Spyware / Malware / Virus Removal

[Resolved] XP Infected with virus or something

25 min read

Looking for the outcome? Ask AI

chiefw Topic Starter

Post #1January 23, 2010, 9:59 PM UTC

Greetings, Believe my old machine is infected. I had AVG installed, quit responding so I tried to reload. Tells me to uninstall malware defender however, it is not shown in the add or remove programs. I tried loading Symantic, wont install. Mozilla keeps redirecting web sites and I have audio commercials play intermittently when no programs are open. I had used Hijack this years ago, reloaded and ran it to look for anything suspicious. Also read numerous topics on your forum, seems I'm not alone. Appreciate any assistance.

RPMcMurphy

Post #2January 23, 2010, 10:09 PM UTC last edited January 23, 2010, 10:19 PM UTC

Hello chiefw and welcome to WhatTheTech. I’ll be happy to look over your log and help you with your issues. It will be very helpful if you follow these guidelines:

Malware removal is a sometimes lengthy and tedious process. Please stick with the thread until I’ve given you the “All clear.” Absence of symptoms does not mean your machine is clean!
Please do not run any scans or install/uninstall any applications without being directed to do so.
Please follow my instructions carefully and in the order they are posted.
Any underlined text in my posts indicates a clickable link.
You should print any instruction I give you for ease of use and reference.
If you have any questions at all, please stop and ask before proceeding.

Please be advised, as I am still in training, all my replies to you will be checked for accuracy by one of our experts to ensure that I am giving you the best possible advise.This may cause a delay, but I will do my best to keep it as short as possible.

I will post back shortly with instructions.

chiefw

Post #3January 23, 2010, 10:27 PM UTC

Thank you, and standing by for further………….

RPMcMurphy

Post #4January 24, 2010, 2:26 PM UTC

chiefw,

🖼Click to load external image (Posted Image) Please download exeHelper to your desktop.
Double-click on exeHelper.com to run the fix.
A black window should pop up, press any key to close once the fix is completed.
Post the contents of exehelperlog.txt (Will be created in the directory where you ran exeHelper.com, and should open at the end of the scan)
Note: If the window shows a message that says "Error deleting file", please re-run the program before posting a log - and post the two logs together (they will both be in the one file).

Next, run these two tools so I can have a closer look at your problem:

🖼Click to load external image (Posted Image) Download OTL to your desktop.

Download OTL to your desktop.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Check the boxes beside LOP Check and Purity Check.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt.
Note:These logs can be located in the OTL. folder on you C:\ drive if they fail to open automatically.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them both in.

🖼Click to load external image (Posted Image) Download the GMER Rootkit Scanner. Unzip it to your Desktop.

Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.

Double-click gmer.exe. The program will begin to run.

**Caution**
These types of scans can produce false positives. Do NOT take any action on any "<— ROOKIT" entries unless advised!

If possible rootkit activity is found, you will be asked if you would like to perform a full scan.

Click NO
In the right panel, you will see a bunch of boxes that have been checked … leave everything checked and ensure the Show all box is un-checked.
Now click the Scan button.
Once the scan is complete, you may receive another notice about rootkit activity.
Click OK.
GMER will produce a log. Click on the [Save..] button, and in the File name area, type in "GMER.txt"
Save it where you can easily find it, such as your desktop.

Post the contents of GMER.txt in your next reply.

Please include the following in your next post:

exeHelper log
OTL log

GMER log

chiefw

Post #5January 24, 2010, 10:32 PM UTC

Here is the EXEhelper, Extras, and OTL logs. Nothing happened when I tried running the GMER Rootkit scanner, I tried in SAFE mode as well, NOTHING. Additionally Mozilla would not let me in the OTL website, I had to download OTL on another computer and copy the file to the infected machine.

exeHelper by Raktor
Build 20091220
Run at 12:53:13 on 01/24/10
Now searching…
Checking for numerical processes…
Checking for sysguard processes…
Checking for bad processes…
Checking for bad files…
Checking for bad registry entries…
Resetting filetype association for .exe
Resetting filetype association for .com
Resetting userinit and shell values…
Resetting policies…
–Finished–

OTL logfile created on: 1/24/2010 1:03:14 PM - Run 1
OTL by OldTimer - Version 3.1.26.0 Folder = C:\Documents and Settings\Owner\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

512.00 Mb Total Physical Memory | 216.00 Mb Available Physical Memory | 42.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 82.00% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 111.79 Gb Total Space | 97.50 Gb Free Space | 87.22% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
Drive H: | 298.09 Gb Total Space | 43.13 Gb Free Space | 14.47% Space Free | Partition Type: NTFS
I: Drive not present or media not loaded

Computer Name: WHITTLEDT01
Current User Name: Owner
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Owner\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\Common Files\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe (Nikon Corporation)
PRC - C:\WINDOWS\soundman.exe (Realtek Semiconductor Corp.)
PRC - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
PRC - C:\Program Files\HP\HP Software Update\hpwuSchd.exe (Hewlett-Packard)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Owner\Desktop\OTL.exe (OldTimer Tools)

========== Win32 Services (SafeList) ==========

SRV - (JavaQuickStarterService) – C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)
SRV - (LiveUpdate) – C:\Program Files\Symantec\LiveUpdate\LuComServer_3_3.EXE (Symantec Corporation)
SRV - (Apple Mobile Device) – C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (Bonjour Service) – C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.)
SRV - (IDriverT) – C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe (Macrovision Corporation)
SRV - (Pml Driver HPZ12) – C:\WINDOWS\system32\hpzipm12.exe (HP)

========== Driver Services (SafeList) ==========

DRV - (mfehidk) – C:\WINDOWS\system32\drivers\mfehidk.sys (McAfee, Inc.)
DRV - (mferkdk) – C:\WINDOWS\system32\drivers\mferkdk.sys (McAfee, Inc.)
DRV - (MPFP) – C:\WINDOWS\system32\drivers\Mpfp.sys (McAfee, Inc.)
DRV - (TVICHW32) – C:\WINDOWS\system32\drivers\TVICHW32.SYS (EnTech Taiwan)
DRV - (GEARAspiWDM) – C:\WINDOWS\system32\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV - (Secdrv) – C:\WINDOWS\system32\drivers\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
DRV - (Ptilink) – C:\WINDOWS\system32\drivers\ptilink.sys (Parallel Technologies, Inc.)
DRV - (gameenum) – C:\WINDOWS\system32\drivers\gameenum.sys (Microsoft Corporation)
DRV - (ati2mtag) – C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (ALCXWDM) Service for Realtek AC97 Audio (WDM) – C:\WINDOWS\system32\drivers\alcxwdm.sys (Realtek Semiconductor Corp.)
DRV - (HPZipr12) – C:\WINDOWS\system32\drivers\HPZipr12.sys (HP)
DRV - (AFS2K) – C:\WINDOWS\system32\drivers\AFS2K.SYS (Oak Technology Inc.)
DRV - (HPZid412) – C:\WINDOWS\system32\drivers\hpzid412.sys (HP)
DRV - (HPZius12) – C:\WINDOWS\system32\drivers\HPZius12.sys (HP)
DRV - (ac97intc) Intel® 82801 Audio Driver Install Service (WDM) – C:\WINDOWS\system32\drivers\ac97intc.sys (Intel Corporation)
DRV - (EL90XBC) – C:\WINDOWS\system32\drivers\el90xbc5.sys (3Com Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.foxnews.com"
FF - prefs.js..extensions.enabledItems: [removed]:1.0

FF - HKLM\software\mozilla\Mozilla Firefox 3.5.7\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/01/07 19:38:35 | 00,000,000 | -H-D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.7\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/01/22 20:44:08 | 00,000,000 | -H-D | M]

[2008/08/13 15:41:58 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Mozilla\Extensions
[2010/01/23 19:34:13 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\lgvoh5ur.default\extensions
[2008/08/13 15:41:58 | 00,000,000 | —D | M] (DriverAgent Plugin for Firefox and Opera) – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\lgvoh5ur.default\extensions\{F8CC37C3-CBEB-4A00-8CBF-26A88693F0C5}
[2010/01/23 19:34:13 | 00,000,000 | -H-D | M] – C:\Program Files\Mozilla Firefox\extensions

O1 HOSTS File: ([2010/01/20 21:26:54 | 00,000,021 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll File not found
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [Adobe ARM] C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [DXDllRegExe] File not found
O4 - HKLM..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd.exe (Hewlett-Packard)
O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\QTTask.exe (Apple Inc.)
O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\soundman.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Common Files\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKCU..\RunOnce: [Shockwave Updater] C:\WINDOWS\System32\Adobe\SHOCKW~1\SWHELP~1.EXE -Update -1100465 -Mozilla\5.0 ( File not found
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation)
O4 - Startup: C:\Documents and Settings\Owner\Start Menu\Programs\Startup\Nikon Monitor.lnk = C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe (Nikon Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: E&xport; to Microsoft Excel - C:\Program Files\Microsoft Office\Office10\EXCEL.EXE (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://www.update.microsoft.com/windowsupd…b?1218672405234 (WUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_06)
O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/08/13 14:20:56 | 00,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O33 - MountPoints2\{46d2a3dc-0f86-11de-9ef7-000475be28e9}\Shell\AutoRun\command - "" = I:\setupSNK.exe – File not found
O33 - MountPoints2\{6690eee4-cb56-11de-8d62-000475be28e9}\Shell\AutoRun\command - "" = I:\RunUltraLock.exe – File not found
O33 - MountPoints2\{a8439c41-b6a0-11de-9f29-000475be28e9}\Shell\AutoRun\command - "" = I:\RunUltraLock.exe – File not found
O33 - MountPoints2\{b24b0043-6a59-11dd-ac95-000475be28e9}\Shell\AutoRun\command - "" = wdsync.exe
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - comfile [open] – "%1" %*
O35 - exefile [open] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/01/24 13:00:42 | 00,547,328 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Owner\Desktop\OTL.exe
[2010/01/22 22:28:21 | 00,000,000 | —D | C] – C:\Program Files\Spybot - Search & Destroy
[2010/01/22 21:22:17 | 00,000,000 | —D | C] – C:\Program Files\Symantec
[2010/01/22 20:44:41 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Sun
[2010/01/22 20:44:07 | 00,411,368 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\deploytk.dll
[2010/01/22 20:44:07 | 00,153,376 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaws.exe
[2010/01/22 20:44:07 | 00,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaw.exe
[2010/01/22 20:44:06 | 00,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\java.exe
[2010/01/22 18:57:11 | 00,000,000 | —D | C] – C:\WINDOWS\Minidump
[2010/01/22 17:49:28 | 00,050,688 | —- | C] (Atribune.org) – C:\Documents and Settings\Owner\Desktop\ATF_Cleaner.exe
[2010/01/22 17:43:13 | 00,000,000 | –SD | M] – C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2010/01/22 17:43:13 | 00,000,000 | –SD | M] – C:\Documents and Settings\LocalService\Application Data\Microsoft
[2010/01/22 17:43:13 | 00,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
[2010/01/22 17:43:13 | 00,000,000 | —D | M] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[2010/01/21 21:16:58 | 00,000,000 | —D | C] – C:\Documents and Settings\Owner\Desktop\backups
[2010/01/21 21:15:01 | 00,401,720 | —- | C] (Trend Micro Inc.) – C:\Documents and Settings\Owner\Desktop\HijackThis.exe
[2010/01/21 19:06:01 | 00,000,000 | —D | C] – C:\Documents and Settings\Owner\Application Data\AVG8
[2010/01/20 22:48:59 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\SiteAdvisor
[2010/01/20 22:48:13 | 00,000,000 | —D | M] – C:\Documents and Settings\LocalService\Application Data\SACore
[2010/01/20 22:16:46 | 00,120,136 | —- | C] (McAfee, Inc.) – C:\WINDOWS\System32\drivers\Mpfp.sys
[2010/01/20 21:34:24 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\RegAce
[2010/01/20 21:34:21 | 00,000,000 | -H-D | C] – C:\Program Files\RegAce
[2010/01/20 21:23:23 | 00,000,000 | —D | C] – C:\Spyware
[2010/01/20 21:13:09 | 00,000,000 | -H-D | C] – C:\Program Files\Common Files\McAfee
[2010/01/20 21:12:36 | 00,000,000 | -H-D | C] – C:\Program Files\McAfee
[2010/01/20 21:10:26 | 00,034,248 | —- | C] (McAfee, Inc.) – C:\WINDOWS\System32\drivers\mferkdk.sys
[2010/01/20 21:09:56 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\McAfee
[2010/01/20 20:21:36 | 00,000,000 | —D | C] – C:\WINDOWS\pss
[2010/01/20 19:35:46 | 00,511,328 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\capicom.dll
[2010/01/20 19:35:05 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Symantec
[2010/01/20 19:32:41 | 00,000,000 | —D | C] – C:\SEP
[2008/10/23 15:45:04 | 00,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Apple
[2008/09/10 12:30:06 | 00,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2008/09/10 12:30:06 | 00,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Application Data\Adobe
[2008/08/14 10:28:28 | 00,000,000 | —D | M] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Adobe
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/01/24 12:59:20 | 00,284,915 | —- | M] () – C:\Documents and Settings\Owner\Desktop\gmer.zip
[2010/01/24 12:58:22 | 00,547,328 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Owner\Desktop\OTL.exe
[2010/01/23 02:32:07 | 00,000,664 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/01/23 01:57:39 | 00,002,422 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/01/23 01:52:31 | 00,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/01/23 01:52:23 | 00,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/01/23 01:52:16 | 53,644,9024 | -HS- | M] () – C:\hiberfil.sys
[2010/01/23 01:51:35 | 05,242,880 | -H– | M] () – C:\Documents and Settings\Owner\NTUSER.DAT
[2010/01/23 01:51:35 | 00,000,178 | -HS- | M] () – C:\Documents and Settings\Owner\ntuser.ini
[2010/01/23 01:51:33 | 03,184,656 | -H– | M] () – C:\Documents and Settings\Owner\Local Settings\Application Data\IconCache.db
[2010/01/23 01:39:51 | 00,103,936 | —- | M] () – C:\Documents and Settings\Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/01/22 23:21:03 | 00,026,112 | —- | M] () – C:\Documents and Settings\Owner\Desktop\Ten.doc
[2010/01/22 21:28:33 | 00,002,369 | —- | M] () – C:\Documents and Settings\All Users\Application Data\LUUnInstall.LiveUpdate
[2010/01/22 20:43:28 | 00,411,368 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\deploytk.dll
[2010/01/22 20:43:28 | 00,153,376 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaws.exe
[2010/01/22 20:43:28 | 00,145,184 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaw.exe
[2010/01/22 20:43:28 | 00,145,184 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\java.exe
[2010/01/22 20:43:28 | 00,073,728 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javacpl.cpl
[2010/01/22 20:43:00 | 00,441,124 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/01/22 20:43:00 | 00,071,060 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2010/01/22 18:55:45 | 00,096,512 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\atapi.sys
[2010/01/22 18:55:24 | 00,057,706 | —- | M] () – C:\WINDOWS\System32\net.net
[2010/01/22 18:37:54 | 00,000,000 | —- | M] () – C:\Documents and Settings\Owner\settings.dat
[2010/01/22 18:20:24 | 00,290,816 | —- | M] () – C:\Documents and Settings\Owner\Desktop\exeHelper.com
[2010/01/22 17:49:28 | 00,050,688 | —- | M] (Atribune.org) – C:\Documents and Settings\Owner\Desktop\ATF_Cleaner.exe
[2010/01/21 21:15:01 | 00,401,720 | —- | M] (Trend Micro Inc.) – C:\Documents and Settings\Owner\Desktop\HijackThis.exe
[2010/01/21 20:53:28 | 00,000,594 | —- | M] () – C:\WINDOWS\win.ini
[2010/01/21 20:53:28 | 00,000,227 | —- | M] () – C:\WINDOWS\system.ini
[2010/01/21 20:53:28 | 00,000,211 | -HS- | M] () – C:\boot.ini
[2010/01/21 19:04:55 | 00,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2010/01/21 16:45:01 | 00,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/01/20 21:26:54 | 00,000,021 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2010/01/20 13:13:02 | 00,000,000 | —- | M] () – C:\Documents and Settings\Owner\Local Settings\Application Data\prvlcl.dat
[2010/01/20 12:52:17 | 00,000,008 | —- | M] () – C:\Documents and Settings\All Users\Application Data\sysReserve.ini
[2010/01/13 12:11:19 | 00,037,376 | —- | M] () – C:\Documents and Settings\Owner\Desktop\Scout Roster.xls
[2010/01/06 19:08:17 | 00,068,608 | —- | M] () – C:\Documents and Settings\Owner\Desktop\calendar.xls
[2010/01/05 22:16:47 | 00,104,470 | —- | M] () – C:\Documents and Settings\Owner\Desktop\Jan 10 Current_Troop_38_Calender.pdf
[2010/01/05 20:50:33 | 00,002,483 | —- | M] () – C:\Documents and Settings\Owner\Desktop\Microsoft Word.lnk
[2010/01/05 19:05:36 | 00,002,481 | —- | M] () – C:\Documents and Settings\Owner\Desktop\Microsoft Excel.lnk
[2010/01/05 01:00:29 | 00,832,512 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wininet.dll
[2010/01/05 01:00:28 | 01,168,384 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\urlmon.dll
[2010/01/05 01:00:28 | 00,671,232 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\mstime.dll
[2010/01/05 01:00:28 | 00,671,232 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mstime.dll
[2010/01/05 01:00:28 | 00,233,472 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\webcheck.dll
[2010/01/05 01:00:28 | 00,105,984 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\url.dll
[2010/01/05 01:00:28 | 00,105,984 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\url.dll
[2010/01/05 01:00:28 | 00,102,912 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\occache.dll
[2010/01/05 01:00:28 | 00,044,544 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\pngfilt.dll
[2010/01/05 01:00:28 | 00,044,544 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\pngfilt.dll
[2010/01/05 01:00:27 | 00,477,696 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mshtmled.dll
[2010/01/05 01:00:27 | 00,193,024 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\msrating.dll
[2010/01/05 01:00:27 | 00,193,024 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msrating.dll
[2010/01/05 01:00:26 | 03,599,360 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mshtml.dll
[2010/01/05 01:00:25 | 00,052,224 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\msfeedsbs.dll
[2010/01/05 01:00:25 | 00,052,224 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msfeedsbs.dll
[2010/01/05 01:00:24 | 01,830,912 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\inetcpl.cpl
[2010/01/05 01:00:24 | 01,830,912 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\inetcpl.cpl
[2010/01/05 01:00:24 | 00,459,264 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\msfeeds.dll
[2010/01/05 01:00:24 | 00,459,264 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msfeeds.dll
[2010/01/05 01:00:24 | 00,268,288 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iertutil.dll
[2010/01/05 01:00:24 | 00,192,512 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\iepeers.dll
[2010/01/05 01:00:24 | 00,192,512 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iepeers.dll
[2010/01/05 01:00:24 | 00,044,544 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\iernonce.dll
[2010/01/05 01:00:24 | 00,044,544 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iernonce.dll
[2010/01/05 01:00:24 | 00,027,648 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\jsproxy.dll
[2010/01/05 01:00:24 | 00,027,648 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\jsproxy.dll
[2010/01/05 01:00:23 | 06,067,200 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ieframe.dll
[2010/01/05 01:00:21 | 00,385,024 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\iedkcs32.dll
[2010/01/05 01:00:21 | 00,385,024 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iedkcs32.dll
[2010/01/05 01:00:21 | 00,380,928 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\ieapfltr.dll
[2010/01/05 01:00:21 | 00,380,928 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ieapfltr.dll
[2010/01/05 01:00:21 | 00,230,400 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\ieaksie.dll
[2010/01/05 01:00:21 | 00,230,400 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ieaksie.dll
[2010/01/05 01:00:21 | 00,214,528 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dxtrans.dll
[2010/01/05 01:00:21 | 00,214,528 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\dxtrans.dll
[2010/01/05 01:00:21 | 00,153,088 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\ieakeng.dll
[2010/01/05 01:00:21 | 00,153,088 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ieakeng.dll
[2010/01/05 01:00:21 | 00,133,120 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\extmgr.dll
[2010/01/05 01:00:21 | 00,078,336 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\ieencode.dll
[2010/01/05 01:00:21 | 00,078,336 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ieencode.dll
[2010/01/05 01:00:21 | 00,063,488 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\icardie.dll
[2010/01/05 01:00:20 | 00,347,136 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dxtmsft.dll
[2010/01/05 01:00:20 | 00,347,136 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\dxtmsft.dll
[2010/01/05 01:00:20 | 00,124,928 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\advpack.dll
[2010/01/05 01:00:20 | 00,124,928 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\advpack.dll
[2010/01/05 01:00:20 | 00,017,408 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\corpol.dll
[2010/01/05 01:00:20 | 00,017,408 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\corpol.dll
[2009/12/31 06:33:27 | 00,389,120 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\html.iec
[2009/12/31 06:33:06 | 00,070,656 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\ie4uinit.exe
[2009/12/31 06:33:06 | 00,070,656 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ie4uinit.exe
[2009/12/31 06:33:06 | 00,013,824 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\ieudinit.exe
[2009/12/31 06:33:06 | 00,013,824 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ieudinit.exe
[2009/12/29 15:10:17 | 00,000,020 | -H– | M] () – C:\Documents and Settings\All Users\Application Data\PKP_DLdu.DAT
[2009/12/29 13:54:29 | 00,000,352 | —- | M] () – C:\WINDOWS\ViewNX.INI
[2009/12/29 13:54:04 | 00,000,020 | -H– | M] () – C:\Documents and Settings\All Users\Application Data\PKP_DLdw.DAT
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/01/24 13:00:47 | 00,284,915 | —- | C] () – C:\Documents and Settings\Owner\Desktop\gmer.zip
[2010/01/23 02:32:07 | 00,000,664 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/01/23 01:52:16 | 53,644,9024 | -HS- | C] () – C:\hiberfil.sys
[2010/01/22 21:28:27 | 00,002,369 | —- | C] () – C:\Documents and Settings\All Users\Application Data\LUUnInstall.LiveUpdate
[2010/01/22 18:55:24 | 00,057,706 | —- | C] () – C:\WINDOWS\System32\net.net
[2010/01/22 18:37:54 | 00,000,000 | —- | C] () – C:\Documents and Settings\Owner\settings.dat
[2010/01/22 18:20:24 | 00,290,816 | —- | C] () – C:\Documents and Settings\Owner\Desktop\exeHelper.com
[2010/01/20 20:48:26 | 00,001,815 | —- | C] () – C:\Documents and Settings\Owner\Start Menu\Programs\Startup\Nikon Monitor.lnk
[2010/01/20 20:48:26 | 00,001,808 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
[2010/01/20 20:48:26 | 00,001,730 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
[2010/01/20 12:52:17 | 00,000,008 | —- | C] () – C:\Documents and Settings\All Users\Application Data\sysReserve.ini
[2010/01/06 18:57:32 | 00,068,608 | —- | C] () – C:\Documents and Settings\Owner\Desktop\calendar.xls
[2010/01/05 22:16:46 | 00,104,470 | —- | C] () – C:\Documents and Settings\Owner\Desktop\Jan 10 Current_Troop_38_Calender.pdf
[2009/11/27 23:56:40 | 00,000,000 | —- | C] () – C:\Documents and Settings\Owner\Local Settings\Application Data\prvlcl.dat
[2009/01/05 18:14:24 | 00,000,352 | —- | C] () – C:\WINDOWS\ViewNX.INI
[2009/01/05 18:08:06 | 00,000,268 | RH– | C] () – C:\Documents and Settings\All Users\Application Data\Displays
[2009/01/05 18:08:06 | 00,000,268 | RH– | C] () – C:\Documents and Settings\Owner\Application Data\Digital Basic
[2009/01/05 18:08:06 | 00,000,020 | -H– | C] () – C:\Documents and Settings\All Users\Application Data\PKP_DLdw.DAT
[2009/01/05 18:05:07 | 00,000,268 | RH– | C] () – C:\Documents and Settings\All Users\Application Data\Digital Mono
[2009/01/05 18:05:07 | 00,000,268 | RH– | C] () – C:\Documents and Settings\Owner\Application Data\Dialogs
[2009/01/05 18:05:07 | 00,000,020 | -H– | C] () – C:\Documents and Settings\All Users\Application Data\PKP_DLdu.DAT
[2008/08/22 21:55:58 | 00,000,128 | —- | C] () – C:\Documents and Settings\Owner\Local Settings\Application Data\fusioncache.dat
[2008/08/14 14:40:44 | 00,103,936 | —- | C] () – C:\Documents and Settings\Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/08/14 14:36:23 | 00,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2008/08/14 13:36:16 | 00,002,530 | —- | C] () – C:\Documents and Settings\All Users\Application Data\hpzinstall.log
[2008/08/13 15:06:09 | 00,147,456 | —- | C] () – C:\WINDOWS\System32\RtlCPAPI.dll
[2008/04/14 03:00:00 | 00,037,376 | —- | C] () – C:\WINDOWS\g3rtrv.dll

========== LOP Check ==========

[2009/01/05 18:05:07 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Analog Pad
[2009/01/05 18:08:06 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Automator
[2010/01/22 17:44:29 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\avg9
[2009/01/05 18:08:06 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\EnterNHelp
[2009/01/05 18:06:56 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Nikon
[2010/01/20 21:34:24 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\RegAce
[2008/08/29 15:56:28 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2009/01/05 18:08:06 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Ultima_T15
[2009/06/14 18:04:45 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2008/08/29 14:43:27 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\InfraRecorder
[2009/03/07 21:10:00 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Nikon
[2008/08/21 09:12:37 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Nova Development

========== Purity Check ==========

========== Alternate Data Streams ==========

@Alternate Data Stream - 109 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:92412C7B
< End of report >
SRV - (JavaQuickStarterService) – C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)
SRV - (LiveUpdate) – C:\Program Files\Symantec\LiveUpdate\LuComServer_3_3.EXE (Symantec Corporation)
SRV - (Apple Mobile Device) – C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (Bonjour Service) – C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.)
SRV - (IDriverT) – C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe (Macrovision Corporation)
SRV - (Pml Driver HPZ12) – C:\WINDOWS\system32\hpzipm12.exe (HP)

========== Driver Services (SafeList) ==========

DRV - (mfehidk) – C:\WINDOWS\system32\drivers\mfehidk.sys (McAfee, Inc.)
DRV - (mferkdk) – C:\WINDOWS\system32\drivers\mferkdk.sys (McAfee, Inc.)
DRV - (MPFP) – C:\WINDOWS\system32\drivers\Mpfp.sys (McAfee, Inc.)
DRV - (TVICHW32) – C:\WINDOWS\system32\drivers\TVICHW32.SYS (EnTech Taiwan)
DRV - (GEARAspiWDM) – C:\WINDOWS\system32\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV - (Secdrv) – C:\WINDOWS\system32\drivers\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
DRV - (Ptilink) – C:\WINDOWS\system32\drivers\ptilink.sys (Parallel Technologies, Inc.)
DRV - (gameenum) – C:\WINDOWS\system32\drivers\gameenum.sys (Microsoft Corporation)
DRV - (ati2mtag) – C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (ALCXWDM) Service for Realtek AC97 Audio (WDM) – C:\WINDOWS\system32\drivers\alcxwdm.sys (Realtek Semiconductor Corp.)
DRV - (HPZipr12) – C:\WINDOWS\system32\drivers\HPZipr12.sys (HP)
DRV - (AFS2K) – C:\WINDOWS\system32\drivers\AFS2K.SYS (Oak Technology Inc.)
DRV - (HPZid412) – C:\WINDOWS\system32\drivers\hpzid412.sys (HP)
DRV - (HPZius12) – C:\WINDOWS\system32\drivers\HPZius12.sys (HP)
DRV - (ac97intc) Intel® 82801 Audio Driver Install Service (WDM) – C:\WINDOWS\system32\drivers\ac97intc.sys (Intel Corporation)
DRV - (EL90XBC) – C:\WINDOWS\system32\drivers\el90xbc5.sys (3Com Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.foxnews.com"
FF - prefs.js..extensions.enabledItems: [removed]:1.0

FF - HKLM\software\mozilla\Mozilla Firefox 3.5.7\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/01/07 19:38:35 | 00,000,000 | -H-D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.7\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/01/22 20:44:08 | 00,000,000 | -H-D | M]

[2008/08/13 15:41:58 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Mozilla\Extensions
[2010/01/23 19:34:13 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\lgvoh5ur.default\extensions
[2008/08/13 15:41:58 | 00,000,000 | —D | M] (DriverAgent Plugin for Firefox and Opera) – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\lgvoh5ur.default\extensions\{F8CC37C3-CBEB-4A00-8CBF-26A88693F0C5}
[2010/01/23 19:34:13 | 00,000,000 | -H-D | M] – C:\Program Files\Mozilla Firefox\extensions

O1 HOSTS File: ([2010/01/20 21:26:54 | 00,000,021 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll File not found
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [Adobe ARM] C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [DXDllRegExe] File not found
O4 - HKLM..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd.exe (Hewlett-Packard)
O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\QTTask.exe (Apple Inc.)
O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\soundman.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Common Files\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKCU..\RunOnce: [Shockwave Updater] C:\WINDOWS\System32\Adobe\SHOCKW~1\SWHELP~1.EXE -Update -1100465 -Mozilla\5.0 ( File not found
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation)
O4 - Startup: C:\Documents and Settings\Owner\Start Menu\Programs\Startup\Nikon Monitor.lnk = C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe (Nikon Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: E&xport; to Microsoft Excel - C:\Program Files\Microsoft Office\Office10\EXCEL.EXE (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://www.update.microsoft.com/windowsupd…b?1218672405234 (WUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_06)
O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/08/13 14:20:56 | 00,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O33 - MountPoints2\{46d2a3dc-0f86-11de-9ef7-000475be28e9}\Shell\AutoRun\command - "" = I:\setupSNK.exe – File not found
O33 - MountPoints2\{6690eee4-cb56-11de-8d62-000475be28e9}\Shell\AutoRun\command - "" = I:\RunUltraLock.exe – File not found
O33 - MountPoints2\{a8439c41-b6a0-11de-9f29-000475be28e9}\Shell\AutoRun\command - "" = I:\RunUltraLock.exe – File not found
O33 - MountPoints2\{b24b0043-6a59-11dd-ac95-000475be28e9}\Shell\AutoRun\command - "" = wdsync.exe
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - comfile [open] – "%1" %*
O35 - exefile [open] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/01/24 13:00:42 | 00,547,328 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Owner\Desktop\OTL.exe
[2010/01/22 22:28:21 | 00,000,000 | —D | C] – C:\Program Files\Spybot - Search & Destroy
[2010/01/22 21:22:17 | 00,000,000 | —D | C] – C:\Program Files\Symantec
[2010/01/22 20:44:41 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Sun
[2010/01/22 20:44:07 | 00,411,368 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\deploytk.dll
[2010/01/22 20:44:07 | 00,153,376 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaws.exe
[2010/01/22 20:44:07 | 00,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaw.exe
[2010/01/22 20:44:06 | 00,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\java.exe
[2010/01/22 18:57:11 | 00,000,000 | —D | C] – C:\WINDOWS\Minidump
[2010/01/22 17:49:28 | 00,050,688 | —- | C] (Atribune.org) – C:\Documents and Settings\Owner\Desktop\ATF_Cleaner.exe
[2010/01/22 17:43:13 | 00,000,000 | –SD | M] – C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2010/01/22 17:43:13 | 00,000,000 | –SD | M] – C:\Documents and Settings\LocalService\Application Data\Microsoft
[2010/01/22 17:43:13 | 00,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
[2010/01/22 17:43:13 | 00,000,000 | —D | M] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[2010/01/21 21:16:58 | 00,000,000 | —D | C] – C:\Documents and Settings\Owner\Desktop\backups
[2010/01/21 21:15:01 | 00,401,720 | —- | C] (Trend Micro Inc.) – C:\Documents and Settings\Owner\Desktop\HijackThis.exe
[2010/01/21 19:06:01 | 00,000,000 | —D | C] – C:\Documents and Settings\Owner\Application Data\AVG8
[2010/01/20 22:48:59 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\SiteAdvisor
[2010/01/20 22:48:13 | 00,000,000 | —D | M] – C:\Documents and Settings\LocalService\Application Data\SACore
[2010/01/20 22:16:46 | 00,120,136 | —- | C] (McAfee, Inc.) – C:\WINDOWS\System32\drivers\Mpfp.sys
[2010/01/20 21:34:24 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\RegAce
[2010/01/20 21:34:21 | 00,000,000 | -H-D | C] – C:\Program Files\RegAce
[2010/01/20 21:23:23 | 00,000,000 | —D | C] – C:\Spyware
[2010/01/20 21:13:09 | 00,000,000 | -H-D | C] – C:\Program Files\Common Files\McAfee
[2010/01/20 21:12:36 | 00,000,000 | -H-D | C] – C:\Program Files\McAfee
[2010/01/20 21:10:26 | 00,034,248 | —- | C] (McAfee, Inc.) – C:\WINDOWS\System32\drivers\mferkdk.sys
[2010/01/20 21:09:56 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\McAfee
[2010/01/20 20:21:36 | 00,000,000 | —D | C] – C:\WINDOWS\pss
[2010/01/20 19:35:46 | 00,511,328 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\capicom.dll
[2010/01/20 19:35:05 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Symantec
[2010/01/20 19:32:41 | 00,000,000 | —D | C] – C:\SEP
[2008/10/23 15:45:04 | 00,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Apple
[2008/09/10 12:30:06 | 00,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2008/09/10 12:30:06 | 00,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Application Data\Adobe
[2008/08/14 10:28:28 | 00,000,000 | —D | M] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Adobe
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/01/24 12:59:20 | 00,284,915 | —- | M] () – C:\Documents and Settings\Owner\Desktop\gmer.zip
[2010/01/24 12:58:22 | 00,547,328 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Owner\Desktop\OTL.exe
[2010/01/23 02:32:07 | 00,000,664 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/01/23 01:57:39 | 00,002,422 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/01/23 01:52:31 | 00,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/01/23 01:52:23 | 00,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/01/23 01:52:16 | 53,644,9024 | -HS- | M] () – C:\hiberfil.sys
[2010/01/23 01:51:35 | 05,242,880 | -H– | M] () – C:\Documents and Settings\Owner\NTUSER.DAT
[2010/01/23 01:51:35 | 00,000,178 | -HS- | M] () – C:\Documents and Settings\Owner\ntuser.ini
[2010/01/23 01:51:33 | 03,184,656 | -H– | M] () – C:\Documents and Settings\Owner\Local Settings\Application Data\IconCache.db
[2010/01/23 01:39:51 | 00,103,936 | —- | M] () – C:\Documents and Settings\Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/01/22 23:21:03 | 00,026,112 | —- | M] () – C:\Documents and Settings\Owner\Desktop\Ten.doc
[2010/01/22 21:28:33 | 00,002,369 | —- | M] () – C:\Documents and Settings\All Users\Application Data\LUUnInstall.LiveUpdate
[2010/01/22 20:43:28 | 00,411,368 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\deploytk.dll
[2010/01/22 20:43:28 | 00,153,376 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaws.exe
[2010/01/22 20:43:28 | 00,145,184 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaw.exe
[2010/01/22 20:43:28 | 00,145,184 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\java.exe
[2010/01/22 20:43:28 | 00,073,728 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javacpl.cpl
[2010/01/22 20:43:00 | 00,441,124 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/01/22 20:43:00 | 00,071,060 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2010/01/22 18:55:45 | 00,096,512 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\atapi.sys
[2010/01/22 18:55:24 | 00,057,706 | —- | M] () – C:\WINDOWS\System32\net.net
[2010/01/22 18:37:54 | 00,000,000 | —- | M] () – C:\Documents and Settings\Owner\settings.dat
[2010/01/22 18:20:24 | 00,290,816 | —- | M] () – C:\Documents and Settings\Owner\Desktop\exeHelper.com
[2010/01/22 17:49:28 | 00,050,688 | —- | M] (Atribune.org) – C:\Documents and Settings\Owner\Desktop\ATF_Cleaner.exe
[2010/01/21 21:15:01 | 00,401,720 | —- | M] (Trend Micro Inc.) – C:\Documents and Settings\Owner\Desktop\HijackThis.exe
[2010/01/21 20:53:28 | 00,000,594 | —- | M] () – C:\WINDOWS\win.ini
[2010/01/21 20:53:28 | 00,000,227 | —- | M] () – C:\WINDOWS\system.ini
[2010/01/21 20:53:28 | 00,000,211 | -HS- | M] () – C:\boot.ini
[2010/01/21 19:04:55 | 00,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2010/01/21 16:45:01 | 00,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/01/20 21:26:54 | 00,000,021 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2010/01/20 13:13:02 | 00,000,000 | —- | M] () – C:\Documents and Settings\Owner\Local Settings\Application Data\prvlcl.dat
[2010/01/20 12:52:17 | 00,000,008 | —- | M] () – C:\Documents and Settings\All Users\Application Data\sysReserve.ini
[2010/01/13 12:11:19 | 00,037,376 | —- | M] () – C:\Documents and Settings\Owner\Desktop\Scout Roster.xls
[2010/01/06 19:08:17 | 00,068,608 | —- | M] () – C:\Documents and Settings\Owner\Desktop\calendar.xls
[2010/01/05 22:16:47 | 00,104,470 | —- | M] () – C:\Documents and Settings\Owner\Desktop\Jan 10 Current_Troop_38_Calender.pdf
[2010/01/05 20:50:33 | 00,002,483 | —- | M] () – C:\Documents and Settings\Owner\Desktop\Microsoft Word.lnk
[2010/01/05 19:05:36 | 00,002,481 | —- | M] () – C:\Documents and Settings\Owner\Desktop\Microsoft Excel.lnk
[2010/01/05 01:00:29 | 00,832,512 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wininet.dll
[2010/01/05 01:00:28 | 01,168,384 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\urlmon.dll
[2010/01/05 01:00:28 | 00,671,232 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\mstime.dll
[2010/01/05 01:00:28 | 00,671,232 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mstime.dll
[2010/01/05 01:00:28 | 00,233,472 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\webcheck.dll
[2010/01/05 01:00:28 | 00,105,984 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\url.dll
[2010/01/05 01:00:28 | 00,105,984 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\url.dll
[2010/01/05 01:00:28 | 00,102,912 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\occache.dll
[2010/01/05 01:00:28 | 00,044,544 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\pngfilt.dll
[2010/01/05 01:00:28 | 00,044,544 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\pngfilt.dll
[2010/01/05 01:00:27 | 00,477,696 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mshtmled.dll
[2010/01/05 01:00:27 | 00,193,024 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\msrating.dll
[2010/01/05 01:00:27 | 00,193,024 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msrating.dll
[2010/01/05 01:00:26 | 03,599,360 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mshtml.dll
[2010/01/05 01:00:25 | 00,052,224 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\msfeedsbs.dll
[2010/01/05 01:00:25 | 00,052,224 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msfeedsbs.dll
[2010/01/05 01:00:24 | 01,830,912 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\inetcpl.cpl
[2010/01/05 01:00:24 | 01,830,912 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\inetcpl.cpl
[2010/01/05 01:00:24 | 00,459,264 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\msfeeds.dll
[2010/01/05 01:00:24 | 00,459,264 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msfeeds.dll
[2010/01/05 01:00:24 | 00,268,288 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iertutil.dll
[2010/01/05 01:00:24 | 00,192,512 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\iepeers.dll
[2010/01/05 01:00:24 | 00,192,512 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iepeers.dll
[2010/01/05 01:00:24 | 00,044,544 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\iernonce.dll
[2010/01/05 01:00:24 | 00,044,544 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iernonce.dll
[2010/01/05 01:00:24 | 00,027,648 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\jsproxy.dll
[2010/01/05 01:00:24 | 00,027,648 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\jsproxy.dll
[2010/01/05 01:00:23 | 06,067,200 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ieframe.dll
[2010/01/05 01:00:21 | 00,385,024 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\iedkcs32.dll
[2010/01/05 01:00:21 | 00,385,024 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iedkcs32.dll
[2010/01/05 01:00:21 | 00,380,928 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\ieapfltr.dll
[2010/01/05 01:00:21 | 00,380,928 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ieapfltr.dll
[2010/01/05 01:00:21 | 00,230,400 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\ieaksie.dll
[2010/01/05 01:00:21 | 00,230,400 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ieaksie.dll
[2010/01/05 01:00:21 | 00,214,528 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dxtrans.dll
[2010/01/05 01:00:21 | 00,214,528 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\dxtrans.dll
[2010/01/05 01:00:21 | 00,153,088 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\ieakeng.dll
[2010/01/05 01:00:21 | 00,153,088 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ieakeng.dll
[2010/01/05 01:00:21 | 00,133,120 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\extmgr.dll
[2010/01/05 01:00:21 | 00,078,336 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\ieencode.dll
[2010/01/05 01:00:21 | 00,078,336 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ieencode.dll
[2010/01/05 01:00:21 | 00,063,488 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\icardie.dll
[2010/01/05 01:00:20 | 00,347,136 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dxtmsft.dll
[2010/01/05 01:00:20 | 00,347,136 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\dxtmsft.dll
[2010/01/05 01:00:20 | 00,124,928 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\advpack.dll
[2010/01/05 01:00:20 | 00,124,928 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\advpack.dll
[2010/01/05 01:00:20 | 00,017,408 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\corpol.dll
[2010/01/05 01:00:20 | 00,017,408 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\corpol.dll
[2009/12/31 06:33:27 | 00,389,120 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\html.iec
[2009/12/31 06:33:06 | 00,070,656 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\ie4uinit.exe
[2009/12/31 06:33:06 | 00,070,656 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ie4uinit.exe
[2009/12/31 06:33:06 | 00,013,824 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\ieudinit.exe
[2009/12/31 06:33:06 | 00,013,824 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ieudinit.exe
[2009/12/29 15:10:17 | 00,000,020 | -H– | M] () – C:\Documents and Settings\All Users\Application Data\PKP_DLdu.DAT
[2009/12/29 13:54:29 | 00,000,352 | —- | M] () – C:\WINDOWS\ViewNX.INI
[2009/12/29 13:54:04 | 00,000,020 | -H– | M] () – C:\Documents and Settings\All Users\Application Data\PKP_DLdw.DAT
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/01/24 13:00:47 | 00,284,915 | —- | C] () – C:\Documents and Settings\Owner\Desktop\gmer.zip
[2010/01/23 02:32:07 | 00,000,664 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/01/23 01:52:16 | 53,644,9024 | -HS- | C] () – C:\hiberfil.sys
[2010/01/22 21:28:27 | 00,002,369 | —- | C] () – C:\Documents and Settings\All Users\Application Data\LUUnInstall.LiveUpdate
[2010/01/22 18:55:24 | 00,057,706 | —- | C] () – C:\WINDOWS\System32\net.net
[2010/01/22 18:37:54 | 00,000,000 | —- | C] () – C:\Documents and Settings\Owner\settings.dat
[2010/01/22 18:20:24 | 00,290,816 | —- | C] () – C:\Documents and Settings\Owner\Desktop\exeHelper.com
[2010/01/20 20:48:26 | 00,001,815 | —- | C] () – C:\Documents and Settings\Owner\Start Menu\Programs\Startup\Nikon Monitor.lnk
[2010/01/20 20:48:26 | 00,001,808 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
[2010/01/20 20:48:26 | 00,001,730 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
[2010/01/20 12:52:17 | 00,000,008 | —- | C] () – C:\Documents and Settings\All Users\Application Data\sysReserve.ini
[2010/01/06 18:57:32 | 00,068,608 | —- | C] () – C:\Documents and Settings\Owner\Desktop\calendar.xls
[2010/01/05 22:16:46 | 00,104,470 | —- | C] () – C:\Documents and Settings\Owner\Desktop\Jan 10 Current_Troop_38_Calender.pdf
[2009/11/27 23:56:40 | 00,000,000 | —- | C] () – C:\Documents and Settings\Owner\Local Settings\Application Data\prvlcl.dat
[2009/01/05 18:14:24 | 00,000,352 | —- | C] () – C:\WINDOWS\ViewNX.INI
[2009/01/05 18:08:06 | 00,000,268 | RH– | C] () – C:\Documents and Settings\All Users\Application Data\Displays
[2009/01/05 18:08:06 | 00,000,268 | RH– | C] () – C:\Documents and Settings\Owner\Application Data\Digital Basic
[2009/01/05 18:08:06 | 00,000,020 | -H– | C] () – C:\Documents and Settings\All Users\Application Data\PKP_DLdw.DAT
[2009/01/05 18:05:07 | 00,000,268 | RH– | C] () – C:\Documents and Settings\All Users\Application Data\Digital Mono
[2009/01/05 18:05:07 | 00,000,268 | RH– | C] () – C:\Documents and Settings\Owner\Application Data\Dialogs
[2009/01/05 18:05:07 | 00,000,020 | -H– | C] () – C:\Documents and Settings\All Users\Application Data\PKP_DLdu.DAT
[2008/08/22 21:55:58 | 00,000,128 | —- | C] () – C:\Documents and Settings\Owner\Local Settings\Application Data\fusioncache.dat
[2008/08/14 14:40:44 | 00,103,936 | —- | C] () – C:\Documents and Settings\Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/08/14 14:36:23 | 00,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2008/08/14 13:36:16 | 00,002,530 | —- | C] () – C:\Documents and Settings\All Users\Application Data\hpzinstall.log
[2008/08/13 15:06:09 | 00,147,456 | —- | C] () – C:\WINDOWS\System32\RtlCPAPI.dll
[2008/04/14 03:00:00 | 00,037,376 | —- | C] () – C:\WINDOWS\g3rtrv.dll

========== LOP Check ==========

[2009/01/05 18:05:07 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Analog Pad
[2009/01/05 18:08:06 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Automator
[2010/01/22 17:44:29 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\avg9
[2009/01/05 18:08:06 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\EnterNHelp
[2009/01/05 18:06:56 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Nikon
[2010/01/20 21:34:24 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\RegAce
[2008/08/29 15:56:28 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2009/01/05 18:08:06 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Ultima_T15
[2009/06/14 18:04:45 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2008/08/29 14:43:27 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\InfraRecorder
[2009/03/07 21:10:00 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Nikon
[2008/08/21 09:12:37 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Nova Development

========== Purity Check ==========

========== Alternate Data Streams ==========

@Alternate Data Stream - 109 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:92412C7B

< End of report >

OTL Extras logfile created on: 1/24/2010 1:03:14 PM - Run 1
OTL by OldTimer - Version 3.1.26.0 Folder = C:\Documents and Settings\Owner\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

512.00 Mb Total Physical Memory | 216.00 Mb Available Physical Memory | 42.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 82.00% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 111.79 Gb Total Space | 97.50 Gb Free Space | 87.22% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
Drive H: | 298.09 Gb Total Space | 43.13 Gb Free Space | 14.47% Space Free | Partition Type: NTFS
I: Drive not present or media not loaded

Computer Name: WHITTLEDT01
Current User Name: Owner
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.html [@ = htmlfile] – C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = htmlfile] – Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
htmlfile – "C:\Program Files\Microsoft Office\Office10\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [open] – "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)
htmlfile [opennew] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] – "C:\Program Files\Microsoft Office\Office10\msohtmed.exe" /p %1 (Microsoft Corporation)
http [open] – "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)
https [open] – "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] – "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] – "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\AVG\AVG8\avgemc.exe" = C:\Program Files\AVG\AVG8\avgemc.exe:*:Enabled:avgemc.exe – File not found
"C:\Program Files\AVG\AVG8\avgupd.exe" = C:\Program Files\AVG\AVG8\avgupd.exe:*:Enabled:avgupd.exe – File not found
"C:\Program Files\Bonjour\mDNSResponder.exe" = C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour – (Apple Inc.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00140409-78E1-11D2-B60F-006097C998E7}" = Microsoft Publisher 2000
"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
"{1451DE6B-ABE1-4F62-BE9A-B363A17588A2}" = QuickTime
"{1F63ED0B-EDD2-4037-B6AB-1358C624AF48}" = Scan
"{1F7473D9-6C0B-4F5A-8FA4-AB8AD78CBE54}" = DocProc
"{26A24AE4-039D-4CA4-87B4-2F83216018FF}" = Java™ 6 Update 18
"{29B50D30-EAFC-4cea-9F76-3A0E3729E9B0}" = SkinsHP1
"{2E132061-C78A-48D4-A899-1D13B9D189FA}" = Memories Disc Creator 2.0
"{3248F0A8-6813-11D6-A77B-00B0D0160060}" = Java™ 6 Update 6
"{34957B51-9676-41CE-9E52-44AE91B73F1C}" = HP Software Update
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{39D4FB9C-9CDE-4449-BD2B-6AD4D376CFDC}" = Art Explosion Publisher Pro 2.0
"{3CF78481-FB7B-4B51-99A2-D5E0CD0B3AAF}" = HPSystemDiagnostics
"{3FA365DF-2D68-45ED-8F83-8C8A33E65143}" = Apple Application Support
"{48242276-DB89-42e8-9678-BD4280D7B99A}" = Copy
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{595D0DE8-C38A-4432-B851-47DECC1A99BD}" = HP Unload DLL Patch
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{723C033E-63EA-4227-BAB2-0AA8693C16EB}" = Director
"{745A92AF-53B4-41A7-91C3-9B026B1D5897}" = InstantShare
"{766273C1-A39B-47EB-ACE8-DEBDD8094BCC}" = overland
"{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com
"{81DD5688-695A-4c1d-AE7D-368BF857725A}" = TrayApp
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{87441A59-5E64-4096-A170-14EFE67200C3}" = Picture Control Utility
"{8777AC6D-89F9-4793-8266-DE406F343E89}" = QFolder
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90280409-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional with FrontPage
"{9B03C535-3AEA-4ef2-B326-0A01A2207034}" = CreativeProjects
"{A1062847-0846-427A-92A1-BB8251A91E91}" = HP PSC & OfficeJet 4.2
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A4EA3AB4-E78C-4286-96DF-26035507CE55}" = AiO_Scan
"{AC76BA86-7AD7-1033-7B44-A92000000001}" = Adobe Reader 9.2
"{BC339BFD-F550-471a-8D26-4D08126C62F7}" = SkinsHP2
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C337BDAF-CB4E-47E2-BE1A-CB31BB7DD0E3}" = Apple Mobile Device Support
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CBE3E0AF-73BB-4c21-8B96-B09E003EDE7F}" = QuickProjects
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D2FCC1AE-6311-47C5-8130-C6C66D77DD71}" = Nikon Message Center
"{E8BFBD0A-8002-4dc9-869C-E495FA9DCE7A}" = PhotoGallery
"{E9757890-7EC5-46C8-99AB-B00F07B6525C}" = Nikon Transfer
"{F007CBCE-D714-4C0B-8CE9-9B0D78116468}" = ViewNX
"{FB08F381-6533-4108-B7DD-039E11FBC27E}" = Realtek AC'97 Audio
"{FBBF532A-47AC-457d-AC06-0D3163D8911E}" = WebReg
"{FF102450-55AA-4AE1-ACE4-E271E2470C83}" = hpmdtab
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player
"BookWorm Deluxe 1.0y" = BookWorm Deluxe 1.0y
"DriverAgent.exe" = DriverAgent by TouchStone Software
"HijackThis" = HijackThis 2.0.2
"HP Photo & Imaging" = HP Image Zone 4.2
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"InfraRecorder" = InfraRecorder
"LiveUpdate" = LiveUpdate 3.3 (Symantec Corporation)
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.5.7)" = Mozilla Firefox (3.5.7)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"Q828026" = Windows Media Player Hotfix [See Q828026 for more information]
"Uninstall_is1" = Uninstall 1.0.0.1
"VLC media player" = VideoLAN VLC media player 0.8.6i
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 8/20/2009 1:42:40 AM | Computer Name = WHITTLEDT01 | Source = Application Hang | ID = 1002
Description = Hanging application MSPUB.EXE, version 6.0.1.427, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 8/20/2009 9:34:19 PM | Computer Name = WHITTLEDT01 | Source = Application Hang | ID = 1002
Description = Hanging application WINWORD.EXE, version 10.0.2627.0, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 8/26/2009 2:17:45 AM | Computer Name = WHITTLEDT01 | Source = Application Hang | ID = 1002
Description = Hanging application WINWORD.EXE, version 10.0.2627.0, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 8/26/2009 2:17:45 AM | Computer Name = WHITTLEDT01 | Source = Application Hang | ID = 1002
Description = Hanging application WINWORD.EXE, version 10.0.2627.0, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 8/31/2009 10:23:31 PM | Computer Name = WHITTLEDT01 | Source = Application Hang | ID = 1002
Description = Hanging application firefox.exe, version 1.9.0.3498, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 9/12/2009 11:30:51 PM | Computer Name = WHITTLEDT01 | Source = Application Hang | ID = 1002
Description = Hanging application ViewNX.exe, version 1.0.3.3004, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 10/5/2009 12:49:29 AM | Computer Name = WHITTLEDT01 | Source = Application Hang | ID = 1002
Description = Hanging application FreeVideoToiPodConverter.exe, version 3.1.2.1,
hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 10/16/2009 12:45:50 PM | Computer Name = WHITTLEDT01 | Source = Windows Search Service | ID = 3013
Description =

Error - 10/30/2009 7:30:10 PM | Computer Name = WHITTLEDT01 | Source = Windows Search Service | ID = 3013
Description =

Error - 10/30/2009 7:30:10 PM | Computer Name = WHITTLEDT01 | Source = Windows Search Service | ID = 3013
Description =

[ System Events ]
Error - 1/23/2010 6:48:53 AM | Computer Name = WHITTLEDT01 | Source = Service Control Manager | ID = 7001
Description = The Apple Mobile Device service depends on the TCP/IP Protocol Driver
service which failed to start because of the following error: %%31

Error - 1/23/2010 6:48:53 AM | Computer Name = WHITTLEDT01 | Source = Service Control Manager | ID = 7001
Description = The Bonjour Service service depends on the TCP/IP Protocol Driver
service which failed to start because of the following error: %%31

Error - 1/23/2010 6:48:53 AM | Computer Name = WHITTLEDT01 | Source = Service Control Manager | ID = 7001
Description = The IPSEC Services service depends on the IPSEC driver service which
failed to start because of the following error: %%31

Error - 1/23/2010 6:48:53 AM | Computer Name = WHITTLEDT01 | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
AFD Fips intelppm IPSec mfehidk MPFP MRxSmb NetBIOS NetBT RasAcd Rdbss Tcpip

Error - 1/23/2010 6:49:08 AM | Computer Name = WHITTLEDT01 | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service EventSystem
with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 1/23/2010 6:49:38 AM | Computer Name = WHITTLEDT01 | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service netman with
arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}

Error - 1/23/2010 6:49:47 AM | Computer Name = WHITTLEDT01 | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service EventSystem
with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 1/23/2010 6:51:34 AM | Computer Name = WHITTLEDT01 | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service EventSystem
with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 1/23/2010 6:58:14 AM | Computer Name = WHITTLEDT01 | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the IMAPI CD-Burning COM
Service service to connect.

Error - 1/23/2010 6:58:14 AM | Computer Name = WHITTLEDT01 | Source = Service Control Manager | ID = 7000
Description = The IMAPI CD-Burning COM Service service failed to start due to the
following error: %%1053

< End of report >

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.html [@ = htmlfile] – C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = htmlfile] – Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
htmlfile – "C:\Program Files\Microsoft Office\Office10\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [open] – "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)
htmlfile [opennew] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] – "C:\Program Files\Microsoft Office\Office10\msohtmed.exe" /p %1 (Microsoft Corporation)
http [open] – "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)
https [open] – "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] – "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] – "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\AVG\AVG8\avgemc.exe" = C:\Program Files\AVG\AVG8\avgemc.exe:*:Enabled:avgemc.exe – File not found
"C:\Program Files\AVG\AVG8\avgupd.exe" = C:\Program Files\AVG\AVG8\avgupd.exe:*:Enabled:avgupd.exe – File not found
"C:\Program Files\Bonjour\mDNSResponder.exe" = C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour – (Apple Inc.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00140409-78E1-11D2-B60F-006097C998E7}" = Microsoft Publisher 2000
"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
"{1451DE6B-ABE1-4F62-BE9A-B363A17588A2}" = QuickTime
"{1F63ED0B-EDD2-4037-B6AB-1358C624AF48}" = Scan
"{1F7473D9-6C0B-4F5A-8FA4-AB8AD78CBE54}" = DocProc
"{26A24AE4-039D-4CA4-87B4-2F83216018FF}" = Java™ 6 Update 18
"{29B50D30-EAFC-4cea-9F76-3A0E3729E9B0}" = SkinsHP1
"{2E132061-C78A-48D4-A899-1D13B9D189FA}" = Memories Disc Creator 2.0
"{3248F0A8-6813-11D6-A77B-00B0D0160060}" = Java™ 6 Update 6
"{34957B51-9676-41CE-9E52-44AE91B73F1C}" = HP Software Update
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{39D4FB9C-9CDE-4449-BD2B-6AD4D376CFDC}" = Art Explosion Publisher Pro 2.0
"{3CF78481-FB7B-4B51-99A2-D5E0CD0B3AAF}" = HPSystemDiagnostics
"{3FA365DF-2D68-45ED-8F83-8C8A33E65143}" = Apple Application Support
"{48242276-DB89-42e8-9678-BD4280D7B99A}" = Copy
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{595D0DE8-C38A-4432-B851-47DECC1A99BD}" = HP Unload DLL Patch
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{723C033E-63EA-4227-BAB2-0AA8693C16EB}" = Director
"{745A92AF-53B4-41A7-91C3-9B026B1D5897}" = InstantShare
"{766273C1-A39B-47EB-ACE8-DEBDD8094BCC}" = overland
"{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com
"{81DD5688-695A-4c1d-AE7D-368BF857725A}" = TrayApp
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{87441A59-5E64-4096-A170-14EFE67200C3}" = Picture Control Utility
"{8777AC6D-89F9-4793-8266-DE406F343E89}" = QFolder
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90280409-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional with FrontPage
"{9B03C535-3AEA-4ef2-B326-0A01A2207034}" = CreativeProjects
"{A1062847-0846-427A-92A1-BB8251A91E91}" = HP PSC & OfficeJet 4.2
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A4EA3AB4-E78C-4286-96DF-26035507CE55}" = AiO_Scan
"{AC76BA86-7AD7-1033-7B44-A92000000001}" = Adobe Reader 9.2
"{BC339BFD-F550-471a-8D26-4D08126C62F7}" = SkinsHP2
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C337BDAF-CB4E-47E2-BE1A-CB31BB7DD0E3}" = Apple Mobile Device Support
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CBE3E0AF-73BB-4c21-8B96-B09E003EDE7F}" = QuickProjects
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D2FCC1AE-6311-47C5-8130-C6C66D77DD71}" = Nikon Message Center
"{E8BFBD0A-8002-4dc9-869C-E495FA9DCE7A}" = PhotoGallery
"{E9757890-7EC5-46C8-99AB-B00F07B6525C}" = Nikon Transfer
"{F007CBCE-D714-4C0B-8CE9-9B0D78116468}" = ViewNX
"{FB08F381-6533-4108-B7DD-039E11FBC27E}" = Realtek AC'97 Audio
"{FBBF532A-47AC-457d-AC06-0D3163D8911E}" = WebReg
"{FF102450-55AA-4AE1-ACE4-E271E2470C83}" = hpmdtab
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player
"BookWorm Deluxe 1.0y" = BookWorm Deluxe 1.0y
"DriverAgent.exe" = DriverAgent by TouchStone Software
"HijackThis" = HijackThis 2.0.2
"HP Photo & Imaging" = HP Image Zone 4.2
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"InfraRecorder" = InfraRecorder
"LiveUpdate" = LiveUpdate 3.3 (Symantec Corporation)
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.5.7)" = Mozilla Firefox (3.5.7)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"Q828026" = Windows Media Player Hotfix [See Q828026 for more information]
"Uninstall_is1" = Uninstall 1.0.0.1
"VLC media player" = VideoLAN VLC media player 0.8.6i
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 8/20/2009 1:42:40 AM | Computer Name = WHITTLEDT01 | Source = Application Hang | ID = 1002
Description = Hanging application MSPUB.EXE, version 6.0.1.427, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 8/20/2009 9:34:19 PM | Computer Name = WHITTLEDT01 | Source = Application Hang | ID = 1002
Description = Hanging application WINWORD.EXE, version 10.0.2627.0, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 8/26/2009 2:17:45 AM | Computer Name = WHITTLEDT01 | Source = Application Hang | ID = 1002
Description = Hanging application WINWORD.EXE, version 10.0.2627.0, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 8/26/2009 2:17:45 AM | Computer Name = WHITTLEDT01 | Source = Application Hang | ID = 1002
Description = Hanging application WINWORD.EXE, version 10.0.2627.0, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 8/31/2009 10:23:31 PM | Computer Name = WHITTLEDT01 | Source = Application Hang | ID = 1002
Description = Hanging application firefox.exe, version 1.9.0.3498, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 9/12/2009 11:30:51 PM | Computer Name = WHITTLEDT01 | Source = Application Hang | ID = 1002
Description = Hanging application ViewNX.exe, version 1.0.3.3004, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 10/5/2009 12:49:29 AM | Computer Name = WHITTLEDT01 | Source = Application Hang | ID = 1002
Description = Hanging application FreeVideoToiPodConverter.exe, version 3.1.2.1,
hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 10/16/2009 12:45:50 PM | Computer Name = WHITTLEDT01 | Source = Windows Search Service | ID = 3013
Description =

Error - 10/30/2009 7:30:10 PM | Computer Name = WHITTLEDT01 | Source = Windows Search Service | ID = 3013
Description =

Error - 10/30/2009 7:30:10 PM | Computer Name = WHITTLEDT01 | Source = Windows Search Service | ID = 3013
Description =

[ System Events ]
Error - 1/23/2010 6:48:53 AM | Computer Name = WHITTLEDT01 | Source = Service Control Manager | ID = 7001
Description = The Apple Mobile Device service depends on the TCP/IP Protocol Driver
service which failed to start because of the following error: %%31

Error - 1/23/2010 6:48:53 AM | Computer Name = WHITTLEDT01 | Source = Service Control Manager | ID = 7001
Description = The Bonjour Service service depends on the TCP/IP Protocol Driver
service which failed to start because of the following error: %%31

Error - 1/23/2010 6:48:53 AM | Computer Name = WHITTLEDT01 | Source = Service Control Manager | ID = 7001
Description = The IPSEC Services service depends on the IPSEC driver service which
failed to start because of the following error: %%31

Error - 1/23/2010 6:48:53 AM | Computer Name = WHITTLEDT01 | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
AFD Fips intelppm IPSec mfehidk MPFP MRxSmb NetBIOS NetBT RasAcd Rdbss Tcpip

Error - 1/23/2010 6:49:08 AM | Computer Name = WHITTLEDT01 | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service EventSystem
with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 1/23/2010 6:49:38 AM | Computer Name = WHITTLEDT01 | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service netman with
arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}

Error - 1/23/2010 6:49:47 AM | Computer Name = WHITTLEDT01 | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service EventSystem
with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 1/23/2010 6:51:34 AM | Computer Name = WHITTLEDT01 | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service EventSystem
with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 1/23/2010 6:58:14 AM | Computer Name = WHITTLEDT01 | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the IMAPI CD-Burning COM
Service service to connect.

Error - 1/23/2010 6:58:14 AM | Computer Name = WHITTLEDT01 | Source = Service Control Manager | ID = 7000
Description = The IMAPI CD-Burning COM Service service failed to start due to the
following error: %%1053

< End of report >

RPMcMurphy

Post #6January 24, 2010, 11:24 PM UTC

chiefw,

Can you re-post the OTL.txt log for me please? It looks like something went wrong with your cut & paste. I only need OTL.txt; the others are fine. If you'd rather, you may attach it as well.

chiefw

Post #7January 25, 2010, 12:08 AM UTC

Is this OK

OTL logfile created on: 1/24/2010 1:03:14 PM - Run 1
OTL by OldTimer - Version 3.1.26.0 Folder = C:\Documents and Settings\Owner\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

512.00 Mb Total Physical Memory | 216.00 Mb Available Physical Memory | 42.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 82.00% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 111.79 Gb Total Space | 97.50 Gb Free Space | 87.22% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
Drive H: | 298.09 Gb Total Space | 43.13 Gb Free Space | 14.47% Space Free | Partition Type: NTFS
I: Drive not present or media not loaded

Computer Name: WHITTLEDT01
Current User Name: Owner
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Owner\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\Common Files\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe (Nikon Corporation)
PRC - C:\WINDOWS\soundman.exe (Realtek Semiconductor Corp.)
PRC - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
PRC - C:\Program Files\HP\HP Software Update\hpwuSchd.exe (Hewlett-Packard)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Owner\Desktop\OTL.exe (OldTimer Tools)

========== Win32 Services (SafeList) ==========

SRV - (JavaQuickStarterService) – C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)
SRV - (LiveUpdate) – C:\Program Files\Symantec\LiveUpdate\LuComServer_3_3.EXE (Symantec Corporation)
SRV - (Apple Mobile Device) – C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (Bonjour Service) – C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.)
SRV - (IDriverT) – C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe (Macrovision Corporation)
SRV - (Pml Driver HPZ12) – C:\WINDOWS\system32\hpzipm12.exe (HP)

========== Driver Services (SafeList) ==========

DRV - (mfehidk) – C:\WINDOWS\system32\drivers\mfehidk.sys (McAfee, Inc.)
DRV - (mferkdk) – C:\WINDOWS\system32\drivers\mferkdk.sys (McAfee, Inc.)
DRV - (MPFP) – C:\WINDOWS\system32\drivers\Mpfp.sys (McAfee, Inc.)
DRV - (TVICHW32) – C:\WINDOWS\system32\drivers\TVICHW32.SYS (EnTech Taiwan)
DRV - (GEARAspiWDM) – C:\WINDOWS\system32\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV - (Secdrv) – C:\WINDOWS\system32\drivers\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
DRV - (Ptilink) – C:\WINDOWS\system32\drivers\ptilink.sys (Parallel Technologies, Inc.)
DRV - (gameenum) – C:\WINDOWS\system32\drivers\gameenum.sys (Microsoft Corporation)
DRV - (ati2mtag) – C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (ALCXWDM) Service for Realtek AC97 Audio (WDM) – C:\WINDOWS\system32\drivers\alcxwdm.sys (Realtek Semiconductor Corp.)
DRV - (HPZipr12) – C:\WINDOWS\system32\drivers\HPZipr12.sys (HP)
DRV - (AFS2K) – C:\WINDOWS\system32\drivers\AFS2K.SYS (Oak Technology Inc.)
DRV - (HPZid412) – C:\WINDOWS\system32\drivers\hpzid412.sys (HP)
DRV - (HPZius12) – C:\WINDOWS\system32\drivers\HPZius12.sys (HP)
DRV - (ac97intc) Intel® 82801 Audio Driver Install Service (WDM) – C:\WINDOWS\system32\drivers\ac97intc.sys (Intel Corporation)
DRV - (EL90XBC) – C:\WINDOWS\system32\drivers\el90xbc5.sys (3Com Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.foxnews.com"
FF - prefs.js..extensions.enabledItems: [removed]:1.0

FF - HKLM\software\mozilla\Mozilla Firefox 3.5.7\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/01/07 19:38:35 | 00,000,000 | -H-D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.7\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/01/22 20:44:08 | 00,000,000 | -H-D | M]

[2008/08/13 15:41:58 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Mozilla\Extensions
[2010/01/23 19:34:13 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\lgvoh5ur.default\extensions
[2008/08/13 15:41:58 | 00,000,000 | —D | M] (DriverAgent Plugin for Firefox and Opera) – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\lgvoh5ur.default\extensions\{F8CC37C3-CBEB-4A00-8CBF-26A88693F0C5}
[2010/01/23 19:34:13 | 00,000,000 | -H-D | M] – C:\Program Files\Mozilla Firefox\extensions

O1 HOSTS File: ([2010/01/20 21:26:54 | 00,000,021 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll File not found
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [Adobe ARM] C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [DXDllRegExe] File not found
O4 - HKLM..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd.exe (Hewlett-Packard)
O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\QTTask.exe (Apple Inc.)
O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\soundman.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Common Files\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKCU..\RunOnce: [Shockwave Updater] C:\WINDOWS\System32\Adobe\SHOCKW~1\SWHELP~1.EXE -Update -1100465 -Mozilla\5.0 ( File not found
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation)
O4 - Startup: C:\Documents and Settings\Owner\Start Menu\Programs\Startup\Nikon Monitor.lnk = C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe (Nikon Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office10\EXCEL.EXE (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://www.update.microsoft.com/windowsupd…b?1218672405234 (WUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_06)
O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/08/13 14:20:56 | 00,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O33 - MountPoints2\{46d2a3dc-0f86-11de-9ef7-000475be28e9}\Shell\AutoRun\command - "" = I:\setupSNK.exe – File not found
O33 - MountPoints2\{6690eee4-cb56-11de-8d62-000475be28e9}\Shell\AutoRun\command - "" = I:\RunUltraLock.exe – File not found
O33 - MountPoints2\{a8439c41-b6a0-11de-9f29-000475be28e9}\Shell\AutoRun\command - "" = I:\RunUltraLock.exe – File not found
O33 - MountPoints2\{b24b0043-6a59-11dd-ac95-000475be28e9}\Shell\AutoRun\command - "" = wdsync.exe
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - comfile [open] – "%1" %*
O35 - exefile [open] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/01/24 13:00:42 | 00,547,328 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Owner\Desktop\OTL.exe
[2010/01/22 22:28:21 | 00,000,000 | —D | C] – C:\Program Files\Spybot - Search & Destroy
[2010/01/22 21:22:17 | 00,000,000 | —D | C] – C:\Program Files\Symantec
[2010/01/22 20:44:41 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Sun
[2010/01/22 20:44:07 | 00,411,368 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\deploytk.dll
[2010/01/22 20:44:07 | 00,153,376 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaws.exe
[2010/01/22 20:44:07 | 00,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaw.exe
[2010/01/22 20:44:06 | 00,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\java.exe
[2010/01/22 18:57:11 | 00,000,000 | —D | C] – C:\WINDOWS\Minidump
[2010/01/22 17:49:28 | 00,050,688 | —- | C] (Atribune.org) – C:\Documents and Settings\Owner\Desktop\ATF_Cleaner.exe
[2010/01/22 17:43:13 | 00,000,000 | –SD | M] – C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2010/01/22 17:43:13 | 00,000,000 | –SD | M] – C:\Documents and Settings\LocalService\Application Data\Microsoft
[2010/01/22 17:43:13 | 00,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
[2010/01/22 17:43:13 | 00,000,000 | —D | M] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[2010/01/21 21:16:58 | 00,000,000 | —D | C] – C:\Documents and Settings\Owner\Desktop\backups
[2010/01/21 21:15:01 | 00,401,720 | —- | C] (Trend Micro Inc.) – C:\Documents and Settings\Owner\Desktop\HijackThis.exe
[2010/01/21 19:06:01 | 00,000,000 | —D | C] – C:\Documents and Settings\Owner\Application Data\AVG8
[2010/01/20 22:48:59 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\SiteAdvisor
[2010/01/20 22:48:13 | 00,000,000 | —D | M] – C:\Documents and Settings\LocalService\Application Data\SACore
[2010/01/20 22:16:46 | 00,120,136 | —- | C] (McAfee, Inc.) – C:\WINDOWS\System32\drivers\Mpfp.sys
[2010/01/20 21:34:24 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\RegAce
[2010/01/20 21:34:21 | 00,000,000 | -H-D | C] – C:\Program Files\RegAce
[2010/01/20 21:23:23 | 00,000,000 | —D | C] – C:\Spyware
[2010/01/20 21:13:09 | 00,000,000 | -H-D | C] – C:\Program Files\Common Files\McAfee
[2010/01/20 21:12:36 | 00,000,000 | -H-D | C] – C:\Program Files\McAfee
[2010/01/20 21:10:26 | 00,034,248 | —- | C] (McAfee, Inc.) – C:\WINDOWS\System32\drivers\mferkdk.sys
[2010/01/20 21:09:56 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\McAfee
[2010/01/20 20:21:36 | 00,000,000 | —D | C] – C:\WINDOWS\pss
[2010/01/20 19:35:46 | 00,511,328 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\capicom.dll
[2010/01/20 19:35:05 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Symantec
[2010/01/20 19:32:41 | 00,000,000 | —D | C] – C:\SEP
[2008/10/23 15:45:04 | 00,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Apple
[2008/09/10 12:30:06 | 00,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2008/09/10 12:30:06 | 00,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Application Data\Adobe
[2008/08/14 10:28:28 | 00,000,000 | —D | M] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Adobe
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/01/24 12:59:20 | 00,284,915 | —- | M] () – C:\Documents and Settings\Owner\Desktop\gmer.zip
[2010/01/24 12:58:22 | 00,547,328 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Owner\Desktop\OTL.exe
[2010/01/23 02:32:07 | 00,000,664 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/01/23 01:57:39 | 00,002,422 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/01/23 01:52:31 | 00,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/01/23 01:52:23 | 00,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/01/23 01:52:16 | 53,644,9024 | -HS- | M] () – C:\hiberfil.sys
[2010/01/23 01:51:35 | 05,242,880 | -H– | M] () – C:\Documents and Settings\Owner\NTUSER.DAT
[2010/01/23 01:51:35 | 00,000,178 | -HS- | M] () – C:\Documents and Settings\Owner\ntuser.ini
[2010/01/23 01:51:33 | 03,184,656 | -H– | M] () – C:\Documents and Settings\Owner\Local Settings\Application Data\IconCache.db
[2010/01/23 01:39:51 | 00,103,936 | —- | M] () – C:\Documents and Settings\Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/01/22 23:21:03 | 00,026,112 | —- | M] () – C:\Documents and Settings\Owner\Desktop\Ten.doc
[2010/01/22 21:28:33 | 00,002,369 | —- | M] () – C:\Documents and Settings\All Users\Application Data\LUUnInstall.LiveUpdate
[2010/01/22 20:43:28 | 00,411,368 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\deploytk.dll
[2010/01/22 20:43:28 | 00,153,376 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaws.exe
[2010/01/22 20:43:28 | 00,145,184 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaw.exe
[2010/01/22 20:43:28 | 00,145,184 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\java.exe
[2010/01/22 20:43:28 | 00,073,728 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javacpl.cpl
[2010/01/22 20:43:00 | 00,441,124 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/01/22 20:43:00 | 00,071,060 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2010/01/22 18:55:45 | 00,096,512 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\atapi.sys
[2010/01/22 18:55:24 | 00,057,706 | —- | M] () – C:\WINDOWS\System32\net.net
[2010/01/22 18:37:54 | 00,000,000 | —- | M] () – C:\Documents and Settings\Owner\settings.dat
[2010/01/22 18:20:24 | 00,290,816 | —- | M] () – C:\Documents and Settings\Owner\Desktop\exeHelper.com
[2010/01/22 17:49:28 | 00,050,688 | —- | M] (Atribune.org) – C:\Documents and Settings\Owner\Desktop\ATF_Cleaner.exe
[2010/01/21 21:15:01 | 00,401,720 | —- | M] (Trend Micro Inc.) – C:\Documents and Settings\Owner\Desktop\HijackThis.exe
[2010/01/21 20:53:28 | 00,000,594 | —- | M] () – C:\WINDOWS\win.ini
[2010/01/21 20:53:28 | 00,000,227 | —- | M] () – C:\WINDOWS\system.ini
[2010/01/21 20:53:28 | 00,000,211 | -HS- | M] () – C:\boot.ini
[2010/01/21 19:04:55 | 00,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2010/01/21 16:45:01 | 00,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/01/20 21:26:54 | 00,000,021 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2010/01/20 13:13:02 | 00,000,000 | —- | M] () – C:\Documents and Settings\Owner\Local Settings\Application Data\prvlcl.dat
[2010/01/20 12:52:17 | 00,000,008 | —- | M] () – C:\Documents and Settings\All Users\Application Data\sysReserve.ini
[2010/01/13 12:11:19 | 00,037,376 | —- | M] () – C:\Documents and Settings\Owner\Desktop\Scout Roster.xls
[2010/01/06 19:08:17 | 00,068,608 | —- | M] () – C:\Documents and Settings\Owner\Desktop\calendar.xls
[2010/01/05 22:16:47 | 00,104,470 | —- | M] () – C:\Documents and Settings\Owner\Desktop\Jan 10 Current_Troop_38_Calender.pdf
[2010/01/05 20:50:33 | 00,002,483 | —- | M] () – C:\Documents and Settings\Owner\Desktop\Microsoft Word.lnk
[2010/01/05 19:05:36 | 00,002,481 | —- | M] () – C:\Documents and Settings\Owner\Desktop\Microsoft Excel.lnk
[2010/01/05 01:00:29 | 00,832,512 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wininet.dll
[2010/01/05 01:00:28 | 01,168,384 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\urlmon.dll
[2010/01/05 01:00:28 | 00,671,232 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\mstime.dll
[2010/01/05 01:00:28 | 00,671,232 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mstime.dll
[2010/01/05 01:00:28 | 00,233,472 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\webcheck.dll
[2010/01/05 01:00:28 | 00,105,984 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\url.dll
[2010/01/05 01:00:28 | 00,105,984 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\url.dll
[2010/01/05 01:00:28 | 00,102,912 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\occache.dll
[2010/01/05 01:00:28 | 00,044,544 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\pngfilt.dll
[2010/01/05 01:00:28 | 00,044,544 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\pngfilt.dll
[2010/01/05 01:00:27 | 00,477,696 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mshtmled.dll
[2010/01/05 01:00:27 | 00,193,024 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\msrating.dll
[2010/01/05 01:00:27 | 00,193,024 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msrating.dll
[2010/01/05 01:00:26 | 03,599,360 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mshtml.dll
[2010/01/05 01:00:25 | 00,052,224 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\msfeedsbs.dll
[2010/01/05 01:00:25 | 00,052,224 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msfeedsbs.dll
[2010/01/05 01:00:24 | 01,830,912 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\inetcpl.cpl
[2010/01/05 01:00:24 | 01,830,912 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\inetcpl.cpl
[2010/01/05 01:00:24 | 00,459,264 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\msfeeds.dll
[2010/01/05 01:00:24 | 00,459,264 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msfeeds.dll
[2010/01/05 01:00:24 | 00,268,288 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iertutil.dll
[2010/01/05 01:00:24 | 00,192,512 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\iepeers.dll
[2010/01/05 01:00:24 | 00,192,512 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iepeers.dll
[2010/01/05 01:00:24 | 00,044,544 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\iernonce.dll
[2010/01/05 01:00:24 | 00,044,544 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iernonce.dll
[2010/01/05 01:00:24 | 00,027,648 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\jsproxy.dll
[2010/01/05 01:00:24 | 00,027,648 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\jsproxy.dll
[2010/01/05 01:00:23 | 06,067,200 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ieframe.dll
[2010/01/05 01:00:21 | 00,385,024 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\iedkcs32.dll
[2010/01/05 01:00:21 | 00,385,024 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iedkcs32.dll
[2010/01/05 01:00:21 | 00,380,928 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\ieapfltr.dll
[2010/01/05 01:00:21 | 00,380,928 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ieapfltr.dll
[2010/01/05 01:00:21 | 00,230,400 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\ieaksie.dll
[2010/01/05 01:00:21 | 00,230,400 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ieaksie.dll
[2010/01/05 01:00:21 | 00,214,528 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dxtrans.dll
[2010/01/05 01:00:21 | 00,214,528 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\dxtrans.dll
[2010/01/05 01:00:21 | 00,153,088 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\ieakeng.dll
[2010/01/05 01:00:21 | 00,153,088 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ieakeng.dll
[2010/01/05 01:00:21 | 00,133,120 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\extmgr.dll
[2010/01/05 01:00:21 | 00,078,336 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\ieencode.dll
[2010/01/05 01:00:21 | 00,078,336 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ieencode.dll
[2010/01/05 01:00:21 | 00,063,488 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\icardie.dll
[2010/01/05 01:00:20 | 00,347,136 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dxtmsft.dll
[2010/01/05 01:00:20 | 00,347,136 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\dxtmsft.dll
[2010/01/05 01:00:20 | 00,124,928 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\advpack.dll
[2010/01/05 01:00:20 | 00,124,928 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\advpack.dll
[2010/01/05 01:00:20 | 00,017,408 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\corpol.dll
[2010/01/05 01:00:20 | 00,017,408 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\corpol.dll
[2009/12/31 06:33:27 | 00,389,120 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\html.iec
[2009/12/31 06:33:06 | 00,070,656 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\ie4uinit.exe
[2009/12/31 06:33:06 | 00,070,656 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ie4uinit.exe
[2009/12/31 06:33:06 | 00,013,824 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\ieudinit.exe
[2009/12/31 06:33:06 | 00,013,824 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ieudinit.exe
[2009/12/29 15:10:17 | 00,000,020 | -H– | M] () – C:\Documents and Settings\All Users\Application Data\PKP_DLdu.DAT
[2009/12/29 13:54:29 | 00,000,352 | —- | M] () – C:\WINDOWS\ViewNX.INI
[2009/12/29 13:54:04 | 00,000,020 | -H– | M] () – C:\Documents and Settings\All Users\Application Data\PKP_DLdw.DAT
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/01/24 13:00:47 | 00,284,915 | —- | C] () – C:\Documents and Settings\Owner\Desktop\gmer.zip
[2010/01/23 02:32:07 | 00,000,664 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/01/23 01:52:16 | 53,644,9024 | -HS- | C] () – C:\hiberfil.sys
[2010/01/22 21:28:27 | 00,002,369 | —- | C] () – C:\Documents and Settings\All Users\Application Data\LUUnInstall.LiveUpdate
[2010/01/22 18:55:24 | 00,057,706 | —- | C] () – C:\WINDOWS\System32\net.net
[2010/01/22 18:37:54 | 00,000,000 | —- | C] () – C:\Documents and Settings\Owner\settings.dat
[2010/01/22 18:20:24 | 00,290,816 | —- | C] () – C:\Documents and Settings\Owner\Desktop\exeHelper.com
[2010/01/20 20:48:26 | 00,001,815 | —- | C] () – C:\Documents and Settings\Owner\Start Menu\Programs\Startup\Nikon Monitor.lnk
[2010/01/20 20:48:26 | 00,001,808 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
[2010/01/20 20:48:26 | 00,001,730 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
[2010/01/20 12:52:17 | 00,000,008 | —- | C] () – C:\Documents and Settings\All Users\Application Data\sysReserve.ini
[2010/01/06 18:57:32 | 00,068,608 | —- | C] () – C:\Documents and Settings\Owner\Desktop\calendar.xls
[2010/01/05 22:16:46 | 00,104,470 | —- | C] () – C:\Documents and Settings\Owner\Desktop\Jan 10 Current_Troop_38_Calender.pdf
[2009/11/27 23:56:40 | 00,000,000 | —- | C] () – C:\Documents and Settings\Owner\Local Settings\Application Data\prvlcl.dat
[2009/01/05 18:14:24 | 00,000,352 | —- | C] () – C:\WINDOWS\ViewNX.INI
[2009/01/05 18:08:06 | 00,000,268 | RH– | C] () – C:\Documents and Settings\All Users\Application Data\Displays
[2009/01/05 18:08:06 | 00,000,268 | RH– | C] () – C:\Documents and Settings\Owner\Application Data\Digital Basic
[2009/01/05 18:08:06 | 00,000,020 | -H– | C] () – C:\Documents and Settings\All Users\Application Data\PKP_DLdw.DAT
[2009/01/05 18:05:07 | 00,000,268 | RH– | C] () – C:\Documents and Settings\All Users\Application Data\Digital Mono
[2009/01/05 18:05:07 | 00,000,268 | RH– | C] () – C:\Documents and Settings\Owner\Application Data\Dialogs
[2009/01/05 18:05:07 | 00,000,020 | -H– | C] () – C:\Documents and Settings\All Users\Application Data\PKP_DLdu.DAT
[2008/08/22 21:55:58 | 00,000,128 | —- | C] () – C:\Documents and Settings\Owner\Local Settings\Application Data\fusioncache.dat
[2008/08/14 14:40:44 | 00,103,936 | —- | C] () – C:\Documents and Settings\Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/08/14 14:36:23 | 00,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2008/08/14 13:36:16 | 00,002,530 | —- | C] () – C:\Documents and Settings\All Users\Application Data\hpzinstall.log
[2008/08/13 15:06:09 | 00,147,456 | —- | C] () – C:\WINDOWS\System32\RtlCPAPI.dll
[2008/04/14 03:00:00 | 00,037,376 | —- | C] () – C:\WINDOWS\g3rtrv.dll

========== LOP Check ==========

[2009/01/05 18:05:07 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Analog Pad
[2009/01/05 18:08:06 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Automator
[2010/01/22 17:44:29 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\avg9
[2009/01/05 18:08:06 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\EnterNHelp
[2009/01/05 18:06:56 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Nikon
[2010/01/20 21:34:24 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\RegAce
[2008/08/29 15:56:28 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2009/01/05 18:08:06 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Ultima_T15
[2009/06/14 18:04:45 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2008/08/29 14:43:27 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\InfraRecorder
[2009/03/07 21:10:00 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Nikon
[2008/08/21 09:12:37 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Nova Development

========== Purity Check ==========

========== Alternate Data Streams ==========

@Alternate Data Stream - 109 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:92412C7B
< End of report >
SRV - (JavaQuickStarterService) – C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)
SRV - (LiveUpdate) – C:\Program Files\Symantec\LiveUpdate\LuComServer_3_3.EXE (Symantec Corporation)
SRV - (Apple Mobile Device) – C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (Bonjour Service) – C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.)
SRV - (IDriverT) – C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe (Macrovision Corporation)
SRV - (Pml Driver HPZ12) – C:\WINDOWS\system32\hpzipm12.exe (HP)

========== Driver Services (SafeList) ==========

DRV - (mfehidk) – C:\WINDOWS\system32\drivers\mfehidk.sys (McAfee, Inc.)
DRV - (mferkdk) – C:\WINDOWS\system32\drivers\mferkdk.sys (McAfee, Inc.)
DRV - (MPFP) – C:\WINDOWS\system32\drivers\Mpfp.sys (McAfee, Inc.)
DRV - (TVICHW32) – C:\WINDOWS\system32\drivers\TVICHW32.SYS (EnTech Taiwan)
DRV - (GEARAspiWDM) – C:\WINDOWS\system32\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV - (Secdrv) – C:\WINDOWS\system32\drivers\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
DRV - (Ptilink) – C:\WINDOWS\system32\drivers\ptilink.sys (Parallel Technologies, Inc.)
DRV - (gameenum) – C:\WINDOWS\system32\drivers\gameenum.sys (Microsoft Corporation)
DRV - (ati2mtag) – C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (ALCXWDM) Service for Realtek AC97 Audio (WDM) – C:\WINDOWS\system32\drivers\alcxwdm.sys (Realtek Semiconductor Corp.)
DRV - (HPZipr12) – C:\WINDOWS\system32\drivers\HPZipr12.sys (HP)
DRV - (AFS2K) – C:\WINDOWS\system32\drivers\AFS2K.SYS (Oak Technology Inc.)
DRV - (HPZid412) – C:\WINDOWS\system32\drivers\hpzid412.sys (HP)
DRV - (HPZius12) – C:\WINDOWS\system32\drivers\HPZius12.sys (HP)
DRV - (ac97intc) Intel® 82801 Audio Driver Install Service (WDM) – C:\WINDOWS\system32\drivers\ac97intc.sys (Intel Corporation)
DRV - (EL90XBC) – C:\WINDOWS\system32\drivers\el90xbc5.sys (3Com Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.foxnews.com"
FF - prefs.js..extensions.enabledItems: [removed]:1.0

FF - HKLM\software\mozilla\Mozilla Firefox 3.5.7\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/01/07 19:38:35 | 00,000,000 | -H-D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.7\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/01/22 20:44:08 | 00,000,000 | -H-D | M]

[2008/08/13 15:41:58 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Mozilla\Extensions
[2010/01/23 19:34:13 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\lgvoh5ur.default\extensions
[2008/08/13 15:41:58 | 00,000,000 | —D | M] (DriverAgent Plugin for Firefox and Opera) – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\lgvoh5ur.default\extensions\{F8CC37C3-CBEB-4A00-8CBF-26A88693F0C5}
[2010/01/23 19:34:13 | 00,000,000 | -H-D | M] – C:\Program Files\Mozilla Firefox\extensions

O1 HOSTS File: ([2010/01/20 21:26:54 | 00,000,021 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll File not found
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [Adobe ARM] C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [DXDllRegExe] File not found
O4 - HKLM..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd.exe (Hewlett-Packard)
O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\QTTask.exe (Apple Inc.)
O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\soundman.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Common Files\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKCU..\RunOnce: [Shockwave Updater] C:\WINDOWS\System32\Adobe\SHOCKW~1\SWHELP~1.EXE -Update -1100465 -Mozilla\5.0 ( File not found
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation)
O4 - Startup: C:\Documents and Settings\Owner\Start Menu\Programs\Startup\Nikon Monitor.lnk = C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe (Nikon Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office10\EXCEL.EXE (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://www.update.microsoft.com/windowsupd…b?1218672405234 (WUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_06)
O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/08/13 14:20:56 | 00,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O33 - MountPoints2\{46d2a3dc-0f86-11de-9ef7-000475be28e9}\Shell\AutoRun\command - "" = I:\setupSNK.exe – File not found
O33 - MountPoints2\{6690eee4-cb56-11de-8d62-000475be28e9}\Shell\AutoRun\command - "" = I:\RunUltraLock.exe – File not found
O33 - MountPoints2\{a8439c41-b6a0-11de-9f29-000475be28e9}\Shell\AutoRun\command - "" = I:\RunUltraLock.exe – File not found
O33 - MountPoints2\{b24b0043-6a59-11dd-ac95-000475be28e9}\Shell\AutoRun\command - "" = wdsync.exe
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - comfile [open] – "%1" %*
O35 - exefile [open] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/01/24 13:00:42 | 00,547,328 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Owner\Desktop\OTL.exe
[2010/01/22 22:28:21 | 00,000,000 | —D | C] – C:\Program Files\Spybot - Search & Destroy
[2010/01/22 21:22:17 | 00,000,000 | —D | C] – C:\Program Files\Symantec
[2010/01/22 20:44:41 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Sun
[2010/01/22 20:44:07 | 00,411,368 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\deploytk.dll
[2010/01/22 20:44:07 | 00,153,376 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaws.exe
[2010/01/22 20:44:07 | 00,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaw.exe
[2010/01/22 20:44:06 | 00,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\java.exe
[2010/01/22 18:57:11 | 00,000,000 | —D | C] – C:\WINDOWS\Minidump
[2010/01/22 17:49:28 | 00,050,688 | —- | C] (Atribune.org) – C:\Documents and Settings\Owner\Desktop\ATF_Cleaner.exe
[2010/01/22 17:43:13 | 00,000,000 | –SD | M] – C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2010/01/22 17:43:13 | 00,000,000 | –SD | M] – C:\Documents and Settings\LocalService\Application Data\Microsoft
[2010/01/22 17:43:13 | 00,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
[2010/01/22 17:43:13 | 00,000,000 | —D | M] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[2010/01/21 21:16:58 | 00,000,000 | —D | C] – C:\Documents and Settings\Owner\Desktop\backups
[2010/01/21 21:15:01 | 00,401,720 | —- | C] (Trend Micro Inc.) – C:\Documents and Settings\Owner\Desktop\HijackThis.exe
[2010/01/21 19:06:01 | 00,000,000 | —D | C] – C:\Documents and Settings\Owner\Application Data\AVG8
[2010/01/20 22:48:59 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\SiteAdvisor
[2010/01/20 22:48:13 | 00,000,000 | —D | M] – C:\Documents and Settings\LocalService\Application Data\SACore
[2010/01/20 22:16:46 | 00,120,136 | —- | C] (McAfee, Inc.) – C:\WINDOWS\System32\drivers\Mpfp.sys
[2010/01/20 21:34:24 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\RegAce
[2010/01/20 21:34:21 | 00,000,000 | -H-D | C] – C:\Program Files\RegAce
[2010/01/20 21:23:23 | 00,000,000 | —D | C] – C:\Spyware
[2010/01/20 21:13:09 | 00,000,000 | -H-D | C] – C:\Program Files\Common Files\McAfee
[2010/01/20 21:12:36 | 00,000,000 | -H-D | C] – C:\Program Files\McAfee
[2010/01/20 21:10:26 | 00,034,248 | —- | C] (McAfee, Inc.) – C:\WINDOWS\System32\drivers\mferkdk.sys
[2010/01/20 21:09:56 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\McAfee
[2010/01/20 20:21:36 | 00,000,000 | —D | C] – C:\WINDOWS\pss
[2010/01/20 19:35:46 | 00,511,328 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\capicom.dll
[2010/01/20 19:35:05 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Symantec
[2010/01/20 19:32:41 | 00,000,000 | —D | C] – C:\SEP
[2008/10/23 15:45:04 | 00,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Apple
[2008/09/10 12:30:06 | 00,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2008/09/10 12:30:06 | 00,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Application Data\Adobe
[2008/08/14 10:28:28 | 00,000,000 | —D | M] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Adobe
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/01/24 12:59:20 | 00,284,915 | —- | M] () – C:\Documents and Settings\Owner\Desktop\gmer.zip
[2010/01/24 12:58:22 | 00,547,328 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Owner\Desktop\OTL.exe
[2010/01/23 02:32:07 | 00,000,664 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/01/23 01:57:39 | 00,002,422 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/01/23 01:52:31 | 00,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/01/23 01:52:23 | 00,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/01/23 01:52:16 | 53,644,9024 | -HS- | M] () – C:\hiberfil.sys
[2010/01/23 01:51:35 | 05,242,880 | -H– | M] () – C:\Documents and Settings\Owner\NTUSER.DAT
[2010/01/23 01:51:35 | 00,000,178 | -HS- | M] () – C:\Documents and Settings\Owner\ntuser.ini
[2010/01/23 01:51:33 | 03,184,656 | -H– | M] () – C:\Documents and Settings\Owner\Local Settings\Application Data\IconCache.db
[2010/01/23 01:39:51 | 00,103,936 | —- | M] () – C:\Documents and Settings\Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/01/22 23:21:03 | 00,026,112 | —- | M] () – C:\Documents and Settings\Owner\Desktop\Ten.doc
[2010/01/22 21:28:33 | 00,002,369 | —- | M] () – C:\Documents and Settings\All Users\Application Data\LUUnInstall.LiveUpdate
[2010/01/22 20:43:28 | 00,411,368 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\deploytk.dll
[2010/01/22 20:43:28 | 00,153,376 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaws.exe
[2010/01/22 20:43:28 | 00,145,184 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaw.exe
[2010/01/22 20:43:28 | 00,145,184 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\java.exe
[2010/01/22 20:43:28 | 00,073,728 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javacpl.cpl
[2010/01/22 20:43:00 | 00,441,124 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/01/22 20:43:00 | 00,071,060 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2010/01/22 18:55:45 | 00,096,512 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\atapi.sys
[2010/01/22 18:55:24 | 00,057,706 | —- | M] () – C:\WINDOWS\System32\net.net
[2010/01/22 18:37:54 | 00,000,000 | —- | M] () – C:\Documents and Settings\Owner\settings.dat
[2010/01/22 18:20:24 | 00,290,816 | —- | M] () – C:\Documents and Settings\Owner\Desktop\exeHelper.com
[2010/01/22 17:49:28 | 00,050,688 | —- | M] (Atribune.org) – C:\Documents and Settings\Owner\Desktop\ATF_Cleaner.exe
[2010/01/21 21:15:01 | 00,401,720 | —- | M] (Trend Micro Inc.) – C:\Documents and Settings\Owner\Desktop\HijackThis.exe
[2010/01/21 20:53:28 | 00,000,594 | —- | M] () – C:\WINDOWS\win.ini
[2010/01/21 20:53:28 | 00,000,227 | —- | M] () – C:\WINDOWS\system.ini
[2010/01/21 20:53:28 | 00,000,211 | -HS- | M] () – C:\boot.ini
[2010/01/21 19:04:55 | 00,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2010/01/21 16:45:01 | 00,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/01/20 21:26:54 | 00,000,021 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2010/01/20 13:13:02 | 00,000,000 | —- | M] () – C:\Documents and Settings\Owner\Local Settings\Application Data\prvlcl.dat
[2010/01/20 12:52:17 | 00,000,008 | —- | M] () – C:\Documents and Settings\All Users\Application Data\sysReserve.ini
[2010/01/13 12:11:19 | 00,037,376 | —- | M] () – C:\Documents and Settings\Owner\Desktop\Scout Roster.xls
[2010/01/06 19:08:17 | 00,068,608 | —- | M] () – C:\Documents and Settings\Owner\Desktop\calendar.xls
[2010/01/05 22:16:47 | 00,104,470 | —- | M] () – C:\Documents and Settings\Owner\Desktop\Jan 10 Current_Troop_38_Calender.pdf
[2010/01/05 20:50:33 | 00,002,483 | —- | M] () – C:\Documents and Settings\Owner\Desktop\Microsoft Word.lnk
[2010/01/05 19:05:36 | 00,002,481 | —- | M] () – C:\Documents and Settings\Owner\Desktop\Microsoft Excel.lnk
[2010/01/05 01:00:29 | 00,832,512 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wininet.dll
[2010/01/05 01:00:28 | 01,168,384 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\urlmon.dll
[2010/01/05 01:00:28 | 00,671,232 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\mstime.dll
[2010/01/05 01:00:28 | 00,671,232 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mstime.dll
[2010/01/05 01:00:28 | 00,233,472 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\webcheck.dll
[2010/01/05 01:00:28 | 00,105,984 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\url.dll
[2010/01/05 01:00:28 | 00,105,984 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\url.dll
[2010/01/05 01:00:28 | 00,102,912 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\occache.dll
[2010/01/05 01:00:28 | 00,044,544 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\pngfilt.dll
[2010/01/05 01:00:28 | 00,044,544 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\pngfilt.dll
[2010/01/05 01:00:27 | 00,477,696 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mshtmled.dll
[2010/01/05 01:00:27 | 00,193,024 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\msrating.dll
[2010/01/05 01:00:27 | 00,193,024 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msrating.dll
[2010/01/05 01:00:26 | 03,599,360 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mshtml.dll
[2010/01/05 01:00:25 | 00,052,224 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\msfeedsbs.dll
[2010/01/05 01:00:25 | 00,052,224 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msfeedsbs.dll
[2010/01/05 01:00:24 | 01,830,912 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\inetcpl.cpl
[2010/01/05 01:00:24 | 01,830,912 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\inetcpl.cpl
[2010/01/05 01:00:24 | 00,459,264 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\msfeeds.dll
[2010/01/05 01:00:24 | 00,459,264 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msfeeds.dll
[2010/01/05 01:00:24 | 00,268,288 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iertutil.dll
[2010/01/05 01:00:24 | 00,192,512 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\iepeers.dll
[2010/01/05 01:00:24 | 00,192,512 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iepeers.dll
[2010/01/05 01:00:24 | 00,044,544 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\iernonce.dll
[2010/01/05 01:00:24 | 00,044,544 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iernonce.dll
[2010/01/05 01:00:24 | 00,027,648 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\jsproxy.dll
[2010/01/05 01:00:24 | 00,027,648 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\jsproxy.dll
[2010/01/05 01:00:23 | 06,067,200 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ieframe.dll
[2010/01/05 01:00:21 | 00,385,024 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\iedkcs32.dll
[2010/01/05 01:00:21 | 00,385,024 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iedkcs32.dll
[2010/01/05 01:00:21 | 00,380,928 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\ieapfltr.dll
[2010/01/05 01:00:21 | 00,380,928 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ieapfltr.dll
[2010/01/05 01:00:21 | 00,230,400 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\ieaksie.dll
[2010/01/05 01:00:21 | 00,230,400 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ieaksie.dll
[2010/01/05 01:00:21 | 00,214,528 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dxtrans.dll
[2010/01/05 01:00:21 | 00,214,528 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\dxtrans.dll
[2010/01/05 01:00:21 | 00,153,088 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\ieakeng.dll
[2010/01/05 01:00:21 | 00,153,088 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ieakeng.dll
[2010/01/05 01:00:21 | 00,133,120 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\extmgr.dll
[2010/01/05 01:00:21 | 00,078,336 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\ieencode.dll
[2010/01/05 01:00:21 | 00,078,336 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ieencode.dll
[2010/01/05 01:00:21 | 00,063,488 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\icardie.dll
[2010/01/05 01:00:20 | 00,347,136 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dxtmsft.dll
[2010/01/05 01:00:20 | 00,347,136 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\dxtmsft.dll
[2010/01/05 01:00:20 | 00,124,928 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\advpack.dll
[2010/01/05 01:00:20 | 00,124,928 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\advpack.dll
[2010/01/05 01:00:20 | 00,017,408 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\corpol.dll
[2010/01/05 01:00:20 | 00,017,408 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\corpol.dll
[2009/12/31 06:33:27 | 00,389,120 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\html.iec
[2009/12/31 06:33:06 | 00,070,656 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\ie4uinit.exe
[2009/12/31 06:33:06 | 00,070,656 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ie4uinit.exe
[2009/12/31 06:33:06 | 00,013,824 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\ieudinit.exe
[2009/12/31 06:33:06 | 00,013,824 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ieudinit.exe
[2009/12/29 15:10:17 | 00,000,020 | -H– | M] () – C:\Documents and Settings\All Users\Application Data\PKP_DLdu.DAT
[2009/12/29 13:54:29 | 00,000,352 | —- | M] () – C:\WINDOWS\ViewNX.INI
[2009/12/29 13:54:04 | 00,000,020 | -H– | M] () – C:\Documents and Settings\All Users\Application Data\PKP_DLdw.DAT
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/01/24 13:00:47 | 00,284,915 | —- | C] () – C:\Documents and Settings\Owner\Desktop\gmer.zip
[2010/01/23 02:32:07 | 00,000,664 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/01/23 01:52:16 | 53,644,9024 | -HS- | C] () – C:\hiberfil.sys
[2010/01/22 21:28:27 | 00,002,369 | —- | C] () – C:\Documents and Settings\All Users\Application Data\LUUnInstall.LiveUpdate
[2010/01/22 18:55:24 | 00,057,706 | —- | C] () – C:\WINDOWS\System32\net.net
[2010/01/22 18:37:54 | 00,000,000 | —- | C] () – C:\Documents and Settings\Owner\settings.dat
[2010/01/22 18:20:24 | 00,290,816 | —- | C] () – C:\Documents and Settings\Owner\Desktop\exeHelper.com
[2010/01/20 20:48:26 | 00,001,815 | —- | C] () – C:\Documents and Settings\Owner\Start Menu\Programs\Startup\Nikon Monitor.lnk
[2010/01/20 20:48:26 | 00,001,808 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
[2010/01/20 20:48:26 | 00,001,730 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
[2010/01/20 12:52:17 | 00,000,008 | —- | C] () – C:\Documents and Settings\All Users\Application Data\sysReserve.ini
[2010/01/06 18:57:32 | 00,068,608 | —- | C] () – C:\Documents and Settings\Owner\Desktop\calendar.xls
[2010/01/05 22:16:46 | 00,104,470 | —- | C] () – C:\Documents and Settings\Owner\Desktop\Jan 10 Current_Troop_38_Calender.pdf
[2009/11/27 23:56:40 | 00,000,000 | —- | C] () – C:\Documents and Settings\Owner\Local Settings\Application Data\prvlcl.dat
[2009/01/05 18:14:24 | 00,000,352 | —- | C] () – C:\WINDOWS\ViewNX.INI
[2009/01/05 18:08:06 | 00,000,268 | RH– | C] () – C:\Documents and Settings\All Users\Application Data\Displays
[2009/01/05 18:08:06 | 00,000,268 | RH– | C] () – C:\Documents and Settings\Owner\Application Data\Digital Basic
[2009/01/05 18:08:06 | 00,000,020 | -H– | C] () – C:\Documents and Settings\All Users\Application Data\PKP_DLdw.DAT
[2009/01/05 18:05:07 | 00,000,268 | RH– | C] () – C:\Documents and Settings\All Users\Application Data\Digital Mono
[2009/01/05 18:05:07 | 00,000,268 | RH– | C] () – C:\Documents and Settings\Owner\Application Data\Dialogs
[2009/01/05 18:05:07 | 00,000,020 | -H– | C] () – C:\Documents and Settings\All Users\Application Data\PKP_DLdu.DAT
[2008/08/22 21:55:58 | 00,000,128 | —- | C] () – C:\Documents and Settings\Owner\Local Settings\Application Data\fusioncache.dat
[2008/08/14 14:40:44 | 00,103,936 | —- | C] () – C:\Documents and Settings\Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/08/14 14:36:23 | 00,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2008/08/14 13:36:16 | 00,002,530 | —- | C] () – C:\Documents and Settings\All Users\Application Data\hpzinstall.log
[2008/08/13 15:06:09 | 00,147,456 | —- | C] () – C:\WINDOWS\System32\RtlCPAPI.dll
[2008/04/14 03:00:00 | 00,037,376 | —- | C] () – C:\WINDOWS\g3rtrv.dll

========== LOP Check ==========

[2009/01/05 18:05:07 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Analog Pad
[2009/01/05 18:08:06 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Automator
[2010/01/22 17:44:29 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\avg9
[2009/01/05 18:08:06 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\EnterNHelp
[2009/01/05 18:06:56 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Nikon
[2010/01/20 21:34:24 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\RegAce
[2008/08/29 15:56:28 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2009/01/05 18:08:06 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Ultima_T15
[2009/06/14 18:04:45 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2008/08/29 14:43:27 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\InfraRecorder
[2009/03/07 21:10:00 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Nikon
[2008/08/21 09:12:37 | 00,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Nova Development

========== Purity Check ==========

========== Alternate Data Streams ==========

@Alternate Data Stream - 109 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:92412C7B

< End of report >

RPMcMurphy

Post #8January 25, 2010, 12:22 AM UTC

That will do, thanks.

RPMcMurphy

Post #9January 25, 2010, 4:43 AM UTC

chiefw,

If you are using a USB flash drive to move files from a clean PC to the infected PC follow these instructions on the clean PC to prevent cross infections: (If you used a CD, skip to the next step - MBR).

Download Flash_Disinfector.exe from HERE and save it to your desktop.

Double-click Flash_Disinfector.exe to run it and follow any prompts that may appear.
The utility may ask you to insert your flash drive and/or other removable drives including your mobile phone. Please do so and allow the utility to clean up those drives as well.
Wait until it has finished scanning and then exit the program.
Reboot your computer when done.

🖼Click to load external image (Posted Image) Please download mbr.exe and save it to your root directory, usually C:\ <- (Important!).

Go to Start > Run and type: cmd.exe
press Ok.
At the command prompt type: c:\mbr.exe -t >>"C:\mbr.log"
press Enter.
A "DOS" box will open and quickly disappear. That is normal.
A log file named mbr.log will be created and saved to the root of the system drive (usually C:\).
Copy and paste the results of the mbr.log in your next reply.

🖼Click to load external image (Posted Image) Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

Double-click SystemLook.exe to run it.
Copy the content of the following codebox into the main textfield:
```
:filefind
*atapi*
```
Click the Look button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

🖼Click to load external image (Posted Image) Go to My Computer-> Tools-> Folder Options-> View tab:

Under the Hidden files and folders heading:
Select - Show hidden files and folders.
Uncheck- Hide protected operating system files (recommended) option.
Also, make sure there is no checkmark beside Hide file extensions for known file types.
Click OK. (Remember to Hide files and folders once done)

Please go to one of the below sites to scan the following files:
jotti.org
Kaspersky Virus File Scanner
Virus Total

click on Browse, and upload the following file for analysis:
C:\WINDOWS\ViewNX.INI
C:\WINDOWS\g3rtrv.dll

Then click Submit. Allow the file to be scanned, and then please copy and paste the results here for me to see.
If it says already scanned – click "reanalyze now"
Please post the results in your next reply.

🖼Click to load external image (Posted Image) You have three different AntiVirus applications showing up in your log, AVG, McAfee and Symantec / Norton. Can you please advise me which you use, (you should only have one AV installed).

Please include the following in your next post:

MBR log
SystemLook log
File upload results

Response to AV question

chiefw

Post #10January 25, 2010, 5:45 AM UTC

Believe this is what you wanted

MBR log didnt show much, not sure if correct also There is a rootrepeal txt in the C:\dir so I attached it?

Also scanned both files, one good, one bad, see at the bottom here

As for AV programs, I don't have any currently installed. I double checked in add/remove programs and none of the three populate. I was running AVG, removed it after my machine started acting goofy. I tried Symantic however, it shows an error during loading and then uninstalls. McAfee did load, locked up when I double click the icon so I removed it using add/remove programs. Currently I have no AV.

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: error reading MBR
kernel: MBR read successfully

ROOTREPEAL © AD, 2007-2009
==================================================
Scan Start Time: 2010/01/22 18:40
Program Version: Version 1.3.5.0
Windows Version: Windows XP SP3
==================================================

Drivers
——————-
Name: dump_atapi.sys
Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys
Address: 0xF1905000 Size: 98304 File Visible: No Signed: -
Status: -

Name: dump_WMILIB.SYS
Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS
Address: 0xF8A69000 Size: 8192 File Visible: No Signed: -
Status: -

Name: H8SRTjulpcwbyqr.sys
Image Path: C:\WINDOWS\system32\drivers\H8SRTjulpcwbyqr.sys
Address: 0xF1BB6000 Size: 114688 File Visible: - Signed: -
Status: Hidden from the Windows API!

Name: rootrepeal.sys
Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys
Address: 0xF0A48000 Size: 49152 File Visible: No Signed: -
Status: -

Stealth Objects
——————-
Object: Hidden Module [Name: H8SRTkyfvyibenv.dll]
Process: services.exe (PID: 584) Address: 0x10000000 Size: 36864

Object: Hidden Module [Name: H8SRTkyfvyibenv.dll]
Process: lsass.exe (PID: 596) Address: 0x10000000 Size: 36864

Object: Hidden Module [Name: H8SRTkppyvblxim.dll]
Process: svchost.exe (PID: 752) Address: 0x10000000 Size: 86016

Object: Hidden Module [Name: H8SRTkyfvyibenv.dll]
Process: svchost.exe (PID: 752) Address: 0x008a0000 Size: 36864

Object: Hidden Module [Name: H8SRTrtajbcvrie.dll]
Process: svchost.exe (PID: 752) Address: 0x00940000 Size: 151552

Object: Hidden Module [Name: H8SRTcjpyappetb.dll]
Process: svchost.exe (PID: 752) Address: 0x00a40000 Size: 65536

Object: Hidden Module [Name: H8SRTkppyvblxim.dll]
Process: svchost.exe (PID: 752) Address: 0x00cf0000 Size: 86016

Object: Hidden Module [Name: H8SRTrtajbcvrie.dll]
Process: svchost.exe (PID: 860) Address: 0x00900000 Size: 151552

Object: Hidden Module [Name: H8SRTkppyvblxim.dll]
Process: svchost.exe (PID: 860) Address: 0x10000000 Size: 86016

Object: Hidden Module [Name: H8SRTrtajbcvrie.dll]
Process: svchost.exe (PID: 944) Address: 0x00900000 Size: 151552

Object: Hidden Module [Name: H8SRTkppyvblxim.dll]
Process: svchost.exe (PID: 944) Address: 0x10000000 Size: 86016

Object: Hidden Module [Name: H8SRTrtajbcvrie.dll]
Process: svchost.exe (PID: 1040) Address: 0x00900000 Size: 151552

Object: Hidden Module [Name: H8SRTkppyvblxim.dll]
Process: svchost.exe (PID: 1040) Address: 0x10000000 Size: 86016

Object: Hidden Module [Name: H8SRTrtajbcvrie.dll]
Process: svchost.exe (PID: 1128) Address: 0x00900000 Size: 151552

Object: Hidden Module [Name: H8SRTkppyvblxim.dll]
Process: svchost.exe (PID: 1128) Address: 0x10000000 Size: 86016

Object: Hidden Module [Name: H8SRTkyfvyibenv.dll]
Process: spoolsv.exe (PID: 1252) Address: 0x10000000 Size: 36864

Object: Hidden Module [Name: H8SRTrtajbcvrie.dll]
Process: svchost.exe (PID: 1712) Address: 0x00900000 Size: 151552

Object: Hidden Module [Name: H8SRTkppyvblxim.dll]
Process: svchost.exe (PID: 1712) Address: 0x10000000 Size: 86016

Object: Hidden Module [Name: H8SRTkyfvyibenv.dll]
Process: AppleMobileDeviceService.exe (PID: 1752) Address: 0x10000000 Size: 36864

Object: Hidden Module [Name: H8SRTkyfvyibenv.dll]
Process: mDNSResponder.exe (PID: 1776) Address: 0x10000000 Size: 36864

Object: Hidden Module [Name: H8SRTrtajbcvrie.dll]
Process: svchost.exe (PID: 1860) Address: 0x00900000 Size: 151552

Object: Hidden Module [Name: H8SRTkppyvblxim.dll]
Process: svchost.exe (PID: 1860) Address: 0x10000000 Size: 86016

Object: Hidden Module [Name: H8SRTkyfvyibenv.dll]
Process: SearchIndexer.exe (PID: 1996) Address: 0x10000000 Size: 36864

Object: Hidden Module [Name: H8SRTkyfvyibenv.dll]
Process: alg.exe (PID: 1356) Address: 0x10000000 Size: 36864

Object: Hidden Module [Name: H8SRTkyfvyibenv.dll]
Process: Explorer.EXE (PID: 1472) Address: 0x00c40000 Size: 36864

Object: Hidden Module [Name: H8SRTkppyvblxim.dll]
Process: Explorer.EXE (PID: 1472) Address: 0x10000000 Size: 86016

Object: Hidden Module [Name: H8SRTkyfvyibenv.dll]
Process: ctfmon.exe (PID: 2188) Address: 0x10000000 Size: 36864

Object: Hidden Module [Name: H8SRTkyfvyibenv.dll]
Process: SOUNDMAN.EXE (PID: 2324) Address: 0x10000000 Size: 36864

Object: Hidden Module [Name: H8SRTkyfvyibenv.dll]
Process: HPWuSchd.exe (PID: 2408) Address: 0x10000000 Size: 36864

Object: Hidden Module [Name: H8SRTkyfvyibenv.dll]
Process: ctfmon.exe (PID: 2476) Address: 0x10000000 Size: 36864

Object: Hidden Module [Name: H8SRTkyfvyibenv.dll]
Process: msmsgs.exe (PID: 2488) Address: 0x10000000 Size: 36864

Object: Hidden Module [Name: H8SRTkyfvyibenv.dll]
Process: hpqtra08.exe (PID: 2516) Address: 0x10000000 Size: 36864

Object: Hidden Module [Name: H8SRTkyfvyibenv.dll]
Process: WindowsSearch.exe (PID: 2540) Address: 0x10000000 Size: 36864

Object: Hidden Module [Name: H8SRTkyfvyibenv.dll]
Process: NkMonitor.exe (PID: 2552) Address: 0x10000000 Size: 36864

Object: Hidden Module [Name: H8SRTkppyvblxim.dll]
Process: firefox.exe (PID: 2152) Address: 0x007e0000 Size: 86016

Object: Hidden Module [Name: H8SRTrtajbcvrie.dll]
Process: firefox.exe (PID: 2152) Address: 0x013d0000 Size: 151552

Object: Hidden Module [Name: H8SRTkyfvyibenv.dll]
Process: RootRepeal.exe (PID: 2484) Address: 0x10000000 Size: 36864

Object: Hidden Module [Name: H8SRTrtajbcvrie.dll]
Process: iexplore.exe (PID: 2156) Address: 0x00e40000 Size: 151552

Object: Hidden Module [Name: H8SRTkppyvblxim.dll]
Process: iexplore.exe (PID: 2156) Address: 0x10000000 Size: 86016

Hidden Services
——————-
Service Name: H8SRTd.sys
Image Path: C:\WINDOWS\system32\drivers\H8SRTjulpcwbyqr.sys

==EOF==

SystemLook v1.0 by jpshortstuff (11.01.10)
Log created at 20:23 on 24/01/2010 by Owner (Administrator - Elevation successful)

========== filefind ==========

Searching for "*atapi*"
C:\WINDOWS\system32\dllcache\atapi.sys –a–c 96512 bytes [12:00 14/04/2008] [03:55 23/01/2010] 9F3A2F5AA6875C72BF062C712CFA2674
C:\WINDOWS\system32\drivers\atapi.sys –a— 96512 bytes [12:00 14/04/2008] [03:55 23/01/2010] 9F3A2F5AA6875C72BF062C712CFA2674

-=End Of File=-

Filename: ViewNX.INI
Status:
Scan finished. 0 out of 20 scanners reported malware.
Scan taken on: Mon 25 Jan 2010 06:29:07 (CET) Permalink

g3rtrv.dll
Status:
Scan finished. 5 out of 20 scanners reported malware.
Scan taken on: Mon 25 Jan 2010 06:33:32 (CET) Permalink

RPMcMurphy

Post #11January 25, 2010, 2:14 PM UTC

chiefw,

🖼Click to load external image (Posted Image) You are infected with a rootkit. While we may be able to remove it there are some very important things you should consider:

Rootkits and Backdoor Trojans are very dangerous because they use advanced techniques (backdoors) as a means of accessing a computer system that bypasses security mechanisms and steal sensitive information which they send back to the hacker. Many rootkits can hook into the Windows 32-bit kernel, and patch several APIs to hide new registry keys and files they install. Remote attackers use backdoor Trojans and rootkits as part of an exploit to gain unauthorized access to a computer and take control of it without your knowledge.

If your computer was used for online banking, has credit card information or other sensitive data on it, you should immediately disconnect from the Internet until your system is cleaned. All passwords should be changed immediately to include those used for banking, email, eBay, paypal and online forums. You should consider them to be compromisedY. You should change each password by using a different computer and not the infected one. If not, an attacker may get the new passwords and transaction information. If using a router, you need to reset it with a strong logon/password so the malware cannot gain control before connect again. Banking and credit card institutions should be notified of the possible security breach. Because your computer was compromised please read How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?

🖼Click to load external image (Posted Image) Download TDSSKiller and save it to your Desktop.

Extract the file and run it.
Once completed it will create a log in your C:\ drive called TDSSKiller_* (* denotes version & date)
Please post the content of that log TDSSKiller

🖼Click to load external image (Posted Image) Run OTL.exe

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

:OTL
SRV - (LiveUpdate) – C:\Program Files\Symantec\LiveUpdate\LuComServer_3_3.EXE (Symantec Corporation)
DRV - (mfehidk) – C:\WINDOWS\system32\drivers\mfehidk.sys (McAfee, Inc.)
DRV - (mferkdk) – C:\WINDOWS\system32\drivers\mferkdk.sys (McAfee, Inc.)
DRV - (MPFP) – C:\WINDOWS\system32\drivers\Mpfp.sys (McAfee, Inc.)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll File not found
O4 - HKLM..\Run: [DXDllRegExe] File not found
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll File not found
O33 - MountPoints2\{46d2a3dc-0f86-11de-9ef7-000475be28e9}\Shell\AutoRun\command - "" = I:\setupSNK.exe – File not found
O33 - MountPoints2\{6690eee4-cb56-11de-8d62-000475be28e9}\Shell\AutoRun\command - "" = I:\RunUltraLock.exe – File not found
O33 - MountPoints2\{a8439c41-b6a0-11de-9f29-000475be28e9}\Shell\AutoRun\command - "" = I:\RunUltraLock.exe – File not found
O33 - MountPoints2\{b24b0043-6a59-11dd-ac95-000475be28e9}\Shell\AutoRun\command - "" = wdsync.exe
[2010/01/22 18:55:24 | 00,057,706 | —- | M] () – C:\WINDOWS\System32\net.net
[2008/04/14 03:00:00 | 00,037,376 | —- | C] () – C:\WINDOWS\g3rtrv.dll

:Commands
[purity]
[emptytemp]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Then post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )

Please include the following in your next post:

TDSSKiller log
OTLlog

Let me know if your PC is any better

chiefw

Post #12January 26, 2010, 3:12 AM UTC

Sorry for the delay, TDSS Killer took a LONG time to run. OTL Log also below Should I try and install Symantic now? 6:45:22:515 2288 TDSS rootkit removing tool 2.2.2 Jan 13 2010 08:42:25 06:45:22:515 2288 ================================================================================ 06:45:22:515 2288 SystemInfo: 06:45:22:515 2288 OS Version: 5.1.2600 ServicePack: 3.0 06:45:22:515 2288 Product type: Workstation 06:45:22:515 2288 ComputerName: WHITTLEDT01 06:45:22:515 2288 UserName: Owner 06:45:22:515 2288 Windows directory: C:\WINDOWS 06:45:22:515 2288 Processor architecture: Intel x86 06:45:22:515 2288 Number of processors: 1 06:45:22:515 2288 Page size: 0x1000 06:45:22:515 2288 Boot type: Normal boot 06:45:22:515 2288 ================================================================================ 06:45:22:546 2288 UnloadDriverW: NtUnloadDriver error 2 06:45:22:546 2288 ForceUnloadDriverW: UnloadDriverW(klmd21) error 2 06:45:22:562 2288 MyNtCreateFileW: NtCreateFile(\??\C:\WINDOWS\system32\drivers\klmd.sys) returned status 00000000 06:45:22:609 2288 UtilityInit: KLMD drop and load success 06:45:22:609 2288 KLMD_OpenDevice: Trying to open KLMD Device(KLMD201000) 06:45:22:609 2288 UtilityInit: KLMD open success 06:45:22:609 2288 UtilityInit: Initialize success 06:45:22:609 2288 06:45:22:609 2288 Scanning Services … 06:45:22:609 2288 CreateRegParser: Registry parser init started 06:45:22:609 2288 DisableWow64Redirection: GetProcAddress(Wow64DisableWow64FsRedirection) error 127 06:45:22:609 2288 CreateRegParser: DisableWow64Redirection error 06:45:22:609 2288 wfopen_ex: Trying to open file C:\WINDOWS\system32\config\system 06:45:22:609 2288 MyNtCreateFileW: NtCreateFile(\??\C:\WINDOWS\system32\config\system) returned status C0000043 06:45:22:609 2288 wfopen_ex: MyNtCreateFileW error 32 (C0000043) 06:45:22:609 2288 wfopen_ex: Trying to KLMD file open 06:45:22:609 2288 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\config\system 06:45:22:609 2288 wfopen_ex: File opened ok (Flags 2) 06:45:22:609 2288 CreateRegParser: HIVE_ADAPTER(C:\WINDOWS\system32\config\system) init success: D94AF0 06:45:22:609 2288 wfopen_ex: Trying to open file C:\WINDOWS\system32\config\software 06:45:22:609 2288 MyNtCreateFileW: NtCreateFile(\??\C:\WINDOWS\system32\config\software) returned status C0000043 06:45:22:609 2288 wfopen_ex: MyNtCreateFileW error 32 (C0000043) 06:45:22:609 2288 wfopen_ex: Trying to KLMD file open 06:45:22:609 2288 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\config\software 06:45:22:609 2288 wfopen_ex: File opened ok (Flags 2) 06:45:22:609 2288 CreateRegParser: HIVE_ADAPTER(C:\WINDOWS\system32\config\software) init success: D94B98 06:45:22:609 2288 EnableWow64Redirection: GetProcAddress(Wow64RevertWow64FsRedirection) error 127 06:45:22:609 2288 CreateRegParser: EnableWow64Redirection error 06:45:22:609 2288 CreateRegParser: RegParser init completed 06:45:23:125 2288 GetAdvancedServicesInfo: Raw services enum returned 311 services 06:45:23:140 2288 ScanTDL2Services: Exact detect H8SRTd.sys (h: 1) 06:45:23:140 2288 RegNode HKLM\SYSTEM\ControlSet001\services\H8SRTd.sys infected by TDSS rootkit … 06:45:23:140 2288 will be deleted on reboot 06:45:23:140 2288 DeleteTDL2Service: SafeBoot Minimal doesn't infected 06:45:23:140 2288 DeleteTDL2Service: SafeBoot Network doesn't infected 06:45:23:140 2288 RegNode HKLM\SYSTEM\ControlSet002\services\H8SRTd.sys infected by TDSS rootkit … 06:45:23:140 2288 will be deleted on reboot 06:45:23:156 2288 DeleteTDL2Service: SafeBoot Minimal doesn't infected 06:45:23:156 2288 DeleteTDL2Service: SafeBoot Network doesn't infected 06:45:23:156 2288 File C:\WINDOWS\system32\drivers\H8SRTjulpcwbyqr.sys infected by TDSS rootkit … 06:45:23:156 2288 will be deleted on reboot 06:45:23:156 2288 DeleteTDL2Service: Module enum: Name: H8SRTd. Type: 1 06:45:23:156 2288 DeleteTDL2Service: Module clone ImagePath, skipping 06:45:23:156 2288 DeleteTDL2Service: Module enum: Name: H8SRTc. Type: 1 06:45:23:156 2288 File C:\WINDOWS\system32\H8SRTcjpyappetb.dll infected by TDSS rootkit … 06:45:23:156 2288 will be deleted on reboot 06:45:23:156 2288 DeleteTDL2Service: Module enum: Name: H8SRTsrcr. Type: 1 06:45:23:156 2288 File C:\WINDOWS\system32\H8SRTdrtcvgqdut.dat infected by TDSS rootkit … 06:45:23:156 2288 will be deleted on reboot 06:45:23:156 2288 DeleteTDL2Service: Module enum: Name: h8srtserf. Type: 1 06:45:23:156 2288 File C:\WINDOWS\system32\H8SRTkppyvblxim.dll infected by TDSS rootkit … 06:45:23:156 2288 will be deleted on reboot 06:45:23:156 2288 DeleteTDL2Service: Module enum: Name: h8srtmsg. Type: 1 06:45:23:156 2288 File C:\WINDOWS\system32\H8SRTkyfvyibenv.dll infected by TDSS rootkit … 06:45:23:156 2288 will be deleted on reboot 06:45:23:156 2288 DeleteTDL2Service: Module enum: Name: h8srtbbr. Type: 1 06:45:23:156 2288 File C:\WINDOWS\system32\H8SRTrtajbcvrie.dll infected by TDSS rootkit … 06:45:23:156 2288 will be deleted on reboot 06:45:23:156 2288 ScanTDL2Services: DeleteEvilService(H8SRTd.sys) success 06:45:23:156 2288 fclose_ex: Trying to close file C:\WINDOWS\system32\config\system 06:45:23:156 2288 fclose_ex: Trying to close file C:\WINDOWS\system32\config\software 06:45:23:156 2288 06:45:23:156 2288 Scanning Kernel memory … 06:45:23:156 2288 KLMD_GetSystemObjectAddressByNameW: Trying to get system object address by name \Driver\Disk 06:45:23:156 2288 DetectCureTDL3: \Driver\Disk PDRIVER_OBJECT: 823D6F38 06:45:23:156 2288 DetectCureTDL3: KLMD_GetDeviceObjectList returned 8 DevObjects 06:45:23:156 2288 06:45:23:156 2288 DetectCureTDL3: DEVICE_OBJECT: 81F72C68 06:45:23:156 2288 KLMD_GetLowerDeviceObject: Trying to get lower device object for 81F72C68 06:45:23:156 2288 KLMD_ReadMem: Trying to ReadMemory 0x81F72C68[0x38] 06:45:23:156 2288 DetectCureTDL3: DRIVER_OBJECT: 823D6F38 06:45:23:156 2288 KLMD_ReadMem: Trying to ReadMemory 0x823D6F38[0xA8] 06:45:23:156 2288 KLMD_ReadMem: Trying to ReadMemory 0xE14711D0[0x18] 06:45:23:156 2288 DetectCureTDL3: DRIVER_OBJECT name: \Driver\Disk, Driver Name: Disk 06:45:23:156 2288 DetectCureTDL3: IrpHandler (0) addr: F857BBB0 06:45:23:156 2288 DetectCureTDL3: IrpHandler (1) addr: 804FA87E 06:45:23:156 2288 DetectCureTDL3: IrpHandler (2) addr: F857BBB0 06:45:23:156 2288 DetectCureTDL3: IrpHandler (3) addr: F8575D1F 06:45:23:156 2288 DetectCureTDL3: IrpHandler (4) addr: F8575D1F 06:45:23:156 2288 DetectCureTDL3: IrpHandler (5) addr: 804FA87E 06:45:23:156 2288 DetectCureTDL3: IrpHandler (6) addr: 804FA87E 06:45:23:156 2288 DetectCureTDL3: IrpHandler (7) addr: 804FA87E 06:45:23:156 2288 DetectCureTDL3: IrpHandler (8) addr: 804FA87E 06:45:23:156 2288 DetectCureTDL3: IrpHandler (9) addr: F85762E2 06:45:23:156 2288 DetectCureTDL3: IrpHandler (10) addr: 804FA87E 06:45:23:156 2288 DetectCureTDL3: IrpHandler (11) addr: 804FA87E 06:45:23:156 2288 DetectCureTDL3: IrpHandler (12) addr: 804FA87E 06:45:23:156 2288 DetectCureTDL3: IrpHandler (13) addr: 804FA87E 06:45:23:156 2288 DetectCureTDL3: IrpHandler (14) addr: F85763BB 06:45:23:156 2288 DetectCureTDL3: IrpHandler (15) addr: F8579F28 06:45:23:156 2288 DetectCureTDL3: IrpHandler (16) addr: F85762E2 06:45:23:156 2288 DetectCureTDL3: IrpHandler (17) addr: 804FA87E 06:45:23:156 2288 DetectCureTDL3: IrpHandler (18) addr: 804FA87E 06:45:23:156 2288 DetectCureTDL3: IrpHandler (19) addr: 804FA87E 06:45:23:156 2288 DetectCureTDL3: IrpHandler (20) addr: 804FA87E 06:45:23:156 2288 DetectCureTDL3: IrpHandler (21) addr: 804FA87E 06:45:23:156 2288 DetectCureTDL3: IrpHandler (22) addr: F8577C82 06:45:23:156 2288 DetectCureTDL3: IrpHandler (23) addr: F857C99E 06:45:23:156 2288 DetectCureTDL3: IrpHandler (24) addr: 804FA87E 06:45:23:156 2288 DetectCureTDL3: IrpHandler (25) addr: 804FA87E 06:45:23:156 2288 DetectCureTDL3: IrpHandler (26) addr: 804FA87E 06:45:23:156 2288 TDL3_FileDetect: Processing driver: Disk 06:45:23:156 2288 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\DRIVERS\disk.sys 06:45:23:156 2288 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\DRIVERS\disk.sys 06:45:23:187 2288 TDL3_FileDetect: C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: Clean 06:45:23:187 2288 06:45:23:187 2288 DetectCureTDL3: DEVICE_OBJECT: 81F7D300 06:45:23:187 2288 KLMD_GetLowerDeviceObject: Trying to get lower device object for 81F7D300 06:45:23:187 2288 KLMD_ReadMem: Trying to ReadMemory 0x81F7D300[0x38] 06:45:23:187 2288 DetectCureTDL3: DRIVER_OBJECT: 823D6F38 06:45:23:187 2288 KLMD_ReadMem: Trying to ReadMemory 0x823D6F38[0xA8] 06:45:23:187 2288 KLMD_ReadMem: Trying to ReadMemory 0xE14711D0[0x18] 06:45:23:187 2288 DetectCureTDL3: DRIVER_OBJECT name: \Driver\Disk, Driver Name: Disk 06:45:23:187 2288 DetectCureTDL3: IrpHandler (0) addr: F857BBB0 06:45:23:187 2288 DetectCureTDL3: IrpHandler (1) addr: 804FA87E 06:45:23:187 2288 DetectCureTDL3: IrpHandler (2) addr: F857BBB0 06:45:23:187 2288 DetectCureTDL3: IrpHandler (3) addr: F8575D1F 06:45:23:187 2288 DetectCureTDL3: IrpHandler (4) addr: F8575D1F 06:45:23:187 2288 DetectCureTDL3: IrpHandler (5) addr: 804FA87E 06:45:23:187 2288 DetectCureTDL3: IrpHandler (6) addr: 804FA87E 06:45:23:187 2288 DetectCureTDL3: IrpHandler (7) addr: 804FA87E 06:45:23:187 2288 DetectCureTDL3: IrpHandler (8) addr: 804FA87E 06:45:23:187 2288 DetectCureTDL3: IrpHandler (9) addr: F85762E2 06:45:23:187 2288 DetectCureTDL3: IrpHandler (10) addr: 804FA87E 06:45:23:187 2288 DetectCureTDL3: IrpHandler (11) addr: 804FA87E 06:45:23:187 2288 DetectCureTDL3: IrpHandler (12) addr: 804FA87E 06:45:23:187 2288 DetectCureTDL3: IrpHandler (13) addr: 804FA87E 06:45:23:187 2288 DetectCureTDL3: IrpHandler (14) addr: F85763BB 06:45:23:187 2288 DetectCureTDL3: IrpHandler (15) addr: F8579F28 06:45:23:187 2288 DetectCureTDL3: IrpHandler (16) addr: F85762E2 06:45:23:187 2288 DetectCureTDL3: IrpHandler (17) addr: 804FA87E 06:45:23:187 2288 DetectCureTDL3: IrpHandler (18) addr: 804FA87E 06:45:23:187 2288 DetectCureTDL3: IrpHandler (19) addr: 804FA87E 06:45:23:187 2288 DetectCureTDL3: IrpHandler (20) addr: 804FA87E 06:45:23:187 2288 DetectCureTDL3: IrpHandler (21) addr: 804FA87E 06:45:23:187 2288 DetectCureTDL3: IrpHandler (22) addr: F8577C82 06:45:23:187 2288 DetectCureTDL3: IrpHandler (23) addr: F857C99E 06:45:23:187 2288 DetectCureTDL3: IrpHandler (24) addr: 804FA87E 06:45:23:187 2288 DetectCureTDL3: IrpHandler (25) addr: 804FA87E 06:45:23:187 2288 DetectCureTDL3: IrpHandler (26) addr: 804FA87E 06:45:23:187 2288 TDL3_FileDetect: Processing driver: Disk 06:45:23:187 2288 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\DRIVERS\disk.sys 06:45:23:187 2288 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\DRIVERS\disk.sys 06:45:23:187 2288 TDL3_FileDetect: C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: Clean 06:45:23:187 2288 06:45:23:187 2288 DetectCureTDL3: DEVICE_OBJECT: 81F6FAB8 06:45:23:187 2288 KLMD_GetLowerDeviceObject: Trying to get lower device object for 81F6FAB8 06:45:23:187 2288 DetectCureTDL3: DEVICE_OBJECT: 81F6F7B8 06:45:23:187 2288 KLMD_GetLowerDeviceObject: Trying to get lower device object for 81F6F7B8 06:45:23:187 2288 KLMD_ReadMem: Trying to ReadMemory 0x81F6F7B8[0x38] 06:45:23:187 2288 DetectCureTDL3: DRIVER_OBJECT: 81FC3030 06:45:23:187 2288 KLMD_ReadMem: Trying to ReadMemory 0x81FC3030[0xA8] 06:45:23:187 2288 KLMD_ReadMem: Trying to ReadMemory 0xE158C530[0x1E] 06:45:23:187 2288 DetectCureTDL3: DRIVER_OBJECT name: \Driver\USBSTOR, Driver Name: USBSTOR 06:45:23:187 2288 DetectCureTDL3: IrpHandler (0) addr: F88FA218 06:45:23:187 2288 DetectCureTDL3: IrpHandler (1) addr: 804FA87E 06:45:23:187 2288 DetectCureTDL3: IrpHandler (2) addr: F88FA218 06:45:23:187 2288 DetectCureTDL3: IrpHandler (3) addr: F88FA23C 06:45:23:187 2288 DetectCureTDL3: IrpHandler (4) addr: F88FA23C 06:45:23:187 2288 DetectCureTDL3: IrpHandler (5) addr: 804FA87E 06:45:23:187 2288 DetectCureTDL3: IrpHandler (6) addr: 804FA87E 06:45:23:187 2288 DetectCureTDL3: IrpHandler (7) addr: 804FA87E 06:45:23:187 2288 DetectCureTDL3: IrpHandler (8) addr: 804FA87E 06:45:23:187 2288 DetectCureTDL3: IrpHandler (9) addr: 804FA87E 06:45:23:187 2288 DetectCureTDL3: IrpHandler (10) addr: 804FA87E 06:45:23:187 2288 DetectCureTDL3: IrpHandler (11) addr: 804FA87E 06:45:23:187 2288 DetectCureTDL3: IrpHandler (12) addr: 804FA87E 06:45:23:187 2288 DetectCureTDL3: IrpHandler (13) addr: 804FA87E 06:45:23:187 2288 DetectCureTDL3: IrpHandler (14) addr: F88FA180 06:45:23:187 2288 DetectCureTDL3: IrpHandler (15) addr: F88F59E6 06:45:23:187 2288 DetectCureTDL3: IrpHandler (16) addr: 804FA87E 06:45:23:187 2288 DetectCureTDL3: IrpHandler (17) addr: 804FA87E 06:45:23:187 2288 DetectCureTDL3: IrpHandler (18) addr: 804FA87E 06:45:23:187 2288 DetectCureTDL3: IrpHandler (19) addr: 804FA87E 06:45:23:187 2288 DetectCureTDL3: IrpHandler (20) addr: 804FA87E 06:45:23:187 2288 DetectCureTDL3: IrpHandler (21) addr: 804FA87E 06:45:23:187 2288 DetectCureTDL3: IrpHandler (22) addr: F88F95F0 06:45:23:187 2288 DetectCureTDL3: IrpHandler (23) addr: F88F7A6E 06:45:23:187 2288 DetectCureTDL3: IrpHandler (24) addr: 804FA87E 06:45:23:187 2288 DetectCureTDL3: IrpHandler (25) addr: 804FA87E 06:45:23:187 2288 DetectCureTDL3: IrpHandler (26) addr: 804FA87E 06:45:23:187 2288 KLMD_ReadMem: Trying to ReadMemory 0xF88F6F26[0x400] 06:45:23:187 2288 TDL3_StartIoHookDetect: CheckParameters: 0, 00000000, 0 06:45:23:187 2288 TDL3_FileDetect: Processing driver: USBSTOR 06:45:23:187 2288 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS 06:45:23:187 2288 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS 06:45:23:234 2288 TDL3_FileDetect: C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS - Verdict: Clean 06:45:23:234 2288 06:45:23:234 2288 DetectCureTDL3: DEVICE_OBJECT: 81FA42E8 06:45:23:234 2288 KLMD_GetLowerDeviceObject: Trying to get lower device object for 81FA42E8 06:45:23:234 2288 DetectCureTDL3: DEVICE_OBJECT: 81F68608 06:45:23:234 2288 KLMD_GetLowerDeviceObject: Trying to get lower device object for 81F68608 06:45:23:234 2288 KLMD_ReadMem: Trying to ReadMemory 0x81F68608[0x38] 06:45:23:234 2288 DetectCureTDL3: DRIVER_OBJECT: 81FC3030 06:45:23:234 2288 KLMD_ReadMem: Trying to ReadMemory 0x81FC3030[0xA8] 06:45:23:234 2288 KLMD_ReadMem: Trying to ReadMemory 0xE158C530[0x1E] 06:45:23:234 2288 DetectCureTDL3: DRIVER_OBJECT name: \Driver\USBSTOR, Driver Name: USBSTOR 06:45:23:234 2288 DetectCureTDL3: IrpHandler (0) addr: F88FA218 06:45:23:234 2288 DetectCureTDL3: IrpHandler (1) addr: 804FA87E 06:45:23:234 2288 DetectCureTDL3: IrpHandler (2) addr: F88FA218 06:45:23:234 2288 DetectCureTDL3: IrpHandler (3) addr: F88FA23C 06:45:23:234 2288 DetectCureTDL3: IrpHandler (4) addr: F88FA23C 06:45:23:234 2288 DetectCureTDL3: IrpHandler (5) addr: 804FA87E 06:45:23:234 2288 DetectCureTDL3: IrpHandler (6) addr: 804FA87E 06:45:23:234 2288 DetectCureTDL3: IrpHandler (7) addr: 804FA87E 06:45:23:234 2288 DetectCureTDL3: IrpHandler (8) addr: 804FA87E 06:45:23:234 2288 DetectCureTDL3: IrpHandler (9) addr: 804FA87E 06:45:23:234 2288 DetectCureTDL3: IrpHandler (10) addr: 804FA87E 06:45:23:234 2288 DetectCureTDL3: IrpHandler (11) addr: 804FA87E 06:45:23:234 2288 DetectCureTDL3: IrpHandler (12) addr: 804FA87E 06:45:23:234 2288 DetectCureTDL3: IrpHandler (13) addr: 804FA87E 06:45:23:234 2288 DetectCureTDL3: IrpHandler (14) addr: F88FA180 06:45:23:234 2288 DetectCureTDL3: IrpHandler (15) addr: F88F59E6 06:45:23:234 2288 DetectCureTDL3: IrpHandler (16) addr: 804FA87E 06:45:23:234 2288 DetectCureTDL3: IrpHandler (17) addr: 804FA87E 06:45:23:234 2288 DetectCureTDL3: IrpHandler (18) addr: 804FA87E 06:45:23:234 2288 DetectCureTDL3: IrpHandler (19) addr: 804FA87E 06:45:23:234 2288 DetectCureTDL3: IrpHandler (20) addr: 804FA87E 06:45:23:234 2288 DetectCureTDL3: IrpHandler (21) addr: 804FA87E 06:45:23:234 2288 DetectCureTDL3: IrpHandler (22) addr: F88F95F0 06:45:23:234 2288 DetectCureTDL3: IrpHandler (23) addr: F88F7A6E 06:45:23:234 2288 DetectCureTDL3: IrpHandler (24) addr: 804FA87E 06:45:23:234 2288 DetectCureTDL3: IrpHandler (25) addr: 804FA87E 06:45:23:234 2288 DetectCureTDL3: IrpHandler (26) addr: 804FA87E 06:45:23:234 2288 KLMD_ReadMem: Trying to ReadMemory 0xF88F6F26[0x400] 06:45:23:234 2288 TDL3_StartIoHookDetect: CheckParameters: 0, 00000000, 0 06:45:23:234 2288 TDL3_FileDetect: Processing driver: USBSTOR 06:45:23:234 2288 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS 06:45:23:234 2288 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS 06:45:23:234 2288 TDL3_FileDetect: C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS - Verdict: Clean 06:45:23:234 2288 06:45:23:234 2288 DetectCureTDL3: DEVICE_OBJECT: 823D0030 06:45:23:234 2288 KLMD_GetLowerDeviceObject: Trying to get lower device object for 823D0030 06:45:23:234 2288 KLMD_ReadMem: Trying to ReadMemory 0x823D0030[0x38] 06:45:23:234 2288 DetectCureTDL3: DRIVER_OBJECT: 823D6F38 06:45:23:234 2288 KLMD_ReadMem: Trying to ReadMemory 0x823D6F38[0xA8] 06:45:23:234 2288 KLMD_ReadMem: Trying to ReadMemory 0xE14711D0[0x18] 06:45:23:234 2288 DetectCureTDL3: DRIVER_OBJECT name: \Driver\Disk, Driver Name: Disk 06:45:23:234 2288 DetectCureTDL3: IrpHandler (0) addr: F857BBB0 06:45:23:234 2288 DetectCureTDL3: IrpHandler (1) addr: 804FA87E 06:45:23:234 2288 DetectCureTDL3: IrpHandler (2) addr: F857BBB0 06:45:23:234 2288 DetectCureTDL3: IrpHandler (3) addr: F8575D1F 06:45:23:234 2288 DetectCureTDL3: IrpHandler (4) addr: F8575D1F 06:45:23:234 2288 DetectCureTDL3: IrpHandler (5) addr: 804FA87E 06:45:23:234 2288 DetectCureTDL3: IrpHandler (6) addr: 804FA87E 06:45:23:234 2288 DetectCureTDL3: IrpHandler (7) addr: 804FA87E 06:45:23:234 2288 DetectCureTDL3: IrpHandler (8) addr: 804FA87E 06:45:23:234 2288 DetectCureTDL3: IrpHandler (9) addr: F85762E2 06:45:23:234 2288 DetectCureTDL3: IrpHandler (10) addr: 804FA87E 06:45:23:234 2288 DetectCureTDL3: IrpHandler (11) addr: 804FA87E 06:45:23:234 2288 DetectCureTDL3: IrpHandler (12) addr: 804FA87E 06:45:23:234 2288 DetectCureTDL3: IrpHandler (13) addr: 804FA87E 06:45:23:234 2288 DetectCureTDL3: IrpHandler (14) addr: F85763BB 06:45:23:234 2288 DetectCureTDL3: IrpHandler (15) addr: F8579F28 06:45:23:234 2288 DetectCureTDL3: IrpHandler (16) addr: F85762E2 06:45:23:234 2288 DetectCureTDL3: IrpHandler (17) addr: 804FA87E 06:45:23:234 2288 DetectCureTDL3: IrpHandler (18) addr: 804FA87E 06:45:23:234 2288 DetectCureTDL3: IrpHandler (19) addr: 804FA87E 06:45:23:234 2288 DetectCureTDL3: IrpHandler (20) addr: 804FA87E 06:45:23:234 2288 DetectCureTDL3: IrpHandler (21) addr: 804FA87E 06:45:23:234 2288 DetectCureTDL3: IrpHandler (22) addr: F8577C82 06:45:23:234 2288 DetectCureTDL3: IrpHandler (23) addr: F857C99E 06:45:23:234 2288 DetectCureTDL3: IrpHandler (24) addr: 804FA87E 06:45:23:234 2288 DetectCureTDL3: IrpHandler (25) addr: 804FA87E 06:45:23:234 2288 DetectCureTDL3: IrpHandler (26) addr: 804FA87E 06:45:23:234 2288 TDL3_FileDetect: Processing driver: Disk 06:45:23:234 2288 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\DRIVERS\disk.sys 06:45:23:234 2288 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\DRIVERS\disk.sys 06:45:23:234 2288 TDL3_FileDetect: C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: Clean 06:45:23:234 2288 06:45:23:234 2288 DetectCureTDL3: DEVICE_OBJECT: 823DA9D0 06:45:23:234 2288 KLMD_GetLowerDeviceObject: Trying to get lower device object for 823DA9D0 06:45:23:234 2288 KLMD_ReadMem: Trying to ReadMemory 0x823DA9D0[0x38] 06:45:23:234 2288 DetectCureTDL3: DRIVER_OBJECT: 823D6F38 06:45:23:234 2288 KLMD_ReadMem: Trying to ReadMemory 0x823D6F38[0xA8] 06:45:23:234 2288 KLMD_ReadMem: Trying to ReadMemory 0xE14711D0[0x18] 06:45:23:234 2288 DetectCureTDL3: DRIVER_OBJECT name: \Driver\Disk, Driver Name: Disk 06:45:23:234 2288 DetectCureTDL3: IrpHandler (0) addr: F857BBB0 06:45:23:234 2288 DetectCureTDL3: IrpHandler (1) addr: 804FA87E 06:45:23:234 2288 DetectCureTDL3: IrpHandler (2) addr: F857BBB0 06:45:23:234 2288 DetectCureTDL3: IrpHandler (3) addr: F8575D1F 06:45:23:234 2288 DetectCureTDL3: IrpHandler (4) addr: F8575D1F 06:45:23:234 2288 DetectCureTDL3: IrpHandler (5) addr: 804FA87E 06:45:23:234 2288 DetectCureTDL3: IrpHandler (6) addr: 804FA87E 06:45:23:234 2288 DetectCureTDL3: IrpHandler (7) addr: 804FA87E 06:45:23:234 2288 DetectCureTDL3: IrpHandler (8) addr: 804FA87E 06:45:23:234 2288 DetectCureTDL3: IrpHandler (9) addr: F85762E2 06:45:23:234 2288 DetectCureTDL3: IrpHandler (10) addr: 804FA87E 06:45:23:234 2288 DetectCureTDL3: IrpHandler (11) addr: 804FA87E 06:45:23:234 2288 DetectCureTDL3: IrpHandler (12) addr: 804FA87E 06:45:23:234 2288 DetectCureTDL3: IrpHandler (13) addr: 804FA87E 06:45:23:234 2288 DetectCureTDL3: IrpHandler (14) addr: F85763BB 06:45:23:234 2288 DetectCureTDL3: IrpHandler (15) addr: F8579F28 06:45:23:234 2288 DetectCureTDL3: IrpHandler (16) addr: F85762E2 06:45:23:234 2288 DetectCureTDL3: IrpHandler (17) addr: 804FA87E 06:45:23:234 2288 DetectCureTDL3: IrpHandler (18) addr: 804FA87E 06:45:23:234 2288 DetectCureTDL3: IrpHandler (19) addr: 804FA87E 06:45:23:234 2288 DetectCureTDL3: IrpHandler (20) addr: 804FA87E 06:45:23:234 2288 DetectCureTDL3: IrpHandler (21) addr: 804FA87E 06:45:23:234 2288 DetectCureTDL3: IrpHandler (22) addr: F8577C82 06:45:23:234 2288 DetectCureTDL3: IrpHandler (23) addr: F857C99E 06:45:23:234 2288 DetectCureTDL3: IrpHandler (24) addr: 804FA87E 06:45:23:234 2288 DetectCureTDL3: IrpHandler (25) addr: 804FA87E 06:45:23:234 2288 DetectCureTDL3: IrpHandler (26) addr: 804FA87E 06:45:23:234 2288 TDL3_FileDetect: Processing driver: Disk 06:45:23:234 2288 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\DRIVERS\disk.sys 06:45:23:234 2288 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\DRIVERS\disk.sys 06:45:23:234 2288 TDL3_FileDetect: C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: Clean 06:45:23:234 2288 06:45:23:234 2288 DetectCureTDL3: DEVICE_OBJECT: 823DCAB8 06:45:23:234 2288 KLMD_GetLowerDeviceObject: Trying to get lower device object for 823DCAB8 06:45:23:234 2288 DetectCureTDL3: DEVICE_OBJECT: 823E09E8 06:45:23:234 2288 KLMD_GetLowerDeviceObject: Trying to get lower device object for 823E09E8 06:45:23:234 2288 DetectCureTDL3: DEVICE_OBJECT: 8237AB00 06:45:23:234 2288 KLMD_GetLowerDeviceObject: Trying to get lower device object for 8237AB00 06:45:23:234 2288 KLMD_ReadMem: Trying to ReadMemory 0x8237AB00[0x38] 06:45:23:234 2288 DetectCureTDL3: DRIVER_OBJECT: 82394AC0 06:45:23:234 2288 KLMD_ReadMem: Trying to ReadMemory 0x82394AC0[0xA8] 06:45:23:234 2288 KLMD_ReadMem: Trying to ReadMemory 0xE1471800[0x1A] 06:45:23:234 2288 DetectCureTDL3: DRIVER_OBJECT name: \Driver\atapi, Driver Name: atapi 06:45:23:234 2288 DetectCureTDL3: IrpHandler (0) addr: F84826F2 06:45:23:234 2288 DetectCureTDL3: IrpHandler (1) addr: 804FA87E 06:45:23:234 2288 DetectCureTDL3: IrpHandler (2) addr: F84826F2 06:45:23:234 2288 DetectCureTDL3: IrpHandler (3) addr: 804FA87E 06:45:23:234 2288 DetectCureTDL3: IrpHandler (4) addr: 804FA87E 06:45:23:234 2288 DetectCureTDL3: IrpHandler (5) addr: 804FA87E 06:45:23:234 2288 DetectCureTDL3: IrpHandler (6) addr: 804FA87E 06:45:23:234 2288 DetectCureTDL3: IrpHandler (7) addr: 804FA87E 06:45:23:234 2288 DetectCureTDL3: IrpHandler (8) addr: 804FA87E 06:45:23:234 2288 DetectCureTDL3: IrpHandler (9) addr: 804FA87E 06:45:23:234 2288 DetectCureTDL3: IrpHandler (10) addr: 804FA87E 06:45:23:234 2288 DetectCureTDL3: IrpHandler (11) addr: 804FA87E 06:45:23:250 2288 DetectCureTDL3: IrpHandler (12) addr: 804FA87E 06:45:23:250 2288 DetectCureTDL3: IrpHandler (13) addr: 804FA87E 06:45:23:250 2288 DetectCureTDL3: IrpHandler (14) addr: F8482712 06:45:23:250 2288 DetectCureTDL3: IrpHandler (15) addr: F847E852 06:45:23:250 2288 DetectCureTDL3: IrpHandler (16) addr: 804FA87E 06:45:23:250 2288 DetectCureTDL3: IrpHandler (17) addr: 804FA87E 06:45:23:250 2288 DetectCureTDL3: IrpHandler (18) addr: 804FA87E 06:45:23:250 2288 DetectCureTDL3: IrpHandler (19) addr: 804FA87E 06:45:23:250 2288 DetectCureTDL3: IrpHandler (20) addr: 804FA87E 06:45:23:250 2288 DetectCureTDL3: IrpHandler (21) addr: 804FA87E 06:45:23:250 2288 DetectCureTDL3: IrpHandler (22) addr: F848273C 06:45:23:250 2288 DetectCureTDL3: IrpHandler (23) addr: F8489336 06:45:23:250 2288 DetectCureTDL3: IrpHandler (24) addr: 804FA87E 06:45:23:250 2288 DetectCureTDL3: IrpHandler (25) addr: 804FA87E 06:45:23:250 2288 DetectCureTDL3: IrpHandler (26) addr: 804FA87E 06:45:23:250 2288 KLMD_ReadMem: Trying to ReadMemory 0xF847F864[0x400] 06:45:23:250 2288 TDL3_StartIoHookDetect: CheckParameters: 0, 00000000, 0 06:45:23:250 2288 TDL3_FileDetect: Processing driver: atapi 06:45:23:250 2288 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\DRIVERS\atapi.sys 06:45:23:250 2288 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\DRIVERS\atapi.sys 06:45:23:250 2288 TDL3_FileDetect: C:\WINDOWS\system32\DRIVERS\atapi.sys - Verdict: Clean 06:45:23:250 2288 06:45:23:250 2288 DetectCureTDL3: DEVICE_OBJECT: 82398AB8 06:45:23:250 2288 KLMD_GetLowerDeviceObject: Trying to get lower device object for 82398AB8 06:45:23:250 2288 DetectCureTDL3: DEVICE_OBJECT: 8239AF18 06:45:23:250 2288 KLMD_GetLowerDeviceObject: Trying to get lower device object for 8239AF18 06:45:23:250 2288 DetectCureTDL3: DEVICE_OBJECT: 82397D98 06:45:23:250 2288 KLMD_GetLowerDeviceObject: Trying to get lower device object for 82397D98 06:45:23:250 2288 KLMD_ReadMem: Trying to ReadMemory 0x82397D98[0x38] 06:45:23:250 2288 DetectCureTDL3: DRIVER_OBJECT: 82394AC0 06:45:23:250 2288 KLMD_ReadMem: Trying to ReadMemory 0x82394AC0[0xA8] 06:45:23:250 2288 KLMD_ReadMem: Trying to ReadMemory 0xE1471800[0x1A] 06:45:23:250 2288 DetectCureTDL3: DRIVER_OBJECT name: \Driver\atapi, Driver Name: atapi 06:45:23:250 2288 DetectCureTDL3: IrpHandler (0) addr: F84826F2 06:45:23:250 2288 DetectCureTDL3: IrpHandler (1) addr: 804FA87E 06:45:23:250 2288 DetectCureTDL3: IrpHandler (2) addr: F84826F2 06:45:23:250 2288 DetectCureTDL3: IrpHandler (3) addr: 804FA87E 06:45:23:250 2288 DetectCureTDL3: IrpHandler (4) addr: 804FA87E 06:45:23:250 2288 DetectCureTDL3: IrpHandler (5) addr: 804FA87E 06:45:23:250 2288 DetectCureTDL3: IrpHandler (6) addr: 804FA87E 06:45:23:250 2288 DetectCureTDL3: IrpHandler (7) addr: 804FA87E 06:45:23:250 2288 DetectCureTDL3: IrpHandler (8) addr: 804FA87E 06:45:23:250 2288 DetectCureTDL3: IrpHandler (9) addr: 804FA87E 06:45:23:250 2288 DetectCureTDL3: IrpHandler (10) addr: 804FA87E 06:45:23:250 2288 DetectCureTDL3: IrpHandler (11) addr: 804FA87E 06:45:23:250 2288 DetectCureTDL3: IrpHandler (12) addr: 804FA87E 06:45:23:250 2288 DetectCureTDL3: IrpHandler (13) addr: 804FA87E 06:45:23:250 2288 DetectCureTDL3: IrpHandler (14) addr: F8482712 06:45:23:250 2288 DetectCureTDL3: IrpHandler (15) addr: F847E852 06:45:23:250 2288 DetectCureTDL3: IrpHandler (16) addr: 804FA87E 06:45:23:250 2288 DetectCureTDL3: IrpHandler (17) addr: 804FA87E 06:45:23:250 2288 DetectCureTDL3: IrpHandler (18) addr: 804FA87E 06:45:23:250 2288 DetectCureTDL3: IrpHandler (19) addr: 804FA87E 06:45:23:250 2288 DetectCureTDL3: IrpHandler (20) addr: 804FA87E 06:45:23:250 2288 DetectCureTDL3: IrpHandler (21) addr: 804FA87E 06:45:23:250 2288 DetectCureTDL3: IrpHandler (22) addr: F848273C 06:45:23:250 2288 DetectCureTDL3: IrpHandler (23) addr: F8489336 06:45:23:250 2288 DetectCureTDL3: IrpHandler (24) addr: 804FA87E 06:45:23:250 2288 DetectCureTDL3: IrpHandler (25) addr: 804FA87E 06:45:23:250 2288 DetectCureTDL3: IrpHandler (26) addr: 804FA87E 06:45:23:250 2288 KLMD_ReadMem: Trying to ReadMemory 0xF847F864[0x400] 06:45:23:250 2288 TDL3_StartIoHookDetect: CheckParameters: 0, 00000000, 0 06:45:23:250 2288 TDL3_FileDetect: Processing driver: atapi 06:45:23:250 2288 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\DRIVERS\atapi.sys 06:45:23:250 2288 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\DRIVERS\atapi.sys 06:45:23:265 2288 TDL3_FileDetect: C:\WINDOWS\system32\DRIVERS\atapi.sys - Verdict: Clean 06:45:23:265 2288 UtilityBootReinit: Reboot required for cure complete.. 06:45:23:265 2288 MyNtCreateFileW: NtCreateFile(\??\C:\WINDOWS\system32\drivers\klmdb.sys) returned status 00000000 06:45:23:265 2288 UtilityBootReinit: KLMD drop success 06:45:23:265 2288 KLMD_ApplyPendList: Pending buffer(6233_263B, 1032) dropped successfully 06:45:23:265 2288 UtilityBootReinit: Cure on reboot scheduled successfully 06:45:23:265 2288 06:45:23:265 2288 Completed 06:45:23:265 2288 06:45:23:265 2288 Results: 06:45:23:265 2288 Memory objects infected / cured / cured on reboot: 0 / 0 / 0 06:45:23:265 2288 Registry objects infected / cured / cured on reboot: 2 / 0 / 2 06:45:23:265 2288 File objects infected / cured / cured on reboot: 6 / 0 / 6 06:45:23:265 2288 06:45:23:265 2288 MyNtCreateFileW: NtCreateFile(\??\C:\WINDOWS\system32\drivers\klmd.sys) returned status 00000000 06:45:23:265 2288 UtilityDeinit: KLMD(ARK) unloaded successfully All processes killed ========== OTL ========== Error: No service named LiveUpdate was found to stop! Unable to stop service LiveUpdate! File C:\Program Files\Symantec\LiveUpdate\LuComServer_3_3.EXE not found. Error: Unable to stop service mfehidk! Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mfehidk deleted successfully. C:\WINDOWS\system32\drivers\mfehidk.sys moved successfully. Service mferkdk stopped successfully! Service mferkdk deleted successfully! C:\WINDOWS\system32\drivers\mferkdk.sys moved successfully. Error: Unable to stop service MPFP! Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MPFP deleted successfully. C:\WINDOWS\system32\drivers\Mpfp.sys moved successfully. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}\ deleted successfully. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\DXDllRegExe deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\linkscanner\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F274614C-63F8-47D5-A4D1-FBDDE494F8D1}\ deleted successfully. File {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll File not found not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{46d2a3dc-0f86-11de-9ef7-000475be28e9}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{46d2a3dc-0f86-11de-9ef7-000475be28e9}\ not found. File I:\setupSNK.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6690eee4-cb56-11de-8d62-000475be28e9}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6690eee4-cb56-11de-8d62-000475be28e9}\ not found. File I:\RunUltraLock.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a8439c41-b6a0-11de-9f29-000475be28e9}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a8439c41-b6a0-11de-9f29-000475be28e9}\ not found. File I:\RunUltraLock.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b24b0043-6a59-11dd-ac95-000475be28e9}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b24b0043-6a59-11dd-ac95-000475be28e9}\ not found. File wdsync.exe not found. C:\WINDOWS\system32\net.net moved successfully. C:\WINDOWS\g3rtrv.dll moved successfully. ========== COMMANDS ========== [EMPTYTEMP] User: Administrator ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes User: All Users User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes User: LocalService ->Temp folder emptied: 66016 bytes ->Temporary Internet Files folder emptied: 32902 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes User: Owner ->Temp folder emptied: 797295613 bytes ->Temporary Internet Files folder emptied: 917638 bytes ->Java cache emptied: 29514731 bytes ->FireFox cache emptied: 37454334 bytes %systemdrive% .tmp files removed: 34062336 bytes %systemroot% .tmp files removed: 2402044 bytes %systemroot%\System32 .tmp files removed: 2577 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 4196532 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 23944172 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 887.00 mb OTL by OldTimer - Version 3.1.26.0 log created on 01252010_071250 Files\Folders moved on Reboot… Registry entries deleted on Reboot…

RPMcMurphy

Post #13January 26, 2010, 4:40 AM UTC

chiefw,

OK, we made some good progress there! Lets make sure you are completely clean before we put your AV back on (I'd limit online activities until then as well):

🖼Click to load external image (Posted Image) Please download Malwarebytes' Anti-Malware to your desktop.

Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform full scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected.
When completed, a log will open in Notepad. Please save it to a convenient location and post the results.

🖼Click to load external image (Posted Image) Using Internet Explorer or Firefox, visit Kaspersky Online Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.

2. To optimize scanning time and produce a more sensible report for review:

Close any open programs
Turn off the real time scanner of any existing antivirus program while performing the online scan. Click HERE to see how to disable the most common antivirus programs.

3. Click Run at the Security prompt.

The program will then begin downloading and installing and will also update the database.
Please be patient as this can take quite a long time to download.

Once the update is complete, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
- Spyware, adware, dialers, and other riskware
- Archives
- E-mail databases
Click on My Computer under the green Scan bar to the left to start the scan.
Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
Click View report… at the bottom.
Click the Save report… button.

[external image: Posted Image]
Change the Files of type dropdown box to Text file (.txt) and name the file KasReport.txt to save the file to your desktop so that you may post it in your next reply

Please include the following in your next post:

MBAM log
Kaspersky log

Let me know how the computer is running

chiefw

Post #14January 27, 2010, 2:03 AM UTC

OK, Here is MBAM and K Log Machine is definately acting better. Mozilla no longer redirects URL's, no more commercials in the background. Hopefully I am ready, and can, load new AV. Malwarebytes' Anti-Malware 1.44 Database version: 3639 Windows 5.1.2600 Service Pack 3 Internet Explorer 7.0.5730.13 1/25/2010 11:51:40 PM mbam-log-2010-01-25 (23-51-40).txt Scan type: Full Scan (C:\|H:\|) Objects scanned: 220691 Time elapsed: 3 hour(s), 46 minute(s), 29 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 2 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: C:\Spyware\XDelBox\quarantine\update.exe (Trojan.LinkBucks) -> Quarantined and deleted successfully. C:\_OTL\MovedFiles\01252010_071250\C_WINDOWS\g3rtrv.dll (Trojan.Hiloti) -> Quarantined and deleted successfully. KASPERSKY ONLINE SCANNER 7.0: scan report Tuesday, January 26, 2010 Operating system: Microsoft Windows XP Professional Service Pack 3 (build 2600) Kaspersky Online Scanner version: 7.0.26.13 Last database update: Tuesday, January 26, 2010 09:23:05 Records in database: 3372511 ——————————————————————————– Scan settings: scan using the following database: extended Scan archives: yes Scan e-mail databases: yes Scan area - My Computer: A:\ C:\ D:\ E:\ F:\ G:\ H:\ Scan statistics: Objects scanned: 102595 Threats found: 0 Infected objects found: 0 Suspicious objects found: 0 Scan duration: 03:19:55 No threats found. Scanned area is clean. Selected area has been scanned.

RPMcMurphy

Post #15January 27, 2010, 3:39 AM UTC

chiefw,

Looks good! Your log showed remnants of both Symantec and McAfee. I recommend that you run the removal tools for those, then reinstall one program of your choosing. Here are the links to the removal tools:

Symantec
McAfee

Now we have some important cleanup to do:

🖼Click to load external image (Posted Image) Run OTL.exe

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL
```
:Commands
[CLEARALLRESTOREPOINTS]
```
Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done

🖼Click to load external image (Posted Image) Clean up with OTL:

Double-click OTL.exe to start the program.
Close all other programs apart from OTL as this step will require a reboot
On the OTL main screen, press the CLEANUP button
Say Yes to the prompt and then allow the program to reboot your computer.
Manually delete any remaining tools and/or logs

🖼Click to load external image (Posted Image) Your Adbobe reader needs to be updated. Please visit Adobe's site and grab the newest version.

Go HERE to scan for any other out of date and/or vulnerable applications on your computer and follow the instructions given for updating them.

Please remove this program via Control Panel > Add/remove programs: Java™ 6 Update 6

🖼Click to load external image (Posted Image) Finally, I'd like to make a couple of suggestions to help you stay clean in the future:

Restart any anti-malware programs that we disabled while we were cleaning your machine.
Keep your antivirus application current and updated. Also, hang on to MBAM. Scan with them at least weekly.
Consider running in a limited user account. See this post for more information.
Please carefully review the information in our Security - Best Practices and Prevention forum located HERE

Please post once more so I know you are all set and I can close this thread. Good luck and stay safe!

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] XP Infected with virus or something

✨ Ask AI

Ask AI