What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] XP Antivirus Pro 2010 infection

35 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
This just showed up today while my husband was on the computer and I was at work. Tried to coach him over the phone, but I'm afraid I'm the tech-savvy one. So, Friday night and I'm trying to get the mess off the computer; we haven't followed any of its lures; using Firefox to avoid its redirector/browser hijacker. I've got SpyWare Blaster, Uniblue SpyEraser, SpyWare Search and Destroy, but apparently either nothing was up or they missed it, and once on the computer, couldn't get rid of it. :pullhair: So, I turn to you wonderful folks…I have followed your instructions, and here's the logfile. What do I do next? Stormicats Malwarebytes' Anti-Malware 1.44 Database version: 3765 Windows 5.1.2600 Service Pack 3 Internet Explorer 7.0.5730.11 2/19/2010 8:14:37 PM mbam-log-2010-02-19 (20-14-37).txt Scan type: Quick Scan Objects scanned: 158800 Time elapsed: 6 minute(s), 4 second(s) Memory Processes Infected: 1 Memory Modules Infected: 0 Registry Keys Infected: 7 Registry Values Infected: 2 Registry Data Items Infected: 3 Folders Infected: 2 Files Infected: 10 Memory Processes Infected: C:\Documents and Settings\Michael\Local Settings\Application Data\av.exe (ROGUE.Win7Antispyware2010) -> Unloaded process successfully. Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CLASSES_ROOT\CLSID\{e9383002-fc55-4330-b9c9-67e03bc5c840} (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{32131238-5434-4234-4234-432432423432} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{32131238-5434-4234-4234-432432423432} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\The Weather Channel (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\System\CurrentControlSet\Services\iTunesMusic (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\typelib (Fake.Dropped.Malware) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Weather Services (Adware.Hotbar) -> Quarantined and deleted successfully. Registry Values Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{e9383002-fc55-4330-b9c9-67e03bc5c840} (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\systemcheck2 (Trojan.Agent) -> Quarantined and deleted successfully. Registry Data Items Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. Folders Infected: C:\WINDOWS\system32\smp (Fake.Dropped.Malware) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Start Menu\Programs\SpyEraser (Rogue.SpyEraser) -> Quarantined and deleted successfully. Files Infected: C:\Documents and Settings\All Users\Start Menu\Programs\SpyEraser\SpyEraser.lnk (Rogue.SpyEraser) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Start Menu\Programs\SpyEraser\SpyEraser Help.lnk (Rogue.SpyEraser) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Start Menu\Programs\SpyEraser\Uninstall SpyEraser.lnk (Rogue.SpyEraser) -> Quarantined and deleted successfully. C:\Documents and Settings\Michael\Local Settings\Application Data\av.exe (ROGUE.Win7Antispyware2010) -> Quarantined and deleted successfully. C:\Program Files\aimax.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully. C:\Program Files\chksign.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully. C:\Program Files\nssckbi.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully. C:\Program Files\oscres.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully. C:\Program Files\PopupShim.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully. C:\Program Files\StatsShim.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
Post #2
Hello Stormicats and :welcome:

My name is JonTom.

  • Malware Logs can sometimes take a lot of time to research and interpret.
  • Please be patient while I try to assist with your problem. If at any time you do not understand what is required, please ask for further explanation.
  • Please note that there is no "Quick Fix" to modern malware infections and we may need to use several different approaches to get your system clean.
  • Read every reply you receive carefully and thoroughly before carrying out the instructions. You may also find it helpful to print out the instructions you receive, as in some instances you may have to disconnect your computer from the Internet.

  • Please be aware that I am still in training, and all of my replies to you will be checked for accuracy by one of our experts to ensure that I am giving you the best possible advice.
  • This may cause a delay in response time, but I will do my best to keep it as short as possible.
  • I am checking over your log, and I will post back shortly with instructions.
Post #3
JonTom, thanks for the welcome. This forum helped me some time ago when a similar infection occurred. I ran the steps, as you see below in the logs, and this morning my computer appeared clean. The Windows protections (firewall, etc.) had been turned off, but I had no trouble turning them back on. Spybot and Uniblue are both running and I was able to download, install and run Norton 360 (we scraped up the space on a card to buy it). It found no infections or problems this morning. Am I missing something, or are your tools really that good? Or did the nasty simply not get a serious hold on our computer because we caught it fast enough? I think from now on, I will forgo just about anything but gas in the car and feeding my kids to make sure this computer stays clean. I'm a writer and an email administrator; although I don't do most of the company work on this computer, it occasionally happens. And since I hope my writing to be my future, this computer is too valuable to allow the sleazebags of the world to mess with it. Again, if that's all it takes, then hooray and you are all Malware Slayers Extraordinaire. If I need to do anything else, just let me know. :notworthy: Stormicats
Post #4
Hello Stormicats

I was able to download, install and run Norton 360. It found no infections or problems this morning.


It sounds as though you may have had a very narrow escape.

However, a second opinion never did anyone any harm, and after reading your MBAM log I think it would be very wise to double check that everything is as it should be. Please work your way through the following steps:

  • Please perform the following scan


    • Please download DDS from here or here and save it to your desktop.
    • Disable any script blocking protection (How to Disable your Security Programs)
    • Double click on the DDS icon to run the tool (may take up to 3 minutes to run).
    • When done, DDS.txt will open.
    • After a few moments, attach.txt will open in a second window.
    • Save both reports to your desktop.
    • Please post the contents of the DDS.txt and Attach.txt logs in your next reply.

  • Please scan your system with GMER


    • Please download GMER from here and save the file to your desktop.
    • NOTE: The saved ".exe" file will have a completely random name. This is normal.

    • You can also download the zipped GMER program from here, here or here.
    • If you download GMER from one of the zipped links, unzip the file (called gmer.zip) to your desktop.

    • Before scanning, please make sure that all other running programs are closed and that no other actions (such as a scheduled antivirus scan) will occur while the scan is being performed. Do not use your computer for anything else during the scan.
    • Double click on the "randomname.exe" or "gmer.exe" to run the program.

    • Caution! These types of scans can produce false positives. Do NOT take any action on any "<— ROOKIT" entries unless advised!
    • If possible rootkit activity is found, you will be asked if you would like to perform a full scan.
    • Click on "NO".
    • In the right panel, you will see a number of boxes that have check marks placed next to them.
    • Leave these boxes as they are, but please ensure that the "Show all" box is un-checked.
    • Now click the "Scan" button.
    • Once the scan is complete, you may receive another notice about rootkit activity. This is normal.
    • Click on "OK".
    • GMER will produce a log. Click on the [Save..] button, and in the File name area, type in "GMER.txt".
    • Save the file where you can easily find it, such as your desktop.
    • Post the contents of GMER.txt in your next reply.

    In your next reply, please provide the DDS logs and the GMER log. Are you experiencing any more symptoms?
Post #5
Well, I apparently spoke too soon. My husband got up earlier than me, tried to get to the Internet, and couldn't, with either Firefox or IE. I came in to see what was going on and saw that Norton 360, which we'd bought and installed yesterday, was not active. A reboot brought no change, I had to go into Programs and start it there – the desktop icon did nothing. Firefox is not saving any history. When I tell it to save my tabs and reopen next time, it fails to do so. Obviously, we are still messed up. I've done all the things you asked me for, and here are the various logs. I am re-enabling the Windows Firewall, Norton, Spybot and Uniblue SpyEraser. If any of these is a problem, please let me know.

Attachments:

Post #6
Hello Stormicats

Thank you for the logs. However, there is no need to attach them. Please just paste them directly into your replies :)


  • P2P Programs:

    • P2P programs are a major source of Malware infections.
    • From your log I see you have µTorrent and LimeWire 4.8.1. We do not pass judgment on file-sharing, however we must inform you that engaging in this activity and having this kind of software installed on your system will always make you more susceptible to Malware infections.
    • The use of P2P programs may be contributing to your current situation, and you would certainly be doing yourself a favour by removing them.
    • If you wish to keep the program(s), please do not use them until your computer is cleaned.
    • Information regarding the risk of using these programs can be found from here and here.
    • It is strongly recommend that you uninstall any P2P programs you have on your system.
    • To do this, Click on "Start" then on "Control Panel" and then on "Add or remove programs".
    • A list of currently installed programs will be displayed.
    • Find the µTorrent and LimeWire 4.8.1 programs, click on them once and then click on the "Remove" button.
    • If you are prompted to re-boot your computer to complete the uninstall please do so.


      PLEASE NOTE:
    • Even if you are using a P2P program that is deemed safe, it is only the program that is safe. Any files that you receive using a "safe" P2P program may be infected with Malware. The malware writers use P2P file-sharing as a major conduit to spread infected files.

  • Foistware


    • I can see from your log that you have Viewpoint Manager installed.
    • Viewpoint Manager is considered "foistware" rather than malware since it is installed without user's approval but doesn't spy or do anything "bad".
    • It is recommended that you remove Viewpoint products. However, this choice is up to you.
    • To remove these programs, click "Start" and then on "Control Panel" and then on "Add or Remove Programs".
    • Select Viewpoint Manager and click on "Remove".


    tried to get to the Internet, and couldn't, with either Firefox or IE


    Are you able to connect to the internet at all? If you are not able to connect, please use a clean (uninfected) machine to burn the following tool to disk.


    You have some drivers that may interfere with our tools. We will need to temporarily disable them. We will re-enable them when we are done.

  • DeFogger


    • Please download DeFogger to your desktop.
    • Double click DeFogger to run the tool.
    • The application window will appear
    • Click the Disable button to disable your CD Emulation drivers
    • Click Yes to continue
    • A 'Finished!' message will appear
    • Click OK
    • DeFogger will now ask to reboot the machine - click OK
    IMPORTANT! If you receive an error message while running DeFogger, please post the log defogger_disable which will appear on your desktop.

    Do not re-enable these drivers until otherwise instructed.


  • Please scan your system with GMER


    • Please scan with GMER again and post the contents of the log created.

  • RootRepeal


    • Please download RootRepeal to your desktop
    • Physically disconnect your machine from the internet as your system will be unprotected.
    • Unzip it to it's own folder, close all other programs especially your security programs (anti-spyware, anti-virus, and firewall) and run RootRepeal.exe
    • Click the Report tab at the bottom and then the Scan button.
    • A box will pop up, check the boxes beside Drivers, Files, Processes SSDT and click OK.
    • Another box will open, check the boxes beside all the drives, eg : C:\, then click OK.
    • The scan will take a little while to run, so let it go unhindered.
    • Once it is done, click the "Save Report" button, call it RepealScan and save the log to your desktop.
    • Reconnect to the internet.
    • Post the log here in your reply.

    Please copy and paste the GMER log and the RootRepeal log into your next reply.
Post #7
Ran defogger; no problems. Cannot get GMER to complete. Three tries have resulted in lockups and reboots. On the last one, I managed to get Task Manager open and displaying. 100% CPU usage by two files, both named ccSvcHst.exe. One showing as being under SYSTEM; the other under my name. I had to hard reboot the computer; it would not shut down normally. I have no logs for you; sorry; I couldn't get anything to save. Where do we go from here? PS – I will not be able to get back to you on this until Thursday night. Tomorrow I am singing (yes, singing) and won't be home until pretty late. Thank you for your help and your patience. I will check back as quickly as I can.
Post #9
Hello Stormicats

It is very important for us to have a GMER (or RootRepeal) log as this may give us an indcation about what is infecting your system.

Did you try RootRepeal? If you didn't, please run it and if it works successfully, post the results for me to review.


sorry; I couldn't get anything to save



Don't worry :) Lets try this instead:


  • Reboot Your System in Safe Mode


    • Please print out the GMER instructions and the instructions provided below before proceeding, as once you are in Safe Mode you will be unable to connect to the Internet.
    • Follow the steps below to Start Your Computer in Safe Mode:
    • Restart your computer.
    • As soon as BIOS is loaded begin tapping the F8 key until the "Advanced Options" menu appears.
    • Use the arrow keys to select the "Safe mode" menu item.
    • Press Enter.

  • Please run GMER in Safe Mode


    • Once you are in Safe Mode, click on the re-named file to start the program.
    • Work your way through the steps listed to run the scan.
    • Once GMER has finished, reboot back into normal mode and post the log created in your next reply.


    If GMER crashes when you run it from safe mode please try the following:

    Cannot get GMER to complete

    When you open GMER, does the program crash during the initial scan, or during the full scan? If the program is able to complete the initial scan, please try this:

  • Please open GMER


    • Once GMER has completed its initial scan, you will be asked if you would like to perform a full scan.
    • Click on "NO".
    • In the panel on the right hand side of the GMER window, you will see a number of boxes that have check marks placed next to them.
    • Please ensure that the "Show all" box is un-checked and then un-check the box marked "Devices", and the box marked "Files".
    • Now click the "Scan" button.

    If a log is produced please post it in your next reply. If you are still having trouble getting the log please let me know.
Post #11 last edited
Okay, new fun and games – how do I get around a non-responsive keyboard? Apparently while booting up, my computer doesn't pay attention to sissy things like F8 and arrow keys. I'm just a bundle of fun, ain't I? :wall:
Post #12
Hello Stormicats

You have not mentioned what happened to the RootRepeal scan I requested (Post #6).

Did you run the tool?

Please scan with RoorRepeal as requuested and post the log that is created.

Scan your system with DDS again and post the log.


Also, please describe that problems and symptoms are you experiencing at the moment.
Post #13
Oh, great, wise and PATIENT JonTom! ;) Sorry about that – I had fixated on getting the GMER to run again, and had not skipped it and gone on to the Root Repeal. Remember, I'm a total novice at this sort of thing – I honestly thought I had to get GMER to run before going on. Here's the Root Repeal Log: ROOTREPEAL © AD, 2007-2009 ================================================== Scan Start Time: 2010/02/28 22:25 Program Version: Version 1.3.5.0 Windows Version: Windows XP SP3 ================================================== Drivers ——————- Name: dump_diskdump.sys Image Path: C:\WINDOWS\System32\Drivers\dump_diskdump.sys Address: 0xB0E40000 Size: 16384 File Visible: No Signed: - Status: - Name: dump_iteraid.sys Image Path: C:\WINDOWS\System32\Drivers\dump_iteraid.sys Address: 0xB1718000 Size: 24576 File Visible: No Signed: - Status: - Name: rootrepeal.sys Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys Address: 0xAD352000 Size: 49152 File Visible: No Signed: - Status: - Name: SYMEFA.SYS Image Path: SYMEFA.SYS Address: 0xB9E7E000 Size: 323584 File Visible: No Signed: - Status: - Hidden/Locked Files ——————- Path: C:\System Volume Information\EfaData\SYMEFA1.DB-journal Status: Invisible to the Windows API! Path: c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\srtsp\srtetmp\c832fe11.tmp Status: Allocation size mismatch (API: 1081344, Raw: 0) SSDT ——————- #: 012 Function Name: NtAlertResumeThread Status: Hooked by "" at address 0x88e9a678 #: 013 Function Name: NtAlertThread Status: Hooked by "" at address 0x88e9a178 #: 017 Function Name: NtAllocateVirtualMemory Status: Hooked by "" at address 0x8a46a4d8 #: 019 Function Name: NtAssignProcessToJobObject Status: Hooked by "" at address 0x88e16a98 #: 031 Function Name: NtConnectPort Status: Hooked by "" at address 0x8a69c7a0 #: 041 Function Name: NtCreateKey Status: Hooked by "C:\WINDOWS\system32\Drivers\SYMEVENT.SYS" at address 0xb44ea130 #: 043 Function Name: NtCreateMutant Status: Hooked by "" at address 0x8a4ae308 #: 052 Function Name: NtCreateSymbolicLinkObject Status: Hooked by "" at address 0x8a3f2418 #: 053 Function Name: NtCreateThread Status: Hooked by "" at address 0x8a41b1c0 #: 057 Function Name: NtDebugActiveProcess Status: Hooked by "" at address 0x88dcc408 #: 063 Function Name: NtDeleteKey Status: Hooked by "C:\WINDOWS\system32\Drivers\SYMEVENT.SYS" at address 0xb44ea3b0 #: 065 Function Name: NtDeleteValueKey Status: Hooked by "C:\WINDOWS\system32\Drivers\SYMEVENT.SYS" at address 0xb44ea910 #: 068 Function Name: NtDuplicateObject Status: Hooked by "" at address 0x8a419b20 #: 083 Function Name: NtFreeVirtualMemory Status: Hooked by "" at address 0x8a3f1b98 #: 089 Function Name: NtImpersonateAnonymousToken Status: Hooked by "" at address 0x88de3900 #: 091 Function Name: NtImpersonateThread Status: Hooked by "" at address 0x88dd14b8 #: 097 Function Name: NtLoadDriver Status: Hooked by "" at address 0x897e46d0 #: 108 Function Name: NtMapViewOfSection Status: Hooked by "" at address 0x8a430c48 #: 114 Function Name: NtOpenEvent Status: Hooked by "" at address 0x88e305e0 #: 122 Function Name: NtOpenProcess Status: Hooked by "" at address 0x8a4429d8 #: 123 Function Name: NtOpenProcessToken Status: Hooked by "" at address 0x88dccef8 #: 125 Function Name: NtOpenSection Status: Hooked by "" at address 0x88dcc868 #: 128 Function Name: NtOpenThread Status: Hooked by "" at address 0x8a46ba38 #: 137 Function Name: NtProtectVirtualMemory Status: Hooked by "" at address 0x8a432838 #: 206 Function Name: NtResumeThread Status: Hooked by "" at address 0x88e17678 #: 213 Function Name: NtSetContextThread Status: Hooked by "" at address 0x8a491270 #: 228 Function Name: NtSetInformationProcess Status: Hooked by "" at address 0x8a439630 #: 240 Function Name: NtSetSystemInformation Status: Hooked by "" at address 0x88dcc638 #: 247 Function Name: NtSetValueKey Status: Hooked by "C:\WINDOWS\system32\Drivers\SYMEVENT.SYS" at address 0xb44eab60 #: 253 Function Name: NtSuspendProcess Status: Hooked by "" at address 0x88e13ef8 #: 254 Function Name: NtSuspendThread Status: Hooked by "" at address 0x89d8f5b8 #: 257 Function Name: NtTerminateProcess Status: Hooked by "" at address 0x88dcccc8 #: 258 Function Name: NtTerminateThread Status: Hooked by "" at address 0x88e1d178 #: 267 Function Name: NtUnmapViewOfSection Status: Hooked by "" at address 0x8a504068 #: 277 Function Name: NtWriteVirtualMemory Status: Hooked by "" at address 0x8a40c9d8 ==EOF== Here's the DDS file: DDS (Ver_09-12-01.01) - FAT32x86 Run by [removed] at 22:36:57.26 on Sun 02/28/2010 Internet Explorer: 7.0.5730.11 BrowserJavaVersion: 1.6.0_18 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1983.1426 [GMT -6:00] AV: Norton 360 *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8} FW: Norton 360 *disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220} ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe -k netsvcs C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup svchost.exe svchost.exe C:\WINDOWS\system32\spoolsv.exe svchost.exe C:\WINDOWS\system32\CTsvcCDA.exe C:\Program Files\EarthLink TotalAccess\WENGINE\wmonitor.exe C:\Program Files\Norton 360\Engine\3.8.0.41\ccSvcHst.exe C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe C:\Program Files\BurnAware Free\nmsaccessu.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\IoctlSvc.exe C:\WINDOWS\System32\svchost.exe -k imgsvc C:\WINDOWS\System32\MsPMSPSv.exe C:\Program Files\Compact Wireless-G USB Network Adapter with SpeedBooster\WLService.exe C:\Program Files\Compact Wireless-G USB Network Adapter with SpeedBooster\WUSB54GSC.exe C:\Program Files\Iomega\AutoDisk\ADService.exe C:\Program Files\Canon\CAL\CALMAIN.exe C:\Program Files\Norton 360\Engine\3.8.0.41\ccSvcHst.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Analog Devices\SoundMAX\Smtray.exe C:\Program Files\Logitech\MouseWare\system\em_exec.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe C:\Program Files\Brother\ControlCenter3\brccMCtl.exe C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe C:\Program Files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe C:\Program Files\Microsoft IntelliType Pro\itype.exe C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\System32\svchost.exe -k HTTPFilter C:\Documents and Settings\Jennifer\Desktop\dds.scr ============== Pseudo HJT Report =============== uStart Page = hxxp://start.earthlink.net/ uDefault_Search_URL = hxxp://www.earthlink.net/partner/more/msie/button/search.html uSearch Page = hxxp://www.earthlink.net/partner/more/msie/button/search.html uSearch Bar = hxxp://start.earthlink.net/AL/Search mStart Page = uURLSearchHooks: SrchHook Class: {44f9b173-041c-4825-a9b9-d914bd9dcbb3} - c:\program files\earthlink totalaccess\ElnIE.dll uURLSearchHooks: H - No File mWinlogon: Userinit=c:\windows\system32\userinit.exe BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 6.0\acrobat\activex\AcroIEHelper.dll BHO: Spybot-S&D; IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll BHO: Symantec NCO BHO: {602adb0e-4aff-4217-8aa1-95dac4dfa408} - c:\program files\norton 360\engine\3.8.0.41\coIEPlg.dll BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - c:\program files\norton 360\engine\3.8.0.41\IPSBHO.DLL BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.1.1309.3572\swg.dll BHO: {B7FF285A-95E0-4C5A-AA93-C4C701533649} - No File BHO: {C9932651-3EB0-4B27-B701-714A6CE4495F} - No File BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: {DE95B055-D183-49F7-873D-AEAB755869CA} - No File BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll BHO: {F835EF2C-3621-41F6-8275-EFD2A4B2B6A2} - No File TB: Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - c:\program files\norton 360\engine\3.8.0.41\coIEPlg.dll TB: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File TB: {C7768536-96F8-4001-B1A2-90EE21279187} - No File EB: {4528BBE0-4E08-11D5-AD55-00010333D0AD} - No File EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRun: [Uniblue SpyEraser] "c:\program files\uniblue\spyeraser\SpyEraser.exe" -m uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe uRun: [ISUSPM] "c:\program files\common files\installshield\updateservice\ISUSPM.exe" -scheduler mRun: [IgfxTray] "c:\windows\system32\igfxtray.exe" mRun: [HotKeysCmds] "c:\windows\system32\hkcmd.exe" mRun: [Smapp] "c:\program files\analog devices\soundmax\Smtray.exe" mRun: [Logitech Utility] "c:\windows\Logi_MwX.Exe" mRun: [nwiz] nwiz.exe /install mRun: [RTHDCPL] "c:\windows\RTHDCPL.EXE" mRun: [Alcmtr] "c:\windows\ALCMTR.EXE" mRun: [BrMfcWnd] "c:\program files\brother\brmfcmon\BrMfcWnd.exe" /AUTORUN mRun: [ControlCenter3] "c:\program files\brother\controlcenter3\brctrcen.exe" /autorun mRun: [NBKeyScan] "c:\program files\nero\nero8\nero backitup\NBKeyScan.exe" mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime mRun: [LexPPS.exe] c:\windows\system32\lexpps.exe mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe" mRun: [] mRun: [RoxWatchTray] "c:\program files\common files\roxio shared\9.0\sharedcom\RoxWatchTray9.exe" dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t mExplorerRun: [TUxpvnTwnl] c:\documents and settings\michael\desktop\AdobeFlashPlayerExt.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office\OSA9.EXE StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\eventr~1.lnk - c:\program files\broderbund\broderbund homework helpers\pmremind.exe IE: {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - c:\program files\new folder\aim.exe IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - hxxp://download.microsoft.com/download/e/4/9/e494c802-dd90-4c6b-a074-469358f075a6/OGAControl.cab DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} - hxxp://www.creative.com/su/ocx/15030/CTSUEng.cab DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} - hxxp://pcpitstop.com/pcpitstop/PCPitStop.CAB DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204 DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} - hxxp://mpijdecd01/wfica.cab DPF: {50F65670-1729-11D2-A51F-0020AFE5D502} - hxxp://objects.compuserve.com/chat/RTCChat.cab DPF: {597C45C2-2D39-11D5-8D53-0050048383FE} - hxxp://office.microsoft.com/productupdates/content/opuc.cab DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1099769654536 DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1124156383368 DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} - hxxp://www.nick.com/common/groove/gx/GrooveAX27.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab DPF: {9059F30F-4EB1-4BD2-9FDC-36F43A218F4A} - hxxp://mpijdecd01/oncall/msrdp.cab DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} - hxxp://us.dl1.yimg.com/download.yahoo.com/dl/installs/suite/yautocomplete.cab DPF: {BCBC9371-595D-11D4-A96D-00105A1CEF6C} - hxxp://hgtv1.view22.com/view22/app/view22rte.cab DPF: {CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab DPF: {CC32D4D8-2A0B-4CEB-B105-C9B968379105} - hxxps://disney.go.com/games/downloads/gamemanager/DIGGameManager.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab DPF: {D5EBF06F-9BAF-11D0-B12D-00C04FC39CEA} - hxxp://info.manpower.com/activex/pcanywhere/pawrem.cab DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} - hxxp://www.creative.com/su/ocx/15030/CTPID.cab Handler: symres - {AA1061FE-6C41-421f-9344-69640C9732AB} - c:\program files\norton 360\engine\3.8.0.41\CoIEPlg.dll Name-Space Handler: ftp\GetRightIEClickCatcher - {73BA8F12-723E-11D1-A9E2-00403320FCF2} - c:\old d\program files\getright\xx2gr.dll Name-Space Handler: http\GetRightIEClickCatcher - {73BA8F12-723E-11D1-A9E2-00403320FCF2} - c:\old d\program files\getright\xx2gr.dll Notify: igfxcui - igfxsrvc.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SEH: Eudora's Shell Extension: {edb0e980-90bd-11d4-8599-0008c7d3b6f8} - c:\eudora\EuShlExt.dll SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\wifd1f~1\MpShHook.dll ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\jennifer\applic~1\mozilla\firefox\profiles\default.bc7\ FF - prefs.js: browser.startup.homepage - hxxp://www.theanimalrescuesite.com/clickToGive/home.faces?siteId=3 FF - component: c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\coffplgn\components\coFFPlgn.dll FF - component: c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\ipsffplgn\components\IPSFFPl.dll FF - plugin: c:\oldd~1\progra~1\netsca~1\program\plugins\np32dsw.dll FF - plugin: c:\oldd~1\progra~1\netsca~1\program\plugins\npaudio.dll FF - plugin: c:\oldd~1\progra~1\netsca~1\program\plugins\npavi32.dll FF - plugin: c:\oldd~1\progra~1\netsca~1\program\plugins\npbeatnk.dll FF - plugin: c:\oldd~1\progra~1\netsca~1\program\plugins\npdrmv2.dll FF - plugin: c:\oldd~1\progra~1\netsca~1\program\plugins\npdsplay.dll FF - plugin: c:\oldd~1\progra~1\netsca~1\program\plugins\NPEvery.dll FF - plugin: c:\oldd~1\progra~1\netsca~1\program\plugins\NPExpFTP.dll FF - plugin: c:\oldd~1\progra~1\netsca~1\program\plugins\NPJava11.dll FF - plugin: c:\oldd~1\progra~1\netsca~1\program\plugins\NPJava12.dll FF - plugin: c:\oldd~1\progra~1\netsca~1\program\plugins\NPJava13.dll FF - plugin: c:\oldd~1\progra~1\netsca~1\program\plugins\NPJava14.dll FF - plugin: c:\oldd~1\progra~1\netsca~1\program\plugins\NPJava32.dll FF - plugin: c:\oldd~1\progra~1\netsca~1\program\plugins\NPJPI142.dll FF - plugin: c:\oldd~1\progra~1\netsca~1\program\plugins\npnsda.dll FF - plugin: c:\oldd~1\progra~1\netsca~1\program\plugins\npnul32.dll FF - plugin: c:\oldd~1\progra~1\netsca~1\program\plugins\NPOJI610.dll FF - plugin: c:\oldd~1\progra~1\netsca~1\program\plugins\nppdf32.dll FF - plugin: c:\oldd~1\progra~1\netsca~1\program\plugins\nppl3260.dll FF - plugin: c:\oldd~1\progra~1\netsca~1\program\plugins\npqtplugin.dll FF - plugin: c:\oldd~1\progra~1\netsca~1\program\plugins\npqtplugin2.dll FF - plugin: c:\oldd~1\progra~1\netsca~1\program\plugins\npqtplugin3.dll FF - plugin: c:\oldd~1\progra~1\netsca~1\program\plugins\nprfxins.dll FF - plugin: c:\oldd~1\progra~1\netsca~1\program\plugins\nprjplug.dll FF - plugin: c:\oldd~1\progra~1\netsca~1\program\plugins\nprpjplug.dll FF - plugin: c:\oldd~1\progra~1\netsca~1\program\plugins\NPSVG3.dll FF - plugin: c:\oldd~1\progra~1\netsca~1\program\plugins\NPSWF32.dll FF - plugin: c:\oldd~1\progra~1\netsca~1\program\plugins\npt3dhd.dll FF - plugin: c:\oldd~1\progra~1\netsca~1\program\plugins\npwmsdrm.dll FF - plugin: c:\oldd~1\progra~1\netsca~1\program\plugins\npyacs.dll FF - plugin: c:\program files\common files\research in motion\bbwebsllauncher\NPWebSLLauncher.dll FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll FF - plugin: c:\program files\google\google updater\2.4.1636.7222\npCIDetect13.dll FF - plugin: c:\program files\google\update\1.2.183.17\npGoogleOneClick8.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\ FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} —- FIREFOX POLICIES —- c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true); ============= SERVICES / DRIVERS =============== R0 iteraid;ITERAID_Service_Install;c:\windows\system32\drivers\iteraid.sys [2007-4-8 24971] R0 ppa;Iomega Parallel Port Filter Driver;c:\windows\system32\drivers\ppa.sys [2002-9-15 17792] R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\n360\0308000.029\SymEFA.sys [2010-2-20 310320] R1 BHDrvx86;Symantec Heuristics Driver;c:\windows\system32\drivers\n360\0308000.029\BHDrvx86.sys [2010-2-20 259632] R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\n360\0308000.029\cchpx86.sys [2010-2-20 482432] R1 IDSxpx86;IDSxpx86;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\definitions\ipsdefs\20100224.002\IDSXpx86.sys [2010-2-26 329592] R2 EarthLinkMonitor;EarthLink Monitor Service;c:\program files\earthlink totalaccess\wengine\wmonitor.exe [2005-1-26 65604] R2 N360;Norton 360;c:\program files\norton 360\engine\3.8.0.41\ccSvcHst.exe [2010-2-20 117640] R2 WinDefend;Windows Defender;c:\program files\windows defender\MsMpEng.exe [2006-11-3 13592] R2 WUSB54GSCSVC;WUSB54GSCSVC;c:\program files\compact wireless-g usb network adapter with speedbooster\WLService.exe [2008-2-18 53307] R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2010-2-21 102448] R3 NAVENG;NAVENG;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\definitions\virusdefs\20100228.005\NAVENG.SYS [2010-2-28 84912] R3 NAVEX15;NAVEX15;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\definitions\virusdefs\20100228.005\NAVEX15.SYS [2010-2-28 1324720] S2 gupdate1ca20173d865692;Google Update Service (gupdate1ca20173d865692);c:\program files\google\update\GoogleUpdate.exe [2009-8-18 133104] S3 BW2NDIS5;BW2NDIS5;c:\windows\system32\drivers\BW2NDIS5.SYS [2004-11-1 17536] S3 rcp_service;ReaConverter scheduler service;c:\program files\reaconverter 5.5 pro\rcp_scheduler.exe [2007-11-30 558592] S4 Volitmutorwa;Volitmutorwa; [x] =============== Created Last 30 ================ 2010-02-28 15:27:46 0 d-sh–w- C:\FOUND.014 2010-02-27 11:57:12 0 d-sh–w- C:\FOUND.013 2010-02-26 11:44:02 0 d-sh–w- C:\FOUND.012 2010-02-25 11:42:52 0 d-sh–w- C:\FOUND.011 2010-02-24 11:38:38 0 d-sh–w- C:\FOUND.010 2010-02-24 04:04:06 0 d-sh–w- C:\FOUND.009 2010-02-24 00:43:41 0 —-a-w- c:\documents and settings\jennifer\defogger_reenable 2010-02-22 15:19:22 0 d—–w- c:\windows\system32\N360_BACKUP 2010-02-21 17:20:59 0 d—–w- c:\docume~1\jennifer\applic~1\Malwarebytes 2010-02-21 13:04:53 40001 —-a-w- c:\windows\system32\unknown_mini_F21A2B85742A4A7BA95E67A150BC8BE5.7z 2010-02-21 13:01:04 0 d-sh–w- C:\FOUND.008 2010-02-20 16:41:58 36400 —-a-r- c:\windows\system32\drivers\SymIM.sys 2010-02-20 16:41:53 806 —-a-w- c:\windows\system32\drivers\SYMEVENT.INF 2010-02-20 16:41:53 7456 —-a-w- c:\windows\system32\drivers\SYMEVENT.CAT 2010-02-20 16:41:53 60808 —-a-w- c:\windows\system32\S32EVNT1.DLL 2010-02-20 16:41:53 124976 —-a-w- c:\windows\system32\drivers\SYMEVENT.SYS 2010-02-20 16:41:52 0 d—–w- c:\program files\Symantec 2010-02-20 16:41:29 0 d—–w- c:\windows\system32\drivers\N360 2010-02-20 16:41:27 0 d—–w- c:\program files\Norton 360 2010-02-20 16:40:48 0 d—–w- c:\program files\NortonInstaller 2010-02-20 01:42:21 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-02-20 01:42:19 19160 —-a-w- c:\windows\system32\drivers\mbam.sys 2010-02-20 01:42:19 0 d—–w- c:\program files\Malwarebytes' Anti-Malware 2010-02-20 01:42:19 0 d—–w- c:\docume~1\alluse~1\applic~1\Malwarebytes 2010-02-20 01:24:25 0 d—–w- c:\program files\a-squared HiJackFree 2010-02-18 10:01:00 0 d-sh–w- C:\FOUND.007 2010-02-12 12:41:12 0 d-sh–w- C:\FOUND.006 2010-02-12 00:28:27 0 d—–w- c:\docume~1\jennifer\applic~1\Tific 2010-02-09 11:55:00 0 d-sh–w- C:\FOUND.005 2010-02-02 11:57:38 0 d-sh–w- C:\FOUND.004 ==================== Find3M ==================== 2010-02-24 15:16:06 181632 ——w- c:\windows\system32\MpSigStub.exe 2010-02-20 16:41:50 26600 —-a-r- c:\windows\system32\drivers\GEARAspiWDM.sys 2010-02-20 16:41:44 107368 —-a-r- c:\windows\system32\GEARAspi.dll 2009-12-31 16:50:04 353792 —-a-w- c:\windows\system32\drivers\srv.sys 2009-12-31 16:50:04 353792 ——w- c:\windows\system32\dllcache\srv.sys 2009-12-31 15:33:06 70656 —-a-w- c:\windows\system32\dllcache\ie4uinit.exe 2009-12-31 15:33:06 13824 —-a-w- c:\windows\system32\dllcache\ieudinit.exe 2009-12-18 13:05:44 634648 —-a-w- c:\windows\system32\dllcache\iexplore.exe 2009-12-18 13:04:10 161792 —-a-w- c:\windows\system32\dllcache\ieakui.dll 2009-12-17 23:14:00 411368 —-a-w- c:\windows\system32\deploytk.dll 2009-12-16 18:43:28 343040 ——w- c:\windows\system32\mspaint.exe 2009-12-16 18:43:28 343040 ——w- c:\windows\system32\dllcache\mspaint.exe 2009-12-14 07:08:24 33280 ——w- c:\windows\system32\dllcache\csrsrv.dll 2009-12-14 07:08:24 33280 ——w- c:\windows\system32\csrsrv.dll 2009-12-08 19:27:52 2189184 ——w- c:\windows\system32\dllcache\ntoskrnl.exe 2009-12-08 19:26:16 2145280 —-a-w- c:\windows\system32\ntoskrnl.exe 2009-12-08 19:26:16 2145280 ——w- c:\windows\system32\dllcache\ntkrnlmp.exe 2009-12-08 18:43:52 2023936 —-a-w- c:\windows\system32\ntkrnlpa.exe 2009-12-08 18:43:52 2023936 ——w- c:\windows\system32\dllcache\ntkrpamp.exe 2009-12-08 18:43:50 2066048 ——w- c:\windows\system32\dllcache\ntkrnlpa.exe 2009-12-08 09:23:28 474112 ——w- c:\windows\system32\dllcache\shlwapi.dll 2009-12-04 18:22:22 455424 ——w- c:\windows\system32\dllcache\mrxsmb.sys 2009-05-04 21:00:40 60879 —-a-w- c:\program files\INSTALL.LOG 2008-03-01 23:26:18 13255661 —-a-w- c:\program files\Luxor.zip 2004-05-30 17:02:32 464 —-a-w- c:\program files\convert.lnk 2003-12-30 05:55:20 515 —-a-w- c:\program files\Uninstall AOL Instant Messenger.lnk 2003-08-01 16:27:30 69632 —-a-w- c:\program files\Patcher.dll 2003-08-01 16:25:52 49152 —-a-w- c:\program files\ProgressDlg.dll 2003-08-01 15:48:10 116852 —-a-w- c:\program files\uninstll.exe 2003-08-01 15:48:08 1335296 —-a-w- c:\program files\AimRes.dll 2003-08-01 15:31:06 61440 —-a-w- c:\program files\aim.exe 2003-08-01 15:30:58 143360 —-a-w- c:\program files\AimCoreSvcs.dll 2003-08-01 15:30:44 196608 —-a-w- c:\program files\AimSecondarySvcs.dll 2003-08-01 15:30:26 41984 —-a-w- c:\program files\AlertUI.ocm 2003-08-01 15:30:18 24064 —-a-w- c:\program files\browse.ocm 2003-08-01 15:30:10 163840 —-a-w- c:\program files\buddyui.ocm 2003-08-01 15:30:00 10752 —-a-w- c:\program files\advert.ocm 2003-08-01 15:29:56 2048 —-a-w- c:\program files\ShareFile.exe 2003-08-01 15:29:54 90112 —-a-w- c:\program files\ChatUI.ocm 2003-08-01 15:29:42 13312 —-a-w- c:\program files\Admin.ocm 2003-08-01 15:29:36 184320 —-a-w- c:\program files\icbmui.ocm 2003-08-01 15:29:24 54272 —-a-w- c:\program files\aimapi.dll 2003-08-01 15:29:16 5632 —-a-w- c:\program files\stats.ocm 2003-08-01 15:29:10 57344 —-a-w- c:\program files\locateui.ocm 2003-08-01 15:29:04 102400 —-a-w- c:\program files\miscui.ocm 2003-08-01 15:28:56 11776 —-a-w- c:\program files\NTP.ocm 2003-08-01 15:28:50 131072 —-a-w- c:\program files\ateima32.dll 2003-08-01 15:28:40 56320 —-a-w- c:\program files\OscMail.ocm 2003-08-01 15:28:34 18944 —-a-w- c:\program files\aimtalk.dll 2003-08-01 15:28:22 61440 —-a-w- c:\program files\osclogin.ocm 2003-08-01 15:28:14 94208 —-a-w- c:\program files\ticker.ocm 2003-08-01 15:28:14 7168 —-a-w- c:\program files\oscmain.ocm 2003-08-01 15:28:14 2048 —-a-w- c:\program files\SendFile.exe 2003-08-01 15:28:08 34304 —-a-w- c:\program files\rvapps.ocm 2003-08-01 15:28:02 73728 —-a-w- c:\program files\OscSrch.ocm 2003-08-01 15:27:54 147456 —-a-w- c:\program files\aimauto.exe 2003-08-01 15:27:50 33792 —-a-w- c:\program files\startup.ocm 2003-08-01 15:27:36 11776 —-a-w- c:\program files\osconfig.ocm 2003-08-01 15:27:34 8192 —-a-w- c:\program files\popup.ocm 2003-08-01 15:27:28 192512 —-a-w- c:\program files\wndutils.dll 2003-08-01 15:27:04 221184 —-a-w- c:\program files\inetsocket.dll 2003-08-01 15:26:04 32768 —-a-w- c:\program files\proto.ocm 2003-08-01 15:25:52 151552 —-a-w- c:\program files\oscarui.dll 2003-08-01 15:25:34 163840 —-a-w- c:\program files\oscore.dll 2003-08-01 15:25:14 180224 —-a-w- c:\program files\ate32.dll 2003-08-01 15:25:04 102400 —-a-w- c:\program files\xmlparse.dll 2003-08-01 15:25:02 6144 —-a-w- c:\program files\idlemon.dll 2003-06-02 15:06:48 73728 —-a-w- c:\program files\coolpeer.dll 2003-06-02 15:06:38 3584 —-a-w- c:\program files\coolsos.dll 2003-06-02 15:06:36 184320 —-a-w- c:\program files\coolbos.dll 2003-06-02 15:06:16 98304 —-a-w- c:\program files\coolbucky.dll 2003-06-02 15:06:02 45056 —-a-w- c:\program files\coolhttp.dll 2003-06-02 15:05:50 57344 —-a-w- c:\program files\coolsecnss.dll 2003-06-02 15:05:32 61440 —-a-w- c:\program files\coolsocket.dll 2003-06-02 15:05:08 8192 —-a-w- c:\program files\xptl.dll 2003-06-02 15:05:06 12288 —-a-w- c:\program files\xpcs.dll 2003-06-02 15:05:02 126976 —-a-w- c:\program files\xprt.dll 2003-04-21 20:25:04 1559 —-a-w- c:\program files\icbmftvc.lst 2003-04-10 22:09:10 477346 —-a-w- c:\program files\AIM95.HLP 2003-04-10 18:43:16 15907 —-a-w- c:\program files\licens32.txt 2003-04-01 16:04:08 12312 —-a-w- c:\program files\aim95.CNT 2003-03-26 23:49:28 339968 —-a-w- c:\program files\softokn3.dll 2003-03-26 23:49:28 327680 —-a-w- c:\program files\nss3.dll 2003-03-26 23:49:28 110592 —-a-w- c:\program files\ssl3.dll 2003-03-26 23:49:28 102400 —-a-w- c:\program files\smime3.dll 2003-01-06 19:41:36 1457 —-a-w- c:\program files\rvappstm.lst 2002-12-18 20:28:50 28672 —-a-w- c:\program files\plc4.dll 2002-12-18 20:28:50 24576 —-a-w- c:\program files\plds4.dll 2002-12-18 20:28:50 147456 —-a-w- c:\program files\nspr4.dll 2002-12-11 18:49:48 2836 —-a-w- c:\program files\aim.odl 2002-12-11 18:49:48 2622 —-a-w- c:\program files\netwait.odl 2002-08-02 22:40:38 364544 —-a-w- c:\program files\dBenderC.dll 2002-07-18 15:00:02 139264 —-a-w- c:\program files\dunzip32.dll 2001-10-22 22:52:12 131574 —-a-w- c:\program files\REGISTER.EXE 2001-10-19 00:02:44 648 —-a-w- c:\program files\START.DAT 2001-10-15 19:12:14 417 —-a-w- c:\program files\ITECH.CFG 2001-09-28 22:00:28 164864 —-a-w- c:\program files\unwise32.exe 2001-09-21 17:47:14 13414 —-a-w- c:\program files\INDEX.DAT 2001-09-21 00:26:00 80 —-a-w- c:\program files\SN.DAT 2001-09-12 17:43:50 1687552 —-a-w- c:\program files\TNGENG.EXE 2008-09-01 03:11:36 32768 –sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008083120080901\index.dat ============= FINISH: 22:37:18.53 =============== And here's the Attach file: UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT DDS (Ver_09-12-01.01) Microsoft Windows XP Home Edition Boot Device: \Device\Harddisk0\DP(1)0x7e00-0x12a0507e00+1 Install Date: 9/15/2002 1:52:53 PM System Uptime: 2/28/2010 9:19:55 AM (13 hours ago) Motherboard: Gigabyte Technology Co., Ltd. | | M61VME-S2 Processor: AMD Athlon™ 64 X2 Dual Core Processor 3800+ | Socket M2 | 2009/200mhz ==== Disk Partitions ========================= A: is Removable C: is FIXED (FAT32) - 74 GiB total, 2.665 GiB free. D: is CDROM () E: is CDROM () ==== Disabled Device Manager Items ============= ==== System Restore Points =================== RP332: 1/13/2010 3:41:38 PM - System Checkpoint RP333: 1/14/2010 2:30:20 PM - Software Distribution Service 3.0 RP334: 1/15/2010 2:51:40 PM - System Checkpoint RP335: 1/16/2010 3:41:31 PM - System Checkpoint RP336: 1/17/2010 11:25:32 PM - System Checkpoint RP337: 1/18/2010 9:11:18 AM - Software Distribution Service 3.0 RP338: 1/19/2010 9:43:34 AM - System Checkpoint RP339: 1/20/2010 10:43:28 AM - System Checkpoint RP340: 1/21/2010 10:01:37 AM - Software Distribution Service 3.0 RP341: 1/22/2010 10:29:06 AM - System Checkpoint RP342: 1/23/2010 3:01:52 AM - Software Distribution Service 3.0 RP343: 1/24/2010 5:07:31 AM - System Checkpoint RP344: 1/25/2010 6:57:44 AM - System Checkpoint RP345: 1/26/2010 7:03:57 AM - System Checkpoint RP346: 1/27/2010 2:15:07 PM - Software Distribution Service 3.0 RP347: 1/27/2010 5:11:16 PM - Installed Java™ 6 Update 18 RP348: 1/28/2010 4:52:39 PM - Software Distribution Service 3.0 RP349: 1/29/2010 5:14:07 PM - System Checkpoint RP350: 1/30/2010 6:29:12 PM - System Checkpoint RP351: 2/1/2010 7:15:06 AM - System Checkpoint RP352: 2/1/2010 2:05:14 PM - Software Distribution Service 3.0 RP353: 2/2/2010 2:50:43 PM - System Checkpoint RP354: 2/3/2010 6:27:47 PM - System Checkpoint RP355: 2/4/2010 7:03:31 PM - System Checkpoint RP356: 2/5/2010 5:54:29 AM - Software Distribution Service 3.0 RP357: 2/6/2010 7:51:10 AM - System Checkpoint RP358: 2/7/2010 9:10:01 AM - System Checkpoint RP359: 2/8/2010 7:54:33 PM - System Checkpoint RP360: 2/9/2010 12:23:24 PM - Software Distribution Service 3.0 RP361: 2/10/2010 3:30:58 PM - System Checkpoint RP362: 2/10/2010 9:06:36 PM - Software Distribution Service 3.0 RP363: 2/11/2010 2:52:16 PM - Software Distribution Service 3.0 RP364: 2/12/2010 3:58:01 PM - System Checkpoint RP365: 2/13/2010 5:11:09 PM - System Checkpoint RP366: 2/14/2010 5:26:58 PM - System Checkpoint RP367: 2/15/2010 5:55:02 PM - System Checkpoint RP368: 2/16/2010 6:04:46 AM - Software Distribution Service 3.0 RP369: 2/17/2010 6:56:26 AM - System Checkpoint RP370: 2/18/2010 7:07:20 AM - System Checkpoint RP371: 2/19/2010 6:16:30 AM - Software Distribution Service 3.0 RP372: 2/19/2010 6:52:14 PM - Spybot-S&D; Spyware removal RP373: 2/19/2010 7:13:15 PM - Spybot-S&D; Spyware removal RP374: 2/20/2010 7:40:11 PM - System Checkpoint RP375: 2/21/2010 11:19:54 AM - Spybot-S&D; Spyware removal RP376: 2/21/2010 12:09:49 PM - Norton 360 Registry Clean RP377: 2/22/2010 9:04:13 AM - Norton 360 Registry Clean RP378: 2/22/2010 1:42:12 PM - Software Distribution Service 3.0 RP379: 2/23/2010 4:11:28 PM - System Checkpoint RP380: 2/23/2010 6:08:05 PM - Software Distribution Service 3.0 RP381: 2/24/2010 11:50:32 PM - Software Distribution Service 3.0 RP382: 2/26/2010 7:29:03 AM - System Checkpoint RP383: 2/27/2010 6:29:56 AM - Software Distribution Service 3.0 RP384: 2/28/2010 9:47:00 AM - System Checkpoint ==== Installed Programs ====================== 3D Groove Playback Engine a-squared HiJackFree 3.1 AAC Decoder Acrobat.com Active Disk Adobe Acrobat 6.0 Professional Adobe AIR Adobe Flash Player 10 ActiveX Adobe Flash Player 10 Plugin Adobe Illustrator CS Adobe Photoshop CS Adobe Shockwave Player 11.5 Adobe SVG Viewer 3.0 AdWare & SpyWare Apple Software Update AudibleManager AutoUpdate AVS Cover Editor [removed] (AVSMedia) AVS DVD Copy version 1.4 BlackBerry Desktop Software 5.0.1 BlackBerry® Media Sync Brother MFL-Pro Suite BurnAware Free 2.3.0 Cake Mania Cake Mania (remove only) Camera Access Library Camera Support Core Library Camera Window DS Camera Window DVC Camera Window MC Camtasia Studio 2 Canon Camera Access Library Canon Camera Support Core Library Canon Camera Window DC_DV 5 for ZoomBrowser EX Canon Camera Window DC_DV 6 for ZoomBrowser EX Canon Camera Window DSLR 5 for ZoomBrowser EX Canon Camera Window MC 6 for ZoomBrowser EX Canon MovieEdit Task for ZoomBrowser EX Canon PhotoRecord Canon RAW Image Task for ZoomBrowser EX Canon Utilities PhotoStitch 3.1 Canon ZoomBrowser EX (E) Cayra Compact Wireless-G USB Network Adapter with SpeedBooster ConvertHelper 2.2 Cosmi Photo Editor Plus Creative MediaSource Creative Removable Disk Manager Creative System Information Creative Zen Vision M Critical Update for Windows Media Player 11 (KB959772) CyberSky Deal Info Dear America Diary Defender Disketch CD Label Software DivX Codec DivX Converter DivX Player DivX Plus DirectShow Filters DivX Version Checker DivX Web Player DVD Identifier dvdSanta 4.50 EarthLink FastLane Earthlink Instant Messenger EarthLink Software EarthLink Wireless High Speed eBay Icon Eudora Fetch FLV Player 1.3.3 Golden Records Vinyl to CD Converter Google Earth Google Update Helper Google Updater H.264 Decoder Harry Potter High Definition Audio Driver Package - KB835221 HighMAT Extension to Microsoft Windows XP CD Writing Wizard HijackThis 2.0.2 Homework Helpers Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595) Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484) Hotfix for Windows Internet Explorer 7 (KB947864) Hotfix for Windows Media Format 11 SDK (KB929399) Hotfix for Windows Media Player 11 (KB939683) Hotfix for Windows XP (KB952287) Hotfix for Windows XP (KB954550-v5) Hotfix for Windows XP (KB961118) Hotfix for Windows XP (KB970653-v3) Hotfix for Windows XP (KB976098-v2) Hotfix for Windows XP (KB979306) Hoyle Solitaire and Mahjong IBM Lotus Sametime Connect 7.5.1 ImagXpress Infine CaptureFlash version 1.6 InSpheration Instant Home Design Intel® Extreme Graphics Driver Iomega App Services IomegaWare IrfanView (remove only) iTunes Java 2 Runtime Environment, SE v1.4.2 Java Auto Updater Java™ 6 Update 16 Java™ 6 Update 18 JetBee FREE 4.0.7 (build 321) Lernout & Hauspie TruVoice for Microsoft Agent Logitech MouseWare 9.79 LunarPhase Pro Demo Luxor Luxor 2 (remove only) Malwarebytes' Anti-Malware Mavis Beacon Teaches Typing Deluxe 17 Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Security Update (KB953297) Microsoft .NET Framework 2.0 Service Pack 2 Microsoft .NET Framework 3.0 Service Pack 2 Microsoft .NET Framework 3.5 SP1 Microsoft Application Error Reporting Microsoft Compression Client Pack 1.0 for Windows XP Microsoft Data Access Components KB870669 Microsoft IntelliType Pro 6.3 Microsoft Internationalized Domain Names Mitigation APIs Microsoft National Language Support Downlevel APIs Microsoft Office 2000 SR-1 Premium Microsoft Silverlight Microsoft User-Mode Driver Framework Feature Pack 1.0 Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 Microsoft Visual C++ 2005 Redistributable Microsoft Web Publishing Wizard 1.52 Microsoft Windows Journal Viewer Microsoft Works 6-9 Converter Microsoft XML Parser MKV Splitter MovieEdit Task Mozilla (1.7.1) Mozilla Firefox (3.5.8) Mozilla Thunderbird (2.0.0.23) MP3 CD Converter 4.02 MPEG Joiner MSN Music Assistant MSXML 4.0 SP2 (KB936181) MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) MSXML 4.0 SP2 and SOAP Toolkit 3.0 MSXML 6.0 Parser (KB933579) My Screen Recorder Pro 2.35 Nancy Drew: Danger on Deception Island Nancy Drew: The Creature of Kapu Cave Nero 8 neroxml Norton 360 NoteWorthy Composer NVIDIA Drivers PaperPort Image Printer PercussionStudio3 Personal License Update Wizard for Windows Media Player Personalized Learning Center Pet Vet (remove only) Pet Vet 2 PhotoStitch Pierresoft Adesign 1.5 Prism Video Converter Professor Teaches Photoshop 6 QuickTime Rainlendar2 (remove only) RAW Image Task 2.2 ReaConverter 5.5 Pro Realtek High Definition Audio Driver Redistributed Files Roxio Media Manager ScanSoft PaperPort 11 Scooby-Doo 2 - Monsters Unleashed Secret Agent™ Barbie™ Security Update for CAPICOM (KB931906) Security Update for Windows Internet Explorer 7 (KB928090) Security Update for Windows Internet Explorer 7 (KB929969) Security Update for Windows Internet Explorer 7 (KB931768) Security Update for Windows Internet Explorer 7 (KB933566) Security Update for Windows Internet Explorer 7 (KB937143) Security Update for Windows Internet Explorer 7 (KB938127) Security Update for Windows Internet Explorer 7 (KB939653) Security Update for Windows Internet Explorer 7 (KB942615) Security Update for Windows Internet Explorer 7 (KB944533) Security Update for Windows Internet Explorer 7 (KB950759) Security Update for Windows Internet Explorer 7 (KB953838) Security Update for Windows Internet Explorer 7 (KB956390) Security Update for Windows Internet Explorer 7 (KB958215) Security Update for Windows Internet Explorer 7 (KB960714) Security Update for Windows Internet Explorer 7 (KB961260) Security Update for Windows Internet Explorer 7 (KB963027) Security Update for Windows Internet Explorer 7 (KB969897) Security Update for Windows Internet Explorer 7 (KB972260) Security Update for Windows Internet Explorer 7 (KB974455) Security Update for Windows Internet Explorer 7 (KB976325) Security Update for Windows Internet Explorer 7 (KB978207) Security Update for Windows Media Player (KB911564) Security Update for Windows Media Player (KB952069) Security Update for Windows Media Player (KB954155) Security Update for Windows Media Player (KB968816) Security Update for Windows Media Player (KB973540) Security Update for Windows Media Player 10 (KB911565) Security Update for Windows Media Player 10 (KB917734) Security Update for Windows Media Player 11 (KB936782) Security Update for Windows Media Player 11 (KB954154) Security Update for Windows Media Player 6.4 (KB925398) Security Update for Windows Media Player 9 (KB917734) Security Update for Windows XP (KB923561) Security Update for Windows XP (KB923689) Security Update for Windows XP (KB938464) Security Update for Windows XP (KB941569) Security Update for Windows XP (KB946648) Security Update for Windows XP (KB950760) Security Update for Windows XP (KB950762) Security Update for Windows XP (KB950974) Security Update for Windows XP (KB951066) Security Update for Windows XP (KB951376-v2) Security Update for Windows XP (KB951376) Security Update for Windows XP (KB951698) Security Update for Windows XP (KB951748) Security Update for Windows XP (KB952004) Security Update for Windows XP (KB952954) Security Update for Windows XP (KB953839) Security Update for Windows XP (KB954211) Security Update for Windows XP (KB954459) Security Update for Windows XP (KB954600) Security Update for Windows XP (KB955069) Security Update for Windows XP (KB956391) Security Update for Windows XP (KB956572) Security Update for Windows XP (KB956744) Security Update for Windows XP (KB956802) Security Update for Windows XP (KB956803) Security Update for Windows XP (KB956841) Security Update for Windows XP (KB956844) Security Update for Windows XP (KB957095) Security Update for Windows XP (KB957097) Security Update for Windows XP (KB958644) Security Update for Windows XP (KB958687) Security Update for Windows XP (KB958690) Security Update for Windows XP (KB958869) Security Update for Windows XP (KB959426) Security Update for Windows XP (KB960225) Security Update for Windows XP (KB960715) Security Update for Windows XP (KB960803) Security Update for Windows XP (KB960859) Security Update for Windows XP (KB961371) Security Update for Windows XP (KB961373) Security Update for Windows XP (KB961501) Security Update for Windows XP (KB968537) Security Update for Windows XP (KB969059) Security Update for Windows XP (KB969898) Security Update for Windows XP (KB969947) Security Update for Windows XP (KB970238) Security Update for Windows XP (KB970430) Security Update for Windows XP (KB971468) Security Update for Windows XP (KB971486) Security Update for Windows XP (KB971557) Security Update for Windows XP (KB971633) Security Update for Windows XP (KB971657) Security Update for Windows XP (KB971961) Security Update for Windows XP (KB972270) Security Update for Windows XP (KB973354) Security Update for Windows XP (KB973507) Security Update for Windows XP (KB973525) Security Update for Windows XP (KB973869) Security Update for Windows XP (KB973904) Security Update for Windows XP (KB974112) Security Update for Windows XP (KB974318) Security Update for Windows XP (KB974392) Security Update for Windows XP (KB974571) Security Update for Windows XP (KB975025) Security Update for Windows XP (KB975467) Security Update for Windows XP (KB975560) Security Update for Windows XP (KB975713) Security Update for Windows XP (KB977165) Security Update for Windows XP (KB977914) Security Update for Windows XP (KB978037) Security Update for Windows XP (KB978251) Security Update for Windows XP (KB978262) Security Update for Windows XP (KB978706) Shockwave SoftV92 Data Fax Modem SoundMAX SoundTap Streaming Audio Recorder Spybot - Search & Destroy SpywareBlaster 4.2 Stellaluna Switch Sound File Converter Symantec Technical Support Web Controls System Requirements Lab The 3D Globe The American Girls Dress Designer ™ The Mystery of the Mummy The Sims Deluxe Edition The Sims™ 2 Sampler - Create-A-Sim The Weather Channel Desktop 6 The White Wolf of Icicle Creek Total 3D Home Deluxe TotalAccess Core Applications TubeHunter Ultra Tunebite [removed] Uniblue DriverScanner 2009 Uniblue SpyEraser Uniblue System Tweaker Uninstall Dual Mode Camera Unlocker 1.8.8 Update for Microsoft .NET Framework 3.5 SP1 (KB963707) Update for Windows Internet Explorer 7 (KB976749) Update for Windows XP (KB951072-v2) Update for Windows XP (KB951978) Update for Windows XP (KB955759) Update for Windows XP (KB955839) Update for Windows XP (KB967715) Update for Windows XP (KB968389) Update for Windows XP (KB971737) Update for Windows XP (KB973687) Update for Windows XP (KB973815) VC80CRTRedist - 8.0.50727.762 VCRedistSetup Video Journal Version 1.4 WavePad Sound Editor WebFldrs XP Where in the USA is Carmen Sandiego for schools WinAVIVideoConverter Windows Defender Windows Defender Signatures Windows Driver Package - Advanced Micro Devices (AmdK8) Processor (05/27/2006 1.3.2.0) Windows Genuine Advantage v1.3.0254.0 Windows Genuine Advantage Validation Tool (KB892130) Windows Imaging Component Windows Internet Explorer 7 Windows Media Format 11 runtime Windows Media Player 10 Hotfix - KB895316 Windows Media Player 11 Windows Media Player 9 Hotfix [See KB885492 for more information] Windows Presentation Foundation Windows XP Service Pack 3 WinRAR archiver WinZip Self-Extractor WordPerfect Office 2002 OEM XML Paper Specification Shared Components Pack 1.0 Y!mLite 292 Y!TunnelPro V1.3 Build 272 Yahoo! Address AutoComplete Yahoo! Internet Mail Yahoo! Messenger Yazak Chat 8.80.0 Your Uninstaller! 2006 Version 5 ==== Event Viewer Messages From Past Week ======== 2/27/2010 7:20:40 AM, error: atapi [9] - The device, \Device\Ide\IdePort0, did not respond within the timeout period. 2/25/2010 3:13:35 PM, error: W32Time [17] - Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 60 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751) 2/25/2010 2:43:35 PM, error: W32Time [17] - Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 30 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751) 2/25/2010 2:28:35 PM, error: W32Time [17] - Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 15 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751) 2/23/2010 8:57:45 PM, error: System Error [1003] - Error code 10000050, parameter1 eaad1000, parameter2 00000000, parameter3 aaf32c3e, parameter4 00000001. 2/23/2010 6:56:10 PM, error: System Error [1003] - Error code 10000050, parameter1 ed552000, parameter2 00000000, parameter3 a9b6ac3e, parameter4 00000001. 2/23/2010 5:49:33 AM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the N360 service. 2/23/2010 12:50:29 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Roxio Hard Drive Watcher 9 service to connect. 2/23/2010 12:50:29 PM, error: Service Control Manager [7000] - The Nero BackItUp Scheduler 4.0 service failed to start due to the following error: The system cannot find the file specified. 2/23/2010 12:49:35 PM, error: Dhcp [1002] - The IP address lease 192.168.1.101 for the Network Card with network address 001A4D64E2D1 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message). 2/22/2010 6:26:52 AM, error: Dhcp [1002] - The IP address lease 192.168.1.103 for the Network Card with network address 001A4D64E2D1 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message). 2/21/2010 7:04:29 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: IDSxpx86 2/21/2010 7:01:23 AM, error: Dhcp [1002] - The IP address lease 192.168.1.100 for the Network Card with network address 001A4D64E2D1 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message). ==== End Of File =========================== Currently we don't seem to be experiencing any problems. I have a flaky cable modem that sometimes doesn't want to send and receive data, and a keyboard that apparently doesn't turn on until Windows does, but otherwise, we're not seeing anything like the mess that brought me to the forum originally. Please let me know if you find anything, and again, thank you for all the effort you've taken on my behalf. I really appreciate it. Stormy
Post #14
Hello Stormicats

Thank you for the logs.

Sorry about that Remember, I'm a total novice at this sort of thing


No problem :)


I would like to take a closer look at some files on your system. Please work your way through the following steps:


  • First we need to make all files and folders VISIBLE:


    • Click "Start" Go to My Computer-> Tools-> Folder Options-> View tab:
    • Choose to "Show hidden files and folders."
    • Uncheck the "Hide protected operating system files" and the "Hide extensions for know file types" boxes.
    • Close the window with "OK".

  • Please scan the following files

    Please visit Virus Total by clicking here.
    You will be taken to a web page that looks like this:
    [external image: Posted Image]

    • Click the Browse button and search for the following file: c:\documents and settings\michael\desktop\AdobeFlashPlayerExt.exe
    • Click Open.
    • Then click Send File.
    • Please be patient while the file is scanned.
    • If Virus Total tells you that the file has already been scanned, click "reanalyse now"
    .

    Once the scan results appear, copy and paste them into Notepad and repeat the procedure for the following file(s):

    c:\old d\program files\getright\xx2gr.dll

    c:\windows\system32\unknown_mini_F21A2B85742A4A7BA95E67A150BC8BE5.7z


We need to create an OTL Report
  • Please download OTL from one of the following mirrors:
    • This is THE Mirror
  • Save it to your desktop.
  • Double click on the [external image: Posted Image] icon on your desktop.
  • Click the "Scan All Users" checkbox.
  • Under "Extra Registry" please check "Use Safelist" and also check "LOP Check" and "Purity Check" as pictured.[external image: Posted Image]
  • Copy and Paste the following code into the [external image: Posted Image] textbox. Do not include the word "Code"

    netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
sceclt.dll
ntelogon.dll
logevent.dll
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT
  • Push [external image: Posted Image]
  • A report will open. Copy and Paste that report in your next reply.
  • Two reports will open, copy and paste them in a reply here:
    • OTListIt.txt <– Will be opened
    • Extra.txt <– Will be minimized

    In your next reply please provide the VirusTotal Scan results and the OTL logs.
Post #15
Hi, JonTom. I will work on these Thursday night, which is the first night I'll have to do so. It's too late in the evening tonight and I have chorus tomorrow evening. I'm sorry. I will run all this and post it before I go to bed Thursday evening. Thank you for your patience.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI