT 8964E340 ZwTerminateProcess SSDT 8964E640 ZwTerminateThread SSDT 8964F440 ZwWriteVirtualMemory ---- Devices - GMER 1.0.15 ---- AttachedDevice \FileSystem\Ntfs \Ntfs bb-run.sys (Promise Disk Accelerator/Promise Technology, Inc.) AttachedDevice \FileSystem\Ntfs \Ntfs eamon.sys (Amon monitor/ESET) AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 ELkbd.sys (Intel Corporation) AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 ELkbd.sys (Intel Corporation) AttachedDevice \Driver\Tcpip \Device\Tcp epfwtdir.sys (ESET Antivirus Network Redirector/ESET) AttachedDevice \FileSystem\Fastfat \Fat bb-run.sys (Promise Disk Accelerator/Promise Technology, Inc.) AttachedDevice \FileSystem\Fastfat \Fat fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation) AttachedDevice \FileSystem\Fastfat \Fat eamon.sys (Amon monitor/ESET) Device \FileSystem\Cdfs \Cdfs DLAIFS_M.SYS (Drive Letter Access Component/Sonic Solutions) ---- EOF - GMER 1.0.15 ---- OTL logfile created on: 2/2/2010 8:18:49 PM - Run 1 OTL by OldTimer - Version 3.1.27.1 Folder = C:\Documents and Settings\HP_Administrator\Desktop Windows XP Media Center Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 7.0.5730.11) Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy 2.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 76.00% Memory free 4.00 Gb Paging File | 4.00 Gb Available in Paging File | 92.00% Paging File free Paging file location(s): C:\pagefile.sys 2046 4092 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 289.27 Gb Total Space | 268.52 Gb Free Space | 92.83% Space Free | Partition Type: NTFS Drive D: | 8.80 Gb Total Space | 0.41 Gb Free Space | 4.62% Space Free | Partition Type: FAT32 E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Drive K: | 247.97 Mb Total Space | 5.06 Mb Free Space | 2.04% Space Free | Partition Type: FAT Computer Name: FRANKIE Current User Name: HP_Administrator Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: On Skip Microsoft Files: On File Age = 14 Days Output = Standard Quick Scan ========== Processes (SafeList) ========== PRC - [2010/02/02 17:48:58 | 000,548,864 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\HP_Administrator\Desktop\OTL.exe PRC - [2009/11/16 09:04:30 | 000,735,960 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe PRC - [2009/11/16 09:03:32 | 002,054,360 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe PRC - [2009/03/19 13:07:02 | 001,032,192 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe PRC - [2008/12/19 12:17:24 | 000,333,088 | ---- | M] (Sony Corporation) -- C:\Program Files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe PRC - [2007/03/11 20:34:40 | 000,049,152 | ---- | M] (Hewlett-Packard Co.) -- C:\Program Files\HP\HP Software Update\hpwuSchd2.exe PRC - [2006/10/11 11:45:12 | 000,075,304 | ---- | M] (ScanSoft, Inc.) -- C:\Program Files\ScanSoft\OmniPageSE4.0\OpWareSE4.exe PRC - [2006/07/11 00:00:51 | 000,311,362 | ---- | M] (United Online, Inc.) -- C:\Program Files\NZSearch\nzspc.exe PRC - [2006/06/13 04:20:00 | 000,127,036 | ---- | M] (Sonic Solutions) -- C:\WINDOWS\system32\DLA\DLACTRLW.EXE PRC - [2006/03/24 02:48:44 | 000,073,728 | ---- | M] (Hewlett-Packard Company) -- C:\Program Files\Common Files\LightScribe\LSSrvc.exe PRC - [2006/03/20 10:05:00 | 000,090,112 | ---- | M] (Sonic Solutions) -- C:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe PRC - [2006/03/16 03:12:40 | 001,077,248 | ---- | M] (Digital Interactive Systems Corporation) -- C:\Program Files\DISC\DISCover.exe PRC - [2006/03/16 03:11:54 | 000,061,440 | ---- | M] (Digital Interactive Systems Corporation, Inc.) -- C:\Program Files\DISC\DISCUpdMgr.exe PRC - [2006/03/16 03:11:54 | 000,057,344 | ---- | M] (Digital Interactive Systems Corporation, Inc.) -- C:\Program Files\DISC\DiscStreamHub.exe PRC - [2006/03/08 05:54:04 | 016,010,240 | ---- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\RTHDCPL.EXE PRC - [2006/02/07 09:40:02 | 000,118,784 | ---- | M] (Intel Corporation) -- C:\WINDOWS\system32\igfxpers.exe PRC - [2006/02/07 09:36:06 | 000,077,824 | ---- | M] (Intel Corporation) -- C:\WINDOWS\system32\hkcmd.exe PRC - [2005/11/08 15:51:54 | 000,180,224 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\IntelDH\Intel® Quick Resume Technology\ELService.exe PRC - [2005/10/12 20:30:42 | 000,139,264 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe PRC - [2005/10/12 20:30:24 | 000,086,140 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe PRC - [2005/08/27 02:14:44 | 000,036,975 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe PRC - [2005/02/23 01:44:56 | 000,806,912 | ---- | M] (Intuit, Inc.) -- C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe PRC - [2005/02/02 17:44:24 | 000,061,440 | ---- | M] (Hewlett-Packard Company) -- C:\hp\KBD\kbd.exe PRC - [2003/08/27 13:20:00 | 000,094,208 | R--- | M] (Cypress Semiconductor) -- C:\WINDOWS\SM1bg.exe PRC - [1998/05/07 10:04:38 | 000,052,736 | ---- | M] (Hewlett-Packard Company) -- c:\WINDOWS\system\hpsysdrv.exe ========== Modules (SafeList) ========== MOD - [2010/02/02 17:48:58 | 000,548,864 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\HP_Administrator\Desktop\OTL.exe MOD - [2006/10/04 21:07:12 | 000,144,936 | ---- | M] (ScanSoft, Inc.) -- C:\Program Files\ScanSoft\OmniPageSE4.0\OpHookSE4.dll MOD - [2006/08/25 09:45:55 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll ========== Win32 Services (SafeList) ========== SRV - [2009/11/16 09:12:54 | 000,020,680 | ---- | M] (ESET) [On_Demand | Stopped] -- C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe -- (EhttpSrv) SRV - [2009/11/16 09:04:30 | 000,735,960 | ---- | M] (ESET) [Auto | Running] -- C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe -- (ekrn) SRV - [2007/02/15 21:00:04 | 000,138,168 | ---- | M] (Google) [On_Demand | Stopped] -- C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe -- (gusvc) SRV - [2006/10/31 13:56:28 | 000,052,736 | ---- | M] (Hewlett-Packard) [Auto | Running] -- C:\WINDOWS\system32\HPZIPM12.DLL -- (Pml Driver HPZ12) SRV - [2006/10/31 13:56:24 | 000,043,520 | ---- | M] (Hewlett-Packard) [Auto | Running] -- C:\WINDOWS\system32\HPZINW12.DLL -- (Net Driver HPZ12) SRV - [2006/03/24 02:48:44 | 000,073,728 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Program Files\Common Files\LightScribe\LSSrvc.exe -- (LightScribeService) SRV - [2005/11/08 15:51:54 | 000,180,224 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\IntelDH\Intel® Quick Resume Technology\ELService.exe -- (ELService) SRV - [2005/10/12 20:30:24 | 000,086,140 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe -- (IAANTMon) Intel® SRV - [2004/10/22 11:24:18 | 000,073,728 | ---- | M] (Macrovision Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe -- (IDriverT) SRV - [2003/07/28 20:28:22 | 000,089,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://my.netzero.net/s/search?r=minisearch IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://my.netzero.net/s/search?r=minisearch IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://my.netzero.net/s/search?r=minisearch IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://my.netzero.net/s/search?r=minisearch IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerm...tf8&oe=utf8 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie IE - HKCU\..\URLSearchHook: {37D2CDBF-2AF4-44AA-8113-BD0D2DA3C2B8} - C:\Program Files\NZSearch\SearchEnh1.dll (United Online, Inc.) IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.) IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 FF - HKLM\software\mozilla\Netscape Browser 8.0.4.0\Extensions\\Components: C:\Program Files\Netscape\Netscape Browser\Components [2006/05/28 01:21:38 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Netscape Browser 8.0.4.0\Extensions\\Plugins: C:\Program Files\Netscape\Netscape Browser\Plugins [2007/06/13 16:04:02 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird [2010/02/01 06:47:15 | 000,000,000 | ---D | M] O1 HOSTS File: ([2004/08/10 05:00:00 | 000,000,734 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.) O2 - BHO: (HP Print Enhancer) - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.) O2 - BHO: (HP Print Clips) - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll (Hewlett-Packard Co.) O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (Lexmark Toolbar) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll () O2 - BHO: (Popup-Blocker Class) - {52706EF7-D7A2-49AD-A615-E903858CF284} - C:\Program Files\NetZero\qsacc\X1IEBHO.dll (NetZero, Inc.) O2 - BHO: (DriveLetterAccess) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\DLA\DLASHX_W.DLL (Sonic Solutions) O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\Program Files\Google\GoogleToolbar3.dll (Google Inc.) O2 - BHO: (hpWebHelper Class) - {AAAE832A-5FFF-4661-9C8F-369692D1DCB9} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\WebHelper.dll (TODO: <Company name>) O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll (Google Inc.) O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll (Yahoo! Inc) O3 - HKLM\..\Toolbar: (Lexmark Toolbar) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll () O3 - HKLM\..\Toolbar: (&Google) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar3.dll (Google Inc.) O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.) O3 - HKLM\..\Toolbar: (ZeroBar) - {F0F8ECBE-D460-4B34-B007-56A92E8F84A7} - C:\Program Files\NetZero\Toolbar.dll () O3 - HKCU\..\Toolbar\WebBrowser: (Lexmark Toolbar) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll () O3 - HKCU\..\Toolbar\WebBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar3.dll (Google Inc.) O3 - HKCU\..\Toolbar\WebBrowser: (ZeroBar) - {F0F8ECBE-D460-4B34-B007-56A92E8F84A7} - C:\Program Files\NetZero\Toolbar.dll () O4 - HKLM..\Run: [DISCover] C:\Program Files\DISC\DISCover.exe (Digital Interactive Systems Corporation) O4 - HKLM..\Run: [DiscUpdateManager] C:\Program Files\DISC\DISCUpdMgr.exe (Digital Interactive Systems Corporation, Inc.) O4 - HKLM..\Run: [DLA] C:\WINDOWS\system32\DLA\DLACTRLW.EXE (Sonic Solutions) O4 - HKLM..\Run: [DMAScheduler] c:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe (Sonic Solutions) O4 - HKLM..\Run: [egui] C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe (ESET) O4 - HKLM..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\hpwuSchd2.exe (Hewlett-Packard Co.) O4 - HKLM..\Run: [HPBootOp] C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe (Hewlett-Packard Company) O4 - HKLM..\Run: [HPHUPD08] c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe (Hewlett-Packard) O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation) O4 - HKLM..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe (Intel Corporation) O4 - HKLM..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe (Intel Corporation) O4 - HKLM..\Run: [KernelFaultCheck] File not found O4 - HKLM..\Run: [OpwareSE4] C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe (ScanSoft, Inc.) O4 - HKLM..\Run: [PCDrProfiler] File not found O4 - HKLM..\Run: [Recguard] C:\WINDOWS\SMINST\Recguard.exe () O4 - HKLM..\Run: [Reminder] C:\Windows\Creator\Remind_XP.exe (SoftThinks) O4 - HKLM..\Run: [RTHDCPL] C:\WINDOWS\RTHDCPL.EXE (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [SM1BG] C:\WINDOWS\SM1bg.exe (Cypress Semiconductor) O4 - HKLM..\Run: [SSBkgdUpdate] C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe (Nuance Communications, Inc.) O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.) O4 - HKCU..\Run: [spc_w] C:\Program Files\NZSearch\nzspc.exe (United Online, Inc.) O4 - HKCU..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe (Adobe Systems Incorporated) O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated) O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe (Intuit, Inc.) O4 - Startup: C:\Documents and Settings\HP_Administrator\Start Menu\Programs\Startup\PMB Media Check Tool.lnk = C:\Program Files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe (Sony Corporation) O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme () O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8 - Extra context menu item: Display All Images with Full Quality - C:\Program Files\NetZero\qsacc\appres.dll (NetZero, Inc.) O8 - Extra context menu item: Display Image with Full Quality - C:\Program Files\NetZero\qsacc\appres.dll (NetZero, Inc.) O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\NPJPI150_05.dll (Sun Microsystems, Inc.) O9 - Extra Button: HP Clipbook - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll (Hewlett-Packard Co.) O9 - Extra Button: HP Smart Select - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll (Hewlett-Packard Co.) O9 - Extra Button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe File not found O9 - Extra 'Tools' menuitem : PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe File not found O9 - Extra Button: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm () O9 - Extra 'Tools' menuitem : Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm () O9 - Extra Button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe () O9 - Extra 'Tools' menuitem : PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe () O15 - HKLM\..Trusted Domains: trymedia.com ([]http in Trusted sites) O15 - HKLM\..Trusted Domains: trymedia.com ([]https in Trusted sites) O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone. O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} http://gfx1.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab (MSN Photo Upload Tool) O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} http://gfx1.hotmail.com/mail/w4/pr01/photo...ol/MSNPUpld.cab (Windows Live Hotmail Photo Upload Tool) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation) O24 - Desktop WallPaper: O24 - Desktop BackupWallPaper: C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Microsoft\Wallpaper1.bmp O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006/05/28 01:33:34 | 000,000,100 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O32 - AutoRun File - [2001/07/27 15:07:38 | 000,000,000 | -HS- | M] () - D:\AUTOEXEC.BAT -- [ FAT32 ] O32 - AutoRun File - [2004/04/30 07:01:14 | 000,000,053 | -HS- | M] () - D:\Autorun.inf -- [ FAT32 ] O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - comfile [open] -- "%1" %* O35 - exefile [open] -- "%1" %* NetSvcs: 6to4 - File not found NetSvcs: Ias - C:\WINDOWS\system32\ias [2005/11/14 20:13:14 | 000,000,000 | ---D | M] NetSvcs: Iprip - File not found NetSvcs: Irmon - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: WmdmPmSp - File not found CREATERESTOREPOINT Restore point Set: OTL Restore Point (53765057741324288) ========== Files/Folders - Created Within 14 Days ========== [2010/02/02 20:04:25 | 000,548,864 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\HP_Administrator\Desktop\OTL.exe [2010/02/02 18:12:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\HP_Administrator\Desktop\gmer [2010/02/02 18:04:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT [2010/02/02 18:02:38 | 000,000,000 | ---D | C] -- C:\Program Files\ERUNT [2010/02/02 17:57:37 | 000,791,393 | ---- | C] (Lars Hederer ) -- C:\Documents and Settings\HP_Administrator\Desktop\erunt_setup.exe [2010/02/02 17:57:27 | 000,439,808 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\HP_Administrator\Desktop\TFC.exe [2010/02/01 07:37:31 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\HP_Administrator\Recent [2010/02/01 06:47:14 | 000,000,000 | ---D | C] -- C:\Program Files\ESET [2010/02/01 06:47:14 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\ESET [2010/02/01 05:38:47 | 000,000,000 | ---D | C] -- C:\Documents and Settings\HP_Administrator\Application Data\Malwarebytes [2010/02/01 05:38:41 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys [2010/02/01 05:38:39 | 000,019,160 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [2010/02/01 05:38:39 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2010/02/01 05:38:39 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes [2010/01/31 20:27:15 | 000,000,000 | ---D | C] -- C:\Program Files\Alwil Software [2010/01/31 20:27:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Alwil Software [2010/01/31 18:57:55 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Lavasoft [2010/01/31 18:03:26 | 005,115,824 | ---- | C] (Malwarebytes Corporation ) -- C:\Documents and Settings\HP_Administrator\Desktop\bites.exe [2010/01/31 18:03:16 | 000,891,248 | ---- | C] (AVG Technologies) -- C:\Documents and Settings\HP_Administrator\Desktop\average.exe [2010/01/31 18:03:03 | 069,672,352 | ---- | C] (Kaspersky Lab) -- C:\Documents and Settings\HP_Administrator\Desktop\cap.exe [2010/01/31 18:02:53 | 091,338,304 | ---- | C] (Lavasoft ) -- C:\Documents and Settings\HP_Administrator\Desktop\wear.exe [2010/01/23 06:44:57 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Yahoo! Companion [2010/01/23 06:44:57 | 000,000,000 | ---D | C] -- C:\Documents and Settings\HP_Administrator\Application Data\Yahoo! [2010/01/23 06:44:55 | 000,000,000 | ---D | C] -- C:\Program Files\Yahoo! [2010/01/23 06:44:53 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner [2010/01/23 06:10:34 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy [2010/01/23 03:32:04 | 000,055,656 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntflt.sys [2010/01/22 21:02:39 | 003,357,024 | ---- | C] (Piriform Ltd) -- C:\Documents and Settings\HP_Administrator\Desktop\ccsetup227.exe [2010/01/22 20:19:35 | 016,409,960 | ---- | C] (Safer Networking Limited ) -- C:\Documents and Settings\HP_Administrator\Desktop\spybotsd162.exe [2007/12/16 13:31:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\HP [2007/11/08 19:37:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft [2007/11/08 19:37:21 | 000,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Application Data\Microsoft [2006/10/10 20:28:06 | 000,036,963 | R--- | C] (Cypress Semiconductor) -- C:\Program Files\Common Files\SM1updtr.dll [2006/05/28 00:43:01 | 000,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Application Data\Microsoft [2006/05/28 00:43:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft [2006/02/19 11:28:56 | 000,012,288 | ---- | C] (Hewlett-Packard Development Company, L.P.) -- C:\WINDOWS\Fonts\RandFont.dll [2 C:\Documents and Settings\All Users\*.tmp files -> C:\Documents and Settings\All Users\*.tmp -> ] ========== Files - Modified Within 14 Days ========== [2010/02/02 18:50:51 | 000,000,247 | ---- | M] () -- C:\WINDOWS\System\hpsysdrv.dat [2010/02/02 18:49:28 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2010/02/02 18:49:22 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2010/02/02 18:49:19 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2010/02/02 18:49:18 | 2137,481,216 | -HS- | M] () -- C:\hiberfil.sys [2010/02/02 18:47:29 | 004,718,592 | ---- | M] () -- C:\Documents and Settings\HP_Administrator\NTUSER.DAT [2010/02/02 18:02:43 | 000,000,622 | ---- | M] () -- C:\Documents and Settings\HP_Administrator\Desktop\NTREGOPT.lnk [2010/02/02 18:02:43 | 000,000,603 | ---- | M] () -- C:\Documents and Settings\HP_Administrator\Desktop\ERUNT.lnk [2010/02/02 17:59:30 | 000,000,278 | -HS- | M] () -- C:\Documents and Settings\HP_Administrator\ntuser.ini [2010/02/02 17:48:58 | 000,548,864 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\HP_Administrator\Desktop\OTL.exe [2010/02/02 17:48:18 | 000,284,915 | ---- | M] () -- C:\Documents and Settings\HP_Administrator\Desktop\gmer.zip [2010/02/02 17:47:52 | 000,791,393 | ---- | M] (Lars Hederer ) -- C:\Documents and Settings\HP_Administrator\Desktop\erunt_setup.exe [2010/02/02 17:47:26 | 000,439,808 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\HP_Administrator\Desktop\TFC.exe [2010/02/01 06:54:01 | 000,002,577 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT [2010/02/01 05:38:44 | 000,000,707 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk [2010/01/31 19:05:50 | 000,000,472 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job [2010/01/31 17:03:06 | 091,338,304 | ---- | M] (Lavasoft ) -- C:\Documents and Settings\HP_Administrator\Desktop\wear.exe [2010/01/31 17:01:12 | 005,115,824 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\HP_Administrator\Desktop\bites.exe [2010/01/31 16:59:16 | 000,891,248 | ---- | M] (AVG Technologies) -- C:\Documents and Settings\HP_Administrator\Desktop\average.exe [2010/01/31 16:57:10 | 035,001,856 | ---- | M] () -- C:\Documents and Settings\HP_Administrator\Desktop\thirty.msi [2010/01/31 16:57:08 | 069,672,352 | ---- | M] (Kaspersky Lab) -- C:\Documents and Settings\HP_Administrator\Desktop\cap.exe [2010/01/31 16:52:28 | 042,044,328 | ---- | M] () -- C:\Documents and Settings\HP_Administrator\Desktop\free.exe [2010/01/31 15:25:13 | 000,262,144 | ---- | M] () -- C:\Documents and Settings\All Users\NTUSER.DAT [2010/01/31 15:24:58 | 000,000,312 | -HS- | M] () -- C:\boot.ini [2010/01/23 10:02:31 | 000,004,757 | ---- | M] () -- C:\WINDOWS\wininit.ini [2010/01/23 09:36:12 | 000,000,000 | ---- | M] () -- C:\WINDOWS\System32\IS15.exe [2010/01/23 09:36:11 | 000,002,931 | ---- | M] () -- C:\WINDOWS\System32\warning.html [2010/01/23 06:57:50 | 000,001,559 | ---- | M] () -- C:\Documents and Settings\HP_Administrator\Desktop\CCleaner.lnk [2010/01/23 06:40:05 | 003,357,024 | ---- | M] (Piriform Ltd) -- C:\Documents and Settings\HP_Administrator\Desktop\ccsetup227.exe [2010/01/23 05:27:08 | 016,409,960 | ---- | M] (Safer Networking Limited ) -- C:\Documents and Settings\HP_Administrator\Desktop\spybotsd162.exe [2010/01/23 00:47:47 | 030,909,992 | ---- | M] () -- C:\Documents and Settings\HP_Administrator\Desktop\avira_antivir_personal_en.exe [2010/01/22 16:33:36 | 000,002,495 | ---- | M] () -- C:\Documents and Settings\HP_Administrator\Desktop\Microsoft Office Excel 2003.lnk [2 C:\Documents and Settings\All Users\*.tmp files -> C:\Documents and Settings\All Users\*.tmp -> ] ========== Files Created - No Company Name ========== [2010/02/02 18:11:41 | 000,293,376 | ---- | C] () -- C:\Documents and Settings\HP_Administrator\Desktop\gmer.exe [2010/02/02 18:02:43 | 000,000,622 | ---- | C] () -- C:\Documents and Settings\HP_Administrator\Desktop\NTREGOPT.lnk [2010/02/02 18:02:43 | 000,000,603 | ---- | C] () -- C:\Documents and Settings\HP_Administrator\Desktop\ERUNT.lnk [2010/02/02 17:57:30 | 000,284,915 | ---- | C] () -- C:\Documents and Settings\HP_Administrator\Desktop\gmer.zip [2010/02/01 05:38:44 | 000,000,707 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk [2010/01/31 19:05:24 | 000,000,472 | ---- | C] () -- C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job [2010/01/31 18:03:20 | 035,001,856 | ---- | C] () -- C:\Documents and Settings\HP_Administrator\Desktop\thirty.msi [2010/01/31 18:03:10 | 042,044,328 | ---- | C] () -- C:\Documents and Settings\HP_Administrator\Desktop\free.exe [2010/01/30 20:54:35 | 2137,481,216 | -HS- | C] () -- C:\hiberfil.sys [2010/01/23 06:44:53 | 000,001,559 | ---- | C] () -- C:\Documents and Settings\HP_Administrator\Desktop\CCleaner.lnk [2010/01/22 21:02:25 | 030,909,992 | ---- | C] () -- C:\Documents and Settings\HP_Administrator\Desktop\avira_antivir_personal_en.exe [2009/08/27 14:02:38 | 000,194,376 | ---- | C] () -- C:\Documents and Settings\HP_Administrator\Application Data\shb.dat [2009/03/30 20:36:22 | 000,758,870 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\LuUninstall.LiveUpdate [2007/10/31 20:43:27 | 000,000,447 | ---- | C] () -- C:\WINDOWS\brwmark.ini [2007/09/02 13:15:34 | 000,000,506 | ---- | C] () -- C:\WINDOWS\hegames.ini [2007/08/01 18:37:12 | 000,010,593 | ---- | C] () -- C:\WINDOWS\CSTBox.INI [2007/08/01 18:32:45 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\IPPCPUID.DLL [2007/08/01 18:32:28 | 000,011,776 | ---- | C] () -- C:\WINDOWS\System32\pmsbfn32.dll [2007/08/01 18:16:16 | 000,000,416 | ---- | C] () -- C:\WINDOWS\MAXLINK.INI [2006/10/08 19:00:59 | 000,000,016 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\DragToDiscUserNameE.txt [2006/10/04 19:46:53 | 000,000,040 | ---- | C] () -- C:\WINDOWS\opt_1440.ini [2006/10/04 19:46:52 | 000,000,058 | ---- | C] () -- C:\WINDOWS\brmx2001.ini [2006/10/04 19:44:58 | 000,000,059 | ---- | C] () -- C:\WINDOWS\BRVIDEO.INI [2006/10/04 19:44:58 | 000,000,039 | ---- | C] () -- C:\WINDOWS\BRDIAG.INI [2006/10/04 19:44:58 | 000,000,030 | ---- | C] () -- C:\WINDOWS\HL-1440.INI [2006/10/04 19:44:58 | 000,000,023 | ---- | C] () -- C:\WINDOWS\Brownie.ini [2006/10/04 19:38:28 | 000,000,052 | ---- | C] () -- C:\WINDOWS\BRPP2KA.INI [2006/10/04 07:16:10 | 000,000,139 | ---- | C] () -- C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\fusioncache.dat [2006/10/03 19:25:35 | 000,014,848 | ---- | C] () -- C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2006/05/28 01:58:55 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini [2006/05/28 01:39:31 | 000,028,848 | ---- | C] () -- C:\WINDOWS\System32\drivers\USBkey.sys [2006/05/28 01:35:46 | 000,014,317 | ---- | C] () -- C:\WINDOWS\System32\CHODDI.SYS [2006/05/28 01:35:40 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\hpreg.dll [2006/05/28 01:33:47 | 000,000,031 | ---- | C] () -- C:\WINDOWS\QUICKEN.INI [2006/05/28 01:31:47 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI [2006/05/28 01:22:16 | 000,004,757 | ---- | C] () -- C:\WINDOWS\wininit.ini [2006/05/28 01:21:40 | 000,000,698 | ---- | C] () -- C:\WINDOWS\NSSetDefaultBrowser.ini [2006/05/28 01:10:41 | 000,010,184 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\hpzinstall.log [2006/05/28 01:09:48 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini [2006/05/28 01:08:02 | 000,102,400 | ---- | C] () -- C:\WINDOWS\System32\hcwXDS.dll [2006/05/28 01:06:23 | 000,000,791 | ---- | C] () -- C:\WINDOWS\orun32.ini [2006/05/28 00:45:09 | 000,323,584 | ---- | C] () -- C:\WINDOWS\System32\pythoncom22.dll [2006/05/28 00:45:09 | 000,094,208 | ---- | C] () -- C:\WINDOWS\System32\pywintypes22.dll [2006/05/28 00:44:52 | 000,016,896 | ---- | C] () -- C:\WINDOWS\System32\bcbmm.dll [2006/03/17 18:23:44 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini [2005/08/05 22:01:54 | 000,239,104 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll [2004/07/26 08:51:38 | 000,000,560 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini [2003/01/07 14:05:08 | 000,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI [2001/07/06 23:30:00 | 000,003,399 | ---- | C] () -- C:\WINDOWS\System32\hptcpmon.ini [2000/09/13 19:00:00 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\BROSNMP.DLL ========== LOP Check ========== [2010/01/31 20:27:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Alwil Software [2006/05/28 01:20:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Digital Interactive Systems Corporation [2010/02/01 06:47:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ESET [2006/10/10 20:27:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Napster [2007/08/08 14:16:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\NetZero [2007/08/01 18:16:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ScanSoft [2010/01/17 14:15:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP [2006/10/02 22:31:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint [2010/01/31 19:05:50 | 000,000,472 | ---- | M] () -- C:\WINDOWS\Tasks\Ad-Aware Update (Weekly).job ========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\*.exe > [2005/12/27 01:21:54 | 007,477,561 | ---- | M] (Intel Corporation ) -- C:\setup_all.exe < MD5 for: AGP440.SYS > [2004/08/10 05:00:00 | 016,971,599 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys [2004/08/09 15:00:00 | 016,971,599 | ---- | M] () .cab file -- C:\WINDOWS\I386\sp2.cab:AGP440.sys < MD5 for: ATAPI.SYS > [2004/08/10 05:00:00 | 016,971,599 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys [2004/08/09 15:00:00 | 016,971,599 | ---- | M] () .cab file -- C:\WINDOWS\I386\sp2.cab:atapi.sys [2004/08/04 06:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\dllcache\atapi.sys [2004/08/04 06:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\drivers\atapi.sys [2004/08/09 22:00:00 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\system32\ReinstallBackups\0002\DriverFiles\i386\atapi.sys < MD5 for: EVENTLOG.DLL > [2004/08/09 22:00:00 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 -- C:\WINDOWS\system32\dllcache\eventlog.dll [2004/08/09 22:00:00 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 -- C:\WINDOWS\system32\eventlog.dll < MD5 for: IASTOR.SYS > [2005/10/12 13:07:12 | 000,874,240 | ---- | M] (Intel Corporation) MD5=309C4D86D989FB1FCF64BD30DC81C51B -- C:\cmdcons\iastor.sys [2005/10/12 13:07:12 | 000,874,240 | ---- | M] (Intel Corporation) MD5=309C4D86D989FB1FCF64BD30DC81C51B -- C:\hp\drivers\Intel_SATA_RAID_ICH7DH\iastor.sys [2005/10/12 20:07:12 | 000,874,240 | ---- | M] (Intel Corporation) MD5=309C4D86D989FB1FCF64BD30DC81C51B -- C:\Program Files\Intel\Intel Matrix Storage Manager\Driver\iaStor.sys [2005/10/12 20:07:12 | 000,874,240 | ---- | M] (Intel Corporation) MD5=309C4D86D989FB1FCF64BD30DC81C51B -- C:\WINDOWS\system32\drivers\iaStor.sys [2005/10/12 13:07:12 | 000,874,240 | ---- | M] (Intel Corporation) MD5=309C4D86D989FB1FCF64BD30DC81C51B -- C:\WINDOWS\system32\ReinstallBackups\0009\DriverFiles\iaStor.sys [2005/10/12 20:08:52 | 000,508,416 | ---- | M] (Intel Corporation) MD5=7C2D98D430DD91570DB63E819B9BC7E0 -- C:\Program Files\Intel\Intel Matrix Storage Manager\Driver64\IaStor.sys [2005/06/17 07:33:40 | 000,872,064 | ---- | M] (Intel Corporation) MD5=9A65E42664D1534B68512CAAD0EFE963 -- C:\hp\drivers\Intel_5_1_0_1022_PV\iastor.sys < MD5 for: NETLOGON.DLL > [2009/02/06 12:46:09 | 000,408,064 | ---- | M] (Microsoft Corporation) MD5=6C476D33D82F1054849790181E8F7772 -- C:\WINDOWS\$hf_mig$\KB968389\SP2QFE\netlogon.dll [2009/02/06 12:46:09 | 000,408,064 | ---- | M] (Microsoft Corporation) MD5=6C476D33D82F1054849790181E8F7772 -- C:\WINDOWS\$hf_mig$\KB975467\SP2QFE\netlogon.dll [2004/08/09 22:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A -- C:\WINDOWS\system32\dllcache\netlogon.dll [2004/08/09 22:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A -- C:\WINDOWS\system32\netlogon.dll < MD5 for: SCECLI.DLL > [2004/08/09 22:00:00 | 000,180,224 | ---- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A -- C:\WINDOWS\system32\dllcache\scecli.dll [2004/08/09 22:00:00 | 000,180,224 | ---- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A -- C:\WINDOWS\system32\scecli.dll < %systemroot%\*. /mp /s > < %systemroot%\system32\*.dll /lockedfiles > < %systemroot%\Tasks\*.job /lockedfiles > < %systemroot%\system32\drivers\*.sys /lockedfiles > < %systemroot%\System32\config\*.sav > [2005/08/30 14:51:10 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav [2005/08/30 14:51:10 | 000,659,456 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav [2005/08/30 14:51:10 | 000,888,832 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav ========== Alternate Data Streams ========== @Alternate Data Stream - 115 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A8ADE5D8 @Alternate Data Stream - 114 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D1B5B4F1 @Alternate Data Stream - 103 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2 < End of report > OTL Extras logfile created on: 2/2/2010 8:18:49 PM - Run 1 OTL by OldTimer - Version 3.1.27.1 Folder = C:\Documents and Settings\HP_Administrator\Desktop Windows XP Media Center Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 7.0.5730.11) Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy 2.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 76.00% Memory free 4.00 Gb Paging File | 4.00 Gb Available in Paging File | 92.00% Paging File free Paging file location(s): C:\pagefile.sys 2046 4092 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 289.27 Gb Total Space | 268.52 Gb Free Space | 92.83% Space Free | Partition Type: NTFS Drive D: | 8.80 Gb Total Space | 0.41 Gb Free Space | 4.62% Space Free | Partition Type: FAT32 E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Drive K: | 247.97 Mb Total Space | 5.06 Mb Free Space | 2.04% Space Free | Partition Type: FAT Computer Name: FRANKIE Current User Name: HP_Administrator Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: On Skip Microsoft Files: On File Age = 14 Days Output = Standard Quick Scan ========== Extra Registry (SafeList) ========== ========== File Associations ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .html [@ = htmlfile] -- C:\Program Files\Internet Explorer\IEXPLORE.EXE (Microsoft Corporation) ========== Shell Spawning ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* exefile [open] -- "%1" %* htmlfile [edit] -- "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation) htmlfile [open] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome (Microsoft Corporation) htmlfile [opennew] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation) htmlfile [print] -- "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" /p %1 (Microsoft Corporation) http [open] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome (Microsoft Corporation) https [open] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation) scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation) Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation) Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation) CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation) ========== Security Center Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "FirstRunDisabled" = 1 "AntiVirusDisableNotify" = 0 "FirewallDisableNotify" = 0 "UpdatesDisableNotify" = 0 "AntiVirusOverride" = 0 "FirewallOverride" = 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] "DisableMonitoring" = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus] "DisableMonitoring" = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall] "DisableMonitoring" = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "EnableFirewall" = 1 "DoNotAllowExceptions" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List] "1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007 ========== Authorized Applications List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] "C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe" = C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe:*:Enabled:Updates from HP -- (Hewlett-Packard) "C:\Program Files\Lexmark 1400 Series\app4r.exe" = C:\Program Files\Lexmark 1400 Series\App4R.exe:*:Enabled:BorgListener -- File not found [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "C:\Program Files\DISC\DISCover.exe" = C:\Program Files\DISC\DISCover.exe:*:Enabled:DISCover Drop & Play System -- (Digital Interactive Systems Corporation) "C:\Program Files\DISC\DiscStreamHub.exe" = C:\Program Files\DISC\DiscStreamHub.exe:*:Enabled:DISCover Stream Hub -- (Digital Interactive Systems Corporation, Inc.) "C:\Program Files\DISC\myFTP.exe" = C:\Program Files\DISC\myFTP.exe:*:Enabled:DISCover FTP -- (Digital Interactive Systems Corporation, Inc.) "C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe" = C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe:*:Enabled:Updates from HP -- (Hewlett-Packard) "C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" = C:\Program Files\EarthLink TotalAccess\TaskPanl.exe:*:Enabled:Earthlink -- File not found "C:\WINDOWS\system32\lxdjcoms.exe" = C:\WINDOWS\system32\lxdjcoms.exe:*:Enabled:Lexmark Communications System -- File not found "C:\Program Files\Lexmark 1400 Series\lxdjamon.exe" = C:\Program Files\Lexmark 1400 Series\lxdjamon.exe:*:Enabled:Lexmark Device Monitor -- File not found "C:\Program Files\Lexmark 1400 Series\app4r.exe" = C:\Program Files\Lexmark 1400 Series\app4r.exe:*:Enabled:Lexmark Imaging Studio -- File not found "C:\Documents and Settings\HP_Administrator\Local Settings\Temp\lxdj\wireless\ENGLISH\lxdjwpss.exe" = C:\Documents and Settings\HP_Administrator\Local Settings\Temp\lxdj\wireless\ENGLISH\lxdjwpss.exe:*:Enabled: -- File not found "C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdjjswx.exe" = C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdjjswx.exe:*:Enabled: -- File not found "C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdjpswx.exe" = C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdjpswx.exe:*:Enabled: -- File not found "C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdjtime.exe" = C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdjtime.exe:*:Enabled: -- File not found "C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe:*:Enabled:hpqtra08.exe -- File not found "C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe -- (Hewlett-Packard Co.) "C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe" = C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe -- (Hewlett-Packard Co.) "C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe" = C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe -- (Hewlett-Packard Co.) "C:\Program Files\HP\Digital Imaging\bin\hposid01.exe" = C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe -- (Hewlett-Packard Co.) "C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe:*:Enabled:hpqscnvw.exe -- () "C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe -- (Hewlett-Packard) "C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe:*:Enabled:hpqcopy.exe -- (Hewlett-Packard Co.) "C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe" = C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe:*:Enabled:hpfccopy.exe -- File not found "C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe" = C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe -- (Hewlett-Packard Co.) "C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe" = C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe:*:Enabled:hpqphunl.exe -- (Hewlett-Packard) "C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe" = C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe:*:Enabled:hpqdia.exe -- ( ) "C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe" = C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe -- (Hewlett-Packard Co.) "C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe:*:Enabled:hpqnrs08.exe -- (Hewlett-Packard Development Company, L.P.) ========== HKEY_LOCAL_MACHINE Uninstall List ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{075473F5-846A-448B-BCB3-104AA1760205}" = Sonic RecordNow Data "{0A65A3BD-54B5-4d0d-B084-7688507813F5}" = SlideShow "{0B33B738-AD79-4E32-90C5-E67BFB10BBFF}" = AiO_Scan "{1017A80C-6F09-4548-A84D-EDD6AC9525F0}" = Lexmark Toolbar "{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_CNQ2411" = CanoScan LiDE 70 "{1206EF92-2E83-4859-ACCB-2048C3CB7DA6}" = Sonic UDF Reader "{1341D838-719C-4A05-B50F-49420CA1B4BB}" = HP Boot Optimizer "{14291118-0C19-45EA-A4FA-5C1C0F5FDE09}" = Primo "{14374622-0900-4056-BA06-C87C900AF9E6}" = QuickBooks Pro 2005 "{15C0AF59-4877-49B6-B8C6-A61CE54515F5}" = cp_OnlineProjectsConfig "{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 "{21657574-BD54-48A2-9450-EB03B2C7FC29}" = Sonic MyDVD Plus "{23012310-3E05-46A5-88A9-C6CBCABCAC79}" = Customer Experience Enhancement "{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer "{2376813B-2E5A-4641-B7B3-A0D5ADB55229}" = HPPhotoSmartExpress "{27428D1B-8CBA-4EEA-B9C0-A23CA7B4FCC1}" = muvee autoProducer 5.0 "{27E395E5-EB04-4BFD-96C3-C9A102E97E1B}" = Intel® Viiv™ Software "{2C5D07FB-31A2-4F2D-9FDA-0B24ACD42BD0}" = HP Deskjet Printer Preload "{2E0695EE-ED29-4D96-BD77-2A9A17EDF0D6}" = Cypress USB Mass Storage Driver Installation "{2F58D60D-2BFD-4467-9B4D-64E7355C329D}" = Sonic_PrimoSDK "{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Sonic Update Manager "{3248F0A8-6813-11D6-A77B-00B0D0150050}" = J2SE Runtime Environment 5.0 Update 5 "{33BF0960-DBA3-4187-B6CC-C969FCFA2D25}" = SkinsHP1 "{33D6CC28-9F75-4d1b-A11D-98895B3A3729}" = HP Photosmart 330,380,420,470,7800,8000,8200 Series "{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP "{352F5013-07DC-446D-8DB6-38F339086C60}" = LightScribe 1.4.84.1 "{36D620AD-EEBA-4973-BA86-0C9AE6396620}" = OptionalContentQFolder "{3CF99DC3-38FD-46E6-A6B4-9C70074E020C}" = DocumentViewer "{415CDA53-9100-476F-A7B2-476691E117C7}" = HP Smart Web Printing "{41E776A5-9B12-416D-9A12-B4F7B044EBED}" = CP_Package_Basic1 "{45D707E9-F3C4-11D9-A373-0050BAE317E1}" = HP DVD Play 2.1 "{47253C9A-7269-4be7-8BFE-50470F6897FE}" = HP Photosmart Printer Software 9.0 "{487B0B9B-DCD4-440D-89A0-A6EDE1A545A3}" = HPSSupply "{543E938C-BDC4-4933-A612-01293996845F}" = UnloadSupport "{54E3707F-808E-4fd4-95C9-15D1AB077E5D}" = NewCopy "{5B79CFD1-6845-4158-9D7D-6BE89DF2C135}" = HP PSC & OfficeJet 5.3.B "{5D61626A-BD55-4e42-82EE-4AE89D8FD050}" = HP Photosmart Cameras 6.0 "{5FDD0538-C67A-4F67-B3F8-09D1AAF04D99}" = muvee autoProducer unPlugged 2.0 "{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Sonic Express Labeler "{6696D9A4-28A8-4F5A-8E9A-2E8974C8C39C}" = RandMap "{6864ABC3-A982-436B-BEF1-5652D6303361}" = ESET NOD32 Antivirus "{68763C27-235D-4165-A961-FDEA228CE504}" = AiOSoftwareNPI "{6A118C80-B382-41c0-8907-CDD0BF5EFE6E}" = CameraDrivers "{6C651250-2EB2-11D5-8E33-0050DAD72AC2}" = NetZero Internet "{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}" = Microsoft .NET Framework 2.0 "{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable "{729DF902-05F9-4C00-9E6D-411119824E5F}" = hpiCamDrvQFolder "{736C803C-DD3B-4015-BC51-AFB9E67B9076}" = Readme "{755EC5E3-FD51-46bd-A57F-7A2D56FBF061}" = PSTAPlugin "{769A295C-DCF4-41d6-AFBA-7D9394B23AFE}" = PSPrinters08 "{7850A6D2-CBEA-4728-9877-F1BEDEA9F619}" = AiOSoftware "{8105684D-8CA6-440D-8F58-7E5FD67A499D}" = Easy Internet Sign-up "{82081779-4175-4666-A457-AB711CD37EF0}" = cp_LightScribeConfig "{829DAAD6-BB11-4BB7-921B-07FFB703F944}" = CP_Package_Variety3 "{82E55892-6FFD-403F-AA97-D726846768AA}" = CP_AtenaShokunin1Config "{85309D89-7BE9-4094-BB17-24999C6118FC}" = ArcSoft PhotoStudio 5.5 "{866A0078-DEA7-4348-9C9A-999AF2991EAA}" = SlideShowMusic "{8A534F71-3202-4464-A422-B767295E67B9}" = CP_Package_Variety2 "{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel® Graphics Media Accelerator Driver "{8C22F265-DE76-44D1-8A79-A71D819137DA}" = Intel® Quick Resume Technology Drivers "{8CE4E6E9-9D55-43FB-9DDB-688C976BFC05}" = Unload "{901B0409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Word 2003 "{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel Matrix Storage Manager "{90A40409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office 2003 Web Components "{91120409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Standard Edition 2003 "{93E5A317-24EC-4744-812C-16FECFE86E6A}" = CP_Package_Variety1 "{9860A9CF-7E71-43AC-888F-0B4D3EA212D1}" = Roxio Burn Engine "{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 "{A29800BA-0BF1-4E63-9F31-DF05A87F4104}" = InstantShareDevices "{A3455242-DAE0-4523-8242-FD82706ABF4B}" = CameraDrivers "{AB708C9B-97C8-4AC9-899B-DBF226AC9382}" = Sonic RecordNow Audio "{AC76BA86-7AD7-1033-7B44-A70900000002}" = Adobe Reader 7.0.9 "{AEA07F97-9088-497c-8821-0F36BD5DC251}" = HPProductAssistant "{B12665F4-4E93-4AB4-B7FC-37053B524629}" = Sonic RecordNow Copy "{B2157760-AA3C-4E2E-BFE6-D20BC52495D9}" = cp_PosterPrintConfig "{B6286A44-7505-471A-A72B-04EC2DB2F442}" = CueTour "{B69CFE29-FD03-4E0A-87A7-6ED97F98E5B3}" = CP_Panorama1Config "{B9DD2DE0-27BE-4e6b-AAD8-0D960ABF87FD}" = CameraUserGuides "{BBBCAE4B-B416-4182-A6F2-438180894A81}" = Napster "{BF4E9ED0-EF26-4A4C-A123-6A6A1ABEE411}" = DocProc "{C13AF9C7-8E06-4354-B629-DF6192CE4A66}" = PANTECH UM175 Driver "{C1C6767D-B395-43CB-BF99-051B58B86DA6}" = PhotoGallery "{C1E693A4-B1D5-4DCD-B68D-2087835B7184}" = ScanSoft OmniPage SE 4.0 "{C3FAA091-B278-44A7-BF48-190811C5F9F7}" = cp_UpdateProjectsConfig "{C6812939-B117-48E6-A3BA-1709C14A3C8C}" = Scan "{C6941FEB-0595-4ff5-8F31-B6F4B31C031F}" = D7200_Help "{C8753E28-2680-49BF-BD48-DD38FD086EFE}" = AiO_Scan_CDA "{C98E8D9D-21DE-4F87-A9B7-142BB89840FC}" = Toolbox "{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1 "{CE24344F-DFD8-40C8-8FD8-C9740B5F25AC}" = Fax "{D2D6B9EB-C6DC-4DAA-B4DE-BB7D9735E7DA}" = Presto! PageManager 7.15.14 "{D5068583-D569-468B-9755-5FBF5848F46F}" = Sony Picture Utility "{DAAD5187-62C5-4AD6-A526-803C18C4944D}" = HP Web Helper "{DABF43D9-1104-4764-927B-5BED1274A3B0}" = Runtime "{DB518BA6-CB74-4EB6-9ABD-880B6D6E1F38}" = HpSdpAppCoreApp "{E2662C24-B31E-4349-A084-32EB76E8B760}" = BufferChm "{E5A8DDAB-AE80-48C6-A75B-D0FAB83B299D}" = HP PSC & OfficeJet 6.1.A "{ED2C557E-9C18-41FF-B58E-A05EEF0B3B5F}" = CP_CalendarTemplates1 "{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver "{F1E63043-54FC-429B-AB2C-31AF9FBA4BC7}" = 32 Bit HP CIO Components Installer "{F6076EF9-08E1-442F-B6A2-BFB61B295A14}" = Fax_CDA "{F80239D8-7811-4D5E-B033-0D0BBFE32920}" = HP DigitalMedia Archive "{FBB980B0-63F8-4B48-8D65-90F1D9F81D9F}" = NewCopy_CDA "Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX "Canon CanoScan LiDE 70 User Registration" = Canon CanoScan LiDE 70 User Registration "CanoScan Toolbox 5.0" = Canon CanoScan Toolbox 5.0 "CCleaner" = CCleaner "CNXT_MODEM_PCI_VEN_14F1&DEV_2F20&SUBSYS_200C14F1" = Data Fax SoftModem with SmartCP "DISCover" = DISCover "ERUNT_is1" = ERUNT 1.1j "HijackThis" = HijackThis 2.0.2 "HP Document Viewer" = HP Document Viewer 6.1 "HP Photo & Imaging" = HP Photosmart Premier Software 6.5 "HP Photosmart for Media Center PC" = HP Photosmart for Media Center PC "HP Rhapsody" = HP Rhapsody "HPOOVClient-9972322 Uninstaller" = Updates from HP (remove only) "IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs "ie7" = Windows Internet Explorer 7 "InstallShield_{23012310-3E05-46A5-88A9-C6CBCABCAC79}" = Customer Experience Enhancement "InstallShield_{8105684D-8CA6-440D-8F58-7E5FD67A499D}" = Easy Internet Sign-up "Intel® Quick Resume Technology" = Intel® Quick Resume Technology Drivers "Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware "Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1 "Microsoft .NET Framework 2.0" = Microsoft .NET Framework 2.0 "Money2006b" = Microsoft Money 2006 "MSNINST" = MSN "MVApplication1" = Memorex exPressit Label Design Studio "Netscape Browser" = Netscape Browser (remove only) "NetZero Connection Wizard" = NetZero Connection Wizard "NetZero HiSpeed" = NetZero HiSpeed (remove only) "NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs "PartyPokerNet" = PartyPokerNet "PC-Doctor 5 for Windows" = PC-Doctor 5 for Windows "Picasa2" = Picasa 2 "PROSet" = Intel® PRO Network Connections Drivers "Python 2.2.3" = Python 2.2.3 "pywin32-py2.2" = Python 2.2 pywin32 extensions (build 203) "RealPlayer 6.0" = RealPlayer "SM1FX_AT" = USB Storage Adapter FX (SM1) "StartUp Manager" = StartUp Manager "ViewpointMediaPlayer" = Viewpoint Media Player "Windows Media Format Runtime" = Windows Media Format Runtime "WT005641" = Insaniquarium Deluxe "Yahoo! Companion" = Yahoo! Toolbar ========== Last 10 Event Log Errors ========== [ Application Events ] Error - 1/13/2010 8:52:46 PM | Computer Name = FRANKIE | Source = Application Error | ID = 1000 Description = Faulting application ccSvcHst.exe, version 107.0.0.102, faulting module ccL70U.dll, version 107.0.0.102, fault address 0x0002a27b. Error - 1/14/2010 3:59:13 PM | Computer Name = FRANKIE | Source = Application Error | ID = 1000 Description = Faulting application iexplore.exe, version 7.0.6000.16945, faulting module unknown, version 0.0.0.0, fault address 0x001e42a9. Error - 1/14/2010 6:41:29 PM | Computer Name = FRANKIE | Source = Application Error | ID = 1000 Description = Faulting application iexplore.exe, version 7.0.6000.16945, faulting module unknown, version 0.0.0.0, fault address 0x003f27da. Error - 1/14/2010 6:53:10 PM | Computer Name = FRANKIE | Source = Application Error | ID = 1000 Description = Faulting application iexplore.exe, version 7.0.6000.16945, faulting module unknown, version 0.0.0.0, fault address 0x001e20c2. Error - 1/14/2010 6:56:51 PM | Computer Name = FRANKIE | Source = Application Error | ID = 1000 Description = Faulting application iexplore.exe, version 7.0.6000.16945, faulting module unknown, version 0.0.0.0, fault address 0x001de698. Error - 1/14/2010 6:57:01 PM | Computer Name = FRANKIE | Source = Application Error | ID = 1000 Description = Faulting application iexplore.exe, version 7.0.6000.16945, faulting module unknown, version 0.0.0.0, fault address 0x001e4405. Error - 1/23/2010 5:32:28 AM | Computer Name = FRANKIE | Source = crypt32 | ID = 131083 Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> with error: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file. Error - 1/23/2010 5:32:28 AM | Computer Name = FRANKIE | Source = crypt32 | ID = 131083 Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab> with error: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file. Error - 1/31/2010 5:15:36 PM | Computer Name = FRANKIE | Source = Application Hang | ID = 1002 Description = Hanging application TeaTimer.exe, version 1.6.4.26, hang module hungapp, version 0.0.0.0, hang address 0x00000000. Error - 1/31/2010 9:02:02 PM | Computer Name = FRANKIE | Source = Lavasoft Ad-Aware Service | ID = 0 Description = [ System Events ] Error - 1/30/2010 12:25:57 AM | Computer Name = FRANKIE | Source = DCOM | ID = 10005 Description = DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF} Error - 1/30/2010 12:25:58 AM | Computer Name = FRANKIE | Source = DCOM | ID = 10005 Description = DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF} Error - 1/30/2010 12:25:59 AM | Computer Name = FRANKIE | Source = DCOM | ID = 10005 Description = DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF} Error - 2/1/2010 7:25:16 AM | Computer Name = FRANKIE | Source = Windows Update Agent | ID = 16 Description = Unable to Connect: Windows is unable to connect to the automatic updates service and therefore cannot download and install updates according to the set schedule. Windows will continue to try to establish a connection. Error - 2/1/2010 8:45:40 AM | Computer Name = FRANKIE | Source = Service Control Manager | ID = 7026 Description = The following boot-start or system-start driver(s) failed to load: IntelIde ViaIde Error - 2/2/2010 7:56:40 PM | Computer Name = FRANKIE | Source = Service Control Manager | ID = 7038 Description = The McrdSvc service was unable to log on as NT AUTHORITY\LocalService with the currently configured password due to the following error: %%5 To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC). Error - 2/2/2010 7:56:40 PM | Computer Name = FRANKIE | Source = Service Control Manager | ID = 7000 Description = The Media Center Extender Service service failed to start due to the following error: %%1069 Error - 2/2/2010 7:59:09 PM | Computer Name = FRANKIE | Source = Service Control Manager | ID = 7034 Description = The LightScribeService Direct Disc Labeling Service service terminated unexpectedly. It has done this 1 time(s). Error - 2/2/2010 7:59:09 PM | Computer Name = FRANKIE | Source = Service Control Manager | ID = 7034 Description = The Intel® Quick Resume Technology Drivers service terminated unexpectedly. It has done this 1 time(s). Error - 2/2/2010 7:59:09 PM | Computer Name = FRANKIE | Source = Service Control Manager | ID = 7034 Description = The Intel® Matrix Storage Event Monitor service terminated unexpectedly. It has done this 1 time(s). < End of report > |
|
|
|
|
Feb 3 2010, 11:03 PM
Post
#6
|
|
|
SuperMember Group: Senior Class Posts: 1,289 Joined: 8-August 08 From: Malaysia Member No.: 80,830 Operating System: Windows XP Professional SP3, Linux Ubuntu 9.10 |
Hi,
Is this your thread? http://www.geekstogo.com/forum/Green-Scree...ed-t267412.html It is advisable to have one topic opened at a time and I do understand your frustrations on what you are experiencing with your computer now. Please do bear with me and I will try my best to help you and return to your as soon as I can. Now if you would, kindly ignore the thread you opened on G2G and stick to this one or you can continue waiting in G2G for help. The choice is yours.  In the mean time, if you decide to stick with me, please carry out the instructions on exeHelper and post the log back to me. Thanks. |
|
|
|
|
Feb 4 2010, 06:36 AM
Post
#7
|
|
|
New Member Group: Authentic Member Posts: 12 Joined: 1-February 10 Member No.: 90,456 Operating System: XP |
ok Conspire will do. In the meantime, this is what happened.
I'm not sure what's going on now. I rebooted the computer after turning it off after runing the programs above. I got a desktop recovery screen...no more green background with "Your System is Infected". I clicked to go to a normal desktop and it is working fine. I reran Malwarebytes in Safe Mode after rebooting. I ran NOD32 after rebooting to normal mode. No sign of viruses. I'll run your exeHelper when I get home from work. Thank you for helping me. oldbear46 |
|
|
|
|
Feb 4 2010, 06:46 AM
Post
#8
|
|
|
SuperMember Group: Senior Class Posts: 1,289 Joined: 8-August 08 From: Malaysia Member No.: 80,830 Operating System: Windows XP Professional SP3, Linux Ubuntu 9.10 |
Hi,
QUOTE ***Read through this entire procedure and if you have any questions, please ask them before you begin. Then either print out, or copy this page to Notepad and save to your desktop for reference as you will not have any browsers open while you are carrying out portions of these instructions. Once you're done with exeHelper, proceed with the instructions given below. Download Combofix from any of the links below but rename it to ConspireCF before saving it to your desktop. Link 1 Link 2 ================================== Double click on the renamed ComboFix.exe & follow the prompts.
 Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:  Click on Yes, to continue scanning for malware. When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply for further review. =================================================== Please run OTL again
=================================================== On your next reply please post : ComboFix log OTL log exeHelper log Good Day! |
|
|
|
|
Feb 4 2010, 07:07 AM
Post
#9
|
|
|
New Member Group: Authentic Member Posts: 12 Joined: 1-February 10 Member No.: 90,456 Operating System: XP |
my virus checker is blocking me from downloading exeHelper. It says the site is possibly fraudulent. Is there another way to get exeHelper?
oldbear46 |
|
|
|
|
Feb 4 2010, 07:09 AM
Post
#10
|
|
|
SuperMember Group: Senior Class Posts: 1,289 Joined: 8-August 08 From: Malaysia Member No.: 80,830 Operating System: Windows XP Professional SP3, Linux Ubuntu 9.10 |
Ok, skip that and carry on with ComboFix.
|
|
|
|
|
Feb 4 2010, 08:26 AM
Post
#11
|
|
|
New Member Group: Authentic Member Posts: 12 Joined: 1-February 10 Member No.: 90,456 Operating System: XP |
Ok Conspire...will do when I get off work.
oldbear46 |
|
|
|
|
Feb 4 2010, 06:20 PM
Post
#12
|
|
|
New Member Group: Authentic Member Posts: 12 Joined: 1-February 10 Member No.: 90,456 Operating System: XP |
ComboFix 10-02-03.06 - HP_Administrator 02/04/2010 18:04:33.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2038.1580 [GMT -6:00] Running from: c:\documents and settings\HP_Administrator\Desktop\ConspireCF.exe AV: ESET NOD32 Antivirus 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0} . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\recycler\S-1-5-21-4278875373-1239264856-653738623-1008 c:\windows\kb913800.exe c:\windows\system32\AutoRun.inf c:\windows\system32\bszip.dll c:\windows\system32\drivers\pshook11.sys c:\windows\system32\IS15.exe D:\Autorun.inf . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_AXPSHOOK11 -------\Service_AxPsHook11 ((((((((((((((((((((((((( Files Created from 2010-01-05 to 2010-02-05 ))))))))))))))))))))))))))))))) . 2010-02-04 03:31 . 2010-02-04 03:31 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\ESET 2010-02-04 00:37 . 2010-02-04 00:37 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes 2010-02-03 00:02 . 2010-02-03 00:02 -------- d-----w- c:\program files\ERUNT 2010-02-01 12:47 . 2010-02-01 12:47 -------- d-----w- c:\program files\ESET 2010-02-01 12:47 . 2010-02-01 12:47 -------- d-----w- c:\documents and settings\All Users\Application Data\ESET 2010-02-01 11:38 . 2010-02-01 11:38 -------- d-----w- c:\documents and settings\HP_Administrator\Application Data\Malwarebytes 2010-02-01 11:38 . 2010-01-07 22:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-02-01 11:38 . 2010-02-01 11:38 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2010-02-01 11:38 . 2010-02-01 11:38 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes 2010-02-01 11:38 . 2010-01-07 22:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys 2010-02-01 02:27 . 2010-02-01 02:27 -------- d-----w- c:\program files\Alwil Software 2010-02-01 02:27 . 2010-02-01 02:27 -------- d-----w- c:\documents and settings\All Users\Application Data\Alwil Software 2010-02-01 00:57 . 2010-02-01 02:10 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft 2010-01-23 12:44 . 2010-01-23 12:44 -------- d-----w- c:\documents and settings\HP_Administrator\Application Data\Yahoo! 2010-01-23 12:44 . 2010-01-23 12:44 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo! Companion 2010-01-23 12:44 . 2010-01-23 12:44 -------- d-----w- c:\program files\Yahoo! 2010-01-23 12:44 . 2010-01-23 12:45 -------- d-----w- c:\program files\CCleaner 2010-01-23 12:10 . 2010-02-01 00:01 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy 2010-01-23 09:32 . 2009-07-28 21:33 55656 ----a-w- c:\windows\system32\drivers\avgntflt.sys 2010-01-17 20:14 . 2010-01-17 20:14 -------- d-----w- c:\documents and settings\HP_Administrator\Local Settings\Application Data\Threat Expert 2010-01-17 20:04 . 2010-01-17 20:15 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-02-04 06:36 . 2006-05-28 07:43 -------- d-----w- c:\program files\Google 2010-02-04 06:35 . 2006-10-11 02:27 -------- d-----w- c:\documents and settings\All Users\Application Data\Napster 2010-02-04 06:35 . 2006-10-06 01:36 -------- d-----w- c:\program files\Common Files\Roxio Shared 2010-01-23 09:31 . 2006-10-04 13:19 -------- d-----w- c:\program files\NetZero 2010-01-17 01:34 . 2006-05-28 07:46 -------- d-----w- c:\documents and settings\All Users\Application Data\Symantec 2010-01-17 01:34 . 2006-05-28 07:46 -------- d-----w- c:\program files\Common Files\Symantec Shared 2010-01-13 20:17 . 2009-08-27 20:02 -------- d-----w- c:\program files\NZSearch 2010-01-05 10:00 . 2004-08-10 04:00 832512 ----a-w- c:\windows\system32\wininet.dll 2010-01-05 10:00 . 2004-08-10 04:00 78336 ----a-w- c:\windows\system32\ieencode.dll 2010-01-05 10:00 . 2004-08-10 04:00 17408 ----a-w- c:\windows\system32\corpol.dll 2010-01-01 00:57 . 2007-10-20 00:45 -------- d-----w- c:\program files\PartyGaming.Net 2009-12-14 22:40 . 2007-04-22 21:37 59908 ---ha-w- c:\windows\system32\mlfcache.dat 2009-11-21 16:36 . 2004-08-10 04:00 470528 ----a-w- c:\windows\AppPatch\aclayers.dll 2009-11-16 15:06 . 2009-11-16 15:06 96408 ----a-w- c:\windows\system32\drivers\epfwtdir.sys 2009-11-16 15:03 . 2009-11-16 15:03 108792 ----a-w- c:\windows\system32\drivers\ehdrv.sys 2009-11-16 14:56 . 2009-11-16 14:56 116520 ----a-w- c:\windows\system32\drivers\eamon.sys 2003-08-27 19:19 . 2006-10-11 02:28 36963 ----a-r- c:\program files\Common Files\SM1updtr.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208] "spc_w"="c:\program files\NZSearch\nzspc.exe" [2006-07-11 311362] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ehTray"="c:\windows\ehome\ehtray.exe" [2005-09-30 67584] "RTHDCPL"="RTHDCPL.EXE" [2006-03-08 16010240] "igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-02-07 77824] "igfxpers"="c:\windows\system32\igfxpers.exe" [2006-02-07 118784] "IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2005-10-13 139264] "HPHUPD08"="c:\program files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe" [2005-06-02 49152] "DISCover"="c:\program files\DISC\DISCover.exe" [2006-03-16 1077248] "DiscUpdateManager"="c:\program files\DISC\DiscUpdMgr.exe" [2006-03-16 61440] "DMAScheduler"="c:\program files\HP DigitalMedia Archive\DMAScheduler.exe" [2006-03-20 90112] "Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2005-07-23 237568] "HPBootOp"="c:\program files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2006-02-16 249856] "Reminder"="c:\windows\Creator\Remind_XP.exe" [2004-12-14 663552] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-12 49152] "SM1BG"="c:\windows\SM1BG.EXE" [2003-08-27 94208] "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2006-05-28 180269] "SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-09-28 185896] "OpwareSE4"="c:\program files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe" [2006-10-11 75304] "DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2006-06-13 127036] "egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-11-16 2054360] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "Picasa Media Detector"="c:\program files\Picasa2\PicasaMediaDetector.exe" [2007-10-23 443968] c:\documents and settings\HP_Administrator\Start Menu\Programs\Startup\ PMB Media Check Tool.lnk - c:\program files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe [2009-7-5 333088] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696] QuickBooks Update Agent.lnk - c:\program files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2005-2-23 806912] [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\DISC\\DISCover.exe"= "c:\\Program Files\\DISC\\DiscStreamHub.exe"= "c:\\Program Files\\DISC\\myFTP.exe"= "c:\\Program Files\\Updates from HP\\9972322\\Program\\Updates from HP.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"= "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"= R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [11/16/2009 9:03 AM 108792] R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [11/16/2009 9:06 AM 96408] R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [11/16/2009 9:04 AM 735960] S3 PTDUBus;PANTECH UM175 Composite Device Driver ;c:\windows\system32\drivers\PTDUBus.sys [9/29/2008 7:32 PM 29824] S3 PTDUMdm;PANTECH UM175 Drivers;c:\windows\system32\drivers\PTDUMdm.sys [9/29/2008 7:32 PM 41344] S3 PTDUVsp;PANTECH UM175 Diagnostic Port;c:\windows\system32\drivers\PTDUVsp.sys [9/29/2008 7:32 PM 39936] S3 PTDUWWAN;PANTECH UM175 WWAN Driver;c:\windows\system32\drivers\PTDUWWAN.sys [9/29/2008 7:32 PM 59776] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 . Contents of the 'Scheduled Tasks' folder . . ------- Supplementary Scan ------- . uStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=63&bd=PAVILION&pf=desktop uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=63&bd=PAVILION&pf=desktop uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=63&bd=PAVILION&pf=desktop uInternet Connection Wizard,ShellNext = hxxp://my.netzero.net/s/sp?r=al&cf=sp&mem=leolita1&login=c9cffe995df53ae9185ffdfa0ef151db/leolita1:netzero.net/1159960855/30/sss.1.39495/&ts=45239917&A=561831200000009&B=1121410800000&C=1121410800000&D=1142064000000&I=8.NH3&N=PLHS&O=I&UT= uSearchAssistant = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://my.netzero.net/s/search?r=minisearch IE: Display All Images with Full Quality - c:\program files\NetZero\qsacc\appres.dll/228 IE: Display Image with Full Quality - c:\program files\NetZero\qsacc\appres.dll/227 IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 Trusted Zone: trymedia.com . - - - - ORPHANS REMOVED - - - - HKLM-Run-PCDrProfiler - (no file) ************************************************************************** scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'explorer.exe'(752) c:\windows\system32\WININET.dll c:\program files\ScanSoft\OmniPageSE4.0\OpHookSE4.dll c:\windows\system32\ieframe.dll . ------------------------ Other Running Processes ------------------------ . c:\program files\Intel\Intel Matrix Storage Manager\iaantmon.exe c:\program files\Common Files\LightScribe\LSSrvc.exe c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE c:\windows\ehome\mcrdsvc.exe c:\program files\Intel\IntelDH\Intel® Quick Resume Technology\ELService.exe c:\windows\RTHDCPL.EXE c:\program files\DISC\DiscStreamHub.exe . ************************************************************************** . Completion time: 2010-02-04 18:12:18 - machine was rebooted ComboFix-quarantined-files.txt 2010-02-05 00:12 Pre-Run: 288,066,285,568 bytes free Post-Run: 287,959,416,832 bytes free - - End Of File - - 57DDDD38752182C028890ACAB59371AE |
|
|
|
|
Feb 4 2010, 10:29 PM
Post
#13
|
|
|
SuperMember Group: Senior Class Posts: 1,289 Joined: 8-August 08 From: Malaysia Member No.: 80,830 Operating System: Windows XP Professional SP3, Linux Ubuntu 9.10 |
Post your OTL log please.
Thanks
|
|
|
|
|
Feb 4 2010, 11:03 PM
Post
#14
|
|
|
New Member Group: Authentic Member Posts: 12 Joined: 1-February 10 Member No.: 90,456 Operating System: XP |
OTL logfile created on: 2/4/2010 10:53:56 PM - Run 2
OTL by OldTimer - Version 3.1.27.1 Folder = C:\Documents and Settings\HP_Administrator\Desktop Windows XP Media Center Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 7.0.5730.11) Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy 2.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 78.00% Memory free 4.00 Gb Paging File | 4.00 Gb Available in Paging File | 93.00% Paging File free Paging file location(s): C:\pagefile.sys 2046 4092 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 289.27 Gb Total Space | 268.21 Gb Free Space | 92.72% Space Free | Partition Type: NTFS Drive D: | 8.80 Gb Total Space | 0.41 Gb Free Space | 4.62% Space Free | Partition Type: FAT32 E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: FRANKIE Current User Name: HP_Administrator Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Minimal ========== Processes (SafeList) ========== PRC - C:\Documents and Settings\HP_Administrator\Desktop\OTL.exe (OldTimer Tools) PRC - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe (ESET) PRC - C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe (ESET) PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation) PRC - C:\Program Files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe (Sony Corporation) PRC - C:\Program Files\HP\HP Software Update\hpwuSchd2.exe (Hewlett-Packard Co.) PRC - C:\Program Files\ScanSoft\OmniPageSE4.0\OpWareSE4.exe (ScanSoft, Inc.) PRC - C:\Program Files\NZSearch\nzspc.exe (United Online, Inc.) PRC - C:\WINDOWS\system32\DLA\DLACTRLW.EXE (Sonic Solutions) PRC - C:\Program Files\Common Files\LightScribe\LSSrvc.exe (Hewlett-Packard Company) PRC - C:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe (Sonic Solutions) PRC - C:\Program Files\DISC\DISCover.exe (Digital Interactive Systems Corporation) PRC - C:\Program Files\DISC\DISCUpdMgr.exe (Digital Interactive Systems Corporation, Inc.) PRC - C:\Program Files\DISC\DiscStreamHub.exe (Digital Interactive Systems Corporation, Inc.) PRC - C:\WINDOWS\RTHDCPL.EXE (Realtek Semiconductor Corp.) PRC - C:\WINDOWS\system32\igfxpers.exe (Intel Corporation) PRC - C:\WINDOWS\system32\hkcmd.exe (Intel Corporation) PRC - C:\Program Files\Intel\IntelDH\Intel® Quick Resume Technology\ELService.exe (Intel Corporation) PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation) PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe (Intel Corporation) PRC - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated) PRC - C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe (Sun Microsystems, Inc.) PRC - C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe (Intuit, Inc.) PRC - C:\hp\KBD\kbd.exe (Hewlett-Packard Company) PRC - C:\WINDOWS\SM1bg.exe (Cypress Semiconductor) PRC - c:\WINDOWS\system\hpsysdrv.exe (Hewlett-Packard Company) ========== Modules (SafeList) ========== MOD - C:\Documents and Settings\HP_Administrator\Desktop\OTL.exe (OldTimer Tools) MOD - C:\Program Files\ScanSoft\OmniPageSE4.0\OpHookSE4.dll (ScanSoft, Inc.) MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll (Microsoft Corporation) ========== Win32 Services (SafeList) ========== SRV - (EhttpSrv) -- C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe (ESET) SRV - (ekrn) -- C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe (ESET) SRV - (gusvc) -- C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (Google) SRV - (Pml Driver HPZ12) -- C:\WINDOWS\system32\HPZIPM12.DLL (Hewlett-Packard) SRV - (Net Driver HPZ12) -- C:\WINDOWS\system32\HPZINW12.DLL (Hewlett-Packard) SRV - (LightScribeService) -- C:\Program Files\Common Files\LightScribe\LSSrvc.exe (Hewlett-Packard Company) SRV - (ELService) -- C:\Program Files\Intel\IntelDH\Intel® Quick Resume Technology\ELService.exe (Intel Corporation) SRV - (IAANTMon) Intel® -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe (Intel Corporation) SRV - (IDriverT) -- C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe (Macrovision Corporation) SRV - (ose) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation) ========== Driver Services (SafeList) ========== DRV - (epfwtdir) -- C:\WINDOWS\system32\drivers\epfwtdir.sys (ESET) DRV - (ehdrv) -- C:\WINDOWS\system32\drivers\ehdrv.sys (ESET) DRV - (eamon) -- C:\WINDOWS\system32\drivers\eamon.sys (ESET) DRV - (PxHelp20) -- C:\WINDOWS\System32\Drivers\PxHelp20.sys (Sonic Solutions) DRV - (PTDUWWAN) -- C:\WINDOWS\system32\drivers\PTDUWWAN.sys (DEVGURU Co,LTD.) DRV - (PTDUVsp) -- C:\WINDOWS\system32\drivers\PTDUVsp.sys (DEVGURU Co,LTD.) DRV - (PTDUMdm) -- C:\WINDOWS\system32\drivers\PTDUMdm.sys (DEVGURU Co,LTD.) DRV - (PTDUBus) -- C:\WINDOWS\system32\drivers\PTDUBus.sys (DEVGURU Co,LTD.) DRV - (eeCtrl) -- C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys (Symantec Corporation) DRV - (Secdrv) -- C:\WINDOWS\system32\drivers\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) DRV - (HPZius12) -- C:\WINDOWS\system32\drivers\HPZius12.sys (HP) DRV - (HPZipr12) -- C:\WINDOWS\system32\drivers\HPZipr12.sys (HP) DRV - (HPZid412) -- C:\WINDOWS\system32\drivers\HPZid412.sys (HP) DRV - (DLAUDFAM) -- C:\WINDOWS\system32\DLA\DLAUDFAM.SYS (Sonic Solutions) DRV - (DLAUDF_M) -- C:\WINDOWS\system32\DLA\DLAUDF_M.SYS (Sonic Solutions) DRV - (DLAIFS_M) -- C:\WINDOWS\system32\DLA\DLAIFS_M.SYS (Sonic Solutions) DRV - (DLABOIOM) -- C:\WINDOWS\system32\DLA\DLABOIOM.SYS (Sonic Solutions) DRV - (DLAOPIOM) -- C:\WINDOWS\system32\DLA\DLAOPIOM.SYS (Sonic Solutions) DRV - (DLAPoolM) -- C:\WINDOWS\system32\DLA\DLAPoolM.SYS (Sonic Solutions) DRV - (DLADResN) -- C:\WINDOWS\system32\DLA\DLADResN.SYS (Sonic Solutions) DRV - (DRVMCDB) -- C:\WINDOWS\System32\Drivers\DRVMCDB.SYS (Sonic Solutions) DRV - (hcwPP2) -- C:\WINDOWS\system32\drivers\hcwPP2.sys (Hauppauge Computer Works, Inc.) DRV - (DLACDBHM) -- C:\WINDOWS\system32\drivers\DLACDBHM.SYS (Sonic Solutions) DRV - (DLARTL_N) -- C:\WINDOWS\system32\drivers\DLARTL_N.SYS (Sonic Solutions) DRV - (DRVNDDM) -- C:\WINDOWS\system32\drivers\DRVNDDM.SYS (Sonic Solutions) DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.) DRV - (ialm) -- C:\WINDOWS\system32\drivers\ialmnt5.sys (Intel Corporation) DRV - (Ps2) -- C:\WINDOWS\system32\drivers\PS2.sys (Hewlett-Packard Company) DRV - (HSXHWBS2) -- C:\WINDOWS\system32\drivers\HSXHWBS2.sys (Conexant Systems, Inc.) DRV - (winachsx) -- C:\WINDOWS\system32\drivers\HSX_CNXT.sys (Conexant Systems, Inc.) DRV - (HSX_DP) -- C:\WINDOWS\system32\drivers\HSX_DP.sys (Conexant Systems, Inc.) DRV - (ELacpi) -- C:\WINDOWS\system32\drivers\ELacpi.sys (Intel Corporation) DRV - (ELmon) -- C:\WINDOWS\system32\drivers\ELmon.sys (Intel Corporation) DRV - (ELkbd) -- C:\WINDOWS\system32\drivers\ELkbd.sys (Intel Corporation) DRV - (ELmou) -- C:\WINDOWS\system32\drivers\ELmou.sys (Intel Corporation) DRV - (ELhid) -- C:\WINDOWS\system32\drivers\ELhid.sys (Intel Corporation) DRV - (iaStor) -- C:\WINDOWS\system32\DRIVERS\iaStor.sys (Intel Corporation) DRV - (mdmxsdk) -- C:\WINDOWS\system32\drivers\mdmxsdk.sys (Conexant) DRV - (ftsata2) -- C:\WINDOWS\system32\DRIVERS\ftsata2.sys (Promise Technology, Inc.) DRV - (E100B) Intel® -- C:\WINDOWS\system32\drivers\e100b325.sys (Intel Corporation) DRV - (HDAudBus) -- C:\WINDOWS\system32\drivers\Hdaudbus.sys (Windows ® Server 2003 DDK provider) DRV - (Ptilink) -- C:\WINDOWS\system32\drivers\ptilink.sys (Parallel Technologies, Inc.) DRV - (rtl8139) Realtek RTL8139(A/B/C) -- C:\WINDOWS\system32\drivers\RTL8139.sys (Realtek Semiconductor Corporation) DRV - (bb-run) -- C:\WINDOWS\system32\DRIVERS\bb-run.sys (Promise Technology, Inc.) DRV - (wanatw) WAN Miniport (ATW) -- C:\WINDOWS\system32\drivers\wanatw4.sys (America Online, Inc.) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerm...tf8&oe=utf8 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie IE - HKCU\..\URLSearchHook: {37D2CDBF-2AF4-44AA-8113-BD0D2DA3C2B8} - C:\Program Files\NZSearch\SearchEnh1.dll (United Online, Inc.) IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.) IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 FF - HKLM\software\mozilla\Netscape Browser 8.0.4.0\Extensions\\Components: C:\Program Files\Netscape\Netscape Browser\Components [2006/05/28 01:21:38 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Netscape Browser 8.0.4.0\Extensions\\Plugins: C:\Program Files\Netscape\Netscape Browser\Plugins [2007/06/13 16:04:02 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird [2010/02/01 06:47:15 | 000,000,000 | ---D | M] O1 HOSTS File: ([2010/02/04 18:09:39 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.) O2 - BHO: (HP Print Enhancer) - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.) O2 - BHO: (HP Print Clips) - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll (Hewlett-Packard Co.) O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (Lexmark Toolbar) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll () O2 - BHO: (Popup-Blocker Class) - {52706EF7-D7A2-49AD-A615-E903858CF284} - C:\Program Files\NetZero\qsacc\X1IEBHO.dll (NetZero, Inc.) O2 - BHO: (DriveLetterAccess) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\DLA\DLASHX_W.DLL (Sonic Solutions) O2 - BHO: (hpWebHelper Class) - {AAAE832A-5FFF-4661-9C8F-369692D1DCB9} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\WebHelper.dll (TODO: <Company name>) O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll (Yahoo! Inc) O3 - HKLM\..\Toolbar: (Lexmark Toolbar) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll () O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.) O3 - HKLM\..\Toolbar: (ZeroBar) - {F0F8ECBE-D460-4B34-B007-56A92E8F84A7} - C:\Program Files\NetZero\Toolbar.dll () O3 - HKCU\..\Toolbar\WebBrowser: (Lexmark Toolbar) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll () O3 - HKCU\..\Toolbar\WebBrowser: (ZeroBar) - {F0F8ECBE-D460-4B34-B007-56A92E8F84A7} - C:\Program Files\NetZero\Toolbar.dll () O4 - HKLM..\Run: [DISCover] C:\Program Files\DISC\DISCover.exe (Digital Interactive Systems Corporation) O4 - HKLM..\Run: [DiscUpdateManager] C:\Program Files\DISC\DISCUpdMgr.exe (Digital Interactive Systems Corporation, Inc.) O4 - HKLM..\Run: [DLA] C:\WINDOWS\system32\DLA\DLACTRLW.EXE (Sonic Solutions) O4 - HKLM..\Run: [DMAScheduler] c:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe (Sonic Solutions) O4 - HKLM..\Run: [egui] C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe (ESET) O4 - HKLM..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\hpwuSchd2.exe (Hewlett-Packard Co.) O4 - HKLM..\Run: [HPBootOp] C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe (Hewlett-Packard Company) O4 - HKLM..\Run: [HPHUPD08] c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe (Hewlett-Packard) O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation) O4 - HKLM..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe (Intel Corporation) O4 - HKLM..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe (Intel Corporation) O4 - HKLM..\Run: [OpwareSE4] C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe (ScanSoft, Inc.) O4 - HKLM..\Run: [Recguard] C:\WINDOWS\SMINST\Recguard.exe () O4 - HKLM..\Run: [Reminder] C:\Windows\Creator\Remind_XP.exe (SoftThinks) O4 - HKLM..\Run: [RTHDCPL] C:\WINDOWS\RTHDCPL.EXE (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [SM1BG] C:\WINDOWS\SM1bg.exe (Cypress Semiconductor) O4 - HKLM..\Run: [SSBkgdUpdate] C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe (Nuance Communications, Inc.) O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.) O4 - HKCU..\Run: [spc_w] C:\Program Files\NZSearch\nzspc.exe (United Online, Inc.) O4 - HKCU..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe (Adobe Systems Incorporated) O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated) O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe (Intuit, Inc.) O4 - Startup: C:\Documents and Settings\HP_Administrator\Start Menu\Programs\Startup\PMB Media Check Tool.lnk = C:\Program Files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe (Sony Corporation) O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme () O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O8 - Extra context menu item: Display All Images with Full Quality - C:\Program Files\NetZero\qsacc\appres.dll (NetZero, Inc.) O8 - Extra context menu item: Display Image with Full Quality - C:\Program Files\NetZero\qsacc\appres.dll (NetZero, Inc.) O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\NPJPI150_05.dll (Sun Microsystems, Inc.) O9 - Extra Button: HP Clipbook - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll (Hewlett-Packard Co.) O9 - Extra Button: HP Smart Select - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll (Hewlett-Packard Co.) O9 - Extra Button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe File not found O9 - Extra 'Tools' menuitem : PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe File not found O9 - Extra Button: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm () O9 - Extra 'Tools' menuitem : Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm () O9 - Extra Button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe () O9 - Extra 'Tools' menuitem : PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe () O15 - HKLM\..Trusted Domains: trymedia.com ([]http in Trusted sites) O15 - HKLM\..Trusted Domains: trymedia.com ([]https in Trusted sites) O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone. O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} http://gfx1.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab (MSN Photo Upload Tool) O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} http://gfx1.hotmail.com/mail/w4/pr01/photo...ol/MSNPUpld.cab (Windows Live Hotmail Photo Upload Tool) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation) O24 - Desktop WallPaper: C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Microsoft\Wallpaper1.bmp O24 - Desktop BackupWallPaper: C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Microsoft\Wallpaper1.bmp O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006/05/28 01:33:34 | 000,000,100 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O32 - AutoRun File - [2001/07/27 15:07:38 | 000,000,000 | -HS- | M] () - D:\AUTOEXEC.BAT -- [ FAT32 ] O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - comfile [open] -- "%1" %* O35 - exefile [open] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2010/02/04 18:12:20 | 000,000,000 | ---D | C] -- C:\WINDOWS\temp [2010/02/04 18:04:03 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe [2010/02/04 18:04:03 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe [2010/02/04 18:04:03 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe [2010/02/04 18:04:03 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe [2010/02/04 18:03:59 | 000,000,000 | ---D | C] -- C:\ConspireCF [2010/02/04 17:59:58 | 000,000,000 | ---D | C] -- C:\Qoobox [2010/02/03 21:31:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ESET [2010/02/02 20:04:25 | 000,548,864 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\HP_Administrator\Desktop\OTL.exe [2010/02/02 18:12:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\HP_Administrator\Desktop\gmer [2010/02/02 18:04:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT [2010/02/02 18:02:38 | 000,000,000 | ---D | C] -- C:\Program Files\ERUNT [2010/02/02 17:57:37 | 000,791,393 | ---- | C] (Lars Hederer ) -- C:\Documents and Settings\HP_Administrator\Desktop\erunt_setup.exe [2010/02/02 17:57:27 | 000,439,808 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\HP_Administrator\Desktop\TFC.exe [2010/02/01 07:37:31 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\HP_Administrator\Recent [2010/02/01 06:47:14 | 000,000,000 | ---D | C] -- C:\Program Files\ESET [2010/02/01 06:47:14 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\ESET [2010/02/01 05:38:47 | 000,000,000 | ---D | C] -- C:\Documents and Settings\HP_Administrator\Application Data\Malwarebytes [2010/02/01 05:38:41 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys [2010/02/01 05:38:39 | 000,019,160 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [2010/02/01 05:38:39 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2010/02/01 05:38:39 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes [2010/01/31 20:27:15 | 000,000,000 | ---D | C] -- C:\Program Files\Alwil Software [2010/01/31 20:27:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Alwil Software [2010/01/31 18:57:55 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Lavasoft [2010/01/31 18:03:26 | 005,115,824 | ---- | C] (Malwarebytes Corporation ) -- C:\Documents and Settings\HP_Administrator\Desktop\bites.exe [2010/01/31 18:03:16 | 000,891,248 | ---- | C] (AVG Technologies) -- C:\Documents and Settings\HP_Administrator\Desktop\average.exe [2010/01/31 18:03:03 | 069,672,352 | ---- | C] (Kaspersky Lab) -- C:\Documents and Settings\HP_Administrator\Desktop\cap.exe [2010/01/31 18:02:53 | 091,338,304 | ---- | C] (Lavasoft ) -- C:\Documents and Settings\HP_Administrator\Desktop\wear.exe [2010/01/23 06:44:57 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Yahoo! Companion [2010/01/23 06:44:57 | 000,000,000 | ---D | C] -- C:\Documents and Settings\HP_Administrator\Application Data\Yahoo! [2010/01/23 06:44:55 | 000,000,000 | ---D | C] -- C:\Program Files\Yahoo! [2010/01/23 06:44:53 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner [2010/01/23 06:10:34 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy [2010/01/23 03:32:04 | 000,055,656 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntflt.sys [2010/01/22 21:02:39 | 003,357,024 | ---- | C] (Piriform Ltd) -- C:\Documents and Settings\HP_Administrator\Desktop\ccsetup227.exe [2010/01/22 20:19:35 | 016,409,960 | ---- | C] (Safer Networking Limited ) -- C:\Documents and Settings\HP_Administrator\Desktop\spybotsd162.exe [2010/01/17 14:14:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Threat Expert [2010/01/17 14:06:37 | 000,000,000 | ---D | C] -- C:\Program Files\Registry Mechanic [2010/01/17 14:04:14 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\TEMP [2007/12/16 13:31:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\HP [2007/11/08 19:37:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft [2007/11/08 19:37:21 | 000,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Application Data\Microsoft [2006/10/10 20:28:06 | 000,036,963 | R--- | C] (Cypress Semiconductor) -- C:\Program Files\Common Files\SM1updtr.dll [2006/05/28 00:43:01 | 000,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Application Data\Microsoft [2006/05/28 00:43:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft [2006/02/19 11:28:56 | 000,012,288 | ---- | C] (Hewlett-Packard Development Company, L.P.) -- C:\WINDOWS\Fonts\RandFont.dll [2 C:\Documents and Settings\All Users\*.tmp files -> C:\Documents and Settings\All Users\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2010/02/04 22:52:10 | 000,000,247 | ---- | M] () -- C:\WINDOWS\System\hpsysdrv.dat [2010/02/04 22:51:11 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2010/02/04 22:50:57 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2010/02/04 22:50:54 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2010/02/04 22:50:53 | 2137,481,216 | -HS- | M] () -- C:\hiberfil.sys [2010/02/04 18:16:51 | 004,718,592 | ---- | M] () -- C:\Documents and Settings\HP_Administrator\NTUSER.DAT [2010/02/04 18:16:29 | 000,000,278 | -HS- | M] () -- C:\Documents and Settings\HP_Administrator\ntuser.ini [2010/02/04 18:09:53 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini [2010/02/04 18:09:39 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts [2010/02/04 07:07:40 | 003,845,975 | R--- | M] () -- C:\Documents and Settings\HP_Administrator\Desktop\ConspireCF.exe [2010/02/02 18:02:43 | 000,000,622 | ---- | M] () -- C:\Documents and Settings\HP_Administrator\Desktop\NTREGOPT.lnk [2010/02/02 18:02:43 | 000,000,603 | ---- | M] () -- C:\Documents and Settings\HP_Administrator\Desktop\ERUNT.lnk [2010/02/02 17:48:58 | 000,548,864 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\HP_Administrator\Desktop\OTL.exe [2010/02/02 17:48:18 | 000,284,915 | ---- | M] () -- C:\Documents and Settings\HP_Administrator\Desktop\gmer.zip [2010/02/02 17:47:52 | 000,791,393 | ---- | M] (Lars Hederer ) -- C:\Documents and Settings\HP_Administrator\Desktop\erunt_setup.exe [2010/02/02 17:47:26 | 000,439,808 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\HP_Administrator\Desktop\TFC.exe [2010/02/01 06:54:01 | 000,002,577 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT [2010/02/01 05:38:44 | 000,000,707 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk [2010/01/31 17:03:06 | 091,338,304 | ---- | M] (Lavasoft ) -- C:\Documents and Settings\HP_Administrator\Desktop\wear.exe [2010/01/31 17:01:12 | 005,115,824 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\HP_Administrator\Desktop\bites.exe [2010/01/31 16:59:16 | 000,891,248 | ---- | M] (AVG Technologies) -- C:\Documents and Settings\HP_Administrator\Desktop\average.exe [2010/01/31 16:57:10 | 035,001,856 | ---- | M] () -- C:\Documents and Settings\HP_Administrator\Desktop\thirty.msi [2010/01/31 16:57:08 | 069,672,352 | ---- | M] (Kaspersky Lab) -- C:\Documents and Settings\HP_Administrator\Desktop\cap.exe [2010/01/31 16:52:28 | 042,044,328 | ---- | M] () -- C:\Documents and Settings\HP_Administrator\Desktop\free.exe [2010/01/31 15:25:13 | 000,262,144 | ---- | M] () -- C:\Documents and Settings\All Users\NTUSER.DAT [2010/01/31 15:24:58 | 000,000,312 | -HS- | M] () -- C:\boot.ini [2010/01/23 10:02:31 | 000,004,757 | ---- | M] () -- C:\WINDOWS\wininit.ini [2010/01/23 06:57:50 | 000,001,559 | ---- | M] () -- C:\Documents and Settings\HP_Administrator\Desktop\CCleaner.lnk [2010/01/23 06:40:05 | 003,357,024 | ---- | M] (Piriform Ltd) -- C:\Documents and Settings\HP_Administrator\Desktop\ccsetup227.exe [2010/01/23 05:27:08 | 016,409,960 | ---- | M] (Safer Networking Limited ) -- C:\Documents and Settings\HP_Administrator\Desktop\spybotsd162.exe [2010/01/23 00:47:47 | 030,909,992 | ---- | M] () -- C:\Documents and Settings\HP_Administrator\Desktop\avira_antivir_personal_en.exe [2010/01/22 16:33:36 | 000,002,495 | ---- | M] () -- C:\Documents and Settings\HP_Administrator\Desktop\Microsoft Office Excel 2003.lnk [2010/01/07 16:07:14 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys [2010/01/07 16:07:04 | 000,019,160 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [2 C:\Documents and Settings\All Users\*.tmp files -> C:\Documents and Settings\All Users\*.tmp -> ] ========== Files Created - No Company Name ========== [2010/02/04 18:04:03 | 000,261,632 | ---- | C] () -- C:\WINDOWS\PEV.exe [2010/02/04 18:04:03 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe [2010/02/04 18:04:03 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe [2010/02/04 18:04:03 | 000,077,312 | ---- | C] () -- C:\WINDOWS\MBR.exe [2010/02/04 18:04:03 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe [2010/02/04 18:00:45 | 003,845,975 | R--- | C] () -- C:\Documents and Settings\HP_Administrator\Desktop\ConspireCF.exe [2010/02/03 19:27:33 | 2137,481,216 | -HS- | C] () -- C:\hiberfil.sys [2010/02/02 18:11:41 | 000,293,376 | ---- | C] () -- C:\Documents and Settings\HP_Administrator\Desktop\gmer.exe [2010/02/02 18:02:43 | 000,000,622 | ---- | C] () -- C:\Documents and Settings\HP_Administrator\Desktop\NTREGOPT.lnk [2010/02/02 18:02:43 | 000,000,603 | ---- | C] () -- C:\Documents and Settings\HP_Administrator\Desktop\ERUNT.lnk [2010/02/02 17:57:30 | 000,284,915 | ---- | C] () -- C:\Documents and Settings\HP_Administrator\Desktop\gmer.zip [2010/02/01 05:38:44 | 000,000,707 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk [2010/01/31 18:03:20 | 035,001,856 | ---- | C] () -- C:\Documents and Settings\HP_Administrator\Desktop\thirty.msi [2010/01/31 18:03:10 | 042,044,328 | ---- | C] () -- C:\Documents and Settings\HP_Administrator\Desktop\free.exe [2010/01/23 06:44:53 | 000,001,559 | ---- | C] () -- C:\Documents and Settings\HP_Administrator\Desktop\CCleaner.lnk [2010/01/22 21:02:25 | 030,909,992 | ---- | C] () -- C:\Documents and Settings\HP_Administrator\Desktop\avira_antivir_personal_en.exe [2009/08/27 14:02:38 | 000,194,376 | ---- | C] () -- C:\Documents and Settings\HP_Administrator\Application Data\shb.dat [2009/03/30 20:36:22 | 000,758,870 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\LuUninstall.LiveUpdate [2007/10/31 20:43:27 | 000,000,447 | ---- | C] () -- C:\WINDOWS\brwmark.ini [2007/09/02 13:15:34 | 000,000,506 | ---- | C] () -- C:\WINDOWS\hegames.ini [2007/08/01 18:37:12 | 000,010,593 | ---- | C] () -- C:\WINDOWS\CSTBox.INI [2007/08/01 18:32:45 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\IPPCPUID.DLL [2007/08/01 18:32:28 | 000,011,776 | ---- | C] () -- C:\WINDOWS\System32\pmsbfn32.dll [2007/08/01 18:16:16 | 000,000,416 | ---- | C] () -- C:\WINDOWS\MAXLINK.INI [2006/10/08 19:00:59 | 000,000,016 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\DragToDiscUserNameE.txt [2006/10/04 19:46:53 | 000,000,040 | ---- | C] () -- C:\WINDOWS\opt_1440.ini [2006/10/04 19:46:52 | 000,000,058 | ---- | C] () -- C:\WINDOWS\brmx2001.ini [2006/10/04 19:44:58 | 000,000,059 | ---- | C] () -- C:\WINDOWS\BRVIDEO.INI [2006/10/04 19:44:58 | 000,000,039 | ---- | C] () -- C:\WINDOWS\BRDIAG.INI [2006/10/04 19:44:58 | 000,000,030 | ---- | C] () -- C:\WINDOWS\HL-1440.INI [2006/10/04 19:44:58 | 000,000,023 | ---- | C] () -- C:\WINDOWS\Brownie.ini [2006/10/04 19:38:28 | 000,000,052 | ---- | C] () -- C:\WINDOWS\BRPP2KA.INI [2006/10/04 07:16:10 | 000,000,139 | ---- | C] () -- C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\fusioncache.dat [2006/10/03 19:25:35 | 000,014,848 | ---- | C] () -- C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2006/05/28 01:58:55 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini [2006/05/28 01:39:31 | 000,028,848 | ---- | C] () -- C:\WINDOWS\System32\drivers\USBkey.sys [2006/05/28 01:35:46 | 000,014,317 | ---- | C] () -- C:\WINDOWS\System32\CHODDI.SYS [2006/05/28 01:35:40 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\hpreg.dll [2006/05/28 01:33:47 | 000,000,031 | ---- | C] () -- C:\WINDOWS\QUICKEN.INI [2006/05/28 01:31:47 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI [2006/05/28 01:22:16 | 000,004,757 | ---- | C] () -- C:\WINDOWS\wininit.ini [2006/05/28 01:21:40 | 000,000,698 | ---- | C] () -- C:\WINDOWS\NSSetDefaultBrowser.ini [2006/05/28 01:10:41 | 000,010,184 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\hpzinstall.log [2006/05/28 01:09:48 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini [2006/05/28 01:08:02 | 000,102,400 | ---- | C] () -- C:\WINDOWS\System32\hcwXDS.dll [2006/05/28 01:06:23 | 000,000,791 | ---- | C] () -- C:\WINDOWS\orun32.ini [2006/05/28 00:45:09 | 000,323,584 | ---- | C] () -- C:\WINDOWS\System32\pythoncom22.dll [2006/05/28 00:45:09 | 000,094,208 | ---- | C] () -- C:\WINDOWS\System32\pywintypes22.dll [2006/05/28 00:44:52 | 000,016,896 | ---- | C] () -- C:\WINDOWS\System32\bcbmm.dll [2006/03/17 18:23:44 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini [2005/08/05 22:01:54 | 000,239,104 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll [2004/07/26 08:51:38 | 000,000,560 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini [2003/01/07 14:05:08 | 000,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI [2001/07/06 23:30:00 | 000,003,399 | ---- | C] () -- C:\WINDOWS\System32\hptcpmon.ini [2000/09/13 19:00:00 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\BROSNMP.DLL ========== LOP Check ========== [2010/01/31 20:27:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Alwil Software [2006/05/28 01:20:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Digital Interactive Systems Corporation [2010/02/01 06:47:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ESET [2010/02/04 00:35:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Napster [2007/08/08 14:16:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\NetZero [2007/08/01 18:16:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ScanSoft [2010/01/17 14:15:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP [2006/10/02 22:31:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint ========== Purity Check ========== ========== Alternate Data Streams ========== @Alternate Data Stream - 115 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A8ADE5D8 @Alternate Data Stream - 114 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D1B5B4F1 @Alternate Data Stream - 103 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2 < End of report > |
|
|
|
|
Feb 4 2010, 11:07 PM
Post
#15
|
|
|
New Member Group: Authentic Member Posts: 12 Joined: 1-February 10 Member No.: 90,456 Operating System: XP |
Conspire,
Is it ok to connect to the internet finally and update Microsoft to Service Pack 3 and any other fixes? oldbear46 |
|
|
|
|
Similar Topics
| Topic Title | Replies | Topic Starter | Views | Last Action | |||
|---|---|---|---|---|---|---|---|
 |
3 | ErinMatthews | 39 | Today, 08:49 AM Last post by: paws |
|||
 |
15 | tiancheng | 452 | Today, 06:46 AM Last post by: Blade81 |
|||
|
15 | Angel2121 | 476 | Today, 05:46 AM Last post by: jpshortstuff |
|||
|
0 | heragoddess | 23 | Today, 03:01 AM Last post by: heragoddess |
|||
|
Time is now: 21st March 2010 - 01:59 PM |
Member site: Alliance of Security Analysis Professionals | UNITE Against Malware
Memory Forums | Auto Repair Forum
© Geeks to Go, Inc. | All Rights Reserved | Privacy Policy
