[Resolved] IE 8 redirected, constant reinfection (page 2)

mowman

Post #16May 26, 2010, 8:16 PM UTC

Hello DannyHaggard,please do the following

Download OTL to your desktop.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Check the boxes beside LOP Check and Purity Check.
Under Custom Scan paste this in

netsvcs
%SYSTEMDRIVE%\*.exe
/md5start
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
sceclt.dll
ntelogon.dll
logevent.dll
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
nvrd32.sys
symmpi.sys
adp3132.sys
/md5stop
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
CREATERESTOREPOINT
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
You may need two posts to fit them both in.

[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.

Extract the contents of the zipped file to desktop.
Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

[external image: Posted Image]
Click the image to enlarge it
In the right panel, you will see several boxes that have been checked. Uncheck the following …
- IAT/EAT
- Drives/Partition other than Systemdrive (typically C:\)
- Show All (don't miss this one)
Then click the Scan button & wait for it to finish.
Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
Save it where you can easily find it, such as your desktop, and attach it in your reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

If GMER won't run try with devices unchecked.If still no go try in safe mode.

In your next reply please post the following.

Both OTL logs
GMER log

Deleted Member

Post #17May 28, 2010, 7:59 PM UTC

Here are the log files, sorry it took so long but I had problems getting gmer to run. I am still getting a hit from NAV on Backdoor.Tidserv!inf on file C:\System Volume Information\_restore{AC246330-AFB4-4A89-90D6-56C53F8291CC}\RP23\a0009894.sys

OTL logfile created on: 5/26/2010 3:22:59 PM - Run 1
OTL by OldTimer - Version 3.2.5.0 Folder = C:\Documents and Settings\danny.brownhelicopter\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 60.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 84.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 149.04 Gb Total Space | 26.44 Gb Free Space | 17.74% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
Drive F: | 55.63 Gb Total Space | 1.68 Gb Free Space | 3.01% Space Free | Partition Type: NTFS
Drive G: | 55.63 Gb Total Space | 1.68 Gb Free Space | 3.01% Space Free | Partition Type: NTFS
Drive H: | 136.62 Gb Total Space | 22.97 Gb Free Space | 16.81% Space Free | Partition Type: NTFS
I: Drive not present or media not loaded
Drive S: | 465.76 Gb Total Space | 213.87 Gb Free Space | 45.92% Space Free | Partition Type: NTFS
Drive Z: | 970.13 Mb Total Space | 969.36 Mb Free Space | 99.92% Space Free | Partition Type: FAT

Computer Name: HAGGARD
Current User Name: danny
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\danny.brownhelicopter\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
PRC - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
PRC - C:\Program Files\Yahoo!\Common\YMailAdvisor.exe (Yahoo! Inc.)
PRC - C:\WINDOWS\system32\inetsrv\inetinfo.exe (Microsoft Corporation)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\FolderSize\FolderSizeSvc.exe (Brio)
PRC - C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe (Protexis Inc.)
PRC - C:\Program Files\Chat\Chat.exe (Brown Helicopter)
PRC - C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe (Microsoft Corporation)
PRC - C:\Program Files\Canon\CAL\CALMAIN.exe (Canon Inc.)
PRC - C:\Program Files\Microsoft IntelliType Pro\itype.exe (Microsoft Corporation)
PRC - C:\Program Files\Symantec AntiVirus\VPTray.exe (Symantec Corporation)
PRC - C:\Program Files\Symantec AntiVirus\SavRoam.exe (symantec)
PRC - C:\Program Files\Symantec AntiVirus\Rtvscan.exe (Symantec Corporation)
PRC - C:\Program Files\Symantec AntiVirus\DefWatch.exe (Symantec Corporation)
PRC - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe (Symantec Corporation)
PRC - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe (Symantec Corporation)
PRC - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe (Symantec Corporation)
PRC - C:\Program Files\Common Files\Symantec Shared\ccApp.exe (Symantec Corporation)
PRC - C:\Program Files\Express ClickYes\ClickYes.exe (ContextMagic.com)
PRC - C:\WINDOWS\system32\MDM.EXE (Microsoft Corporation)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\danny.brownhelicopter\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (Browser Defender Update Service) – C:\Program Files\Spyware Doctor\BDT\BDTUpdateService.exe (Threat Expert Ltd.)
SRV - (PublicPreviewTurbineMessageService) – C:\Program Files\Turbine\Turbine Download Manager - Lamannia\TurbineMessageService.exe (Turbine, Inc.)
SRV - (PublicPreviewTurbineNetworkService) – C:\Program Files\Turbine\Turbine Download Manager - Lamannia\TurbineNetworkService.exe (Turbine, Inc.)
SRV - (YahooAUService) – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
SRV - (msvsmon90) – C:\Program Files\Microsoft Visual Studio 9.0\Common7\IDE\Remote Debugger\x86\msvsmon.exe (Microsoft Corporation)
SRV - (W3SVC) – C:\WINDOWS\system32\inetsrv\inetinfo.exe (Microsoft Corporation)
SRV - (SMTPSVC) Simple Mail Transfer Protocol (SMTP) – C:\WINDOWS\system32\inetsrv\inetinfo.exe (Microsoft Corporation)
SRV - (IISADMIN) – C:\WINDOWS\system32\inetsrv\inetinfo.exe (Microsoft Corporation)
SRV - (FolderSize) – C:\Program Files\FolderSize\FolderSizeSvc.exe (Brio)
SRV - (PSI_SVC_2) – C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe (Protexis Inc.)
SRV - (Canon Driver Information Assist Service) – C:\Program Files\Canon\DIAS\CnxDIAS.exe (CANON INC.)
SRV - (MSSQL$SQLEXPRESS) SQL Server (SQLEXPRESS) – C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe (Microsoft Corporation)
SRV - (SQLBrowser) – C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe (Microsoft Corporation)
SRV - (SQLWriter) – C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe (Microsoft Corporation)
SRV - (CCALib8) – C:\Program Files\Canon\CAL\CALMAIN.exe (Canon Inc.)
SRV - (rpcapd) Remote Packet Capture Protocol v.0 (experimental) – C:\Program Files\WinPcap\rpcapd.exe (CACE Technologies)
SRV - (IviRegMgr) – C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe (InterVideo)
SRV - (Commander Service) – C:\Program Files\Seagull\BarTender\7.75\CmdrSrv.exe (Seagull Scientific, Inc)
SRV - (SavRoam) – C:\Program Files\Symantec AntiVirus\SavRoam.exe (symantec)
SRV - (Symantec AntiVirus) – C:\Program Files\Symantec AntiVirus\Rtvscan.exe (Symantec Corporation)
SRV - (DefWatch) – C:\Program Files\Symantec AntiVirus\DefWatch.exe (Symantec Corporation)
SRV - (SPBBCSvc) – C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe (Symantec Corporation)
SRV - (ccSetMgr) – C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe (Symantec Corporation)
SRV - (ccEvtMgr) – C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe (Symantec Corporation)
SRV - (SNDSrvc) – C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe (Symantec Corporation)
SRV - (APC UPS Service) – C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe (American Power Conversion Corporation)
SRV - (MSSQLServerADHelper) – C:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe (Microsoft Corporation)
SRV - (Visual Studio Analyzer RPC bridge) – C:\Program Files\Microsoft Visual Studio\Common\Tools\VS-Ent98\Vanalyzr\VARPC.EXE (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV - (catchme) – File not found
DRV - (NAVEX15) – C:\Program Files\Common Files\Symantec Shared\VirusDefs\20100503.002\NAVEX15.SYS (Symantec Corporation)
DRV - (NAVENG) – C:\Program Files\Common Files\Symantec Shared\VirusDefs\20100503.002\NAVENG.SYS (Symantec Corporation)
DRV - (nv) – C:\WINDOWS\system32\drivers\nv4_mini.sys (NVIDIA Corporation)
DRV - (PCTCore) – C:\WINDOWS\system32\drivers\PCTCore.sys (PC Tools)
DRV - (EraserUtilRebootDrv) – C:\Program Files\Common Files\Symantec Shared\eengine\EraserUtilRebootDrv.sys (Symantec Corporation)
DRV - (eeCtrl) – C:\Program Files\Common Files\Symantec Shared\eengine\eeCtrl.sys (Symantec Corporation)
DRV - (LMouFilt) – C:\WINDOWS\system32\drivers\LMouFilt.Sys (Logitech, Inc.)
DRV - (LUsbFilt) – C:\WINDOWS\system32\drivers\LUsbFilt.sys (Logitech, Inc.)
DRV - (LHidFilt) – C:\WINDOWS\system32\drivers\LHidFilt.Sys (Logitech, Inc.)
DRV - (nm) – C:\WINDOWS\system32\drivers\nmnt.sys (Microsoft Corporation)
DRV - (HidBatt) – C:\WINDOWS\system32\drivers\hidbatt.sys (Microsoft Corporation)
DRV - (HDAudBus) – C:\WINDOWS\system32\drivers\hdaudbus.sys (Windows ® Server 2003 DDK provider)
DRV - (Haspnt) – C:\WINDOWS\system32\drivers\Haspnt.sys (Aladdin Knowledge Systems)
DRV - (e1express) Intel® – C:\WINDOWS\system32\drivers\e1e5132.sys (Intel Corporation)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) – C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (regi) – C:\WINDOWS\system32\drivers\regi.sys (InterVideo)
DRV - (HECI) Intel® – C:\WINDOWS\system32\drivers\HECI.sys (Intel Corporation)
DRV - (NPF) – C:\WINDOWS\system32\drivers\npf.sys (CACE Technologies)
DRV - (SymEvent) – C:\Program Files\Symantec\SYMEVENT.SYS (Symantec Corporation)
DRV - (SPBBCDrv) – C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys (Symantec Corporation)
DRV - (SYMTDI) – C:\WINDOWS\System32\Drivers\SYMTDI.SYS (Symantec Corporation)
DRV - (SYMREDRV) – C:\WINDOWS\System32\Drivers\SYMREDRV.SYS (Symantec Corporation)
DRV - (SAVRTPEL) – C:\Program Files\Symantec AntiVirus\Savrtpel.sys (Symantec Corporation)
DRV - (SAVRT) – C:\Program Files\Symantec AntiVirus\savrt.sys (Symantec Corporation)
DRV - (Iviaspi) – C:\WINDOWS\system32\drivers\iviaspi.sys (InterVideo, Inc.)
DRV - (Hardlock) – C:\WINDOWS\system32\drivers\hardlock.sys (Aladdin Knowledge Systems)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Search Bar = http://search.msn.com/spbasic.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Yahoo! Search
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://search.yahoo.com/search?p={searchTe…-8&fr=b1ie7
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://my.yahoo.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch =
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =

FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Program Files\Real\RealPlayer\browserrecord [2009/02/13 12:21:08 | 000,000,000 | —D | M]

O1 HOSTS File: ([2010/05/26 14:06:35 | 000,000,027 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn4\yt.dll (Yahoo! Inc.)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn4\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (PC Tools Browser Guard) - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll File not found
O4 - HKLM..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe (Symantec Corporation)
O4 - HKLM..\Run: [itype] C:\Program Files\Microsoft IntelliType Pro\itype.exe (Microsoft Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [Seagull Drivers] C:\WINDOWS\ssdal_nc.exe ()
O4 - HKLM..\Run: [SpybotSnD] C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe (Safer Networking Limited)
O4 - HKLM..\Run: [vptray] C:\Program Files\Symantec AntiVirus\VPTray.exe (Symantec Corporation)
O4 - HKLM..\Run: [YMailAdvisor] C:\Program Files\Yahoo!\Common\YMailAdvisor.exe (Yahoo! Inc.)
O4 - HKCU..\Run: [Express ClickYes] C:\Program Files\Express ClickYes\ClickYes.exe (ContextMagic.com)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - Startup: C:\Documents and Settings\danny.brownhelicopter\Start Menu\Programs\Startup\Chat.lnk = G:\vbapps\Chat.exe (CPASoftware)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Main present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoWelcomeScreen = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: DisablePersonalDirChange = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoWelcomeScreen = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra Button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll (Yahoo! Inc.)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.)
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} http://office.microsoft.com/templates/ieawsdc.cab (Microsoft Office Template and Media Control)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\Common\Yinsthelper.dll (Installation Support)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…t/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0014-0002-0016-ABCDEFFEDCBA} http://java.sun.com/products/plugin/autodl…indows-i586.cab (Java Plug-in 1.4.2_16)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_03)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_05)
O16 - DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553536000} http://fpdownload.macromedia.com/pub/shock…ash/swflash.cab (Reg Error: Key error.)
O16 - DPF: Garmin Communicator Plug-In https://my.garmin.com/mygarmin/m/GarminAxControl.CAB (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.111.2
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = brownhelicopter.local
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - File not found
O20 - Winlogon\Notify\NavLogon: DllName - C:\WINDOWS\system32\NavLogon.dll - C:\WINDOWS\system32\NavLogon.dll (Symantec Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007/12/13 09:52:44 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - C:\WINDOWS\system32\ias [2007/12/13 03:33:59 | 000,000,000 | —D | M]
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (16902109354000384)

========== Files/Folders - Created Within 30 Days ==========

[2010/05/26 15:20:52 | 000,000,000 | —D | C] – C:\Documents and Settings\danny.brownhelicopter\Desktop\gmer
[2010/05/26 15:16:48 | 000,571,904 | —- | C] (OldTimer Tools) – C:\Documents and Settings\danny.brownhelicopter\Desktop\OTL.exe
[2010/05/26 14:22:49 | 000,000,000 | —D | C] – C:\Documents and Settings\danny.brownhelicopter\Local Settings\Application Data\Yahoo!
[2010/05/26 13:57:04 | 000,000,000 | —D | C] – C:\dannyfix24102d
[2010/05/25 17:23:05 | 000,000,000 | —D | C] – C:\Program Files\ESET
[2010/05/25 03:00:22 | 000,000,000 | —D | C] – C:\WINDOWS\LastGood
[2010/05/24 17:42:24 | 000,000,000 | —D | C] – C:\dannyfix19068d
[2010/05/24 14:06:33 | 000,000,000 | RHSD | C] – C:\cmdcons
[2010/05/24 14:01:14 | 000,000,000 | —D | C] – C:\dannyfix
[2010/05/21 16:50:58 | 000,000,000 | —D | C] – C:\Program Files\NVIDIA Corporation
[2010/05/17 10:59:14 | 000,000,000 | —D | C] – C:\Documents and Settings\danny.brownhelicopter\Application Data\uqm
[2010/05/17 10:59:14 | 000,000,000 | —D | C] – C:\Program Files\The Ur-Quan Masters
[2010/05/14 15:21:26 | 000,000,000 | —D | C] – C:\Program Files\Trend Micro
[2010/05/13 09:35:23 | 000,000,000 | —D | C] – C:\Documents and Settings\danny.brownhelicopter\Local Settings\Application Data\File Renamer Basic
[2010/05/13 09:35:10 | 000,000,000 | —D | C] – C:\Program Files\File Renamer
[2010/05/13 09:31:00 | 000,000,000 | —D | C] – C:\Documents and Settings\danny.brownhelicopter\WINDOWS
[2010/05/12 16:49:24 | 000,000,000 | —D | C] – C:\Documents and Settings\danny.brownhelicopter\My Documents\test
[2010/05/12 13:16:32 | 000,061,440 | —- | C] (Khronos Group) – C:\WINDOWS\System32\OpenCL.dll
[2010/05/12 13:16:31 | 014,757,888 | —- | C] (NVIDIA Corporation) – C:\WINDOWS\System32\nvoglnt.dll
[2010/05/12 13:16:30 | 004,075,520 | —- | C] (NVIDIA Corporation) – C:\WINDOWS\System32\nvcuda.dll
[2010/05/12 13:16:30 | 002,646,632 | —- | C] (NVIDIA Corporation) – C:\WINDOWS\System32\nvcuvenc.dll
[2010/05/12 13:16:30 | 002,030,184 | —- | C] (NVIDIA Corporation) – C:\WINDOWS\System32\nvcuvid.dll
[2010/05/12 13:16:29 | 011,647,592 | —- | C] (NVIDIA Corporation) – C:\WINDOWS\System32\nvcompiler.dll
[2010/05/12 13:16:29 | 001,097,728 | —- | C] (NVIDIA Corporation) – C:\WINDOWS\System32\nvapi.dll
[2010/05/12 13:16:29 | 000,227,944 | —- | C] (NVIDIA Corporation) – C:\WINDOWS\System32\nvcodins.dll
[2010/05/12 13:16:29 | 000,227,944 | —- | C] (NVIDIA Corporation) – C:\WINDOWS\System32\nvcod.dll
[2010/05/12 13:15:59 | 082,045,688 | —- | C] (NVIDIA Corporation) – C:\Documents and Settings\danny.brownhelicopter\My Documents\197.45_desktop_winxp_32bit_english_whql.exe
[2010/05/08 07:20:19 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Sun
[2010/05/03 16:44:59 | 000,314,328 | —- | C] (Intel Corporation) – C:\Documents and Settings\danny.brownhelicopter\My Documents\BoardID.exe
[2010/05/03 11:43:01 | 000,000,000 | —D | C] – C:\Program Files\Spybot - Search & Destroy
[2010/05/03 11:43:01 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
[2010/05/03 11:00:33 | 000,000,000 | —D | C] – C:\TEMP
[2010/05/03 10:41:50 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Yahoo!
[2010/05/03 10:41:50 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Threat Expert
[2010/05/03 08:30:43 | 000,000,000 | —D | C] – C:\Documents and Settings\danny.brownhelicopter\My Documents\GFX_XP32_14.37.4.5218_PV_Intel
[2010/05/03 08:30:31 | 016,172,950 | —- | C] (Intel Corporation ) – C:\Documents and Settings\danny.brownhelicopter\My Documents\GFX_XP32_14.37.4.5218_PV_Intel.exe
[2010/04/30 22:41:41 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Adobe
[2010/04/30 03:28:13 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Real
[2010/04/29 17:47:56 | 000,000,000 | —D | C] – C:\Documents and Settings\danny.brownhelicopter\Desktop\ProcessExplorer
[2010/04/29 17:46:22 | 000,000,000 | —D | C] – C:\Documents and Settings\danny.brownhelicopter\Local Settings\Application Data\Threat Expert
[2010/04/29 17:37:32 | 000,181,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\MpSigStub.exe
[2010/04/29 17:36:37 | 001,652,688 | —- | C] (Threat Expert Ltd.) – C:\WINDOWS\PCTBDCore.dll
[2010/04/29 17:36:37 | 000,165,840 | —- | C] (Threat Expert Ltd.) – C:\WINDOWS\PCTBDRes.dll
[2010/04/29 17:36:37 | 000,149,456 | —- | C] (PC Tools) – C:\WINDOWS\SGDetectionTool.dll
[2010/04/29 17:36:19 | 000,233,136 | —- | C] (PC Tools) – C:\WINDOWS\System32\drivers\pctgntdi.sys
[2010/04/29 17:36:12 | 000,218,592 | —- | C] (PC Tools) – C:\WINDOWS\System32\drivers\PCTCore.sys
[2010/04/29 17:36:12 | 000,088,040 | —- | C] (PC Tools) – C:\WINDOWS\System32\drivers\PCTAppEvent.sys
[2010/04/29 17:35:57 | 000,063,360 | —- | C] (PC Tools) – C:\WINDOWS\System32\drivers\pctplsg.sys
[2010/04/29 17:35:45 | 000,000,000 | —D | C] – C:\Program Files\Spyware Doctor
[2010/04/29 17:35:45 | 000,000,000 | —D | C] – C:\Program Files\Common Files\PC Tools
[2010/04/29 17:35:45 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\PC Tools
[2010/04/29 15:17:49 | 000,015,360 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\taskman2.exe
[2010/04/29 15:14:10 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2010/04/29 15:14:09 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Adobe
[2010/04/29 15:01:52 | 000,000,000 | —D | C] – C:\WINDOWS\temp
[2010/04/29 14:47:03 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2010/04/29 14:47:03 | 000,161,792 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2010/04/29 14:47:03 | 000,136,704 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2010/04/29 14:06:56 | 000,000,000 | —D | C] – C:\VundoFix Backups
[2010/04/29 12:10:27 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/04/29 12:10:25 | 000,020,952 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2010/04/29 12:10:25 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2010/04/29 11:43:32 | 000,031,232 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2010/04/29 11:43:10 | 000,000,000 | —D | C] – C:\WINDOWS\ERDNT
[2010/04/29 11:41:53 | 000,000,000 | —D | C] – C:\Qoobox
[2010/04/29 11:30:00 | 000,000,000 | —D | C] – C:\Documents and Settings\danny.brownhelicopter\Local Settings\Application Data\cfkbetxpr
[2010/04/29 11:29:25 | 000,000,000 | —D | C] – C:\spoolerlogs
[2010/04/29 11:29:21 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Firefox
[2010/04/28 15:28:44 | 000,000,000 | -HSD | C] – C:\Documents and Settings\danny.brownhelicopter\IECompatCache
[2010/04/28 15:28:18 | 000,000,000 | -HSD | C] – C:\Documents and Settings\danny.brownhelicopter\PrivacIE
[2010/04/28 15:26:17 | 000,000,000 | -HSD | C] – C:\Documents and Settings\danny.brownhelicopter\IETldCache
[2010/04/28 15:05:46 | 000,000,000 | —D | C] – C:\WINDOWS\ie8updates
[2010/04/28 15:02:39 | 000,000,000 | -H-D | C] – C:\WINDOWS\ie8
[7 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\Documents and Settings\danny.brownhelicopter\My Documents\*.tmp files -> C:\Documents and Settings\danny.brownhelicopter\My Documents\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/05/26 15:20:36 | 000,284,915 | —- | M] () – C:\Documents and Settings\danny.brownhelicopter\Desktop\gmer.zip
[2010/05/26 15:17:10 | 000,000,264 | —- | M] () – C:\WINDOWS\BHI.ini
[2010/05/26 15:16:49 | 000,571,904 | —- | M] (OldTimer Tools) – C:\Documents and Settings\danny.brownhelicopter\Desktop\OTL.exe
[2010/05/26 15:02:30 | 000,000,324 | —- | M] () – C:\WINDOWS\hpbafd.ini
[2010/05/26 14:32:00 | 000,001,010 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-3768510774-2719637463-2565569504-1153UA.job
[2010/05/26 14:29:33 | 000,001,860 | -H– | M] () – C:\Documents and Settings\danny.brownhelicopter\My Documents\Default.rdp
[2010/05/26 14:26:37 | 007,602,176 | -H– | M] () – C:\Documents and Settings\danny.brownhelicopter\NTUSER.DAT
[2010/05/26 14:09:51 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/05/26 14:06:47 | 000,000,000 | —- | M] () – C:\WINDOWS\system.ini
[2010/05/26 14:06:35 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2010/05/26 13:51:02 | 000,001,074 | —- | M] () – C:\WINDOWS\tasks\Roxio PhotoShow Updater.job
[2010/05/26 12:36:55 | 000,004,151 | —- | M] () – C:\WINDOWS\estwn323.ini
[2010/05/26 12:36:55 | 000,001,453 | —- | M] () – C:\WINDOWS\win.ini
[2010/05/26 11:53:57 | 000,000,600 | —- | M] () – C:\Documents and Settings\danny.brownhelicopter\PUTTY.RND
[2010/05/25 17:14:24 | 000,100,908 | —- | M] () – C:\Documents and Settings\danny.brownhelicopter\Desktop\SystemLook.exe
[2010/05/25 15:32:00 | 000,000,958 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-3768510774-2719637463-2565569504-1153Core.job
[2010/05/25 08:38:29 | 000,000,117 | —- | M] () – C:\WINDOWS\vbaddin.ini
[2010/05/25 08:08:36 | 000,276,202 | —- | M] () – C:\WINDOWS\System32\NvApps.xml
[2010/05/25 08:04:07 | 000,013,646 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/05/25 08:02:09 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/05/25 08:02:02 | 2128,281,600 | -HS- | M] () – C:\hiberfil.sys
[2010/05/25 03:01:12 | 000,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2010/05/24 17:41:35 | 003,696,466 | R— | M] () – C:\Documents and Settings\danny.brownhelicopter\Desktop\dannyfix.exe
[2010/05/24 16:37:26 | 000,001,796 | —- | M] () – C:\WINDOWS\FEDLOG.INI
[2010/05/24 14:06:39 | 000,000,281 | RHS- | M] () – C:\boot.ini
[2010/05/24 10:26:01 | 000,074,240 | —- | M] () – C:\Documents and Settings\danny.brownhelicopter\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/05/21 16:59:49 | 000,000,278 | -HS- | M] () – C:\Documents and Settings\danny.brownhelicopter\ntuser.ini
[2010/05/19 16:08:38 | 000,014,757 | —- | M] () – C:\Documents and Settings\danny.brownhelicopter\My Documents\Picture1.jpg
[2010/05/19 16:08:38 | 000,000,881 | —- | M] () – C:\Documents and Settings\danny.brownhelicopter\.recently-used.xbel
[2010/05/19 14:21:14 | 000,359,929 | —- | M] () – C:\Documents and Settings\danny.brownhelicopter\Desktop\dds.scr
[2010/05/18 10:44:39 | 000,000,127 | —- | M] () – C:\Documents and Settings\danny.brownhelicopter\Desktop\185538.url
[2010/05/17 11:02:33 | 000,000,728 | —- | M] () – C:\Documents and Settings\danny.brownhelicopter\Desktop\The Ur-Quan Masters.lnk
[2010/05/17 10:56:32 | 001,226,923 | —- | M] () – C:\Documents and Settings\danny.brownhelicopter\My Documents\uqm-0.6.2-installer.exe
[2010/05/14 16:34:01 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/05/14 15:21:26 | 000,001,734 | —- | M] () – C:\Documents and Settings\danny.brownhelicopter\Desktop\HijackThis.lnk
[2010/05/14 14:54:03 | 000,000,000 | —- | M] () – C:\Documents and Settings\danny.brownhelicopter\My Documents\IMG00019.jpg
[2010/05/14 10:01:52 | 000,000,330 | —- | M] () – C:\Documents and Settings\danny.brownhelicopter\My Documents\pod.sql
[2010/05/13 09:35:20 | 000,121,320 | —- | M] () – C:\WINDOWS\File Renamer - Basic Uninstaller.exe
[2010/05/13 09:35:12 | 000,000,725 | —- | M] () – C:\Documents and Settings\danny.brownhelicopter\Desktop\FileRenamer.lnk
[2010/05/13 09:30:50 | 001,923,072 | —- | M] () – C:\Documents and Settings\danny.brownhelicopter\My Documents\renameit305-setup.exe
[2010/05/12 13:15:59 | 082,045,688 | —- | M] (NVIDIA Corporation) – C:\Documents and Settings\danny.brownhelicopter\My Documents\197.45_desktop_winxp_32bit_english_whql.exe
[2010/05/06 16:50:40 | 607,410,176 | —- | M] () – C:\Documents and Settings\danny.brownhelicopter\My Documents\en_office_enterprise_2007_united_states_x86_cd_481472.iso
[2010/05/05 17:32:43 | 000,000,963 | —- | M] () – C:\Documents and Settings\danny.brownhelicopter\Desktop\Spybot - Search & Destroy.lnk
[2010/05/03 16:50:53 | 016,172,950 | —- | M] (Intel Corporation ) – C:\Documents and Settings\danny.brownhelicopter\My Documents\GFX_XP32_14.37.4.5218_PV_Intel.exe
[2010/05/03 16:44:59 | 000,314,328 | —- | M] (Intel Corporation) – C:\Documents and Settings\danny.brownhelicopter\My Documents\BoardID.exe
[2010/05/03 15:29:45 | 000,002,402 | —- | M] () – C:\Documents and Settings\danny.brownhelicopter\Desktop\Google Chrome.lnk
[2010/05/03 14:25:00 | 000,050,688 | —- | M] (Atribune.org) – C:\Documents and Settings\danny.brownhelicopter\My Documents\ATF_Cleaner.exe
[2010/04/29 17:38:54 | 000,000,211 | —- | M] () – C:\Boot.bak
[2010/04/29 17:36:05 | 000,001,637 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Spyware Doctor.lnk
[2010/04/29 15:39:38 | 000,038,224 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/04/29 15:39:26 | 000,020,952 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2010/04/29 15:19:52 | 001,728,943 | —- | M] () – C:\Documents and Settings\danny.brownhelicopter\Desktop\ProcessExplorer.zip
[2010/04/29 15:09:45 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20100512-141629.backup
[2010/04/29 12:10:30 | 000,000,696 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/04/29 11:31:46 | 000,012,530 | -HS- | M] () – C:\Documents and Settings\danny.brownhelicopter\Local Settings\Application Data\RIiYj0K8
[2010/04/29 11:31:46 | 000,012,530 | -HS- | M] () – C:\Documents and Settings\All Users\Application Data\RIiYj0K8
[2010/04/28 15:31:58 | 000,064,000 | —- | M] () – C:\WINDOWS\System32\ieframe.oca
[2010/04/28 14:23:58 | 000,001,850 | —- | M] () – C:\Documents and Settings\danny.brownhelicopter\Desktop\File Transfer Manager.lnk
[2010/04/28 07:58:30 | 000,009,885 | —- | M] () – C:\Documents and Settings\danny.brownhelicopter\My Documents\DF8BDFFD948F14C1A2A9421B0D90E9C44555BB2B.torrent
[2010/04/27 15:19:07 | 000,010,054 | —- | M] () – C:\Documents and Settings\danny.brownhelicopter\My Documents\Nurse.Jackie.S02E05.HDTV.XviD-NoTV_[www.NewTorrents.info].torrent
[2010/04/27 14:55:10 | 000,010,033 | —- | M] () – C:\Documents and Settings\danny.brownhelicopter\My Documents\Nurse.Jackie.S02E04.HDTV.XviD-LOL.[eztv].torrent
[2010/04/27 13:54:02 | 000,010,034 | —- | M] () – C:\Documents and Settings\danny.brownhelicopter\My Documents\Nurse.Jackie.S02E03.HDTV.XviD-NoTV.[eztv].torrent
[2010/04/27 10:46:47 | 000,262,144 | —- | M] () – C:\Documents and Settings\All Users\ntuser.dat
[2010/04/27 09:15:30 | 000,019,189 | —- | M] () – C:\Documents and Settings\danny.brownhelicopter\My Documents\Nurse_Jackie_S2_E2-Braveheart2112_[h33t].torrent
[2010/04/27 08:45:17 | 000,019,168 | —- | M] () – C:\Documents and Settings\danny.brownhelicopter\My Documents\F961E572D6865FB51E83ACD15EB2FC73C802112F.torrent
[2010/04/27 08:44:58 | 000,020,700 | —- | M] () – C:\Documents and Settings\danny.brownhelicopter\My Documents\Nurse.Jackie.S02E01.HDTV.XviD-NoTV.5455751.TPB.torrent
[2010/04/26 15:58:12 | 000,256,512 | —- | M] () – C:\WINDOWS\PEV.exe
[7 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\Documents and Settings\danny.brownhelicopter\My Documents\*.tmp files -> C:\Documents and Settings\danny.brownhelicopter\My Documents\*.tmp -> ]

========== Files Created - No Company Name ==========

[2049/12/31 17:00:00 | 001,022,976 | —- | C] () – C:\Documents and Settings\danny.brownhelicopter\My Documents\ZanZune.doc
[2049/12/31 17:00:00 | 000,008,326 | —- | C] () – C:\Documents and Settings\danny.brownhelicopter\My Documents\zanszune.fdf
[2010/05/26 15:20:34 | 000,284,915 | —- | C] () – C:\Documents and Settings\danny.brownhelicopter\Desktop\gmer.zip
[2010/05/25 17:14:23 | 000,100,908 | —- | C] () – C:\Documents and Settings\danny.brownhelicopter\Desktop\SystemLook.exe
[2010/05/24 14:06:38 | 000,000,211 | —- | C] () – C:\Boot.bak
[2010/05/24 14:06:34 | 000,260,272 | —- | C] () – C:\cmldr
[2010/05/24 08:04:10 | 003,696,466 | R— | C] () – C:\Documents and Settings\danny.brownhelicopter\Desktop\dannyfix.exe
[2010/05/21 17:15:50 | 2128,281,600 | -HS- | C] () – C:\hiberfil.sys
[2010/05/19 16:08:38 | 000,000,881 | —- | C] () – C:\Documents and Settings\danny.brownhelicopter\.recently-used.xbel
[2010/05/19 14:21:14 | 000,359,929 | —- | C] () – C:\Documents and Settings\danny.brownhelicopter\Desktop\dds.scr
[2010/05/18 10:44:39 | 000,000,127 | —- | C] () – C:\Documents and Settings\danny.brownhelicopter\Desktop\185538.url
[2010/05/17 11:02:33 | 000,000,728 | —- | C] () – C:\Documents and Settings\danny.brownhelicopter\Desktop\The Ur-Quan Masters.lnk
[2010/05/17 10:56:30 | 001,226,923 | —- | C] () – C:\Documents and Settings\danny.brownhelicopter\My Documents\uqm-0.6.2-installer.exe
[2010/05/14 15:21:26 | 000,001,734 | —- | C] () – C:\Documents and Settings\danny.brownhelicopter\Desktop\HijackThis.lnk
[2010/05/14 14:54:03 | 000,000,000 | —- | C] () – C:\Documents and Settings\danny.brownhelicopter\My Documents\IMG00019.jpg
[2010/05/14 10:01:51 | 000,000,330 | —- | C] () – C:\Documents and Settings\danny.brownhelicopter\My Documents\pod.sql
[2010/05/13 09:35:12 | 000,000,725 | —- | C] () – C:\Documents and Settings\danny.brownhelicopter\Desktop\FileRenamer.lnk
[2010/05/13 09:35:11 | 000,121,320 | —- | C] () – C:\WINDOWS\File Renamer - Basic Uninstaller.exe
[2010/05/13 09:30:48 | 001,923,072 | —- | C] () – C:\Documents and Settings\danny.brownhelicopter\My Documents\renameit305-setup.exe
[2010/05/12 13:16:29 | 002,183,470 | —- | C] () – C:\WINDOWS\System32\nvdata.bin
[2010/05/06 16:41:56 | 607,410,176 | —- | C] () – C:\Documents and Settings\danny.brownhelicopter\My Documents\en_office_enterprise_2007_united_states_x86_cd_481472.iso
[2010/05/03 15:29:45 | 000,002,402 | —- | C] () – C:\Documents and Settings\danny.brownhelicopter\Desktop\Google Chrome.lnk
[2010/05/03 15:27:56 | 000,001,010 | —- | C] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-3768510774-2719637463-2565569504-1153UA.job
[2010/05/03 15:27:55 | 000,000,958 | —- | C] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-3768510774-2719637463-2565569504-1153Core.job
[2010/05/03 11:43:07 | 000,000,963 | —- | C] () – C:\Documents and Settings\danny.brownhelicopter\Desktop\Spybot - Search & Destroy.lnk
[2010/04/29 17:47:43 | 001,728,943 | —- | C] () – C:\Documents and Settings\danny.brownhelicopter\Desktop\ProcessExplorer.zip
[2010/04/29 17:36:38 | 000,767,952 | —- | C] () – C:\WINDOWS\BDTSupport.dll
[2010/04/29 17:36:37 | 001,152,444 | —- | C] () – C:\WINDOWS\UDB.zip
[2010/04/29 17:36:37 | 000,000,882 | —- | C] () – C:\WINDOWS\RegSDImport.xml
[2010/04/29 17:36:37 | 000,000,879 | —- | C] () – C:\WINDOWS\RegISSImport.xml
[2010/04/29 17:36:37 | 000,000,131 | —- | C] () – C:\WINDOWS\IDB.zip
[2010/04/29 17:36:19 | 000,007,387 | —- | C] () – C:\WINDOWS\System32\drivers\pctgntdi.cat
[2010/04/29 17:36:12 | 000,007,412 | —- | C] () – C:\WINDOWS\System32\drivers\PCTAppEvent.cat
[2010/04/29 17:36:12 | 000,007,383 | —- | C] () – C:\WINDOWS\System32\drivers\pctcore.cat
[2010/04/29 17:36:05 | 000,001,637 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Spyware Doctor.lnk
[2010/04/29 17:35:57 | 000,007,383 | —- | C] () – C:\WINDOWS\System32\drivers\pctplsg.cat
[2010/04/29 14:47:03 | 000,256,512 | —- | C] () – C:\WINDOWS\PEV.exe
[2010/04/29 14:47:03 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2010/04/29 14:47:03 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2010/04/29 14:47:03 | 000,077,312 | —- | C] () – C:\WINDOWS\MBR.exe
[2010/04/29 14:47:03 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2010/04/29 12:10:30 | 000,000,696 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/04/29 11:29:38 | 000,012,530 | -HS- | C] () – C:\Documents and Settings\danny.brownhelicopter\Local Settings\Application Data\RIiYj0K8
[2010/04/29 11:29:38 | 000,012,530 | -HS- | C] () – C:\Documents and Settings\All Users\Application Data\RIiYj0K8
[2010/04/28 15:31:58 | 000,064,000 | —- | C] () – C:\WINDOWS\System32\ieframe.oca
[2010/04/28 14:23:58 | 000,001,850 | —- | C] () – C:\Documents and Settings\danny.brownhelicopter\Desktop\File Transfer Manager.lnk
[2010/04/28 07:58:28 | 000,009,885 | —- | C] () – C:\Documents and Settings\danny.brownhelicopter\My Documents\DF8BDFFD948F14C1A2A9421B0D90E9C44555BB2B.torrent
[2010/04/27 15:19:05 | 000,010,054 | —- | C] () – C:\Documents and Settings\danny.brownhelicopter\My Documents\Nurse.Jackie.S02E05.HDTV.XviD-NoTV_[www.NewTorrents.info].torrent
[2010/04/27 14:55:06 | 000,010,033 | —- | C] () – C:\Documents and Settings\danny.brownhelicopter\My Documents\Nurse.Jackie.S02E04.HDTV.XviD-LOL.[eztv].torrent
[2010/04/27 13:54:00 | 000,010,034 | —- | C] () – C:\Documents and Settings\danny.brownhelicopter\My Documents\Nurse.Jackie.S02E03.HDTV.XviD-NoTV.[eztv].torrent
[2010/04/27 10:46:46 | 000,262,144 | —- | C] () – C:\Documents and Settings\All Users\ntuser.dat
[2010/04/27 10:46:46 | 000,001,024 | -H– | C] () – C:\Documents and Settings\All Users\ntuser.dat.LOG
[2010/04/27 09:15:28 | 000,019,189 | —- | C] () – C:\Documents and Settings\danny.brownhelicopter\My Documents\Nurse_Jackie_S2_E2-Braveheart2112_[h33t].torrent
[2010/04/27 08:45:16 | 000,019,168 | —- | C] () – C:\Documents and Settings\danny.brownhelicopter\My Documents\F961E572D6865FB51E83ACD15EB2FC73C802112F.torrent
[2010/04/27 08:44:57 | 000,020,700 | —- | C] () – C:\Documents and Settings\danny.brownhelicopter\My Documents\Nurse.Jackie.S02E01.HDTV.XviD-NoTV.5455751.TPB.torrent
[2010/01/11 18:02:14 | 000,000,066 | —- | C] () – C:\WINDOWS\GraphEdt.INI
[2009/10/30 08:06:19 | 000,000,000 | —- | C] () – C:\WINDOWS\SPYXX.INI
[2009/06/12 11:19:04 | 000,000,666 | —- | C] () – C:\WINDOWS\hpntwksetup.ini
[2009/02/04 11:31:48 | 000,021,791 | —- | C] () – C:\WINDOWS\System32\smtpctrs.ini
[2009/02/04 11:31:48 | 000,001,037 | —- | C] () – C:\WINDOWS\System32\ntfsdrct.ini
[2009/02/04 11:31:24 | 000,038,576 | —- | C] () – C:\WINDOWS\System32\w3ctrs.ini
[2009/02/04 11:31:23 | 000,010,225 | —- | C] () – C:\WINDOWS\System32\axperf.ini
[2009/02/04 11:31:20 | 000,011,435 | —- | C] () – C:\WINDOWS\System32\infoctrs.ini
[2008/12/03 12:00:02 | 000,000,433 | —- | C] () – C:\WINDOWS\faxtst.ini
[2008/07/31 17:20:13 | 000,018,790 | —- | C] () – C:\WINDOWS\System32\ddmon.dll
[2008/03/17 08:57:34 | 000,000,000 | —- | C] () – C:\WINDOWS\VPC32.INI
[2007/12/13 14:42:09 | 000,000,036 | —- | C] () – C:\WINDOWS\FedLogFind.ini
[2007/12/13 12:55:31 | 000,229,376 | R— | C] () – C:\WINDOWS\System32\FEDSRCH.DLL
[2007/12/13 12:55:31 | 000,001,389 | —- | C] () – C:\WINDOWS\System32\FEDLOG97.INI
[2007/12/13 12:55:16 | 000,001,796 | —- | C] () – C:\WINDOWS\FEDLOG.INI
[2007/12/13 12:30:26 | 000,210,944 | —- | C] () – C:\WINDOWS\System32\msvcrt10.dll
[2007/12/13 12:26:58 | 000,249,856 | —- | C] () – C:\WINDOWS\System32\dtidb.dll
[2007/12/13 12:05:48 | 000,000,383 | —- | C] () – C:\WINDOWS\System32\haspdos.sys
[2007/12/13 11:51:48 | 000,000,185 | —- | C] () – C:\WINDOWS\mdm.ini
[2007/12/13 11:15:39 | 000,000,324 | —- | C] () – C:\WINDOWS\hpbafd.ini
[2007/12/13 10:59:53 | 000,004,151 | —- | C] () – C:\WINDOWS\estwn323.ini
[2007/12/13 10:53:43 | 000,001,030 | —- | C] () – C:\WINDOWS\ODBC.INI
[2007/12/13 10:40:35 | 000,000,264 | —- | C] () – C:\WINDOWS\BHI.ini
[2007/10/18 17:36:54 | 000,061,440 | —- | C] () – C:\WINDOWS\System32\deskMenu2.dll
[2007/07/27 07:00:00 | 000,002,048 | —- | C] () – C:\WINDOWS\System32\syscvchk.dll
[2007/07/23 10:03:32 | 000,053,248 | —- | C] () – C:\WINDOWS\System32\AgCPanelTraditionalChinese.dll
[2007/07/23 10:03:32 | 000,053,248 | —- | C] () – C:\WINDOWS\System32\AgCPanelSwedish.dll
[2007/07/23 10:03:32 | 000,053,248 | —- | C] () – C:\WINDOWS\System32\AgCPanelSpanish.dll
[2007/07/23 10:03:30 | 000,053,248 | —- | C] () – C:\WINDOWS\System32\AgCPanelSimplifiedChinese.dll
[2007/07/23 10:03:30 | 000,053,248 | —- | C] () – C:\WINDOWS\System32\AgCPanelPortugese.dll
[2007/07/23 10:03:30 | 000,053,248 | —- | C] () – C:\WINDOWS\System32\AgCPanelKorean.dll
[2007/07/23 10:03:30 | 000,053,248 | —- | C] () – C:\WINDOWS\System32\AgCPanelJapanese.dll
[2007/07/23 10:03:30 | 000,053,248 | —- | C] () – C:\WINDOWS\System32\AgCPanelGerman.dll
[2007/07/23 10:03:30 | 000,053,248 | —- | C] () – C:\WINDOWS\System32\AgCPanelFrench.dll
[2007/03/16 17:00:00 | 000,003,403 | —- | C] () – C:\WINDOWS\System32\hptcpmon.ini
[2007/01/25 12:31:36 | 000,053,299 | —- | C] () – C:\WINDOWS\System32\pthreadVC.dll
[2003/01/07 18:05:08 | 000,002,695 | —- | C] () – C:\WINDOWS\System32\OUTLPERF.INI
[1999/01/22 13:46:56 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\MSRTEDIT.DLL
[1998/06/10 01:00:00 | 000,015,120 | —- | C] () – C:\WINDOWS\System32\REPUTIL.DLL
[1998/05/18 01:00:00 | 000,014,017 | —- | C] () – C:\WINDOWS\JAUTOEXP.INI
[1998/04/24 01:00:00 | 000,000,218 | —- | C] () – C:\WINDOWS\FRONTPG.INI

========== LOP Check ==========

[2009/05/15 11:16:00 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\EuroPlus
[2008/03/10 12:22:29 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\GlobalSCAPE
[2009/05/27 13:53:12 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PhotoShow Shared Assets
[2009/02/04 18:22:21 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PreEmptive Solutions
[2009/05/15 10:58:09 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PTI
[2007/12/13 12:05:32 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Seagull
[2009/05/27 13:23:43 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Simple Star
[2009/05/27 13:20:20 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Simple Star Shared
[2010/05/14 15:25:16 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2009/06/19 11:34:31 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Turbine
[2009/04/06 08:11:21 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
[2009/05/14 08:08:14 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2010/02/02 10:30:01 | 000,000,000 | —D | M] – C:\Documents and Settings\danny.brownhelicopter\Application Data\AnvSoft
[2010/04/22 16:42:40 | 000,000,000 | —D | M] – C:\Documents and Settings\danny.brownhelicopter\Application Data\Auslogics
[2009/02/16 12:28:31 | 000,000,000 | —D | M] – C:\Documents and Settings\danny.brownhelicopter\Application Data\CoreFTP
[2010/04/15 10:46:51 | 000,000,000 | —D | M] – C:\Documents and Settings\danny.brownhelicopter\Application Data\deskPDF
[2010/04/15 10:46:52 | 000,000,000 | —D | M] – C:\Documents and Settings\danny.brownhelicopter\Application Data\GARMIN
[2010/01/29 11:13:41 | 000,000,000 | —D | M] – C:\Documents and Settings\danny.brownhelicopter\Application Data\GetRightToGo
[2008/03/10 12:22:28 | 000,000,000 | —D | M] – C:\Documents and Settings\danny.brownhelicopter\Application Data\GlobalSCAPE
[2010/03/30 10:34:45 | 000,000,000 | —D | M] – C:\Documents and Settings\danny.brownhelicopter\Application Data\gtk-2.0
[2010/04/27 16:48:12 | 000,000,000 | —D | M] – C:\Documents and Settings\danny.brownhelicopter\Application Data\id Software
[2010/04/14 17:33:00 | 000,000,000 | —D | M] – C:\Documents and Settings\danny.brownhelicopter\Application Data\ImgBurn
[2010/02/01 12:28:56 | 000,000,000 | —D | M] – C:\Documents and Settings\danny.brownhelicopter\Application Data\InfraRecorder
[2008/06/30 11:54:00 | 000,000,000 | —D | M] – C:\Documents and Settings\danny.brownhelicopter\Application Data\Movies Extractor Scout
[2010/04/15 10:37:28 | 000,000,000 | —D | M] – C:\Documents and Settings\danny.brownhelicopter\Application Data\NesterSoft
[2009/05/27 13:46:33 | 000,000,000 | —D | M] – C:\Documents and Settings\danny.brownhelicopter\Application Data\Simple Star
[2009/01/08 18:14:51 | 000,000,000 | —D | M] – C:\Documents and Settings\danny.brownhelicopter\Application Data\Snapfish
[2010/04/20 15:53:28 | 000,000,000 | —D | M] – C:\Documents and Settings\danny.brownhelicopter\Application Data\TeraCopy
[2009/06/30 13:34:35 | 000,000,000 | —D | M] – C:\Documents and Settings\danny.brownhelicopter\Application Data\Turbine
[2008/06/30 14:06:30 | 000,000,000 | —D | M] – C:\Documents and Settings\danny.brownhelicopter\Application Data\UltraGet
[2010/05/17 11:02:46 | 000,000,000 | —D | M] – C:\Documents and Settings\danny.brownhelicopter\Application Data\uqm
[2010/05/18 16:19:53 | 000,000,000 | —D | M] – C:\Documents and Settings\danny.brownhelicopter\Application Data\uTorrent
[2010/04/15 10:36:54 | 000,000,000 | —D | M] – C:\Documents and Settings\danny.brownhelicopter\Application Data\Video DVD Maker FREE
[2009/03/23 14:23:21 | 000,000,000 | —D | M] – C:\Documents and Settings\danny.brownhelicopter\Application Data\XnView

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >

< MD5 for: AGP440.SYS >
[2007/07/27 07:00:00 | 018,738,937 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2008/11/12 09:06:43 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2008/11/12 09:06:43 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
[2008/04/13 13:36:38 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 – C:\WINDOWS\ERDNT\cache\agp440.sys
[2008/04/13 13:36:38 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 – C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008/04/13 13:36:38 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 – C:\WINDOWS\system32\drivers\agp440.sys

< MD5 for: ATAPI.SYS >
[2007/07/27 07:00:00 | 018,738,937 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2008/11/12 09:06:43 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2008/11/12 09:06:43 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2008/04/13 13:40:30 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\ERDNT\cache\atapi.sys
[2008/04/13 13:40:30 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008/04/13 13:40:30 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\system32\drivers\atapi.sys
[2004/08/03 23:59:44 | 000,095,360 | —- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 – C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
[2007/07/27 07:00:00 | 000,095,360 | —- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 – C:\WINDOWS\system32\ReinstallBackups\0008\DriverFiles\i386\atapi.sys
[2004/08/03 23:59:44 | 000,095,360 | —- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 – C:\WINDOWS\system32\ReinstallBackups\0009\DriverFiles\i386\atapi.sys

< MD5 for: EVENTLOG.DLL >
[2003/03/27 08:00:00 | 000,112,640 | —- | M] (Microsoft Corporation) MD5=6081703EB261E2C98C87B3075CB5995E – C:\old-c\WINDOWS\system32\eventlog.dll
[2008/04/13 19:11:53 | 000,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\ERDNT\cache\eventlog.dll
[2008/04/13 19:11:53 | 000,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008/04/13 19:11:53 | 000,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\system32\eventlog.dll
[2007/07/27 07:00:00 | 000,055,808 | —- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 – C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll

< MD5 for: NETLOGON.DLL >
[2003/03/27 08:00:00 | 000,403,456 | —- | M] (Microsoft Corporation) MD5=13B9941CB224D41E9AA9C2662CEABBAA – C:\old-c\WINDOWS\system32\netlogon.dll
[2008/04/13 19:12:01 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\ERDNT\cache\netlogon.dll
[2008/04/13 19:12:01 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008/04/13 19:12:01 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\system32\netlogon.dll
[2007/07/27 07:00:00 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A – C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll

< MD5 for: SCECLI.DLL >
[2007/07/27 07:00:00 | 000,180,224 | —- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A – C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
[2003/03/27 08:00:00 | 000,207,360 | —- | M] (Microsoft Corporation) MD5=120E16058D924DB3E64AAD5E7BA5C89D – C:\old-c\WINDOWS\system32\scecli.dll
[2008/04/13 19:12:05 | 000,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\ERDNT\cache\scecli.dll
[2008/04/13 19:12:05 | 000,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008/04/13 19:12:05 | 000,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\system32\scecli.dll

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[7 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2007/12/13 03:38:34 | 000,094,208 | —- | M] () – C:\WINDOWS\system32\config\default.sav
[2007/12/13 03:38:34 | 000,659,456 | —- | M] () – C:\WINDOWS\system32\config\software.sav
[2007/12/13 03:38:34 | 000,929,792 | —- | M] () – C:\WINDOWS\system32\config\system.sav

========== Alternate Data Streams ==========

@Alternate Data Stream - 498 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:05EE1EEF
@Alternate Data Stream - 163 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2
@Alternate Data Stream - 109 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A8ADE5D8
< End of report >

OTL Extras logfile created on: 5/26/2010 3:22:59 PM - Run 1
OTL by OldTimer - Version 3.2.5.0 Folder = C:\Documents and Settings\danny.brownhelicopter\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 60.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 84.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 149.04 Gb Total Space | 26.44 Gb Free Space | 17.74% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
Drive F: | 55.63 Gb Total Space | 1.68 Gb Free Space | 3.01% Space Free | Partition Type: NTFS
Drive G: | 55.63 Gb Total Space | 1.68 Gb Free Space | 3.01% Space Free | Partition Type: NTFS
Drive H: | 136.62 Gb Total Space | 22.97 Gb Free Space | 16.81% Space Free | Partition Type: NTFS
I: Drive not present or media not loaded
Drive S: | 465.76 Gb Total Space | 213.87 Gb Free Space | 45.92% Space Free | Partition Type: NTFS
Drive Z: | 970.13 Mb Total Space | 969.36 Mb Free Space | 99.92% Space Free | Partition Type: FAT

Computer Name: HAGGARD
Current User Name: danny
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Extra Registry (All) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.chm [@ = chm.file] – C:\WINDOWS\hh.exe (Microsoft Corporation)
.cpl [@ = cplfile] – C:\WINDOWS\System32\shell32.dll (Microsoft Corporation)
.hlp [@ = hlpfile] – C:\WINDOWS\System32\winhlp32.exe (Microsoft Corporation)
.hta [@ = htafile] – C:\WINDOWS\System32\mshta.exe (Microsoft Corporation)
.html [@ = htmlfile] – C:\Program Files\Internet Explorer\IEXPLORE.EXE (Microsoft Corporation)
.inf [@ = inffile] – C:\WINDOWS\System32\NOTEPAD.EXE (Microsoft Corporation)
.ini [@ = inifile] – C:\WINDOWS\System32\NOTEPAD.EXE (Microsoft Corporation)
.url [@ = InternetShortcut] – C:\WINDOWS\system32\ieframe.DLL (Microsoft Corporation)
.js [@ = JSFile] – C:\WINDOWS\System32\WScript.exe (Microsoft Corporation)
.jse [@ = JSEFile] – C:\WINDOWS\System32\WScript.exe (Microsoft Corporation)
.reg [@ = regfile] – C:\WINDOWS\regedit.exe (Microsoft Corporation)
.txt [@ = txtfile] – C:\WINDOWS\System32\NOTEPAD.EXE (Microsoft Corporation)
.vbe [@ = VBEFile] – C:\WINDOWS\System32\WScript.exe (Microsoft Corporation)
.vbs [@ = VBSFile] – C:\WINDOWS\System32\WScript.exe (Microsoft Corporation)
.wsf [@ = WSFFile] – C:\WINDOWS\System32\WScript.exe (Microsoft Corporation)
.wsh [@ = WSHFile] – C:\WINDOWS\System32\WScript.exe (Microsoft Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile – %SystemRoot%\System32\NOTEPAD.EXE %1 (Microsoft Corporation)
batfile [open] – "%1" %*
batfile [print] – %SystemRoot%\System32\NOTEPAD.EXE /p %1 (Microsoft Corporation)
chm.file [open] – "%SYSTEMROOT%\hh.exe" %1 (Microsoft Corporation)
cmdfile – %SystemRoot%\System32\NOTEPAD.EXE %1 (Microsoft Corporation)
cmdfile [open] – "%1" %*
cmdfile [print] – %SystemRoot%\System32\NOTEPAD.EXE /p %1 (Microsoft Corporation)
comfile [open] – "%1" %*
cplfile [cplopen] – rundll32.exe shell32.dll,Control_RunDLL "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – winhlp32.exe %1 (Microsoft Corporation)
hlpfile [open] – %SystemRoot%\System32\winhlp32.exe %1 (Microsoft Corporation)
htafile [open] – C:\WINDOWS\system32\mshta.exe "%1" %* (Microsoft Corporation)
htmlfile – "C:\Program Files\Microsoft Office\Office\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [open] – "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome (Microsoft Corporation)
htmlfile [opennew] – "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation)
htmlfile [print] – "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
http [open] – "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome (Microsoft Corporation)
https [open] – "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome (Microsoft Corporation)
inffile [install] – %SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 %1 (Microsoft Corporation)
inffile [open] – %SystemRoot%\System32\NOTEPAD.EXE %1 (Microsoft Corporation)
inffile [print] – %SystemRoot%\System32\NOTEPAD.EXE /p %1 (Microsoft Corporation)
inifile [open] – %SystemRoot%\System32\NOTEPAD.EXE %1 (Microsoft Corporation)
inifile [print] – %SystemRoot%\System32\NOTEPAD.EXE /p %1 (Microsoft Corporation)
InternetShortcut [open] – "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] – rundll32.exe %SystemRoot%\System32\Mshtml.dll,PrintHTML "%1" (Microsoft Corporation)
jsfile – %SystemRoot%\System32\Notepad.exe %1 (Microsoft Corporation)
jsfile [open] – %SystemRoot%\System32\WScript.exe "%1" %* (Microsoft Corporation)
jsfile [print] – %SystemRoot%\System32\Notepad.exe /p %1 (Microsoft Corporation)
jsefile – %SystemRoot%\System32\Notepad.exe %1 (Microsoft Corporation)
jsefile [open] – %SystemRoot%\System32\WScript.exe "%1" %* (Microsoft Corporation)
jsefile [print] – %SystemRoot%\System32\Notepad.exe /p %1 (Microsoft Corporation)
piffile [open] – "%1" %*
regfile – %SystemRoot%\system32\NOTEPAD.EXE %1 (Microsoft Corporation)
regfile [open] – regedit.exe "%1" (Microsoft Corporation)
regfile [merge] – Reg Error: Key error.
regfile [print] – %SystemRoot%\system32\NOTEPAD.EXE /p %1 (Microsoft Corporation)
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
txtfile [open] – %SystemRoot%\system32\NOTEPAD.EXE %1 (Microsoft Corporation)
txtfile [print] – %SystemRoot%\system32\NOTEPAD.EXE /p %1 (Microsoft Corporation)
txtfile [printto] – %SystemRoot%\system32\notepad.exe /pt "%1" "%2" "%3" "%4" (Microsoft Corporation)
vbefile – %SystemRoot%\System32\Notepad.exe %1 (Microsoft Corporation)
vbefile [open] – %SystemRoot%\System32\WScript.exe "%1" %* (Microsoft Corporation)
vbefile [print] – %SystemRoot%\System32\Notepad.exe /p %1 (Microsoft Corporation)
vbsfile – %SystemRoot%\System32\Notepad.exe %1 (Microsoft Corporation)
vbsfile [open] – %SystemRoot%\System32\WScript.exe "%1" %* (Microsoft Corporation)
vbsfile [print] – %SystemRoot%\System32\Notepad.exe /p %1 (Microsoft Corporation)
wsffile – %SystemRoot%\System32\Notepad.exe %1 (Microsoft Corporation)
wsffile [open] – %SystemRoot%\System32\WScript.exe "%1" %* (Microsoft Corporation)
wsffile [print] – %SystemRoot%\System32\Notepad.exe /p %1 (Microsoft Corporation)
wshfile [open] – %SystemRoot%\System32\WScript.exe "%1" %* (Microsoft Corporation)
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] – "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file –playlist-enqueue "%1" ()
Directory [Browse with XnView] – "C:\Program Files\XnView\xnview.exe" "%1" File not found
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] – "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file –no-playlist-enqueue "%1" ()
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] – "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] – "%programfiles%\internet explorer\iexplore.exe" (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
"6160:TCP" = 6160:TCP:*:Enabled:Seagull Driver Networking
"4500:UDP" = 4500:UDP:LocalSubNet:Enabled:IPsec (IKE NAT-T)
"500:UDP" = 500:UDP:LocalSubNet:Enabled:IPsec (IKE)
"135:TCP" = 135:TCP:LocalSubNet:Enabled:RPC Endpoint Mapper and DCOM infrastructure
"3389:TCP" = 3389:TCP:*:Enabled:@xpsp2res.dll,-22009

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"3389:TCP" = 3389:TCP:*:Enabled:@xpsp2res.dll,-22009

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\Chat\Chat.exe" = C:\Program Files\Chat\Chat.exe:*:Enabled:Chat – (Brown Helicopter)
"C:\Program Files\uTorrent\uTorrent.exe" = C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent – (BitTorrent, Inc.)
"C:\Program Files\Unreal Tournament 3\Binaries\UT3.exe" = C:\Program Files\Unreal Tournament 3\Binaries\UT3.exe:*:Enabled:Unreal Tournament 3 – ()
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" = C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger – (Yahoo! Inc.)
"C:\Program Files\Yahoo!\Messenger\YServer.exe" = C:\Program Files\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server – File not found
"C:\Program Files\Corel\DVD9\WinDVD.exe" = C:\Program Files\Corel\DVD9\WinDVD.exe:*:Disabled:WinDVD – (Corel Corporation)
"C:\Program Files\NetMeeting\conf.exe" = C:\Program Files\NetMeeting\conf.exe:*:Enabled:Windows® NetMeeting® – (Microsoft Corporation)
"C:\Program Files\Canon\DIAS\CnxDIAS.exe" = C:\Program Files\Canon\DIAS\CnxDIAS.exe:*:Disabled:Canon Driver Information Assist Service – (CANON INC.)
"C:\Program Files\Canon\Color Network ScanGear\SgTool.exe" = C:\Program Files\Canon\Color Network ScanGear\SgTool.exe:*:Enabled:SGTOOL – (CANON INC.)
"C:\Program Files\MSSOAP\Binaries\MsSoapT3.exe" = C:\Program Files\MSSOAP\Binaries\MsSoapT3.exe:*:Enabled:Microsoft Soap Toolkit 3.0 Trace Tool – (Microsoft Corporation)
"C:\Program Files\Microsoft Visual Studio 9.0\Common7\IDE\devenv.exe" = C:\Program Files\Microsoft Visual Studio 9.0\Common7\IDE\devenv.exe:LocalSubNet:Enabled:Microsoft Visual Studio – (Microsoft Corporation)
"C:\WINDOWS\system32\dpvsetup.exe" = C:\WINDOWS\system32\dpvsetup.exe:*:Disabled:Microsoft DirectPlay Voice Test – (Microsoft Corporation)
"C:\WINDOWS\system32\PnkBstrA.exe" = C:\WINDOWS\system32\PnkBstrA.exe:*:Enabled:PnkBstrA – File not found
"C:\WINDOWS\system32\PnkBstrB.exe" = C:\WINDOWS\system32\PnkBstrB.exe:*:Enabled:PnkBstrB – File not found
"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes – (Apple Inc.)
"C:\HP_P2055_Network_Express_Install\setup\hppnet01.exe" = C:\HP_P2055_Network_Express_Install\setup\hppnet01.exe:*:Enabled:HP Installer Network Plug in – File not found
"C:\Program Files\Turbine\Dungeons and Dragons Online - Stormreach - Lamannia\dndclient.exe" = C:\Program Files\Turbine\Dungeons and Dragons Online - Stormreach - Lamannia\dndclient.exe:*:Enabled:dndclient – (Turbine, Inc.)
"C:\Program Files\Turbine\Turbine Download Manager - Lamannia\TurbineMessageService.exe" = C:\Program Files\Turbine\Turbine Download Manager - Lamannia\TurbineMessageService.exe:*:Enabled:TurbineMessageService – (Turbine, Inc.)
"C:\Program Files\Turbine\Turbine Download Manager - Lamannia\TurbineNetworkService.exe" = C:\Program Files\Turbine\Turbine Download Manager - Lamannia\TurbineNetworkService.exe:*:Enabled:TurbineNetworkService – (Turbine, Inc.)
"C:\Program Files\QuickTime\QuickTimePlayer.exe" = C:\Program Files\QuickTime\QuickTimePlayer.exe:*:Enabled:QuickTime Player – (Apple Inc.)
"C:\Program Files\eclipse\eclipse.exe" = C:\Program Files\eclipse\eclipse.exe:*:Enabled:eclipse – ()
"C:\WINDOWS\explorer.exe" = C:\WINDOWS\explorer.exe:*:Enabled:Explorer – (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Chat\Chat.exe" = C:\Program Files\Chat\Chat.exe:*:Enabled:Chat – (Brown Helicopter)
"C:\Program Files\Microsoft Visual Studio\Common\Tools\VS-Ent98\Vanalyzr\VARPC.EXE" = C:\Program Files\Microsoft Visual Studio\Common\Tools\VS-Ent98\Vanalyzr\VARPC.EXE:*:Enabled:Microsoft ® Visual Studio VSA RPC Event Creator – (Microsoft Corporation)
"C:\Program Files\Corel\DVD9\WinDVD.exe" = C:\Program Files\Corel\DVD9\WinDVD.exe:*:Disabled:WinDVD – (Corel Corporation)
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" = C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger – (Yahoo! Inc.)
"C:\Program Files\uTorrent\uTorrent.exe" = C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent – (BitTorrent, Inc.)
"C:\Program Files\NetMeeting\conf.exe" = C:\Program Files\NetMeeting\conf.exe:*:Enabled:Windows® NetMeeting® – (Microsoft Corporation)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00000409-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 SR-1 Premium
"{05EC21B8-4593-3037-A781-A6B5AFFCB19D}" = Microsoft Windows SDK for Visual Studio 2008 .NET Framework Tools - enu
"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
"{0C19D563-5F25-4621-BF10-01F741BD283F}" = Microsoft SQL Server Compact 3.5 SP1 Design Tools English
"{0DD140D3-9563-481E-AA75-BA457CBDAEF2}" = PC Inspector File Recovery
"{0DF3AE91-E533-3960-8516-B23737F8B7A2}" = Visual C++ 2008 x64 Runtime - (v9.0.30729)
"{0DF3AE91-E533-3960-8516-B23737F8B7A2}.vc_x64runtime_30729_01" = Visual C++ 2008 x64 Runtime - v9.0.30729.01
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{172423F9-522A-483A-AD65-03600CE4CA4F}" = Microsoft Works 6-9 Converter
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{197A3012-8C85-4FD3-AB66-9EC7E13DB92E}" = Adobe AIR
"{1A3E23D7-7A1E-43EC-B35D-EB2A31BED943}" = Video DVD Maker v3.19.0.42
"{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}" = YouTube Downloader 2.5.3
"{1BECC4FB-A8E4-492D-90A2-05C46C5356F7}" = Color Network ScanGear Ver.2.1
"{1EBB57D4-63FF-87CC-A0F0-D73982CF6008}" = Adobe Media Player
"{216AB108-2AE1-4130-B3D5-20B2C4C80F8F}" = QuickTime
"{21F89C51-0B30-4658-8ADC-2AFC7EC51284}_is1" = FaxMan SDK
"{22E23C71-C27A-3F30-8849-BB6129E50679}" = Visual C++ 2008 IA64 Runtime - (v9.0.30729)
"{22E23C71-C27A-3F30-8849-BB6129E50679}.vc_i64runtime_30729_01" = Visual C++ 2008 IA64 Runtime - v9.0.30729.01
"{241F2BF7-69EB-42A4-9156-96B2426C7504}" = Microsoft SQL Server Compact 3.5 for Devices ENU
"{247105F0-3FDE-11D5-B8E3-00B0D0620265}" = Consolidated Publication of Component Lists
"{26A24AE4-039D-4CA4-87B4-2F83216011FF}" = Java™ 6 Update 11
"{2750B389-A2D2-4953-99CA-27C1F2A8E6FD}" = Microsoft SQL Server 2005 Tools Express Edition
"{291B3A3B-F808-45B8-8113-DF232FCB6C82}" = Microsoft .NET Compact Framework 3.5
"{2AFFFDD7-ED85-4A90-8C52-5DA9EBDC9B8F}" = Microsoft SQL Server 2005 Express Edition (SQLEXPRESS)
"{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java™ 6 Update 3
"{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java™ 6 Update 5
"{342D4AD7-EC4C-4EC8-AEA6-E70F5905A490}" = SQL Server System CLR Types
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{388E4B09-3E71-4649-8921-F44A3A2954A7}" = Microsoft Visual Studio 2005 Tools for Office Runtime
"{3D9A74FE-F076-49FD-9C3F-942B6C3EAF92}" = Datamax Printer Configuration Utility
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{45235788-142C-44BE-8A4D-DDE9A84492E5}" = AGEIA PhysX v7.09.13
"{47ECCB1F-2811-49C0-B6A7-26778639ABA0}" = 32 Bit HP CIO Components Installer
"{493800B7-D0CF-41D2-90DC-C6AFE888B180}" = CHAT
"{4C8169AB-B6C1-413B-81B6-73B77127D82F}" = Microsoft File Transfer Manager
"{4D167610-0680-42ED-8362-050CE3064A79}" = XML to Schema
"{53F5C3EE-05ED-4830-994B-50B2F0D50FCE}" = Microsoft SQL Server Setup Support Files (English)
"{5A0C892E-FD1C-4203-941E-0956AED20A6A}" = APC PowerChute Personal Edition
"{5EC9AD36-5167-470E-B0F9-CB3EA12F442E}" = Avery Wizard 3.1
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{5EFCBB42-36AB-4FF9-B90C-E78C7B9EE7B3}" = iTunes
"{61128AC7-BD78-4D62-A114-2EF23856F558}" = Music Transfer Utility Ver.2
"{6232617D-B765-42B6-872A-EEFBD4528D22}_is1" = FaxMan SDK V [removed]
"{64c5b887-b5ee-42b8-8596-78905a6b5f1f}" = Microsoft Windows SDK for Visual Studio 2008 SDK Reference Assemblies and IntelliSense
"{6753B40C-0FBD-3BED-8A9D-0ACAC2DCD85D}" = Microsoft Document Explorer 2008
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6C117F31-28A8-4477-BE91-64AC0A2204AD}" = Microsoft IntelliPoint 6.01
"{6C9F6D23-E9AD-43C9-B43A-011562AAF876}" = Windows Mobile 5.0 SDK R2 for Pocket PC
"{6F801026-6AF0-4520-9153-4C9B4CAAB361}" = HP LaserJet P2050 Series 3.0
"{7148F0A8-6813-11D6-A77B-00B0D0142160}" = Java 2 Runtime Environment, SE v1.4.2_16
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{777CA40C-0206-4EF6-A0FC-618BF06BF8D0}" = Intel® PRO Network Connections 12.1.12.0
"{78D891EF-9E2D-4FC8-A71F-E6F897BA1B21}" = Symantec AntiVirus
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{842FAF7C-50EF-4463-9B8F-6222E1384D7D}" = Microsoft Windows SDK for Visual Studio 2008 Headers and Libraries
"{86ADE91C-5971-4DAE-82D7-961F2737B2AD}" = Character Builder Beta
"{89B6F63A-7E0C-424A-9D39-C4EF59E96D78}" = hppQFolderP2050
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{8FB53850-246A-3507-8ADE-0060093FFEA6}" = Visual Studio Tools for the Office system 3.0 Runtime
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90120000-0021-0000-0000-0000000FF1CE}" = Microsoft Office Visual Web Developer 2007
"{90120000-0021-0409-0000-0000000FF1CE}" = Microsoft Office Visual Web Developer MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90E00409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Outlook 2003
"{924EB80F-C2BB-4B9F-8412-88BBA937393F}" = MobileMe Control Panel
"{949DBB22-2FB7-4de1-804C-23D495A988D8}" = CuteFTP 8 Home
"{9656F3AC-6BA9-43F0-ABED-F214B5DAB27B}" = Windows Mobile 5.0 SDK R2 for Smartphone
"{9A33B83D-FFC4-44CF-BEEF-632DECEF2FCD}" = Microsoft SQL Server Database Publishing Wizard 1.3
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A43BF6A5-D5F0-4AAA-BF41-65995063EC44}" = MSXML 6.0 Parser
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A4EDCE24-82DD-4988-B69E-08572C131043}" = BHI
"{A96E97134CA649888820BCDE5E300BBD}" = H.264 Decoder
"{AA467959-A1D6-4F45-90CD-11DC57733F32}" = Crystal Reports Basic for Visual Studio 2008
"{AAC389499AEF40428987B3D30CFC76C9}" = MKV Splitter
"{AC76BA86-7AD7-1033-7B44-A82000000003}" = Adobe Reader 8.2.2
"{AC76BA86-7AD7-5464-3428-800000000003}" = Spelling Dictionaries Support For Adobe Reader 8
"{AC76BA86-7AD7-5760-0000-800000000003}" = Japanese Fonts Support For Adobe Reader 8
"{AEF9DC35ADDF4825B049ACBFD1C6EB37}" = AAC Decoder
"{AFA20D47-69C3-4030-8DF8-D37466E70F13}" = Apple Mobile Device Support
"{B1102A25-3AA3-446B-AA0F-A699B07A02FD}" = Garmin USB Drivers
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B268E9A1-04A9-40D0-9866-846BE2B74BA7}" = Microsoft Windows SDK for Visual Studio 2008 SP1 Win32 Tools
"{B32E7732-B2FB-3FD0-81AC-6025B1104C66}" = Microsoft Device Emulator version 3.0 - ENU
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B583754B-2C87-4944-BB9E-DF3C44234759}" = Calling Web Services from Visual Basic 6
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Plus Web Player
"{BCB4C18A-ACA6-4383-8688-E19933A705DD}" = Microsoft SOAP Toolkit 3.0
"{BFA90209-7AFF-4DB6-8E4B-E57305751AD7}" = Unreal Tournament 3
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C47159CC-9550-485B-ABB0-8D40D5A34244}" = BarTender 7.75.1965
"{CAA376AF-0DE8-4FCA-942E-C6AC579B94B3}" = Microsoft Windows SDK for Visual Studio 2008 SP1 Tools
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D75915D3-6CFF-445F-A346-18ED6EF2F618}" = Microsoft IntelliType Pro 6.01
"{D7DAD1E4-45F4-3B2B-899A-EA728167EC4F}" = Microsoft Visual Studio 2008 Professional Edition - ENU
"{DF6A13C0-77DF-41FE-BD05-6D5201EB0CE7}_is1" = Auslogics Disk Defrag
"{DFE492C4-A9F5-413E-A2CC-6F5F3ACC229F}" = ImageMixer 3 SE Ver.5 Transfer Utility
"{E0783143-EAE2-4047-A8D6-E155523C594C}" = Garmin WebUpdater
"{E3993D46-AE3F-402E-9F9D-EEBDFBEC3564}" = Corel WinDVD 9
"{E59113EB-0285-4BFD-A37A-B79EAC6B8F4B}" = Microsoft SQL Server Compact 3.5 SP1 English
"{E5D52570-5EF1-4576-A434-6CCD92268F0F}" = Google SketchUp 7
"{E9F44C98-B8B6-480F-AF7B-E42A0A46F4E3}" = Microsoft SQL Server VSS Writer
"{EDDF99D9-9FE3-4871-A7DB-D1522C51EE9A}" = Microsoft .NET Compact Framework 2.0 SP2
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"{F5E87B12-3C27-452F-8E78-21D42164FD83}" = Microsoft SQL Server 2008 Management Objects
"{F6970FBD-809A-4C51-BAB3-D94A04C6C8E7}" = Garmin Communicator Plugin
"{F9B3DD02-B0B3-42E9-8650-030DFF0D133D}" = Microsoft SQL Server Native Client
"{FC8D21C8-7B29-4104-ADB0-FEE9CA1C7922}" = Folder Size for Windows
"45A7283175C62FAC673F913C1F532C5361F97841" = Windows Driver Package - Garmin (grmnusb) GARMIN Devices (03/08/2007 2.2.1.0)
"7-Zip" = 7-Zip 4.64
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Any Video Converter_is1" = Any Video Converter 3.0.3
"AudibleManager" = AudibleManager
"AviScreen Classic (Freeware)_is1" = AviScreen Classic Version 1.3
"b35d407a-d5d8-4a2e-91bf-1d95b9f3f590_is1" = Turbine Download Manager - PublicPreview
"Browser Defender_is1" = Browser Defender 2.0.6.15
"Bytescout Movies Extractor Scout (demo)_is1" = Bytescout Movies Extractor Scout
"CAL" = Canon Camera Access Library
"CameraWindowDVC5" = Canon Utilities CameraWindow DC_DV 5 for ZoomBrowser EX
"CameraWindowDVC6" = Canon Utilities CameraWindow DC_DV 6 for ZoomBrowser EX
"CameraWindowLauncher" = Canon Utilities CameraWindow
"CamStudio" = CamStudio
"CANON iMAGE GATEWAY Task" = CANON iMAGE GATEWAY Task for ZoomBrowser EX
"Canon Internet Library for ZoomBrowser EX" = Canon Internet Library for ZoomBrowser EX
"CDSpectrum Pro" = CD/Spectrum Pro
"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player
"Core FTP LE 2.1" = Core FTP LE 2.1
"Coupon Printer for Windows4.0" = Coupon Printer for Windows
"CSCLIB" = Canon Camera Support Core Library
"deskPDF 2.5 Professional_is1" = deskPDF 2.5 Professional Edition
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"DVD Decrypter" = DVD Decrypter (Remove Only)
"DVD Flick_is1" = DVD Flick 1.3.0.7
"DVD Shrink_is1" = DVD Shrink 3.2
"ef57af2e-47b7-4e04-8c4b-48fb10fc34f0_is1" = Dungeons and Dragons Online™ - Lamannia - PublicPreview
"EPSON Scan! II" = EPSON Scan! II
"ESET Online Scanner" = ESET Online Scanner v3
"Express ClickYes" = Express ClickYes 1.2
"FaxMan 3.53" = FaxMan 3.53
"FED LOG" = FED LOG
"ffdshow" = ffdshow (remove only)
"File Renamer - Basic" = File Renamer - Basic
"Flash Capture_is1" = Flash Capture 1.20
"Flv Recorder_is1" = FlvRecorder
"Fraps" = Fraps
"Free WMA to MP3 Converter_is1" = Free WMA to MP3 Converter 1.16
"getPlus®_ocx" = getPlus®_ocx
"Glary Undelete_is1" = Glary Undelete 1.3
"HECI" = Intel® Management Engine Interface
"HijackThis" = HijackThis 2.0.2
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"ImageMan Active X Suite Version 6.50" = ImageMan Active X Suite Version 6.50
"ImgBurn" = ImgBurn
"InstallShield_{1BECC4FB-A8E4-492D-90A2-05C46C5356F7}" = Color Network ScanGear Ver.2.1
"InstallShield_{5EC9AD36-5167-470E-B0F9-CB3EA12F442E}" = Avery Wizard 3.1
"InstallShield_{E3993D46-AE3F-402E-9F9D-EEBDFBEC3564}" = Corel WinDVD 9
"Kine" = The Kinemorphic 3D Screen Saver
"KodakImgV1" = Imaging for Windows® Professional Edition 2.5
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft Developer Network - Visual Studio 6.0a" = MSDN Library - Visual Studio 6.0a
"Microsoft Document Explorer 2008" = Microsoft Document Explorer 2008
"Microsoft SQL Server 2000" = Microsoft SQL Server 2000
"Microsoft SQL Server 2005" = Microsoft SQL Server 2005
"Microsoft Visual Studio 2005 Tools for Office Runtime" = Visual Studio 2005 Tools for Office Second Edition Runtime
"Microsoft Visual Studio 2008 Professional Edition - ENU" = Microsoft Visual Studio 2008 Professional Edition - ENU
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"MyCamera" = Canon Utilities MyCamera
"NiceLabel SE 4_is1" = NiceLabel SE 4
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"NVIDIA Drivers" = NVIDIA Drivers
"NVIDIA nView Desktop Manager" = NVIDIA nView Desktop Manager
"RealPlayer 6.0" = RealPlayer
"RemoteCaptureTask" = Canon Utilities RemoteCapture Task for ZoomBrowser EX
"Replay Media Catcher2.30" = Replay Media Catcher
"Roxio PhotoShow" = Roxio PhotoShow
"Spyware Doctor" = Spyware Doctor 7.0
"TeraCopy_is1" = TeraCopy 2.12
"The Ur-Quan Masters" = The Ur-Quan Masters 0.6.2
"TIMELEFT3_is1" = TimeLeft
"Tweak UI 2.10" = Tweak UI
"UltraGet Video Downloader_is1" = UltraGet Video Downloader 2.0.5
"Visual Studio 6.0 Enterprise Edition" = Microsoft Visual Studio 6.0 Enterprise Edition
"Visual Studio Tools for the Office system 3.0 Runtime" = Visual Studio Tools for the Office system 3.0 Runtime
"VisualWebDeveloper" = Microsoft Visual Studio Web Authoring Component
"VLC media player" = VLC media player 1.0.5
"Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
"WebPost" = Microsoft Web Publishing Wizard 1.53
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinGimp-2.0_is1" = GIMP 2.6.6
"WinPcapInst" = WinPcap 4.0
"WinRAR archiver" = WinRAR archiver
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"XML Marker_is1" = XML Marker version 1.1
"Yahoo! Companion" = Yahoo! Toolbar
"Yahoo! Extras" = Yahoo! Browser Services
"Yahoo! Mail" = Yahoo! Internet Mail
"Yahoo! Mail Advisor" = Yahoo! Mail Advisor
"Yahoo! Messenger" = Yahoo! Messenger
"Yahoo! Search Defender" = Yahoo! Search Protection
"Yahoo! Software Update" = Yahoo! Software Update
"YInstHelper" = Yahoo! Install Manager
"ZoomBrowser EX" = Canon Utilities ZoomBrowser EX
"ZoomBrowser EX Memory Card Utility" = Canon ZoomBrowser EX Memory Card Utility

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome
"Octoshape add-in for Adobe Flash Player" = Octoshape add-in for Adobe Flash Player
"Yahoo! BrowserPlus" = Yahoo! BrowserPlus 2.8.1

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 5/26/2010 2:30:06 AM | Computer Name = HAGGARD | Source = Symantec AntiVirus | ID = 16711726
Description = Security Risk Found!Risk: Backdoor.Tidserv!inf in File: C:\System
Volume Information\_restore{AC246330-AFB4-4A89-90D6-56C53F8291CC}\RP23\A0009894.sys
by: Auto-Protect scan. Action: Clean failed : Quarantine failed. Action Description:
The file was left unchanged.

Error - 5/26/2010 3:54:06 AM | Computer Name = HAGGARD | Source = Symantec AntiVirus | ID = 16711726
Description = Security Risk Found!Risk: Backdoor.Tidserv!inf in File: C:\System
Volume Information\_restore{AC246330-AFB4-4A89-90D6-56C53F8291CC}\RP23\A0009894.sys
by: Auto-Protect scan. Action: Clean failed : Quarantine failed. Action Description:
The file was left unchanged.

Error - 5/26/2010 5:54:06 AM | Computer Name = HAGGARD | Source = Symantec AntiVirus | ID = 16711726
Description = Security Risk Found!Risk: Backdoor.Tidserv!inf in File: C:\System
Volume Information\_restore{AC246330-AFB4-4A89-90D6-56C53F8291CC}\RP23\A0009894.sys
by: Auto-Protect scan. Action: Clean failed : Quarantine failed. Action Description:
The file was left unchanged.

Error - 5/26/2010 7:54:36 AM | Computer Name = HAGGARD | Source = Symantec AntiVirus | ID = 16711726
Description = Security Risk Found!Risk: Backdoor.Tidserv!inf in File: C:\System
Volume Information\_restore{AC246330-AFB4-4A89-90D6-56C53F8291CC}\RP23\A0009894.sys
by: Auto-Protect scan. Action: Clean failed : Quarantine failed. Action Description:
The file was left unchanged.

Error - 5/26/2010 1:52:41 PM | Computer Name = HAGGARD | Source = Symantec AntiVirus | ID = 16711726
Description = Security Risk Found!Risk: Backdoor.Tidserv!inf in File: C:\System
Volume Information\_restore{AC246330-AFB4-4A89-90D6-56C53F8291CC}\RP23\A0009894.sys
by: Auto-Protect scan. Action: Clean failed : Quarantine failed. Action Description:
The file was left unchanged.

Error - 5/26/2010 1:52:41 PM | Computer Name = HAGGARD | Source = Symantec AntiVirus | ID = 16711685
Description = Risk Found!Risk: Backdoor.Tidserv!inf in File: C:\System Volume Information\_restore{AC246330-AFB4-4A89-90D6-56C53F8291CC}\RP23\A0009894.sys
by: Auto-Protect scan. Action: Clean failed : Quarantine failed : Access denied.
Action Description: The file was left unchanged.

Error - 5/26/2010 1:52:48 PM | Computer Name = HAGGARD | Source = Symantec AntiVirus | ID = 16711685
Description = Risk Found!Risk: Backdoor.Tidserv!inf in File: c:\system volume information\_restore{ac246330-afb4-4a89-90d6-56c53f8291cc}\RP23\A0009894.sys
by: Auto-Protect scan. Action: Clean failed : Quarantine failed. Action Description:
The file was left unchanged.

Error - 5/26/2010 1:52:50 PM | Computer Name = HAGGARD | Source = Symantec AntiVirus | ID = 16711731
Description = Security Risk Found!Risk: Backdoor.Tidserv!inf in File: C:\System
Volume Information\_restore{AC246330-AFB4-4A89-90D6-56C53F8291CC}\RP23\A0009894.sys
by: Auto-Protect scan. Action: Clean failed : Quarantine failed : Access denied.
Action Description: Risk was partially removed.

Error - 5/26/2010 2:09:33 PM | Computer Name = HAGGARD | Source = Symantec AntiVirus | ID = 16711726
Description = Security Risk Found!Risk: Backdoor.Tidserv!inf in File: C:\System
Volume Information\_restore{AC246330-AFB4-4A89-90D6-56C53F8291CC}\RP23\A0009894.sys
by: Auto-Protect scan. Action: Clean failed : Quarantine failed. Action Description:
The file was left unchanged.

Error - 5/26/2010 2:09:33 PM | Computer Name = HAGGARD | Source = Symantec AntiVirus | ID = 16711685
Description = Risk Found!Risk: Backdoor.Tidserv!inf in File: C:\System Volume Information\_restore{AC246330-AFB4-4A89-90D6-56C53F8291CC}\RP23\A0009894.sys
by: Auto-Protect scan. Action: Clean failed : Quarantine failed : Access denied.
Action Description: The file was left unchanged.

[ System Events ]
Error - 5/21/2010 6:16:25 PM | Computer Name = HAGGARD | Source = Ftdisk | ID = 262193
Description = Configuring the Page file for crash dump failed. Make sure there is
a page file on the boot partition and that is large enough to contain all physical
memory.

Error - 5/21/2010 6:27:08 PM | Computer Name = HAGGARD | Source = Ntfs | ID = 262199
Description = The file system structure on the disk is corrupt and unusable. Please
run the chkdsk utility on the volume S:.

Error - 5/23/2010 7:48:08 AM | Computer Name = HAGGARD | Source = Windows Update Agent | ID = 16
Description = Unable to Connect: Windows is unable to connect to the automatic updates
service and therefore cannot download and install updates according to the set
schedule. Windows will continue to try to establish a connection.

Error - 5/23/2010 8:46:36 PM | Computer Name = HAGGARD | Source = TermDD | ID = 655410
Description = The RDP protocol component X.224 detected an error in the protocol
stream and has disconnected the client.

Error - 5/24/2010 2:59:12 PM | Computer Name = HAGGARD | Source = Service Control Manager | ID = 7034
Description = The SQL Server VSS Writer service terminated unexpectedly. It has
done this 1 time(s).

Error - 5/24/2010 6:40:24 PM | Computer Name = HAGGARD | Source = Service Control Manager | ID = 7034
Description = The SQL Server VSS Writer service terminated unexpectedly. It has
done this 1 time(s).

Error - 5/24/2010 6:53:57 PM | Computer Name = HAGGARD | Source = Service Control Manager | ID = 7022
Description = The Windows Image Acquisition (WIA) service hung on starting.

Error - 5/24/2010 6:53:57 PM | Computer Name = HAGGARD | Source = Service Control Manager | ID = 7001
Description = The Canon Camera Access Library 8 service depends on the Windows Image
Acquisition (WIA) service which failed to start because of the following error:
%%1070

Error - 5/25/2010 8:59:29 AM | Computer Name = HAGGARD | Source = Service Control Manager | ID = 7011
Description = Timeout (30000 milliseconds) waiting for a transaction response from
the stisvc service.

Error - 5/26/2010 2:56:48 PM | Computer Name = HAGGARD | Source = Service Control Manager | ID = 7034
Description = The SQL Server VSS Writer service terminated unexpectedly. It has
done this 1 time(s).

< End of report >

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-05-28 10:27:50
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:\DOCUME~1\DANNY~1.BRO\LOCALS~1\Temp\ufrdipob.sys

—- System - GMER 1.0.15 —-

SSDT 8A6FEFC0 ZwConnectPort
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwCreateKey [0xB7ECC112]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwCreateProcess [0xB7EAB2D6]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwCreateProcessEx [0xB7EAB4C8]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwDeleteKey [0xB7ECC900]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwDeleteValueKey [0xB7ECCBB4]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwOpenKey [0xB7ECAE12]
SSDT 8A645D40 ZwQueryValueKey
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwRenameKey [0xB7ECD020]
SSDT 8A7065F0 ZwResumeThread
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwSetValueKey [0xB7ECC3D2]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwTerminateProcess [0xB7EAAF44]

INT 0x06 \??\C:\WINDOWS\system32\drivers\Haspnt.sys (HASP Kernel Device Driver for Windows NT/Aladdin Knowledge Systems) B369D16D
INT 0x0E \??\C:\WINDOWS\system32\drivers\Haspnt.sys (HASP Kernel Device Driver for Windows NT/Aladdin Knowledge Systems) B369CFC2

—- Kernel code sections - GMER 1.0.15 —-

.text ntkrnlpa.exe!ZwCallbackReturn + 2C8C 80504528 8 Bytes JMP EAB4C8B7
.text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xB6CAE380, 0x566445, 0xE8000020]
.text C:\WINDOWS\system32\drivers\hardlock.sys section is writeable [0xB336F400, 0x82482, 0xE8000020]
.protectÿÿÿÿhardlockentry point in ".protectÿÿÿÿhardlockentry point in ".protectÿÿÿÿhardlockentry point in ".p" section [0xB340F420] C:\WINDOWS\system32\drivers\hardlock.sys entry point in ".protectÿÿÿÿhardlockentry point in ".protectÿÿÿÿhardlockentry point in ".p" section [0xB340F420]
.protectÿÿÿÿhardlockunknown last code section [0xB340F200, 0x5105, 0xE0000020] C:\WINDOWS\system32\drivers\hardlock.sys unknown last code section [0xB340F200, 0x5105, 0xE0000020]

—- EOF - GMER 1.0.15 —-

mowman

Post #18May 28, 2010, 9:33 PM UTC

Hello DannyHaggard your logs appear clean of infections,backdoor.Tidserv!inf is in system restore which we will take care of now.

Please do the following

ComboFix - Cleanup
Time for some housekeeping

Click Start…select Run from the menu.
Copy and paste the following into the text entry box:
Combofix /Uninstall
Click the OK button. (See image below as reference.)

🖼Click to load external image (Posted Image)

Clean up with OTL:

Double-click OTL.exe to start the program.
Close all other programs apart from OTL as this step will require a reboot
On the OTL main screen, press the CLEANUP button
Say Yes to the prompt and then allow the program to reboot your computer.

[external image: Posted Image]
Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.

Download the latest version of Java Runtime Environment (JRE) 20 and save it to your desktop.
Scroll down to where it says JDK 6 Update 20 (JDK or JRE)
Click the Download JRE button to the right
Select the Windows platform from the dropdown menu.
Read the License Agreement and then check the box that says: "I agree to the Java SE Runtime Environment 6u20 with JavaFX 1 License Agreement". Click on Continue.The page will refresh.
Click on the link to download Windows Offline Installation and save the file to your desktop.
Close any programs you may have running - especially your web browser.
Go to Start > Control Panel, double-click on Add or Remove Programs and remove all older versions of Java.
Check (highlight) any item with Java Runtime Environment (JRE or J2SE or Java™ 6) in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java versions.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-6u20-windows-i586-p.exe to install the newest version.

After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
- On the General tab, under Temporary Internet Files, click the Settings button.
- Next, click on the Delete Files button
- There are two options in the window to clear the cache - Leave BOTH CheckedApplications and Applets
  Trace and Log Files
Click OK on Delete Temporary Files Window
Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
Click OK to leave the Temporary Files Window
Click OK to leave the Java Control Panel.

Here are some recommendations to help you stay clean.

Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.

Visit Microsoft often to get the latest updates for your computer.
http://www.update.microsoft.com/

Make sure you are running a FIREWALL.The windows firewall is not sufficient to protect your system. It doesn't monitor outgoing traffic and this is a must.
Please read this article 'Safe Computing Practices'.
So how did I get infected in the first place.

please take a moment to read quietman7's excellent prevention tips in post 3 here
Click >>>> Tips to protect yourself against malware and reduce the potential for re-infection:

Preventing Infections in the Future

Please also have a look at the following links, giving some advice and Tips to protect yourself against malware and reduce the potential for re-infection:

So How did I get infected?
Miekies' prevention suggestions
Hardening Windows Security - Part 1 & Part 2.

Avoid gaming sites, underground web pages, pirated software sites, and peer-to-peer (P2P) file sharing programs. They are a security risk which can make your computer susceptible to a smörgåsbord of malware infections, remote attacks, exposure of personal information, and identity theft. Many malicious worms and Trojans spread across P2P file sharing networks, gaming and underground sites. Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and Flash ads that install viruses, Trojans and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users. The best way to reduce the risk of infection is to avoid these types of web sites and not use any P2P applications. Read P2P Software User Advisories and Risks of File-Sharing Technology.

Update Non-Microsoft Programs

It is also a good idea to check for the latest versions of commonly installed applications that are regularly patched to fix vulnerabilities. You can check these by visiting Secunia Software Inspector and Calendar of Updates.

Thats it you are good to go.Safe surfing

Essexboy

Post #19May 30, 2010, 11:55 AM UTC

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.

[Resolved] IE 8 redirected, constant reinfection

✨ Ask AI

Ask AI