What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Suspicious.vundo.2/Rootkit Help!?

22 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
I have been having trouble with Suspicious.vundo.2. at first it was a bunch of fke anti virus pop ups now i try to remove it and it didnt work i search on the other topics and dowloaded the recommended malware remover but for some reason my computer wont open them

OK im using Symantec AntiVirus version : 9.05.1000

Ok i found out i had suspicious.vundo.2 yesterday and i went to www.symantec.com and

it told me to

1. Disable System Restore (Windows Me/XP).
2. Update the virus definitions.
3. Run a full system scan

and i did all of that and Symantec didnt find anything then i retryed it in safe mode and still nothing at first there was a bunch fake antvirus pop ups on my computer then it stoppedso i seach forums for a answer and i read in this other tread about a person with the similar promblem and i read that to downloaded - www.malwarebytes.org but that didnt work window said it wasnt a winodws program then i tried this other one this http://www.gmer.net/ that didnt work and it saod it was not a valid win32 applicationand alos this internet expoler page keeps poping up with the same link everytime Link Removed: LDT

Help?
Post #2
Hi Lunaris, welcome to the forum.

To make cleaning this machine easier
  • Please do not uninstall/install any programs unless asked to
    It is more difficult when files/programs are appearing in/disappearing from the logs.
  • Please do not run any scans other than those requested
  • Please follow all instructions in the order posted
  • All logs/reports, etc.. must be posted in Notepad. Please ensure that word wrap is unchecked. In notepad click format, uncheck word wrap if it is checked.
  • Do not attach any logs/reports, etc.. unless specifically requested to do so.
  • If you have problems with or do not understand the instructions, Please ask before continuing.
  • Please stay with this thread until given the All Clear. A absence of symptoms does not mean a clean machine.

Disable System Restore (Windows Me/XP).

Don't know why they tell peopple to this. They certainly don't offer any support should something go wrong and a restore point is needed.

-Click Start, right-click My Computer, and then click Properties.
-In the System Properties dialog box, click the System Restore tab.
-Click to clear the Turn off System Restore check box. Or, click the Turn off System -Restore on all drives check box.
-Click OK.

Wait for a restore point to be created. The System Properties dialog box will close when it's finished.



Let's see if we can get a log of some kind.

Download OTL to your desktop.
  • Double click on OTL.exe to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • When the window appears, underneath Output at the top change it to Minimal Output
  • Check the boxes beside LOP Check and Purity Check.
  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.

Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them all in.

Thanks
Post #3
So you want me to turn on system restore? And also i tried to download the OTL file but when i went to the page it said that Firefox can't find the server at oldtimer.geekstogo.com.
Post #4
Hi Lunaris,

So you want me to turn on system restore?

Yes. An infected restore point is better than no restore point, we would at least have something to fall back on if the need arises. It will not reinfect your compter unless you restore to that point. As part of the cleaning process these old restore points will be removed once the computer is clean.

OTL

Use this LINK instead.

Thanks
Post #5
This is the OTL report



OTL logfile created on: 1/19/2010 10:04:49 PM - Run 1
OTL by OldTimer - Version 3.1.25.2 Folder = C:\Documents and Settings\Administrator\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

735.00 Mb Total Physical Memory | 408.00 Mb Available Physical Memory | 56.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 81.00% Paging File free
Paging file location(s): C:\pagefile.sys 720 1440 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 37.26 Gb Total Space | 13.99 Gb Free Space | 37.55% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: DANIEL-PC
Current User Name: Administrator
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Administrator\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Documents and Settings\Administrator\Local Settings\Application Data\wferrt\iyaksysguard.exe ()
PRC - C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\ErrorSmart\ErrorSmart.exe (AntiSpyware LLC)
PRC - C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Symantec AntiVirus\VPTray.exe (Symantec Corporation)
PRC - C:\Program Files\Symantec AntiVirus\DefWatch.exe (Symantec Corporation)
PRC - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe (Symantec Corporation)
PRC - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe (Symantec Corporation)
PRC - C:\Program Files\Common Files\Symantec Shared\ccApp.exe (Symantec Corporation)
PRC - C:\WINDOWS\system32\CTSVCCDA.EXE (Creative Technology Ltd)


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Administrator\Desktop\OTL.exe (OldTimer Tools)


========== Win32 Services (SafeList) ==========

SRV - (iPod Service) – C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)
SRV - (Apple Mobile Device) – C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (JavaQuickStarterService) – C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)
SRV - (Bonjour Service) – C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.)
SRV - (SavRoam) – C:\Program Files\Symantec AntiVirus\SavRoam.exe (symantec)
SRV - (Symantec AntiVirus) – C:\Program Files\Symantec AntiVirus\Rtvscan.exe (Symantec Corporation)
SRV - (DefWatch) – C:\Program Files\Symantec AntiVirus\DefWatch.exe (Symantec Corporation)
SRV - (SNDSrvc) – C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe (Symantec Corporation)
SRV - (ccSetMgr) – C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe (Symantec Corporation)
SRV - (ccPwdSvc) – C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe (Symantec Corporation)
SRV - (ccEvtMgr) – C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe (Symantec Corporation)
SRV - (ose) – C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (Creative Service for CDROM Access) – C:\WINDOWS\system32\CTSVCCDA.EXE (Creative Technology Ltd)


========== Driver Services (SafeList) ==========

DRV - (NAVEX15) – C:\Program Files\Common Files\Symantec Shared\VirusDefs\20100115.050\NAVEX15.SYS (Symantec Corporation)
DRV - (NAVENG) – C:\Program Files\Common Files\Symantec Shared\VirusDefs\20100115.050\NAVENG.SYS (Symantec Corporation)
DRV - (sptd) – C:\WINDOWS\System32\Drivers\sptd.sys ()
DRV - (USBAAPL) – C:\WINDOWS\system32\drivers\usbaapl.sys (Apple, Inc.)
DRV - (GEARAspiWDM) – C:\WINDOWS\system32\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV - (Secdrv) – C:\WINDOWS\system32\drivers\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
DRV - (SYMTDI) – C:\WINDOWS\System32\Drivers\SYMTDI.SYS (Symantec Corporation)
DRV - (SYMREDRV) – C:\WINDOWS\System32\Drivers\SYMREDRV.SYS (Symantec Corporation)
DRV - (SymEvent) – C:\Program Files\Symantec\SYMEVENT.SYS (Symantec Corporation)
DRV - (SAVRTPEL) – C:\Program Files\Symantec AntiVirus\Savrtpel.sys (Symantec Corporation)
DRV - (SAVRT) – C:\Program Files\Symantec AntiVirus\savrt.sys (Symantec Corporation)
DRV - (FETND5BV) – C:\WINDOWS\system32\drivers\fetnd5bv.sys (VIA Technologies, Inc. )
DRV - (S3SavageNB) – C:\WINDOWS\system32\drivers\s3gnbm.sys (S3 Graphics, Inc.)
DRV - (Ptilink) – C:\WINDOWS\system32\drivers\ptilink.sys (Parallel Technologies, Inc.)
DRV - (sfman) Creative SoundFont Manager Driver (WDM) – C:\WINDOWS\system32\drivers\sfmanm.sys (Creative Technology Ltd.)
DRV - (emu10k1) Creative Interface Manager Driver (WDM) – C:\WINDOWS\system32\drivers\ctlfacem.sys (Creative Technology Ltd.)
DRV - (emu10k) Creative SB Live! (WDM) – C:\WINDOWS\system32\drivers\emu10k1m.sys (Creative Technology Ltd.)
DRV - (FETNDIS) – C:\WINDOWS\system32\drivers\fetnd5.sys (VIA Technologies, Inc. )


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.live.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.msn.com/sphome.aspx
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.defaulturl: "http://search.yahoo.com/search?ei=UTF-8&fr;=ytff-sunm&p;="
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.param.yahoo-fr: "moz2-ytff-sunm"
FF - prefs.js..browser.search.param.yahoo-fr-cjkt: "moz2-ytff-sunm"
FF - prefs.js..browser.search.selectedEngine: "Ask.com"
FF - prefs.js..browser.search.update: false
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.google.com/"
FF - prefs.js..extensions.enabledItems: {B042753D-F57E-4e8e-A01B-7379A6D4CEFB}:1.10
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: [removed]:1.5.1
FF - prefs.js..keyword.URL: "http://supertoolbar.ask.com/redirect?client=ff&src;=kw&tb;=DVSV5&o;=15016&locale;=en_US&q;="


FF - HKLM\software\mozilla\Mozilla Firefox 3.5.7\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/01/16 16:15:02 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.7\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/01/15 12:36:06 | 00,000,000 | —D | M]

[2009/03/04 20:09:06 | 00,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Mozilla\Extensions
[2010/01/19 11:47:15 | 00,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\7yjf1fkk.default\extensions
[2009/11/27 16:03:12 | 00,000,000 | —D | M] (BitComet Video Downloader) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\7yjf1fkk.default\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}
[2010/01/18 08:13:26 | 00,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\7yjf1fkk.default\extensions\[removed]
[2009/11/15 00:49:41 | 00,002,059 | —- | M] () – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\7yjf1fkk.default\searchplugins\daemon-search.xml
[2009/07/22 10:12:25 | 00,009,941 | —- | M] () – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\7yjf1fkk.default\searchplugins\mywebsearch.xml
[2010/01/18 09:58:09 | 00,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2009/07/17 03:40:12 | 00,704,512 | —- | M] (BitComet) – C:\Program Files\Mozilla Firefox\plugins\npBitCometAgent.dll
[2009/02/02 21:15:28 | 03,771,296 | —- | M] () – C:\Program Files\Mozilla Firefox\plugins\NPSWF32.dll
[2009/06/04 07:16:30 | 00,372,736 | —- | M] (Adobe Systems, Inc.) – C:\Program Files\Mozilla Firefox\plugins\Plugin.dll

O1 HOSTS File: ([2002/08/29 07:00:00 | 00,000,734 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (BitComet Helper) - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.3.7.16.dll (BitComet)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O3 - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll ()
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O4 - HKLM..\Run: [bcuoygkb] C:\Documents and Settings\Administrator\Local Settings\Application Data\wferrt\iyaksysguard.exe ()
O4 - HKLM..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe (Symantec Corporation)
O4 - HKLM..\Run: [ErrorSmart] C:\Program Files\ErrorSmart\ErrorSmart.exe (AntiSpyware LLC)
O4 - HKLM..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe (HP)
O4 - HKLM..\Run: [HPHmon03] C:\WINDOWS\System32\hphmon03.exe File not found
O4 - HKLM..\Run: [vptray] C:\Program Files\Symantec AntiVirus\VPTray.exe (Symantec Corporation)
O4 - HKCU..\Run: [bcuoygkb] C:\Documents and Settings\Administrator\Local Settings\Application Data\wferrt\iyaksysguard.exe ()
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: &D;&ownload; &with; BitComet - C:\Program Files\BitComet\BitComet.exe (www.BitComet.com)
O8 - Extra context menu item: &D;&ownload; all video with BitComet - C:\Program Files\BitComet\BitComet.exe (www.BitComet.com)
O8 - Extra context menu item: &D;&ownload; all with BitComet - C:\Program Files\BitComet\BitComet.exe (www.BitComet.com)
O9 - Extra Button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - C:\Program Files\BitComet\tools\BitCometBHO_1.3.7.16.dll (BitComet)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab (HP Download Manager)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_15)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = ITC2-DOMAIN.COM
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\NavLogon: DllName - C:\WINDOWS\system32\NavLogon.dll - C:\WINDOWS\system32\NavLogon.dll (Symantec Corporation)
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/12/15 16:45:06 | 00,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O33 - MountPoints2\F\Shell - "" = AutoRun
O33 - MountPoints2\F\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\RunGame.exe – File not found
O33 - MountPoints2\G\Shell - "" = AutoRun
O33 - MountPoints2\G\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\RunGame.exe – File not found
O33 - MountPoints2\I\Shell - "" = AutoRun
O33 - MountPoints2\I\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\I\Shell\AutoRun\command - "" = I:\RunGame.exe – File not found
O33 - MountPoints2\J\Shell - "" = AutoRun
O33 - MountPoints2\J\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\J\Shell\AutoRun\command - "" = J:\RunGame.exe – File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - comfile [open] – "%1" %*
O35 - exefile [open] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/01/19 22:03:37 | 00,547,328 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Administrator\Desktop\OTL.exe
[2010/01/19 12:16:13 | 00,000,000 | —D | C] – C:\Documents and Settings\Administrator\Local Settings\Application Data\wferrt
[2010/01/17 19:54:17 | 00,000,000 | —D | C] – C:\WINDOWS\pss
[2009/12/28 23:06:06 | 00,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Apple
[2009/05/29 15:21:04 | 00,000,000 | —D | M] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[2008/12/15 16:49:03 | 00,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
[2008/12/15 16:44:57 | 00,000,000 | –SD | M] – C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2008/12/15 16:44:57 | 00,000,000 | –SD | M] – C:\Documents and Settings\LocalService\Application Data\Microsoft
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/01/19 22:03:38 | 00,547,328 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Administrator\Desktop\OTL.exe
[2010/01/19 22:01:03 | 00,000,250 | —- | M] () – C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2010/01/19 21:58:39 | 00,002,206 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/01/19 21:58:12 | 00,000,418 | —- | M] () – C:\WINDOWS\tasks\ErrorSmart Scheduled Scan.job
[2010/01/19 21:57:54 | 00,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/01/19 21:57:52 | 00,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/01/19 21:57:49 | 77,128,4992 | -HS- | M] () – C:\hiberfil.sys
[2010/01/19 12:19:22 | 04,980,736 | -H– | M] () – C:\Documents and Settings\Administrator\NTUSER.DAT
[2010/01/19 12:19:22 | 00,000,278 | -HS- | M] () – C:\Documents and Settings\Administrator\ntuser.ini
[2010/01/19 12:19:21 | 01,568,656 | -H– | M] () – C:\Documents and Settings\Administrator\Local Settings\Application Data\IconCache.db
[2010/01/19 12:19:19 | 00,000,603 | —- | M] () – C:\WINDOWS\win.ini
[2010/01/19 12:19:19 | 00,000,227 | —- | M] () – C:\WINDOWS\system.ini
[2010/01/19 12:19:19 | 00,000,211 | -HS- | M] () – C:\boot.ini
[2010/01/19 12:15:48 | 00,000,664 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/01/19 12:15:48 | 00,000,552 | —- | M] () – C:\WINDOWS\System32\d3d8caps.dat
[2010/01/19 11:58:43 | 00,001,908 | —- | M] () – C:\WINDOWS\diagwrn.xml
[2010/01/19 11:58:43 | 00,001,908 | —- | M] () – C:\WINDOWS\diagerr.xml
[2010/01/18 18:17:02 | 00,002,187 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Norton Security Scan.lnk
[2010/01/18 07:43:33 | 00,000,611 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Shortcut to sims 2+power iso 3.1.lnk
[2010/01/17 19:20:12 | 00,000,008 | —- | M] () – C:\Documents and Settings\All Users\Application Data\sysReserve.ini
[2010/01/17 19:09:58 | 00,000,000 | -H– | M] () – C:\Documents and Settings\Administrator\My Documents\Default.rdp
[2010/01/17 18:00:03 | 00,000,424 | —- | M] () – C:\WINDOWS\tasks\Norton Security Scan for Administrator.job
[2010/01/13 19:37:09 | 00,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2010/01/11 23:25:58 | 00,019,968 | —- | M] () – C:\Documents and Settings\Administrator\My Documents\The cold musty air gracefully spiraed around.doc
[2010/01/11 23:06:05 | 00,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/01/09 22:19:07 | 00,024,064 | —- | M] () – C:\Documents and Settings\Administrator\My Documents\Doc2.doc
[2010/01/09 11:08:15 | 00,006,144 | —- | M] () – C:\Documents and Settings\Administrator\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/01/05 22:59:15 | 00,020,480 | —- | M] () – C:\Documents and Settings\Administrator\My Documents\The green canopy was engraved in gold in the fiery morning sun.doc
[2010/01/05 14:43:15 | 03,426,304 | —- | M] () – C:\Documents and Settings\Administrator\My Documents\Imani.doc
[2010/01/01 12:28:54 | 00,020,992 | —- | M] () – C:\Documents and Settings\Administrator\My Documents\Ultimate TekTek Contest.doc
[2009/12/29 14:08:35 | 00,019,968 | —- | M] () – C:\Documents and Settings\Administrator\My Documents\X7zabclopjksilverluna5199pqltpzk123462011131419100.doc
[2009/12/25 11:18:02 | 00,512,960 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2009/12/25 11:18:02 | 00,435,260 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2009/12/25 11:18:02 | 00,068,156 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2009/12/21 23:25:50 | 00,028,672 | —- | M] () – C:\Documents and Settings\Administrator\My Documents\The Life of a Pressured Teen.doc
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/01/19 12:20:10 | 77,128,4992 | -HS- | C] () – C:\hiberfil.sys
[2010/01/19 12:15:48 | 00,000,552 | —- | C] () – C:\WINDOWS\System32\d3d8caps.dat
[2010/01/19 12:15:35 | 00,000,664 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/01/17 19:20:12 | 00,000,008 | —- | C] () – C:\Documents and Settings\All Users\Application Data\sysReserve.ini
[2010/01/17 19:09:58 | 00,000,000 | -H– | C] () – C:\Documents and Settings\Administrator\My Documents\Default.rdp
[2010/01/09 22:19:06 | 00,024,064 | —- | C] () – C:\Documents and Settings\Administrator\My Documents\Doc2.doc
[2010/01/01 12:28:53 | 00,020,992 | —- | C] () – C:\Documents and Settings\Administrator\My Documents\Ultimate TekTek Contest.doc
[2009/12/21 21:35:46 | 00,028,672 | —- | C] () – C:\Documents and Settings\Administrator\My Documents\The Life of a Pressured Teen.doc
[2009/11/15 00:49:31 | 00,691,696 | —- | C] () – C:\WINDOWS\System32\drivers\sptd.sys
[2009/08/19 20:12:21 | 00,006,144 | —- | C] () – C:\Documents and Settings\Administrator\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/08/05 11:26:29 | 00,027,648 | —- | C] () – C:\WINDOWS\System32\AVSredirect.dll
[2009/04/15 14:42:21 | 00,000,035 | —- | C] () – C:\WINDOWS\GetGoDM.INI
[2009/03/07 16:16:43 | 00,000,000 | —- | C] () – C:\WINDOWS\VPC32.INI
[2009/01/02 21:31:26 | 00,000,034 | —- | C] () – C:\WINDOWS\hpfsched.ini
[2008/12/15 18:09:53 | 00,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2008/12/15 17:01:06 | 00,002,573 | —- | C] () – C:\WINDOWS\WAVEMIX.INI
[2008/12/15 17:01:06 | 00,000,247 | —- | C] () – C:\WINDOWS\QNETP7.INI
[2004/09/17 17:37:42 | 00,061,440 | —- | C] () – C:\WINDOWS\System32\vuins32.dll
[2003/01/07 15:05:08 | 00,002,695 | —- | C] () – C:\WINDOWS\System32\OUTLPERF.INI

========== LOP Check ==========

[2009/08/03 22:59:47 | 00,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\4Media Software Studio
[2009/07/15 15:54:15 | 00,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Canon
[2009/11/15 00:54:35 | 00,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\DAEMON Tools Lite
[2009/09/18 16:02:13 | 00,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\ErrorSmart
[2009/04/15 14:28:03 | 00,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\GetGo Software
[2009/06/06 14:09:00 | 00,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Leadertech
[2009/11/28 22:05:52 | 00,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Rock Your Phone
[2009/11/15 00:49:19 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\DAEMON Tools Lite
[2009/07/25 12:23:04 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\MSScanAppDataDir
[2008/12/27 18:30:06 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PC Drivers HeadQuarters
[2008/12/15 16:59:46 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\WinZip
[2009/11/27 13:35:50 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2010/01/19 21:58:12 | 00,000,418 | —- | M] () – C:\WINDOWS\Tasks\ErrorSmart Scheduled Scan.job
[2010/01/19 22:01:03 | 00,000,250 | —- | M] () – C:\WINDOWS\Tasks\Scheduled Update for Ask Toolbar.job

========== Purity Check ==========


< End of report >
Post #6
This is the extra report

OTL Extras logfile created on: 1/19/2010 10:04:49 PM - Run 1
OTL by OldTimer - Version 3.1.25.2 Folder = C:\Documents and Settings\Administrator\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

735.00 Mb Total Physical Memory | 408.00 Mb Available Physical Memory | 56.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 81.00% Paging File free
Paging file location(s): C:\pagefile.sys 720 1440 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 37.26 Gb Total Space | 13.99 Gb Free Space | 37.55% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: DANIEL-PC
Current User Name: Administrator
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.html [@ = htmlfile] – C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = htmlfile] – Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
htmlfile – "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [open] – "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)
htmlfile [opennew] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] – "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" /p %1 (Microsoft Corporation)
http [open] – "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome (Microsoft Corporation)
https [open] – "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] – "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] – "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"26859:TCP" = 26859:TCP:*:Enabled:BitComet 26859 TCP
"26859:UDP" = 26859:UDP:*:Enabled:BitComet 26859 UDP

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\gtatclient.exe" = C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\gtatclient.exe:*:Enabled:gtatclient – File not found
"C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\gtaT\Server\gtatserver.exe" = C:\Program Files\Rockstar Games\Grand Theft Auto Vice City\gtaT\Server\gtatserver.exe:*:Enabled:gtatserver – File not found
"C:\Program Files\BitTorrent\bittorrent.exe" = C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent – File not found
"C:\Program Files\BitLord\BitLord.exe" = C:\Program Files\BitLord\BitLord.exe:*:Enabled:BitLord – File not found
"C:\Program Files\Bonjour\mDNSResponder.exe" = C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour – (Apple Inc.)
"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes – (Apple Inc.)
"C:\Program Files\BitComet\BitComet.exe" = C:\Program Files\BitComet\BitComet.exe:*:Enabled:BitComet.exe – (www.BitComet.com)
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" = C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Disabled:Yahoo! Messenger – File not found


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
"{1451DE6B-ABE1-4F62-BE9A-B363A17588A2}" = QuickTime
"{2469F39C-54EC-4DDE-AA02-FF9633F20190}" = Ad-Aware SE Plus
"{26A24AE4-039D-4CA4-87B4-2F83216012FF}" = Java™ 6 Update 15
"{2CFECCAA-8CB0-459B-9636-40430DBC8951}" = Symantec AntiVirus
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3FA365DF-2D68-45ED-8F83-8C8A33E65143}" = Apple Application Support
"{3FADAA19-E595-44CA-A072-58B6B0851768}" = Norton Security Scan
"{5520BD9C-4798-4094-A1D9-3E8573D42B55}" = ErrorSmart
"{621C02EA-AAFF-4026-A903-165D59529A16}" = Driver Detective
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{9CC99440-C974-427E-A218-9E79752BC7DB}_is1" = Rock Your Phone 1.63.18
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A6FDF86A-F541-4E7B-AEA0-8849A2A700D5}" = iTunes
"{AADEA55D-C834-4BCB-98A3-4B8D1C18F4EE}" = Apple Mobile Device Support
"{AC76BA86-7AD7-1033-7B44-A91000000001}" = Adobe Reader 9.1
"{BEEFC4F8-2909-48B3-AFAA-55D3533FDEDD}" = Creative MediaSource 5
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"AVS4YOU Software Navigator_is1" = AVS4YOU Software Navigator 1.3
"BitComet" = BitComet 1.16
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"Creative Software AutoUpdate" = Creative Software AutoUpdate
"DAEMON Tools Toolbar" = DAEMON Tools Toolbar
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.2
"Free Video to iPhone Converter_is1" = Free Video to iPhone Converter version 2.2
"Free YouTube to iPhone Converter_is1" = Free YouTube to iPhone Converter version 2.2
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.2
"HexDump plug-in for Ad-Aware SE" = HexDump plug-in for Ad-Aware SE
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"InstallShield_{621C02EA-AAFF-4026-A903-165D59529A16}" = Driver Detective
"LiveUpdate" = LiveUpdate 2.0 (Symantec Corporation)
"LSP Explorer plug-in for Ad-Aware SE" = LSP Explorer plug-in for Ad-Aware SE
"Malware Defense" = Malware Defense
"Messenger-Control plug-in for Ad-Aware SE" = Messenger-Control plug-in for Ad-Aware SE
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.5.7)" = Mozilla Firefox (3.5.7)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"NSSSetup.{3FADAA19-E595-44CA-A072-58B6B0851768}" = Norton Security Scan (Symantec Corporation)
"OE/W Messengerctrl plug-in for Ad-Aware SE" = OE/W Messengerctrl plug-in for Ad-Aware SE
"SUPER ©" = SUPER © Version 2009.bld.36 (June 10, 2009)
"Uninstall_is1" = Uninstall 1.0.0.1
"VN_VUIns_Rhine_VIA" = VIA Rhine-Family Fast Ethernet Adapter
"VX2 Cleaner plug-in for Ad-Aware SE" = VX2 Cleaner plug-in for Ad-Aware SE
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinZip" = WinZip
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 1/18/2010 8:42:04 PM | Computer Name = DANIEL-PC | Source = Userenv | ID = 1054
Description = Windows cannot obtain the domain controller name for your computer
network. (The specified domain either does not exist or could not be contacted.
). Group Policy processing aborted.

Error - 1/18/2010 8:42:05 PM | Computer Name = DANIEL-PC | Source = AutoEnrollment | ID = 15
Description = Automatic certificate enrollment for local system failed to contact
the active directory (0x8007054b). The specified domain either does not exist
or could not be contacted. Enrollment will not be performed.

Error - 1/19/2010 12:35:41 PM | Computer Name = DANIEL-PC | Source = Userenv | ID = 1054
Description = Windows cannot obtain the domain controller name for your computer
network. (The specified domain either does not exist or could not be contacted.
). Group Policy processing aborted.

Error - 1/19/2010 12:35:42 PM | Computer Name = DANIEL-PC | Source = AutoEnrollment | ID = 15
Description = Automatic certificate enrollment for local system failed to contact
the active directory (0x8007054b). The specified domain either does not exist
or could not be contacted. Enrollment will not be performed.

Error - 1/19/2010 1:11:39 PM | Computer Name = DANIEL-PC | Source = Userenv | ID = 1054
Description = Windows cannot obtain the domain controller name for your computer
network. (The specified domain either does not exist or could not be contacted.
). Group Policy processing aborted.

Error - 1/19/2010 1:15:52 PM | Computer Name = DANIEL-PC | Source = Application Error | ID = 1000
Description = Faulting application firefox.exe, version 1.9.1.3642, faulting module
3difr.x3d, version 9.1.0.0, fault address 0x0001d601.

Error - 1/19/2010 1:20:26 PM | Computer Name = DANIEL-PC | Source = Userenv | ID = 1054
Description = Windows cannot obtain the domain controller name for your computer
network. (The specified domain either does not exist or could not be contacted.
). Group Policy processing aborted.

Error - 1/19/2010 1:20:27 PM | Computer Name = DANIEL-PC | Source = AutoEnrollment | ID = 15
Description = Automatic certificate enrollment for local system failed to contact
the active directory (0x8007054b). The specified domain either does not exist
or could not be contacted. Enrollment will not be performed.

Error - 1/19/2010 10:58:05 PM | Computer Name = DANIEL-PC | Source = Userenv | ID = 1054
Description = Windows cannot obtain the domain controller name for your computer
network. (The specified domain either does not exist or could not be contacted.
). Group Policy processing aborted.

Error - 1/19/2010 10:58:11 PM | Computer Name = DANIEL-PC | Source = AutoEnrollment | ID = 15
Description = Automatic certificate enrollment for local system failed to contact
the active directory (0x8007054b). The specified domain either does not exist
or could not be contacted. Enrollment will not be performed.

[ System Events ]
Error - 1/19/2010 12:35:41 PM | Computer Name = DANIEL-PC | Source = NETLOGON | ID = 5719
Description = No Domain Controller is available for domain ITC2-DOMAIN due to the
following: %%1311. Make sure that the computer is connected to the network and try
again.
If the problem persists, please contact your domain administrator.

Error - 1/19/2010 12:37:11 PM | Computer Name = DANIEL-PC | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the Symantec AntiVirus service
to connect.

Error - 1/19/2010 1:11:40 PM | Computer Name = DANIEL-PC | Source = NETLOGON | ID = 5719
Description = No Domain Controller is available for domain ITC2-DOMAIN due to the
following: %%1311. Make sure that the computer is connected to the network and try
again.
If the problem persists, please contact your domain administrator.

Error - 1/19/2010 1:11:41 PM | Computer Name = DANIEL-PC | Source = sptd | ID = 262148
Description = Driver detected an internal error in its data structures for .

Error - 1/19/2010 1:13:07 PM | Computer Name = DANIEL-PC | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service EventSystem
with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 1/19/2010 1:13:09 PM | Computer Name = DANIEL-PC | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
AmdK7 Fips SAVRT sptd SYMTDI

Error - 1/19/2010 1:19:21 PM | Computer Name = DANIEL-PC | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service EventSystem
with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 1/19/2010 1:20:26 PM | Computer Name = DANIEL-PC | Source = NETLOGON | ID = 5719
Description = No Domain Controller is available for domain ITC2-DOMAIN due to the
following: %%1311. Make sure that the computer is connected to the network and try
again.
If the problem persists, please contact your domain administrator.

Error - 1/19/2010 10:58:05 PM | Computer Name = DANIEL-PC | Source = NETLOGON | ID = 5719
Description = No Domain Controller is available for domain ITC2-DOMAIN due to the
following: %%1311. Make sure that the computer is connected to the network and try
again.
If the problem persists, please contact your domain administrator.

Error - 1/19/2010 10:59:21 PM | Computer Name = DANIEL-PC | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the Symantec AntiVirus service
to connect.


< End of report >
Post #7
Hi Lunaris,

Let's clean some of this up and see if we can get some other tools to work.

Next, Double click on OTL.exe
  • Under the Custom Scans/Fixes box at the bottom, paste in the following
  • Do Not copy the word CODE
  • please note the fix starts with the :
:Services

:OTL
PRC - C:\Documents and Settings\Administrator\Local Settings\Application Data\wferrt\iyaksysguard.exe ()
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O4 - HKCU..\Run: [bcuoygkb] C:\Documents and Settings\Administrator\Local Settings\Application Data\wferrt\iyaksysguard.exe ()
O4 - HKLM..\Run: [bcuoygkb] C:\Documents and Settings\Administrator\Local Settings\Application Data\wferrt\iyaksysguard.exe ()
[2010/01/19 12:16:13 | 00,000,000 | —D | C] – C:\Documents and Settings\Administrator\Local Settings\Application Data\wferrt
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

:Commands
[createrestorepoint]
[emptytemp]
[Reboot]

Then click the Run Fix button at the top
  • Let the program run unhindered
  • Please save the resulting log to be posted in your next reply.

You have a program whose drivers may interfere with some of our tools. We will temporarily disable them. They will be re-enabled when we are finsished cleaning your computer.

Please download DeFogger to your desktop.

Double click DeFogger to run the tool.
  • The application window will appear
  • Click the Disable button to disable your CD Emulation drivers
  • Click Yes to continue
  • A 'Finished!' message will appear
  • Click OK
  • DeFogger will now ask to reboot the machine - click OK
IMPORTANT! If you receive an error message while running DeFogger, please post the log defogger_disable which will appear on your desktop.

Do not re-enable these drivers until otherwise instructed.


Next

Try to run GMER again. If you don't have the randomly named exe, rename the one you have to ermg.exe.

Please post back with
  • OTL fix log
  • GMER log, if it ran
  • new OTL scan log taken after all other steps…, there will only be a OTL.txt this time
Post #10
ok im going to do the scan right now but there is this window called SWP2009demo? andi cant open it ? and about the other drives i can just disable them and then uninstall the program that makes them ?
Post #11 last edited

andi cant open it

Do you mean you can't open OTL?

about the other drives i can just disable them and then uninstall the program that makes them

No need to uninstall the program. Defogger should disable the drivers and leave them disabled untill we are finished.


SWP2009demo is the rogue.

Just run the tools in the order that I posted. The drivers we are going to disable will not interfere with OTL.
Post #12
All processes killed ========== SERVICES/DRIVERS ========== ========== OTL ========== Process iyaksysguard.exe killed successfully! Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ not found. Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\ not found. Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\ not found. Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\bcuoygkb deleted successfully. C:\Documents and Settings\Administrator\Local Settings\Application Data\wferrt\iyaksysguard.exe moved successfully. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\bcuoygkb deleted successfully. File C:\Documents and Settings\Administrator\Local Settings\Application Data\wferrt\iyaksysguard.exe not found. C:\Documents and Settings\Administrator\Local Settings\Application Data\wferrt folder moved successfully. C:\WINDOWS\002896_.tmp deleted successfully. C:\WINDOWS\SET3.tmp deleted successfully. C:\WINDOWS\SET4.tmp deleted successfully. C:\WINDOWS\SET8.tmp deleted successfully. C:\WINDOWS\System32\CONFIG.TMP deleted successfully. C:\WINDOWS\System32\SET14F.tmp deleted successfully. C:\WINDOWS\System32\SET154.tmp deleted successfully. ========== COMMANDS ========== Error starting restore point: 31 Error closing restore point: The sequence number is invalid. [EMPTYTEMP] User: Administrator ->Temp folder emptied: 510701216 bytes ->Temporary Internet Files folder emptied: 3924046 bytes ->Java cache emptied: 39699502 bytes ->FireFox cache emptied: 32299657 bytes User: All Users User: danielw ->Temp folder emptied: 19967076 bytes ->Temporary Internet Files folder emptied: 28962773 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: LocalService ->Temp folder emptied: 66016 bytes ->Temporary Internet Files folder emptied: 112094 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 509830 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 20340145 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 13498646 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes RecycleBin emptied: 50621 bytes Total Files Cleaned = 639.00 mb OTL by OldTimer - Version 3.1.25.2 log created on 01202010_134701 Files\Folders moved on Reboot… Registry entries deleted on Reboot…
Post #14
Gmer log


GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-01-20 16:00:41
Windows 5.1.2600 Service Pack 3
Running: fb9fgijy.exe; Driver: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\uwlirpod.sys


—- System - GMER 1.0.15 —-

Code 836BB900 ZwEnumerateKey
Code 836C8488 ZwFlushInstructionCache
Code 8352600E IofCallDriver
Code 8352747E IofCompleteRequest

—- Kernel code sections - GMER 1.0.15 —-

.text ntoskrnl.exe!IofCallDriver 804E37C5 5 Bytes JMP 83526013
.text ntoskrnl.exe!IofCompleteRequest 804E3BF6 5 Bytes JMP 83527483
PAGE ntoskrnl.exe!ZwFlushInstructionCache 8056E42A 5 Bytes JMP 836C848C
PAGE ntoskrnl.exe!ZwEnumerateKey 805735A4 5 Bytes JMP 836BB904

—- User code sections - GMER 1.0.15 —-

.text C:\WINDOWS\system32\ctfmon.exe[208] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00B7000A
.text C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[212] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 009C000A
.text C:\Program Files\Bonjour\mDNSResponder.exe[240] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00A0000A
.text C:\WINDOWS\system32\CTsvcCDA.exe[300] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 0098000A
.text C:\Program Files\Symantec AntiVirus\DefWatch.exe[324] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 00C1000A
.text …

—- Devices - GMER 1.0.15 —-

AttachedDevice \FileSystem\Ntfs \Ntfs SYMEVENT.SYS (Symantec Event Library/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\Ip SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\Tcp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\Udp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\RawIp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \FileSystem\Fastfat \Fat SYMEVENT.SYS (Symantec Event Library/Symantec Corporation)

Device \FileSystem\Cdfs \Cdfs EF00C400
—- Processes - GMER 1.0.15 —-

Library \\?\globalroot\systemroot\system32\H8SRTulkriqpeex.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [164] 0x00860000
Library \\?\globalroot\systemroot\system32\H8SRTulkriqpeex.dll (*** hidden *** ) @ C:\WINDOWS\system32\winlogon.exe [632] 0x10000000
Library \\?\globalroot\systemroot\system32\H8SRTulkriqpeex.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [968] 0x00860000
Library \\?\globalroot\systemroot\system32\H8SRTulkriqpeex.dll (*** hidden *** ) @ C:\WINDOWS\System32\svchost.exe [1068] 0x00860000
Library \\?\globalroot\systemroot\system32\H8SRTulkriqpeex.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [1116] 0x00860000
Library \\?\globalroot\systemroot\system32\H8SRTulkriqpeex.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [1284] 0x00860000
Library \\?\globalroot\systemroot\system32\H8SRTulkriqpeex.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [1592] 0x00860000
Library \\?\globalroot\systemroot\system32\H8SRTruppsxthxl.dll (*** hidden *** ) @ C:\WINDOWS\System32\alg.exe [2476] 0x10000000

—- Services - GMER 1.0.15 —-

Service C:\WINDOWS\system32\drivers\H8SRTaskwbavbrf.sys (*** hidden *** ) [SYSTEM] H8SRTd.sys <– ROOTKIT !!!

—- Registry - GMER 1.0.15 —-

Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys@start 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys@type 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys@imagepath \systemroot\system32\drivers\H8SRTaskwbavbrf.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys@group file system
Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys\modules
Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys\modules@H8SRTd \\?\globalroot\systemroot\system32\drivers\H8SRTaskwbavbrf.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys\modules@H8SRTc \\?\globalroot\systemroot\system32\H8SRTwbxxrxuxdk.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys\modules@H8SRTsrcr \\?\globalroot\systemroot\system32\H8SRTpkbeetnovm.dat
Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys\modules@h8srtserf \\?\globalroot\systemroot\system32\H8SRTruppsxthxl.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys\modules@h8srtmsg \\?\globalroot\systemroot\system32\H8SRTulkriqpeex.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys\modules@h8srtbbr \\?\globalroot\systemroot\system32\H8SRTrwpuykbdte.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0xD4 0xC3 0x97 0x02 …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xA7 0xA7 0xF1 0x20 …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x2A 0x55 0xC6 0x55 …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x80 0xFE 0xBD 0x53 …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1@hdf12 0x1D 0x16 0x69 0x0C …
Reg HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys@start 1
Reg HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys@type 1
Reg HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys@imagepath \systemroot\system32\drivers\H8SRTaskwbavbrf.sys
Reg HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys@group file system
Reg HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys\modules (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys\modules@H8SRTd \\?\globalroot\systemroot\system32\drivers\H8SRTaskwbavbrf.sys
Reg HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys\modules@H8SRTc \\?\globalroot\systemroot\system32\H8SRTwbxxrxuxdk.dll
Reg HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys\modules@H8SRTsrcr \\?\globalroot\systemroot\system32\H8SRTpkbeetnovm.dat
Reg HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys\modules@h8srtserf \\?\globalroot\systemroot\system32\H8SRTruppsxthxl.dll
Reg HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys\modules@h8srtmsg \\?\globalroot\systemroot\system32\H8SRTulkriqpeex.dll
Reg HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys\modules@h8srtbbr \\?\globalroot\systemroot\system32\H8SRTrwpuykbdte.dll
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0xD4 0xC3 0x97 0x02 …
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xA7 0xA7 0xF1 0x20 …
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 …
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x2A 0x55 0xC6 0x55 …
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x80 0xFE 0xBD 0x53 …
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1@hdf12 0x1D 0x16 0x69 0x0C …

—- Files - GMER 1.0.15 —-

File C:\Documents and Settings\Administrator\Local Settings\Temp\H8SRT8169.tmp 343040 bytes executable
File C:\Documents and Settings\Administrator\Local Settings\Temp\h8srtmainqt.dll 16459 bytes
File C:\WINDOWS\system32\drivers\H8SRTaskwbavbrf.sys 40448 bytes executable <– ROOTKIT !!!
File C:\WINDOWS\system32\h8srtkrl32mainweq.dll 765 bytes
File C:\WINDOWS\system32\H8SRTpkbeetnovm.dat 243 bytes
File C:\WINDOWS\system32\H8SRTruppsxthxl.dll 27136 bytes executable
File C:\WINDOWS\system32\H8SRTrwpuykbdte.dll 40960 bytes executable
File C:\WINDOWS\system32\h8srtshsyst.dll 2620 bytes
File C:\WINDOWS\system32\H8SRTulkriqpeex.dll 16896 bytes executable
File C:\WINDOWS\system32\H8SRTwbxxrxuxdk.dll 23552 bytes executable
File C:\WINDOWS\Temp\H8SRT4b0e.tmp 243 bytes
File C:\WINDOWS\Temp\H8SRTe21d.tmp 213 bytes

—- EOF - GMER 1.0.15 —-
Post #15
Otl scan

OTL logfile created on: 1/20/2010 4:04:34 PM - Run 3
OTL by OldTimer - Version 3.1.25.2 Folder = C:\Documents and Settings\Administrator\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

735.00 Mb Total Physical Memory | 303.00 Mb Available Physical Memory | 41.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 77.00% Paging File free
Paging file location(s): C:\pagefile.sys 720 1440 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 37.26 Gb Total Space | 14.65 Gb Free Space | 39.31% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
Drive E: | 979.73 Mb Total Space | 979.11 Mb Free Space | 99.94% Space Free | Partition Type: FAT
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: DANIEL-PC
Current User Name: Administrator
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Administrator\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\ErrorSmart\ErrorSmart.exe (AntiSpyware LLC)
PRC - C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Symantec AntiVirus\VPTray.exe (Symantec Corporation)
PRC - C:\Program Files\Symantec AntiVirus\DefWatch.exe (Symantec Corporation)
PRC - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe (Symantec Corporation)
PRC - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe (Symantec Corporation)
PRC - C:\Program Files\Common Files\Symantec Shared\ccApp.exe (Symantec Corporation)
PRC - C:\WINDOWS\system32\CTSVCCDA.EXE (Creative Technology Ltd)


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Administrator\Desktop\OTL.exe (OldTimer Tools)


========== Win32 Services (SafeList) ==========

SRV - (iPod Service) – C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)
SRV - (Apple Mobile Device) – C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (JavaQuickStarterService) – C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)
SRV - (Bonjour Service) – C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.)
SRV - (SavRoam) – C:\Program Files\Symantec AntiVirus\SavRoam.exe (symantec)
SRV - (Symantec AntiVirus) – C:\Program Files\Symantec AntiVirus\Rtvscan.exe (Symantec Corporation)
SRV - (DefWatch) – C:\Program Files\Symantec AntiVirus\DefWatch.exe (Symantec Corporation)
SRV - (SNDSrvc) – C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe (Symantec Corporation)
SRV - (ccSetMgr) – C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe (Symantec Corporation)
SRV - (ccPwdSvc) – C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe (Symantec Corporation)
SRV - (ccEvtMgr) – C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe (Symantec Corporation)
SRV - (ose) – C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (Creative Service for CDROM Access) – C:\WINDOWS\system32\CTSVCCDA.EXE (Creative Technology Ltd)


========== Driver Services (SafeList) ==========

DRV - (NAVEX15) – C:\Program Files\Common Files\Symantec Shared\VirusDefs\20100115.050\NAVEX15.SYS (Symantec Corporation)
DRV - (NAVENG) – C:\Program Files\Common Files\Symantec Shared\VirusDefs\20100115.050\NAVENG.SYS (Symantec Corporation)
DRV - (sptd) – C:\WINDOWS\System32\Drivers\sptd.sys (Duplex Secure Ltd.)
DRV - (USBAAPL) – C:\WINDOWS\system32\drivers\usbaapl.sys (Apple, Inc.)
DRV - (GEARAspiWDM) – C:\WINDOWS\system32\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV - (Secdrv) – C:\WINDOWS\system32\drivers\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
DRV - (SYMTDI) – C:\WINDOWS\System32\Drivers\SYMTDI.SYS (Symantec Corporation)
DRV - (SYMREDRV) – C:\WINDOWS\System32\Drivers\SYMREDRV.SYS (Symantec Corporation)
DRV - (SymEvent) – C:\Program Files\Symantec\SYMEVENT.SYS (Symantec Corporation)
DRV - (SAVRTPEL) – C:\Program Files\Symantec AntiVirus\Savrtpel.sys (Symantec Corporation)
DRV - (SAVRT) – C:\Program Files\Symantec AntiVirus\savrt.sys (Symantec Corporation)
DRV - (FETND5BV) – C:\WINDOWS\system32\drivers\fetnd5bv.sys (VIA Technologies, Inc. )
DRV - (S3SavageNB) – C:\WINDOWS\system32\drivers\s3gnbm.sys (S3 Graphics, Inc.)
DRV - (Ptilink) – C:\WINDOWS\system32\drivers\ptilink.sys (Parallel Technologies, Inc.)
DRV - (sfman) Creative SoundFont Manager Driver (WDM) – C:\WINDOWS\system32\drivers\sfmanm.sys (Creative Technology Ltd.)
DRV - (emu10k1) Creative Interface Manager Driver (WDM) – C:\WINDOWS\system32\drivers\ctlfacem.sys (Creative Technology Ltd.)
DRV - (emu10k) Creative SB Live! (WDM) – C:\WINDOWS\system32\drivers\emu10k1m.sys (Creative Technology Ltd.)
DRV - (FETNDIS) – C:\WINDOWS\system32\drivers\fetnd5.sys (VIA Technologies, Inc. )


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.live.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.msn.com/sphome.aspx
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:5555

========== FireFox ==========

FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.defaulturl: "http://search.yahoo.com/search?ei=UTF-8&fr;=ytff-sunm&p;="
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.param.yahoo-fr: "moz2-ytff-sunm"
FF - prefs.js..browser.search.param.yahoo-fr-cjkt: "moz2-ytff-sunm"
FF - prefs.js..browser.search.selectedEngine: "Ask.com"
FF - prefs.js..browser.search.update: false
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.google.com/"
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: [removed]:1.5.1
FF - prefs.js..keyword.URL: "http://supertoolbar.ask.com/redirect?client=ff&src;=kw&tb;=DVSV5&o;=15016&locale;=en_US&q;="


FF - HKLM\software\mozilla\Mozilla Firefox 3.5.7\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/01/16 16:15:02 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.7\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/01/15 12:36:06 | 00,000,000 | —D | M]

[2009/03/04 20:09:06 | 00,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Mozilla\Extensions
[2010/01/20 14:05:14 | 00,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\7yjf1fkk.default\extensions
[2010/01/18 08:13:26 | 00,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\7yjf1fkk.default\extensions\[removed]
[2009/11/15 00:49:41 | 00,002,059 | —- | M] () – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\7yjf1fkk.default\searchplugins\daemon-search.xml
[2009/07/22 10:12:25 | 00,009,941 | —- | M] () – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\7yjf1fkk.default\searchplugins\mywebsearch.xml
[2010/01/20 14:05:14 | 00,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2009/07/17 03:40:12 | 00,704,512 | —- | M] (BitComet) – C:\Program Files\Mozilla Firefox\plugins\npBitCometAgent.dll
[2009/02/02 21:15:28 | 03,771,296 | —- | M] () – C:\Program Files\Mozilla Firefox\plugins\NPSWF32.dll
[2009/06/04 07:16:30 | 00,372,736 | —- | M] (Adobe Systems, Inc.) – C:\Program Files\Mozilla Firefox\plugins\Plugin.dll

O1 HOSTS File: ([2002/08/29 07:00:00 | 00,000,734 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O3 - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll ()
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O3 - HKCU\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O4 - HKLM..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe (Symantec Corporation)
O4 - HKLM..\Run: [ErrorSmart] C:\Program Files\ErrorSmart\ErrorSmart.exe (AntiSpyware LLC)
O4 - HKLM..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe (HP)
O4 - HKLM..\Run: [HPHmon03] C:\WINDOWS\System32\hphmon03.exe File not found
O4 - HKLM..\Run: [vptray] C:\Program Files\Symantec AntiVirus\VPTray.exe (Symantec Corporation)
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab (HP Download Manager)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_15)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = ITC2-DOMAIN.COM
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\NavLogon: DllName - C:\WINDOWS\system32\NavLogon.dll - C:\WINDOWS\system32\NavLogon.dll (Symantec Corporation)
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/12/15 16:45:06 | 00,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O33 - MountPoints2\F\Shell - "" = AutoRun
O33 - MountPoints2\F\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\RunGame.exe – File not found
O33 - MountPoints2\G\Shell - "" = AutoRun
O33 - MountPoints2\G\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\RunGame.exe – File not found
O33 - MountPoints2\I\Shell - "" = AutoRun
O33 - MountPoints2\I\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\I\Shell\AutoRun\command - "" = I:\RunGame.exe – File not found
O33 - MountPoints2\J\Shell - "" = AutoRun
O33 - MountPoints2\J\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\J\Shell\AutoRun\command - "" = J:\RunGame.exe – File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - comfile [open] – "%1" %*
O35 - exefile [open] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/01/20 16:03:52 | 00,000,000 | —D | C] – C:\Documents and Settings\Administrator\Desktop\New Folder
[2010/01/20 13:47:01 | 00,000,000 | —D | C] – C:\_OTL
[2010/01/20 12:52:07 | 00,547,328 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Administrator\Desktop\OTL(2).exe
[2010/01/19 22:03:37 | 00,547,328 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Administrator\Desktop\OTL.exe
[2010/01/17 19:54:17 | 00,000,000 | —D | C] – C:\WINDOWS\pss
[2009/12/28 23:06:06 | 00,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Apple
[2009/05/29 15:21:04 | 00,000,000 | —D | M] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[2008/12/15 16:49:03 | 00,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
[2008/12/15 16:44:57 | 00,000,000 | –SD | M] – C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2008/12/15 16:44:57 | 00,000,000 | –SD | M] – C:\Documents and Settings\LocalService\Application Data\Microsoft

========== Files - Modified Within 30 Days ==========

[2010/01/20 16:01:00 | 00,000,250 | —- | M] () – C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2010/01/20 15:37:32 | 00,002,206 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/01/20 15:37:08 | 00,000,418 | —- | M] () – C:\WINDOWS\tasks\ErrorSmart Scheduled Scan.job
[2010/01/20 15:36:46 | 00,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/01/20 15:36:43 | 00,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/01/20 15:36:40 | 77,128,4992 | -HS- | M] () – C:\hiberfil.sys
[2010/01/20 15:03:41 | 04,980,736 | -H– | M] () – C:\Documents and Settings\Administrator\NTUSER.DAT
[2010/01/20 15:03:41 | 00,000,278 | -HS- | M] () – C:\Documents and Settings\Administrator\ntuser.ini
[2010/01/20 15:03:40 | 03,766,340 | -H– | M] () – C:\Documents and Settings\Administrator\Local Settings\Application Data\IconCache.db
[2010/01/20 13:56:53 | 00,293,376 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\fb9fgijy.exe
[2010/01/20 13:52:52 | 00,000,020 | —- | M] () – C:\Documents and Settings\Administrator\defogger_reenable
[2010/01/20 13:52:11 | 00,050,621 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Defogger.exe
[2010/01/20 12:52:10 | 00,547,328 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Administrator\Desktop\OTL(2).exe
[2010/01/19 22:27:05 | 00,001,917 | —- | M] () – C:\WINDOWS\imsins.BAK
[2010/01/19 22:03:38 | 00,547,328 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Administrator\Desktop\OTL.exe
[2010/01/19 12:19:19 | 00,000,603 | —- | M] () – C:\WINDOWS\win.ini
[2010/01/19 12:19:19 | 00,000,227 | —- | M] () – C:\WINDOWS\system.ini
[2010/01/19 12:19:19 | 00,000,211 | -HS- | M] () – C:\boot.ini
[2010/01/19 12:15:48 | 00,000,664 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/01/19 12:15:48 | 00,000,552 | —- | M] () – C:\WINDOWS\System32\d3d8caps.dat
[2010/01/19 11:58:43 | 00,001,908 | —- | M] () – C:\WINDOWS\diagwrn.xml
[2010/01/19 11:58:43 | 00,001,908 | —- | M] () – C:\WINDOWS\diagerr.xml
[2010/01/18 18:17:02 | 00,002,187 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Norton Security Scan.lnk
[2010/01/18 07:43:33 | 00,000,611 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Shortcut to sims 2+power iso 3.1.lnk
[2010/01/17 19:20:12 | 00,000,008 | —- | M] () – C:\Documents and Settings\All Users\Application Data\sysReserve.ini
[2010/01/17 19:09:58 | 00,000,000 | -H– | M] () – C:\Documents and Settings\Administrator\My Documents\Default.rdp
[2010/01/17 18:00:03 | 00,000,424 | —- | M] () – C:\WINDOWS\tasks\Norton Security Scan for Administrator.job
[2010/01/11 23:25:58 | 00,019,968 | —- | M] () – C:\Documents and Settings\Administrator\My Documents\The cold musty air gracefully spiraed around.doc
[2010/01/11 23:06:05 | 00,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/01/09 22:19:07 | 00,024,064 | —- | M] () – C:\Documents and Settings\Administrator\My Documents\Doc2.doc
[2010/01/09 11:08:15 | 00,006,144 | —- | M] () – C:\Documents and Settings\Administrator\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/01/05 22:59:15 | 00,020,480 | —- | M] () – C:\Documents and Settings\Administrator\My Documents\The green canopy was engraved in gold in the fiery morning sun.doc
[2010/01/05 14:43:15 | 03,426,304 | —- | M] () – C:\Documents and Settings\Administrator\My Documents\Imani.doc
[2010/01/01 12:28:54 | 00,020,992 | —- | M] () – C:\Documents and Settings\Administrator\My Documents\Ultimate TekTek Contest.doc
[2009/12/29 14:08:35 | 00,019,968 | —- | M] () – C:\Documents and Settings\Administrator\My Documents\X7zabclopjksilverluna5199pqltpzk123462011131419100.doc
[2009/12/25 11:18:02 | 00,512,960 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2009/12/25 11:18:02 | 00,435,260 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2009/12/25 11:18:02 | 00,068,156 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2009/12/21 23:25:50 | 00,028,672 | —- | M] () – C:\Documents and Settings\Administrator\My Documents\The Life of a Pressured Teen.doc

========== Files Created - No Company Name ==========

[2010/01/20 13:56:52 | 00,293,376 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\fb9fgijy.exe
[2010/01/20 13:52:45 | 00,000,020 | —- | C] () – C:\Documents and Settings\Administrator\defogger_reenable
[2010/01/20 13:52:11 | 00,050,621 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\Defogger.exe
[2010/01/19 12:20:10 | 77,128,4992 | -HS- | C] () – C:\hiberfil.sys
[2010/01/19 12:15:48 | 00,000,552 | —- | C] () – C:\WINDOWS\System32\d3d8caps.dat
[2010/01/19 12:15:35 | 00,000,664 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/01/17 19:20:12 | 00,000,008 | —- | C] () – C:\Documents and Settings\All Users\Application Data\sysReserve.ini
[2010/01/17 19:09:58 | 00,000,000 | -H– | C] () – C:\Documents and Settings\Administrator\My Documents\Default.rdp
[2010/01/09 22:19:06 | 00,024,064 | —- | C] () – C:\Documents and Settings\Administrator\My Documents\Doc2.doc
[2010/01/01 12:28:53 | 00,020,992 | —- | C] () – C:\Documents and Settings\Administrator\My Documents\Ultimate TekTek Contest.doc
[2009/12/21 21:35:46 | 00,028,672 | —- | C] () – C:\Documents and Settings\Administrator\My Documents\The Life of a Pressured Teen.doc
[2009/08/19 20:12:21 | 00,006,144 | —- | C] () – C:\Documents and Settings\Administrator\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/08/05 11:26:29 | 00,027,648 | —- | C] () – C:\WINDOWS\System32\AVSredirect.dll
[2009/04/15 14:42:21 | 00,000,035 | —- | C] () – C:\WINDOWS\GetGoDM.INI
[2009/03/07 16:16:43 | 00,000,000 | —- | C] () – C:\WINDOWS\VPC32.INI
[2009/01/02 21:31:26 | 00,000,034 | —- | C] () – C:\WINDOWS\hpfsched.ini
[2008/12/15 18:09:53 | 00,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2008/12/15 17:01:06 | 00,002,573 | —- | C] () – C:\WINDOWS\WAVEMIX.INI
[2008/12/15 17:01:06 | 00,000,247 | —- | C] () – C:\WINDOWS\QNETP7.INI
[2004/09/17 17:37:42 | 00,061,440 | —- | C] () – C:\WINDOWS\System32\vuins32.dll
[2003/01/07 15:05:08 | 00,002,695 | —- | C] () – C:\WINDOWS\System32\OUTLPERF.INI

========== LOP Check ==========

[2009/08/03 22:59:47 | 00,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\4Media Software Studio
[2009/07/15 15:54:15 | 00,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Canon
[2009/11/15 00:54:35 | 00,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\DAEMON Tools Lite
[2009/09/18 16:02:13 | 00,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\ErrorSmart
[2009/04/15 14:28:03 | 00,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\GetGo Software
[2009/06/06 14:09:00 | 00,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Leadertech
[2009/11/28 22:05:52 | 00,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Rock Your Phone
[2009/11/15 00:49:19 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\DAEMON Tools Lite
[2009/07/25 12:23:04 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\MSScanAppDataDir
[2008/12/27 18:30:06 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PC Drivers HeadQuarters
[2008/12/15 16:59:46 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\WinZip
[2009/11/27 13:35:50 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2010/01/20 15:37:08 | 00,000,418 | —- | M] () – C:\WINDOWS\Tasks\ErrorSmart Scheduled Scan.job
[2010/01/20 16:01:00 | 00,000,250 | —- | M] () – C:\WINDOWS\Tasks\Scheduled Update for Ask Toolbar.job

========== Purity Check ==========


< End of report >

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI