[Resolved] Secure Antivirus Pro & Infected Wallpaper

GMER 1.0.15.15252 - http://www.gmer.net
Rootkit scan 2009-11-29 10:53:08
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:\DOCUME~1\Mark\LOCALS~1\Temp\uxtdrpoc.sys


—- System - GMER 1.0.15 —-

SSDT 8294BDC8 ZwAlertResumeThread
SSDT 82925158 ZwAlertThread
SSDT 82925D68 ZwAllocateVirtualMemory
SSDT 824F1C10 ZwConnectPort
SSDT \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ZwCreateKey [0xF53E7020]
SSDT 82940830 ZwCreateMutant
SSDT 82926278 ZwCreateThread
SSDT 829402F8 ZwDebugActiveProcess
SSDT \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ZwDeleteKey [0xF53E72A0]
SSDT \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ZwDeleteValueKey [0xF53E7800]
SSDT 82925BA8 ZwFreeVirtualMemory
SSDT 82940988 ZwImpersonateAnonymousToken
SSDT 8294BCC0 ZwImpersonateThread
SSDT 82925A58 ZwMapViewOfSection
SSDT 829406B8 ZwOpenEvent
SSDT 8282BCE0 ZwOpenProcessToken
SSDT 829403F8 ZwOpenSection
SSDT 82925828 ZwOpenThreadToken
SSDT 82AAEA00 ZwResumeThread
SSDT 82926950 ZwSetContextThread
SSDT 82925928 ZwSetInformationProcess
SSDT 82925680 ZwSetInformationThread
SSDT \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ZwSetValueKey [0xF53E7A50]
SSDT 829405B8 ZwSuspendProcess
SSDT 82925318 ZwSuspendThread
SSDT 8278E8E0 ZwTerminateProcess
SSDT 82925528 ZwTerminateThread
SSDT 82927340 ZwUnmapViewOfSection
SSDT 82925CA8 ZwWriteVirtualMemory

—- Kernel code sections - GMER 1.0.15 —-

.text ntkrnlpa.exe!ZwCallbackReturn + 2EFC 80504798 4 Bytes JMP 526682AA
.text ntkrnlpa.exe!ZwCallbackReturn + 2FC8 80504864 8 Bytes CALL D578CAE1
init C:\WINDOWS\system32\DRIVERS\mohfilt.sys entry point in "init" section [0xF883A760]

—- Devices - GMER 1.0.15 —-

AttachedDevice \Driver\Tcpip \Device\Ip SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\Tcp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\Udp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\RawIp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)

Device mrxsmb.sys (Windows NT SMB Minirdr/Microsoft Corporation)
Device B69B7D20

AttachedDevice fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

Device \FileSystem\Fs_Rec \FileSystem\UdfsCdRomRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\FatCdRomRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\CdfsRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\FatDiskRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\UdfsDiskRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Cdfs \Cdfs tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)

—- Files - GMER 1.0.15 —-

File C:\WINDOWS\$NtUninstallWMFDist11$\wmasf.dll 229376 bytes executable
File C:\WINDOWS\$NtUninstallWMFDist11$\audiodev.dll 480768 bytes executable
File C:\WINDOWS\$NtUninstallWMFDist11$\blackbox.dll 233472 bytes executable
File C:\WINDOWS\$NtUninstallWMFDist11$\cewmdm.dll 161792 bytes executable
File C:\WINDOWS\$NtUninstallWMFDist11$\drmv2clt.dll 527360 bytes executable
File C:\WINDOWS\$NtUninstallWMFDist11$\laprxy.dll 6656 bytes executable
File C:\WINDOWS\$NtUninstallWMFDist11$\logagent.exe 96768 bytes executable
File C:\WINDOWS\$NtUninstallWMFDist11$\mp43dmod.dll 310272 bytes executable
File C:\WINDOWS\$NtUninstallWMFDist11$\mp4sdmod.dll 384512 bytes executable
File C:\WINDOWS\$NtUninstallWMFDist11$\mpg4dmod.dll 240640 bytes executable
File C:\WINDOWS\$NtUninstallWMFDist11$\msnetobj.dll 141312 bytes executable
File C:\WINDOWS\$NtUninstallWMFDist11$\mspmsnsv.dll 25088 bytes executable
File C:\WINDOWS\$NtUninstallWMFDist11$\mspmsp.dll 169472 bytes executable
File C:\WINDOWS\$NtUninstallWMFDist11$\msscp.dll 360176 bytes executable
File C:\WINDOWS\$NtUninstallWMFDist11$\mswmdm.dll 311296 bytes
File C:\WINDOWS\$NtUninstallWMFDist11$\qasf.dll 221184 bytes executable
File C:\WINDOWS\$NtUninstallWMFDist11$\reg00019 8192 bytes
File C:\WINDOWS\$NtUninstallWMFDist11$\spuninst 0 bytes
File C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe 213216 bytes executable
File C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.inf 30673 bytes
File C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.txt 7552 bytes
File C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\updspapi.dll 371424 bytes executable
File C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\wpdinstallutil.dll 13312 bytes executable
File C:\WINDOWS\$NtUninstallWMFDist11$\uwdf.exe 47104 bytes executable
File C:\WINDOWS\$NtUninstallWMFDist11$\wdfapi.dll 15872 bytes executable
File C:\WINDOWS\$NtUninstallWMFDist11$\wdfmgr.exe 38912 bytes executable
File C:\WINDOWS\$NtUninstallWMFDist11$\wmadmod.dll 380144 bytes executable
File C:\WINDOWS\$NtUninstallWMFDist11$\wmadmoe.dll 712704 bytes executable
File C:\WINDOWS\$NtUninstallWMFDist11$\wmdmlog.dll 30208 bytes executable
File C:\WINDOWS\$NtUninstallWMFDist11$\wmdmps.dll 34304 bytes executable
File C:\WINDOWS\$NtUninstallWMFDist11$\wmdrmdev.dll 344064 bytes executable
File C:\WINDOWS\$NtUninstallWMFDist11$\wmdrmnet.dll 290816 bytes executable
File C:\WINDOWS\$NtUninstallWMFDist11$\wmidx.dll 150016 bytes executable
File C:\WINDOWS\$NtUninstallWMFDist11$\wmnetmgr.dll 1027072 bytes executable
File C:\WINDOWS\$NtUninstallWMFDist11$\wmsdmod.dll 773368 bytes executable
File C:\WINDOWS\$NtUninstallWMFDist11$\wmsdmoe2.dll 1116160 bytes executable
File C:\WINDOWS\$NtUninstallWMFDist11$\wmsetsdk.exe 819200 bytes executable
File C:\WINDOWS\$NtUninstallWMFDist11$\wmspdmod.dll 531192 bytes executable
File C:\WINDOWS\$NtUninstallWMFDist11$\wmspdmoe.dll 936960 bytes executable
File C:\WINDOWS\$NtUninstallWMFDist11$\wmvadvd.dll 1181944 bytes executable
File C:\WINDOWS\$NtUninstallWMFDist11$\wmvadve.dll 1509376 bytes executable
File C:\WINDOWS\$NtUninstallWMFDist11$\wmvcore.dll 2362184 bytes
File C:\WINDOWS\$NtUninstallWMFDist11$\wmvdmod.dll 871160 bytes executable
File C:\WINDOWS\$NtUninstallWMFDist11$\wmvdmoe2.dll 999424 bytes executable
File C:\WINDOWS\$NtUninstallWMFDist11$\wpdconns.dll 61952 bytes executable
File C:\WINDOWS\$NtUninstallWMFDist11$\wpdmtp.dll 114176 bytes executable
File C:\WINDOWS\$NtUninstallWMFDist11$\wpdmtp.inf 6099 bytes
File C:\WINDOWS\$NtUninstallWMFDist11$\wpdmtpus.dll 66560 bytes executable
File C:\WINDOWS\$NtUninstallWMFDist11$\wpdsp.dll 327680 bytes executable
File C:\WINDOWS\$NtUninstallWMFDist11$\wpdusb.sys 18944 bytes executable
File C:\WINDOWS\$NtUninstallWMFDist11$\wpd_ci.dll 38912 bytes executable
File C:\WINDOWS\$NtUninstallwmp11$\reg00028 8192 bytes
File C:\WINDOWS\$NtUninstallwmp11$\reg00063 8192 bytes
File C:\WINDOWS\$NtUninstallwmp11$\asferror.dll 8192 bytes executable
File C:\WINDOWS\$NtUninstallwmp11$\l3codecp.acm 360448 bytes executable
File C:\WINDOWS\$NtUninstallwmp11$\mpvis.dll 344064 bytes executable
File C:\WINDOWS\$NtUninstallwmp11$\reg00003 8192 bytes
File C:\WINDOWS\$NtUninstallwmp11$\reg00004 8192 bytes
File C:\WINDOWS\$NtUninstallwmp11$\reg00005 8192 bytes
File C:\WINDOWS\$NtUninstallwmp11$\reg00006 8192 bytes
File C:\WINDOWS\$NtUninstallwmp11$\reg00011 8192 bytes
File C:\WINDOWS\$NtUninstallwmp11$\reg00012 8192 bytes
File C:\WINDOWS\$NtUninstallwmp11$\reg00013 8192 bytes
File C:\WINDOWS\$NtUninstallwmp11$\reg00014 8192 bytes
File C:\WINDOWS\$NtUninstallwmp11$\reg00016 8192 bytes
File C:\WINDOWS\$NtUninstallwmp11$\reg00017 8192 bytes
File C:\WINDOWS\$NtUninstallwmp11$\reg00018 8192 bytes
File C:\WINDOWS\$NtUninstallwmp11$\reg00019 8192 bytes
File C:\WINDOWS\$NtUninstallwmp11$\reg00020 8192 bytes
File C:\WINDOWS\$NtUninstallwmp11$\reg00021 8192 bytes
File C:\WINDOWS\$NtUninstallwmp11$\reg00022 8192 bytes
File C:\WINDOWS\$NtUninstallwmp11$\reg00027 8192 bytes
File C:\WINDOWS\$NtUninstallwmp11$\reg00029 8192 bytes
File C:\WINDOWS\$NtUninstallwmp11$\reg00030 8192 bytes
File C:\WINDOWS\$NtUninstallwmp11$\reg00031 8192 bytes
File C:\WINDOWS\$NtUninstallwmp11$\reg00032 8192 bytes
File C:\WINDOWS\$NtUninstallwmp11$\reg00033 8192 bytes
File C:\WINDOWS\$NtUninstallwmp11$\reg00034 8192 bytes
File C:\WINDOWS\$NtUninstallwmp11$\reg00035 8192 bytes
File C:\WINDOWS\$NtUninstallwmp11$\reg00036 8192 bytes
File C:\WINDOWS\$NtUninstallwmp11$\reg00037 8192 bytes
File C:\WINDOWS\$NtUninstallwmp11$\reg00038 8192 bytes
File C:\WINDOWS\$NtUninstallwmp11$\reg00039 8192 bytes
File C:\WINDOWS\$NtUninstallwmp11$\reg00041 8192 bytes
File C:\WINDOWS\$NtUninstallwmp11$\reg00042 8192 bytes
File C:\WINDOWS\$NtUninstallwmp11$\reg00043 8192 bytes
File C:\WINDOWS\$NtUninstallwmp11$\reg00044 8192 bytes
File C:\WINDOWS\$NtUninstallwmp11$\reg00045 8192 bytes
File C:\WINDOWS\$NtUninstallwmp11$\reg00060 12288 bytes
File C:\WINDOWS\$NtUninstallwmp11$\reg00061 8192 bytes
File C:\WINDOWS\$NtUninstallwmp11$\reg00062 8192 bytes
File C:\WINDOWS\$NtUninstallwmp11$\reg00064 8192 bytes
File C:\WINDOWS\$NtUninstallwmp11$\reg00065 8192 bytes
File C:\WINDOWS\$NtUninstallwmp11$\reg00066 8192 bytes
File C:\WINDOWS\$NtUninstallwmp11$\reg00067 8192 bytes
File C:\WINDOWS\$NtUninstallwmp11$\reg00068 8192 bytes
File C:\WINDOWS\$NtUninstallwmp11$\reg00069 8192 bytes
File C:\WINDOWS\$NtUninstallwmp11$\reg00071 8192 bytes
File C:\WINDOWS\$NtUninstallwmp11$\setup_wm.exe 819200 bytes executable
File C:\WINDOWS\$NtUninstallwmp11$\spuninst 0 bytes
File C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe 213216 bytes executable
File C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.inf 30585 bytes
File C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.txt 6216 bytes
File C:\WINDOWS\$NtUninstallwmp11$\spuninst\updspapi.dll 371424 bytes executable
File C:\WINDOWS\$NtUninstallwmp11$\unregmp2.exe 192512 bytes executable
File C:\WINDOWS\$NtUninstallwmp11$\wmerror.dll 189440 bytes executable
File C:\WINDOWS\$NtUninstallwmp11$\wmlaunch.exe 122880 bytes executable
File C:\WINDOWS\$NtUninstallwmp11$\wmp.dll 5537792 bytes
File C:\WINDOWS\$NtUninstallwmp11$\wmpasf.dll 135168 bytes executable
File C:\WINDOWS\$NtUninstallwmp11$\wmpband.dll 77824 bytes executable
File C:\WINDOWS\$NtUninstallwmp11$\wmpdxm.dll 282624 bytes executable
File C:\WINDOWS\$NtUninstallwmp11$\wmpenc.exe 28672 bytes executable
File C:\WINDOWS\$NtUninstallwmp11$\wmpencen.dll 1589760 bytes executable
File C:\WINDOWS\$NtUninstallwmp11$\wmplayer.adm 67456 bytes
File C:\WINDOWS\$NtUninstallwmp11$\wmplayer.exe 73728 bytes executable
File C:\WINDOWS\$NtUninstallwmp11$\wmploc.dll 3371008 bytes executable
File C:\WINDOWS\$NtUninstallwmp11$\wmpshell.dll 86016 bytes executable
File C:\WINDOWS\$NtUninstallwmp11$\wmpsrcwp.dll 175104 bytes executable
File C:\WINDOWS\$NtUninstallKB952004$\msdtclog.dll 58880 bytes executable
File C:\WINDOWS\$NtUninstallKB952004$\msdtcprx.dll 427008 bytes executable
File C:\WINDOWS\$NtUninstallKB952004$\msdtctm.dll 956928 bytes executable
File C:\WINDOWS\$NtUninstallKB952004$\msdtcuiu.dll 161792 bytes executable
File C:\WINDOWS\$NtUninstallKB952004$\mtxclu.dll 66560 bytes executable
File C:\WINDOWS\$NtUninstallKB952004$\mtxoci.dll 91648 bytes executable
File C:\WINDOWS\$NtUninstallKB952004$\reg00001 8192 bytes
File C:\WINDOWS\$NtUninstallKB952004$\reg00002 8192 bytes
File C:\WINDOWS\$NtUninstallKB952004$\reg00003 8192 bytes
File C:\WINDOWS\$NtUninstallKB952004$\reg00004 8192 bytes
File C:\WINDOWS\$NtUninstallKB952004$\reg00005 8192 bytes
File C:\WINDOWS\$NtUninstallKB952004$\spuninst 0 bytes
File C:\WINDOWS\$NtUninstallKB952004$\spuninst\spuninst.exe 231288 bytes executable
File C:\WINDOWS\$NtUninstallKB952004$\spuninst\spuninst.inf 10735 bytes
File C:\WINDOWS\$NtUninstallKB952004$\spuninst\spuninst.txt 1290 bytes
File C:\WINDOWS\$NtUninstallKB952004$\spuninst\updspapi.dll 382840 bytes executable

—- EOF - GMER 1.0.15 —-
OTL logfile created on: 11/29/2009 11:13:13 AM - Run 1
OTL by OldTimer - Version 3.1.11.2 Folder = C:\Documents and Settings\Mark\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

510.07 Mb Total Physical Memory | 47.88 Mb Available Physical Memory | 9.39% Memory free
1.97 Gb Paging File | 1.55 Gb Available in Paging File | 78.76% Paging File free
Paging file location(s): C:\pagefile.sys 1536 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 144.96 Gb Total Space | 83.14 Gb Free Space | 57.36% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: RICKEY
Current User Name: Mark
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Mark\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\WINDOWS\system32\winupdate86.exe ()
PRC - C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
PRC - C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)
PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
PRC - C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
PRC - C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.)
PRC - C:\Program Files\Common Files\Symantec Shared\CCSVCHST.EXE (Symantec Corporation)
PRC - C:\Program Files\Common Files\Symantec Shared\CCSVCHST.EXE (Symantec Corporation)
PRC - C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe (Sun Microsystems, Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
PRC - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe (Symantec Corporation)
PRC - C:\Program Files\Viewpoint\Common\ViewpointService.exe (Viewpoint Corporation)
PRC - C:\Program Files\WinZip\WZQKPICK.EXE (WinZip Computing LP)
PRC - C:\Program Files\FinePixViewer\QuickDCF.exe (FUJI PHOTO FILM CO., LTD.)
PRC - C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe (ATI Technologies, Inc.)
PRC - C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe (CyberLink Corp.)
PRC - C:\WINDOWS\system32\dla\tfswctrl.exe (Sonic Solutions)
PRC - C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (InstallShield Software Corporation)
PRC - C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe (InterVideo Inc.)
PRC - C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe (Intel Corporation)
PRC - C:\WINDOWS\system32\spool\drivers\w32x86\3\E_S4I2K1.EXE (SEIKO EPSON CORPORATION)
PRC - C:\Program Files\BroadJump\Client Foundation\CFD.exe ()
PRC - C:\WINDOWS\system32\MsPMSPSv.exe (Microsoft Corporation)
PRC - C:\WINDOWS\system32\CTSVCCDA.EXE (Creative Technology Ltd)


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Mark\Desktop\OTL.exe (OldTimer Tools)


========== Win32 Services (SafeList) ==========

SRV - (iPod Service) – C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)
SRV - (Apple Mobile Device) – C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (Bonjour Service) – C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.)
SRV - (LiveUpdate Notice) – C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (Symantec Corporation)
SRV - (CLTNetCnService) – C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (Symantec Corporation)
SRV - (ccSetMgr) – C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (Symantec Corporation)
SRV - (ccEvtMgr) – C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (Symantec Corporation)
SRV - (Symantec Core LC) – C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe ()
SRV - (Symantec RemoteAssist) – C:\Program Files\Common Files\Symantec Shared\Support Controls\ssrc.exe (Symantec, Inc.)
SRV - (Automatic LiveUpdate Scheduler) – C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe (Symantec Corporation)
SRV - (LiveUpdate) – C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE (Symantec Corporation)
SRV - (comHost) – C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe (Symantec Corporation)
SRV - (DSBrokerService) – C:\Program Files\DellSupport\brkrsvc.exe ()
SRV - (gusvc) – C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (Google)
SRV - (Viewpoint Manager Service) – C:\Program Files\Viewpoint\Common\ViewpointService.exe (Viewpoint Corporation)
SRV - (IDriverT) – C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe (Macrovision Corporation)
SRV - (Ati HotKey Poller) – C:\WINDOWS\system32\ati2evxx.exe (ATI Technologies Inc.)
SRV - (ose) – C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (WMDM PMSP Service) – C:\WINDOWS\system32\MsPMSPSv.exe (Microsoft Corporation)
SRV - (Creative Service for CDROM Access) – C:\WINDOWS\system32\CTSVCCDA.EXE (Creative Technology Ltd)


========== Driver Services (SafeList) ==========

DRV - (USBAAPL) – C:\WINDOWS\system32\drivers\usbaapl.sys (Apple, Inc.)
DRV - (NAVEX15) – C:\Program Files\Common Files\Symantec Shared\VirusDefs\20091128.020\NAVEX15.SYS (Symantec Corporation)
DRV - (eeCtrl) – C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys (Symantec Corporation)
DRV - (EraserUtilRebootDrv) – C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation)
DRV - (NAVENG) – C:\Program Files\Common Files\Symantec Shared\VirusDefs\20091128.020\NAVENG.SYS (Symantec Corporation)
DRV - (GEARAspiWDM) – C:\WINDOWS\system32\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV - (NuidFltr) – C:\WINDOWS\system32\drivers\nuidfltr.sys (Microsoft Corporation)
DRV - (SymIMMP) – C:\WINDOWS\system32\drivers\SymIM.sys (Symantec Corporation)
DRV - (SymIM) – C:\WINDOWS\system32\drivers\SymIM.sys (Symantec Corporation)
DRV - (SYMTDI) – C:\WINDOWS\System32\Drivers\SYMTDI.SYS (Symantec Corporation)
DRV - (SYMFW) – C:\WINDOWS\System32\Drivers\SYMFW.SYS (Symantec Corporation)
DRV - (SYMIDS) – C:\WINDOWS\System32\Drivers\SYMIDS.SYS (Symantec Corporation)
DRV - (SYMNDIS) – C:\WINDOWS\System32\Drivers\SYMNDIS.SYS (Symantec Corporation)
DRV - (SYMREDRV) – C:\WINDOWS\System32\Drivers\SYMREDRV.SYS (Symantec Corporation)
DRV - (SYMDNS) – C:\WINDOWS\System32\Drivers\SYMDNS.SYS (Symantec Corporation)
DRV - (SYMIDSCO) – C:\Program Files\Common Files\Symantec Shared\SymcData\ipsdefs\20091111.001\SymIDSCo.sys (Symantec Corporation)
DRV - (SymEvent) – C:\WINDOWS\system32\drivers\SYMEVENT.SYS (Symantec Corporation)
DRV - (hamachi) – C:\WINDOWS\system32\drivers\hamachi.sys (LogMeIn, Inc.)
DRV - (SPBBCDrv) – C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys (Symantec Corporation)
DRV - (COH_Mon) – C:\WINDOWS\system32\drivers\COH_Mon.sys (Symantec Corporation)
DRV - (amdagp) – C:\WINDOWS\system32\DRIVERS\amdagp.sys (Advanced Micro Devices, Inc.)
DRV - (sisagp) – C:\WINDOWS\system32\DRIVERS\sisagp.sys (Silicon Integrated Systems Corporation)
DRV - (SRTSPL) – C:\WINDOWS\system32\drivers\srtspl.sys (Symantec Corporation)
DRV - (SRTSP) – C:\WINDOWS\system32\drivers\srtsp.sys (Symantec Corporation)
DRV - (SRTSPX) – C:\WINDOWS\system32\drivers\srtspx.sys (Symantec Corporation)
DRV - (Secdrv) – C:\WINDOWS\system32\drivers\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
DRV - (CO_Mon) – C:\WINDOWS\system32\drivers\CO_Mon.sys (Symantec Corporation)
DRV - (P17) – C:\WINDOWS\system32\drivers\P17.sys (Creative Technology Ltd.)
DRV - (dsunidrv) – C:\WINDOWS\system32\drivers\dsunidrv.sys (Gteko Ltd.)
DRV - (DSproct) – C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys (Gteko Ltd.)
DRV - (ati2mtag) – C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (PxHelp20) – C:\WINDOWS\System32\Drivers\PxHelp20.sys (Sonic Solutions)
DRV - (ossrv) – C:\WINDOWS\system32\drivers\ctoss2k.sys (Creative Technology Ltd.)
DRV - (ctsfm2k) – C:\WINDOWS\system32\drivers\ctsfm2k.sys (Creative Technology Ltd)
DRV - (tfsnudfa) – C:\WINDOWS\system32\dla\tfsnudfa.sys (Sonic Solutions)
DRV - (tfsnudf) – C:\WINDOWS\system32\dla\tfsnudf.sys (Sonic Solutions)
DRV - (tfsnifs) – C:\WINDOWS\system32\dla\tfsnifs.sys (Sonic Solutions)
DRV - (tfsncofs) – C:\WINDOWS\system32\dla\tfsncofs.sys (Sonic Solutions)
DRV - (tfsnboio) – C:\WINDOWS\system32\dla\tfsnboio.sys (Sonic Solutions)
DRV - (tfsnopio) – C:\WINDOWS\system32\dla\tfsnopio.sys (Sonic Solutions)
DRV - (tfsnpool) – C:\WINDOWS\system32\dla\tfsnpool.sys (Sonic Solutions)
DRV - (tfsndrct) – C:\WINDOWS\system32\dla\tfsndrct.sys (Sonic Solutions)
DRV - (tfsndres) – C:\WINDOWS\system32\dla\tfsndres.sys (Sonic Solutions)
DRV - (drvmcdb) – C:\WINDOWS\system32\drivers\drvmcdb.sys (Sonic Solutions)
DRV - (drvnddm) – C:\WINDOWS\system32\drivers\drvnddm.sys (Sonic Solutions)
DRV - (E100B) Intel® – C:\WINDOWS\system32\drivers\e100b325.sys (Intel Corporation)
DRV - (Ptilink) – C:\WINDOWS\system32\drivers\ptilink.sys (Parallel Technologies, Inc.)
DRV - (nv) – C:\WINDOWS\system32\drivers\nv4_mini.sys (NVIDIA Corporation)
DRV - (sscdbhk5) – C:\WINDOWS\system32\drivers\sscdbhk5.sys (Sonic Solutions)
DRV - (ssrtln) – C:\WINDOWS\system32\drivers\ssrtln.sys (Sonic Solutions)
DRV - (IntelC53) – C:\WINDOWS\system32\drivers\IntelC53.sys (Intel Corporation)
DRV - (cdrbsdrv) – C:\WINDOWS\system32\drivers\CDRBSDRV.SYS (B.H.A Corporation)
DRV - (IntelC52) – C:\WINDOWS\system32\drivers\IntelC52.sys (Intel Corporation)
DRV - (IntelC51) – C:\WINDOWS\system32\drivers\IntelC51.sys (Intel Corporation)
DRV - (mohfilt) – C:\WINDOWS\system32\drivers\mohfilt.sys (Intel Corporation)
DRV - (omci) – C:\WINDOWS\system32\drivers\omci.sys (Dell Computer Corporation)
DRV - (ASPI32) – C:\WINDOWS\system32\drivers\Aspi32.sys (Adaptec)
DRV - (Sparrow) – C:\WINDOWS\system32\DRIVERS\sparrow.sys (Adaptec, Inc.)
DRV - (sym_u3) – C:\WINDOWS\system32\DRIVERS\sym_u3.sys (LSI Logic)
DRV - (sym_hi) – C:\WINDOWS\system32\DRIVERS\sym_hi.sys (LSI Logic)
DRV - (symc8xx) – C:\WINDOWS\system32\DRIVERS\symc8xx.sys (LSI Logic)
DRV - (symc810) – C:\WINDOWS\system32\DRIVERS\symc810.sys (Symbios Logic Inc.)
DRV - (MODEMCSA) – C:\WINDOWS\system32\drivers\MODEMCSA.sys (Microsoft Corporation)
DRV - (ultra) – C:\WINDOWS\system32\DRIVERS\ultra.sys (Promise Technology, Inc.)
DRV - (ql12160) – C:\WINDOWS\system32\DRIVERS\ql12160.sys (QLogic Corporation)
DRV - (ql1080) – C:\WINDOWS\system32\DRIVERS\ql1080.sys (QLogic Corporation)
DRV - (ql1280) – C:\WINDOWS\system32\DRIVERS\ql1280.sys (QLogic Corporation)
DRV - (dac2w2k) – C:\WINDOWS\system32\DRIVERS\dac2w2k.sys (Mylex Corporation)
DRV - (mraid35x) – C:\WINDOWS\system32\DRIVERS\mraid35x.sys (American Megatrends Inc.)
DRV - (asc) – C:\WINDOWS\system32\DRIVERS\asc.sys (Advanced System Products, Inc.)
DRV - (asc3550) – C:\WINDOWS\system32\DRIVERS\asc3550.sys (Advanced System Products, Inc.)
DRV - (AliIde) – C:\WINDOWS\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.)
DRV - (CmdIde) – C:\WINDOWS\system32\DRIVERS\cmdide.sys (CMD Technology, Inc.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerm…tf8&oe=utf8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://flory.net/cof/index.php
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Program Files\Real\RealPlayer\browserrecord [2008/02/19 21:52:07 | 00,000,000 | —D | M]


O1 HOSTS File: (734 bytes) - C:\WINDOWS\system32\drivers\etc\HOSTS
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (DriveLetterAccess) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll (Sonic Solutions)
O2 - BHO: (no name) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Common Files\Symantec Shared\IDS\IPSBHO.dll (Symantec Corporation)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\Program Files\Google\GoogleToolbar4.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (&Google) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar4.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Show Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll (Symantec Corporation)
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar4.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Show Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll (Symantec Corporation)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe (Apple Inc.)
O4 - HKLM..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe (ATI Technologies, Inc.)
O4 - HKLM..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe ()
O4 - HKLM..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe (Symantec Corporation)
O4 - HKLM..\Run: [dla] C:\WINDOWS\System32\dla\tfswctrl.exe (Sonic Solutions)
O4 - HKLM..\Run: [DVDLauncher] C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe (CyberLink Corp.)
O4 - HKLM..\Run: [EPSON Stylus Photo RX500] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2K1.EXE (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe (Intel Corporation)
O4 - HKLM..\Run: [ISUSScheduler] C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [osCheck] C:\Program Files\Norton Internet Security\osCheck.exe (Symantec Corporation)
O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\QTTask.exe (Apple Inc.)
O4 - HKLM..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE (FUJI PHOTO FILM CO., LTD.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [winupdate86.exe] C:\WINDOWS\system32\winupdate86.exe ()
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Exif Launcher.lnk = C:\Program Files\FinePixViewer\QuickDCF.exe (FUJI PHOTO FILM CO., LTD.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe (InterVideo Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE (WinZip Computing LP)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetActiveDesktop = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetActiveDesktop = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll (Sun Microsystems, Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\WINDOWS\System32\winhelper86.dll ()
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\WINDOWS\System32\winhelper86.dll ()
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKCU\..Trusted Domains: turbotax.com ([]https in Trusted sites)
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} http://supportcenter.rr.com/sdccommon/download/tgctlcm.cab (Support.com Configuration Class)
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} http://download.microsoft.com/download/e/7…/OGAControl.cab (Office Genuine Advantage Validation Tool)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool)
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} http://www.snapfish.com/SnapfishActivia.cab (Snapfish Activia)
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} https://webdl.symantec.com/activex/symdlmgr.cab (Symantec Download Manager)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…t/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {C7DB51B4-BCF7-4923-8874-7F1A0DC92277} http://office.microsoft.com/officeupdate/content/opuc4.cab (Office Update Installation Engine)
O16 - DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} http://java.sun.com/products/plugin/autodl…indows-i586.cab (Java Plug-in 1.4.2_03)
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_06)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_03)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/pub/shock…ash/swflash.cab (Shockwave Flash Object)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/08/10 12:04:08 | 00,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck) - File not found
O34 - HKLM BootExecute: (*) - File not found
O35 - comfile [open] – "%1" %* File not found
O35 - exefile [open] – "%1" %* File not found

NetSvcs: 6to4 - File not found
NetSvcs: Ias - C:\WINDOWS\system32\ias [2004/08/10 11:52:56 | 00,000,000 | —D | M]
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: Wmi - C:\WINDOWS\system32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (16891947461378048)

========== Files/Folders - Created Within 30 Days ==========

[2009/11/29 11:10:09 | 00,535,552 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Mark\Desktop\OTL.exe
[2009/11/29 01:24:04 | 01,197,568 | —- | C] (Advanced Virus Remover) – C:\WINDOWS\System32\AVR10.exe
[2009/11/29 01:13:14 | 00,050,688 | —- | C] (Atribune.org) – C:\Documents and Settings\Mark\Desktop\ATF_Cleaner.exe
[2009/11/28 23:41:10 | 00,000,000 | —D | C] – C:\Documents and Settings\Mark\Desktop\SmitfraudFix
[2009/11/28 22:07:20 | 00,000,000 | —D | C] – C:\Documents and Settings\Mark\Application Data\Malwarebytes
[2009/11/28 22:07:13 | 00,038,224 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/11/28 22:07:11 | 00,019,160 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2009/11/28 22:07:11 | 00,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2009/11/28 22:07:11 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2009/11/28 22:06:20 | 04,045,544 | —- | C] (Malwarebytes Corporation ) – C:\Documents and Settings\Mark\Desktop\mbam-setup.exe
[2009/11/17 20:55:35 | 00,000,000 | —D | C] – C:\Program Files\iTunes
[2009/11/17 20:55:35 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2009/11/17 20:50:30 | 00,000,000 | —D | C] – C:\Program Files\QuickTime
[2005/07/12 16:28:50 | 00,065,536 | —- | C] ( ) – C:\WINDOWS\System32\A3d.dll
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2009/11/29 11:16:00 | 00,000,366 | —- | M] () – C:\WINDOWS\tasks\Symantec NetDetect.job
[2009/11/29 11:10:13 | 00,535,552 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Mark\Desktop\OTL.exe
[2009/11/29 11:07:57 | 01,197,568 | —- | M] (Advanced Virus Remover) – C:\WINDOWS\System32\AVR10.exe
[2009/11/29 11:07:57 | 00,000,000 | —- | M] () – C:\WINDOWS\System32\41.exe
[2009/11/29 11:06:53 | 00,002,854 | —- | M] () – C:\WINDOWS\System32\critical_warning.html
[2009/11/29 11:05:55 | 00,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2009/11/29 11:05:22 | 00,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2009/11/29 11:05:11 | 53,492,5312 | -HS- | M] () – C:\hiberfil.sys
[2009/11/29 11:03:31 | 07,602,176 | -H– | M] () – C:\Documents and Settings\Mark\NTUSER.DAT
[2009/11/29 11:03:31 | 00,000,278 | -HS- | M] () – C:\Documents and Settings\Mark\ntuser.ini
[2009/11/29 10:59:41 | 00,000,000 | —- | M] () – C:\WINDOWS\System32\15724.exe
[2009/11/29 10:39:41 | 00,000,000 | —- | M] () – C:\WINDOWS\System32\19169.exe
[2009/11/29 10:19:41 | 00,000,000 | —- | M] () – C:\WINDOWS\System32\26500.exe
[2009/11/29 09:59:40 | 00,000,000 | —- | M] () – C:\WINDOWS\System32\6334.exe
[2009/11/29 09:39:40 | 00,000,000 | —- | M] () – C:\WINDOWS\System32\18467.exe
[2009/11/29 09:21:35 | 00,002,497 | —- | M] () – C:\Documents and Settings\Mark\Desktop\Microsoft Office Word 2003.lnk
[2009/11/29 09:02:40 | 00,000,420 | -H– | M] () – C:\WINDOWS\tasks\User_Feed_Synchronization-{FAEDD853-077D-4077-B36D-22E9E1DC69C5}.job
[2009/11/29 01:13:16 | 00,050,688 | —- | M] (Atribune.org) – C:\Documents and Settings\Mark\Desktop\ATF_Cleaner.exe
[2009/11/29 00:33:01 | 00,000,414 | —- | M] () – C:\WINDOWS\tasks\ParetoLogic Update Version2.job
[2009/11/28 23:33:26 | 01,872,472 | —- | M] () – C:\Documents and Settings\Mark\Desktop\SmitfraudFix.exe
[2009/11/28 23:28:41 | 00,165,376 | —- | M] () – C:\Documents and Settings\Mark\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/11/28 22:07:15 | 00,000,696 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2009/11/28 22:06:25 | 04,045,544 | —- | M] (Malwarebytes Corporation ) – C:\Documents and Settings\Mark\Desktop\mbam-setup.exe
[2009/11/28 20:19:56 | 00,000,104 | —- | M] () – C:\Documents and Settings\Mark\My Documents\My Computer.lnk
[2009/11/28 20:08:46 | 00,022,528 | —- | M] () – C:\WINDOWS\System32\winhelper86.dll
[2009/11/28 20:05:39 | 00,018,944 | —- | M] () – C:\WINDOWS\System32\winupdate86.exe
[2009/11/28 20:05:39 | 00,018,944 | —- | M] () – C:\WINDOWS\System32\winlogon86.exe
[2009/11/28 18:00:01 | 00,000,440 | —- | M] () – C:\WINDOWS\tasks\ParetoLogic Registration.job
[2009/11/28 11:51:43 | 00,002,206 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2009/11/26 23:43:19 | 00,000,444 | —- | M] () – C:\WINDOWS\tasks\ParetoLogic Privacy Controls_{736BF93C-FEE4-11DD-BCE6-00123F94A147}.job
[2009/11/25 19:03:49 | 00,001,393 | —- | M] () – C:\WINDOWS\imsins.BAK
[2009/11/24 09:03:10 | 00,002,495 | —- | M] () – C:\Documents and Settings\Mark\Desktop\Microsoft Office Excel 2003.lnk
[2009/11/23 23:02:24 | 00,000,620 | —- | M] () – C:\WINDOWS\tasks\Norton Internet Security - Run Full System Scan - Mark.job
[2009/11/21 23:47:47 | 00,002,137 | —- | M] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2009/11/21 12:17:18 | 00,292,352 | —- | M] () – C:\Documents and Settings\Mark\Desktop\gmer.exe
[2009/11/17 21:03:34 | 00,001,854 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Safari.lnk
[2009/11/11 19:57:39 | 00,159,544 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2009/11/04 22:51:58 | 00,002,419 | —- | M] () – C:\Documents and Settings\Mark\Desktop\Draft Analyzer 2009.lnk
[2009/11/01 09:54:33 | 00,445,370 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2009/11/01 09:54:33 | 00,072,576 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2009/11/01 09:54:31 | 00,528,020 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2009/10/30 17:25:47 | 00,002,521 | —- | M] () – C:\Documents and Settings\Mark\Desktop\Microsoft Office Outlook 2003.lnk
[2009/10/30 11:34:55 | 00,039,068 | —- | M] () – C:\Documents and Settings\Mark\My Documents\export.qfx
[2009/10/30 11:33:28 | 00,013,689 | —- | M] () – C:\Documents and Settings\Mark\My Documents\TransactionHistory.csv
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2009/11/29 11:06:53 | 00,002,854 | —- | C] () – C:\WINDOWS\System32\critical_warning.html
[2009/11/28 23:33:18 | 01,872,472 | —- | C] () – C:\Documents and Settings\Mark\Desktop\SmitfraudFix.exe
[2009/11/28 22:07:15 | 00,000,696 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2009/11/28 21:51:04 | 00,000,000 | —- | C] () – C:\WINDOWS\System32\15724.exe
[2009/11/28 21:30:43 | 00,000,000 | —- | C] () – C:\WINDOWS\System32\19169.exe
[2009/11/28 21:10:22 | 00,000,000 | —- | C] () – C:\WINDOWS\System32\26500.exe
[2009/11/28 20:50:01 | 00,000,000 | —- | C] () – C:\WINDOWS\System32\6334.exe
[2009/11/28 20:29:40 | 00,000,000 | —- | C] () – C:\WINDOWS\System32\18467.exe
[2009/11/28 20:19:55 | 00,000,104 | —- | C] () – C:\Documents and Settings\Mark\My Documents\My Computer.lnk
[2009/11/28 20:09:19 | 00,000,000 | —- | C] () – C:\WINDOWS\System32\41.exe
[2009/11/28 20:08:32 | 00,022,528 | —- | C] () – C:\WINDOWS\System32\winhelper86.dll
[2009/11/28 20:05:50 | 00,018,944 | —- | C] () – C:\WINDOWS\System32\winupdate86.exe
[2009/11/28 20:05:50 | 00,018,944 | —- | C] () – C:\WINDOWS\System32\winlogon86.exe
[2009/11/21 12:17:18 | 00,292,352 | —- | C] () – C:\Documents and Settings\Mark\Desktop\gmer.exe
[2009/11/17 21:03:34 | 00,001,854 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Safari.lnk
[2009/11/17 20:57:11 | 00,002,137 | —- | C] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2009/10/30 11:34:55 | 00,039,068 | —- | C] () – C:\Documents and Settings\Mark\My Documents\export.qfx
[2009/10/30 11:33:26 | 00,013,689 | —- | C] () – C:\Documents and Settings\Mark\My Documents\TransactionHistory.csv
[2008/04/15 20:29:21 | 00,010,426 | —- | C] () – C:\Documents and Settings\Mark\Application Data\Comma Separated Values (Windows).CAL
[2008/02/11 09:10:08 | 00,012,558 | —- | C] () – C:\Documents and Settings\All Users\Application Data\LuUninstall.LiveUpdate
[2007/06/29 13:50:21 | 00,000,067 | —- | C] () – C:\WINDOWS\AoADVDRipper.INI
[2007/03/05 12:34:28 | 00,676,224 | —- | C] () – C:\WINDOWS\System32\OGACheckControl.DLL
[2006/07/21 21:37:27 | 00,122,880 | —- | C] () – C:\WINDOWS\System32\cddvdint.dll
[2006/01/26 18:36:32 | 00,000,210 | —- | C] () – C:\WINDOWS\QUICKEN.INI
[2005/12/28 20:00:01 | 00,001,359 | —- | C] () – C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2005/08/06 11:49:27 | 00,000,866 | —- | C] () – C:\WINDOWS\cdPlayer.ini
[2005/08/03 18:57:49 | 00,165,376 | —- | C] () – C:\Documents and Settings\Mark\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2005/07/26 21:52:55 | 00,000,029 | —- | C] () – C:\WINDOWS\DEBUGSM.INI
[2005/07/26 15:08:01 | 00,000,000 | —- | C] () – C:\WINDOWS\OpPrintServer.INI
[2005/07/21 21:19:17 | 00,000,002 | —- | C] () – C:\WINDOWS\msoffice.ini
[2005/07/18 21:11:11 | 00,024,932 | —- | C] () – C:\Documents and Settings\Mark\Application Data\Comma Separated Values (Windows).ADR
[2005/07/18 20:16:29 | 00,000,021 | —- | C] () – C:\WINDOWS\PI_setup.ini
[2005/07/18 20:14:07 | 00,096,768 | —- | C] () – C:\WINDOWS\SlantAdj.dll
[2005/07/18 20:14:07 | 00,000,072 | —- | C] () – C:\WINDOWS\System32\epDPE.ini
[2005/07/18 20:11:06 | 00,000,196 | —- | C] () – C:\WINDOWS\EPSON RX500 Installer.ini
[2005/07/18 19:39:53 | 00,000,127 | —- | C] () – C:\Documents and Settings\Mark\Local Settings\Application Data\fusioncache.dat
[2005/07/18 19:29:17 | 00,000,118 | —- | C] () – C:\WINDOWS\kodakpcd.Mark.ini
[2005/07/12 17:09:17 | 00,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2005/07/12 17:01:08 | 00,000,138 | —- | C] () – C:\WINDOWS\wininit.ini
[2005/07/12 16:53:05 | 00,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2005/07/12 16:50:36 | 00,000,011 | —- | C] () – C:\WINDOWS\SBWIN.INI
[2005/07/12 16:28:16 | 00,000,375 | —- | C] () – C:\WINDOWS\System32\OEMINFO.INI
[2005/05/03 10:38:42 | 00,064,512 | —- | C] () – C:\WINDOWS\System32\P17.dll
[2005/01/28 07:08:34 | 00,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini
[2004/08/10 12:12:05 | 00,000,780 | —- | C] () – C:\WINDOWS\orun32.ini
[2004/08/10 12:01:18 | 00,001,793 | —- | C] () – C:\WINDOWS\System32\fxsperf.ini
[2003/10/02 09:48:18 | 00,053,248 | —- | C] () – C:\WINDOWS\System32\P17CPI.dll
[2003/01/07 14:05:08 | 00,002,695 | —- | C] () – C:\WINDOWS\System32\OUTLPERF.INI

========== LOP Check ==========

[2008/12/14 21:31:12 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\acccore
[2008/09/18 19:50:27 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\CopyTransControlCenter
[2009/02/19 18:20:19 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Downloaded Installations
[2009/02/19 18:21:15 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\ParetoLogic
[2007/06/29 16:29:16 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SupportSoft
[2007/06/29 14:04:39 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2007/02/05 13:38:05 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TurboTax 2006
[2008/12/14 21:31:19 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Viewpoint
[2009/04/01 08:03:57 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\WinZip
[2009/11/17 20:56:52 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2009/04/09 20:24:12 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2008/12/14 21:32:08 | 00,000,000 | —D | M] – C:\Documents and Settings\Mark\Application Data\acccore
[2008/12/19 19:01:14 | 00,000,000 | —D | M] – C:\Documents and Settings\Mark\Application Data\Aim
[2008/09/19 15:51:01 | 00,000,000 | —D | M] – C:\Documents and Settings\Mark\Application Data\CopyTrans
[2008/09/19 15:50:48 | 00,000,000 | —D | M] – C:\Documents and Settings\Mark\Application Data\CopyTransControlCenter
[2006/04/12 08:43:03 | 00,000,000 | —D | M] – C:\Documents and Settings\Mark\Application Data\EPSON
[2006/05/05 17:44:59 | 00,000,000 | —D | M] – C:\Documents and Settings\Mark\Application Data\FUJIFILM
[2006/07/21 21:39:24 | 00,000,000 | —D | M] – C:\Documents and Settings\Mark\Application Data\InterVideo
[2005/07/18 19:39:09 | 00,000,000 | —D | M] – C:\Documents and Settings\Mark\Application Data\Leadertech
[2007/10/11 08:12:58 | 00,000,000 | —D | M] – C:\Documents and Settings\Mark\Application Data\OfficeUpdate12
[2009/02/19 18:21:55 | 00,000,000 | —D | M] – C:\Documents and Settings\Mark\Application Data\ParetoLogic
[2008/09/22 17:47:48 | 00,000,000 | —D | M] – C:\Documents and Settings\Mark\Application Data\Smart Panel
[2005/12/31 13:16:49 | 00,000,000 | —D | M] – C:\Documents and Settings\Mark\Application Data\Snapfish
[2008/02/12 22:01:10 | 00,000,000 | —D | M] – C:\Documents and Settings\Mark\Application Data\Uniblue
[2007/12/11 21:45:31 | 00,000,000 | —D | M] – C:\Documents and Settings\Mark\Application Data\Viewpoint
[2009/11/26 23:43:19 | 00,000,444 | —- | M] () – C:\WINDOWS\Tasks\ParetoLogic Privacy Controls_{736BF93C-FEE4-11DD-BCE6-00123F94A147}.job
[2009/11/28 18:00:01 | 00,000,440 | —- | M] () – C:\WINDOWS\Tasks\ParetoLogic Registration.job
[2009/11/29 00:33:01 | 00,000,414 | —- | M] () – C:\WINDOWS\Tasks\ParetoLogic Update Version2.job
[2009/11/29 09:02:40 | 00,000,420 | -H– | M] () – C:\WINDOWS\Tasks\User_Feed_Synchronization-{FAEDD853-077D-4077-B36D-22E9E1DC69C5}.job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.exe >


< MD5 for: AGP440.SYS >
[2008/04/13 12:36:38 | 00,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 – C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008/04/13 12:36:38 | 00,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 – C:\WINDOWS\system32\drivers\agp440.sys
[2004/08/03 22:07:42 | 00,042,368 | —- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB – C:\i386\AGP440.SYS
[2004/08/03 22:07:42 | 00,042,368 | —- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB – C:\WINDOWS\$NtServicePackUninstall$\agp440.sys

< MD5 for: ATAPI.SYS >
[2008/04/13 12:40:30 | 00,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008/04/13 12:40:30 | 00,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\system32\drivers\atapi.sys
[2004/08/03 21:59:44 | 00,095,360 | —- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 – C:\i386\atapi.sys
[2004/08/03 21:59:44 | 00,095,360 | —- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 – C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
[2004/08/03 21:59:44 | 00,095,360 | —- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 – C:\WINDOWS\system32\ReinstallBackups\0004\DriverFiles\i386\atapi.sys
[2004/08/03 21:59:44 | 00,095,360 | —- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 – C:\WINDOWS\system32\ReinstallBackups\0011\DriverFiles\i386\atapi.sys

< MD5 for: EVENTLOG.DLL >
[2008/04/13 18:11:53 | 00,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008/04/13 18:11:53 | 00,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\system32\eventlog.dll
[2004/08/04 04:00:00 | 00,055,808 | —- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 – C:\i386\eventlog.dll
[2004/08/04 04:00:00 | 00,055,808 | —- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 – C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll

< MD5 for: IASTOR.SYS >
[2005/04/25 12:28:14 | 00,871,040 | —- | M] (Intel Corporation) MD5=D593517879E65167DF35F6015814AC59 – C:\dell\MEDIAEXE\RepFiles\iastor.sys

< MD5 for: NETLOGON.DLL >
[2008/04/13 18:12:01 | 00,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008/04/13 18:12:01 | 00,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\system32\netlogon.dll
[2004/08/04 04:00:00 | 00,407,040 | —- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A – C:\i386\netlogon.dll
[2004/08/04 04:00:00 | 00,407,040 | —- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A – C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll

< MD5 for: SCECLI.DLL >
[2004/08/04 04:00:00 | 00,180,224 | —- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A – C:\i386\scecli.dll
[2004/08/04 04:00:00 | 00,180,224 | —- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A – C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
[2008/04/13 18:12:05 | 00,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008/04/13 18:12:05 | 00,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\system32\scecli.dll

========== Alternate Data Streams ==========

@Alternate Data Stream - 102 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:30FD0CBD
< End of report >
OTL Extras logfile created on: 11/29/2009 11:13:13 AM - Run 1
OTL by OldTimer - Version 3.1.11.2 Folder = C:\Documents and Settings\Mark\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

510.07 Mb Total Physical Memory | 47.88 Mb Available Physical Memory | 9.39% Memory free
1.97 Gb Paging File | 1.55 Gb Available in Paging File | 78.76% Paging File free
Paging file location(s): C:\pagefile.sys 1536 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 144.96 Gb Total Space | 83.14 Gb Free Space | 57.36% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: RICKEY
Current User Name: Mark
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.html [@ = htmlfile] – C:\Program Files\Internet Explorer\IEXPLORE.EXE (Microsoft Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %* File not found
cmdfile [open] – "%1" %* File not found
comfile [open] – "%1" %* File not found
exefile [open] – "%1" %* File not found
htmlfile – "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [open] – "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome (Microsoft Corporation)
htmlfile [opennew] – "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation)
htmlfile [print] – "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" /p %1 (Microsoft Corporation)
http [open] – "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome (Microsoft Corporation)
https [open] – "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome (Microsoft Corporation)
piffile [open] – "%1" %* File not found
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1" File not found
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S File not found
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not found
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [FinePix] – "C:\Program Files\FinePixViewer\FinePixViewer.exe" "%1" (FUJI PHOTO FILM CO.,LTD.)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] – "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] – "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"508:TCP" = 508:TCP:*:Enabled:baseball
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe" = C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe:*:Enabled:AOL – File not found
"C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" = C:\Program Files\Common Files\AOL\ACS\AOLDial.exe:*:Enabled:AOL – File not found
"C:\Program Files\America Online 9.0\waol.exe" = C:\Program Files\America Online 9.0\waol.exe:*:Enabled:AOL – File not found
"C:\Program Files\AIM\aim.exe" = C:\Program Files\AIM\aim.exe:*:Enabled:AOL Instant Messenger – File not found
"C:\Program Files\MSN Messenger\msnmsgr.exe" = C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:MSN Messenger 7.5 – File not found

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe" = C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe:*:Enabled:AOL – File not found
"C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" = C:\Program Files\Common Files\AOL\ACS\AOLDial.exe:*:Enabled:AOL – File not found
"C:\Program Files\America Online 9.0\waol.exe" = C:\Program Files\America Online 9.0\waol.exe:*:Enabled:AOL – File not found
"C:\Program Files\AIM\aim.exe" = C:\Program Files\AIM\aim.exe:*:Enabled:AOL Instant Messenger – File not found
"C:\Program Files\MSN Messenger\msnmsgr.exe" = C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:MSN Messenger 7.5 – File not found
"C:\Program Files\TurboTax\Deluxe Deduction Maximizer 2006\32bit\ttax.exe" = C:\Program Files\TurboTax\Deluxe Deduction Maximizer 2006\32bit\ttax.exe:LocalSubNet:Enabled:TurboTax – File not found
"C:\Program Files\TurboTax\Deluxe Deduction Maximizer 2006\32bit\updatemgr.exe" = C:\Program Files\TurboTax\Deluxe Deduction Maximizer 2006\32bit\updatemgr.exe:LocalSubNet:Enabled:TurboTax Update Manager – File not found
"C:\Program Files\TurboTax\Deluxe 2007\32bit\ttax.exe" = C:\Program Files\TurboTax\Deluxe 2007\32bit\ttax.exe:LocalSubNet:Enabled:TurboTax – File not found
"C:\Program Files\TurboTax\Deluxe 2007\32bit\updatemgr.exe" = C:\Program Files\TurboTax\Deluxe 2007\32bit\updatemgr.exe:LocalSubNet:Enabled:TurboTax Update Manager – File not found
"C:\Program Files\Common Files\AOL\Loader\aolload.exe" = C:\Program Files\Common Files\AOL\Loader\aolload.exe:*:Enabled:AOL Loader – (AOL LLC)
"C:\Program Files\AIM6\aim6.exe" = C:\Program Files\AIM6\aim6.exe:*:Enabled:AIM – (AOL LLC)
"C:\Program Files\Bonjour\mDNSResponder.exe" = C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour – (Apple Inc.)
"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes – (Apple Inc.)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{001AB29C-5468-4972-8D24-2EBDB2B12133}" = Camera Window DVC
"{023914C7-2806-41BF-9404-5C670AC48AA0}" = SymNet
"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
"{075473F5-846A-448B-BCB3-104AA1760205}" = Sonic RecordNow Data
"{0B53B71D-9E2F-42B8-9123-96354872D166}" = EPSON Photo Print
"{0BEDBD4E-2D34-47B5-9973-57E62B29307C}" = ATI Control Panel
"{0D2E80C8-0875-43EB-9623-47118E2DFBCA}" = Quicken 2007
"{0E0131B2-CF18-40D9-A331-60A3746C1204}" = EPSON Scan
"{0EB5D9B7-8E6C-4A9E-B74F-16B7EE89A67B}" = Microsoft Plus! Photo Story 2 LE
"{109D28C7-FB38-483A-9C91-001CB59E2699}" = EPSON CardMonitor
"{1206EF92-2E83-4859-ACCB-2048C3CB7DA6}" = Sonic DLA
"{1B399A41-C1D0-40A2-9E4F-095868EFAF01}" = InterVideo WinDVD 5
"{20C53FA2-4307-4671-A93F-9463B29DFCF1}" = Symantec Technical Support Web Controls
"{21657574-BD54-48A2-9450-EB03B2C7FC29}" = Sonic MyDVD LE
"{22DE1881-9D24-4981-B5CC-EC7E9F2F4D52}" = Rhapsody Player Engine
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{24ED4D80-8294-11D5-96CD-0040266301AD}" = FinePixViewer Ver.5.1
"{2E63BD12-932B-42F5-86B9-5E05BCA1DC3E}" = ParetoLogic Privacy Controls
"{2E7595EC-4FB1-4E29-93D4-9083C8A9B107}" = TurboTax ItsDeductible 2005
"{31478BE1-CDE5-4753-A8B2-F6D4BC1FBE09}" = Component Framework
"{32343DB6-9A52-40C9-87E4-5E7C79791C87}" = MSXML 4.0 SP2 and SOAP Toolkit 3.0
"{3248F0A8-6813-11D6-A77B-00B0D0150060}" = J2SE Runtime Environment 5.0 Update 6
"{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java™ 6 Update 3
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java™ 6 Update 7
"{33BB4982-DC52-4886-A03B-F4C5C80BEE89}" = Windows Media Player 10
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{35BDEFF1-A610-4956-A00D-15453C116395}" = Internet Explorer Default Page
"{36BD0774-6CD6-4FF9-A148-83CA09AC123E}" = Intel® PROSafe for Wired Connections
"{3AC54383-31D1-4907-961B-B12CBB1D0AE8}" = MobileMe Control Panel
"{3F92ABBB-6BBF-11D5-B229-002078017FBF}" = Modem On Hold
"{3FA365DF-2D68-45ED-8F83-8C8A33E65143}" = Apple Application Support
"{403EF592-953B-4794-BCEF-ECAB835C2095}" = Intel® PROSafe for Wired Connections
"{44E24545-F317-4498-B7CD-240DE7BA8DE2}" = RAW Image Task
"{5490882C-6961-11D5-BAE5-00E0188E010B}" = FUJIFILM USB Driver
"{55A6283C-638A-4EE0-B491-51118554BDA2}" = Norton Confidential Core
"{56F3E1FF-54FE-4384-A153-6CCABA097814}" = Creative MediaSource
"{5905F42D-3F5F-4916-ADA6-94A3646AEE76}" = Dell Driver Reset Tool
"{5983C895-DDA4-45D9-A8D1-877D5DE7693E}" = EPSON PhotoStarter3.0
"{62120008-8E1E-4807-860D-A8B48F8552DB}" = Norton Protection Center
"{62BD0AE0-4EB1-4BBB-8F43-B6400C8FEB2C}" = AOLIcon
"{66C8BE35-8BBB-472B-96C7-C7C9A499F988}" = ArcSoft Software Suite
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD 5.5
"{68D27126-BF6A-457D-8DD0-5F35E8D41310}" = MovieEdit Task
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6B8BDABA-6737-4998-AEE4-E218EDE5FC7A}" = Camera Window DS
"{6C11D561-620B-47DA-A693-4C597F3CDF40}" = EPSON Smart Panel
"{6E179C77-7335-458D-9537-4F4EAC0181ED}" = Photo Click
"{6E45BA47-383C-4C1E-8ED0-0D4845C293D7}" = Microsoft Plus! Digital Media Edition Installer
"{7148F0A8-6813-11D6-A77B-00B0D0142030}" = Java 2 Runtime Environment, SE v1.4.2_03
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{74F7662C-B1DB-489E-A8AC-07A06B24978B}" = Dell System Restore
"{77772678-817F-4401-9301-ED1D01A8DA56}" = SPBBC 32bit
"{77FFBA7E-0973-4F39-BBDB-AC2F537578D2}" = Norton AntiVirus
"{78D944D7-A97B-4004-AB0A-B5AD06839940}" = My Way Search Assistant
"{7A0EFAFB-AC4B-4B88-8C6B-6731BE88DB68}" = Modem Event Monitor
"{7DD9A065-2C86-4A9F-A5FF-796EC1B99DCA}" = AnswerWorks 4.0 Runtime - English
"{7EFA5E6F-74F7-4AFB-8AEA-AA790BD3A76D}" = DellSupport
"{7F142D56-3326-11D5-B229-002078017FBF}" = Modem Helper
"{89EB3ED7-225A-412E-B048-623D502C000F}" = Camera Window MC
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{91130409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Basic Edition 2003
"{942C27F5-00CA-4D85-9D28-48B9BAFF0E88}" = Symantec Real Time Storage Protection Component
"{A1D0D14A-B776-4907-BC00-5149F2298086}" = Camera Support Core Library
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A429C2AE-EBF1-4F81-A221-1C115CAADDAD}" = QuickTime
"{AADEA55D-C834-4BCB-98A3-4B8D1C18F4EE}" = Apple Mobile Device Support
"{AB708C9B-97C8-4AC9-899B-DBF226AC9382}" = Sonic RecordNow Audio
"{AC76BA86-7AD7-1033-7B44-A70000000000}" = Adobe Reader 7.0
"{AFF1EA96-9C23-4249-B7D4-CD4B54D4582F}" = TurboTax ItsDeductible 2006
"{B12665F4-4E93-4AB4-B7FC-37053B524629}" = Sonic RecordNow Copy
"{B24E05CC-46FF-4787-BBB8-5CD516AFB118}" = ccCommon
"{B44529FF-501E-47CD-A06D-223C161BE058}" = FinePixViewer Resource
"{B69CC1A5-0404-11D6-ABCB-005004C21D30}" = EPSON Copy Utility
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C1C185CA-C531-49F5-A6FA-B838405A049D}" = Norton Internet Security
"{C1D76D7A-F3BB-47EA-A746-5B1E2FFC1DF2}" = Canon ZoomBrowser EX
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D1A74FBB-CA8D-4CCA-9B89-BAAA436DB178}" = iTunes
"{D4936AAF-FFD0-44A1-A7EA-A2DB41CEB5BC}" = iPod for Windows 2005-09-23
"{D680C913-5955-469D-9D88-C1940F7506D6}" = RAW FILE CONVERTER LE
"{D6E4E5D6-7693-4BB4-95BA-21F38FAFEE90}" = Safari
"{E3EFA461-EB83-4C3B-9C47-2C1D58A01555}" = Norton AntiVirus Help
"{E80F62FF-5D3C-4A19-8409-9721F2928206}" = LiveUpdate (Symantec Corporation)
"{E8192116-B93A-4245-AF56-C4016D5DF331}" = Draft Analyzer 2009
"{EA2BEBD6-87B9-41E5-95AC-7E4C165A9475}" = WexTech AnswerWorks
"{EBAE381B-60A6-4863-AA9F-FCAB755BC9E5}" = ScanToWeb
"{EF91B23E-3819-43A1-AE47-043E1900EB2B}" = RemoteCapture 2.7.4
"{EFB5B3B5-A280-4E25-BE1C-634EEFE32C1B}" = AppCore
"{F11A403B-0DE9-4953-B790-7A2F014FBB2B}" = PhotoStitch
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"AIM_6" = AIM 6
"ATI Display Driver" = ATI Display Driver
"BroadJump Client Foundation" = BroadJump Client Foundation
"CopyTrans Suite" = CopyTrans Suite Remove Only
"CTDVDAudio Plugin" = Creative DVD Audio Plugin for Audigy Series
"EPSON Printer and Utilities" = EPSON Printer Software
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"InstallShield_{001AB29C-5468-4972-8D24-2EBDB2B12133}" = Canon Camera Window DC_DV 5 for ZoomBrowser EX
"InstallShield_{44E24545-F317-4498-B7CD-240DE7BA8DE2}" = Canon RAW Image Task for ZoomBrowser EX
"InstallShield_{68D27126-BF6A-457D-8DD0-5F35E8D41310}" = Canon MovieEdit Task for ZoomBrowser EX
"InstallShield_{6B8BDABA-6737-4998-AEE4-E218EDE5FC7A}" = Canon Camera Window DS for ZoomBrowser EX
"InstallShield_{89EB3ED7-225A-412E-B048-623D502C000F}" = Canon Camera Window MC 5 for ZoomBrowser EX
"InstallShield_{A1D0D14A-B776-4907-BC00-5149F2298086}" = Canon Camera Support Core Library
"InstallShield_{D4936AAF-FFD0-44A1-A7EA-A2DB41CEB5BC}" = iPod for Windows 2005-09-23
"InstallShield_{EF91B23E-3819-43A1-AE47-043E1900EB2B}" = Canon Utilities RemoteCapture 2.7
"InstallShield_{F11A403B-0DE9-4953-B790-7A2F014FBB2B}" = Canon Utilities PhotoStitch 3.1
"Intel® 537EP V9x DF PCI Modem" = Intel® 537EP V9x DF PCI Modem
"InterActual Player" = InterActual Player
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"MyWaySearchAssistantDE" = My Way Search Assistant
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"PhotoRecord" = Canon PhotoRecord
"PROSetDX" = Intel® PRO Network Connections Software v9.2.4.11
"PsuedoLiveUpdate" = LiveUpdate (Symantec Corporation)
"RealPlayer 6.0" = RealPlayer
"RegistryBooster 2_is1" = Uniblue RegistryBooster 2
"Silent Package Run-Time Sample" = EPSON RX500 Reference Guide
"SoftwareUpdUtility" = Download Updater (AOL LLC)
"ST6UNST #1" = Action PC Football 2009
"Strat-O-Matic CD-ROM Ver12.0" = Strat-O-Matic CD-ROM Ver12.0
"Strat-O-Matic CD-ROM Ver13.0" = Strat-O-Matic CD-ROM Ver13.0
"Strat-O-Matic CD-ROM Ver14.0" = Strat-O-Matic CD-ROM Ver14.0
"StreetPlugin" = Learn2 Player (Uninstall Only)
"SymSetup.{C1C185CA-C531-49F5-A6FA-B838405A049D}" = Norton Internet Security (Symantec Corporation)
"ViewpointMediaPlayer" = Viewpoint Media Player
"Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinZip" = WinZip
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"XiRCON 1.0B4" = XiRCON 1.0B4

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"ESPN Java Check" = ESPN Java Check

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 10/23/2009 12:35:01 AM | Computer Name = RICKEY | Source = Automatic LiveUpdate Scheduler | ID = 101
Description = Information Level: error Initialization of the COM subsystem failed.
Error code: 0x8007041D.

Error - 11/28/2009 2:07:58 PM | Computer Name = RICKEY | Source = Automatic LiveUpdate Scheduler | ID = 101
Description = Information Level: error Initialization of the COM subsystem failed.
Error code: 0x8007041D.

Error - 11/29/2009 12:26:17 AM | Computer Name = RICKEY | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: The server name or address could not be resolved

Error - 11/29/2009 12:26:17 AM | Computer Name = RICKEY | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This network connection does not exist.

Error - 11/29/2009 12:26:17 AM | Computer Name = RICKEY | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This network connection does not exist.

Error - 11/29/2009 12:26:17 AM | Computer Name = RICKEY | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This network connection does not exist.

Error - 11/29/2009 12:26:17 AM | Computer Name = RICKEY | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This network connection does not exist.

Error - 11/29/2009 12:26:17 AM | Computer Name = RICKEY | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This network connection does not exist.

[ System Events ]
Error - 11/29/2009 1:27:25 AM | Computer Name = RICKEY | Source = Service Control Manager | ID = 7034
Description = The Ati HotKey Poller service terminated unexpectedly. It has done
this 1 time(s).

Error - 11/29/2009 1:41:06 AM | Computer Name = RICKEY | Source = Service Control Manager | ID = 7034
Description = The Ati HotKey Poller service terminated unexpectedly. It has done
this 1 time(s).

Error - 11/29/2009 2:03:23 AM | Computer Name = RICKEY | Source = Service Control Manager | ID = 7034
Description = The Ati HotKey Poller service terminated unexpectedly. It has done
this 1 time(s).

Error - 11/29/2009 3:23:37 AM | Computer Name = RICKEY | Source = Service Control Manager | ID = 7034
Description = The Ati HotKey Poller service terminated unexpectedly. It has done
this 1 time(s).

Error - 11/29/2009 10:58:45 AM | Computer Name = RICKEY | Source = Service Control Manager | ID = 7034
Description = The Ati HotKey Poller service terminated unexpectedly. It has done
this 1 time(s).

Error - 11/29/2009 11:19:28 AM | Computer Name = RICKEY | Source = Service Control Manager | ID = 7034
Description = The Ati HotKey Poller service terminated unexpectedly. It has done
this 1 time(s).

Error - 11/29/2009 12:54:42 PM | Computer Name = RICKEY | Source = Dhcp | ID = 1008
Description = Your computer was unable to initialize a Network Interface attached
to
the system. The error code is: %%1450.

Error - 11/29/2009 12:56:49 PM | Computer Name = RICKEY | Source = Dhcp | ID = 1008
Description = Your computer was unable to initialize a Network Interface attached
to
the system. The error code is: %%1450.

Error - 11/29/2009 1:01:47 PM | Computer Name = RICKEY | Source = Dhcp | ID = 1008
Description = Your computer was unable to initialize a Network Interface attached
to
the system. The error code is: %%1450.

Error - 11/29/2009 1:07:16 PM | Computer Name = RICKEY | Source = Service Control Manager | ID = 7034
Description = The Ati HotKey Poller service terminated unexpectedly. It has done
this 1 time(s).


< End of report >

Ok, here they are, looks much better….:

All processes killed
========== OTL ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\winupdate86.exe deleted successfully.
C:\WINDOWS\system32\winupdate86.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktopChanges deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoSetActiveDesktop deleted successfully.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktopChanges deleted successfully.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoSetActiveDesktop deleted successfully.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\DisableTaskMgr deleted successfully.
File C:\WINDOWS\System32\AVR10.exe not found.
C:\WINDOWS\system32\critical_warning.html moved successfully.
C:\WINDOWS\system32\15724.exe moved successfully.
C:\WINDOWS\system32\19169.exe moved successfully.
C:\WINDOWS\system32\26500.exe moved successfully.
C:\WINDOWS\system32\6334.exe moved successfully.
C:\WINDOWS\system32\18467.exe moved successfully.
C:\WINDOWS\system32\winhelper86.dll moved successfully.
C:\WINDOWS\system32\winlogon86.exe moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Mark
->Temp folder emptied: 67592 bytes
->Temporary Internet Files folder emptied: 10409466 bytes
->Java cache emptied: 6727288 bytes
->Apple Safari cache emptied: 2167321 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Stephanie
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Java cache emptied: 123194 bytes
->Apple Safari cache emptied: 101483 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 19569 bytes
%systemroot%\System32 .tmp files removed: 2577 bytes
Windows Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 23956322 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 53262 bytes
RecycleBin emptied: 34 bytes

Total Files Cleaned = 41.67 mb


OTL by OldTimer - Version 3.1.11.2 log created on 11292009_123100

Files\Folders moved on Reboot…
File\Folder C:\WINDOWS\temp\JETD88.tmp not found!

Registry entries deleted on Reboot…
ComboFix 09-11-29.01 - Mark 11/29/2009 12:44.1.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.510.118 [GMT -6:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: Norton Internet Security *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Internet Security *enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Mark\Application Data\Microsoft\Internet Explorer\Quick Launch\Advanced Virus Remover.lnk
c:\documents and settings\Mark\Desktop\Advanced Virus Remover.lnk
c:\documents and settings\Mark\Start Menu\Advanced Virus Remover.lnk
c:\program files\AdvancedVirusRemover
c:\program files\AdvancedVirusRemover\AVR.exe
c:\windows\system32\41.exe

.
((((((((((((((((((((((((( Files Created from 2009-10-28 to 2009-11-29 )))))))))))))))))))))))))))))))
.

2009-11-29 18:31 . 2009-11-29 18:31 ——– d—–w- C:\_OTL
2009-11-29 04:07 . 2009-11-29 04:07 ——– d—–w- c:\documents and settings\Mark\Application Data\Malwarebytes
2009-11-29 04:07 . 2009-09-10 20:54 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-11-29 04:07 . 2009-11-29 04:07 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2009-11-29 04:07 . 2009-11-29 04:07 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-11-29 04:07 . 2009-09-10 20:53 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-11-18 02:58 . 2009-11-18 02:58 79144 —-a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\Safari 5.31.21.10\SetupAdmin.exe
2009-11-18 02:55 . 2009-11-18 02:56 ——– d—–w- c:\program files\iTunes
2009-11-18 02:55 . 2009-11-18 02:56 ——– d—–w- c:\documents and settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
2009-11-18 02:50 . 2009-11-18 02:51 ——– d—–w- c:\program files\QuickTime
2009-11-18 02:40 . 2009-11-18 02:40 79144 —-a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.2.25\SetupAdmin.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-29 18:43 . 2005-07-12 23:02 ——– d—–w- c:\program files\Common Files\Symantec Shared
2009-11-24 14:29 . 2005-07-12 23:02 ——– d—–w- c:\documents and settings\All Users\Application Data\Symantec
2009-11-18 03:18 . 2005-11-18 02:59 ——– d—–w- c:\documents and settings\Mark\Application Data\Apple Computer
2009-11-18 03:04 . 2008-07-22 22:09 ——– d—–w- c:\program files\Safari
2009-11-18 02:55 . 2005-11-18 02:56 ——– d—–w- c:\program files\iPod
2009-11-18 02:55 . 2007-08-25 19:56 ——– d—–w- c:\program files\Common Files\Apple
2009-11-05 04:53 . 2009-09-09 21:44 ——– d—–w- c:\program files\Draft Analyzer 2009
2009-10-03 05:14 . 2006-03-07 03:15 ——– d—–w- c:\program files\FinePixViewer
2009-09-30 19:58 . 2007-08-25 05:07 9576 —-a-w- c:\documents and settings\All Users\Application Data\Symantec\LiveUpdate\LuRegManifests\Static\CCMSLLUM.DLL
2009-09-11 14:18 . 2004-08-10 17:51 136192 —-a-w- c:\windows\system32\msv1_0.dll
2009-09-09 21:44 . 2009-09-09 21:44 2462 —-a-r- c:\documents and settings\Mark\Application Data\Microsoft\Installer\{E8192116-B93A-4245-AF56-C4016D5DF331}\_3AE314221EB7B7F1A37101.exe
2009-09-09 21:44 . 2009-09-09 21:44 2462 —-a-r- c:\documents and settings\Mark\Application Data\Microsoft\Installer\{E8192116-B93A-4245-AF56-C4016D5DF331}\_F4E3E166EDAB03F036EBD1.exe
2009-09-04 21:03 . 2004-08-10 17:51 58880 —-a-w- c:\windows\system32\msasn1.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-03-30 339968]
"IntelMeM"="c:\program files\Intel\Modem Event Monitor\IntelMEM.exe" [2003-09-04 221184]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-12-06 127035]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
"BJCFD"="c:\program files\BroadJump\Client Foundation\CFD.exe" [2002-09-11 368706]
"EPSON Stylus Photo RX500"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_S4I2K1.EXE" [2003-06-01 99840]
"REGSHAVE"="c:\program files\REGSHAVE\REGSHAVE.EXE" [2002-02-05 53248]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-10-17 51048]
"osCheck"="c:\program files\Norton Internet Security\osCheck.exe" [2007-08-25 714608]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-02-20 185896]
"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 53248]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-08-13 177440]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-09-05 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-10-29 141600]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]
Exif Launcher.lnk - c:\program files\FinePixViewer\QuickDCF.exe [2006-3-6 282624]
InterVideo WinCinema Manager.lnk - c:\program files\InterVideo\Common\Bin\WinCinemaMgr.exe [2006-7-21 184320]
WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2009-4-1 122880]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"508:TCP"= 508:TCP:baseball

R2 LiveUpdate Notice;LiveUpdate Notice;c:\program files\Common Files\Symantec Shared\CCSVCHST.EXE [8/24/2007 11:07 PM 149352]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [12/14/2008 9:31 PM 24652]
R3 COH_Mon;COH_Mon;c:\windows\system32\drivers\COH_Mon.sys [5/29/2007 2:55 PM 23888]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [9/1/2009 8:58 PM 102448]

— Other Services/Drivers In Memory —

*NewlyCreated* - COMHOST
.
Contents of the 'Scheduled Tasks' folder

2009-09-18 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 17:34]

2009-11-24 c:\windows\Tasks\Norton Internet Security - Run Full System Scan - Mark.job
- c:\program files\Norton Internet Security\Norton AntiVirus\Navw32.exe [2007-08-27 01:19]

2009-11-27 c:\windows\Tasks\ParetoLogic Privacy Controls_{736BF93C-FEE4-11DD-BCE6-00123F94A147}.job
- c:\program files\ParetoLogic\Privacy Controls\Pareto_PC.exe [2008-11-25 17:29]

2009-11-29 c:\windows\Tasks\ParetoLogic Registration.job
- c:\program files\Common Files\ParetoLogic\UUS2\UUS.dll [2008-02-22 18:25]

2009-11-29 c:\windows\Tasks\ParetoLogic Update Version2.job
- c:\program files\Common Files\ParetoLogic\UUS2\Pareto_Update.exe [2008-02-22 18:25]

2009-11-29 c:\windows\Tasks\User_Feed_Synchronization-{FAEDD853-077D-4077-B36D-22E9E1DC69C5}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 09:31]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://flory.net/cof/index.php
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search/?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
Trusted Zone: turbotax.com
.
- - - - ORPHANS REMOVED - - - -

AddRemove-CopyTrans Suite - c:\program files\WindSolutions\CopyTrans Suite\CopyTransControlCenter.exe uninstall
AddRemove-RealJukebox 1.0 - c:\program files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
AddRemove-RealPlayer 6.0 - c:\program files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
AddRemove-Strat-O-Matic CD-ROM Ver14.0 - g:\cdrombb\UNWISE.EXE
AddRemove-{1B399A41-C1D0-40A2-9E4F-095868EFAF01} - c:\program files\InstallShield Installation Information\{1B399A41-C1D0-40A2-9E4F-095868EFAF01}\setup.exe REMOVEALL



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-29 12:59
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2009-11-29 13:15
ComboFix-quarantined-files.txt 2009-11-29 19:15

Pre-Run: 89,217,130,496 bytes free
Post-Run: 88,918,822,912 bytes free

- - End Of File - - 9F296B1B29EB5F03F5C192DEA0A576DD

got it, here it is:

ComboFix 09-11-29.01 - Mark 11/29/2009 14:05.2.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.510.283 [GMT -6:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Mark\Desktop\WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
AV: Norton Internet Security *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Internet Security *enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
.

((((((((((((((((((((((((( Files Created from 2009-10-28 to 2009-11-29 )))))))))))))))))))))))))))))))
.

2009-11-29 18:31 . 2009-11-29 18:31 ——– d—–w- C:\_OTL
2009-11-29 04:07 . 2009-11-29 04:07 ——– d—–w- c:\documents and settings\Mark\Application Data\Malwarebytes
2009-11-29 04:07 . 2009-09-10 20:54 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-11-29 04:07 . 2009-11-29 04:07 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2009-11-29 04:07 . 2009-11-29 04:07 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-11-29 04:07 . 2009-09-10 20:53 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-11-18 02:58 . 2009-11-18 02:58 79144 —-a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\Safari 5.31.21.10\SetupAdmin.exe
2009-11-18 02:55 . 2009-11-18 02:56 ——– d—–w- c:\program files\iTunes
2009-11-18 02:55 . 2009-11-18 02:56 ——– d—–w- c:\documents and settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
2009-11-18 02:50 . 2009-11-18 02:51 ——– d—–w- c:\program files\QuickTime
2009-11-18 02:40 . 2009-11-18 02:40 79144 —-a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.2.25\SetupAdmin.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-29 20:00 . 2005-07-12 23:02 ——– d—–w- c:\program files\Common Files\Symantec Shared
2009-11-24 14:29 . 2005-07-12 23:02 ——– d—–w- c:\documents and settings\All Users\Application Data\Symantec
2009-11-18 03:18 . 2005-11-18 02:59 ——– d—–w- c:\documents and settings\Mark\Application Data\Apple Computer
2009-11-18 03:04 . 2008-07-22 22:09 ——– d—–w- c:\program files\Safari
2009-11-18 02:55 . 2005-11-18 02:56 ——– d—–w- c:\program files\iPod
2009-11-18 02:55 . 2007-08-25 19:56 ——– d—–w- c:\program files\Common Files\Apple
2009-11-05 04:53 . 2009-09-09 21:44 ——– d—–w- c:\program files\Draft Analyzer 2009
2009-10-03 05:14 . 2006-03-07 03:15 ——– d—–w- c:\program files\FinePixViewer
2009-09-30 19:58 . 2007-08-25 05:07 9576 —-a-w- c:\documents and settings\All Users\Application Data\Symantec\LiveUpdate\LuRegManifests\Static\CCMSLLUM.DLL
2009-09-11 14:18 . 2004-08-10 17:51 136192 —-a-w- c:\windows\system32\msv1_0.dll
2009-09-09 21:44 . 2009-09-09 21:44 2462 —-a-r- c:\documents and settings\Mark\Application Data\Microsoft\Installer\{E8192116-B93A-4245-AF56-C4016D5DF331}\_3AE314221EB7B7F1A37101.exe
2009-09-09 21:44 . 2009-09-09 21:44 2462 —-a-r- c:\documents and settings\Mark\Application Data\Microsoft\Installer\{E8192116-B93A-4245-AF56-C4016D5DF331}\_F4E3E166EDAB03F036EBD1.exe
2009-09-04 21:03 . 2004-08-10 17:51 58880 —-a-w- c:\windows\system32\msasn1.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-03-30 339968]
"IntelMeM"="c:\program files\Intel\Modem Event Monitor\IntelMEM.exe" [2003-09-04 221184]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-12-06 127035]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
"BJCFD"="c:\program files\BroadJump\Client Foundation\CFD.exe" [2002-09-11 368706]
"EPSON Stylus Photo RX500"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_S4I2K1.EXE" [2003-06-01 99840]
"REGSHAVE"="c:\program files\REGSHAVE\REGSHAVE.EXE" [2002-02-05 53248]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-10-17 51048]
"osCheck"="c:\program files\Norton Internet Security\osCheck.exe" [2007-08-25 714608]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-02-20 185896]
"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 53248]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-08-13 177440]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-09-05 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-10-29 141600]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]
Exif Launcher.lnk - c:\program files\FinePixViewer\QuickDCF.exe [2006-3-6 282624]
InterVideo WinCinema Manager.lnk - c:\program files\InterVideo\Common\Bin\WinCinemaMgr.exe [2006-7-21 184320]
WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2009-4-1 122880]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"508:TCP"= 508:TCP:baseball

R2 LiveUpdate Notice;LiveUpdate Notice;c:\program files\Common Files\Symantec Shared\CCSVCHST.EXE [8/24/2007 11:07 PM 149352]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [12/14/2008 9:31 PM 24652]
R3 COH_Mon;COH_Mon;c:\windows\system32\drivers\COH_Mon.sys [5/29/2007 2:55 PM 23888]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [9/1/2009 8:58 PM 102448]

— Other Services/Drivers In Memory —

*NewlyCreated* - COMHOST
.
Contents of the 'Scheduled Tasks' folder

2009-09-18 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 17:34]

2009-11-24 c:\windows\Tasks\Norton Internet Security - Run Full System Scan - Mark.job
- c:\program files\Norton Internet Security\Norton AntiVirus\Navw32.exe [2007-08-27 01:19]

2009-11-27 c:\windows\Tasks\ParetoLogic Privacy Controls_{736BF93C-FEE4-11DD-BCE6-00123F94A147}.job
- c:\program files\ParetoLogic\Privacy Controls\Pareto_PC.exe [2008-11-25 17:29]

2009-11-29 c:\windows\Tasks\ParetoLogic Registration.job
- c:\program files\Common Files\ParetoLogic\UUS2\UUS.dll [2008-02-22 18:25]

2009-11-29 c:\windows\Tasks\ParetoLogic Update Version2.job
- c:\program files\Common Files\ParetoLogic\UUS2\Pareto_Update.exe [2008-02-22 18:25]

2009-11-29 c:\windows\Tasks\User_Feed_Synchronization-{FAEDD853-077D-4077-B36D-22E9E1DC69C5}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 09:31]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://flory.net/cof/index.php
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search/?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
Trusted Zone: turbotax.com
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-29 14:15
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'explorer.exe'(3132)
c:\windows\system32\WININET.dll
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\mshtml.dll
c:\windows\system32\msls31.dll
c:\windows\IME\SPGRMR.DLL
c:\program files\Common Files\Microsoft Shared\INK\SKCHUI.DLL
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\program files\Common Files\Symantec Shared\NPC\2.0\NPCEXT.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll
.
Completion time: 2009-11-29 14:19
ComboFix-quarantined-files.txt 2009-11-29 20:19
ComboFix2.txt 2009-11-29 19:15

Pre-Run: 88,911,888,384 bytes free
Post-Run: 88,900,878,336 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

- - End Of File - - 6246886F57C46BE5E3BADCCF49248906