Spyware / Malware / Virus Removal

[Solved] Help remove Tidserv Request

15 min read

Looking for the outcome? Ask AI

Gadgetgal Topic Starter

Post #1May 23, 2010, 6:51 PM UTC

Hi, I have Norton 360 and it is constantly blocking attacks from risk name Tidserv Request. I am experiencing website redirects. Any help in removing this malware would be greatly appreciated. Below is the DDS log. Thanks, Gadgetgal DDS (Ver_09-06-26.01) - NTFSx86 Run by [removed] at 11:37:58.81 on Sun 05/23/2010 Internet Explorer: 8.0.6001.18702 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1014.315 [GMT -7:00] AV: Norton 360 *On-access scanning enabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8} FW: Norton 360 *enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220} ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\acs.exe svchost.exe C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\Program Files\Norton 360\Engine\3.8.0.41\ccSvcHst.exe C:\TOSHIBA\IVP\ISM\pinger.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\WINDOWS\Explorer.EXE c:\TOSHIBA\IVP\swupdate\swupdtmr.exe C:\WINDOWS\system32\ThpSrv.exe C:\WINDOWS\system32\TODDSrv.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe C:\Program Files\Atheros\ACU.exe C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe C:\Program Files\TOSHIBA\TouchPad\TPTray.exe C:\WINDOWS\system32\thpsrv.exe C:\WINDOWS\system32\igfxtray.exe C:\WINDOWS\system32\igfxpers.exe C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe C:\WINDOWS\system32\TDispVol.exe C:\WINDOWS\system32\igfxsrvc.exe C:\WINDOWS\system32\ZoomingHook.exe C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe C:\WINDOWS\system32\TPSMain.exe C:\Program Files\TOSHIBA\TOSHIBA Direct Disc Writer\ddwmon.exe C:\Program Files\TOSHIBA\TOSHIBA USB Sleep and Charge Utility\TUSBSleepChargeSrv.exe C:\Program Files\Apoint2K\Apoint.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Apoint2K\ApMsgFwd.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Norton 360\Engine\3.8.0.41\ccSvcHst.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe C:\Program Files\Apoint2K\HidFind.exe C:\Program Files\Apoint2K\Apntex.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe C:\WINDOWS\system32\TPSBattM.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Netbook\Desktop\dds.scr ============== Pseudo HJT Report =============== mWinlogon: Userinit=c:\windows\system32\Userinit.exe BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: Symantec NCO BHO: {602adb0e-4aff-4217-8aa1-95dac4dfa408} - c:\program files\norton 360\engine\3.8.0.41\coIEPlg.dll BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - c:\program files\norton 360\engine\3.8.0.41\IPSBHO.DLL BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar.dll BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.4.4525.1752\swg.dll BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_A8904FB862BD9564.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar.dll TB: Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - c:\program files\norton 360\engine\3.8.0.41\coIEPlg.dll uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe" uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe mRun: [ACU] "c:\program files\atheros\ACU.exe" -nogui mRun: [Camera Assistant Software] "c:\program files\camera assistant software for toshiba\traybar.exe" /start mRun: [ITSecMng] %ProgramFiles%\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe /START mRun: [TPNF] c:\program files\toshiba\touchpad\TPTray.exe mRun: [] mRun: [ThpSrv] c:\windows\system32\thpsrv /logon mRun: [IgfxTray] c:\windows\system32\igfxtray.exe mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe mRun: [Persistence] c:\windows\system32\igfxpers.exe mRun: [NDSTray.exe] NDSTray.exe mRun: [CeEKEY] c:\program files\toshiba\e-key\CeEKey.exe mRun: [TDispVol] TDispVol.exe mRun: [HWSetup] c:\program files\toshiba\toshiba applet\HWSetup.exe hwSetUP mRun: [ZoomingHook] ZoomingHook.exe mRun: [SmoothView] c:\program files\toshiba\toshiba zooming utility\SmoothView.exe mRun: [TAccessibility] c:\program files\toshiba\accessibility\TAccessibility.exe Instant mRun: [TPSMain] TPSMain.exe mRun: [DDWMon] c:\program files\toshiba\toshiba direct disc writer\\ddwmon.exe mRun: [TUSBSleepChargeSrv] %ProgramFiles%\TOSHIBA\TOSHIBA USB Sleep and Charge Utility\TUSBSleepChargeSrv.exe mRun: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime mRun: [Apoint] c:\program files\apoint2k\Apoint.exe mRun: [RTHDCPL] RTHDCPL.EXE StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\blueto~1.lnk - c:\program files\toshiba\bluetooth toshiba stack\TosBtMng.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office10\EXCEL.EXE/3000 IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} - hxxp://gfx2.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\google\google toolbar\component\fastsearch_A8904FB862BD9564.dll Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL Handler: symres - {AA1061FE-6C41-421f-9344-69640C9732AB} - c:\program files\norton 360\engine\3.8.0.41\CoIEPlg.dll Notify: igfxcui - igfxdev.dll ============= SERVICES / DRIVERS =============== R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\n360\0308000.029\SymEFA.sys [2010-1-27 310320] R0 Thpdrv;TOSHIBA HDD Protection Driver;c:\windows\system32\drivers\thpdrv.sys [2008-8-21 28536] R0 Thpevm;TOSHIBA HDD Protection - Shock Sensor Driver;c:\windows\system32\drivers\Thpevm.sys [2007-9-4 6528] R1 BHDrvx86;Symantec Heuristics Driver;c:\windows\system32\drivers\n360\0308000.029\BHDrvx86.sys [2010-1-27 259632] R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\n360\0308000.029\cchpx86.sys [2010-1-27 482432] R1 IDSxpx86;IDSxpx86;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\definitions\ipsdefs\20100513.002\IDSXpx86.sys [2010-5-18 329592] R2 N360;Norton 360;c:\program files\norton 360\engine\3.8.0.41\ccSvcHst.exe [2010-1-27 117640] R2 tdudf;TOSHIBA UDF File System Driver;c:\windows\system32\drivers\tdudf.sys [2007-3-26 105856] R2 trudf;TOSHIBA DVD-RAM UDF File System Driver;c:\windows\system32\drivers\trudf.sys [2007-2-19 134016] R3 cecnuvc;Chicony USB 2.0 Camera VD;c:\windows\system32\drivers\cec_uvc.sys [2009-6-10 48176] R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2010-2-10 102448] R3 NAVENG;NAVENG;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\definitions\virusdefs\20100523.004\NAVENG.SYS [2010-5-23 85552] R3 NAVEX15;NAVEX15;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\definitions\virusdefs\20100523.004\NAVEX15.SYS [2010-5-23 1347504] R3 WSIMD;wsimd Service;c:\windows\system32\drivers\wsimd.sys [2009-6-10 58208] S2 gupdate1ca13554584f12e;Google Update Service (gupdate1ca13554584f12e);c:\program files\google\update\GoogleUpdate.exe [2009-8-2 133104] S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [2010-1-1 1684736] S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\drivers\RtsUStor.sys [2009-4-6 164864] S3 RtsUIR;Realtek IR Driver;c:\windows\system32\drivers\rts516xir.sys –> c:\windows\system32\drivers\Rts516xIR.sys [?] =============== Created Last 30 ================ 2010-05-23 08:44 3,558,912 -c—— c:\windows\system32\dllcache\moviemk.exe 2010-05-06 03:20 100 a–s—- c:\windows\system32\1259322740.dat ==================== Find3M ==================== 2010-03-09 23:15 420,352 a——- c:\windows\system32\vbscript.dll 2010-02-24 23:24 916,480 a——- c:\windows\system32\wininet.dll 2009-04-06 12:37 32,768 a–sh— c:\windows\system32\config\systemprofile\local settings\application data\microsoft\feeds cache\index.dat 2009-07-14 16:24 32,768 a–sh— c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012009071420090715\index.dat 2009-07-14 16:27 13 —shr– c:\windows\system32\drivers\fbd.sys 2009-07-14 16:27 4 —shr– c:\windows\system32\drivers\taishop.sys ============= FINISH: 11:40:05.18 ===============

martix

Post #2May 23, 2010, 8:11 PM UTC

Hi Gadgetgal

I'm martix and I'll be glad to assist you and look over your PC problems.

Before we proceed please read carefully the following guidelines:

Malware removal process takes time so be patient and stick with the thread until I’ve given you the “All clean". Absence of symptoms does not mean your machine is clean!
Do not run any scans or install/uninstall any applications without being directed to do so.
Follow my instructions carefully and in the order they are posted.
If you do not understand any step(s) provided, please do not hesitate to ask before continuing.
If you do not reply within 5 days after my last response the topic will be closed.

Now we can proceed. While I'm examining your log please do a scan with GMER:

[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.

Extract the contents of the zipped file to desktop.
Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

[external image: Posted Image]
Click the image to enlarge it
In the right panel, you will see several boxes that have been checked. Uncheck the following …
- IAT/EAT
- Drives/Partition other than Systemdrive (typically C:\)
- Show All (don't miss this one)
Then click the Scan button & wait for it to finish.
Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
Save it where you can easily find it, such as your desktop, and attach it in your reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

Gadgetgal

Post #3May 23, 2010, 9:52 PM UTC

Hi Martix, I tried to run GMER 4 times and each time the system displayed the "blue screen of death" and rebooted my machine. What should I do now? Thank you for your help.

martix

Post #4May 25, 2010, 6:48 AM UTC

Please download maxlook, saving the file to your desktop.
Double click maxlook.exe to run it. Note - you must run it only once!
As instructed when the tool runs, restart the computer and logon to the Recovery Console.
Execute the following bolded command at the x:\windows> prompt <— the red x represents your operating system drive letter, usually C

batch look.bat

🖼Click to load external image (Posted Image)

You will see 1 file copied many times then return to the x:\windows> prompt.
Type Exit to restart your computer then logon in normal mode.

Once back in Windows, go to Start > Run, and copy/paste the following then press Enter.

maxlook -sig

Follow the prompts, and post (or attach) the log produced, C:\looklog.txt

Gadgetgal

Post #5May 26, 2010, 1:54 AM UTC last edited May 26, 2010, 3:04 AM UTC

Hi, Can you please clarify this instruction before I attempt this . How do I logon to the Recovery Console? After reading some posts it appears to me that the Recovery Console must be loaded on my machine first. I could not find the Recovery Console on my machine and cannot load it from a CD as I have a netbook. Is that correct? Thank you

martix

Post #6May 27, 2010, 12:41 AM UTC

Ok, lets do something else before we proceed with the Recovery console:

Please download RootRepeal to your desktop

Physically disconnect your machine from the internet as your system will be unprotected.
Unzip it to it's own folder, close all other programs especially your security programs (anti-spyware, anti-virus, and firewall) and run RootRepeal.exe
Click the Report tab at the bottom and then the Scan button.
A box will pop up, check the boxes beside Drivers, Files, Processes SSDT and click OK.
Another box will open, check the boxes beside all the drives, eg : C:\, then click OK.
The scan will take a little while to run, so let it go unhindered.
Once it is done, click the Save Report button, call it RepealScan and save the log to your desktop.
Reconnect to the internet.
Post the log here in your reply.

Gadgetgal

Post #7May 27, 2010, 2:19 AM UTC

This tool worked well. Here is the report: -Thanks Repeal Scan ROOTREPEAL © AD, 2007-2009 ================================================== Scan Start Time: 2010/05/26 18:54 Program Version: Version 1.3.5.0 Windows Version: Windows XP SP3 ================================================== Drivers ——————- Name: dump_iaStor.sys Image Path: C:\WINDOWS\System32\Drivers\dump_iaStor.sys Address: 0xA99D8000 Size: 897024 File Visible: No Signed: - Status: - Name: rootrepeal.sys Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys Address: 0xA8319000 Size: 49152 File Visible: No Signed: - Status: - Name: SYMEFA.SYS Image Path: SYMEFA.SYS Address: 0xF72EA000 Size: 323584 File Visible: No Signed: - Status: - Hidden/Locked Files ——————- Path: C:\hiberfil.sys Status: Locked to the Windows API! SSDT ——————- #: 012 Function Name: NtAlertResumeThread Status: Hooked by "" at address 0x83d6e068 #: 013 Function Name: NtAlertThread Status: Hooked by "" at address 0x83d6e128 #: 017 Function Name: NtAllocateVirtualMemory Status: Hooked by "" at address 0x83d711d0 #: 019 Function Name: NtAssignProcessToJobObject Status: Hooked by "" at address 0x83d18e88 #: 031 Function Name: NtConnectPort Status: Hooked by "" at address 0x84eb1440 #: 041 Function Name: NtCreateKey Status: Hooked by "C:\WINDOWS\system32\Drivers\SYMEVENT.SYS" at address 0xa9f3a130 #: 043 Function Name: NtCreateMutant Status: Hooked by "" at address 0x834e69c0 #: 052 Function Name: NtCreateSymbolicLinkObject Status: Hooked by "" at address 0x83d65eb0 #: 053 Function Name: NtCreateThread Status: Hooked by "" at address 0x83d4b9f8 #: 057 Function Name: NtDebugActiveProcess Status: Hooked by "" at address 0x83d18f48 #: 063 Function Name: NtDeleteKey Status: Hooked by "C:\WINDOWS\system32\Drivers\SYMEVENT.SYS" at address 0xa9f3a3b0 #: 065 Function Name: NtDeleteValueKey Status: Hooked by "C:\WINDOWS\system32\Drivers\SYMEVENT.SYS" at address 0xa9f3a910 #: 068 Function Name: NtDuplicateObject Status: Hooked by "" at address 0x83d16148 #: 083 Function Name: NtFreeVirtualMemory Status: Hooked by "" at address 0x83d19008 #: 089 Function Name: NtImpersonateAnonymousToken Status: Hooked by "" at address 0x83d410e8 #: 091 Function Name: NtImpersonateThread Status: Hooked by "" at address 0x83d411a8 #: 097 Function Name: NtLoadDriver Status: Hooked by "" at address 0x8595b060 #: 108 Function Name: NtMapViewOfSection Status: Hooked by "" at address 0x83d19138 #: 114 Function Name: NtOpenEvent Status: Hooked by "" at address 0x834e6900 #: 122 Function Name: NtOpenProcess Status: Hooked by "" at address 0x83d5b100 #: 123 Function Name: NtOpenProcessToken Status: Hooked by "" at address 0x83d617f0 #: 125 Function Name: NtOpenSection Status: Hooked by "" at address 0x83d19f70 #: 128 Function Name: NtOpenThread Status: Hooked by "" at address 0x83d16008 #: 137 Function Name: NtProtectVirtualMemory Status: Hooked by "" at address 0x83d65f80 #: 206 Function Name: NtResumeThread Status: Hooked by "" at address 0x8590b060 #: 213 Function Name: NtSetContextThread Status: Hooked by "" at address 0x83d1a110 #: 228 Function Name: NtSetInformationProcess Status: Hooked by "" at address 0x83d1a1d0 #: 240 Function Name: NtSetSystemInformation Status: Hooked by "" at address 0x83d19e28 #: 247 Function Name: NtSetValueKey Status: Hooked by "C:\WINDOWS\system32\Drivers\SYMEVENT.SYS" at address 0xa9f3ab60 #: 253 Function Name: NtSuspendProcess Status: Hooked by "" at address 0x834e6840 #: 254 Function Name: NtSuspendThread Status: Hooked by "" at address 0x83d6e1e8 #: 257 Function Name: NtTerminateProcess Status: Hooked by "" at address 0x83d3b660 #: 258 Function Name: NtTerminateThread Status: Hooked by "" at address 0x83d1a050 #: 267 Function Name: NtUnmapViewOfSection Status: Hooked by "" at address 0x83d43770 #: 277 Function Name: NtWriteVirtualMemory Status: Hooked by "" at address 0x83d71100 ==EOF==

martix

Post #8May 27, 2010, 9:33 PM UTC

We can proceed:

Download Combofix from any of the links below but rename it to before saving it to your desktop.

Link 1
Link 2

[external image: Posted Image]

[external image: Posted Image]

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
See this Link for programs that need to be disabled and instruction on how to disable them.
Remember to re-enable them when we're done.
Double click on the renamed ComboFix.exe & follow the prompts.
- Please post the C:\ComboFix.txt so we can continue cleaning the system.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

Gadgetgal

Post #9May 28, 2010, 2:58 AM UTC

Hi Martix

Please find the Combofix log below. Thank you so much for your help!

ComboFix 10-05-27.01 - Netbook 05/27/2010 19:42:44.1.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1014.620 [GMT -7:00]
Running from: c:\documents and settings\[removed]\Desktop\Combo-Fix.exe
AV: Norton 360 *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton 360 *disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\1259322740.dat

Infected copy of c:\windows\system32\drivers\thpdrv.sys was found and disinfected
Restored copy from - Kitty had a snack

.
((((((((((((((((((((((((( Files Created from 2010-04-28 to 2010-05-28 )))))))))))))))))))))))))))))))
.

2010-05-27 01:54 . 2010-05-27 01:54 0 —-a-w- c:\documents and settings\Netbook\settings.dat
2010-05-26 04:07 . 2010-05-26 04:07 ——– d—–r- c:\program files\Norton Support
2010-05-26 02:42 . 2010-05-26 02:42 9691 —-a-w- c:\windows\look.bat
2010-05-26 02:42 . 2010-05-26 02:42 ——– d—–w- c:\windows\maxdriver
2010-05-23 15:44 . 2009-10-23 15:28 3558912 -c—-w- c:\windows\system32\dllcache\moviemk.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-15 14:16 . 2009-04-06 19:43 ——– d—–w- c:\program files\Google
2010-03-10 06:15 . 2009-04-06 19:48 420352 —-a-w- c:\windows\system32\vbscript.dll
2009-07-14 23:27 . 2009-07-14 23:27 13 –sh–r- c:\windows\system32\drivers\fbd.sys
2009-07-14 23:27 . 2009-07-14 23:27 4 –sh–r- c:\windows\system32\drivers\taishop.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-04-06 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ThpSrv"="c:\windows\system32\thpsrv" [X]
"ACU"="c:\program files\Atheros\ACU.exe" [2009-03-06 479320]
"Camera Assistant Software"="c:\program files\Camera Assistant Software for Toshiba\traybar.exe" [2009-03-26 417792]
"ITSecMng"="c:\program files\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe" [2008-12-20 83336]
"TPNF"="c:\program files\TOSHIBA\TouchPad\TPTray.exe" [2009-04-03 73728]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-02-17 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-02-17 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-02-17 137752]
"NDSTray.exe"="NDSTray.exe" [BU]
"CeEKEY"="c:\program files\TOSHIBA\E-KEY\CeEKey.exe" [2009-03-18 827392]
"TDispVol"="TDispVol.exe" [2009-04-02 210232]
"HWSetup"="c:\program files\TOSHIBA\TOSHIBA Applet\HWSetup.exe" [2004-05-01 28672]
"ZoomingHook"="ZoomingHook.exe" [2005-06-06 24576]
"SmoothView"="c:\program files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe" [2007-04-10 159744]
"TAccessibility"="c:\program files\TOSHIBA\Accessibility\TAccessibility.exe" [2009-02-25 110592]
"TPSMain"="TPSMain.exe" [2009-03-17 283960]
"DDWMon"="c:\program files\TOSHIBA\TOSHIBA Direct Disc Writer\\ddwmon.exe" [2007-04-14 311296]
"TUSBSleepChargeSrv"="c:\program files\TOSHIBA\TOSHIBA USB Sleep and Charge Utility\TUSBSleepChargeSrv.exe" [2009-03-16 252288]
"Pinger"="c:\toshiba\ivp\ism\pinger.exe" [2007-01-26 136816]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-05-27 413696]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2009-09-11 241664]
"RTHDCPL"="RTHDCPL.EXE" [2009-07-29 18671104]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Bluetooth Manager.lnk - c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2009-1-6 2360648]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-12 83360]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys]
@="FSFilter Activity Monitor"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\TOSHIBA\\ivp\\NetInt\\Netint.exe"=
"c:\\TOSHIBA\\Ivp\\ISM\\pinger.exe"= c:\\TOSHIBA\\IVP\\ISM\\pinger.exe

R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\N360\0308000.029\SymEFA.sys [1/27/2010 7:55 PM 310320]
R0 Thpdrv;TOSHIBA HDD Protection Driver;c:\windows\system32\drivers\thpdrv.sys [8/21/2008 10:35 AM 28536]
R0 Thpevm;TOSHIBA HDD Protection - Shock Sensor Driver;c:\windows\system32\drivers\Thpevm.sys [9/4/2007 10:14 AM 6528]
R1 BHDrvx86;Symantec Heuristics Driver;c:\windows\system32\drivers\N360\0308000.029\BHDrvx86.sys [1/27/2010 7:55 PM 259632]
R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\N360\0308000.029\cchpx86.sys [1/27/2010 7:55 PM 482432]
R1 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100520.001\IDSXpx86.sys [10/28/2009 3:37 PM 329592]
R2 N360;Norton 360;c:\program files\Norton 360\Engine\3.8.0.41\ccSvcHst.exe [1/27/2010 7:55 PM 117640]
R2 tdudf;TOSHIBA UDF File System Driver;c:\windows\system32\drivers\tdudf.sys [3/26/2007 12:22 PM 105856]
R2 trudf;TOSHIBA DVD-RAM UDF File System Driver;c:\windows\system32\drivers\trudf.sys [2/19/2007 12:15 PM 134016]
R3 cecnuvc;Chicony USB 2.0 Camera VD;c:\windows\system32\drivers\cec_uvc.sys [6/10/2009 10:39 AM 48176]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [5/27/2010 1:00 AM 102448]
S2 gupdate1ca13554584f12e;Google Update Service (gupdate1ca13554584f12e);c:\program files\Google\Update\GoogleUpdate.exe [8/2/2009 2:40 AM 133104]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [1/1/2010 11:26 AM 1684736]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\drivers\RtsUStor.sys [4/6/2009 12:09 PM 164864]
S3 RtsUIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys –> c:\windows\system32\DRIVERS\Rts516xIR.sys [?]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{C97751B1-BF63-4867-87FB-49B72502DBCD}]
2003-08-13 09:03 710 —-a-w- c:\program files\Microsoft Office\Office10\OfficeXPFirstRun.vbs
.
Contents of the 'Scheduled Tasks' folder

2010-05-28 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-04-06 09:39]

2010-05-28 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-08-02 09:40]

2010-05-28 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-08-02 09:40]
.
.
——- Supplementary Scan ——-
.
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~3\Office10\EXCEL.EXE/3000
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-27 19:50
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\N360]
"ImagePath"="\"c:\program files\Norton 360\Engine\3.8.0.41\ccSvcHst.exe\" /s \"N360\" /m \"c:\program files\Norton 360\Engine\3.8.0.41\diMaster.dll\" /prefetch:1"
.
Completion time: 2010-05-27 19:52:35
ComboFix-quarantined-files.txt 2010-05-28 02:52

Pre-Run: 135,620,923,392 bytes free
Post-Run: 135,609,552,896 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

- - End Of File - - BCC4802B5D9C971D7CC3F02228830DCD

martix

Post #10June 1, 2010, 9:53 AM UTC

Sorry about the delay but I was away for the weekend. Now, let's proceed:

Please download Malwarebytes' Anti-Malware from Here or Here

Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform quick scan, then click Scan.
[external image: Posted Image]
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected .
When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.

NEXT

Please do a scan with Kaspersky Online Scanner or from Here.

Click on the Accept button and install any components it needs.
The program will install and then begin downloading the latest definition files.
After the files have been downloaded on the left side of the page in the Scan section select My Computer.
This will start the program and scan your system.
The scan will take a while, so be patient and let it run. (At times it may appear to stall)
Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
- Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
- Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
Once the scan is complete, click on View scan report To obtain the report:
Click on: Save Report As
Next, in the Save as prompt, Save in area, select: Desktop
In the File name area, use KScan, or something similar In Save as type, click the drop arrow and select: Text file [*.txt]
Then, click: Save
Please post the Kaspersky Online Scanner Report in your reply.

[external image: Posted Image]

Things I'll need in your next reply:
MBAM log
Kaspersky log

Gadgetgal

Post #11June 4, 2010, 5:52 AM UTC

Hi, sorry for my late response, work has been CRAZY lately. Thank you! MBAM log Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Database version: 4165 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 6/2/2010 8:39:17 PM mbam-log-2010-06-02 (20-39-17).txt Scan type: Quick scan Objects scanned: 144433 Time elapsed: 11 minute(s), 1 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) Kscan ——————————————————————————– KASPERSKY ONLINE SCANNER 7.0: scan report Thursday, June 3, 2010 Operating system: Microsoft Windows XP Home Edition Service Pack 3 (build 2600) Kaspersky Online Scanner version: 7.0.26.13 Last database update: Thursday, June 03, 2010 20:07:03 Records in database: 4197620 ——————————————————————————– Scan settings: scan using the following database: extended Scan archives: yes Scan e-mail databases: yes Scan area - My Computer: C:\ Scan statistics: Objects scanned: 46268 Threats found: 3 Infected objects found: 3 Suspicious objects found: 0 Scan duration: 02:15:40 File name / Threat / Threats count C:\Documents and Settings\Delbert\Application Data\Sun\Java\Deployment\cache\6.0\2\4c5a95c2-370e2b31 Infected: Trojan-Downloader.Java.Agent.cd 1 C:\Documents and Settings\Delbert\Application Data\Sun\Java\Deployment\cache\6.0\2\4c5a95c2-370e2b31 Infected: Trojan-Downloader.Java.OpenStream.al 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\Drivers\thpdrv.sys.vir Infected: Rootkit.Win32.TDSS.ap 1 Selected area has been scanned.

martix

Post #12June 6, 2010, 9:05 AM UTC

[external image: Posted Image]
Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.

Download the latest version of Java Runtime Environment (JRE) 20 and save it to your desktop.
Scroll down to where it says JDK 6 Update 20 (JDK or JRE)
Click the Download JRE button to the right
Select the Windows platform from the dropdown menu.
Read the License Agreement and then check the box that says: "I agree to the Java SE Runtime Environment 6u20 with JavaFX 1 License Agreement". Click on Continue.The page will refresh.
Click on the link to download Windows Offline Installation and save the file to your desktop.
Close any programs you may have running - especially your web browser.
Go to Start > Control Panel, double-click on Add or Remove Programs and remove all older versions of Java.
Check (highlight) any item with Java Runtime Environment (JRE or J2SE or Java™ 6) in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java versions.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-6u20-windows-i586-p.exe to install the newest version.

After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
- On the General tab, under Temporary Internet Files, click the Settings button.
- Next, click on the Delete Files button
- There are two options in the window to clear the cache - Leave BOTH CheckedApplications and Applets
  Trace and Log Files
Click OK on Delete Temporary Files Window
Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
Click OK to leave the Temporary Files Window
Click OK to leave the Java Control Panel.

Download OTL to your desktop.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Check the boxes beside LOP Check and Purity Check.
Under Custom Scan paste this in
netsvcs
%SYSTEMDRIVE%\*.exe
/md5start
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
sceclt.dll
ntelogon.dll
logevent.dll
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
nvrd32.sys
symmpi.sys
adp3132.sys
mv61xx.sys
/md5stop
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt.
Note:These logs can be located in the OTL. folder on you C:\ drive if they fail to open automatically.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them both in.

Gadgetgal

Post #13June 6, 2010, 10:43 PM UTC last edited June 6, 2010, 10:47 PM UTC

Hello, here is the first log.

OTL.txt
OTL logfile created on: 6/6/2010 3:16:45 PM - Run 1
OTL by OldTimer - Version 3.2.5.3 Folder = C:\Documents and Settings\Netbook\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,014.00 Mb Total Physical Memory | 494.00 Mb Available Physical Memory | 49.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 83.00% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 141.55 Gb Total Space | 125.29 Gb Free Space | 88.51% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: TOSHIBA
Current User Name: Netbook
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Netbook\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Norton 360\Engine\3.8.0.41\ccSvcHst.exe (Symantec Corporation)
PRC - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
PRC - C:\Program Files\TOSHIBA\TouchPad\TPTray.exe (COMPAL ELECTRONIC INC.)
PRC - C:\WINDOWS\system32\TDispVol.exe (TOSHIBA Corporation)
PRC - C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe (Chicony)
PRC - C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe (COMPAL ELECTRONIC INC.)
PRC - C:\WINDOWS\system32\TPSMain.exe (TOSHIBA Corporation)
PRC - C:\Program Files\TOSHIBA\TOSHIBA USB Sleep and Charge Utility\TUSBSleepChargeSrv.exe (TOSHIBA)
PRC - C:\Program Files\Atheros\ACU.exe (Atheros Communications, Inc.)
PRC - C:\WINDOWS\system32\acs.exe (Atheros)
PRC - C:\Program Files\Apoint2K\hidfind.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\TosBtHSP.exe (TOSHIBA CORPORATION.)
PRC - C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\TosA2dp.exe (TOSHIBA CORPORATION.)
PRC - C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\TosBtMng.exe (TOSHIBA CORPORATION.)
PRC - C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\TosBtSrv.exe (TOSHIBA CORPORATION)
PRC - C:\WINDOWS\system32\ThpSrv.exe (TOSHIBA Corporation)
PRC - C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\TosBtHid.exe (TOSHIBA CORPORATION.)
PRC - C:\WINDOWS\system32\TPSBattM.exe (TOSHIBA Corporation)
PRC - c:\TOSHIBA\IVP\swupdate\swupdtmr.exe ()
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\WINDOWS\system32\drwtsn32.exe (Microsoft Corporation)
PRC - C:\WINDOWS\system32\TODDSrv.exe (TOSHIBA Corporation)
PRC - C:\Program Files\TOSHIBA\TOSHIBA Direct Disc Writer\DDWMon.exe (TOSHIBA Corporation)
PRC - C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe (TOSHIBA Corporation)
PRC - C:\TOSHIBA\IVP\ISM\pinger.exe ()
PRC - C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe (TOSHIBA CORPORATION)
PRC - C:\WINDOWS\system32\ZoomingHook.exe (TOSHIBA)
PRC - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe (TOSHIBA CORPORATION)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Netbook\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Program Files\Norton 360\Engine\3.8.0.41\asOEHook.dll (Symantec Corporation)
MOD - C:\WINDOWS\system32\TDispVol.dll ()
MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (N360) – C:\Program Files\Norton 360\Engine\3.8.0.41\ccSvcHst.exe (Symantec Corporation)
SRV - (ACS) – C:\WINDOWS\system32\acs.exe (Atheros)
SRV - (TOSHIBA Bluetooth Service) – C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\TosBtSrv.exe (TOSHIBA CORPORATION)
SRV - (Thpsrv) – C:\WINDOWS\system32\ThpSrv.exe (TOSHIBA Corporation)
SRV - (Swupdtmr) – c:\TOSHIBA\IVP\swupdate\swupdtmr.exe ()
SRV - (TODDSrv) – C:\WINDOWS\system32\TODDSrv.exe (TOSHIBA Corporation)
SRV - (pinger) – C:\TOSHIBA\IVP\ISM\pinger.exe ()
SRV - (IDriverT) – C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe (Macrovision Corporation)
SRV - (CFSvcs) – C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe (TOSHIBA CORPORATION)

========== Driver Services (SafeList) ==========

DRV - (IDSxpx86) – C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100528.003\IDSXpx86.sys (Symantec Corporation)
DRV - (eeCtrl) – C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys (Symantec Corporation)
DRV - (EraserUtilRebootDrv) – C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation)
DRV - (NAVEX15) – C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100606.003\NAVEX15.SYS (Symantec Corporation)
DRV - (NAVENG) – C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100606.003\NAVENG.SYS (Symantec Corporation)
DRV - (ApfiltrService) – C:\WINDOWS\system32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)
DRV - (ccHP) – C:\WINDOWS\System32\Drivers\N360\0308000.029\ccHPx86.sys (Symantec Corporation)
DRV - (SymEFA) – C:\WINDOWS\system32\drivers\N360\0308000.029\SYMEFA.SYS (Symantec Corporation)
DRV - (SRTSP) – C:\WINDOWS\System32\Drivers\N360\0308000.029\SRTSP.SYS (Symantec Corporation)
DRV - (BHDrvx86) – C:\WINDOWS\System32\Drivers\N360\0308000.029\BHDrvx86.sys (Symantec Corporation)
DRV - (SYMTDI) – C:\WINDOWS\System32\Drivers\N360\0308000.029\SYMTDI.SYS (Symantec Corporation)
DRV - (SYMFW) – C:\WINDOWS\System32\Drivers\N360\0308000.029\SYMFW.SYS (Symantec Corporation)
DRV - (SRTSPX) Symantec Real Time Storage Protection (PEL) – C:\WINDOWS\system32\drivers\N360\0308000.029\SRTSPX.SYS (Symantec Corporation)
DRV - (SYMNDIS) – C:\WINDOWS\System32\Drivers\N360\0308000.029\SYMNDIS.SYS (Symantec Corporation)
DRV - (SYMIDS) – C:\WINDOWS\System32\Drivers\N360\0308000.029\SYMIDS.SYS (Symantec Corporation)
DRV - (SymEvent) – C:\WINDOWS\system32\drivers\SYMEVENT.SYS (Symantec Corporation)
DRV - (SymIMMP) – C:\WINDOWS\system32\drivers\SymIM.sys (Symantec Corporation)
DRV - (SymIM) – C:\WINDOWS\system32\drivers\SymIM.sys (Symantec Corporation)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) – C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (cecnuvc) – C:\WINDOWS\system32\drivers\cec_uvc.sys (Chicony Electronics Co., Ltd.)
DRV - (UVCFTR) – C:\WINDOWS\system32\drivers\UVCFTR_S.SYS (Chicony Electronics Co., Ltd.)
DRV - (RSUSBSTOR) – C:\WINDOWS\system32\drivers\RtsUStor.sys (Realtek Semiconductor Corp.)
DRV - (TVALZ) – C:\WINDOWS\system32\DRIVERS\TVALZ_O.SYS (TOSHIBA Corporation)
DRV - (AR5416) – C:\WINDOWS\system32\drivers\athw.sys (Atheros Communications, Inc.)
DRV - (iaStor) – C:\WINDOWS\system32\drivers\iaStor.sys (Intel Corporation)
DRV - (WSIMD) – C:\WINDOWS\system32\drivers\wsimd.sys (Atheros Communications, Inc.)
DRV - (RTLE8023xp) – C:\WINDOWS\system32\drivers\Rtenicxp.sys (Realtek Semiconductor Corporation )
DRV - (Tosrfusb) – C:\WINDOWS\system32\drivers\tosrfusb.sys (TOSHIBA CORPORATION)
DRV - (TosRfSnd) – C:\WINDOWS\system32\drivers\TosRfSnd.sys (TOSHIBA Corporation)
DRV - (tosrfbd) – C:\WINDOWS\system32\drivers\tosrfbd.sys (TOSHIBA CORPORATION)
DRV - (Tosrfhid) – C:\WINDOWS\system32\drivers\Tosrfhid.sys (TOSHIBA Corporation.)
DRV - (Tosrfcom) – C:\WINDOWS\system32\drivers\tosrfcom.sys (TOSHIBA Corporation)
DRV - (Thpdrv) – C:\WINDOWS\system32\DRIVERS\thpdrv.sys (TOSHIBA Corporation)
DRV - (Ambfilt) – C:\WINDOWS\system32\drivers\Ambfilt.sys (Creative)
DRV - (TPwSav) – C:\WINDOWS\system32\drivers\TPwSav.sys (TOSHIBA )
DRV - (HDAudBus) – C:\WINDOWS\system32\drivers\hdaudbus.sys (Windows ® Server 2003 DDK provider)
DRV - (tosporte) – C:\WINDOWS\system32\drivers\tosporte.sys (TOSHIBA Corporation)
DRV - (ialm) – C:\WINDOWS\system32\drivers\igxpmp32.sys (Intel Corporation)
DRV - (tosrfbnp) – C:\WINDOWS\system32\drivers\tosrfbnp.sys (TOSHIBA Corporation)
DRV - (Thpevm) – C:\WINDOWS\system32\DRIVERS\Thpevm.SYS (TOSHIBA Corporation)
DRV - (tdudf) – C:\WINDOWS\system32\drivers\tdudf.sys (TOSHIBA Corporation)
DRV - (tdcmdpst) – C:\WINDOWS\system32\drivers\tdcmdpst.sys (TOSHIBA Corporation.)
DRV - (trudf) – C:\WINDOWS\system32\drivers\trudf.sys (TOSHIBA Corporation)
DRV - (tosrfec) – C:\WINDOWS\system32\drivers\tosrfec.sys (TOSHIBA Corporation)
DRV - (Monfilt) – C:\WINDOWS\system32\drivers\Monfilt.sys (Creative Technology Ltd.)
DRV - (tosrfnds) – C:\WINDOWS\system32\drivers\tosrfnds.sys (TOSHIBA Corporation.)
DRV - (Netdevio) – C:\WINDOWS\system32\drivers\Netdevio.sys (TOSHIBA Corporation.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/?st=1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\software\mozilla\Firefox\extensions\\{7BA52691-1876-45ce-9EE6-54BCB3B04BBC}: C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn\ [2010/04/26 18:20:39 | 000,000,000 | —D | M]

O1 HOSTS File: ([2010/05/27 19:50:04 | 000,000,027 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton 360\Engine\3.8.0.41\CoIEPlg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton 360\Engine\3.8.0.41\IPSBHO.dll (Symantec Corporation)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll (Google Inc.)
O2 - BHO: (Google Dictionary Compression sdch) - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360\Engine\3.8.0.41\CoIEPlg.dll (Symantec Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360\Engine\3.8.0.41\CoIEPlg.dll (Symantec Corporation)
O4 - HKLM..\Run: [ACU] C:\Program Files\Atheros\ACU.exe (Atheros Communications, Inc.)
O4 - HKLM..\Run: [Camera Assistant Software] C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe (Chicony)
O4 - HKLM..\Run: [CeEKEY] C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe (COMPAL ELECTRONIC INC.)
O4 - HKLM..\Run: [DDWMon] C:\Program Files\TOSHIBA\TOSHIBA Direct Disc Writer\\ddwmon.exe ()
O4 - HKLM..\Run: [HWSetup] C:\Program Files\TOSHIBA\TOSHIBA Applet\HWSetup.exe (TOSHIBA CO.,LTD.)
O4 - HKLM..\Run: [ITSecMng] C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe (TOSHIBA CORPORATION)
O4 - HKLM..\Run: [NDSTray.exe] File not found
O4 - HKLM..\Run: [Pinger] c:\toshiba\ivp\ism\pinger.exe ()
O4 - HKLM..\Run: [SmoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [TAccessibility] C:\Program Files\TOSHIBA\Accessibility\TAccessibility.exe ()
O4 - HKLM..\Run: [TDispVol] C:\WINDOWS\System32\TDispVol.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [ThpSrv] C:\WINDOWS\System32\thpsrv.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [TPNF] C:\Program Files\TOSHIBA\TouchPad\TPTray.exe (COMPAL ELECTRONIC INC.)
O4 - HKLM..\Run: [TPSMain] C:\WINDOWS\System32\TPSMain.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [TUSBSleepChargeSrv] C:\Program Files\TOSHIBA\TOSHIBA USB Sleep and Charge Utility\TUSBSleepChargeSrv.exe (TOSHIBA)
O4 - HKLM..\Run: [ZoomingHook] C:\WINDOWS\System32\ZoomingHook.exe (TOSHIBA)
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Bluetooth Manager.lnk = C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\TosBtMng.exe (TOSHIBA CORPORATION.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office10\EXCEL.EXE (Microsoft Corporation)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} http://gfx2.hotmail.com/mail/w4/pr01/photo…ol/MSNPUpld.cab (Windows Live Hotmail Photo Upload Tool)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\symres {AA1061FE-6C41-421f-9344-69640C9732AB} - C:\Program Files\Norton 360\Engine\3.8.0.41\CoIEPlg.dll (Symantec Corporation)
O18 - Protocol\Filter\x-sdch {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll (Google Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Netbook\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Netbook\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/04/06 11:11:52 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - C:\WINDOWS\system32\ias [2009/04/06 11:11:18 | 000,000,000 | —D | M]
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: Wmi - C:\WINDOWS\system32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found

========== Files/Folders - Created Within 30 Days ==========

[2010/06/06 15:13:44 | 000,571,904 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Netbook\Desktop\OTL.exe
[2010/06/06 15:04:18 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Sun
[2010/06/06 15:04:17 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Java
[2010/06/06 15:04:00 | 000,411,368 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\deployJava1.dll
[2010/06/06 15:04:00 | 000,153,376 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaws.exe
[2010/06/06 15:04:00 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaw.exe
[2010/06/06 15:04:00 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\java.exe
[2010/06/06 15:04:00 | 000,073,728 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javacpl.cpl
[2010/06/06 14:56:04 | 016,295,712 | —- | C] (Sun Microsystems, Inc.) – C:\Documents and Settings\Netbook\Desktop\jre-6u20-windows-i586.exe
[2010/06/02 20:27:22 | 000,000,000 | —D | C] – C:\Documents and Settings\Netbook\Application Data\Malwarebytes
[2010/06/02 20:26:48 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/06/02 20:26:46 | 000,020,952 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2010/06/02 20:26:46 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2010/06/02 20:26:45 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2010/06/02 20:25:15 | 006,153,352 | —- | C] (Malwarebytes Corporation ) – C:\Documents and Settings\Netbook\Desktop\mbam-setup-1.46.exe
[2010/05/27 20:04:46 | 000,000,000 | —D | C] – C:\Documents and Settings\Netbook\Desktop\Malware removal tools
[2010/05/27 20:04:40 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2010/05/27 19:35:21 | 000,000,000 | RHSD | C] – C:\cmdcons
[2010/05/27 19:32:22 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2010/05/27 19:32:22 | 000,161,792 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2010/05/27 19:32:22 | 000,136,704 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2010/05/27 19:32:22 | 000,031,232 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2010/05/27 19:31:56 | 000,000,000 | —D | C] – C:\WINDOWS\ERDNT
[2010/05/27 19:31:08 | 000,000,000 | —D | C] – C:\Qoobox
[2010/05/25 21:07:26 | 000,000,000 | R–D | C] – C:\Program Files\Norton Support
[2010/05/25 19:42:44 | 000,000,000 | —D | C] – C:\WINDOWS\maxdriver
[2010/05/23 14:20:19 | 000,000,000 | —D | C] – C:\WINDOWS\Minidump
[2010/05/23 08:44:15 | 003,558,912 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\moviemk.exe
[2010/05/13 21:11:25 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2010/05/13 21:11:24 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Adobe
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/06/06 15:13:51 | 000,571,904 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Netbook\Desktop\OTL.exe
[2010/06/06 15:11:01 | 000,000,886 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/06/06 15:03:36 | 000,411,368 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\deployJava1.dll
[2010/06/06 15:03:36 | 000,153,376 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaws.exe
[2010/06/06 15:03:36 | 000,145,184 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaw.exe
[2010/06/06 15:03:36 | 000,145,184 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\java.exe
[2010/06/06 15:03:36 | 000,073,728 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javacpl.cpl
[2010/06/06 15:01:04 | 000,001,158 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/06/06 15:00:31 | 000,000,868 | —- | M] () – C:\WINDOWS\tasks\Google Software Updater.job
[2010/06/06 15:00:25 | 000,000,882 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/06/06 15:00:16 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/06/06 15:00:04 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/06/06 14:59:42 | 1063,702,528 | -HS- | M] () – C:\hiberfil.sys
[2010/06/06 14:58:51 | 003,670,016 | -H– | M] () – C:\Documents and Settings\Netbook\NTUSER.DAT
[2010/06/06 14:58:51 | 000,000,178 | -HS- | M] () – C:\Documents and Settings\Netbook\ntuser.ini
[2010/06/06 14:56:05 | 016,295,712 | —- | M] (Sun Microsystems, Inc.) – C:\Documents and Settings\Netbook\Desktop\jre-6u20-windows-i586.exe
[2010/06/02 20:54:21 | 000,576,054 | —- | M] () – C:\Documents and Settings\Netbook\Desktop\Kerror.bmp
[2010/06/02 20:26:51 | 000,000,708 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/06/02 20:25:15 | 006,153,352 | —- | M] (Malwarebytes Corporation ) – C:\Documents and Settings\Netbook\Desktop\mbam-setup-1.46.exe
[2010/05/27 19:50:19 | 000,000,227 | —- | M] () – C:\WINDOWS\system.ini
[2010/05/27 19:50:04 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2010/05/27 19:35:29 | 000,000,281 | RHS- | M] () – C:\boot.ini
[2010/05/27 19:20:39 | 003,700,283 | R— | M] () – C:\Documents and Settings\Netbook\Desktop\Combo-Fix.exe
[2010/05/26 18:54:04 | 000,000,000 | —- | M] () – C:\Documents and Settings\Netbook\settings.dat
[2010/05/26 18:48:47 | 000,464,491 | —- | M] () – C:\Documents and Settings\Netbook\Desktop\RootRepeal.zip
[2010/05/25 19:42:49 | 000,009,691 | —- | M] () – C:\WINDOWS\look.bat
[2010/05/25 19:37:23 | 001,138,992 | —- | M] () – C:\Documents and Settings\Netbook\Desktop\maxlook.exe
[2010/05/23 14:24:23 | 000,038,912 | —- | M] () – C:\Documents and Settings\Netbook\Desktop\error.doc
[2010/05/23 14:24:23 | 000,000,162 | -H– | M] () – C:\Documents and Settings\Netbook\Desktop\~$error.doc
[2010/05/23 11:37:15 | 000,359,929 | —- | M] () – C:\Documents and Settings\Netbook\Desktop\dds.scr
[2010/05/23 08:48:16 | 000,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2010/05/15 07:16:26 | 000,001,927 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Google Earth.lnk
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/06/02 20:54:21 | 000,576,054 | —- | C] () – C:\Documents and Settings\Netbook\Desktop\Kerror.bmp
[2010/06/02 20:26:51 | 000,000,708 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/05/27 19:35:28 | 000,000,211 | —- | C] () – C:\Boot.bak
[2010/05/27 19:35:23 | 000,260,272 | —- | C] () – C:\cmldr
[2010/05/27 19:32:22 | 000,256,512 | —- | C] () – C:\WINDOWS\PEV.exe
[2010/05/27 19:32:22 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2010/05/27 19:32:22 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2010/05/27 19:32:22 | 000,077,312 | —- | C] () – C:\WINDOWS\MBR.exe
[2010/05/27 19:32:22 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2010/05/27 19:20:28 | 003,700,283 | R— | C] () – C:\Documents and Settings\Netbook\Desktop\Combo-Fix.exe
[2010/05/26 18:54:04 | 000,000,000 | —- | C] () – C:\Documents and Settings\Netbook\settings.dat
[2010/05/26 18:48:46 | 000,464,491 | —- | C] () – C:\Documents and Settings\Netbook\Desktop\RootRepeal.zip
[2010/05/25 19:42:47 | 000,009,691 | —- | C] () – C:\WINDOWS\look.bat
[2010/05/25 19:37:17 | 001,138,992 | —- | C] () – C:\Documents and Settings\Netbook\Desktop\maxlook.exe
[2010/05/23 14:24:23 | 000,038,912 | —- | C] () – C:\Documents and Settings\Netbook\Desktop\error.doc
[2010/05/23 14:24:23 | 000,000,162 | -H– | C] () – C:\Documents and Settings\Netbook\Desktop\~$error.doc
[2010/05/23 11:37:14 | 000,359,929 | —- | C] () – C:\Documents and Settings\Netbook\Desktop\dds.scr
[2010/05/15 07:16:26 | 000,001,927 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Google Earth.lnk
[2009/08/06 21:06:07 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2009/07/14 16:27:53 | 000,000,013 | RHS- | C] () – C:\WINDOWS\System32\drivers\fbd.sys
[2009/07/14 16:27:46 | 000,000,004 | RHS- | C] () – C:\WINDOWS\System32\drivers\taishop.sys
[2009/06/10 10:45:15 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2009/06/10 10:38:07 | 000,262,216 | —- | C] () – C:\WINDOWS\System32\IPTests.dll
[2009/04/06 12:54:02 | 000,000,348 | —- | C] () – C:\WINDOWS\System32\OEMINFO.INI
[2009/04/06 12:33:07 | 000,000,000 | —- | C] () – C:\WINDOWS\NDSTray.INI
[2009/04/06 12:23:37 | 000,040,960 | —- | C] () – C:\WINDOWS\System32\EBLib.DLL
[2009/04/06 12:03:17 | 000,147,456 | —- | C] () – C:\WINDOWS\System32\igfxCoIn_v4926.dll
[2009/04/06 11:09:03 | 000,001,793 | —- | C] () – C:\WINDOWS\System32\fxsperf.ini
[2009/04/02 11:54:38 | 000,028,672 | —- | C] () – C:\WINDOWS\System32\TPeculiarity.dll
[2009/04/02 10:35:18 | 000,024,576 | —- | C] () – C:\WINDOWS\System32\EKECioCtl.dll
[2009/03/31 11:13:20 | 000,045,056 | —- | C] () – C:\WINDOWS\System32\HWS_Ctrl.dll
[2009/03/13 15:05:14 | 000,045,056 | —- | C] () – C:\WINDOWS\System32\TDispVol.dll

========== LOP Check ==========

[2009/08/06 20:18:52 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PCSettings
[2009/09/21 20:46:54 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TOSHIBA
[2009/04/06 12:23:36 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Vista32
[2009/04/06 12:23:36 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Vista64
[2009/04/06 12:33:51 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\XP
[2009/08/19 09:48:29 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{7B6BA59A-FB0E-4499-8536-A7420338BF3B}
[2009/04/06 12:27:40 | 000,000,000 | —D | M] – C:\Documents and Settings\Netbook\Application Data\toshiba
[2009/04/06 11:16:29 | 000,000,000 | —D | M] – C:\Documents and Settings\Netbook\Application Data\WinBatch

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >

< MD5 for: AGP440.SYS >
[2008/04/14 05:00:00 | 020,056,462 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2008/04/14 05:00:00 | 020,056,462 | —- | M] () .cab file – C:\WINDOWS\I386\sp3.cab:AGP440.sys

< MD5 for: ATAPI.SYS >
[2008/04/14 05:00:00 | 020,056,462 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2008/04/14 05:00:00 | 020,056,462 | —- | M] () .cab file – C:\WINDOWS\I386\sp3.cab:atapi.sys
[2008/04/14 00:10:32 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\ERDNT\cache\atapi.sys
[2008/04/14 00:10:32 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\system32\dllcache\atapi.sys
[2008/04/14 00:10:32 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\system32\drivers\atapi.sys
[2008/04/14 05:00:00 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\system32\ReinstallBackups\0006\DriverFiles\i386\atapi.sys

< MD5 for: EVENTLOG.DLL >
[2008/04/14 05:00:00 | 000,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\ERDNT\cache\eventlog.dll
[2008/04/14 05:00:00 | 000,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\system32\eventlog.dll

< MD5 for: IASTOR.SYS >
[2009/02/11 17:26:18 | 000,407,576 | —- | M] (Intel Corporation) MD5=1ADAA4F16073FD0C7270F451FD024E97 – C:\Program Files\Intel\Intel Matrix Storage Manager\driver64\IaStor.sys
[2009/02/11 17:11:50 | 000,329,752 | —- | M] (Intel Corporation) MD5=71ECC07BC7C5E24C3DD01D8A29A24054 – C:\Program Files\Intel\Intel Matrix Storage Manager\driver\IaStor.sys
[2009/02/11 18:11:50 | 000,329,752 | —- | M] (Intel Corporation) MD5=71ECC07BC7C5E24C3DD01D8A29A24054 – C:\WINDOWS\OemDir\iaStor.sys
[2009/02/11 17:11:50 | 000,329,752 | —- | M] (Intel Corporation) MD5=71ECC07BC7C5E24C3DD01D8A29A24054 – C:\WINDOWS\system32\drivers\iaStor.sys
[2009/02/11 17:11:50 | 000,329,752 | —- | M] (Intel Corporation) MD5=71ECC07BC7C5E24C3DD01D8A29A24054 – C:\WINDOWS\system32\DRVSTORE\iaAHCI_DAB8BE0C6A617003890F5FDA36EBBE5A46A6D51A\iaStor.sys
[2009/02/11 18:11:50 | 000,329,752 | —- | M] (Intel Corporation) MD5=71ECC07BC7C5E24C3DD01D8A29A24054 – C:\WINDOWS\system32\ReinstallBackups\0012\DriverFiles\iaStor.sys

< MD5 for: NETLOGON.DLL >
[2008/04/14 05:00:00 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\ERDNT\cache\netlogon.dll
[2008/04/14 05:00:00 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\system32\netlogon.dll

< MD5 for: SCECLI.DLL >
[2008/04/14 05:00:00 | 000,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\ERDNT\cache\scecli.dll
[2008/04/14 05:00:00 | 000,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\system32\scecli.dll

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[2008/04/14 05:00:00 | 000,098,304 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\actxprxy.dll
[2008/04/14 05:00:00 | 000,029,184 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\batmeter.dll
[2008/04/14 05:00:00 | 000,063,488 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\browselc.dll
[2008/04/14 05:00:00 | 000,163,840 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\credui.dll
[2008/04/14 05:00:00 | 000,033,280 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\cryptdll.dll
[2008/04/14 05:00:00 | 000,025,088 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\davclnt.dll
[2008/04/14 05:00:00 | 000,847,872 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\dbgeng.dll
[2008/04/14 05:00:00 | 000,640,000 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\dbghelp.dll
[2008/04/14 05:00:00 | 000,026,112 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\dot3api.dll
[2008/04/14 05:00:00 | 000,009,216 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\dot3dlg.dll
[2008/04/14 05:00:00 | 000,014,336 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\drprov.dll
[2008/04/14 05:00:00 | 000,304,128 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\duser.dll
[2008/04/14 05:00:00 | 000,126,976 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\eappcfg.dll
[2008/04/14 05:00:00 | 000,040,960 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\eappprxy.dll
[2008/04/14 05:00:00 | 000,125,952 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\exts.dll
[2008/04/14 05:00:00 | 000,451,584 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\fxsapi.dll
[2008/04/14 05:00:00 | 000,562,176 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\fxsst.dll
[2008/04/14 05:00:00 | 000,344,064 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\hnetcfg.dll
[2008/02/15 12:46:08 | 000,048,128 | —- | M] (Intel Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\igfxsrvc.dll
[2008/04/14 05:00:00 | 000,094,720 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\iphlpapi.dll
[2008/04/14 05:00:00 | 000,586,240 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\mlang.dll
[2008/04/14 05:00:00 | 000,071,680 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\msacm32.dll
[2008/04/14 05:00:00 | 002,843,136 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\msi.dll
[2008/04/14 05:00:00 | 000,195,072 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\msutb.dll
[2008/04/14 05:00:00 | 000,413,696 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\msvcp60.dll
[2008/04/14 05:00:00 | 000,011,776 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\netrap.dll
[2008/04/14 05:00:00 | 000,080,896 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\netui0.dll
[2008/04/14 05:00:00 | 000,245,760 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\netui1.dll
[2008/04/14 05:00:00 | 000,044,032 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\ntlanman.dll
[2008/04/14 05:00:00 | 000,036,864 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\ntsdexts.dll
[2008/04/14 05:00:00 | 000,144,384 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\onex.dll
[2008/04/14 05:00:00 | 000,017,408 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\powrprof.dll
[2008/04/14 05:00:00 | 000,007,680 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\rasadhlp.dll
[2008/04/14 05:00:00 | 000,237,056 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\rasapi32.dll
[2008/04/14 05:00:00 | 000,061,440 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\rasman.dll
[2008/04/14 05:00:00 | 000,208,384 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\rsaenh.dll
[2008/04/14 05:00:00 | 000,044,032 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\rtutils.dll
[2008/04/14 05:00:00 | 000,007,168 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\sensapi.dll
[2008/04/14 05:00:00 | 000,181,760 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\tapi32.dll
[2009/03/13 15:05:14 | 000,045,056 | —- | M] () Unable to obtain MD5 – C:\WINDOWS\system32\TDispVol.dll
[2007/10/08 13:02:46 | 000,040,960 | —- | M] (TOSHIBA Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\TPSTrace.dll
[2007/10/08 13:02:46 | 000,053,248 | —- | M] (TOSHIBA Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\TPwrCfg.dll
[2007/10/08 13:02:46 | 000,069,632 | —- | M] (TOSHIBA Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\TPwrReg.dll
[2008/04/14 05:00:00 | 000,053,760 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\winsta.dll
[2008/04/14 05:00:00 | 000,019,456 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\wshtcpip.dll
[2008/04/14 05:00:00 | 000,018,432 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\wtsapi32.dll
[2008/04/14 05:00:00 | 000,052,736 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\wzcsapi.dll
[2008/04/14 05:00:00 | 002,897,920 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\xpsp2res.dll
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2009/04/06 04:05:33 | 000,094,208 | —- | M] () – C:\WINDOWS\system32\config\default.sav
[2009/04/06 04:05:33 | 001,064,960 | —- | M] () – C:\WINDOWS\system32\config\software.sav
[2009/04/06 04:05:32 | 000,905,216 | —- | M] () – C:\WINDOWS\system32\config\system.sav
< End of report >
O4 - HKLM..\Run: [ACU] C:\Program Files\Atheros\ACU.exe (Atheros Communications, Inc.)
O4 - HKLM..\Run: [Camera Assistant Software] C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe (Chicony)
O4 - HKLM..\Run: [CeEKEY] C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe (COMPAL ELECTRONIC INC.)
O4 - HKLM..\Run: [DDWMon] C:\Program Files\TOSHIBA\TOSHIBA Direct Disc Writer\\ddwmon.exe ()
O4 - HKLM..\Run: [HWSetup] C:\Program Files\TOSHIBA\TOSHIBA Applet\HWSetup.exe (TOSHIBA CO.,LTD.)
O4 - HKLM..\Run: [ITSecMng] C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe (TOSHIBA CORPORATION)
O4 - HKLM..\Run: [NDSTray.exe] File not found
O4 - HKLM..\Run: [Pinger] c:\toshiba\ivp\ism\pinger.exe ()
O4 - HKLM..\Run: [SmoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [TAccessibility] C:\Program Files\TOSHIBA\Accessibility\TAccessibility.exe ()
O4 - HKLM..\Run: [TDispVol] C:\WINDOWS\System32\TDispVol.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [ThpSrv] C:\WINDOWS\System32\thpsrv.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [TPNF] C:\Program Files\TOSHIBA\TouchPad\TPTray.exe (COMPAL ELECTRONIC INC.)
O4 - HKLM..\Run: [TPSMain] C:\WINDOWS\System32\TPSMain.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [TUSBSleepChargeSrv] C:\Program Files\TOSHIBA\TOSHIBA USB Sleep and Charge Utility\TUSBSleepChargeSrv.exe (TOSHIBA)
O4 - HKLM..\Run: [ZoomingHook] C:\WINDOWS\System32\ZoomingHook.exe (TOSHIBA)
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Bluetooth Manager.lnk = C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\TosBtMng.exe (TOSHIBA CORPORATION.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office10\EXCEL.EXE (Microsoft Corporation)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} http://gfx2.hotmail.com/mail/w4/pr01/photo…ol/MSNPUpld.cab (Windows Live Hotmail Photo Upload Tool)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\symres {AA1061FE-6C41-421f-9344-69640C9732AB} - C:\Program Files\Norton 360\Engine\3.8.0.41\CoIEPlg.dll (Symantec Corporation)
O18 - Protocol\Filter\x-sdch {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll (Google Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Netbook\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Netbook\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/04/06 11:11:52 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/06/06 15:13:44 | 000,571,904 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Netbook\Desktop\OTL.exe
[2010/06/06 15:04:18 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Sun
[2010/06/06 15:04:17 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Java
[2010/06/06 15:04:00 | 000,411,368 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\deployJava1.dll
[2010/06/06 15:04:00 | 000,153,376 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaws.exe
[2010/06/06 15:04:00 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaw.exe
[2010/06/06 15:04:00 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\java.exe
[2010/06/06 15:04:00 | 000,073,728 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javacpl.cpl
[2010/06/06 14:56:04 | 016,295,712 | —- | C] (Sun Microsystems, Inc.) – C:\Documents and Settings\Netbook\Desktop\jre-6u20-windows-i586.exe
[2010/06/02 20:27:22 | 000,000,000 | —D | C] – C:\Documents and Settings\Netbook\Application Data\Malwarebytes
[2010/06/02 20:26:48 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/06/02 20:26:46 | 000,020,952 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2010/06/02 20:26:46 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2010/06/02 20:26:45 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2010/06/02 20:25:15 | 006,153,352 | —- | C] (Malwarebytes Corporation ) – C:\Documents and Settings\Netbook\Desktop\mbam-setup-1.46.exe
[2010/05/27 20:04:46 | 000,000,000 | —D | C] – C:\Documents and Settings\Netbook\Desktop\Malware removal tools
[2010/05/27 20:04:40 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2010/05/27 19:35:21 | 000,000,000 | RHSD | C] – C:\cmdcons
[2010/05/27 19:32:22 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2010/05/27 19:32:22 | 000,161,792 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2010/05/27 19:32:22 | 000,136,704 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2010/05/27 19:32:22 | 000,031,232 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2010/05/27 19:31:56 | 000,000,000 | —D | C] – C:\WINDOWS\ERDNT
[2010/05/27 19:31:08 | 000,000,000 | —D | C] – C:\Qoobox
[2010/05/25 21:07:26 | 000,000,000 | R–D | C] – C:\Program Files\Norton Support
[2010/05/25 19:42:44 | 000,000,000 | —D | C] – C:\WINDOWS\maxdriver
[2010/05/23 14:20:19 | 000,000,000 | —D | C] – C:\WINDOWS\Minidump
[2010/05/23 08:44:15 | 003,558,912 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\moviemk.exe
[2010/05/13 21:11:25 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2010/05/13 21:11:24 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Adobe
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/06/06 15:13:51 | 000,571,904 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Netbook\Desktop\OTL.exe
[2010/06/06 15:11:01 | 000,000,886 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/06/06 15:03:36 | 000,411,368 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\deployJava1.dll
[2010/06/06 15:03:36 | 000,153,376 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaws.exe
[2010/06/06 15:03:36 | 000,145,184 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaw.exe
[2010/06/06 15:03:36 | 000,145,184 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\java.exe
[2010/06/06 15:03:36 | 000,073,728 | —- | M] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javacpl.cpl
[2010/06/06 15:01:04 | 000,001,158 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/06/06 15:00:31 | 000,000,868 | —- | M] () – C:\WINDOWS\tasks\Google Software Updater.job
[2010/06/06 15:00:25 | 000,000,882 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/06/06 15:00:16 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/06/06 15:00:04 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/06/06 14:59:42 | 1063,702,528 | -HS- | M] () – C:\hiberfil.sys
[2010/06/06 14:58:51 | 003,670,016 | -H– | M] () – C:\Documents and Settings\Netbook\NTUSER.DAT
[2010/06/06 14:58:51 | 000,000,178 | -HS- | M] () – C:\Documents and Settings\Netbook\ntuser.ini
[2010/06/06 14:56:05 | 016,295,712 | —- | M] (Sun Microsystems, Inc.) – C:\Documents and Settings\Netbook\Desktop\jre-6u20-windows-i586.exe
[2010/06/02 20:54:21 | 000,576,054 | —- | M] () – C:\Documents and Settings\Netbook\Desktop\Kerror.bmp
[2010/06/02 20:26:51 | 000,000,708 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/06/02 20:25:15 | 006,153,352 | —- | M] (Malwarebytes Corporation ) – C:\Documents and Settings\Netbook\Desktop\mbam-setup-1.46.exe
[2010/05/27 19:50:19 | 000,000,227 | —- | M] () – C:\WINDOWS\system.ini
[2010/05/27 19:50:04 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2010/05/27 19:35:29 | 000,000,281 | RHS- | M] () – C:\boot.ini
[2010/05/27 19:20:39 | 003,700,283 | R— | M] () – C:\Documents and Settings\Netbook\Desktop\Combo-Fix.exe
[2010/05/26 18:54:04 | 000,000,000 | —- | M] () – C:\Documents and Settings\Netbook\settings.dat
[2010/05/26 18:48:47 | 000,464,491 | —- | M] () – C:\Documents and Settings\Netbook\Desktop\RootRepeal.zip
[2010/05/25 19:42:49 | 000,009,691 | —- | M] () – C:\WINDOWS\look.bat
[2010/05/25 19:37:23 | 001,138,992 | —- | M] () – C:\Documents and Settings\Netbook\Desktop\maxlook.exe
[2010/05/23 14:24:23 | 000,038,912 | —- | M] () – C:\Documents and Settings\Netbook\Desktop\error.doc
[2010/05/23 14:24:23 | 000,000,162 | -H– | M] () – C:\Documents and Settings\Netbook\Desktop\~$error.doc
[2010/05/23 11:37:15 | 000,359,929 | —- | M] () – C:\Documents and Settings\Netbook\Desktop\dds.scr
[2010/05/23 08:48:16 | 000,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2010/05/15 07:16:26 | 000,001,927 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Google Earth.lnk
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/06/02 20:54:21 | 000,576,054 | —- | C] () – C:\Documents and Settings\Netbook\Desktop\Kerror.bmp
[2010/06/02 20:26:51 | 000,000,708 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/05/27 19:35:28 | 000,000,211 | —- | C] () – C:\Boot.bak
[2010/05/27 19:35:23 | 000,260,272 | —- | C] () – C:\cmldr
[2010/05/27 19:32:22 | 000,256,512 | —- | C] () – C:\WINDOWS\PEV.exe
[2010/05/27 19:32:22 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2010/05/27 19:32:22 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2010/05/27 19:32:22 | 000,077,312 | —- | C] () – C:\WINDOWS\MBR.exe
[2010/05/27 19:32:22 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2010/05/27 19:20:28 | 003,700,283 | R— | C] () – C:\Documents and Settings\Netbook\Desktop\Combo-Fix.exe
[2010/05/26 18:54:04 | 000,000,000 | —- | C] () – C:\Documents and Settings\Netbook\settings.dat
[2010/05/26 18:48:46 | 000,464,491 | —- | C] () – C:\Documents and Settings\Netbook\Desktop\RootRepeal.zip
[2010/05/25 19:42:47 | 000,009,691 | —- | C] () – C:\WINDOWS\look.bat
[2010/05/25 19:37:17 | 001,138,992 | —- | C] () – C:\Documents and Settings\Netbook\Desktop\maxlook.exe
[2010/05/23 14:24:23 | 000,038,912 | —- | C] () – C:\Documents and Settings\Netbook\Desktop\error.doc
[2010/05/23 14:24:23 | 000,000,162 | -H– | C] () – C:\Documents and Settings\Netbook\Desktop\~$error.doc
[2010/05/23 11:37:14 | 000,359,929 | —- | C] () – C:\Documents and Settings\Netbook\Desktop\dds.scr
[2010/05/15 07:16:26 | 000,001,927 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Google Earth.lnk
[2009/08/06 21:06:07 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2009/07/14 16:27:53 | 000,000,013 | RHS- | C] () – C:\WINDOWS\System32\drivers\fbd.sys
[2009/07/14 16:27:46 | 000,000,004 | RHS- | C] () – C:\WINDOWS\System32\drivers\taishop.sys
[2009/06/10 10:45:15 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2009/06/10 10:38:07 | 000,262,216 | —- | C] () – C:\WINDOWS\System32\IPTests.dll
[2009/04/06 12:54:02 | 000,000,348 | —- | C] () – C:\WINDOWS\System32\OEMINFO.INI
[2009/04/06 12:33:07 | 000,000,000 | —- | C] () – C:\WINDOWS\NDSTray.INI
[2009/04/06 12:23:37 | 000,040,960 | —- | C] () – C:\WINDOWS\System32\EBLib.DLL
[2009/04/06 12:03:17 | 000,147,456 | —- | C] () – C:\WINDOWS\System32\igfxCoIn_v4926.dll
[2009/04/06 11:09:03 | 000,001,793 | —- | C] () – C:\WINDOWS\System32\fxsperf.ini
[2009/04/02 11:54:38 | 000,028,672 | —- | C] () – C:\WINDOWS\System32\TPeculiarity.dll
[2009/04/02 10:35:18 | 000,024,576 | —- | C] () – C:\WINDOWS\System32\EKECioCtl.dll
[2009/03/31 11:13:20 | 000,045,056 | —- | C] () – C:\WINDOWS\System32\HWS_Ctrl.dll
[2009/03/13 15:05:14 | 000,045,056 | —- | C] () – C:\WINDOWS\System32\TDispVol.dll

========== LOP Check ==========

[2009/08/06 20:18:52 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PCSettings
[2009/09/21 20:46:54 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TOSHIBA
[2009/04/06 12:23:36 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Vista32
[2009/04/06 12:23:36 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Vista64
[2009/04/06 12:33:51 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\XP
[2009/08/19 09:48:29 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{7B6BA59A-FB0E-4499-8536-A7420338BF3B}
[2009/04/06 12:27:40 | 000,000,000 | —D | M] – C:\Documents and Settings\Netbook\Application Data\toshiba
[2009/04/06 11:16:29 | 000,000,000 | —D | M] – C:\Documents and Settings\Netbook\Application Data\WinBatch

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >

< MD5 for: AGP440.SYS >
[2008/04/14 05:00:00 | 020,056,462 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2008/04/14 05:00:00 | 020,056,462 | —- | M] () .cab file – C:\WINDOWS\I386\sp3.cab:AGP440.sys

< MD5 for: ATAPI.SYS >
[2008/04/14 05:00:00 | 020,056,462 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2008/04/14 05:00:00 | 020,056,462 | —- | M] () .cab file – C:\WINDOWS\I386\sp3.cab:atapi.sys
[2008/04/14 00:10:32 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\ERDNT\cache\atapi.sys
[2008/04/14 00:10:32 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\system32\dllcache\atapi.sys
[2008/04/14 00:10:32 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\system32\drivers\atapi.sys
[2008/04/14 05:00:00 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\system32\ReinstallBackups\0006\DriverFiles\i386\atapi.sys

< MD5 for: EVENTLOG.DLL >
[2008/04/14 05:00:00 | 000,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\ERDNT\cache\eventlog.dll
[2008/04/14 05:00:00 | 000,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\system32\eventlog.dll

< MD5 for: IASTOR.SYS >
[2009/02/11 17:26:18 | 000,407,576 | —- | M] (Intel Corporation) MD5=1ADAA4F16073FD0C7270F451FD024E97 – C:\Program Files\Intel\Intel Matrix Storage Manager\driver64\IaStor.sys
[2009/02/11 17:11:50 | 000,329,752 | —- | M] (Intel Corporation) MD5=71ECC07BC7C5E24C3DD01D8A29A24054 – C:\Program Files\Intel\Intel Matrix Storage Manager\driver\IaStor.sys
[2009/02/11 18:11:50 | 000,329,752 | —- | M] (Intel Corporation) MD5=71ECC07BC7C5E24C3DD01D8A29A24054 – C:\WINDOWS\OemDir\iaStor.sys
[2009/02/11 17:11:50 | 000,329,752 | —- | M] (Intel Corporation) MD5=71ECC07BC7C5E24C3DD01D8A29A24054 – C:\WINDOWS\system32\drivers\iaStor.sys
[2009/02/11 17:11:50 | 000,329,752 | —- | M] (Intel Corporation) MD5=71ECC07BC7C5E24C3DD01D8A29A24054 – C:\WINDOWS\system32\DRVSTORE\iaAHCI_DAB8BE0C6A617003890F5FDA36EBBE5A46A6D51A\iaStor.sys
[2009/02/11 18:11:50 | 000,329,752 | —- | M] (Intel Corporation) MD5=71ECC07BC7C5E24C3DD01D8A29A24054 – C:\WINDOWS\system32\ReinstallBackups\0012\DriverFiles\iaStor.sys

< MD5 for: NETLOGON.DLL >
[2008/04/14 05:00:00 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\ERDNT\cache\netlogon.dll
[2008/04/14 05:00:00 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\system32\netlogon.dll

< MD5 for: SCECLI.DLL >
[2008/04/14 05:00:00 | 000,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\ERDNT\cache\scecli.dll
[2008/04/14 05:00:00 | 000,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\system32\scecli.dll

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[2008/04/14 05:00:00 | 000,098,304 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\actxprxy.dll
[2008/04/14 05:00:00 | 000,029,184 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\batmeter.dll
[2008/04/14 05:00:00 | 000,063,488 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\browselc.dll
[2008/04/14 05:00:00 | 000,163,840 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\credui.dll
[2008/04/14 05:00:00 | 000,033,280 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\cryptdll.dll
[2008/04/14 05:00:00 | 000,025,088 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\davclnt.dll
[2008/04/14 05:00:00 | 000,847,872 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\dbgeng.dll
[2008/04/14 05:00:00 | 000,640,000 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\dbghelp.dll
[2008/04/14 05:00:00 | 000,026,112 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\dot3api.dll
[2008/04/14 05:00:00 | 000,009,216 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\dot3dlg.dll
[2008/04/14 05:00:00 | 000,014,336 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\drprov.dll
[2008/04/14 05:00:00 | 000,304,128 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\duser.dll
[2008/04/14 05:00:00 | 000,126,976 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\eappcfg.dll
[2008/04/14 05:00:00 | 000,040,960 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\eappprxy.dll
[2008/04/14 05:00:00 | 000,125,952 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\exts.dll
[2008/04/14 05:00:00 | 000,451,584 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\fxsapi.dll
[2008/04/14 05:00:00 | 000,562,176 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\fxsst.dll
[2008/04/14 05:00:00 | 000,344,064 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\hnetcfg.dll
[2008/02/15 12:46:08 | 000,048,128 | —- | M] (Intel Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\igfxsrvc.dll
[2008/04/14 05:00:00 | 000,094,720 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\iphlpapi.dll
[2008/04/14 05:00:00 | 000,586,240 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\mlang.dll
[2008/04/14 05:00:00 | 000,071,680 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\msacm32.dll
[2008/04/14 05:00:00 | 002,843,136 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\msi.dll
[2008/04/14 05:00:00 | 000,195,072 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\msutb.dll
[2008/04/14 05:00:00 | 000,413,696 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\msvcp60.dll
[2008/04/14 05:00:00 | 000,011,776 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\netrap.dll
[2008/04/14 05:00:00 | 000,080,896 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\netui0.dll
[2008/04/14 05:00:00 | 000,245,760 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\netui1.dll
[2008/04/14 05:00:00 | 000,044,032 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\ntlanman.dll
[2008/04/14 05:00:00 | 000,036,864 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\ntsdexts.dll
[2008/04/14 05:00:00 | 000,144,384 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\onex.dll
[2008/04/14 05:00:00 | 000,017,408 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\powrprof.dll
[2008/04/14 05:00:00 | 000,007,680 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\rasadhlp.dll
[2008/04/14 05:00:00 | 000,237,056 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\rasapi32.dll
[2008/04/14 05:00:00 | 000,061,440 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\rasman.dll
[2008/04/14 05:00:00 | 000,208,384 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\rsaenh.dll
[2008/04/14 05:00:00 | 000,044,032 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\rtutils.dll
[2008/04/14 05:00:00 | 000,007,168 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\sensapi.dll
[2008/04/14 05:00:00 | 000,181,760 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\tapi32.dll
[2009/03/13 15:05:14 | 000,045,056 | —- | M] () Unable to obtain MD5 – C:\WINDOWS\system32\TDispVol.dll
[2007/10/08 13:02:46 | 000,040,960 | —- | M] (TOSHIBA Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\TPSTrace.dll
[2007/10/08 13:02:46 | 000,053,248 | —- | M] (TOSHIBA Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\TPwrCfg.dll
[2007/10/08 13:02:46 | 000,069,632 | —- | M] (TOSHIBA Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\TPwrReg.dll
[2008/04/14 05:00:00 | 000,053,760 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\winsta.dll
[2008/04/14 05:00:00 | 000,019,456 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\wshtcpip.dll
[2008/04/14 05:00:00 | 000,018,432 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\wtsapi32.dll
[2008/04/14 05:00:00 | 000,052,736 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\wzcsapi.dll
[2008/04/14 05:00:00 | 002,897,920 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\xpsp2res.dll
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2009/04/06 04:05:33 | 000,094,208 | —- | M] () – C:\WINDOWS\system32\config\default.sav
[2009/04/06 04:05:33 | 001,064,960 | —- | M] () – C:\WINDOWS\system32\config\software.sav
[2009/04/06 04:05:32 | 000,905,216 | —- | M] () – C:\WINDOWS\system32\config\system.sav

< End of report

Gadgetgal

Post #14June 6, 2010, 10:46 PM UTC

And here is the second log Thank you Martix!

extras.txt

OTL Extras logfile created on: 6/6/2010 3:16:45 PM - Run 1
OTL by OldTimer - Version 3.2.5.3 Folder = C:\Documents and Settings\Netbook\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,014.00 Mb Total Physical Memory | 494.00 Mb Available Physical Memory | 49.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 83.00% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 141.55 Gb Total Space | 125.29 Gb Free Space | 88.51% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: TOSHIBA
Current User Name: Netbook
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
htmlfile – "C:\Program Files\Microsoft Office\Office10\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] – "C:\Program Files\Microsoft Office\Office10\msohtmed.exe" /p %1 (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22002
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\TOSHIBA\ivp\NetInt\Netint.exe" = C:\TOSHIBA\ivp\NetInt\Netint.exe:*:Enabled:NIE - Toshiba Software Upgrade Engine – (TOSHIBA Corporation)
"C:\TOSHIBA\Ivp\ISM\pinger.exe" = C:\TOSHIBA\IVP\ISM\pinger.exe:*:Enabled:Toshiba Software Upgrades Pinger – ()

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02EED746-8C5A-43C8-BB3D-D29C8B363A4D}" = TOSHIBA Zooming Utility
"{12688FD7-CB92-4A5B-BEE4-5C8E0574434F}" = Utility Common Driver
"{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}" = Microsoft Works
"{16E8BF9A-B419-4A44-A020-30F8CFB84B9D}" = Atheros Client Utility
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{21526716-DFD8-4B90-86D9-EF9F47057B3E}" = Toshiba Resources Page
"{224821ED-CADA-4A8A-AC8D-3734CC0F0931}" = Amazon Links
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java™ 6 Update 20
"{287ECFA4-719A-2143-A09B-D6A12DE54E40}" = Acrobat.com
"{2C38F661-26B7-445D-B87D-B53FE2D3BD42}" = TOSHIBA PC Diagnostic Tool
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{37C866E4-AA67-4725-9E95-A39968DD7960}" = Camera Assistant Software for Toshiba
"{3A57482F-BEBC-47E4-ADA1-6302403C7E50}" = TOSHIBA Accessibility
"{400830CA-F056-4BBE-80A3-9DF9CA4FB889}" = TOSHIBA Direct Disc Writer
"{425A2BC2-AA64-4107-9C29-484245BBEA05}" = TOSHIBA Software Upgrades
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{5279374D-87FE-4879-9385-F17278EBB9D3}" = TOSHIBA Hardware Setup
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7900D3A6-A9E8-4954-ACCB-AB15867978BF}" = TOSHIBA Hotkey Utility
"{80977342-27E8-4FF7-8B6A-D8D89461DA7F}" = TouchPad On/Off Utility
"{8E9DB7EF-5DD3-499E-BA2A-A1F3153A4DF8}" = Adobe Flash Player 9 ActiveX
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90280409-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional with FrontPage
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager
"{94A90C69-71C1-470A-88F5-AA47ECC96B40}" = TOSHIBA HDD Protection
"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
"{96AE7E41-E34E-47D0-AC07-1091A8127911}" = USB2.0 Card Reader Software
"{970472D0-F5F9-4158-A6E3-1AE49EFEF2D3}" = Toshiba Application and Driver Installer
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = ALPS Touch Pad Driver
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A38D57D1-5F29-4691-B3DD-FE4B3A7B3AFE}" = TOSHIBA Power Saver
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1033-7B44-A91000000001}" = Adobe Reader 9.1
"{B65BBB06-1F8E-48F5-8A54-B024A9E15FDF}" = TOSHIBA Recovery Disc Creator
"{BDD83DC9-BEE9-4654-A5DA-CC46C250088D}" = TOSHIBA ConfigFree
"{BF5A20B4-55F7-49B8-9302-FAC7C459AF3D}" = Skype Launcher
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C3A32068-8AB1-4327-BB16-BED9C6219DC7}" = Atheros Driver Installation Program
"{C53D16CC-E56F-47B8-906E-70AAF8EABB4F}" = Toshiba Registration
"{C78EAC6F-7A73-452E-8134-DBB2165C5A68}" = QuickTime
"{C9BED750-1211-4480-B1A5-718A3BE15525}" = REALTEK GbE & FE Ethernet PCI-E NIC Driver
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CEBB6BFB-D708-4F99-A633-BC2600E01EF6}" = Bluetooth Stack for Windows by Toshiba
"{E487EE7D-EAAA-4E2A-9116-E3B477D8A74F}" = TOSHIBA USB Sleep and Charge Utility
"{E69992ED-A7F6-406C-9280-1C156417BC49}" = Toshiba Quality Application
"{EBFF48F5-3CFA-436F-8FD5-94FB01D3A0A7}" = TOSHIBA SD Memory Utilities
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F7B0939E-58DF-11DF-B3A6-005056806466}" = Google Earth
"0C1E66B43FC1E6F11D2308E9D4B5ECD1E601C2E9" = Windows Driver Package - Chicony (cecnuvc) Image (03/26/2009 6.4.64.0326)
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Fn-esse" = TOSHIBA Fn-esse
"Google Updater" = Google Updater
"HDMI" = Intel® Graphics Media Accelerator Driver
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"InstallShield_{02EED746-8C5A-43C8-BB3D-D29C8B363A4D}" = TOSHIBA Zooming Utility
"InstallShield_{2C38F661-26B7-445D-B87D-B53FE2D3BD42}" = TOSHIBA PC Diagnostic Tool
"InstallShield_{3A57482F-BEBC-47E4-ADA1-6302403C7E50}" = TOSHIBA Accessibility
"InstallShield_{5279374D-87FE-4879-9385-F17278EBB9D3}" = TOSHIBA Hardware Setup
"InstallShield_{7900D3A6-A9E8-4954-ACCB-AB15867978BF}" = TOSHIBA Hotkey Utility
"InstallShield_{80977342-27E8-4FF7-8B6A-D8D89461DA7F}" = TouchPad On/Off Utility
"InstallShield_{A38D57D1-5F29-4691-B3DD-FE4B3A7B3AFE}" = TOSHIBA Power Saver
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"MSNINST" = MSN
"N360" = Norton 360
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
"Windows Media Format Runtime" = Windows Media Format Runtime
"Windows Media Player" = Windows Media Player 10
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 1/10/2010 5:05:52 AM | Computer Name = TOSHIBA | Source = Application Error | ID = 1000
Description = Faulting application ccsvchst.exe, version 108.1.1.10, faulting module
ntdll.dll, version 5.1.2600.5755, fault address 0x00011780.

Error - 1/13/2010 4:02:25 PM | Computer Name = TOSHIBA | Source = Google Update | ID = 20
Description =

Error - 1/21/2010 12:24:15 AM | Computer Name = TOSHIBA | Source = Application Error | ID = 1000
Description = Faulting application ccsvchst.exe, version 108.1.1.10, faulting module
symhtml.dll, version 3.8.0.2, fault address 0x00069d1a.

Error - 1/31/2010 4:21:09 AM | Computer Name = TOSHIBA | Source = Application Error | ID = 1000
Description = Faulting application ccsvchst.exe, version 108.1.1.10, faulting module
symhtml.dll, version 3.8.0.2, fault address 0x0002c32c.

Error - 2/27/2010 4:01:05 AM | Computer Name = TOSHIBA | Source = Google Update | ID = 20
Description =

Error - 5/23/2010 11:52:55 AM | Computer Name = TOSHIBA | Source = Application Error | ID = 1000
Description = Faulting application ccsvchst.exe, version 108.1.1.10, faulting module
symhtml.dll, version 3.8.0.2, fault address 0x0002c32c.

Error - 5/26/2010 10:11:51 PM | Computer Name = TOSHIBA | Source = Google Update | ID = 20
Description =

Error - 5/27/2010 10:46:19 PM | Computer Name = TOSHIBA | Source = Application Error | ID = 1000
Description = Faulting application pev.exe, version 0.0.0.0, faulting module pev.exe,
version 0.0.0.0, fault address 0x0008d560.

Error - 6/6/2010 6:04:52 PM | Computer Name = TOSHIBA | Source = Application Error | ID = 1000
Description = Faulting application explorer.exe, version 6.0.2900.5512, faulting
module shell32.dll, version 6.0.2900.5622, fault address 0x0002b284.

Error - 6/6/2010 6:08:58 PM | Computer Name = TOSHIBA | Source = Application Error | ID = 1000
Description = Faulting application drwtsn32.exe, version 5.1.2600.0, faulting module
dbghelp.dll, version 5.1.2600.5512, fault address 0x0001295d.

[ System Events ]
Error - 6/6/2010 5:58:29 PM | Computer Name = TOSHIBA | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
%%126

Error - 6/6/2010 5:58:29 PM | Computer Name = TOSHIBA | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
%%126

Error - 6/6/2010 5:58:29 PM | Computer Name = TOSHIBA | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
%%126

Error - 6/6/2010 5:58:29 PM | Computer Name = TOSHIBA | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
%%126

Error - 6/6/2010 5:58:29 PM | Computer Name = TOSHIBA | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
%%126

Error - 6/6/2010 5:58:29 PM | Computer Name = TOSHIBA | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
%%126

Error - 6/6/2010 5:58:30 PM | Computer Name = TOSHIBA | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
%%126

Error - 6/6/2010 5:58:30 PM | Computer Name = TOSHIBA | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
%%126

Error - 6/6/2010 5:58:30 PM | Computer Name = TOSHIBA | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
%%126

Error - 6/6/2010 6:10:34 PM | Computer Name = TOSHIBA | Source = MRxSmb | ID = 8003
Description = The master browser has received a server announcement from the computer
DGS3MPD1 that believes that it is the master browser for the domain on transport
NetBT_Tcpip_{030D5B11-B8DE-44FF-. The master browser is stopping or an election
is being forced.

< End of report >

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
htmlfile – "C:\Program Files\Microsoft Office\Office10\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] – "C:\Program Files\Microsoft Office\Office10\msohtmed.exe" /p %1 (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22002
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\TOSHIBA\ivp\NetInt\Netint.exe" = C:\TOSHIBA\ivp\NetInt\Netint.exe:*:Enabled:NIE - Toshiba Software Upgrade Engine – (TOSHIBA Corporation)
"C:\TOSHIBA\Ivp\ISM\pinger.exe" = C:\TOSHIBA\IVP\ISM\pinger.exe:*:Enabled:Toshiba Software Upgrades Pinger – ()

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02EED746-8C5A-43C8-BB3D-D29C8B363A4D}" = TOSHIBA Zooming Utility
"{12688FD7-CB92-4A5B-BEE4-5C8E0574434F}" = Utility Common Driver
"{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}" = Microsoft Works
"{16E8BF9A-B419-4A44-A020-30F8CFB84B9D}" = Atheros Client Utility
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{21526716-DFD8-4B90-86D9-EF9F47057B3E}" = Toshiba Resources Page
"{224821ED-CADA-4A8A-AC8D-3734CC0F0931}" = Amazon Links
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java™ 6 Update 20
"{287ECFA4-719A-2143-A09B-D6A12DE54E40}" = Acrobat.com
"{2C38F661-26B7-445D-B87D-B53FE2D3BD42}" = TOSHIBA PC Diagnostic Tool
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{37C866E4-AA67-4725-9E95-A39968DD7960}" = Camera Assistant Software for Toshiba
"{3A57482F-BEBC-47E4-ADA1-6302403C7E50}" = TOSHIBA Accessibility
"{400830CA-F056-4BBE-80A3-9DF9CA4FB889}" = TOSHIBA Direct Disc Writer
"{425A2BC2-AA64-4107-9C29-484245BBEA05}" = TOSHIBA Software Upgrades
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{5279374D-87FE-4879-9385-F17278EBB9D3}" = TOSHIBA Hardware Setup
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7900D3A6-A9E8-4954-ACCB-AB15867978BF}" = TOSHIBA Hotkey Utility
"{80977342-27E8-4FF7-8B6A-D8D89461DA7F}" = TouchPad On/Off Utility
"{8E9DB7EF-5DD3-499E-BA2A-A1F3153A4DF8}" = Adobe Flash Player 9 ActiveX
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90280409-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional with FrontPage
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager
"{94A90C69-71C1-470A-88F5-AA47ECC96B40}" = TOSHIBA HDD Protection
"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
"{96AE7E41-E34E-47D0-AC07-1091A8127911}" = USB2.0 Card Reader Software
"{970472D0-F5F9-4158-A6E3-1AE49EFEF2D3}" = Toshiba Application and Driver Installer
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = ALPS Touch Pad Driver
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A38D57D1-5F29-4691-B3DD-FE4B3A7B3AFE}" = TOSHIBA Power Saver
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1033-7B44-A91000000001}" = Adobe Reader 9.1
"{B65BBB06-1F8E-48F5-8A54-B024A9E15FDF}" = TOSHIBA Recovery Disc Creator
"{BDD83DC9-BEE9-4654-A5DA-CC46C250088D}" = TOSHIBA ConfigFree
"{BF5A20B4-55F7-49B8-9302-FAC7C459AF3D}" = Skype Launcher
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C3A32068-8AB1-4327-BB16-BED9C6219DC7}" = Atheros Driver Installation Program
"{C53D16CC-E56F-47B8-906E-70AAF8EABB4F}" = Toshiba Registration
"{C78EAC6F-7A73-452E-8134-DBB2165C5A68}" = QuickTime
"{C9BED750-1211-4480-B1A5-718A3BE15525}" = REALTEK GbE & FE Ethernet PCI-E NIC Driver
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CEBB6BFB-D708-4F99-A633-BC2600E01EF6}" = Bluetooth Stack for Windows by Toshiba
"{E487EE7D-EAAA-4E2A-9116-E3B477D8A74F}" = TOSHIBA USB Sleep and Charge Utility
"{E69992ED-A7F6-406C-9280-1C156417BC49}" = Toshiba Quality Application
"{EBFF48F5-3CFA-436F-8FD5-94FB01D3A0A7}" = TOSHIBA SD Memory Utilities
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F7B0939E-58DF-11DF-B3A6-005056806466}" = Google Earth
"0C1E66B43FC1E6F11D2308E9D4B5ECD1E601C2E9" = Windows Driver Package - Chicony (cecnuvc) Image (03/26/2009 6.4.64.0326)
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Fn-esse" = TOSHIBA Fn-esse
"Google Updater" = Google Updater
"HDMI" = Intel® Graphics Media Accelerator Driver
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"InstallShield_{02EED746-8C5A-43C8-BB3D-D29C8B363A4D}" = TOSHIBA Zooming Utility
"InstallShield_{2C38F661-26B7-445D-B87D-B53FE2D3BD42}" = TOSHIBA PC Diagnostic Tool
"InstallShield_{3A57482F-BEBC-47E4-ADA1-6302403C7E50}" = TOSHIBA Accessibility
"InstallShield_{5279374D-87FE-4879-9385-F17278EBB9D3}" = TOSHIBA Hardware Setup
"InstallShield_{7900D3A6-A9E8-4954-ACCB-AB15867978BF}" = TOSHIBA Hotkey Utility
"InstallShield_{80977342-27E8-4FF7-8B6A-D8D89461DA7F}" = TouchPad On/Off Utility
"InstallShield_{A38D57D1-5F29-4691-B3DD-FE4B3A7B3AFE}" = TOSHIBA Power Saver
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"MSNINST" = MSN
"N360" = Norton 360
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
"Windows Media Format Runtime" = Windows Media Format Runtime
"Windows Media Player" = Windows Media Player 10
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 1/10/2010 5:05:52 AM | Computer Name = TOSHIBA | Source = Application Error | ID = 1000
Description = Faulting application ccsvchst.exe, version 108.1.1.10, faulting module
ntdll.dll, version 5.1.2600.5755, fault address 0x00011780.

Error - 1/13/2010 4:02:25 PM | Computer Name = TOSHIBA | Source = Google Update | ID = 20
Description =

Error - 1/21/2010 12:24:15 AM | Computer Name = TOSHIBA | Source = Application Error | ID = 1000
Description = Faulting application ccsvchst.exe, version 108.1.1.10, faulting module
symhtml.dll, version 3.8.0.2, fault address 0x00069d1a.

Error - 1/31/2010 4:21:09 AM | Computer Name = TOSHIBA | Source = Application Error | ID = 1000
Description = Faulting application ccsvchst.exe, version 108.1.1.10, faulting module
symhtml.dll, version 3.8.0.2, fault address 0x0002c32c.

Error - 2/27/2010 4:01:05 AM | Computer Name = TOSHIBA | Source = Google Update | ID = 20
Description =

Error - 5/23/2010 11:52:55 AM | Computer Name = TOSHIBA | Source = Application Error | ID = 1000
Description = Faulting application ccsvchst.exe, version 108.1.1.10, faulting module
symhtml.dll, version 3.8.0.2, fault address 0x0002c32c.

Error - 5/26/2010 10:11:51 PM | Computer Name = TOSHIBA | Source = Google Update | ID = 20
Description =

Error - 5/27/2010 10:46:19 PM | Computer Name = TOSHIBA | Source = Application Error | ID = 1000
Description = Faulting application pev.exe, version 0.0.0.0, faulting module pev.exe,
version 0.0.0.0, fault address 0x0008d560.

Error - 6/6/2010 6:04:52 PM | Computer Name = TOSHIBA | Source = Application Error | ID = 1000
Description = Faulting application explorer.exe, version 6.0.2900.5512, faulting
module shell32.dll, version 6.0.2900.5622, fault address 0x0002b284.

Error - 6/6/2010 6:08:58 PM | Computer Name = TOSHIBA | Source = Application Error | ID = 1000
Description = Faulting application drwtsn32.exe, version 5.1.2600.0, faulting module
dbghelp.dll, version 5.1.2600.5512, fault address 0x0001295d.

[ System Events ]
Error - 6/6/2010 5:58:29 PM | Computer Name = TOSHIBA | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
%%126

Error - 6/6/2010 5:58:29 PM | Computer Name = TOSHIBA | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
%%126

Error - 6/6/2010 5:58:29 PM | Computer Name = TOSHIBA | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
%%126

Error - 6/6/2010 5:58:29 PM | Computer Name = TOSHIBA | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
%%126

Error - 6/6/2010 5:58:29 PM | Computer Name = TOSHIBA | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
%%126

Error - 6/6/2010 5:58:29 PM | Computer Name = TOSHIBA | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
%%126

Error - 6/6/2010 5:58:30 PM | Computer Name = TOSHIBA | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
%%126

Error - 6/6/2010 5:58:30 PM | Computer Name = TOSHIBA | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
%%126

Error - 6/6/2010 5:58:30 PM | Computer Name = TOSHIBA | Source = Service Control Manager | ID = 7023
Description = The Application Management service terminated with the following error:
%%126

Error - 6/6/2010 6:10:34 PM | Computer Name = TOSHIBA | Source = MRxSmb | ID = 8003
Description = The master browser has received a server announcement from the computer
DGS3MPD1 that believes that it is the master browser for the domain on transport
NetBT_Tcpip_{030D5B11-B8DE-44FF-. The master browser is stopping or an election
is being forced.

< End of report >

CatByte

Post #15June 9, 2010, 3:41 AM UTC

Hi,

martix is unavailable at the moment, so i will finish up for him.

Your logs are clean, just some housekeeping to do now:

Please do the following:

Visit ADOBEand download the latest version of Acrobat Reader (version 9.3)
Having the latest updates ensures there are no security vulnerabilities in your system.

NEXT

Follow these steps to uninstall Combofix

Click START then RUN
Now copy/paste Combofix /uninstall into the runbox and click OK. Note the space between the ..X and the /U, it needs to be there.

[external image: Posted Image]

NEXT

Clean up with OTL:

Double-click OTL.exe to start the program.
Close all other programs apart from OTL as this step will require a reboot
On the OTL main screen, press the CLEANUP button
Say Yes to the prompt and then allow the program to reboot your computer.

If any logs/tools remain on your desktop > right click and delete them.

NEXT

Below I have included a number of recommendations for how to protect your computer against malware infections.

It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
Strong passwords: How to create and use them
Then consider a password keeper, to keep all your passwords safe.
Keep Windows updated by regularly checking their website at :
http://windowsupdate.microsoft.com/
This will ensure your computer has always the latest security updates available installed on your computer.
Make Internet Explorer more secure
- Click Start > Run
- Type Inetcpl.cpl & click OK
- Click on the Security tab
- Click Reset all zones to default level
- Make sure the Internet Zone is selected & Click Custom level
- In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
- Next Click OK, then Apply button and then OK to exit the Internet Properties page.
Download TFC to your desktop
- Close any open windows.
- Double click the TFC icon to run the program
- TFC will close all open programs itself in order to run,
- Click the Start button to begin the process.
- Allow TFC to run uninterrupted.
- The program should not take long to finish it's job
- Once its finished it should automatically reboot your machine,
- if it doesn't, manually reboot to ensure a complete clean
It's normal after running TFC cleaner that the PC will be slower to boot the first time.

WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
- Green to go
- Yellow for caution
- Red to stop
WOT has an addon available for both Firefox, IE and chrome.
Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.
ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.
In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at these well written articles:
Think Prevention.
PC Safety and Security–What Do I Need?.

**Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them.

Thank you for your patience, and performing all of the procedures requested.

Please respond one last time so we can consider the thread resolved and close it, thank-you.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Solved] Help remove Tidserv Request

✨ Ask AI

Ask AI