Spyware / Malware / Virus Removal

[Resolved] Windows Antivirus Pro on XP 64-bit

130 min read

Looking for the outcome? Ask AI

Pahonix

Post #46September 2, 2009, 3:22 PM UTC

Seems I should have turned off my antivirus before running that first scanner too. It caught everything before ESET did. So ESET came back with 0 threats found and no option to save a log file.

However, here's the log entries McAfee Antivirus' OnAccess scanner saved as the ESET scanner worked:

9/2/2009	10:35:17 AM	Deleted 	ACB-DUNN-COREI7\Administrator	F:\Program Files (x86)\ESET\ESET Online Scanner\OnlineCmdLineScanner.exe	F:\System Volume Information\_restore{5B690656-38CF-48D5-AE23-263DADC837F6}\RP48\A0002710.exe	Generic FakeAlert!bu (Trojan)
9/2/2009	10:35:17 AM	Deleted 	ACB-DUNN-COREI7\Administrator	F:\Program Files (x86)\ESET\ESET Online Scanner\OnlineCmdLineScanner.exe	F:\System Volume Information\_restore{5B690656-38CF-48D5-AE23-263DADC837F6}\RP48\A0002711.dll	FakeAlert-GA.dll (Trojan)
9/2/2009	10:35:17 AM	Deleted 	ACB-DUNN-COREI7\Administrator	F:\Program Files (x86)\ESET\ESET Online Scanner\OnlineCmdLineScanner.exe	F:\System Volume Information\_restore{5B690656-38CF-48D5-AE23-263DADC837F6}\RP48\A0002722.exe	Generic FakeAlert!bu (Trojan)
9/2/2009	10:35:17 AM	Deleted 	ACB-DUNN-COREI7\Administrator	F:\Program Files (x86)\ESET\ESET Online Scanner\OnlineCmdLineScanner.exe	F:\System Volume Information\_restore{5B690656-38CF-48D5-AE23-263DADC837F6}\RP48\A0002723.dll	FakeAlert-GA.dll (Trojan)
9/2/2009	10:35:18 AM	Deleted 	ACB-DUNN-COREI7\Administrator	F:\Program Files (x86)\ESET\ESET Online Scanner\OnlineCmdLineScanner.exe	F:\System Volume Information\_restore{5B690656-38CF-48D5-AE23-263DADC837F6}\RP49\A0002728.exe	Generic FakeAlert!bu (Trojan)
9/2/2009	10:35:18 AM	Deleted 	ACB-DUNN-COREI7\Administrator	F:\Program Files (x86)\ESET\ESET Online Scanner\OnlineCmdLineScanner.exe	F:\System Volume Information\_restore{5B690656-38CF-48D5-AE23-263DADC837F6}\RP49\A0002736.exe	Generic FakeAlert!bu (Trojan)
9/2/2009	10:35:18 AM	Deleted 	ACB-DUNN-COREI7\Administrator	F:\Program Files (x86)\ESET\ESET Online Scanner\OnlineCmdLineScanner.exe	F:\System Volume Information\_restore{5B690656-38CF-48D5-AE23-263DADC837F6}\RP49\A0002737.dll	FakeAlert-GA.dll (Trojan)
9/2/2009	10:35:44 AM	Deleted 	ACB-DUNN-COREI7\Administrator	F:\Program Files (x86)\ESET\ESET Online Scanner\OnlineCmdLineScanner.exe	F:\System Volume Information\_restore{5B690656-38CF-48D5-AE23-263DADC837F6}\RP50\A0002744.exe	Generic FakeAlert!bu (Trojan)
9/2/2009	10:35:44 AM	Deleted 	ACB-DUNN-COREI7\Administrator	F:\Program Files (x86)\ESET\ESET Online Scanner\OnlineCmdLineScanner.exe	F:\System Volume Information\_restore{5B690656-38CF-48D5-AE23-263DADC837F6}\RP50\A0002752.exe	Generic FakeAlert!bu (Trojan)
9/2/2009	10:35:44 AM	Deleted 	ACB-DUNN-COREI7\Administrator	F:\Program Files (x86)\ESET\ESET Online Scanner\OnlineCmdLineScanner.exe	F:\System Volume Information\_restore{5B690656-38CF-48D5-AE23-263DADC837F6}\RP50\A0002753.dll	FakeAlert-GA.dll (Trojan)
9/2/2009	10:46:18 AM	Deleted 	ACB-DUNN-COREI7\Administrator	F:\Program Files (x86)\ESET\ESET Online Scanner\OnlineCmdLineScanner.exe	F:\_OTS\MovedFiles\08312009_134238\F_WINDOWS\svchast.exe	Generic FakeAlert.a (Trojan)
9/2/2009	10:46:25 AM	Deleted 	ACB-DUNN-COREI7\Administrator	F:\Program Files (x86)\ESET\ESET Online Scanner\OnlineCmdLineScanner.exe	F:\_OTS\MovedFiles\08312009_134419\F_WINDOWS\SysWow64\dddesot.dll	FakeAlert-GA.dll (Trojan)
9/2/2009	10:46:25 AM	Deleted 	ACB-DUNN-COREI7\Administrator	F:\Program Files (x86)\ESET\ESET Online Scanner\OnlineCmdLineScanner.exe	F:\_OTS\MovedFiles\08312009_134419\F_WINDOWS\SysWow64\desot.exe	Generic FakeAlert!bu (Trojan)
9/2/2009	10:46:25 AM	Deleted 	ACB-DUNN-COREI7\Administrator	F:\Program Files (x86)\ESET\ESET Online Scanner\OnlineCmdLineScanner.exe	F:\_OTS\MovedFiles\08312009_134419\F_WINDOWS\SysWow64\onhelp.htm	FakeAlert-GA!htm (Trojan)
9/2/2009	10:46:25 AM	Deleted 	ACB-DUNN-COREI7\Administrator	F:\Program Files (x86)\ESET\ESET Online Scanner\OnlineCmdLineScanner.exe	F:\_OTS\MovedFiles\08312009_134419\F_WINDOWS\SysWow64\tapi.nfo	Generic Downloader.ap (Trojan)

And here's the log results from the Panda scan:

;*******************************************************************************
*********************************************************************************
*******************
ANALYSIS: 2009-09-02 11:17:20
PROTECTIONS: 1
MALWARE: 4
SUSPECTS: 0
;*******************************************************************************
*********************************************************************************
*******************
PROTECTIONS
Description								  Version					   Active	Updated
;===============================================================================
=================================================================================
===================
McAfee VirusScan Enterprise				  8.7.0.570					 No		Yes
;===============================================================================
=================================================================================
===================
MALWARE
Id		Description						Type				Active	Severity  Disinfectable  Disinfected Location
;===============================================================================
=================================================================================
===================
00139061  Cookie/Doubleclick				 TrackingCookie	  No		0		 Yes			No		   F:\Documents and Settings\Administrator\Cookies\administrator@doubleclick[1].txt
00139064  Cookie/Atlas DMT				   TrackingCookie	  No		0		 Yes			No		   F:\Documents and Settings\Administrator\Cookies\administrator@atdmt[2].txt
00167642  Cookie/Com.com					 TrackingCookie	  No		0		 Yes			No		   F:\Documents and Settings\Administrator\Cookies\administrator@com[1].txt
00170304  Cookie/WebtrendsLive			   TrackingCookie	  No		0		 Yes			No		   F:\Documents and Settings\Administrator\Cookies\[removed][2].txt
;===============================================================================
=================================================================================
===================
SUSPECTS
Sent	  Location																																																																																																																											  yj@9%
;===============================================================================
=================================================================================
===================
;===============================================================================
=================================================================================
===================
VULNERABILITIES
Id		Severity   Description																																																																																																																								yj@9%
;===============================================================================
=================================================================================
===================
;===============================================================================
=================================================================================
===================

Hmm, i thought the code tag used a monospace font to make that easier to read. I hope you can make it out. In the mean time, I'm off to install all the Windows updates that this machine needs.

CatByte

Post #47September 2, 2009, 3:39 PM UTC

Hi,

Please run this program, I want to make certain you are clean, then we can clean up our tools.

Please download OTL from one of the following mirrors:
- This is THE Mirror
Save it to your desktop.
Double click on the [external image: Posted Image] icon on your desktop.
Click the "Scan All Users" checkbox.
Push the [external image: Posted Image] button.
Two reports will open, copy and paste them in a reply here:
- OTListIt.txt <– Will be opened
- Extra.txt <– Will be minimized

Also, please advise how the computer is behaving and if there are any outstanding issues

Pahonix

Post #48September 2, 2009, 4:25 PM UTC

Now that everything is updated and seemingly clean, the computer runs great. I haven't run into any problems since the Malwarebytes scan/cleanup. Here's the two logs as requested:

OTL logfile created on: 9/2/2009 12:22:12 PM - Run 1
OTL by OldTimer - Version 3.0.10.7 Folder = F:\Documents and Settings\Administrator\Desktop
64bit-Windows Server 2003 Service Pack 2 (Version = 5.2.3790) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

4.00 Gb Total Physical Memory | 4.00 Gb Available Physical Memory | 100.00% Memory free
4.00 Gb Paging File | 4.00 Gb Available in Paging File | 100.00% Paging File free
Paging file location(s): F:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = F: | %SystemRoot% = F:\WINDOWS | %ProgramFiles% = F:\Program Files (x86)
Drive C: | 931.50 Gb Total Space | 929.10 Gb Free Space | 99.74% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
Drive F: | 59.61 Gb Total Space | 44.47 Gb Free Space | 74.60% Space Free | Partition Type: NTFS
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: ACB-DUNN-COREI7
Current User Name: Administrator
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Include 64bit Scans
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Processes (SafeList) ==========

PRC - [2004/06/14 00:00:00 | 00,057,344 | —- | M] (brother Industries Ltd) – F:\WINDOWS\SysWOW64\brsvc01a.exe
PRC - [2001/12/13 00:01:00 | 00,045,056 | —- | M] (brother Industries Ltd) – F:\WINDOWS\SysWOW64\brss01a.exe
PRC - [2009/01/21 15:00:54 | 00,065,536 | —- | M] () – F:\Program Files (x86)\Brother\BRAdmin Professional 3\bratimer.exe
PRC - [2008/03/14 04:00:00 | 00,103,744 | —- | M] (McAfee, Inc.) – F:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe
PRC - [2008/09/29 08:07:00 | 00,062,800 | —- | M] (McAfee, Inc.) – F:\Program Files (x86)\McAfee\VirusScan Enterprise\VsTskMgr.exe
PRC - [2008/03/14 04:00:00 | 00,226,624 | —- | M] (McAfee, Inc.) – F:\Program Files (x86)\McAfee\Common Framework\naPrdMgr.exe
PRC - [2008/10/28 05:18:26 | 17,331,200 | —- | M] (Realtek Semiconductor Corp.) – F:\WINDOWS\RTHDCPL.EXE
PRC - [2008/03/14 04:00:00 | 00,136,512 | —- | M] (McAfee, Inc.) – F:\Program Files (x86)\McAfee\Common Framework\udaterui.exe
PRC - [2008/09/29 08:07:00 | 00,124,240 | —- | M] (McAfee, Inc.) – F:\Program Files (x86)\McAfee\VirusScan Enterprise\SHSTAT.EXE
PRC - [2004/12/14 02:12:02 | 00,483,328 | —- | M] (Adobe Systems Inc.) – F:\Program Files (x86)\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
PRC - [2009/09/02 12:21:22 | 00,514,048 | —- | M] (OldTimer Tools) – F:\Documents and Settings\Administrator\Desktop\OTL.exe

========== Win32 Services (SafeList) ==========

SRV - [2008/07/25 10:13:44 | 00,046,088 | —- | M] (Microsoft Corporation) – F:\WINDOWS\Microsoft.NET\Framework64\v2.0.50727\aspnet_state.exe – (aspnet_state [On_Demand | Stopped])
SRV - [2009/05/15 21:05:00 | 00,665,088 | —- | M] () – F:\WINDOWS\SysWow64\ati2saag.exe – (ATI Smart [Auto | Stopped])
SRV - [2009/01/21 15:00:54 | 00,065,536 | —- | M] () – F:\Program Files (x86)\Brother\BRAdmin Professional 3\bratimer.exe – (BRA_Scheduler [Auto | Running])
SRV - [2004/06/14 00:00:00 | 00,057,344 | —- | M] (brother Industries Ltd) – F:\WINDOWS\SysWOW64\brsvc01a.exe – (Brother XP spl Service [Auto | Running])
SRV - [2008/07/25 11:17:02 | 00,069,632 | —- | M] (Microsoft Corporation) – F:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe – (clr_optimization_v2.0.50727_32 [On_Demand | Stopped])
SRV - [2008/07/25 10:13:48 | 00,093,184 | —- | M] (Microsoft Corporation) – F:\WINDOWS\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe – (clr_optimization_v2.0.50727_64 [On_Demand | Stopped])
SRV - [2008/07/29 21:18:04 | 00,046,104 | —- | M] (Microsoft Corporation) – F:\WINDOWS\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe – (FontCache3.0.0.0 [On_Demand | Stopped])
SRV - [2007/02/17 00:44:20 | 00,077,312 | —- | M] (Microsoft Corporation) – F:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll – (helpsvc [Auto | Running])
SRV - [2005/03/25 08:00:00 | 00,162,816 | —- | M] (Microsoft Corporation) – F:\WINDOWS\SysWOW64\iasrecst.dll – (IASJet [On_Demand | Stopped])
SRV - [2008/07/29 19:28:38 | 00,859,648 | —- | M] (Microsoft Corporation) – F:\WINDOWS\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe – (idsvc [Unknown | Stopped])
SRV - [2008/09/29 08:07:00 | 00,017,920 | —- | M] (McAfee, Inc.) – F:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\EngineServer.exe – (McAfeeEngineService [Unknown | Running])
SRV - [2008/03/14 04:00:00 | 00,103,744 | —- | M] (McAfee, Inc.) – F:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe – (McAfeeFramework [Unknown | Running])
SRV - [2008/09/29 08:07:00 | 00,175,072 | —- | M] (McAfee, Inc.) – F:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\McShield.exe – (McShield [Unknown | Running])
SRV - [2008/09/29 08:07:00 | 00,062,800 | —- | M] (McAfee, Inc.) – F:\Program Files (x86)\McAfee\VirusScan Enterprise\VsTskMgr.exe – (McTaskManager [Unknown | Running])
SRV - [2007/02/18 11:05:42 | 00,430,592 | —- | M] (Microsoft Corporation) – F:\WINDOWS\SysWow64\netlogon.dll – (Netlogon [On_Demand | Stopped])
SRV - [2003/07/28 12:28:22 | 00,089,136 | —- | M] (Microsoft Corporation) – F:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE – (ose [On_Demand | Stopped])
SRV - [2005/03/25 08:00:00 | 00,039,424 | —- | M] (Microsoft Corporation) – F:\WINDOWS\SysWow64\wdfmgr.exe – (UMWdf [On_Demand | Stopped])

========== Driver Services (SafeList) ==========

DRV - [2000/07/24 01:01:00 | 00,019,537 | —- | M] (Brother Industries Ltd.) – F:\WINDOWS\System32\drivers\BrPar.sys – (BrPar [Auto | Stopped])
DRV - [2005/03/25 08:00:00 | 00,033,792 | —- | M] (Microsoft Corporation) – F:\WINDOWS\SysWow64\mnmdd.dll – (mnmdd [System | Running])

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = F:\WINDOWS\system32\blank.htm
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = F:\WINDOWS\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm

IE - HKU\.DEFAULT\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-4179629445-2272284309-725556747-500\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = F:\WINDOWS\system32\blank.htm
IE - HKU\S-1-5-21-4179629445-2272284309-725556747-500\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?p…amp;ar=iesearch
IE - HKU\S-1-5-21-4179629445-2272284309-725556747-500\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?p…&ar=msnhome
IE - HKU\S-1-5-21-4179629445-2272284309-725556747-500\S-1-5-21-4179629445-2272284309-725556747-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\software\mozilla\Firefox\Extensions\\{20a82645-c095-46ed-80e3-08825760534b}: F:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [2009/09/02 09:59:48 | 00,000,000 | —D | M]

Hosts file not found
O2:64bit: - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - F:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\scriptsn.dll (McAfee, Inc.)
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Program Files (x86)\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - F:\Program Files (x86)\McAfee\VirusScan Enterprise\scriptsn.dll (McAfee, Inc.)
O2 - BHO: (AcroIEToolbarHelper Class) - {AE7CD045-E861-484f-8273-0445EE161910} - F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKU\S-1-5-21-4179629445-2272284309-725556747-500\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [Alcmtr] F:\WINDOWS\ALCMTR.EXE (Realtek Semiconductor Corp.)
O4:64bit: - HKLM..\Run: [AlcWzrd] F:\WINDOWS\ALCWZRD.EXE (RealTek Semicoductor Corp.)
O4:64bit: - HKLM..\Run: [RTHDCPL] F:\WINDOWS\RTHDCPL.EXE (Realtek Semiconductor Corp.)
O4:64bit: - HKLM..\Run: [SkyTel] F:\WINDOWS\SkyTel.EXE (Realtek Semiconductor Corp.)
O4:64bit: - HKLM..\Run: [SoundMan] F:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [Acrobat Assistant 7.0] F:\Program Files (x86)\Adobe\Acrobat 7.0\Distillr\Acrotray.exe (Adobe Systems Inc.)
O4 - HKLM..\Run: [McAfeeUpdaterUI] F:\Program Files (x86)\McAfee\Common Framework\udaterui.exe (McAfee, Inc.)
O4 - HKLM..\Run: [ShStatEXE] F:\Program Files (x86)\McAfee\VirusScan Enterprise\SHSTAT.EXE (McAfee, Inc.)
O4 - HKLM..\Run: [StartCCC] F:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKU\.DEFAULT..\RunOnce: [tscuninstall] F:\WINDOWS\SysWow64\tscupgrd.exe File not found
O4 - HKU\S-1-5-18..\RunOnce: [tscuninstall] F:\WINDOWS\SysWow64\tscupgrd.exe File not found
O4 - HKU\S-1-5-19..\RunOnce: [tscuninstall] F:\WINDOWS\SysWow64\tscupgrd.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [tscuninstall] F:\WINDOWS\SysWow64\tscupgrd.exe File not found
O4 - Startup: F:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk = F:\WINDOWS\Installer\{AC76BA86-1033-0000-BA7E-100000000002}\SC_Acrobat.exe ()
O4 - Startup: F:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk = F:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: ForceActiveDesktopOn = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: scforceoption = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-4179629445-2272284309-725556747-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8:64bit: - Extra context menu item: Convert link target to Adobe PDF - F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Convert link target to existing PDF - F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Convert selected links to Adobe PDF - F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Convert selected links to existing PDF - F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Convert selection to Adobe PDF - F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Convert selection to existing PDF - F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Convert to Adobe PDF - F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Convert to existing PDF - F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: E&xport to Microsoft Excel - F:\Program Files (x86)\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Convert link target to Adobe PDF - F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert link target to existing PDF - F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selected links to Adobe PDF - F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selected links to existing PDF - F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selection to Adobe PDF - F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selection to existing PDF - F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert to Adobe PDF - F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert to existing PDF - F:\Program Files (x86)\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: E&xport to Microsoft Excel - F:\Program Files (x86)\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation)
O9:64bit: - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - F:\Program Files (x86)\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O15:64bit: - ..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab (ActiveScan 2.0 Installer Class)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/…b?1247275271781 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdat…b?1251900151765 (MUWebControl Class)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed] [removed]
O18:64bit: - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - F:\WINDOWS\SysNative\mshtml.dll File not found
O18:64bit: - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - F:\WINDOWS\SysNative\mshtml.dll File not found
O18:64bit: - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - F:\WINDOWS\SysNative\mshtml.dll File not found
O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - F:\WINDOWS\SysNative\mshtml.dll File not found
O18:64bit: - Protocol\Handler\sysimage {76E67A63-06E9-11D2-A840-006008059382} - F:\WINDOWS\SysNative\mshtml.dll File not found
O18:64bit: - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - F:\WINDOWS\SysNative\mshtml.dll File not found
O18:64bit: - Protocol\Handler\wia {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - F:\WINDOWS\SysNative\wiascr.dll File not found
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - F:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - F:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - F:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - F:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - F:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - F:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - F:\Program Files (x86)\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - F:\Program Files (x86)\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18:64bit: - Protocol\Filter: - application/octet-stream - File not found
O18:64bit: - Protocol\Filter: - application/x-complus - File not found
O18:64bit: - Protocol\Filter: - application/x-msdownload - File not found
O18:64bit: - Protocol\Filter: - text/xml - Reg Error: Key error. File not found
O18 - Protocol\Filter: - text/xml - F:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - F:\WINDOWS\Explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UIHost - (%SystemRoot%\system32\logonui.exe) - F:\WINDOWS\SysNative\logonui.exe File not found
O20:64bit: - HKLM Winlogon: VMApplet - (Control_RunDLL "sysdm.cpl") - File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - F:\WINDOWS\SysWow64\Explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: System - (lsass.exe) - File not found
O20:64bit: - Winlogon\Notify\AtiExtEvent: DllName - Reg Error: Key error. - File not found
O20:64bit: - Winlogon\Notify\crypt32chain: DllName - crypt32.dll - File not found
O20:64bit: - Winlogon\Notify\cryptnet: DllName - cryptnet.dll - File not found
O20:64bit: - Winlogon\Notify\cscdll: DllName - cscdll.dll - File not found
O20:64bit: - Winlogon\Notify\dimsntfy: DllName - dimsntfy.dll - File not found
O20:64bit: - Winlogon\Notify\ScCertProp: DllName - wlnotify.dll - File not found
O20:64bit: - Winlogon\Notify\Schedule: DllName - wlnotify.dll - File not found
O20:64bit: - Winlogon\Notify\sclgntfy: DllName - sclgntfy.dll - File not found
O20:64bit: - Winlogon\Notify\SensLogn: DllName - WlNotify.dll - File not found
O20:64bit: - Winlogon\Notify\termsrv: DllName - Reg Error: Key error. - File not found
O20:64bit: - Winlogon\Notify\wlballoon: DllName - wlnotify.dll - File not found
O20 - Winlogon\Notify\ScCertProp: DllName - wlnotify.dll - File not found
O20 - Winlogon\Notify\Schedule: DllName - wlnotify.dll - File not found
O20 - Winlogon\Notify\SensLogn: DllName - WlNotify.dll - File not found
O20 - Winlogon\Notify\wlballoon: DllName - wlnotify.dll - File not found
O21:64bit: - SSODL: SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} - F:\WINDOWS\SysNative\stobject.dll File not found
O28:64bit: - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - File not found
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/07/10 20:40:29 | 00,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O33 - MountPoints2\{2beef6d5-6e37-11de-b0ef-0001292264a7}\Shell - "" = AutoRun
O33 - MountPoints2\{2beef6d5-6e37-11de-b0ef-0001292264a7}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{2beef6d5-6e37-11de-b0ef-0001292264a7}\Shell\AutoRun\command - "" = G:\LaunchU3.exe – File not found
O33 - MountPoints2\{dcb2c169-6e4a-11de-85a3-0001292264a7}\Shell - "" = AutoRun
O33 - MountPoints2\{dcb2c169-6e4a-11de-85a3-0001292264a7}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{dcb2c169-6e4a-11de-85a3-0001292264a7}\Shell\AutoRun\command - "" = G:\LaunchU3.exe – File not found
O33 - MountPoints2\{fdbee656-6e39-11de-a229-0001292264a7}\Shell\AutoRun\command - "" = G:\setup.exe – File not found
O34 - HKLM BootExecute: (autocheck) - File not found
O34 - HKLM BootExecute: (autochk) - F:\WINDOWS\SysWow64\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (*) - File not found

========== Files/Folders - Created Within 30 Days ==========

[2009/09/02 12:21:15 | 00,514,048 | —- | C] (OldTimer Tools) – F:\Documents and Settings\Administrator\Desktop\OTL.exe
[2009/09/02 12:06:48 | 00,000,000 | —D | C] – F:\WINDOWS\ie8updates
[2009/09/02 12:06:44 | 11,067,392 | —- | C] (Microsoft Corporation) – F:\WINDOWS\SysWow64\ieframe.dll
[2009/09/02 12:06:44 | 05,937,152 | —- | C] (Microsoft Corporation) – F:\WINDOWS\SysWow64\mshtml.dll
[2009/09/02 12:06:44 | 01,985,536 | —- | C] (Microsoft Corporation) – F:\WINDOWS\SysWow64\iertutil.dll
[2009/09/02 12:06:44 | 01,208,832 | —- | C] (Microsoft Corporation) – F:\WINDOWS\SysWow64\urlmon.dll
[2009/09/02 12:06:44 | 00,915,456 | —- | C] (Microsoft Corporation) – F:\WINDOWS\SysWow64\wininet.dll
[2009/09/02 12:06:44 | 00,184,320 | —- | C] (Microsoft Corporation) – F:\WINDOWS\SysWow64\iepeers.dll
[2009/09/02 12:05:48 | 00,000,000 | -H-D | C] – F:\WINDOWS\ie8
[2009/09/02 11:48:40 | 00,000,000 | -H-D | C] – F:\Program Files\Uninstall Information
[2009/09/02 11:43:32 | 00,000,000 | —D | C] – F:\WINDOWS\ie7updates
[2009/09/02 11:43:08 | 00,000,000 | —D | C] – F:\WINDOWS\WBEM
[2009/09/02 11:42:40 | 00,000,000 | -H-D | C] – F:\WINDOWS\ie7
[2009/09/02 11:42:34 | 00,000,000 | -H-D | C] – F:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$
[2009/09/02 11:42:25 | 00,000,000 | -H-D | C] – F:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$
[2009/09/02 11:11:40 | 00,000,000 | —D | C] – F:\Program Files (x86)\Panda Security
[2009/09/02 10:35:17 | 00,000,000 | —D | C] – F:\QUARANTINE
[2009/09/02 10:17:47 | 00,000,000 | —D | C] – F:\Program Files (x86)\ESET
[2009/09/02 10:07:58 | 00,039,936 | —- | C] (Microsoft Corporation) – F:\WINDOWS\SysWow64\icacls.exe
[2009/09/02 10:07:58 | 00,008,192 | —- | C] (Microsoft Corporation) – F:\WINDOWS\SysWow64\kbdfi1.dll
[2009/09/02 10:07:58 | 00,007,168 | —- | C] (Microsoft Corporation) – F:\WINDOWS\SysWow64\kbdiultn.dll
[2009/09/02 10:07:58 | 00,007,168 | —- | C] (Microsoft Corporation) – F:\WINDOWS\SysWow64\kbdbhc.dll
[2009/09/02 10:07:58 | 00,006,144 | —- | C] (Microsoft Corporation) – F:\WINDOWS\SysWow64\kbdmaori.dll
[2009/09/02 10:07:57 | 01,099,264 | —- | C] () – F:\WINDOWS\adfs.msp
[2009/09/02 10:07:57 | 00,029,184 | —- | C] (Microsoft Corporation) – F:\WINDOWS\SysWow64\verclsid.exe
[2009/09/02 10:07:57 | 00,020,480 | —- | C] (Microsoft Corporation) – F:\WINDOWS\SysWow64\setupn.exe
[2009/09/02 10:07:57 | 00,008,192 | —- | C] (Microsoft Corporation) – F:\WINDOWS\SysWow64\kbdsmsno.dll
[2009/09/02 10:07:57 | 00,008,192 | —- | C] (Microsoft Corporation) – F:\WINDOWS\SysWow64\kbdsmsfi.dll
[2009/09/02 10:07:57 | 00,008,192 | —- | C] (Microsoft Corporation) – F:\WINDOWS\SysWow64\kbdno1.dll
[2009/09/02 10:07:57 | 00,007,680 | —- | C] (Microsoft Corporation) – F:\WINDOWS\SysWow64\kbdukx.dll
[2009/09/02 10:07:57 | 00,007,168 | —- | C] (Microsoft Corporation) – F:\WINDOWS\SysWow64\kbdmlt48.dll
[2009/09/02 10:07:57 | 00,007,168 | —- | C] (Microsoft Corporation) – F:\WINDOWS\SysWow64\kbdmlt47.dll
[2009/09/02 10:07:57 | 00,006,656 | —- | C] (Microsoft Corporation) – F:\WINDOWS\SysWow64\kbdpash.dll
[2009/09/02 10:07:57 | 00,006,656 | —- | C] (Microsoft Corporation) – F:\WINDOWS\SysWow64\kbdnepr.dll
[2009/09/02 10:07:57 | 00,000,000 | —D | C] – F:\WINDOWS\adfs
[2009/09/02 10:07:56 | 00,000,000 | —D | C] – F:\WINDOWS\SysWow64\en
[2009/09/02 10:07:08 | 00,000,000 | —D | C] – F:\WINDOWS\ServicePackFiles
[2009/09/02 10:06:58 | 01,364,480 | —- | C] (Microsoft Corporation) – F:\WINDOWS\explorer.exe
[2009/09/02 10:06:57 | 00,148,992 | —- | C] (Microsoft Corporation) – F:\WINDOWS\SysWow64\apphelp.dll
[2009/09/02 10:06:56 | 00,088,576 | —- | C] (Microsoft Corporation) – F:\WINDOWS\SysWow64\cabinet.dll
[2009/09/02 10:06:55 | 00,599,040 | —- | C] (Microsoft Corporation) – F:\WINDOWS\SysWow64\comctl32.dll
[2009/09/02 10:06:55 | 00,595,456 | —- | C] (Microsoft Corporation) – F:\WINDOWS\SysWow64\crypt32.dll
[2009/09/02 10:06:55 | 00,506,880 | —- | C] (Microsoft Corporation) – F:\WINDOWS\SysWow64\cryptui.dll
[2009/09/02 10:06:55 | 00,273,408 | —- | C] (Microsoft Corporation) – F:\WINDOWS\SysWow64\comdlg32.dll
[2009/09/02 10:06:55 | 00,062,464 | —- | C] (Microsoft Corporation) – F:\WINDOWS\SysWow64\cryptnet.dll
[2009/09/02 10:06:53 | 00,360,960 | —- | C] (Microsoft Corporation) – F:\WINDOWS\SysWow64\dsound.dll
[2009/09/02 10:06:52 | 00,355,328 | —- | C] (Microsoft Corporation) – F:\WINDOWS\SysWow64\hnetcfg.dll
[2009/09/02 10:06:52 | 00,147,968 | —- | C] (Microsoft Corporation) – F:\WINDOWS\SysWow64\imagehlp.dll
[2009/09/02 10:06:52 | 00,112,640 | —- | C] (Microsoft Corporation) – F:\WINDOWS\SysWow64\imm32.dll
[2009/09/02 10:06:51 | 00,095,232 | —- | C] (Microsoft Corporation) – F:\WINDOWS\SysWow64\iphlpapi.dll
[2009/09/02 10:06:51 | 00,019,968 | —- | C] (Microsoft Corporation) – F:\WINDOWS\SysWow64\linkinfo.dll
[2009/09/02 10:06:50 | 00,589,824 | —- | C] (Microsoft Corporation) – F:\WINDOWS\SysWow64\mlang.dll
[2009/09/02 10:06:50 | 00,057,856 | —- | C] (Microsoft Corporation) – F:\WINDOWS\SysWow64\mpr.dll
[2009/09/02 10:06:49 | 00,271,360 | —- | C] (Microsoft Corporation) – F:\WINDOWS\SysWow64\msihnd.dll
[2009/09/02 10:06:49 | 00,078,848 | —- | C] (Microsoft Corporation) – F:\WINDOWS\SysWow64\msiexec.exe
[2009/09/02 10:06:49 | 00,071,168 | —- | C] (Microsoft Corporation) – F:\WINDOWS\SysWow64\msacm32.dll
[2009/09/02 10:06:49 | 00,057,344 | —- | C] (Microsoft Corporation) – F:\WINDOWS\SysWow64\msasn1.dll
[2009/09/02 10:06:48 | 00,348,672 | —- | C] (Microsoft Corporation) – F:\WINDOWS\SysWow64\msvcrt.dll
[2009/09/02 10:06:47 | 00,142,848 | —- | C] (Microsoft Corporation) – F:\WINDOWS\SysWow64\ntshrui.dll
[2009/09/02 10:06:47 | 00,121,856 | —- | C] (Microsoft Corporation) – F:\WINDOWS\SysWow64\ntmarta.dll
[2009/09/02 10:06:47 | 00,071,680 | —- | C] (Microsoft Corporation) – F:\WINDOWS\SysWow64\ntdsapi.dll
[2009/09/02 10:06:46 | 01,267,200 | —- | C] (Microsoft Corporation) – F:\WINDOWS\SysWow64\ole32.dll
[2009/09/02 10:06:46 | 00,180,224 | —- | C] (Microsoft Corporation) – F:\WINDOWS\SysWow64\oleacc.dll
[2009/09/02 10:06:46 | 00,076,288 | —- | C] (Microsoft Corporation) – F:\WINDOWS\SysWow64\olecli32.dll
[2009/09/02 10:06:46 | 00,038,912 | —- | C] (Microsoft Corporation) – F:\WINDOWS\SysWow64\olecnv32.dll
[2009/09/02 10:06:45 | 00,246,272 | —- | C] (Microsoft Corporation) – F:\WINDOWS\SysWow64\rasapi32.dll
[2009/09/02 10:06:45 | 00,062,976 | —- | C] (Microsoft Corporation) – F:\WINDOWS\SysWow64\rasman.dll
[2009/09/02 10:06:45 | 00,020,480 | —- | C] (Microsoft Corporation) – F:\WINDOWS\SysWow64\psapi.dll
[2009/09/02 10:06:45 | 00,007,680 | —- | C] (Microsoft Corporation) – F:\WINDOWS\SysWow64\rasadhlp.dll
[2009/09/02 10:06:44 | 01,069,568 | —- | C] (Microsoft Corporation) – F:\WINDOWS\SysWow64\setupapi.dll
[2009/09/02 10:06:44 | 00,213,336 | —- | C] (Microsoft Corporation) – F:\WINDOWS\SysWow64\rsaenh.dll
[2009/09/02 10:06:44 | 00,047,104 | —- | C] (Microsoft Corporation) – F:\WINDOWS\SysWow64\samlib.dll
[2009/09/02 10:06:44 | 00,006,656 | —- | C] (Microsoft Corporation) – F:\WINDOWS\SysWow64\sensapi.dll
[2009/09/02 10:06:43 | 00,320,000 | —- | C] (Microsoft Corporation) – F:\WINDOWS\SysWow64\shlwapi.dll
[2009/09/02 10:06:43 | 00,141,312 | —- | C] (Microsoft Corporation) – F:\WINDOWS\SysWow64\sfc_os.dll
[2009/09/02 10:06:42 | 00,762,368 | —- | C] (Microsoft Corporation) – F:\WINDOWS\SysWow64\sxs.dll
[2009/09/02 10:06:42 | 00,183,808 | —- | C] (Microsoft Corporation) – F:\WINDOWS\SysWow64\tapi32.dll
[2009/09/02 10:06:42 | 00,016,896 | —- | C] (Microsoft Corporation) – F:\WINDOWS\SysWow64\stdole2.tlb
[2009/09/02 10:06:41 | 00,780,800 | —- | C] (Microsoft Corporation) – F:\WINDOWS\SysWow64\userenv.dll
[2009/09/02 10:06:41 | 00,215,040 | —- | C] (Microsoft Corporation) – F:\WINDOWS\SysWow64\uxtheme.dll
[2009/09/02 10:06:41 | 00,174,080 | —- | C] (Microsoft Corporation) – F:\WINDOWS\SysWow64\winmm.dll
[2009/09/02 10:06:41 | 00,017,408 | —- | C] (Microsoft Corporation) – F:\WINDOWS\SysWow64\winrnr.dll
[2009/09/02 10:06:40 | 00,179,712 | —- | C] (Microsoft Corporation) – F:\WINDOWS\SysWow64\wldap32.dll
[2009/09/02 10:06:40 | 00,165,888 | —- | C] (Microsoft Corporation) – F:\WINDOWS\SysWow64\wintrust.dll
[2009/09/02 10:06:40 | 00,150,528 | —- | C] (Microsoft Corporation) – F:\WINDOWS\SysWow64\winspool.drv
[2009/09/02 10:06:40 | 00,056,320 | —- | C] (Microsoft Corporation) – F:\WINDOWS\SysWow64\winsta.dll
[2009/09/02 10:06:39 | 00,812,544 | —- | C] (Microsoft Corporation) – F:\WINDOWS\SysWow64\ws03res.dll
[2009/09/02 10:06:39 | 00,083,456 | —- | C] (Microsoft Corporation) – F:\WINDOWS\SysWow64\ws2_32.dll
[2009/09/02 10:06:39 | 00,019,456 | —- | C] (Microsoft Corporation) – F:\WINDOWS\SysWow64\wtsapi32.dll
[2009/09/02 10:06:39 | 00,018,944 | —- | C] (Microsoft Corporation) – F:\WINDOWS\SysWow64\wshtcpip.dll
[2009/09/02 10:06:38 | 02,897,920 | —- | C] (Microsoft Corporation) – F:\WINDOWS\SysWow64\xpsp2res.dll
[2009/09/02 10:04:48 | 00,000,000 | -H-D | C] – F:\WINDOWS\$NtServicePackUninstall$
[2009/09/02 10:04:48 | 00,000,000 | —D | C] – F:\WINDOWS\PolicyBackup
[2009/09/02 09:28:34 | 11,746,7995 | —- | C] (McAfee, Inc.) – F:\Documents and Settings\Administrator\Desktop\sdat5727.exe
[2009/09/02 08:54:33 | 03,088,104 | —- | C] (Malwarebytes Corporation ) – F:\Documents and Settings\Administrator\Desktop\mbam-rules.exe
[2009/09/02 08:52:40 | 00,000,000 | —D | C] – F:\Documents and Settings\Administrator\Application Data\Malwarebytes
[2009/09/02 08:52:39 | 00,000,726 | —- | C] () – F:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2009/09/02 08:52:37 | 00,038,160 | —- | C] (Malwarebytes Corporation) – F:\WINDOWS\SysWow64\drivers\mbamswissarmy.sys
[2009/09/02 08:52:36 | 00,000,000 | —D | C] – F:\Program Files (x86)\Malwarebytes' Anti-Malware
[2009/09/02 08:52:36 | 00,000,000 | —D | C] – F:\Documents and Settings\All Users\Application Data\Malwarebytes
[2009/09/02 08:52:17 | 03,942,048 | —- | C] (Malwarebytes Corporation ) – F:\Documents and Settings\Administrator\Desktop\mbam-setup.exe
[2009/09/02 08:20:07 | 01,557,504 | —- | C] (Topala Software Solutions) – F:\Documents and Settings\Administrator\Desktop\siw.exe
[2009/09/01 13:31:42 | 00,000,437 | —- | C] () – F:\Documents and Settings\Administrator\Desktop\exe.reg
[2009/09/01 13:18:50 | 00,000,000 | —D | C] – F:\Application Data
[2009/09/01 10:16:32 | 00,000,350 | —- | C] () – F:\Documents and Settings\Administrator\Desktop\fixme.reg
[2009/09/01 08:20:50 | 00,000,129 | —- | C] () – F:\Documents and Settings\Administrator\Desktop\query.bat
[2009/08/31 13:42:38 | 00,000,000 | —D | C] – F:\_OTS
[2009/08/31 11:32:45 | 00,514,048 | —- | C] (OldTimer Tools) – F:\Documents and Settings\Administrator\Desktop\OTS.exe
[2009/08/31 10:47:51 | 00,401,720 | —- | C] (Trend Micro Inc.) – F:\Documents and Settings\Administrator\Desktop\HijackThis.exe
[2009/08/31 10:39:13 | 00,000,000 | —D | C] – F:\WINDOWS\ERDNT
[2009/08/31 10:38:42 | 00,000,641 | —- | C] () – F:\Documents and Settings\Administrator\Desktop\NTREGOPT.lnk
[2009/08/31 10:38:42 | 00,000,622 | —- | C] () – F:\Documents and Settings\Administrator\Desktop\ERUNT.lnk
[2009/08/31 10:38:41 | 00,000,000 | —D | C] – F:\Program Files (x86)\ERUNT
[2009/08/31 09:56:36 | 00,472,064 | —- | C] ( ) – F:\Documents and Settings\Administrator\Desktop\RootRepeal.exe
[2009/08/31 09:56:29 | 00,791,393 | —- | C] (Lars Hederer ) – F:\Documents and Settings\Administrator\Desktop\asdjflkjt.exe
[2009/07/11 15:45:00 | 00,033,280 | —- | C] () – F:\WINDOWS\SysWow64\Sp32w.dll
[2009/07/11 15:17:25 | 00,000,030 | —- | C] () – F:\WINDOWS\SysWow64\brss01a.ini
[2009/07/11 15:17:24 | 00,000,410 | —- | C] () – F:\WINDOWS\BRWMARK.INI
[2009/07/11 14:14:28 | 00,000,153 | —- | C] () – F:\WINDOWS\BRVIDEO.INI
[2009/07/11 14:14:28 | 00,000,052 | —- | C] () – F:\WINDOWS\brpp2ka.ini
[2009/07/11 14:14:28 | 00,000,040 | —- | C] () – F:\WINDOWS\BRDIAG.INI
[2009/07/11 14:14:28 | 00,000,023 | —- | C] () – F:\WINDOWS\Brownie.ini
[2009/07/11 14:14:28 | 00,000,000 | —- | C] () – F:\WINDOWS\bw5170dn.ini
[2009/07/11 14:14:28 | 00,000,000 | —- | C] () – F:\WINDOWS\brmx2001.ini
[2009/07/11 14:14:26 | 00,077,824 | —- | C] () – F:\WINDOWS\SysWow64\BROSNMP.DLL
[2009/07/11 14:14:26 | 00,026,624 | —- | C] () – F:\WINDOWS\SysWow64\BRGSRC32.DLL
[2009/07/11 14:14:26 | 00,015,108 | —- | C] () – F:\WINDOWS\HL-5170DN.INI
[2009/07/11 14:14:26 | 00,004,608 | —- | C] () – F:\WINDOWS\SysWow64\BRGSRC16.DLL
[2009/07/11 14:14:13 | 00,045,056 | —- | C] () – F:\WINDOWS\SysWow64\PTRCENG.DLL
[2009/07/11 14:07:47 | 00,000,376 | —- | C] () – F:\WINDOWS\ODBC.INI
[2009/07/10 20:54:58 | 00,541,752 | —- | C] () – F:\WINDOWS\SysWow64\PerfStringBackup.INI
[2009/07/10 20:39:26 | 00,000,497 | —- | C] () – F:\WINDOWS\win.ini
[2009/07/10 16:16:08 | 00,000,150 | —- | C] () – F:\WINDOWS\system.ini
[2005/03/25 08:00:00 | 01,277,952 | —- | C] () – F:\WINDOWS\SysWow64\quartz.dll
[2005/03/25 08:00:00 | 00,733,696 | —- | C] () – F:\WINDOWS\SysWow64\qedwipes.dll
[2005/03/25 08:00:00 | 00,512,512 | —- | C] () – F:\WINDOWS\SysWow64\qedit.dll
[2005/03/25 08:00:00 | 00,498,742 | —- | C] () – F:\WINDOWS\SysWow64\dxmasf.dll
[2005/03/25 08:00:00 | 00,396,288 | —- | C] () – F:\WINDOWS\SysWow64\encdec.dll
[2005/03/25 08:00:00 | 00,385,536 | —- | C] () – F:\WINDOWS\SysWow64\qdvd.dll
[2005/03/25 08:00:00 | 00,355,112 | —- | C] () – F:\WINDOWS\SysWow64\msjetoledb40.dll
[2005/03/25 08:00:00 | 00,279,040 | —- | C] () – F:\WINDOWS\SysWow64\qdv.dll
[2005/03/25 08:00:00 | 00,276,992 | —- | C] () – F:\WINDOWS\SysWow64\sbe.dll
[2005/03/25 08:00:00 | 00,199,168 | —- | C] () – F:\WINDOWS\SysWow64\ir32_32.dll
[2005/03/25 08:00:00 | 00,192,512 | —- | C] () – F:\WINDOWS\SysWow64\qcap.dll
[2005/03/25 08:00:00 | 00,114,688 | —- | C] () – F:\WINDOWS\SysWow64\msencode.dll
[2005/03/25 08:00:00 | 00,072,704 | —- | C] () – F:\WINDOWS\SysWow64\amstream.dll
[2005/03/25 08:00:00 | 00,062,464 | —- | C] () – F:\WINDOWS\SysWow64\mciqtz32.dll
[2005/03/25 08:00:00 | 00,061,440 | —- | C] () – F:\WINDOWS\SysWow64\devenum.dll
[2005/03/25 08:00:00 | 00,016,896 | —- | C] () – F:\WINDOWS\SysWow64\tsd32.dll
[2005/03/25 08:00:00 | 00,014,336 | —- | C] () – F:\WINDOWS\SysWow64\msdmo.dll
[2005/03/25 08:00:00 | 00,004,126 | —- | C] () – F:\WINDOWS\SysWow64\msdxmlc.dll
[2003/01/07 15:05:08 | 00,002,695 | —- | C] () – F:\WINDOWS\SysWow64\OUTLPERF.INI

========== Files - Modified Within 30 Days ==========

[2009/09/02 12:21:22 | 00,514,048 | —- | M] (OldTimer Tools) – F:\Documents and Settings\Administrator\Desktop\OTL.exe
[2009/09/02 12:13:42 | 00,002,359 | —- | M] () – F:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk
[2009/09/02 12:13:38 | 00,000,006 | -H– | M] () – F:\WINDOWS\tasks\SA.DAT
[2009/09/02 12:13:37 | 00,002,048 | –S- | M] () – F:\WINDOWS\bootstat.dat
[2009/09/02 12:06:56 | 00,000,956 | —- | M] () – F:\WINDOWS\imsins.BAK
[2009/09/02 11:59:21 | 00,000,497 | —- | M] () – F:\WINDOWS\win.ini
[2009/09/02 11:48:44 | 00,042,560 | —- | M] () – F:\Documents and Settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2009/09/02 09:28:46 | 11,746,7995 | —- | M] (McAfee, Inc.) – F:\Documents and Settings\Administrator\Desktop\sdat5727.exe
[2009/09/02 09:01:37 | 03,942,048 | —- | M] (Malwarebytes Corporation ) – F:\Documents and Settings\Administrator\Desktop\mbam-setup.exe
[2009/09/02 08:53:38 | 03,088,104 | —- | M] (Malwarebytes Corporation ) – F:\Documents and Settings\Administrator\Desktop\mbam-rules.exe
[2009/09/02 08:52:39 | 00,000,726 | —- | M] () – F:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2009/09/02 08:19:48 | 01,557,504 | —- | M] (Topala Software Solutions) – F:\Documents and Settings\Administrator\Desktop\siw.exe
[2009/09/01 13:32:24 | 00,000,437 | —- | M] () – F:\Documents and Settings\Administrator\Desktop\exe.reg
[2009/09/01 10:17:04 | 00,000,350 | —- | M] () – F:\Documents and Settings\Administrator\Desktop\fixme.reg
[2009/09/01 08:23:40 | 00,000,129 | —- | M] () – F:\Documents and Settings\Administrator\Desktop\query.bat
[2009/08/31 11:33:10 | 00,514,048 | —- | M] (OldTimer Tools) – F:\Documents and Settings\Administrator\Desktop\OTS.exe
[2009/08/31 10:48:16 | 00,401,720 | —- | M] (Trend Micro Inc.) – F:\Documents and Settings\Administrator\Desktop\HijackThis.exe
[2009/08/31 10:38:42 | 00,000,641 | —- | M] () – F:\Documents and Settings\Administrator\Desktop\NTREGOPT.lnk
[2009/08/31 10:38:42 | 00,000,622 | —- | M] () – F:\Documents and Settings\Administrator\Desktop\ERUNT.lnk
[2009/08/31 09:49:34 | 00,472,064 | —- | M] ( ) – F:\Documents and Settings\Administrator\Desktop\RootRepeal.exe
[2009/08/31 09:48:46 | 00,791,393 | —- | M] (Lars Hederer ) – F:\Documents and Settings\Administrator\Desktop\asdjflkjt.exe
[2009/08/15 06:32:36 | 06,413,810 | -H– | M] () – F:\Documents and Settings\Administrator\Local Settings\Application Data\IconCache.db
[2009/08/05 15:48:48 | 00,209,408 | —- | M] (Microsoft Corporation) – F:\WINDOWS\SysWow64\mswebdvd.dll
[2009/08/03 13:36:28 | 00,038,160 | —- | M] (Malwarebytes Corporation) – F:\WINDOWS\SysWow64\drivers\mbamswissarmy.sys
< End of report >

OTL Extras logfile created on: 9/2/2009 12:22:12 PM - Run 1
OTL by OldTimer - Version 3.0.10.7 Folder = F:\Documents and Settings\Administrator\Desktop
64bit-Windows Server 2003 Service Pack 2 (Version = 5.2.3790) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

4.00 Gb Total Physical Memory | 4.00 Gb Available Physical Memory | 100.00% Memory free
4.00 Gb Paging File | 4.00 Gb Available in Paging File | 100.00% Paging File free
Paging file location(s): F:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = F: | %SystemRoot% = F:\WINDOWS | %ProgramFiles% = F:\Program Files (x86)
Drive C: | 931.50 Gb Total Space | 929.10 Gb Free Space | 99.74% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
Drive F: | 59.61 Gb Total Space | 44.47 Gb Free Space | 74.60% Space Free | Partition Type: NTFS
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: ACB-DUNN-COREI7
Current User Name: Administrator
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Include 64bit Scans
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Extra Registry (SafeList) ==========

========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html[@ = htmlfile] – F:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE (Microsoft Corporation)
.inf[@ = inffile] – F:\WINDOWS\SysNative\NOTEPAD.EXE File not found
.ini[@ = inifile] – F:\WINDOWS\SysNative\NOTEPAD.EXE File not found
.url[@ = InternetShortcut] – F:\WINDOWS\system32\ieframe.DLL (Microsoft Corporation)
.js[@ = JSFile] – F:\WINDOWS\SysNative\WScript.exe File not found
.jse[@ = JSEFile] – F:\WINDOWS\SysNative\WScript.exe File not found
.txt[@ = txtfile] – F:\WINDOWS\SysNative\NOTEPAD.EXE File not found
.vbe[@ = VBEFile] – F:\WINDOWS\SysNative\WScript.exe File not found
.vbs[@ = VBSFile] – F:\WINDOWS\SysNative\WScript.exe File not found
.wsf[@ = WSFFile] – F:\WINDOWS\SysNative\WScript.exe File not found
.wsh[@ = WSHFile] – F:\WINDOWS\SysNative\WScript.exe File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.html [@ = htmlfile] – F:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE (Microsoft Corporation)
.url [@ = InternetShortcut] – F:\WINDOWS\system32\ieframe.DLL (Microsoft Corporation)
.reg [@ = regfile] – F:\WINDOWS\SysWow64\regedit.exe (Microsoft Corporation)

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 – File not found
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 – File not found

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 – File not found
"F:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe" = F:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe:*:Enabled:McAfee Framework Service – (McAfee, Inc.)
"F:\Program Files (x86)\Brother\BRAdmin Professional 3\discover.exe" = F:\Program Files (x86)\Brother\BRAdmin Professional 3\discover.exe:*:Enabled:BRAdmin Professional 3 – ()
"F:\Program Files (x86)\Brother\BRAdmin Professional 3\AuditorServer.exe" = F:\Program Files (x86)\Brother\BRAdmin Professional 3\AuditorServer.exe:*:Enabled:BRAdmin Professional 3 – ()
"F:\Program Files (x86)\Brother\BRAdmin Professional 3\bradminv3.exe" = F:\Program Files (x86)\Brother\BRAdmin Professional 3\bradminv3.exe:*:Enabled:BRAdmin Professional 3 – (Brother Industries, Ltd.)
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 – File not found
"F:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe" = F:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe:*:Enabled:McAfee Framework Service – (McAfee, Inc.)
"F:\Program Files (x86)\Brother\BRAdmin Professional 3\discover.exe" = F:\Program Files (x86)\Brother\BRAdmin Professional 3\discover.exe:*:Enabled:BRAdmin Professional 3 – ()
"F:\Program Files (x86)\Brother\BRAdmin Professional 3\AuditorServer.exe" = F:\Program Files (x86)\Brother\BRAdmin Professional 3\AuditorServer.exe:*:Enabled:BRAdmin Professional 3 – ()
"F:\Program Files (x86)\Brother\BRAdmin Professional 3\bradminv3.exe" = F:\Program Files (x86)\Brother\BRAdmin Professional 3\bradminv3.exe:*:Enabled:BRAdmin Professional 3 – (Brother Industries, Ltd.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{26F66AF6-4FDB-357A-7DCE-646C3D05D3A9}" = ccc-utility64
"{5254156F-AA77-499A-B7C1-D5581D44E788}" = Marvell Miniport Driver
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"ATI Display Driver" = ATI Display Driver
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"WIC" = Windows Imaging Component
"Windows x64 Service Pack" = Windows XP Service Pack 2

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{04F38D49-8732-4139-0C9F-6794937C7E6B}" = CCC Help English
"{055EE59D-217B-43A7-ABFF-507B966405D8}" = ATI Catalyst Control Center
"{0B3D3425-401F-798B-1DE6-DAA497E67DA2}" = CCC Help Italian
"{147BCE03-C0F1-4C9F-8157-6A89B6D2D973}" = McAfee VirusScan Enterprise
"{2007A5BF-A9BA-728B-AD14-90251EDF19FD}" = ccc-core-preinstall
"{33CE9398-8C1A-11D9-8BDE-F66BAD1E3F3A}" = EndNote 9
"{4A653EC8-A017-5ED8-4929-46FA814AC197}" = Catalyst Control Center HydraVision Full
"{4DA77116-40B2-6C31-3F48-F94726B7CC60}" = Catalyst Control Center Graphics Light
"{5AB082A1-EEC6-9C43-23FD-0ED68770A085}" = Catalyst Control Center Graphics Previews Common
"{5AEE14C1-A580-9A1C-6036-2EA514B69C3C}" = Catalyst Control Center Core Implementation
"{5E210E4A-1C33-AB78-D3B6-BAC2B43A489B}" = Catalyst Control Center Graphics Full Existing
"{75C885D4-C758-4896-A3B4-90DA34B44C31}" = BRAdmin Professional 3
"{7A4F8E83-27D9-4DC6-0A27-3E96C5886440}" = Catalyst Control Center Graphics Full New
"{7E37E484-4C35-B62F-6309-7D852B0B50E0}" = CCC Help French
"{830FBA32-7B93-3B18-4D45-74483FDC87D0}" = ccc-core-static
"{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{908A9D8C-262B-8847-4AC7-B0A7E95271F0}" = CCC Help Spanish
"{A638557B-1F13-40A0-9627-C892FBCA6960}" = McAfee Agent
"{AC76BA86-1033-0000-BA7E-100000000002}" = Adobe Acrobat 7.0 Standard
"{C209E5C0-14A0-518D-2023-8F1C242A77C9}" = CCC Help German
"{C9EA111F-132D-1715-7E35-8E5B599F81B6}" = CCC Help Portuguese
"{D3B1C799-CB73-42DE-BA0F-2344793A095C}" = Catalyst Control Center - Branding
"{E525D847-3475-975A-F9D1-A30D0D218F91}" = Catalyst Control Center Localization All
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{FE4BD9BD-4A26-4F39-B12C-19336204B101}" = EndNote X Upgrade Edition
"ActiveScan 2.0" = Panda ActiveScan 2.0
"Adobe Acrobat 7.0 Standard - V" = Adobe Acrobat 7.0 Standard
"Adobe Photoshop 7.0.1" = Adobe Photoshop 7.0.1
"All ATI Software" = ATI - Software Uninstall Utility
"Brother HL-5170DN" = Brother HL-5170DN
"ERUNT_is1" = ERUNT 1.1j
"ESET Online Scanner" = ESET Online Scanner v3
"HijackThis" = HijackThis 2.0.2
"ISI ResearchSoft - Export Helper" = ISI ResearchSoft - Export Helper
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"SigmaPlot 6.00" = SigmaPlot 6.00

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 7/11/2009 12:38:56 PM | Computer Name = HOME | Source = MsiInstaller | ID = 1013
Description = Product: Gatorlink VPN Client 5.0.04.0300 – Error 28011: Windows
64-bit is not supported by Gatorlink VPN Client 5.0.04.0300.

Error - 7/11/2009 12:41:51 PM | Computer Name = HOME | Source = MsiInstaller | ID = 11721
Description = Product: Gatorlink VPN Client 5.0.00.0340 – Error 1721. There is
a problem with this Windows Installer package. A program required for this install
to complete could not be run. Contact your support personnel or package vendor.
Action: CsCaExe_RegisterIPSecPlugin1, location: F:\Program Files (x86)\Common Files\Deterministic
Networks\Common files\dneinst.exe, command: -AddPlugin CVPNDRVA -Description "Cisco
Systems Inc. IPSec Driver" -InstallPath F:\WINDOWS\SysWOW64\Drivers -Verbose

Error - 7/11/2009 1:27:47 PM | Computer Name = HOME | Source = MsiInstaller | ID = 1013
Description = Product: Gatorlink VPN Client 5.0.04.0300 – Error 28011: Windows
64-bit is not supported by Gatorlink VPN Client 5.0.04.0300.

Error - 8/1/2009 6:06:43 PM | Computer Name = HOME | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 6.0.3790.1830, faulting
module unknown, version 0.0.0.0, fault address 0x00000000.

Error - 8/1/2009 6:07:47 PM | Computer Name = HOME | Source = Application Hang | ID = 1002
Description = Hanging application IEXPLORE.EXE, version 6.0.3790.1830, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

[ System Events ]
Error - 9/2/2009 9:23:50 AM | Computer Name = HOME | Source = NetBT | ID = 4321
Description = The name "HOME :0" could not be registered on the Interface
with IP address 10.15.253.95. The machine with the IP address [removed] did
not allow the name to be claimed by this machine.

Error - 9/2/2009 9:59:38 AM | Computer Name = HOME | Source = NetBT | ID = 4321
Description = The name "HOME :0" could not be registered on the Interface
with IP address 10.15.253.95. The machine with the IP address [removed] did
not allow the name to be claimed by this machine.

Error - 9/2/2009 10:01:54 AM | Computer Name = ACB-DUNN-COREI7 | Source = Service Control Manager | ID = 7002
Description = The BrPar service depends on the Parallel arbitrator group and no
member of this group started.

Error - 9/2/2009 10:15:35 AM | Computer Name = ACB-DUNN-COREI7 | Source = Service Control Manager | ID = 7002
Description = The BrPar service depends on the Parallel arbitrator group and no
member of this group started.

Error - 9/2/2009 11:12:13 AM | Computer Name = ACB-DUNN-COREI7 | Source = Application Popup | ID = 1060
Description = \??\F:\WINDOWS\SysWow64\drivers\RkPavproc1.sys has been blocked from
loading due to incompatibility with this system. Please contact your software vendor
for a compatible version of the driver.

Error - 9/2/2009 11:12:13 AM | Computer Name = ACB-DUNN-COREI7 | Source = Service Control Manager | ID = 7000
Description = The RkPavproc1 service failed to start due to the following error:
%%1275

Error - 9/2/2009 11:12:30 AM | Computer Name = ACB-DUNN-COREI7 | Source = Application Popup | ID = 1060
Description = \??\F:\WINDOWS\SysWow64\drivers\RkPavproc1.sys has been blocked from
loading due to incompatibility with this system. Please contact your software vendor
for a compatible version of the driver.

Error - 9/2/2009 11:12:30 AM | Computer Name = ACB-DUNN-COREI7 | Source = Service Control Manager | ID = 7000
Description = The RkPavproc1 service failed to start due to the following error:
%%1275

Error - 9/2/2009 11:48:42 AM | Computer Name = ACB-DUNN-COREI7 | Source = Service Control Manager | ID = 7002
Description = The BrPar service depends on the Parallel arbitrator group and no
member of this group started.

Error - 9/2/2009 12:13:41 PM | Computer Name = ACB-DUNN-COREI7 | Source = Service Control Manager | ID = 7002
Description = The BrPar service depends on the Parallel arbitrator group and no
member of this group started.

< End of report >

CatByte

Post #49September 2, 2009, 4:49 PM UTC

Hi,

This was an adventuire. This was the first 64bit machine that I have seen with that particular Rogue Antivirus Infection, so now I know how to clean it better, so thank-you for your patience in following all the procedures.

Your logs are now clean,

Now we just need to do some housekeeping.

OTS shows hidden files and folders - we need to set them back to their default setting

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Click the "Restore Defaults" button
Click Apply, and then click OK.

NEXT

Delete the reg files and any logs on your desktop - Keep the MalwareBytes program, it's handy to have - update and scan with it regularly.

NEXT

Make sure you have an Internet Connection.
Double-click OTS.exe to run it.
Click on the CleanUp! button
A list of tool components used in the Cleanup of malware will be downloaded.
If your Firewall or Real Time protection attempts to block OTS to reach the Internet, please allow the application to do so.
Click Yes to begin the Cleanup process and remove these components, including this application.
You should be asked to reboot the machine to finish the Cleanup process. If you are asked to reboot the machine choose Yes.

NEXT

Below I have included a number of recommendations for how to protect your computer against malware infections.

Keep Windows updated by regularly checking their website at :
http://windowsupdate.microsoft.com/
This will ensure your computer has always the latest security updates available installed on your computer.
Make Internet Explorer more secure
- Click Start > Run
- Type Inetcpl.cpl & click OK
- Click on the Security tab
- Click Reset all zones to default level
- Make sure the Internet Zone is selected & Click Custom level
- In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
- Next Click OK, then Apply button and then OK to exit the Internet Properties page.
ATF Cleaner - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.
MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.
WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
- Green to go
- Yellow for caution
- Red to stop
WOT has an addon available for both Firefox and IE
For Firefox, I highly recommend this add-on to keep your PC even more secure.
- NoScript - for blocking ads and other potential website attacks
Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.
ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.
Please read these useful guides How did I get infected in the first place?
PC Safety and Security–What Do I Need?
miekiemoes' Prevention topic.

Thank you for your patience, and performing all of the procedures requested.

Please respond to this thread one more time so we can mark this thread as resolved.

Pahonix

Post #50September 2, 2009, 5:24 PM UTC

I have finished the cleanup process. Many, many thanks for your help!

CatByte

Post #51September 2, 2009, 7:05 PM UTC

You are more than welcome stay safe

~CB

CatByte

Post #52September 2, 2009, 7:05 PM UTC

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] Windows Antivirus Pro on XP 64-bit

✨ Ask AI

Ask AI