Spyware / Malware / Virus Removal

SLLLLOOOOWWWW....

24 min read

Looking for the outcome? Ask AI

Jeff S Topic Starter

Post #1September 16, 2010, 12:39 AM UTC

Internet related apps excessively slow, particularly IE (there are even delays between my keystrokes and the appearance of charaters as I type this post). Icon in system tray & Task Manager indicate CPU is being maxed out 100% when onlihe using IE. Plz assist. HJT log follows:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 5:35:15 PM, on 9/15/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Norton AntiVirus\Engine\17.7.0.12\ccSvcHst.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Common Files\Seagate\Schedule2\schedhlp.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe
C:\Program Files\Common Files\Seagate\Schedule2\schedul2.exe
C:\WINDOWS\system32\svchost.exe
c:\WINDOWS\system32\ZuneBusEnum.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Norton AntiVirus\Engine\17.7.0.12\ccSvcHst.exe
C:\Program Files\MSI\PC Alert 4\PCAlert4.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;*.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {671EB3E7-0955-03FE-2BB4-0495CBA2819E} - (no file)
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton AntiVirus\Engine\17.7.0.12\IPSBHO.DLL
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [itype] "C:\Program Files\Microsoft IntelliType Pro\itype.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [Seagate Scheduler2 Service] "C:\Program Files\Common Files\Seagate\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: PC Alert 4.lnk = C:\Program Files\MSI\PC Alert 4\StartPCAlert4.exe
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: officejet 6100.lnk = ?
O8 - Extra context menu item: &AIM Search - res://C:\PROGRA~1\AIMTOO~1\AIMBAR.DLL/aimsearch.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1…toUploader5.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://pcpitstop.com/betapit/PCPitStop.CAB
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} -
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2EDF75C0-5ABD-49f9-BAB6-220476A32034} (System Requirements Lab) - http://intel-drv-cdn.systemrequirementslab…reqlab_srlx.cab
O16 - DPF: {4E330863-6A11-11D0-BFD8-006097237877} (InstallFromTheWeb ActiveX Control) - http://tw.msi.com.tw/autobios/client/iftwclix.cab
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} (GMNRev Class) - http://h20270.www2.hp.com/ediags/gmn2/inst…tDetection2.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} -
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} -
O16 - DPF: {A82C3A33-5C0E-466C-B020-71585433A7E4} (PhxStudent.OeSetup15) - https://mycampus.phoenix.edu/secure/PhxStudent15.CAB
O16 - DPF: {A8683C98-5341-421B-B23C-8514C05354F1} (FujifilmUploader Class) - http://photo.walmart.com/photo/uploads/Fuj…ploadClient.cab
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O16 - DPF: {A9F8D9EC-3D0A-4A60-BD82-FBD64BAD370D} (DDRevision Class) - http://h20264.www2.hp.com/ediags/dd/instal…nosticsxp2k.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} -
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (ASquaredScanForm Element) - http://www.windowsecurity.com/trojanscan/axscan.cab
O16 - DPF: {BEA7310D-06C4-4339-A784-DC3804819809} (Photo Upload Plugin Class) - http://www.cvsphoto.com/upload/activex/v3_…veX_Control.cab
O16 - DPF: {CAFEEFAC-0014-0002-0005-ABCDEFFEDCBA} (Java Plug-in 1.4.2_05) -
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/hpdj/en/check/qdiagh.cab?326
O16 - DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} (PCPitstop Exam) - http://utilities.pcpitstop.com/da2/PCPitStop2.cab
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: IE Component Categories cache daemon - {553858A7-4922-4e7e-B1C1-97140C1C16EF} - C:\WINDOWS\system32\ieframe.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Unknown owner - C:\WINDOWS\system32\drivers\KodakCCS.exe (file missing)
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: Norton AntiVirus (NAV) - Symantec Corporation - C:\Program Files\Norton AntiVirus\Engine\17.7.0.12\ccSvcHst.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe
O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: Seagate Scheduler2 Service (SgtSch2Svc) - Seagate - C:\Program Files\Common Files\Seagate\Schedule2\schedul2.exe

–
End of file - 10801 bytes

Satchfan

Post #2September 16, 2010, 11:17 AM UTC

Hello Jeffs and welcome to the WTT forum.

My name is Satchfan and I would be glad to help you with your computer problem. Please read the following guidelines which will help to make cleaning your machine easier:
• Please do not install/uninstall any programs unless asked to.
• Please do not run any scans other than those requested
• Please follow all instructions in the order posted
• Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
• If you don't understand something, please don't hesitate to ask for clarification before proceeding
• The fixes are specific to your problem and should only be used for this issue on this machine.
• Please reply within 3 days. If you do not reply within this period I will post a reminder but topics with no reply in 4 days will be closed!
Please note that I am still in training and my replies need to be checked by an expert in order for you to receive the best possible advice. This may result in a small delay between my posts but I shall try to keep this to a minimum.

I am looking through your log now and will reply as soon as possible.

Satchfan

Satchfan

Post #3September 16, 2010, 9:08 PM UTC

Hello again Jeffs

OTL Custom Scan

Download OTL to your Desktop

Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
Click on Minimal Output at the top
Download the following file scan.txt to your Desktop. Click here to download it. You may need to right click on it and select "Save"
Double click inside the Custom Scan box at the bottom
A window will appear saying "Click Ok to load a custom scan from a file or Cancel to cancel"
Click the Ok button and navigate to the file scan.txt which we just saved to your desktop
Select scan.txt and click Open. Writing will now appear under the Custom Scan box
Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time and post them in your topic

Download the GMER Rootkit Scanner

[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.

Extract the contents of the zipped file to desktop.
Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

[external image: Posted Image]
Click the image to enlarge it
In the right panel, you will see several boxes that have been checked. Uncheck the following …
- IAT/EAT
- All drives/partitions except C:\)
- Show All (don't miss this one)
Then click the Scan button & wait for it to finish.
Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
Save it where you can easily find it, such as your desktop, and attach it in your reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

Please download MBRCheck.exe to your desktop.

Be sure to disable your security programs
Double click on the file to run it (Vista and Windows 7 users will have to confirm the UAC prompt)
A window will open on your desktop
if an unknown bootcode is found you will have further options available to you, at this time press N then press Enter twice.
If nothing unusual is found just press Enter
A .txt file named MBRCheck_mm.dd.yy_hh.mm.ss should appear on your desktop.
Please post the contents of that file.

Logs to include with next post:

OTL.txt
Extras.txt
Gmer.txt
MBRCheck log

Thanks

Satchfan

Jeff S

Post #4September 19, 2010, 1:58 AM UTC

Thanks for your direction; sorry for my delayed response. The scan results you requested follow:

OTL.txt

OTL logfile created on: 9/18/2010 6:19:02 PM - Run 1
OTL by OldTimer - Version 3.2.12.1 Folder = C:\Documents and Settings\jschmitz\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: enu | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 74.00% Memory free
5.00 Gb Paging File | 5.00 Gb Available in Paging File | 92.00% Paging File free
Paging file location(s): C:\pagefile.sys 2560 2560 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 465.65 Gb Total Space | 430.60 Gb Free Space | 92.47% Space Free | Partition Type: FAT32
D: Drive not present or media not loaded
E: Drive not present or media not loaded
Drive F: | 28.61 Gb Total Space | 0.89 Gb Free Space | 3.11% Space Free | Partition Type: FAT32
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: JSCHMITZ
Current User Name: jschmitz
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Minimal
Quick Scan

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\jschmitz\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe (Lavasoft )
PRC - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft )
PRC - C:\Program Files\Norton AntiVirus\Engine\17.7.0.12\ccsvchst.exe (Symantec Corporation)
PRC - C:\Program Files\MSI\PC Alert 4\PCAlert4.exe (MICRO-STAR INT'L CO., LTD.)
PRC - C:\WINDOWS\SYSTEM32\ZuneBusEnum.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\Seagate\Schedule2\schedhlp.exe (Seagate)
PRC - C:\Program Files\Common Files\Seagate\Schedule2\schedul2.exe (Seagate)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Microsoft IntelliType Pro\itype.exe (Microsoft Corporation)
PRC - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposts08.exe (Hewlett-Packard Co.)
PRC - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe (Hewlett-Packard Co.)
PRC - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe (Hewlett-Packard Co.)
PRC - C:\WINDOWS\SYSTEM32\HPZipm12.exe (HP)
PRC - C:\WINDOWS\SYSTEM32\spool\drivers\w32x86\3\hpztsb07.exe (HP)
PRC - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe (Hewlett-Packard)
PRC - C:\Program Files\Microsoft Office\Office\OUTLOOK.EXE (Microsoft Corporation)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\jschmitz\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\SYSTEM32\msscript.ocx (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (KodakCCS) – C:\WINDOWS\System32\drivers\KodakCCS.exe File not found
SRV - (AppMgmt) – C:\WINDOWS\System32\appmgmts.dll File not found
SRV - (Lavasoft Ad-Aware Service) – C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft )
SRV - (NAV) – C:\Program Files\Norton AntiVirus\Engine\17.7.0.12\ccSvcHst.exe (Symantec Corporation)
SRV - (PCPitstop Scheduling) – C:\Program Files\PCPitstop\PCPitstopScheduleService.exe (PC Pitstop LLC)
SRV - (ZuneNetworkSvc) – c:\Program Files\Zune\ZuneNss.exe (Microsoft Corporation)
SRV - (ZuneWlanCfgSvc) – C:\WINDOWS\SYSTEM32\ZuneWlanCfgSvc.exe (Microsoft Corporation)
SRV - (ZuneBusEnum) – C:\WINDOWS\SYSTEM32\ZuneBusEnum.exe (Microsoft Corporation)
SRV - (SgtSch2Svc) – C:\Program Files\Common Files\Seagate\Schedule2\schedul2.exe (Seagate)
SRV - (Pml Driver HPZ12) – C:\WINDOWS\SYSTEM32\HPZipm12.exe (HP)

========== Driver Services (SafeList) ==========

DRV - (EraserUtilRebootDrv) – C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation)
DRV - (BHDrvx86) – C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_17.0.0.136\Definitions\BASHDefs\20100901.003\BHDrvx86.sys (Symantec Corporation)
DRV - (NAVEX15) – C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_17.0.0.136\Definitions\VirusDefs\20100918.003\NAVEX15.SYS (Symantec Corporation)
DRV - (NAVENG) – C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_17.0.0.136\Definitions\VirusDefs\20100918.003\NAVENG.SYS (Symantec Corporation)
DRV - (IDSxpx86) – C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_17.0.0.136\Definitions\IPSDefs\20100917.001\IDSXpx86.sys (Symantec Corporation)
DRV - (eeCtrl) – C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys (Symantec Corporation)
DRV - (SYMTDI) – C:\WINDOWS\System32\Drivers\NAV\1107000.00C\SYMTDI.SYS (Symantec Corporation)
DRV - (SymIRON) – C:\WINDOWS\system32\drivers\NAV\1107000.00C\Ironx86.SYS (Symantec Corporation)
DRV - (SymEFA) – C:\WINDOWS\system32\drivers\NAV\1107000.00C\SYMEFA.SYS (Symantec Corporation)
DRV - (SRTSP) – C:\WINDOWS\System32\Drivers\NAV\1107000.00C\SRTSP.SYS (Symantec Corporation)
DRV - (SRTSPX) Symantec Real Time Storage Protection (PEL) – C:\WINDOWS\system32\drivers\NAV\1107000.00C\SRTSPX.SYS (Symantec Corporation)
DRV - (ccHP) – C:\WINDOWS\system32\drivers\NAV\1107000.00C\ccHPx86.sys (Symantec Corporation)
DRV - (SymDS) – C:\WINDOWS\system32\drivers\NAV\1107000.00C\SYMDS.SYS (Symantec Corporation)
DRV - (SymEvent) – C:\WINDOWS\SYSTEM32\DRIVERS\SYMEVENT.SYS (Symantec Corporation)
DRV - (timounter) – C:\WINDOWS\system32\DRIVERS\timntr.sys (Acronis)
DRV - (tifsfilter) – C:\WINDOWS\SYSTEM32\DRIVERS\tifsfilt.sys (Acronis)
DRV - (snapman) – C:\WINDOWS\system32\DRIVERS\snapman.sys (Acronis)
DRV - (tdrpman) – C:\WINDOWS\system32\DRIVERS\tdrpman.sys (Acronis)
DRV - (Lbd) – C:\WINDOWS\system32\DRIVERS\Lbd.sys (Lavasoft AB)
DRV - (zumbus) – C:\WINDOWS\SYSTEM32\DRIVERS\zumbus.sys (Microsoft Corporation)
DRV - (PCAlertDriver) – C:\Program Files\MSI\PC Alert 4\NTGLM7X.sys (MICRO-STAR INT'L CO., LTD.)
DRV - (tffsport) – C:\WINDOWS\system32\DRIVERS\tffsport.sys (M-Systems)
DRV - (FLASHSYS) – C:\Program Files\MSI\Live Update 4\LU4\FlashSys.sys ()
DRV - (WinUSB) – C:\WINDOWS\SYSTEM32\DRIVERS\winusb.sys (Microsoft Corporation)
DRV - (ndiscm) – C:\WINDOWS\SYSTEM32\DRIVERS\NetMotCM.sys (Motorola Inc.)
DRV - (CA561) ICatch (VI) – C:\WINDOWS\SYSTEM32\DRIVERS\spca561.sys (SP)
DRV - (USB20L) – C:\WINDOWS\SYSTEM32\DRIVERS\USB200M.sys (Linksys)
DRV - (Edspport) – C:\WINDOWS\SYSTEM32\DRIVERS\es56tpi.sys (ESS Technology, Inc.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Yahoo!
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://search.yahoo.com/search/msie?p={sea…s}&ei;=UTF-8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Data = C3 17 11 E0 B2 A4 AC 29 3E F1 D7 B3 41 49 19 66 EF FE DE 71 3C 18 BA 0A F9 AA 17 17 FE 78 [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = 127.0.0.1;*.local

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.google.com/"
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {BBDA0591-3099-440a-AA10-41764D9DB4DB}:2.0

FF - HKLM\software\mozilla\Firefox\extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_17.0.0.136\IPSFFPlgn\ [2010/06/04 22:14:16 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.15\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009/11/05 23:15:00 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.15\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2009/11/05 23:15:00 | 000,000,000 | —D | M]

[2010/09/15 17:54:52 | 000,000,000 | —D | M] – C:\Documents and Settings\jschmitz\Application Data\Mozilla\Extensions
[2009/11/05 23:15:24 | 000,000,000 | —D | M] – C:\Documents and Settings\jschmitz\Application Data\Mozilla\Firefox\Profiles\ef8skqvf.default\extensions
[2009/11/06 12:31:12 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\jschmitz\Application Data\Mozilla\Firefox\Profiles\ef8skqvf.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2009/11/05 23:15:00 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions

O1 HOSTS File: ([2010/09/14 22:38:54 | 000,420,063 | R— | M]) - C:\WINDOWS\SYSTEM32\DRIVERS\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.123topsearch.com
O1 - Hosts: 127.0.0.1 123topsearch.com
O1 - Hosts: 127.0.0.1 www.132.com
O1 - Hosts: 127.0.0.1 132.com
O1 - Hosts: 127.0.0.1 www.136136.net
O1 - Hosts: 127.0.0.1 136136.net
O1 - Hosts: 127.0.0.1 www.163ns.com
O1 - Hosts: 127.0.0.1 163ns.com
O1 - Hosts: 14499 more lines…
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (no name) - {671EB3E7-0955-03FE-2BB4-0495CBA2819E} - No CLSID value found.
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton AntiVirus\Engine\17.7.0.12\ipsbho.dll (Symantec Corporation)
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {C4069E3A-68F1-403E-B40E-20066696354B} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found.
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [gcasServ] C:\Program Files\Microsoft AntiSpyware\gcasServ.exe File not found
O4 - HKLM..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\SYSTEM32\spool\drivers\w32x86\3\hpztsb07.exe (HP)
O4 - HKLM..\Run: [itype] C:\Program Files\Microsoft IntelliType Pro\itype.exe (Microsoft Corporation)
O4 - HKLM..\Run: [Seagate Scheduler2 Service] C:\Program Files\Common Files\Seagate\Schedule2\schedhlp.exe (Seagate)
O4 - HKLM..\Run: [SystemTray] C:\WINDOWS\System32\systray.exe (Microsoft Corporation)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\PC Alert 4.lnk = C:\Program Files\MSI\PC Alert 4\StartPCAlert4.exe ()
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hpoddt01.exe.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe (Hewlett-Packard)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\officejet 6100.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe (Hewlett-Packard Co.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: CDRAutoRun = [binary data]
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: = [binary data]
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoNetHood = [binary data]
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKCU\..Trusted Domains: k12.ca.us ([owa.vusd] https in Trusted sites)
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} http://office.microsoft.com/templates/ieawsdc.cab (Microsoft Office Template and Media Control)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} http://www.apple.com/qtactivex/qtplugin.cab (QuickTime Object)
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} http://upload.facebook.com/controls/2008.1…toUploader5.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} http://pcpitstop.com/betapit/PCPitStop.CAB (PCPitstop Utility)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} Reg Error: Value error. (Reg Error: Key error.)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool)
O16 - DPF: {2EDF75C0-5ABD-49f9-BAB6-220476A32034} http://intel-drv-cdn.systemrequirementslab…reqlab_srlx.cab (System Requirements Lab Class)
O16 - DPF: {4B48D5DF-9021-45F7-A240-60304302A215} http://download.microsoft.com/download/b/d…/WebCleaner.cab (Malicious Software Removal Tool)
O16 - DPF: {4E330863-6A11-11D0-BFD8-006097237877} http://tw.msi.com.tw/autobios/client/iftwclix.cab (InstallFromTheWeb ActiveX Control)
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} https://webdl.symantec.com/activex/symdlmgr.cab (Symantec Download Manager)
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} http://h20270.www2.hp.com/ediags/gmn2/inst…tDetection2.cab (GMNRev Class)
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} Reg Error: Value error. (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} Reg Error: Value error. (Reg Error: Key error.)
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} http://v4.windowsupdate.microsoft.com/CAB/…8146.8594328704 (Reg Error: Key error.)
O16 - DPF: {A82C3A33-5C0E-466C-B020-71585433A7E4} https://mycampus.phoenix.edu/secure/PhxStudent15.CAB (PhxStudent.OeSetup15)
O16 - DPF: {A8683C98-5341-421B-B23C-8514C05354F1} http://photo.walmart.com/photo/uploads/Fuj…ploadClient.cab (FujifilmUploader Class)
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} http://www.crucial.com/controls/cpcScanner.cab (Crucial cpcScan)
O16 - DPF: {A9F8D9EC-3D0A-4A60-BD82-FBD64BAD370D} http://h20264.www2.hp.com/ediags/dd/instal…nosticsxp2k.cab (DDRevision Class)
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} Reg Error: Value error. (Reg Error: Key error.)
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} http://www.windowsecurity.com/trojanscan/axscan.cab (ASquaredScanForm Element)
O16 - DPF: {BEA7310D-06C4-4339-A784-DC3804819809} http://www.cvsphoto.com/upload/activex/v3_…veX_Control.cab (Photo Upload Plugin Class)
O16 - DPF: {CAFEEFAC-0014-0002-0005-ABCDEFFEDCBA} Reg Error: Value error. (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/get/flash…ent/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} http://h30043.www3.hp.com/hpdj/en/check/qdiagh.cab?326 (QDiagHUpdateObj Class)
O16 - DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} http://utilities.pcpitstop.com/da2/PCPitStop2.cab (PCPitstop Exam)
O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\SYSTEM\dajava.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso4.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.10.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\jschmitz\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\jschmitz\Application Data\Microsoft\Wallpaper1.bmp
O30 - LSA: Authentication Packages - (relog_ap) - C:\WINDOWS\System32\relog_ap.dll (Acronis)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005/02/22 12:26:50 | 000,000,194 | -H– | M] () - C:\AUTOEXEC.BAT – [ FAT32 ]
O32 - AutoRun File - [2005/02/22 12:26:50 | 000,000,194 | -H– | M] () - F:\AUTOEXEC.BAT – [ FAT32 ]
O33 - MountPoints2\{4089a165-22ce-11de-a28f-000f9f4a4ab1}\Shell\AutoRun\command - "" = G:\setupSNK.exe – File not found
O33 - MountPoints2\{4e171672-6c49-11dd-a26f-000f9f4a4ab1}\Shell - "" = AutoRun
O33 - MountPoints2\{4e171672-6c49-11dd-a26f-000f9f4a4ab1}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{4e171672-6c49-11dd-a26f-000f9f4a4ab1}\Shell\AutoRun\command - "" = H:\LaunchU3.exe – File not found
O33 - MountPoints2\{5e0ede48-4ac6-11dc-a1fa-000f9f4a4ab1}\Shell - "" = AutoRun
O33 - MountPoints2\{5e0ede48-4ac6-11dc-a1fa-000f9f4a4ab1}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{5e0ede48-4ac6-11dc-a1fa-000f9f4a4ab1}\Shell\AutoRun\command - "" = F:\LaunchU3.exe – File not found
O33 - MountPoints2\{a07bde95-9df2-11de-a2a4-000f9f4a4ab1}\Shell\AutoRun\command - "" = WD_Windows_Tools\Setup.exe
O33 - MountPoints2\{a07bde96-9df2-11de-a2a4-000f9f4a4ab1}\Shell - "" = AutoRun
O33 - MountPoints2\{a07bde96-9df2-11de-a2a4-000f9f4a4ab1}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{a07bde96-9df2-11de-a2a4-000f9f4a4ab1}\Shell\AutoRun\command - "" = H:\LaunchU3.exe – File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (lsdelete) - C:\WINDOWS\System32\lsdelete.exe ()
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - C:\WINDOWS\System32\appmgmts.dll File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: Wmi - C:\WINDOWS\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.iac2 - C:\WINDOWS\SYSTEM32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\SYSTEM32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.lhacm - C:\WINDOWS\System32\LHACM.ACM (Microsoft Corporation)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\IR41_32.DLL (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: VIDC.VDOM - vdowave.drv File not found

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (16902109354000384)

========== Files/Folders - Created Within 90 Days ==========

[2010/09/18 18:08:07 | 000,575,488 | —- | C] (OldTimer Tools) – C:\Documents and Settings\jschmitz\Desktop\OTL.exe
[2010/09/14 23:18:39 | 000,000,000 | RH-D | C] – C:\Documents and Settings\jschmitz\Recent
[2010/08/11 20:57:39 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Hewlett-Packard
[7 C:\WINDOWS\Fonts\*.tmp files -> C:\WINDOWS\Fonts\*.tmp -> ]
[20 C:\WINDOWS\System\*.tmp files -> C:\WINDOWS\System\*.tmp -> ]
[148 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1371 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 90 Days ==========

[2010/09/18 18:08:08 | 000,575,488 | —- | M] (OldTimer Tools) – C:\Documents and Settings\jschmitz\Desktop\OTL.exe
[2010/09/18 18:06:04 | 000,000,472 | —- | M] () – C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2010/09/18 18:06:04 | 000,000,472 | —- | M] () – C:\WINDOWS\tasks\Ad-Aware Update (Daily 4).job
[2010/09/18 18:06:04 | 000,000,472 | —- | M] () – C:\WINDOWS\tasks\Ad-Aware Update (Daily 3).job
[2010/09/18 18:06:04 | 000,000,472 | —- | M] () – C:\WINDOWS\tasks\Ad-Aware Update (Daily 2).job
[2010/09/18 18:06:02 | 000,000,472 | —- | M] () – C:\WINDOWS\tasks\Ad-Aware Update (Daily 1).job
[2010/09/18 18:03:00 | 000,013,646 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/09/18 18:01:58 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/09/18 18:01:46 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/09/17 19:52:22 | 011,796,480 | —- | M] () – C:\Documents and Settings\jschmitz\ntuser.dat
[2010/09/16 08:50:16 | 000,000,408 | —- | M] () – C:\WINDOWS\tasks\FRU Task #Hewlett-Packard#hp officejet 6100 series#1281585584.job
[2010/09/15 17:34:30 | 000,002,453 | —- | M] () – C:\Documents and Settings\jschmitz\Desktop\HiJackThis.lnk
[2010/09/15 17:11:28 | 000,010,864 | —- | M] () – C:\Documents and Settings\jschmitz\Desktop\hijackthis 9-15-10
[2010/09/15 07:40:50 | 000,001,633 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk
[2010/09/14 23:18:56 | 000,000,248 | -HS- | M] () – C:\Documents and Settings\jschmitz\ntuser.ini
[2010/09/14 23:12:42 | 000,000,837 | —- | M] () – C:\Documents and Settings\jschmitz\Desktop\Spybot - Search & Destroy.lnk
[2010/09/14 23:05:44 | 000,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2010/09/14 22:55:26 | 000,000,217 | -HS- | M] () – C:\boot.ini
[2010/09/14 22:55:24 | 000,002,662 | —- | M] () – C:\WINDOWS\win.ini
[2010/09/14 22:55:24 | 000,000,773 | —- | M] () – C:\WINDOWS\system.ini
[2010/09/06 14:39:18 | 000,000,494 | —- | M] () – C:\hpfr5550.xml
[2010/08/30 13:15:22 | 000,002,137 | —- | M] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2010/08/11 21:00:10 | 000,000,779 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\officejet 6100.lnk
[2010/08/11 20:59:42 | 000,019,558 | —- | M] () – C:\WINDOWS\hpoins01.dat
[2010/08/11 20:56:40 | 000,000,779 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hpoddt01.exe.lnk
[2010/08/11 20:56:40 | 000,000,755 | —- | M] () – C:\Documents and Settings\All Users\Desktop\HP Photo & Imaging.lnk
[2010/08/11 20:05:12 | 000,000,214 | —- | M] () – C:\WINDOWS\HP_48BitScanUpdatePatch.ini
[2010/08/11 05:54:54 | 000,200,936 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2010/08/11 03:26:00 | 006,416,248 | -H– | M] () – C:\Documents and Settings\jschmitz\Application Data\IconCache.db
[2010/08/11 03:09:04 | 000,479,392 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2010/08/11 03:09:04 | 000,426,070 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/08/11 03:09:04 | 000,065,080 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[20 C:\WINDOWS\System\*.tmp files -> C:\WINDOWS\System\*.tmp -> ]
[148 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1371 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/09/15 17:31:34 | 000,002,453 | —- | C] () – C:\Documents and Settings\jschmitz\Desktop\HiJackThis.lnk
[2010/09/15 17:11:26 | 000,010,864 | —- | C] () – C:\Documents and Settings\jschmitz\Desktop\hijackthis 9-15-10
[2010/09/14 23:12:40 | 000,000,837 | —- | C] () – C:\Documents and Settings\jschmitz\Desktop\Spybot - Search & Destroy.lnk
[2010/09/14 19:27:37 | 000,000,472 | —- | C] () – C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2010/09/14 19:27:36 | 000,000,472 | —- | C] () – C:\WINDOWS\tasks\Ad-Aware Update (Daily 4).job
[2010/09/14 19:27:36 | 000,000,472 | —- | C] () – C:\WINDOWS\tasks\Ad-Aware Update (Daily 3).job
[2010/08/16 08:50:55 | 000,000,408 | —- | C] () – C:\WINDOWS\tasks\FRU Task #Hewlett-Packard#hp officejet 6100 series#1281585584.job
[2010/08/11 21:00:09 | 000,000,779 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\officejet 6100.lnk
[2010/08/11 20:56:38 | 000,000,779 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hpoddt01.exe.lnk
[2010/08/11 20:56:38 | 000,000,755 | —- | C] () – C:\Documents and Settings\All Users\Desktop\HP Photo & Imaging.lnk
[2010/08/11 20:54:23 | 000,019,558 | —- | C] () – C:\WINDOWS\hpoins01.dat
[2010/08/11 20:54:23 | 000,016,606 | —- | C] () – C:\WINDOWS\hpomdl01.dat
[2010/08/11 20:54:23 | 000,000,228 | —- | C] () – C:\Documents and Settings\All Users\Application Data\hpzinstall.log
[2010/08/11 20:05:10 | 000,002,936 | —- | C] () – C:\Documents and Settings\jschmitz\Application Data\HPCOM_48BitScanUpdate.log
[2010/08/11 20:05:10 | 000,000,214 | —- | C] () – C:\WINDOWS\HP_48BitScanUpdatePatch.ini
[2009/03/08 23:35:16 | 000,561,152 | R— | C] () – C:\WINDOWS\System32\hpotscl.dll
[2008/01/14 03:02:55 | 000,000,249 | —- | C] () – C:\WINDOWS\System32\MRT.INI
[2006/03/05 11:58:02 | 000,000,032 | —- | C] () – C:\WINDOWS\thxcfg.ini
[2006/02/18 17:45:05 | 000,001,402 | —- | C] () – C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2006/01/02 16:43:16 | 000,014,385 | —- | C] () – C:\WINDOWS\Tw561a.ini
[2006/01/02 16:43:16 | 000,000,081 | —- | C] () – C:\WINDOWS\Setup8a.ini
[2005/06/21 17:25:45 | 000,044,544 | —- | C] () – C:\Documents and Settings\jschmitz\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2005/02/28 18:39:09 | 000,000,414 | —- | C] () – C:\WINDOWS\hpbvspst.ini
[2005/02/23 10:32:28 | 000,000,000 | —- | C] () – C:\WINDOWS\Wininit.ini
[2005/02/23 10:32:27 | 000,028,672 | —- | C] () – C:\WINDOWS\System32\cmirmdrv.dll
[2005/02/23 09:34:17 | 000,130,160 | —- | C] () – C:\WINDOWS\Cmuda.ini
[2005/02/23 09:34:17 | 000,012,484 | —- | C] () – C:\WINDOWS\IOS.INI
[2005/02/23 09:34:17 | 000,005,231 | —- | C] () – C:\WINDOWS\hpdj5100.ini
[2005/02/23 09:34:17 | 000,003,974 | —- | C] () – C:\WINDOWS\Oatwtiqa.ini
[2005/02/23 09:34:17 | 000,003,079 | —- | C] () – C:\WINDOWS\cdplayer.ini
[2005/02/23 09:34:17 | 000,002,529 | —- | C] () – C:\WINDOWS\Ascd_tmp.ini
[2005/02/23 09:34:17 | 000,001,021 | —- | C] () – C:\WINDOWS\ODBC.INI
[2005/02/23 09:34:17 | 000,000,871 | —- | C] () – C:\WINDOWS\hegames.ini
[2005/02/23 09:34:17 | 000,000,787 | —- | C] () – C:\WINDOWS\SCANREG.INI
[2005/02/23 09:34:17 | 000,000,772 | —- | C] () – C:\WINDOWS\eregppak.ini
[2005/02/23 09:34:17 | 000,000,585 | —- | C] () – C:\WINDOWS\dialer.ini
[2005/02/23 09:34:17 | 000,000,575 | —- | C] () – C:\WINDOWS\CBWVIEW.INI
[2005/02/23 09:34:17 | 000,000,428 | —- | C] () – C:\WINDOWS\TELEPHON.INI
[2005/02/23 09:34:17 | 000,000,372 | —- | C] () – C:\WINDOWS\sonic.ini
[2005/02/23 09:34:17 | 000,000,301 | —- | C] () – C:\WINDOWS\SBWIN.INI
[2005/02/23 09:34:17 | 000,000,269 | —- | C] () – C:\WINDOWS\tmupdate.ini
[2005/02/23 09:34:17 | 000,000,256 | —- | C] () – C:\WINDOWS\aucfg.ini
[2005/02/23 09:34:17 | 000,000,240 | —- | C] () – C:\WINDOWS\kodakPS.ini
[2005/02/23 09:34:17 | 000,000,180 | —- | C] () – C:\WINDOWS\PPI.INI
[2005/02/23 09:34:17 | 000,000,170 | —- | C] () – C:\WINDOWS\GetServer.ini
[2005/02/23 09:34:17 | 000,000,162 | —- | C] () – C:\WINDOWS\KPCMS.INI
[2005/02/23 09:34:17 | 000,000,126 | —- | C] () – C:\WINDOWS\CTSYNWDM.INI
[2005/02/23 09:34:17 | 000,000,124 | —- | C] () – C:\WINDOWS\mdm.ini
[2005/02/23 09:34:17 | 000,000,094 | —- | C] () – C:\WINDOWS\CMISETUP.INI
[2005/02/23 09:34:17 | 000,000,087 | —- | C] () – C:\WINDOWS\HPFDJC07.INI
[2005/02/23 09:34:17 | 000,000,071 | —- | C] () – C:\WINDOWS\WP-UI.INI
[2005/02/23 09:34:17 | 000,000,063 | —- | C] () – C:\WINDOWS\7thlevel.ini
[2005/02/23 09:34:17 | 000,000,060 | —- | C] () – C:\WINDOWS\POWERPNT.INI
[2005/02/23 09:34:17 | 000,000,054 | —- | C] () – C:\WINDOWS\WAVEMIX.INI
[2005/02/23 09:34:17 | 000,000,045 | —- | C] () – C:\WINDOWS\PRINTPLY.INI
[2005/02/23 09:34:17 | 000,000,045 | —- | C] () – C:\WINDOWS\IIIFLHL.ini
[2005/02/23 09:34:17 | 000,000,042 | —- | C] () – C:\WINDOWS\CWLMAW.INI
[2005/02/23 09:34:17 | 000,000,033 | —- | C] () – C:\WINDOWS\SOL.INI
[2005/02/23 09:34:17 | 000,000,031 | —- | C] () – C:\WINDOWS\KA.INI
[2005/02/23 09:34:17 | 000,000,030 | —- | C] () – C:\WINDOWS\MORPHEUS.INI
[2005/02/23 09:34:17 | 000,000,028 | —- | C] () – C:\WINDOWS\QTW.INI
[2005/02/23 09:34:17 | 000,000,026 | —- | C] () – C:\WINDOWS\MSOFFICE.INI
[2005/02/23 09:34:17 | 000,000,026 | —- | C] () – C:\WINDOWS\CMCDPLAY.INI
[2005/02/23 09:34:17 | 000,000,000 | —- | C] () – C:\WINDOWS\UMP.INI
[2005/02/23 09:34:17 | 000,000,000 | —- | C] () – C:\WINDOWS\rkeeper.ini
[2005/02/23 09:34:17 | 000,000,000 | —- | C] () – C:\WINDOWS\progman.ini
[2005/02/23 09:34:17 | 000,000,000 | —- | C] () – C:\WINDOWS\NSREX.INI
[2005/02/23 09:34:17 | 000,000,000 | —- | C] () – C:\WINDOWS\MSREGUSR.INI
[2005/02/23 09:34:17 | 000,000,000 | —- | C] () – C:\WINDOWS\MADCCS.INI
[2005/02/23 09:34:17 | 000,000,000 | —- | C] () – C:\WINDOWS\MADCCF.INI
[2005/02/23 09:34:16 | 000,007,885 | —- | C] () – C:\WINDOWS\NETDET.INI
[2005/02/23 09:34:16 | 000,005,068 | —- | C] () – C:\WINDOWS\DELETEFI.INI
[2005/02/23 09:34:16 | 000,003,598 | —- | C] () – C:\WINDOWS\HTMLHELP.INI
[2005/02/23 09:34:16 | 000,000,171 | —- | C] () – C:\WINDOWS\winmine.ini
[2005/02/21 11:22:55 | 000,057,344 | —- | C] () – C:\WINDOWS\System32\ICMFILTER.DLL
[2005/01/30 16:43:43 | 000,028,672 | —- | C] () – C:\WINDOWS\CMIRmDriver.dll
[2004/10/24 00:58:42 | 000,003,587 | —- | C] () – C:\WINDOWS\goeaoa.dll
[2004/06/22 17:54:46 | 000,001,167 | —- | C] () – C:\Documents and Settings\jschmitz\Application Data\dw.log
[2004/06/13 15:26:20 | 000,000,000 | —- | C] () – C:\Documents and Settings\jschmitz\Application Data\dm.ini
[2003/12/31 14:38:36 | 000,203,189 | —- | C] () – C:\Program Files\spampal-1.53-binaries.zip
[2003/10/24 12:15:10 | 000,427,303 | —- | C] () – C:\Program Files\spampal-beta-1.52.exe
[2003/10/24 12:07:12 | 000,582,937 | —- | C] () – C:\Program Files\spampal-1.50.exe
[2002/12/05 18:51:00 | 000,059,392 | R— | C] () – C:\WINDOWS\streamhlp.dll
[2002/04/03 23:02:06 | 000,002,596 | —- | C] () – C:\Documents and Settings\jschmitz\Application Data\evpro32.prf
[2001/12/14 13:34:46 | 000,164,864 | —- | C] () – C:\WINDOWS\patchw32.dll
[2001/04/27 19:59:31 | 000,056,832 | —- | C] () – C:\WINDOWS\System32\IYVU9_32.DLL
[2001/03/11 21:03:36 | 000,107,456 | —- | C] () – C:\WINDOWS\System32\sh33w32.DLL
[2001/03/10 21:51:07 | 000,210,944 | —- | C] () – C:\WINDOWS\System32\MSVCRT10.DLL
[2001/03/03 22:57:11 | 000,202,240 | —- | C] () – C:\WINDOWS\System32\sp3.dll
[2001/03/03 22:56:59 | 000,028,672 | —- | C] () – C:\WINDOWS\wutil.dll
[2001/03/03 22:20:27 | 000,036,864 | —- | C] () – C:\WINDOWS\System32\PTISTP.DLL
[2001/03/03 22:04:47 | 000,023,357 | -H– | C] () – C:\Program Files\folder.htt
[2000/09/08 17:53:50 | 000,073,839 | —- | C] () – C:\WINDOWS\System32\KodakOneTouch.dll
[1999/01/22 10:46:58 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\MSRTEDIT.DLL
[1980/01/01 00:00:00 | 000,000,025 | —- | C] () – C:\WINDOWS\System32\OEMINFO.INI

========== LOP Check ==========

[2005/02/23 09:33:24 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Viewpoint
[2005/02/23 09:33:26 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\x2ff
[2008/10/11 17:40:06 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PCSettings
[2009/03/09 00:04:02 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PC Drivers HeadQuarters
[2009/03/24 22:31:02 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2009/05/14 22:13:10 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2009/10/18 20:43:04 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Seagate
[2009/11/01 13:20:44 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\{CFBD8779-FAAB-4357-84F2-1EC8619FADA6}
[2009/11/05 22:27:50 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PCPitstop
[2009/11/06 15:19:04 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2005/02/23 09:33:34 | 000,000,000 | —D | M] – C:\Documents and Settings\jschmitz\Application Data\InterTrust
[2005/02/23 09:33:34 | 000,000,000 | —D | M] – C:\Documents and Settings\jschmitz\Application Data\SpamPal
[2005/02/23 09:33:36 | 000,000,000 | —D | M] – C:\Documents and Settings\jschmitz\Application Data\esue
[2005/02/23 09:33:42 | 000,000,000 | —D | M] – C:\Documents and Settings\jschmitz\Application Data\Avant Browser
[2005/02/23 09:33:42 | 000,000,000 | —D | M] – C:\Documents and Settings\jschmitz\Application Data\rahs
[2005/06/12 21:47:36 | 000,000,000 | —D | M] – C:\Documents and Settings\jschmitz\Application Data\Aim
[2005/09/06 20:05:34 | 000,000,000 | —D | M] – C:\Documents and Settings\jschmitz\Application Data\WMTools Downloaded Files
[2006/08/16 12:35:10 | 000,000,000 | —D | M] – C:\Documents and Settings\jschmitz\Application Data\FilmLoop
[2007/03/26 15:09:12 | 000,000,000 | —D | M] – C:\Documents and Settings\jschmitz\Application Data\MTV Networks
[2007/05/07 21:14:08 | 000,000,000 | —D | M] – C:\Documents and Settings\jschmitz\Application Data\Viewpoint
[2008/06/30 12:32:48 | 000,000,000 | —D | M] – C:\Documents and Settings\jschmitz\Application Data\Wal-Mart Digital Photo Viewer
[2008/07/31 23:52:10 | 000,000,000 | —D | M] – C:\Documents and Settings\jschmitz\Application Data\Wal-Mart Digital Photo Manager
[2008/10/12 00:19:46 | 000,000,000 | —D | M] – C:\Documents and Settings\jschmitz\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2008/12/21 19:21:26 | 000,000,000 | —D | M] – C:\Documents and Settings\jschmitz\Application Data\FullTiltPoker
[2009/03/09 00:02:54 | 000,000,000 | —D | M] – C:\Documents and Settings\jschmitz\Application Data\Downloaded Installations
[2009/03/09 00:06:08 | 000,000,000 | —D | M] – C:\Documents and Settings\jschmitz\Application Data\PC_Drivers_Headquarters
[2009/03/11 23:06:24 | 000,000,000 | —D | M] – C:\Documents and Settings\jschmitz\Application Data\VSRevoGroup
[2009/05/02 09:15:56 | 000,000,000 | —D | M] – C:\Documents and Settings\jschmitz\Application Data\Research In Motion
[2009/05/13 21:53:34 | 000,000,000 | —D | M] – C:\Documents and Settings\jschmitz\Application Data\GetRightToGo
[2010/06/14 17:01:38 | 000,000,000 | —D | M] – C:\Documents and Settings\jschmitz\Application Data\PhotoChannel
[2010/09/18 18:06:02 | 000,000,472 | —- | M] () – C:\WINDOWS\Tasks\Ad-Aware Update (Daily 1).job
[2010/09/18 18:06:04 | 000,000,472 | —- | M] () – C:\WINDOWS\Tasks\Ad-Aware Update (Daily 2).job
[2010/09/18 18:06:04 | 000,000,472 | —- | M] () – C:\WINDOWS\Tasks\Ad-Aware Update (Daily 3).job
[2010/09/18 18:06:04 | 000,000,472 | —- | M] () – C:\WINDOWS\Tasks\Ad-Aware Update (Daily 4).job
[2010/09/18 18:06:04 | 000,000,472 | —- | M] () – C:\WINDOWS\Tasks\Ad-Aware Update (Weekly).job
[2010/09/16 08:50:16 | 000,000,408 | —- | M] () – C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp officejet 6100 series#1281585584.job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2005/02/21 12:26:24 | 000,001,744 | RHS- | M] () – C:\MSDOS.SYS
[2005/02/22 12:26:50 | 000,000,000 | —- | M] () – C:\CONFIG.SYS
[2009/07/24 14:18:08 | 000,000,232 | -H– | M] () – C:\sqmdata12.sqm
[2001/09/05 21:00:58 | 001,700,352 | —- | M] (Microsoft Corporation) – C:\gdiplus.dll
[2005/02/22 12:26:50 | 000,000,000 | —- | M] () – C:\CONFIG.BAK
[2005/02/22 12:26:50 | 000,000,194 | -H– | M] () – C:\AUTOEXEC.BAT
[2005/02/21 11:29:38 | 004,841,504 | RH– | M] () – C:\CLASSES.1ST
[2009/10/18 20:35:24 | 000,029,512 | —- | M] () – C:\WINDOWSSerifastd-black.otf
[2010/09/06 14:39:18 | 000,000,494 | —- | M] () – C:\hpfr5550.xml
[2006/04/18 20:42:08 | 000,002,244 | —- | M] () – C:\VundoFix.txt
[2006/12/17 19:02:02 | 000,000,652 | —- | M] () – C:\EasyShareInstall.log
[2008/04/12 14:29:20 | 000,000,232 | -H– | M] () – C:\sqmdata04.sqm
[2005/02/01 22:11:26 | 000,004,531 | —- | M] () – C:\logfile
[2007/12/25 14:34:04 | 000,000,244 | -H– | M] () – C:\sqmnoopt00.sqm
[2005/02/23 09:10:52 | 000,000,512 | -HS- | M] () – C:\BOOTSECT.DOS
[2007/12/25 14:34:04 | 000,000,232 | -H– | M] () – C:\sqmdata00.sqm
[2007/12/25 14:34:26 | 000,000,244 | -H– | M] () – C:\sqmnoopt01.sqm
[2008/10/05 23:21:46 | 000,250,048 | RHS- | M] () – C:\ntldr
[2004/08/04 12:00:00 | 000,047,564 | RHS- | M] () – C:\ntdetect.com
[2010/09/14 22:55:26 | 000,000,217 | -HS- | M] () – C:\boot.ini
[2007/12/25 14:34:26 | 000,000,232 | -H– | M] () – C:\sqmdata01.sqm
[2007/12/25 14:35:36 | 000,000,244 | -H– | M] () – C:\sqmnoopt02.sqm
[2007/12/25 14:35:36 | 000,000,232 | -H– | M] () – C:\sqmdata02.sqm
[2007/12/25 14:35:42 | 000,000,244 | -H– | M] () – C:\sqmnoopt03.sqm
[2007/12/25 14:35:42 | 000,000,232 | -H– | M] () – C:\sqmdata03.sqm
[2008/04/12 14:29:40 | 000,000,232 | -H– | M] () – C:\sqmdata05.sqm
[2008/01/02 11:34:28 | 000,016,100 | —- | M] () – C:\ComboFix.txt
[2008/04/12 14:29:20 | 000,000,244 | -H– | M] () – C:\sqmnoopt04.sqm
[2008/04/12 14:29:40 | 000,000,244 | -H– | M] () – C:\sqmnoopt05.sqm
[2009/03/04 21:03:08 | 000,766,489 | —- | M] () – C:\hpfr5100.log
[2008/04/12 14:29:50 | 000,000,244 | -H– | M] () – C:\sqmnoopt06.sqm
[2008/04/12 14:29:50 | 000,000,232 | -H– | M] () – C:\sqmdata06.sqm
[2008/09/28 09:54:36 | 000,000,244 | -H– | M] () – C:\sqmnoopt07.sqm
[2008/09/28 09:54:36 | 000,000,232 | -H– | M] () – C:\sqmdata07.sqm
[2008/09/28 10:03:04 | 000,000,244 | -H– | M] () – C:\sqmnoopt08.sqm
[2008/09/28 10:03:04 | 000,000,232 | -H– | M] () – C:\sqmdata08.sqm
[2008/09/28 14:13:16 | 000,000,244 | -H– | M] () – C:\sqmnoopt09.sqm
[2008/09/28 14:13:16 | 000,000,232 | -H– | M] () – C:\sqmdata09.sqm
[2008/12/25 05:34:28 | 000,000,244 | -H– | M] () – C:\sqmnoopt10.sqm
[2008/12/25 05:34:28 | 000,000,232 | -H– | M] () – C:\sqmdata10.sqm
[2009/03/08 12:34:26 | 000,000,244 | -H– | M] () – C:\sqmnoopt11.sqm
[2009/03/08 12:34:26 | 000,000,232 | -H– | M] () – C:\sqmdata11.sqm
[2009/07/24 14:18:08 | 000,000,244 | -H– | M] () – C:\sqmnoopt12.sqm
[2009/10/18 20:35:24 | 000,027,772 | —- | M] () – C:\WINDOWSSerifastd-bold.otf
[2009/10/18 20:35:24 | 000,028,252 | —- | M] () – C:\WINDOWSSerifastd-italic.otf
[2009/10/18 20:35:24 | 000,027,440 | —- | M] () – C:\WINDOWSSerifastd-light.otf
[2009/10/18 20:35:24 | 000,028,260 | —- | M] () – C:\WINDOWSSerifastd-lightitalic.otf
[2009/10/18 20:35:24 | 000,027,452 | —- | M] () – C:\WINDOWSSerifastd-roman.otf
[2006/01/02 17:02:34 | 018,874,379 | —- | M] () – C:\Snap.avi
[2006/03/12 19:51:54 | 000,304,182 | —- | M] () – C:\Snap.bmp
[2006/01/02 17:00:52 | 013,462,300 | —- | M] () – C:\LOSER
[2006/01/03 16:24:38 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2010/09/18 18:01:38 | 2684,354,560 | -HS- | M] () – C:\pagefile.sys
[2010/09/18 18:01:38 | 000,008,732 | —- | M] () – C:\aaw7boot.log
[2009/11/11 13:26:12 | 000,016,653 | —- | M] () – C:\LU4.log

< %systemroot%\Fonts\*.com >
[2006/04/18 15:39:28 | 000,026,040 | —- | M] () – C:\WINDOWS\FONTS\GlobalMonospace.CompositeFont
[2006/06/29 14:53:56 | 000,026,489 | —- | M] () – C:\WINDOWS\FONTS\GlobalSansSerif.CompositeFont
[2006/04/18 15:39:28 | 000,029,779 | —- | M] () – C:\WINDOWS\FONTS\GlobalSerif.CompositeFont
[2006/06/29 14:58:52 | 000,030,808 | —- | M] () – C:\WINDOWS\FONTS\GlobalUserInterface.CompositeFont
[7 C:\WINDOWS\Fonts\*.tmp files -> C:\WINDOWS\Fonts\*.tmp -> ]

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2005/02/23 09:32:06 | 000,000,067 | -HS- | M] () – C:\WINDOWS\FONTS\desktop.ini
[7 C:\WINDOWS\Fonts\*.tmp files -> C:\WINDOWS\Fonts\*.tmp -> ]

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/07/06 03:50:04 | 000,597,504 | —- | M] (Microsoft Corporation) – C:\WINDOWS\SYSTEM32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe
[2008/07/06 05:06:10 | 000,089,088 | —- | M] (Microsoft Corporation) – C:\WINDOWS\SYSTEM32\spool\prtprocs\w32x86\filterpipelineprintproc.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2000/06/08 17:00:00 | 000,071,952 | —- | M] (Microsoft Corporation) – C:\WINDOWS\Channel Screen Saver.SCR
[1371 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >
[2008/10/09 18:14:20 | 001,440,054 | —- | M] () – C:\Documents and Settings\jschmitz\Application Data\Microsoft\Wallpaper1.bmp
[2009/12/23 19:30:08 | 000,001,754 | -H– | M] () – C:\Documents and Settings\jschmitz\Application Data\Microsoft\LastFlashConfig.WFC

< %PROGRAMFILES%\*.* >
[2005/02/21 12:27:40 | 000,023,357 | -H– | M] () – C:\Program Files\folder.htt
[2005/02/21 12:27:40 | 000,000,271 | -HS- | M] () – C:\Program Files\desktop.ini
[2003/10/24 12:07:12 | 000,582,937 | —- | M] () – C:\Program Files\spampal-1.50.exe
[2003/10/24 12:15:10 | 000,427,303 | —- | M] () – C:\Program Files\spampal-beta-1.52.exe
[2003/12/31 14:38:36 | 000,203,189 | —- | M] () – C:\Program Files\spampal-1.53-binaries.zip

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2005/02/23 09:23:44 | 000,880,640 | —- | M] () – C:\WINDOWS\SYSTEM32\config\system.sav
[2005/02/23 09:23:44 | 000,634,880 | —- | M] () – C:\WINDOWS\SYSTEM32\config\software.sav
[2005/02/23 09:23:44 | 000,094,208 | —- | M] () – C:\WINDOWS\SYSTEM32\config\default.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2008/10/05 23:34:16 | 000,000,272 | -HS- | M] () – C:\Documents and Settings\All Users\Start Menu\desktop.ini

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2005/02/23 09:48:16 | 000,000,119 | -HS- | M] () – C:\Documents and Settings\jschmitz\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
[2005/02/23 09:48:12 | 000,000,079 | —- | M] () – C:\Documents and Settings\jschmitz\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

< %USERPROFILE%\Desktop\*.exe >
[2009/05/01 22:42:52 | 037,008,656 | —- | M] () – C:\Documents and Settings\jschmitz\Desktop\BlackBerryMediaSync_2.0.exe
[2010/03/26 18:59:06 | 027,386,256 | —- | M] ( ) – C:\Documents and Settings\jschmitz\Desktop\AdbeRdr930_en_US.exe
[2010/09/18 18:08:08 | 000,575,488 | —- | M] (OldTimer Tools) – C:\Documents and Settings\jschmitz\Desktop\OTL.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >
[2002/08/13 18:01:26 | 000,007,431 | —- | M] () – C:\WINDOWS\Tw561a.src
[1371 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >
[2002/07/25 17:45:32 | 003,439,230 | —- | M] (Adaptec) – C:\Documents and Settings\jschmitz\My Documents\ecdc_v405_up.exe
[2005/12/26 19:15:06 | 034,412,848 | —- | M] (Apple Computer, Inc. ) – C:\Documents and Settings\jschmitz\My Documents\iTunesSetup.exe

< %USERPROFILE%\*.exe >

< %systemroot%\ADDINS\*.* >

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >
[2010/09/18 18:18:34 | 000,163,840 | -HS- | M] () – C:\Documents and Settings\jschmitz\Cookies\index.dat

< %SystemRoot%\system32\fonts\*.* >

< %systemroot%\system32\winlog\*.* >

< %systemroot%\system32\Language\*.* >

< %systemroot%\system32\Settings\*.* >

< %systemroot%\system32\*.quo >

< %SYSTEMROOT%\AppPatch\*.exe >

< %SYSTEMROOT%\inf\*.exe >
[2007/06/26 22:10:26 | 000,317,440 | —- | M] (Microsoft Corporation) – C:\WINDOWS\INF\unregmp2.exe

< %SYSTEMROOT%\Installer\*.exe >
[2009/04/15 15:40:58 | 000,585,728 | —- | M] (Research In Motion Limited) – C:\WINDOWS\Installer\BBMediaSyncUninstall.exe
[5 C:\WINDOWS\Installer\*.tmp files -> C:\WINDOWS\Installer\*.tmp -> ]

< %systemroot%\system32\config\*.bak2 >

< %systemroot%\system32\Computers\*.* >

< %SystemRoot%\system32\Sound\*.* >

< %SystemRoot%\system32\SpecialImg\*.* >

< %SystemRoot%\system32\code\*.* >

< %SystemRoot%\system32\draft\*.* >

< %SystemRoot%\system32\MSSSys\*.* >

< %ProgramFiles%\Javascript\*.* >

< %systemroot%\pchealth\helpctr\System\*.exe /s >

< %systemroot%\Web\*.exe >

< %systemroot%\system32\msn\*.* >

< %systemroot%\system32\*.tro >

< %AppData%\Microsoft\Installer\msupdates\*.* >

< %ProgramFiles%\Messenger\*.exe >
[2000/06/08 17:00:00 | 000,012,560 | —- | M] () – C:\Program Files\Messenger\MSMSGSIN.EXE
[2008/04/13 17:12:28 | 001,695,232 | -HS- | M] (Microsoft Corporation) – C:\Program Files\Messenger\msmsgs.exe

< %systemroot%\system32\systhem32\*.* >

< %systemroot%\system\*.exe >
[1998/03/26 00:00:00 | 000,038,160 | —- | M] (Microsoft Corporation) – C:\WINDOWS\SYSTEM\MAPISRVR.EXE
[1997/07/11 00:37:00 | 000,011,856 | —- | M] () – C:\WINDOWS\SYSTEM\MVTHKSVR.EXE
[1992/03/22 19:00:00 | 000,016,752 | —- | M] (Microsoft Corporation) – C:\WINDOWS\SYSTEM\regload.exe
[2004/02/17 10:51:56 | 001,458,176 | —- | M] (C-Media Electronics Inc.) – C:\WINDOWS\SYSTEM\SmWizard.exe
[20 C:\WINDOWS\system\*.tmp files -> C:\WINDOWS\system\*.tmp -> ]

< %USERPROFILE%\Templates\*.tmp >

< %SYSTEMDRIVE%\explorexxx.exe\*.* >

< %Windir%\Installer\*.tmp >
[5 C:\WINDOWS\Installer\*.tmp files -> C:\WINDOWS\Installer\*.tmp -> ]

< %systemroot%\System32\*.xco >

< %ProgramFiles%\system32\*.* >

< %systemroot%\System32\windos\*.* >

< %SystemRoot%\system32\sandbox\*.* >

< %SystemRoot%\system32\*.amo >

< %SystemRoot%\system32\Windows Live\*.* >

< %ProgramFiles%\logs\*.* >

< %ProgramFiles%\Bifrost\*.* >

< %SystemRoot%\system32\*.goo >

< %systemroot%\system32\IME\*.* >

< %systemroot%\BackUp\*.* >

< %systemroot%\system32\*.ico >
[2006/01/15 15:32:58 | 000,001,406 | —- | M] () – C:\WINDOWS\SYSTEM32\Help.ico
[2006/01/15 15:32:58 | 000,002,550 | —- | M] () – C:\WINDOWS\SYSTEM32\Uninstall.ico
[148 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\system\*.dat >
[2003/04/05 11:23:12 | 000,002,172 | —- | M] () – C:\WINDOWS\SYSTEM\d3d8caps.dat
[2005/02/22 14:21:58 | 000,001,054 | —- | M] () – C:\WINDOWS\SYSTEM\SMBIOS.DAT
[2000/06/14 08:40:52 | 000,131,611 | —- | M] () – C:\WINDOWS\SYSTEM\ELSAST3D.DAT
[2000/06/14 08:40:52 | 000,023,579 | —- | M] () – C:\WINDOWS\SYSTEM\ELSALOGO.DAT
[2000/06/14 08:40:52 | 000,066,075 | —- | M] () – C:\WINDOWS\SYSTEM\ELSAGC3D.DAT
[2003/03/26 09:27:50 | 000,108,557 | R— | M] () – C:\WINDOWS\SYSTEM\hpf3xo08.dat
[20 C:\WINDOWS\system\*.tmp files -> C:\WINDOWS\system\*.tmp -> ]

< %systemroot%\system\*.exe >
[1998/03/26 00:00:00 | 000,038,160 | —- | M] (Microsoft Corporation) – C:\WINDOWS\SYSTEM\MAPISRVR.EXE
[1997/07/11 00:37:00 | 000,011,856 | —- | M] () – C:\WINDOWS\SYSTEM\MVTHKSVR.EXE
[1992/03/22 19:00:00 | 000,016,752 | —- | M] (Microsoft Corporation) – C:\WINDOWS\SYSTEM\regload.exe
[2004/02/17 10:51:56 | 001,458,176 | —- | M] (C-Media Electronics Inc.) – C:\WINDOWS\SYSTEM\SmWizard.exe
[20 C:\WINDOWS\system\*.tmp files -> C:\WINDOWS\system\*.tmp -> ]

< %AppData%\Macromedia\Common\*.* >

< %SYSTEMDRIVE%\dir\*.* /s >

< %systemroot%\system32\ras\*.exe >

< %SYSTEMDRIVE%\MFILES\*.* >

< %SYSTEMDRIVE%\mDNSRespon.exe\*.* >

< %systemroot%\system32\services\*.* >

< %systemroot%\Spooler\*.* >

< %ProgramFiles%\system32\*.* >

< %systemroot%\system32\Setup\*.dll /x >

< %systemroot%\system32\*.mine >

< %SYSTEMDRIVE%\cleansweep.exe\*.* >

< %systemroot%\system32\ras\*.dll >

< %systemroot%\system32\ras\*.drv >

< %systemroot%\*.iq >

< %systemroot%\system32\XP\*.* >

< %SYSTEMDRIVE%\Extracted\*.* >

< %systemroot%\system32\windows\*.* >

< %systemroot%\logs\*.* >

< %SYSTEMDRIVE%\Win.Msi\*.* >

< %systemroot%\regedit\*.* >

< %systemroot%\system32\skype\*.* >

< %AppData%\Adobe\dlluplwin25\*.* >

< %UserProfile%\*.dat >
[2010/09/17 19:52:22 | 011,796,480 | —- | M] () – C:\Documents and Settings\jschmitz\ntuser.dat

< %UserProfile%\*.dll >

< %systemroot%\system32\*.sxo >

< %SYSTEMDRIVE%\Gazma\*.* /s >

< %systemroot%\system32\spynet\*.* >

< %systemroot%\system32\System\*.* >

< %appdata%\Microsoft\Windows\*.* >
[2010/09/14 23:18:44 | 000,524,288 | -H– | M] () – C:\Documents and Settings\jschmitz\Application Data\Microsoft\Windows\UsrClass.dat
[2010/09/18 18:03:06 | 000,001,024 | -H– | M] () – C:\Documents and Settings\jschmitz\Application Data\Microsoft\Windows\UsrClass.dat.LOG

< %systemroot%\system32\WinDir\*.* >

< %systemroot%\_\*.* >

< %systemroot%\system32\windows32\*.* >

< %ProgramFiles%\win\*.* >

< %AppData%\Microsoft\CD Burning\*.* >

< %systemroot%\*.cab >
[2000/06/08 17:00:00 | 000,006,325 | —- | M] () – C:\WINDOWS\RUNHELP.CAB
[1371 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

< %systemroot%\K.Backup\*.* >

< %ProgramFiles%\Massenger\*.* >

< %systemroot%\System32\*.doc >

< %systemroot%\Office12\*.* >

< %systemroot%\System32\Rundl32.exe\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-09-15 06:05:52
< End of report >

Extras.txt

OTL Extras logfile created on: 9/18/2010 6:19:02 PM - Run 1
OTL by OldTimer - Version 3.2.12.1 Folder = C:\Documents and Settings\jschmitz\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: enu | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 74.00% Memory free
5.00 Gb Paging File | 5.00 Gb Available in Paging File | 92.00% Paging File free
Paging file location(s): C:\pagefile.sys 2560 2560 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 465.65 Gb Total Space | 430.60 Gb Free Space | 92.47% Space Free | Partition Type: FAT32
D: Drive not present or media not loaded
E: Drive not present or media not loaded
Drive F: | 28.61 Gb Total Space | 0.89 Gb Free Space | 3.11% Space Free | Partition Type: FAT32
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: JSCHMITZ
Current User Name: jschmitz
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Minimal
Quick Scan

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
htmlfile – "C:\Program Files\Microsoft Office\Office\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] – "C:\Program Files\Microsoft Office\Office\msohtmed.exe" /p %1 (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\MSN Messenger\msnmsgr.exe" = C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1 – File not found
"C:\Program Files\MSN Messenger\livecall.exe" = C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone) – File not found

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\KODAK\Kodak EasyShare software\bin\EasyShare.exe" = C:\Program Files\KODAK\Kodak EasyShare software\bin\EasyShare.exe:*:Enabled:EasyShare – File not found
"C:\Program Files\MSN Messenger\msnmsgr.exe" = C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1 – File not found
"C:\Program Files\MSN Messenger\livecall.exe" = C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone) – File not found
"C:\Program Files\MSI\i-Speeder\i-Speeder.exe" = C:\Program Files\MSI\i-Speeder\i-Speeder.exe:*:Enabled:i-Speeder – (Micro-Star International Co.,Ltd.)
"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes – (Apple Inc.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00000409-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 Premium
"{00203668-8170-44A0-BE44-B632FA4D780F}" = Adobe AIR
"{0076E1AC-9E7B-4B9F-A62A-4CC9511AD8E3}" = Zune Language Pack (FR)
"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
"{0E4BC542-9CFD-4E97-B586-9F1E5516E7B9}" = Microsoft IntelliPoint 6.1
"{0ECB59D5-A3FC-4D61-AD3B-6CE679B3F852}" = Java DB 10.2.2.0
"{0FD7D92D-81B7-11D5-9268-006097A63005}" = USB SmartMedia Reader
"{0FD7D92F-81B7-11D5-9268-006097A63005}" = USB CompactFlash Reader
"{12BB7942-1E1F-43D9-B441-4668C1629425}" = hp officejet 6100 series
"{2070F79D-46BC-4EEA-8F02-9B4DCABAE7CB}" = iPod for Windows 2006-03-23
"{26A24AE4-039D-4CA4-87B4-2F83216010FF}" = Java™ 6 Update 13
"{303379C9-8610-4CCF-AF37-C4BF8998C591}" = Roxio Media Manager
"{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java™ 6 Update 3
"{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java™ 6 Update 5
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java™ 6 Update 7
"{32A3A4F4-B792-11D6-A78A-00B0D0160030}" = Java™ SE Development Kit 6 Update 3
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{45EBDA59-D33B-433A-956E-B2F236468B56}" = MUSICMATCH® Jukebox
"{49672EC2-171B-47B4-8CE7-50D7806360D7}" = Windows Live Sign-in Assistant
"{4CCC7F68-A437-4559-A840-F5E010934951}" = HP Driver Diagnostics
"{6687607F-350F-43E2-8620-D8759E9F65E3}" = Instant Play Guitar Deluxe
"{689E0AB3-50B2-4E5A-9DCE-6DA9F5BE1314}" = BlackBerry® Media Sync
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6ECB39BD-73C2-44DD-B1A0-898207C58D8B}" = HP Photo and Imaging 2.0 - All-in-One Drivers
"{6FC82D6E-0D46-4E72-90DC-36E5D59B97E4}" = WinPatrol 8.0
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel® Extreme Graphics 2 Driver
"{8BBF6DFD-0AD9-43A7-9FBD-BF065E3866AF}" = URGE
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9867A917-5D17-40DE-83BA-BEA5293194B1}" = HP Photo and Imaging 2.0 - All-in-One
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A429C2AE-EBF1-4F81-A221-1C115CAADDAD}" = QuickTime
"{A5CC2A09-E9D3-49EC-923D-03874BBD4C2C}" = Windows Defender Signatures
"{AADEA55D-C834-4BCB-98A3-4B8D1C18F4EE}" = Apple Mobile Device Support
"{AC76BA86-7AD7-1033-7B44-A93000000001}" = Adobe Reader 9.3.4
"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B607C354-CD79-4D22-86D1-92DC94153F42}" = Apple Application Support
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C43E4B9C-14C8-4EB0-998B-85211B6EDD61}" = Seagate DiscWizard
"{C4868E88-F5B5-4E45-9592-C7062BD97441}" = Symantec Technical Support Web Controls
"{C73A3AB4-99A4-45E5-B77F-09A3065E0D6A}" = Microsoft IntelliType Pro 6.1
"{CAE7D1D9-3794-4169-B4DD-964ADBC534EE}" = HP Product Detection
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D1A74FBB-CA8D-4CCA-9B89-BAAA436DB178}" = iTunes
"{D793A12F-E362-48BB-B332-1DA5E936B52D}" = BlackBerry Desktop Software 4.3
"{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}" = Ad-Aware
"{E0828692-FD9D-459F-9312-C645C3CA6650}" = HP Photo and Imaging 2.0 - Deskjet Series
"{E14B8A08-42B3-4676-9E91-1D39F8158DA1}" = HP Print Diagnostic Utility
"{EE4ACABF-531E-419A-9225-B8E0FA4955AF}" = Zune Language Pack (ES)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"{F48C6EA5-3B43-11D6-86A6-0050BA0259A2}" = ICatch (VI) PC Camera
"{FE242C4A-4AF0-4E9F-ABFF-92CA3CEE8761}" = MySpaceIM
"{FF70513F-E3A7-402F-84FB-B7810A064BE2}" = Zune
"Ad-Aware" = Ad-Aware
"Adobe Acrobat 4.0" = Adobe Acrobat 4.0
"Adobe Atmosphere Player" = Adobe Atmosphere Player for Acrobat and Adobe Reader
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Photoshop 5.0" = Adobe Photoshop 5.0
"Adobe Shockwave Player" = Adobe Shockwave Player
"AdobeESD" = Adobe Download Manager 1.2 (Remove Only)
"BBMediaSyncUninstall" = BlackBerry Media Sync
"BlackBerry_{D793A12F-E362-48BB-B332-1DA5E936B52D}" = BlackBerry Desktop Software 4.3
"CCleaner" = CCleaner (remove only)
"Chopper_is1" = Chopper XP 2.7
"C-Media Audio" = C-Media 3D Audio
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"DirectCD" = Adaptec DirectCD
"DMI Browser" = DMI Browse
"EnZip" = EnZip
"ESSMDM" = Uninstall Broadxent DSI Modem
"FilmLoopPlayer" = FilmLoop Player
"hp instant support" = hp instant support
"HP OfficeJet 6100 Series" = HP Photo and Imaging 2.0 - hp officejet 6100 series
"hp officejet 6100 series_Driver" = hp officejet 6100 series
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie7beta2" = Internet Explorer 7 Beta 2
"ie8" = Windows Internet Explorer 8
"InfoView" = InfoView
"InstallShield_{2070F79D-46BC-4EEA-8F02-9B4DCABAE7CB}" = iPod for Windows 2006-03-23
"i-Speeder" = i-Speeder
"Liveupdate4_is1" = Liveupdate4
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.0.15)" = Mozilla Firefox (3.0.15)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NAV" = Norton AntiVirus
"Network Play System (Patching)" = Network Play System (Patching)
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"PC Alert 4" = PC Alert 4
"PC Pitstop Driver Alert2_is1" = PC Pitstop Driver Alert2 2.0.0.0
"PrintMaster 7.00" = PrintMaster 7.00
"PrintMaster Gold 4.00" = PrintMaster Gold 4.00
"PROSet" = Intel® PRO Network Connections Drivers
"Revo Uninstaller" = Revo Uninstaller 1.83
"Sound Blaster Live! Value" = Sound Blaster Live! Value
"SpywareBlaster_is1" = SpywareBlaster 4.2
"SystemRequirementsLab" = System Requirements Lab
"Universal Media Player" = Universal Media Player
"Wdf01007" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinMX" = WinMX
"winusb0100" = Microsoft WinUsb 1.0
"WMFDist11" = Windows Media Format 11 runtime
"WMIinfo" = WMIinfo
"wmp11" = Windows Media Player 11
"Wudf01007" = Microsoft User-Mode Driver Framework Feature Pack 1.7
"Zune" = Zune

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 8/16/2010 12:01:44 PM | Computer Name = JSCHMITZ | Source = Application Error | ID = 1000
Description = Faulting application winword.exe, version 9.0.0.2717, faulting module
winword.exe, version 9.0.0.2717, fault address 0x000c2639.

Error - 8/17/2010 10:22:53 AM | Computer Name = JSCHMITZ | Source = Lavasoft Ad-Aware Service | ID = 0
Description =

Error - 8/23/2010 4:22:41 AM | Computer Name = JSCHMITZ | Source = Lavasoft Ad-Aware Service | ID = 0
Description =

Error - 8/26/2010 4:22:43 AM | Computer Name = JSCHMITZ | Source = Lavasoft Ad-Aware Service | ID = 0
Description =

Error - 8/30/2010 10:22:42 AM | Computer Name = JSCHMITZ | Source = Lavasoft Ad-Aware Service | ID = 0
Description =

Error - 9/2/2010 10:22:47 AM | Computer Name = JSCHMITZ | Source = Lavasoft Ad-Aware Service | ID = 0
Description =

Error - 9/6/2010 4:22:42 AM | Computer Name = JSCHMITZ | Source = Lavasoft Ad-Aware Service | ID = 0
Description =

Error - 9/8/2010 10:22:42 AM | Computer Name = JSCHMITZ | Source = Lavasoft Ad-Aware Service | ID = 0
Description =

Error - 9/9/2010 10:22:42 AM | Computer Name = JSCHMITZ | Source = Lavasoft Ad-Aware Service | ID = 0
Description =

Error - 9/13/2010 10:22:41 AM | Computer Name = JSCHMITZ | Source = Lavasoft Ad-Aware Service | ID = 0
Description =

[ System Events ]
Error - 9/15/2010 7:18:50 AM | Computer Name = JSCHMITZ | Source = Disk | ID = 262151
Description = The device, \Device\Harddisk0\D, has a bad block.

Error - 9/15/2010 7:19:41 AM | Computer Name = JSCHMITZ | Source = Disk | ID = 262151
Description = The device, \Device\Harddisk0\D, has a bad block.

Error - 9/15/2010 7:19:53 AM | Computer Name = JSCHMITZ | Source = Disk | ID = 262151
Description = The device, \Device\Harddisk0\D, has a bad block.

Error - 9/15/2010 10:27:10 PM | Computer Name = JSCHMITZ | Source = Dhcp | ID = 1002
Description = The IP address lease 192.168.10.102 for the Network Card with network
address 000C766198DC has been denied by the DHCP server 192.168.10.1 (The DHCP Server
sent a DHCPNACK message).

Error - 9/17/2010 10:29:33 AM | Computer Name = JSCHMITZ | Source = Dhcp | ID = 1002
Description = The IP address lease 192.168.10.101 for the Network Card with network
address 000C766198DC has been denied by the DHCP server 192.168.10.1 (The DHCP Server
sent a DHCPNACK message).

Error - 9/17/2010 10:52:26 AM | Computer Name = JSCHMITZ | Source = Dhcp | ID = 1002
Description = The IP address lease 192.168.10.101 for the Network Card with network
address 000C766198DC has been denied by the DHCP server 192.168.10.1 (The DHCP Server
sent a DHCPNACK message).

Error - 9/18/2010 9:02:34 PM | Computer Name = JSCHMITZ | Source = Service Control Manager | ID = 7000
Description = The Kodak Camera Connection Software service failed to start due to
the following error: %%2

Error - 9/18/2010 9:02:34 PM | Computer Name = JSCHMITZ | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the Roxio Upnp Server 9 service
to connect.

Error - 9/18/2010 9:02:34 PM | Computer Name = JSCHMITZ | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the LiveShare P2P Server
9 service to connect.

Error - 9/18/2010 9:02:34 PM | Computer Name = JSCHMITZ | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the Roxio Hard Drive Watcher
9 service to connect.

< End of report >

Gmer.txt

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-09-18 18:40:13
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:\DOCUME~1\jschmitz\LOCALS~1\Temp\axloypow.sys

—- System - GMER 1.0.15 —-

SSDT 8AAD0050 ZwAlertResumeThread
SSDT 8A414050 ZwAlertThread
SSDT 8A2C41B8 ZwAllocateVirtualMemory
SSDT 8A38E050 ZwAssignProcessToJobObject
SSDT 8AB1F208 ZwConnectPort
SSDT \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ZwCreateKey [0xB1FAF210]
SSDT 8A2C38C0 ZwCreateMutant
SSDT 8A2C33A8 ZwCreateSymbolicLinkObject
SSDT 8A9C52B8 ZwCreateThread
SSDT 8A40E050 ZwDebugActiveProcess
SSDT \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ZwDeleteKey [0xB1FAF490]
SSDT \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ZwDeleteValueKey [0xB1FAF9F0]
SSDT 8A2C4310 ZwDuplicateObject
SSDT 8A2C3008 ZwFreeVirtualMemory
SSDT 8A390050 ZwImpersonateAnonymousToken
SSDT 8A410050 ZwImpersonateThread
SSDT 8AB3BAE0 ZwLoadDriver
SSDT 8A2C3F28 ZwMapViewOfSection
SSDT 8AACF050 ZwOpenEvent
SSDT 8A2C44B0 ZwOpenProcess
SSDT 8AADAD60 ZwOpenProcessToken
SSDT 8A38F050 ZwOpenSection
SSDT 8A2C43E0 ZwOpenThread
SSDT 8A2C3478 ZwProtectVirtualMemory
SSDT 8AAE6050 ZwResumeThread
SSDT 8A9C50C0 ZwSetContextThread
SSDT 8A2C3DD0 ZwSetInformationProcess
SSDT 8AACE050 ZwSetSystemInformation
SSDT \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ZwSetValueKey [0xB1FAFC40]
SSDT 8A40F050 ZwSuspendProcess
SSDT 8AAB9AE0 ZwSuspendThread
SSDT 8AAF2EC0 ZwTerminateProcess
SSDT 8AA86AE0 ZwTerminateThread
SSDT 8AAD80C0 ZwUnmapViewOfSection
SSDT 8A2C40E8 ZwWriteVirtualMemory

—- Kernel code sections - GMER 1.0.15 —-

.text ntoskrnl.exe!_abnormal_termination + 4A0 804E2B0C 4 Bytes CALL 36D85751
? SYMDS.SYS The system cannot find the file specified. !
? SYMEFA.SYS The system cannot find the file specified. !

—- User code sections - GMER 1.0.15 —-

.text C:\Program Files\Mozilla Firefox\firefox.exe[2780] ntdll.dll!RtlValidateUnicodeString + 554 7C9163BE 10 Bytes JMP 01CA003A

—- Devices - GMER 1.0.15 —-

AttachedDevice \Driver\Tcpip \Device\Ip SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\Tcp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume1 tdrpman.sys (Acronis Try&Decide; and Restore Points Volume Filter Driver/Acronis)
AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume1 snapman.sys (Acronis Snapshot API/Acronis)
AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume2 tdrpman.sys (Acronis Try&Decide; and Restore Points Volume Filter Driver/Acronis)
AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume2 snapman.sys (Acronis Snapshot API/Acronis)
AttachedDevice \Driver\Tcpip \Device\Udp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\RawIp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

—- EOF - GMER 1.0.15 —-

MBRCheck.txt

MBRCheck, version 1.2.3
© 2010, AD

Command-line:
Windows Version: Windows XP Home Edition
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x0000003d

Kernel Drivers (total 148):
0x804D7000 \WINDOWS\system32\ntoskrnl.exe
0x806EE000 \WINDOWS\system32\hal.dll
0xF7987000 \WINDOWS\system32\KDCOM.DLL
0xF7897000 \WINDOWS\system32\BOOTVID.dll
0xF75A8000 ACPI.sys
0xF7989000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
0xF7597000 pci.sys
0xF75F7000 isapnp.sys
0xF7A4F000 pciide.sys
0xF7707000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
0xF798B000 intelide.sys
0xF7607000 MountMgr.sys
0xF74D8000 ftdisk.sys
0xF770F000 PartMgr.sys
0xF7617000 VolSnap.sys
0xF74C0000 atapi.sys
0xF749B000 tffsport.sys
0xF7627000 disk.sys
0xF7637000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
0xF747B000 fltmgr.sys
0xF7425000 SYMDS.SYS
0xF7413000 sr.sys
0xF7647000 Lbd.sys
0xF786A000 SYMEFA.SYS
0xF7657000 PxHelp20.sys
0xF7846000 Fastfat.sys
0xF782F000 KSecDD.sys
0xF7400000 WudfPf.sys
0xF795A000 NDIS.sys
0xF7B74000 timntr.sys
0xF7B1B000 tdrpman.sys
0xF7A30000 snapman.sys
0xF7A16000 Mup.sys
0xF7687000 \SystemRoot\system32\DRIVERS\intelppm.sys
0xBA55A000 \SystemRoot\system32\DRIVERS\ialmnt5.sys
0xBA546000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
0xF7737000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0xBA522000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0xF773F000 \SystemRoot\system32\DRIVERS\usbehci.sys
0xBA4FA000 \SystemRoot\system32\DRIVERS\e100b325.sys
0xBA4A5000 \SystemRoot\system32\DRIVERS\es56tpi.sys
0xF7747000 \SystemRoot\System32\Drivers\Modem.SYS
0xF774F000 \SystemRoot\system32\DRIVERS\fdc.sys
0xF7697000 \SystemRoot\system32\DRIVERS\serial.sys
0xBA728000 \SystemRoot\system32\DRIVERS\serenum.sys
0xBA491000 \SystemRoot\system32\DRIVERS\parport.sys
0xF76A7000 \SystemRoot\system32\DRIVERS\cdrom.sys
0xF76B7000 \SystemRoot\system32\DRIVERS\redbook.sys
0xBA46E000 \SystemRoot\system32\DRIVERS\ks.sys
0xF7757000 \SystemRoot\System32\Drivers\GEARAspiWDM.sys
0xF76C7000 \SystemRoot\system32\DRIVERS\imapi.sys
0xBA3A6000 \SystemRoot\system32\drivers\cmuda.sys
0xBA382000 \SystemRoot\system32\drivers\portcls.sys
0xF76D7000 \SystemRoot\system32\drivers\drmk.sys
0xF7A9D000 \SystemRoot\system32\DRIVERS\audstub.sys
0xF798D000 \SystemRoot\System32\Drivers\RootMdm.sys
0xF76E7000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0xBA720000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0xBA36B000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0xF76F7000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0xF7587000 \SystemRoot\system32\DRIVERS\raspptp.sys
0xF775F000 \SystemRoot\system32\DRIVERS\TDI.SYS
0xF7767000 \SystemRoot\system32\DRIVERS\ptilink.sys
0xF776F000 \SystemRoot\system32\DRIVERS\raspti.sys
0xF7777000 \SystemRoot\system32\DRIVERS\RimSerial.sys
0xF7577000 \SystemRoot\system32\DRIVERS\termdd.sys
0xF777F000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0xF7787000 \SystemRoot\system32\DRIVERS\mouclass.sys
0xF798F000 \SystemRoot\system32\DRIVERS\swenum.sys
0xBA21D000 \SystemRoot\system32\DRIVERS\update.sys
0xBA714000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0xF7567000 \SystemRoot\system32\DRIVERS\zumbus.sys
0xF7557000 \SystemRoot\system32\DRIVERS\WDFLDR.SYS
0xBA1A1000 \SystemRoot\System32\Drivers\wdf01000.sys
0xF7547000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xF7527000 \SystemRoot\system32\DRIVERS\usbhub.sys
0xF7991000 \SystemRoot\system32\DRIVERS\USBD.SYS
0xF778F000 \SystemRoot\system32\DRIVERS\flpydisk.sys
0xF7993000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xF7A72000 \SystemRoot\System32\Drivers\Null.SYS
0xF7995000 \SystemRoot\System32\Drivers\Beep.SYS
0xF779F000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0xF77A7000 \SystemRoot\System32\drivers\vga.sys
0xF7997000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xF7999000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xF77AF000 \SystemRoot\System32\Drivers\Msfs.SYS
0xF77B7000 \SystemRoot\System32\Drivers\Npfs.SYS
0xBA6E4000 \SystemRoot\system32\DRIVERS\rasacd.sys
0xB20BC000 \SystemRoot\system32\DRIVERS\ipsec.sys
0xF74F7000 \SystemRoot\system32\DRIVERS\msgpc.sys
0xB2063000 \SystemRoot\system32\DRIVERS\tcpip.sys
0xB1FE4000 \SystemRoot\System32\Drivers\NAV\1107000.00C\SYMTDI.SYS
0xB1FBE000 \SystemRoot\system32\DRIVERS\ipnat.sys
0xBA7C8000 \SystemRoot\system32\DRIVERS\wanarp.sys
0xB1F99000 \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS
0xB1F44000 \??\C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_17.0.0.136\Definitions\IPSDefs\20100917.001\IDSxpx86.sys
0xB1F1C000 \SystemRoot\system32\DRIVERS\netbt.sys
0xB1EFA000 \SystemRoot\System32\drivers\afd.sys
0xBA7B8000 \SystemRoot\system32\DRIVERS\netbios.sys
0xB1E3B000 \SystemRoot\system32\drivers\NAV\1107000.00C\Ironx86.SYS
0xBA7A8000 \SystemRoot\system32\drivers\NAV\1107000.00C\SRTSPX.SYS
0xB1E10000 \SystemRoot\system32\DRIVERS\rdbss.sys
0xB1DA0000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xBA798000 \SystemRoot\System32\Drivers\Fips.SYS
0xB1D42000 \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys
0xB1D25000 \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys
0xB1CA6000 \SystemRoot\system32\drivers\NAV\1107000.00C\ccHPx86.sys
0xB1BFA000 \??\C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_17.0.0.136\Definitions\BASHDefs\20100901.003\BHDrvx86.sys
0xF77D7000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0xBA6C0000 \SystemRoot\system32\DRIVERS\usbscan.sys
0xF77DF000 \SystemRoot\system32\DRIVERS\usbprint.sys
0xF77E7000 \SystemRoot\system32\DRIVERS\HPZius12.sys
0xBA778000 \SystemRoot\system32\DRIVERS\HPZid412.sys
0xBA6B0000 \SystemRoot\system32\DRIVERS\HPZipr12.sys
0xBA6AC000 \SystemRoot\system32\DRIVERS\hidusb.sys
0xBA768000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0xBA6A8000 \SystemRoot\system32\DRIVERS\mouhid.sys
0xF77EF000 \SystemRoot\system32\DRIVERS\point32.sys
0xBA6A4000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0xBA748000 \SystemRoot\System32\Drivers\Cdfs.SYS
0xB1B6A000 \SystemRoot\System32\Drivers\dump_atapi.sys
0xF79A1000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
0xBF800000 \SystemRoot\System32\win32k.sys
0xB210F000 \SystemRoot\System32\drivers\Dxapi.sys
0xF77FF000 \SystemRoot\System32\watchdog.sys
0xBF000000 \SystemRoot\System32\drivers\dxg.sys
0xF7A98000 \SystemRoot\System32\drivers\dxgthk.sys
0xBF020000 \SystemRoot\System32\ialmdnt5.dll
0xBF012000 \SystemRoot\System32\ialmrnt5.dll
0xBF042000 \SystemRoot\System32\ialmdev5.DLL
0xBF077000 \SystemRoot\System32\ialmdd5.DLL
0xBFFA0000 \SystemRoot\System32\ATMFD.DLL
0xB1EEA000 \SystemRoot\system32\DRIVERS\tifsfilt.sys
0xB1A32000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0xB171D000 \SystemRoot\system32\drivers\wdmaud.sys
0xB186A000 \SystemRoot\system32\drivers\sysaudio.sys
0xB14C0000 \SystemRoot\system32\DRIVERS\mrxdav.sys
0xF79D9000 \SystemRoot\System32\Drivers\ParVdm.SYS
0xB136F000 \SystemRoot\system32\DRIVERS\srv.sys
0xB12C7000 \SystemRoot\system32\DRIVERS\secdrv.sys
0xB0BAE000 \SystemRoot\System32\Drivers\HTTP.sys
0xB0C7F000 \??\C:\Program Files\MSI\PC Alert 4\NTGLM7X.sys
0xB09EF000 \SystemRoot\System32\Drivers\NAV\1107000.00C\SRTSP.SYS
0xB0588000 \??\C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_17.0.0.136\Definitions\VirusDefs\20100918.003\NAVEX15.SYS
0xB0574000 \??\C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_17.0.0.136\Definitions\VirusDefs\20100918.003\NAVENG.SYS
0xB0492000 \??\C:\DOCUME~1\jschmitz\LOCALS~1\Temp\axloypow.sys
0xB0467000 \SystemRoot\system32\drivers\kmixer.sys
0x7C900000 \WINDOWS\System32\ntdll.dll

Processes (total 51):
0 System Idle Process
4 System
480 C:\WINDOWS\System32\smss.exe
536 csrss.exe
560 C:\WINDOWS\System32\winlogon.exe
604 C:\WINDOWS\System32\services.exe
616 C:\WINDOWS\System32\lsass.exe
764 C:\WINDOWS\System32\svchost.exe
824 svchost.exe
912 C:\WINDOWS\System32\svchost.exe
1012 C:\WINDOWS\System32\svchost.exe
1092 svchost.exe
1208 svchost.exe
1332 C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
1340 C:\WINDOWS\Explorer.EXE
1436 C:\WINDOWS\System32\spoolsv.exe
2028 svchost.exe
264 C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
300 C:\Program Files\Bonjour\mDNSResponder.exe
384 C:\Program Files\Java\jre6\bin\jqs.exe
976 C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe
988 C:\Program Files\Norton AntiVirus\Engine\17.7.0.12\ccSvcHst.exe
1088 C:\Program Files\Microsoft IntelliType Pro\itype.exe
1160 C:\Program Files\Microsoft IntelliPoint\ipoint.exe
1148 C:\Program Files\Common Files\Seagate\Schedule2\schedhlp.exe
1176 C:\WINDOWS\System32\igfxtray.exe
1232 C:\WINDOWS\System32\hkcmd.exe
1240 C:\WINDOWS\System32\igfxpers.exe
1284 C:\Program Files\iTunes\iTunesHelper.exe
1580 C:\WINDOWS\System32\ctfmon.exe
1652 C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
1688 C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe
1876 C:\Program Files\Common Files\Seagate\Schedule2\schedul2.exe
1932 C:\WINDOWS\System32\svchost.exe
924 C:\WINDOWS\System32\ZuneBusEnum.exe
2388 C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
2680 unsecapp.exe
2700 C:\Program Files\iPod\BIN\iPodService.exe
2880 wmiprvse.exe
2932 C:\WINDOWS\System32\HPZipm12.exe
2948 C:\Program Files\MSI\PC Alert 4\PCAlert4.exe
3168 alg.exe
3576 C:\Program Files\Norton AntiVirus\Engine\17.7.0.12\ccSvcHst.exe
1376 C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoSTS08.exe
2408 C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
2780 C:\Program Files\Mozilla Firefox\firefox.exe
2872 C:\WINDOWS\notepad.exe
2532 C:\WINDOWS\notepad.exe
1680 C:\WINDOWS\System32\NOTEPAD.EXE
2228 C:\WINDOWS\System32\wscntfy.exe
2832 C:\Documents and Settings\jschmitz\Desktop\MBRCheck.exe

\\.\C: –> \\.\PhysicalDrive1 at offset 0x00000000`00007e00 (FAT32)
\\.\F: –> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (FAT32)

PhysicalDrive1 Model Number: ST3500418AS, Rev: CC37
PhysicalDrive0 Model Number: IBM-DTLA-307030, Rev: TX4OA60A

Size Device Name MBR Status
——————————————–
465 GB \\.\PhysicalDrive1 Unknown MBR code
SHA1: 597401A4CE7D05F1E68A3BD6A0720148E5DB5F61
28 GB \\.\PhysicalDrive0 Unknown MBR code
SHA1: 597401A4CE7D05F1E68A3BD6A0720148E5DB5F61

Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:

Done!

Satchfan

Post #5September 21, 2010, 8:25 AM UTC

Jeff S Sorry for the late reply but had a bit of a mishap. I will be posting a full reply as soon as I have run it past an expert. Thanks Satchfan

Satchfan

Post #6September 21, 2010, 12:08 PM UTC

Hello again Jeff S

Thanks for your patience.

Update Java

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update to the latest version

Please download JavaRa to your desktop and unzip it to its own folder

Double-click on JavaRa.exe to start the program
From the drop-down menu, choose English or the appropriate language…and click on Select.
Click Remove Older Versions to remove the older versions of Java installed on your computer
Accept any prompts.
Open JavaRa.exe again and select Search For Updates.
Select Update Using Sun Java's Website then click Search and click on the Open Webpage button. Download and install the latest Java Runtime Environment (JRE) version for your computer.

Run OTL

Double click on the icon to run it.

Copy/paste ALL the following text written inside the code box into the Custom Scans/Fixes box located at the bottom of OTL

:Services :OTL SRV - (KodakCCS) – C:\WINDOWS\System32\drivers\KodakCCS.exe File not found O2 - BHO: (no name) - {671EB3E7-0955-03FE-2BB4-0495CBA2819E} - No CLSID value found. O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {C4069E3A-68F1-403E-B40E-20066696354B} - No CLSID value found O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [gcasServ] C:\Program Files\Microsoft AntiSpyware\gcasServ.exe File not found O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} Reg Error: Value error. (Reg Error: Key error.) O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} Reg Error: Value error. (Reg Error: Key error.) O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} Reg Error: Value error. (Reg Error: Key error.) O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} http://v4.windowsupdate.microsoft.com/CAB/…8146.8594328704 (Reg Error: Key error.) O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} Reg Error: Value error. (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0014-0002-0005-ABCDEFFEDCBA} Reg Error: Value error. (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Key error.) O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\SYSTEM\dajava.cab (Reg Error: Key error.) O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso4.cab (Reg Error: Key error.) O33 - MountPoints2\{4089a165-22ce-11de-a28f-000f9f4a4ab1}\Shell\AutoRun\command - "" = G:\setupSNK.exe – File not found O33 - MountPoints2\{4e171672-6c49-11dd-a26f-000f9f4a4ab1}\Shell - "" = AutoRun O33 - MountPoints2\{4e171672-6c49-11dd-a26f-000f9f4a4ab1}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{4e171672-6c49-11dd-a26f-000f9f4a4ab1}\Shell\AutoRun\command - "" = H:\LaunchU3.exe – File not found O33 - MountPoints2\{5e0ede48-4ac6-11dc-a1fa-000f9f4a4ab1}\Shell - "" = AutoRun O33 - MountPoints2\{5e0ede48-4ac6-11dc-a1fa-000f9f4a4ab1}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{5e0ede48-4ac6-11dc-a1fa-000f9f4a4ab1}\Shell\AutoRun\command - "" = F:\LaunchU3.exe – File not found O33 - MountPoints2\{a07bde95-9df2-11de-a2a4-000f9f4a4ab1}\Shell\AutoRun\command - "" = WD_Windows_Tools\Setup.exe O33 - MountPoints2\{a07bde96-9df2-11de-a2a4-000f9f4a4ab1}\Shell - "" = AutoRun O33 - MountPoints2\{a07bde96-9df2-11de-a2a4-000f9f4a4ab1}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{a07bde96-9df2-11de-a2a4-000f9f4a4ab1}\Shell\AutoRun\command - "" = H:\LaunchU3.exe – File not found [2005/02/23 09:33:26 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\x2ff [2008/01/02 11:34:28 | 000,016,100 | —- | M] () – C:\ComboFix.txt :Commands [purity] [emptytemp] [Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Then post the fix log with your next reply.

Double click on MBRCheck.exe to run it,

type in Y and press Enter when asked if you wish to see more options
Type in 1 to "Dump the MBR of a physical disk to file" and press Enter
Type in 0 to select your disk and press Enter
Type in dump.txt as the file name and press Enter
Type in -1 to exit and press Enter.

Please attach dump.txt to your next reply for me.

Download ComboFix from the following location:

Link

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
See this Link for programs that need to be disabled and instruction on how to disable them.
Remember to re-enable them when we're done.
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

Note: Do not mouse-click combofix's window while it is running. That may cause it to stall.

When finished, it will produce a log. Please include the ComboFix.txt in your next reply. It can be found at C:\ComboFix.txt

Logs to include in next post:

Fixlog.txt
Dump.txt
ComboFix.txt

Also, can you tell what make of computer you have

Thanks

Satchfan

Jeff S

Post #7September 24, 2010, 2:39 AM UTC

I am using a PC with an MSI Mainboard (MS 6743), Intel Celeron CPU (2.5GHz), 2GB RAM, and a 500GB hard drive. My OS is Windows XP. The logs you requested follow:

OTL Fixlog:

All processes killed
========== SERVICES/DRIVERS ==========
========== OTL ==========
Service KodakCCS stopped successfully!
Service KodakCCS deleted successfully!
File C:\WINDOWS\System32\drivers\KodakCCS.exe File not found not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{671EB3E7-0955-03FE-2BB4-0495CBA2819E}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{671EB3E7-0955-03FE-2BB4-0495CBA2819E}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\\{C4069E3A-68F1-403E-B40E-20066696354B} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C4069E3A-68F1-403E-B40E-20066696354B}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{EF99BD32-C1FB-11D2-892F-0090271D4F88} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\gcasServ deleted successfully.
Starting removal of ActiveX control {166B1BCA-3F9C-11CF-8075-444553540000}
Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{166B1BCA-3F9C-11CF-8075-444553540000}\DownloadInformation\\INF .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{166B1BCA-3F9C-11CF-8075-444553540000}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{166B1BCA-3F9C-11CF-8075-444553540000}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{166B1BCA-3F9C-11CF-8075-444553540000}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{166B1BCA-3F9C-11CF-8075-444553540000}\ not found.
Starting removal of ActiveX control {74D05D43-3236-11D4-BDCD-00C04F9A3B61}
Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{74D05D43-3236-11D4-BDCD-00C04F9A3B61}\DownloadInformation\\INF .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{74D05D43-3236-11D4-BDCD-00C04F9A3B61}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{74D05D43-3236-11D4-BDCD-00C04F9A3B61}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{74D05D43-3236-11D4-BDCD-00C04F9A3B61}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{74D05D43-3236-11D4-BDCD-00C04F9A3B61}\ not found.
Starting removal of ActiveX control {9A9307A0-7DA4-4DAF-B042-5009F29E09E1}
Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{9A9307A0-7DA4-4DAF-B042-5009F29E09E1}\DownloadInformation\\INF .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{9A9307A0-7DA4-4DAF-B042-5009F29E09E1}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9A9307A0-7DA4-4DAF-B042-5009F29E09E1}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9A9307A0-7DA4-4DAF-B042-5009F29E09E1}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9A9307A0-7DA4-4DAF-B042-5009F29E09E1}\ not found.
Starting removal of ActiveX control {9F1C11AA-197B-4942-BA54-47A8489BB47F}
C:\WINDOWS\Downloaded Program Files\iuctl.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{9F1C11AA-197B-4942-BA54-47A8489BB47F}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9F1C11AA-197B-4942-BA54-47A8489BB47F}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9F1C11AA-197B-4942-BA54-47A8489BB47F}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9F1C11AA-197B-4942-BA54-47A8489BB47F}\ not found.
Starting removal of ActiveX control {AB86CE53-AC9F-449F-9399-D8ABCA09EC09}
Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{AB86CE53-AC9F-449F-9399-D8ABCA09EC09}\DownloadInformation\\INF .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{AB86CE53-AC9F-449F-9399-D8ABCA09EC09}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AB86CE53-AC9F-449F-9399-D8ABCA09EC09}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{AB86CE53-AC9F-449F-9399-D8ABCA09EC09}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AB86CE53-AC9F-449F-9399-D8ABCA09EC09}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0014-0002-0005-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0014-0002-0005-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0005-ABCDEFFEDCBA}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0005-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0014-0002-0005-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0005-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
C:\WINDOWS\Downloaded Program Files\gp.inf not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
File Animation Java Classes file://C:\WINDOWS\SYSTEM\dajava.cab not found.
Starting removal of ActiveX control DirectAnimation Java Classes
Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\DirectAnimation Java Classes\DownloadInformation\\INF .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\DirectAnimation Java Classes\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\DirectAnimation Java Classes\ not found.
File oft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso4.cab not found.
Starting removal of ActiveX control Microsoft XML Parser for Java
Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Microsoft XML Parser for Java\DownloadInformation\\INF .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Microsoft XML Parser for Java\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Microsoft XML Parser for Java\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4089a165-22ce-11de-a28f-000f9f4a4ab1}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4089a165-22ce-11de-a28f-000f9f4a4ab1}\ not found.
File G:\setupSNK.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4e171672-6c49-11dd-a26f-000f9f4a4ab1}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4e171672-6c49-11dd-a26f-000f9f4a4ab1}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4e171672-6c49-11dd-a26f-000f9f4a4ab1}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4e171672-6c49-11dd-a26f-000f9f4a4ab1}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4e171672-6c49-11dd-a26f-000f9f4a4ab1}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4e171672-6c49-11dd-a26f-000f9f4a4ab1}\ not found.
File H:\LaunchU3.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5e0ede48-4ac6-11dc-a1fa-000f9f4a4ab1}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5e0ede48-4ac6-11dc-a1fa-000f9f4a4ab1}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5e0ede48-4ac6-11dc-a1fa-000f9f4a4ab1}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5e0ede48-4ac6-11dc-a1fa-000f9f4a4ab1}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5e0ede48-4ac6-11dc-a1fa-000f9f4a4ab1}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5e0ede48-4ac6-11dc-a1fa-000f9f4a4ab1}\ not found.
File F:\LaunchU3.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a07bde95-9df2-11de-a2a4-000f9f4a4ab1}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a07bde95-9df2-11de-a2a4-000f9f4a4ab1}\ not found.
File WD_Windows_Tools\Setup.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a07bde96-9df2-11de-a2a4-000f9f4a4ab1}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a07bde96-9df2-11de-a2a4-000f9f4a4ab1}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a07bde96-9df2-11de-a2a4-000f9f4a4ab1}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a07bde96-9df2-11de-a2a4-000f9f4a4ab1}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a07bde96-9df2-11de-a2a4-000f9f4a4ab1}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a07bde96-9df2-11de-a2a4-000f9f4a4ab1}\ not found.
File H:\LaunchU3.exe not found.
C:\Documents and Settings\All Users\Application Data\x2ff folder moved successfully.
C:\ComboFix.txt moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Default User
->Flash cache emptied: 83 bytes

User: All Users
->Temp folder emptied: 125 bytes

User: jschmitz
->Java cache emptied: 1699903 bytes
->FireFox cache emptied: 37518600 bytes
->Apple Safari cache emptied: 0 bytes
->Flash cache emptied: 67945 bytes

User: sschm000

User: NetworkService

User: LocalService

User: Administrator

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 2187487 bytes
%systemroot%\System32 .tmp files removed: 56408875 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 8306396 bytes
Session Manager Temp folder emptied: 16384 bytes
Session Manager Tmp folder emptied: 16384 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 64485860 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 80701735 bytes

Total Files Cleaned = 240.00 mb

OTL by OldTimer - Version 3.2.12.1 log created on 09212010_195344

Files\Folders moved on Reboot…
File\Folder C:\WINDOWS\temp\Perflib_Perfdata_3dc.dat not found!

Registry entries deleted on Reboot…

MBRCheck dump.txt

MBRCheck, version 1.2.3
© 2010, AD

Command-line:
Windows Version: Windows XP Home Edition
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x0000003d

Kernel Drivers (total 146):
0x804D7000 \WINDOWS\system32\ntoskrnl.exe
0x806EE000 \WINDOWS\system32\hal.dll
0xF7987000 \WINDOWS\system32\KDCOM.DLL
0xF7897000 \WINDOWS\system32\BOOTVID.dll
0xF75A8000 ACPI.sys
0xF7989000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
0xF7597000 pci.sys
0xF75F7000 isapnp.sys
0xF7A4F000 pciide.sys
0xF7707000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
0xF798B000 intelide.sys
0xF7607000 MountMgr.sys
0xF74D8000 ftdisk.sys
0xF770F000 PartMgr.sys
0xF7617000 VolSnap.sys
0xF74C0000 atapi.sys
0xF749B000 tffsport.sys
0xF7627000 disk.sys
0xF7637000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
0xF747B000 fltmgr.sys
0xF7425000 SYMDS.SYS
0xF7413000 sr.sys
0xF7647000 Lbd.sys
0xF786A000 SYMEFA.SYS
0xF7657000 PxHelp20.sys
0xF7846000 Fastfat.sys
0xF782F000 KSecDD.sys
0xF7400000 WudfPf.sys
0xF795A000 NDIS.sys
0xF7B74000 timntr.sys
0xF7B1B000 tdrpman.sys
0xF7A30000 snapman.sys
0xF7A16000 Mup.sys
0xF7687000 \SystemRoot\system32\DRIVERS\intelppm.sys
0xBA55A000 \SystemRoot\system32\DRIVERS\ialmnt5.sys
0xBA546000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
0xF7737000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0xBA522000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0xF773F000 \SystemRoot\system32\DRIVERS\usbehci.sys
0xBA4FA000 \SystemRoot\system32\DRIVERS\e100b325.sys
0xBA4A5000 \SystemRoot\system32\DRIVERS\es56tpi.sys
0xF7747000 \SystemRoot\System32\Drivers\Modem.SYS
0xF774F000 \SystemRoot\system32\DRIVERS\fdc.sys
0xF7697000 \SystemRoot\system32\DRIVERS\serial.sys
0xBA728000 \SystemRoot\system32\DRIVERS\serenum.sys
0xBA491000 \SystemRoot\system32\DRIVERS\parport.sys
0xF76A7000 \SystemRoot\system32\DRIVERS\cdrom.sys
0xF76B7000 \SystemRoot\system32\DRIVERS\redbook.sys
0xBA46E000 \SystemRoot\system32\DRIVERS\ks.sys
0xF7757000 \SystemRoot\System32\Drivers\GEARAspiWDM.sys
0xF76C7000 \SystemRoot\system32\DRIVERS\imapi.sys
0xBA3A6000 \SystemRoot\system32\drivers\cmuda.sys
0xBA382000 \SystemRoot\system32\drivers\portcls.sys
0xF76D7000 \SystemRoot\system32\drivers\drmk.sys
0xF7A9D000 \SystemRoot\system32\DRIVERS\audstub.sys
0xF798D000 \SystemRoot\System32\Drivers\RootMdm.sys
0xF76E7000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0xBA720000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0xBA36B000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0xF76F7000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0xF7587000 \SystemRoot\system32\DRIVERS\raspptp.sys
0xF775F000 \SystemRoot\system32\DRIVERS\TDI.SYS
0xF7767000 \SystemRoot\system32\DRIVERS\ptilink.sys
0xF776F000 \SystemRoot\system32\DRIVERS\raspti.sys
0xF7777000 \SystemRoot\system32\DRIVERS\RimSerial.sys
0xF7577000 \SystemRoot\system32\DRIVERS\termdd.sys
0xF777F000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0xF7787000 \SystemRoot\system32\DRIVERS\mouclass.sys
0xF798F000 \SystemRoot\system32\DRIVERS\swenum.sys
0xBA21D000 \SystemRoot\system32\DRIVERS\update.sys
0xBA714000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0xF7567000 \SystemRoot\system32\DRIVERS\zumbus.sys
0xF7557000 \SystemRoot\system32\DRIVERS\WDFLDR.SYS
0xBA1A1000 \SystemRoot\System32\Drivers\wdf01000.sys
0xF7547000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xF7527000 \SystemRoot\system32\DRIVERS\usbhub.sys
0xF7991000 \SystemRoot\system32\DRIVERS\USBD.SYS
0xF778F000 \SystemRoot\system32\DRIVERS\flpydisk.sys
0xF7993000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xF7A74000 \SystemRoot\System32\Drivers\Null.SYS
0xF7995000 \SystemRoot\System32\Drivers\Beep.SYS
0xF779F000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0xF77A7000 \SystemRoot\System32\drivers\vga.sys
0xF7997000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xF7999000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xF77AF000 \SystemRoot\System32\Drivers\Msfs.SYS
0xF77B7000 \SystemRoot\System32\Drivers\Npfs.SYS
0xBA6E4000 \SystemRoot\system32\DRIVERS\rasacd.sys
0xB20BC000 \SystemRoot\system32\DRIVERS\ipsec.sys
0xF74F7000 \SystemRoot\system32\DRIVERS\msgpc.sys
0xB2063000 \SystemRoot\system32\DRIVERS\tcpip.sys
0xB1FE4000 \SystemRoot\System32\Drivers\NAV\1108000.005\SYMTDI.SYS
0xB1FBE000 \SystemRoot\system32\DRIVERS\ipnat.sys
0xBA7C8000 \SystemRoot\system32\DRIVERS\wanarp.sys
0xB1F99000 \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS
0xB1F1C000 \SystemRoot\system32\DRIVERS\netbt.sys
0xB1EFA000 \SystemRoot\System32\drivers\afd.sys
0xBA7B8000 \SystemRoot\system32\DRIVERS\netbios.sys
0xB1E3B000 \SystemRoot\system32\drivers\NAV\1108000.005\Ironx86.SYS
0xBA7A8000 \SystemRoot\system32\drivers\NAV\1108000.005\SRTSPX.SYS
0xB1E10000 \SystemRoot\system32\DRIVERS\rdbss.sys
0xF77C7000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0xB1DA0000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xBA798000 \SystemRoot\System32\Drivers\Fips.SYS
0xB1D42000 \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys
0xB1D25000 \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys
0xB1CA6000 \SystemRoot\system32\drivers\NAV\1108000.005\ccHPx86.sys
0xB1BFA000 \??\C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_17.0.0.136\Definitions\BASHDefs\20100901.003\BHDrvx86.sys
0xBA6C8000 \SystemRoot\system32\DRIVERS\usbscan.sys
0xF77D7000 \SystemRoot\system32\DRIVERS\usbprint.sys
0xF77DF000 \SystemRoot\system32\DRIVERS\HPZius12.sys
0xBA778000 \SystemRoot\system32\DRIVERS\HPZid412.sys
0xBA6BC000 \SystemRoot\system32\DRIVERS\HPZipr12.sys
0xBA6AC000 \SystemRoot\system32\DRIVERS\hidusb.sys
0xBA768000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0xBA6A8000 \SystemRoot\system32\DRIVERS\mouhid.sys
0xF77EF000 \SystemRoot\system32\DRIVERS\point32.sys
0xBA6A4000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0xBA758000 \SystemRoot\System32\Drivers\Cdfs.SYS
0xB1B6A000 \SystemRoot\System32\Drivers\dump_atapi.sys
0xF79C5000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
0xBF800000 \SystemRoot\System32\win32k.sys
0xB1BEA000 \SystemRoot\System32\drivers\Dxapi.sys
0xF7797000 \SystemRoot\System32\watchdog.sys
0xBF000000 \SystemRoot\System32\drivers\dxg.sys
0xF7AAF000 \SystemRoot\System32\drivers\dxgthk.sys
0xBF020000 \SystemRoot\System32\ialmdnt5.dll
0xBF012000 \SystemRoot\System32\ialmrnt5.dll
0xBF042000 \SystemRoot\System32\ialmdev5.DLL
0xBF077000 \SystemRoot\System32\ialmdd5.DLL
0xBFFA0000 \SystemRoot\System32\ATMFD.DLL
0xB1EEA000 \SystemRoot\system32\DRIVERS\tifsfilt.sys
0xB1A1C000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0xB16D7000 \SystemRoot\system32\drivers\wdmaud.sys
0xB1964000 \SystemRoot\system32\drivers\sysaudio.sys
0xB14A2000 \SystemRoot\system32\DRIVERS\mrxdav.sys
0xF79F5000 \SystemRoot\System32\Drivers\ParVdm.SYS
0xB135B000 \SystemRoot\system32\DRIVERS\srv.sys
0xB11B9000 \SystemRoot\system32\DRIVERS\secdrv.sys
0xB0AF0000 \SystemRoot\System32\Drivers\HTTP.sys
0xB0A21000 \SystemRoot\System32\Drivers\NAV\1108000.005\SRTSP.SYS
0xB0D39000 \??\C:\Program Files\MSI\PC Alert 4\NTGLM7X.sys
0xB068C000 \??\C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_17.0.0.136\Definitions\IPSDefs\20100923.001\IDSxpx86.sys
0xB0540000 \??\C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_17.0.0.136\Definitions\VirusDefs\20100923.022\NAVEX15.SYS
0xB052C000 \??\C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_17.0.0.136\Definitions\VirusDefs\20100923.022\NAVENG.SYS
0x7C900000 \WINDOWS\System32\ntdll.dll

Processes (total 50):
0 System Idle Process
4 System
480 C:\WINDOWS\System32\smss.exe
536 csrss.exe
560 C:\WINDOWS\System32\WINLOGON.EXE
604 C:\WINDOWS\System32\SERVICES.EXE
616 C:\WINDOWS\System32\LSASS.EXE
764 C:\WINDOWS\System32\SVCHOST.EXE
812 SVCHOST.EXE
896 C:\WINDOWS\System32\SVCHOST.EXE
968 C:\WINDOWS\System32\SVCHOST.EXE
1088 SVCHOST.EXE
1152 SVCHOST.EXE
1300 C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
1336 C:\WINDOWS\EXPLORER.EXE
1460 C:\WINDOWS\System32\spoolsv.exe
2016 SVCHOST.EXE
228 C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
264 C:\Program Files\Bonjour\mDNSResponder.exe
312 C:\Program Files\Java\jre6\bin\jqs.exe
440 C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe
500 C:\Program Files\Norton AntiVirus\Engine\17.8.0.5\ccSvcHst.exe
496 C:\Program Files\Microsoft IntelliType Pro\itype.exe
512 C:\Program Files\Microsoft IntelliPoint\ipoint.exe
864 C:\Program Files\Common Files\Seagate\Schedule2\schedhlp.exe
924 C:\WINDOWS\System32\igfxtray.exe
980 C:\WINDOWS\System32\hkcmd.exe
948 C:\WINDOWS\System32\igfxpers.exe
1024 C:\Program Files\iTunes\iTunesHelper.exe
1176 C:\Program Files\QuickTime\QTTask.exe
1236 C:\Program Files\Common Files\Java\Java Update\jusched.exe
1256 C:\WINDOWS\System32\ctfmon.exe
1484 C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
1568 C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe
1792 C:\Program Files\Common Files\Seagate\Schedule2\schedul2.exe
1840 C:\WINDOWS\System32\SVCHOST.EXE
1888 C:\WINDOWS\System32\ZuneBusEnum.exe
2128 C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
2508 C:\Program Files\iPod\BIN\iPodService.exe
2528 unsecapp.exe
2700 wmiprvse.exe
2980 C:\WINDOWS\System32\HPZipm12.exe
3120 alg.exe
3220 C:\Program Files\Norton AntiVirus\Engine\17.8.0.5\ccSvcHst.exe
3340 C:\Program Files\MSI\PC Alert 4\PCAlert4.exe
1776 C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoSTS08.exe
2596 C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
3304 C:\Program Files\Internet Explorer\iexplore.exe
3508 C:\Program Files\Internet Explorer\iexplore.exe
3908 C:\Documents and Settings\jschmitz\Desktop\AntiSpy\MBRCheck.exe

\\.\C: –> \\.\PhysicalDrive1 at offset 0x00000000`00007e00 (FAT32)
\\.\F: –> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (FAT32)

PhysicalDrive1 Model Number: ST3500418AS, Rev: CC37
PhysicalDrive0 Model Number: IBM-DTLA-307030, Rev: TX4OA60A

Size Device Name MBR Status
——————————————–
465 GB \\.\PhysicalDrive1 Unknown MBR code
SHA1: 597401A4CE7D05F1E68A3BD6A0720148E5DB5F61
28 GB \\.\PhysicalDrive0 Unknown MBR code
SHA1: 597401A4CE7D05F1E68A3BD6A0720148E5DB5F61

Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:
Options:
[1] Dump the MBR of a physical disk to file.
[2] Restore the MBR of a physical disk with a standard boot code.
[3] Exit.

Enter your choice: Enter the physical disk number to dump (0-99, -1 to exit): 0Dumping \\.\PhysicalDisk0…
Enter filename to dump to: dump.txtDumped successfully!

Enter the physical disk number to dump (0-99, -1 to exit): -1

Done!

Combofix Log

ComboFix 10-09-23.01 - jschmitz 09/23/2010 18:53:32.4.1 - FAT32x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3063.2404 [GMT -7:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: Norton AntiVirus *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
.

((((((((((((((((((((((((( Files Created from 2010-08-24 to 2010-09-24 )))))))))))))))))))))))))))))))
.

2010-09-22 02:53 . 2010-09-22 02:53 ——– d—–w- C:\_OTL
2010-09-22 02:49 . 2010-09-22 02:49 503808 —-a-w- c:\documents and settings\jschmitz\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-66d84ef1-n\msvcp71.dll
2010-09-22 02:49 . 2010-09-22 02:49 61440 —-a-w- c:\documents and settings\jschmitz\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-31ed7c9e-n\decora-sse.dll
2010-09-22 02:49 . 2010-09-22 02:49 499712 —-a-w- c:\documents and settings\jschmitz\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-66d84ef1-n\jmc.dll
2010-09-22 02:49 . 2010-09-22 02:49 348160 —-a-w- c:\documents and settings\jschmitz\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-66d84ef1-n\msvcr71.dll
2010-09-22 02:49 . 2010-09-22 02:49 12800 —-a-w- c:\documents and settings\jschmitz\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-31ed7c9e-n\decora-d3d.dll
2010-09-22 02:48 . 2010-09-22 02:48 423656 —-a-w- c:\windows\system32\deployJava1.dll
2010-09-16 00:31 . 2010-09-16 00:31 388096 —-a-r- c:\documents and settings\jschmitz\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-20 14:24 . 2009-11-01 20:22 95024 —-a-w- c:\windows\system32\drivers\SBREDrv.sys
2010-09-20 14:23 . 2009-11-01 20:22 64288 —-a-w- c:\windows\system32\drivers\Lbd.sys
2010-08-17 13:17 . 2005-02-23 16:02 58880 —-a-w- c:\windows\system32\spoolsv.exe
2010-08-12 03:59 . 2010-08-12 03:54 19558 —-a-w- c:\windows\hpoins01.dat
2010-08-12 03:57 . 2010-08-12 03:57 ——– d—–w- c:\program files\Common Files\Hewlett-Packard
2010-08-12 03:04 . 2010-08-12 03:04 10134 —-a-r- c:\documents and settings\jschmitz\Application Data\Microsoft\Installer\{4CCC7F68-A437-4559-A840-F5E010934951}\ARPPRODUCTICON.exe
2010-08-12 02:55 . 2010-08-12 02:55 10134 —-a-r- c:\documents and settings\jschmitz\Application Data\Microsoft\Installer\{CAE7D1D9-3794-4169-B4DD-964ADBC534EE}\ARPPRODUCTICON.exe
2010-07-22 15:49 . 2005-02-23 16:01 590848 —-a-w- c:\windows\system32\rpcrt4.dll
2010-07-22 05:57 . 2009-04-15 01:03 5120 —-a-w- c:\windows\system32\xpsp4res.dll
2010-06-30 12:31 . 2005-02-23 16:01 149504 —-a-w- c:\windows\system32\schannel.dll
2005-02-21 19:27 . 2001-03-04 05:04 23357 —h–w- c:\program files\folder.htt
2003-12-31 21:38 . 2003-12-31 21:38 203189 —-a-w- c:\program files\spampal-1.53-binaries.zip
2003-10-24 19:15 . 2003-10-24 19:15 427303 —-a-w- c:\program files\spampal-beta-1.52.exe
2003-10-24 19:07 . 2003-10-24 19:07 582937 —-a-w- c:\program files\spampal-1.50.exe
2004-11-18 05:12 . 2004-11-18 05:12 8 –sh–w- c:\windows\DRM\pdrm.dat
2009-01-14 01:18 . 2009-01-14 01:18 0 –sha-w- c:\windows\DRM\Cache\Indiv01.tmp
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb07.exe" [2002-12-04 188416]
"itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2006-11-22 813912]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2007-02-05 849280]
"Seagate Scheduler2 Service"="c:\program files\Common Files\Seagate\Schedule2\schedhlp.exe" [2008-06-25 136472]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-09-20 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-09-20 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-09-20 114688]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-10-29 141600]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-09-05 417792]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
PC Alert 4.lnk - c:\program files\MSI\PC Alert 4\StartPCAlert4.exe [2009-6-6 188416]
hpoddt01.exe.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe [2002-12-2 40960]
officejet 6100.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe [2003-4-9 147456]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
""= 00000000

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
""= 00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Cmaudio
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UserFaultCheck

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AcronisTimounterMonitor]
2008-06-25 03:06 904768 —-a-w- c:\program files\Seagate\DiscWizard\TimounterMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-06-20 02:04 35760 —-a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DiscWizardMonitor.exe]
2008-06-25 02:52 1325848 —-a-w- c:\program files\Seagate\DiscWizard\DiscWizardMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-09-05 08:54 417792 —-a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
2009-03-05 23:07 2260480 –sha-r- c:\program files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"SpybotSD TeaTimer"=c:\program files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\setup\disabledrunkeys]
"pccguide.exe"="c:\program files\Trend Micro\Internet Security\pccguide.exe"
"PCCIOMON.exe"="c:\program files\Trend Micro\Internet Security\PCCIOMON.exe"
"PCClient.exe"="c:\program files\Trend Micro\Internet Security\PCClient.exe"
"TM Outbreak Agent"="c:\program files\Trend Micro\Internet Security\TMOAgent.exe" /run
"IgfxTray"=c:\windows\SYSTEM32\IGFXTRAY.EXE
"HotKeysCmds"=c:\windows\SYSTEM32\HKCMD.EXE
"Cmaudio"=RunDll32 cmicnfg.cpl,CMICtrlWnd
"HPDJ Taskbar Utility"=c:\windows\SYSTEM32\hpztsb08.exe
"HP Software Update"=c:\program files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
"DeviceDiscovery"=c:\program files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
"EssSpkPhone"=essspk.exe
"LoadPowerProfile"=Rundll32.exe powrprof.dll,LoadCurrentPwrScheme

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\MSI\\i-Speeder\\i-Speeder.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundTimestampRequest"= 1 (0x1)
"AllowInboundMaskRequest"= 1 (0x1)
"AllowInboundRouterRequest"= 1 (0x1)
"AllowOutboundDestinationUnreachable"= 1 (0x1)
"AllowOutboundSourceQuench"= 1 (0x1)
"AllowOutboundParameterProblem"= 1 (0x1)
"AllowOutboundTimeExceeded"= 1 (0x1)
"AllowRedirect"= 1 (0x1)
"AllowOutboundPacketTooBig"= 1 (0x1)

R0 Lbd;Lbd;c:\windows\SYSTEM32\DRIVERS\Lbd.sys [11/1/2009 1:22 PM 64288]
R0 SymDS;Symantec Data Store;c:\windows\SYSTEM32\DRIVERS\NAV\1108000.005\symds.sys [9/21/2010 1:21 PM 328752]
R0 SymEFA;Symantec Extended File Attributes;c:\windows\SYSTEM32\DRIVERS\NAV\1108000.005\symefa.sys [9/21/2010 1:21 PM 173104]
R0 tffsport;M-Systems DiskOnChip 2000;c:\windows\SYSTEM32\DRIVERS\tffsport.sys [3/8/2009 11:26 PM 149376]
R1 BHDrvx86;BHDrvx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_17.0.0.136\Definitions\BASHDefs\20100901.003\BHDrvx86.sys [8/31/2010 3:57 PM 692272]
R1 ccHP;Symantec Hash Provider;c:\windows\SYSTEM32\DRIVERS\NAV\1108000.005\cchpx86.sys [9/21/2010 1:21 PM 501888]
R1 SymIRON;Symantec Iron Driver;c:\windows\SYSTEM32\DRIVERS\NAV\1108000.005\ironx86.sys [9/21/2010 1:21 PM 116784]
R2 NAV;Norton AntiVirus;c:\program files\Norton AntiVirus\Engine\17.8.0.5\ccsvchst.exe [9/21/2010 1:21 PM 126392]
R2 SgtSch2Svc;Seagate Scheduler2 Service;c:\program files\Common Files\Seagate\Schedule2\schedul2.exe [6/24/2008 7:56 PM 431384]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [9/14/2010 10:54 PM 102448]
R3 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_17.0.0.136\Definitions\IPSDefs\20100923.001\IDSXpx86.sys [9/23/2010 3:55 PM 331640]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [9/24/2009 3:17 AM 1352832]
S3 FLASHSYS;FLASHSYS;c:\program files\MSI\Live Update 4\LU4\FlashSys.sys [11/11/2009 1:22 PM 9216]
S4 PCPitstop Scheduling;PCPitstop Scheduling;c:\program files\PCPitstop\PCPitstopScheduleService.exe [11/5/2009 10:27 PM 85504]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
2008-04-14 00:12 73216 —-a-w- c:\program files\Outlook Express\setup50.exe

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
2008-04-14 00:12 73216 —-a-w- c:\program files\Outlook Express\setup50.exe

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
2008-04-14 00:12 73216 —-a-w- c:\program files\Outlook Express\setup50.exe

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
2008-04-14 00:12 73216 —-a-w- c:\program files\Outlook Express\setup50.exe

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9EF0045A-CDD9-438e-95E6-02B9AFEC8E11}]
2001-03-23 23:17 7168 ——w- c:\windows\SYSTEM32\updcrl.exe
.
Contents of the 'Scheduled Tasks' folder

2010-09-24 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 14:23]

2010-09-16 c:\windows\Tasks\FRU Task 2003-04-10 00:56ewlett-Packard2003-04-10 00:56p officejet 6100 series272A572217594EBCF1CEE215E352B92AD073FDE4281585584.job
- c:\program files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe [2003-04-10 00:56]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search/msie?p={searchTerms}&ei=UTF-8
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = 127.0.0.1;*.local
IE: &AIM Search - c:\progra~1\AIMTOO~1\AIMBAR.DLL/aimsearch.htm
IE: Add to AD Black List
IE: Block All Images from the Same Server
IE: Highlight
IE: Open All Links in This Page…
IE: Search
Trusted Zone: k12.ca.us\owa.vusd
DPF: {A82C3A33-5C0E-466C-B020-71585433A7E4} - hxxps://mycampus.phoenix.edu/secure/PhxStudent15.CAB
DPF: {BEA7310D-06C4-4339-A784-DC3804819809} - hxxp://www.cvsphoto.com/upload/activex/v3_0_0_7/PhotoCenter_ActiveX_Control.cab
FF - ProfilePath -
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - ORPHANS REMOVED - - - -

MSConfigStartUp-CTFMON - (no file)
MSConfigStartUp-updateMgr - c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe
AddRemove-Adobe Acrobat 4.0 - c:\program files\Common Files\Adobe\Acrobat 4.0\98\Uninst.isu
AddRemove-Creative Keytar - c:\program files\Creative\SBLive\Keytar\Keytar.isu
AddRemove-Creative MiniDisc Center - c:\program files\Creative\SBLive\PlayCenter\MDC.isu
AddRemove-Creative Restore Defaults - c:\program files\Creative\SBLive\Restore.isu
AddRemove-Creative Rhythmania - c:\program files\Creative\SBLive\Creative Rhythmania\Rhythm.isu
AddRemove-Creative WaveStudio - c:\program files\Creative\SBLive\Wstudio.isu
AddRemove-ESSMDM - c:\windows\remvdsi
AddRemove-Midi Samples - c:\program files\Creative\SBLive\Midi.isu
AddRemove-Sound Blaster Live! Experience - c:\program files\Creative\SBLive\SBLiveXP.isu
AddRemove-SoundFont Banks - c:\program files\Creative\SBLive\SoundFont.isu
AddRemove-Universal Media Player - c:\program files\LocalAutorun\Uninst.isu
AddRemove-Vienna SoundFont Studio - c:\program files\Creative\SBLive\Vienna\vienna.isu
AddRemove-WinMX - c:\program files\WinMX\Uninst.isu

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-09-23 19:03
Windows 5.1.2600 Service Pack 3 FAT NTAPI

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NAV]
"ImagePath"="\"c:\program files\Norton AntiVirus\Engine\17.8.0.5\ccSvcHst.exe\" /s \"NAV\" /m \"c:\program files\Norton AntiVirus\Engine\17.8.0.5\diMaster.dll\" /prefetch:1"
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\$$$\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'lsass.exe'(616)
c:\windows\system32\relog_ap.dll

- - - - - - - > 'explorer.exe'(3264)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2010-09-23 19:08:52
ComboFix-quarantined-files.txt 2010-09-24 02:08

Pre-Run: 462,561,247,232 bytes free
Post-Run: 462,728,101,888 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout = 30
default = multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS = "Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

- - End Of File - - 38B1F3DDC0102F5FE4D1439FC8DE1748

Satchfan

Post #8September 26, 2010, 6:49 PM UTC

Jeff S

I don’t see any malware but I’d like another couple of MBR checks and an online scan, just to be sure.

Please run this twice, once for each drive, (C:\ and F:\).

Double click on MBRCheck.exe to run it,

type in Y and press Enter when asked if you wish to see more options
Type in 1 to "Dump the MBR of a physical disk to file" and press Enter
Type in 0 to select your disk and press Enter
Type in dump.txt as the file name and press Enter
Type in -1 to exit and press Enter.

Please repeat the above instructions but this time, type in 1 to select your disk and name the new file as dump2.txt.

Please attach both dump.txt files to your next reply.

Run an on-line scan with Kaspersky

Using Internet Explorer or Firefox, visit Kaspersky On-line Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.
2. To optimize scanning time and produce a more sensible report for review:

Close any open programs
Turn off the real time scanner of any existing antivirus program while performing the online scan

3. Click Run at the Security prompt.

The program will then begin downloading and installing and will also update the database.
Please be patient as this can take several minutes.

Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
Click View scan report at the bottom.

[external image: Posted Image]
Click the Save as Text button to save the file to your desktop so that you may post it in your next reply

Thanks

Satchfan

Jeff S

Post #9September 29, 2010, 3:36 AM UTC

Thanks for your assistance up to this point. I'm not sure what you're going to see in the following logs, but here are the persisting issues I have:

1) Browsing remains sluggish.
2) Whenever I reboot, Windows wants to check C:/ and F:/ for errors. This scan takes about 2 hours before Windows finally starts.
3) Whenever I try to open Firefox,(even after rebooting), the follwoing message appears: "Firefox is already running, but is not responding. To open a new window, you must first close the existing Firefox process, or restart your system".
4) I am using a wireless router which needs to be reset frequently (daily) for my laptop to be able to connect.

I'm not sure if any of these maladies are interconnected in some way, or if I'm in the right forum to address them all, but I thought you should be aware of the big picture.

Here are the logs you requested:

dump.txt

MBRCheck, version 1.2.3
© 2010, AD

Command-line:
Windows Version: Windows XP Home Edition
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x0000003d

Kernel Drivers (total 149):
0x804D7000 \WINDOWS\system32\ntoskrnl.exe
0x806EE000 \WINDOWS\system32\hal.dll
0xF7987000 \WINDOWS\system32\KDCOM.DLL
0xF7897000 \WINDOWS\system32\BOOTVID.dll
0xF75A8000 ACPI.sys
0xF7989000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
0xF7597000 pci.sys
0xF75F7000 isapnp.sys
0xF7A4F000 pciide.sys
0xF7707000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
0xF798B000 intelide.sys
0xF7607000 MountMgr.sys
0xF74D8000 ftdisk.sys
0xF770F000 PartMgr.sys
0xF7617000 VolSnap.sys
0xF74C0000 atapi.sys
0xF749B000 tffsport.sys
0xF7627000 disk.sys
0xF7637000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
0xF747B000 fltmgr.sys
0xF7425000 SYMDS.SYS
0xF7413000 sr.sys
0xF7647000 Lbd.sys
0xF786A000 SYMEFA.SYS
0xF7657000 PxHelp20.sys
0xF7846000 Fastfat.sys
0xF782F000 KSecDD.sys
0xF7400000 WudfPf.sys
0xF795A000 NDIS.sys
0xF7B74000 timntr.sys
0xF7B1B000 tdrpman.sys
0xF7A30000 snapman.sys
0xF7A16000 Mup.sys
0xF7687000 \SystemRoot\system32\DRIVERS\intelppm.sys
0xBA55A000 \SystemRoot\system32\DRIVERS\ialmnt5.sys
0xBA546000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
0xF7737000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0xBA522000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0xF773F000 \SystemRoot\system32\DRIVERS\usbehci.sys
0xBA4FA000 \SystemRoot\system32\DRIVERS\e100b325.sys
0xBA4A5000 \SystemRoot\system32\DRIVERS\es56tpi.sys
0xF7747000 \SystemRoot\System32\Drivers\Modem.SYS
0xF774F000 \SystemRoot\system32\DRIVERS\fdc.sys
0xF7697000 \SystemRoot\system32\DRIVERS\serial.sys
0xBA728000 \SystemRoot\system32\DRIVERS\serenum.sys
0xBA491000 \SystemRoot\system32\DRIVERS\parport.sys
0xF76A7000 \SystemRoot\system32\DRIVERS\cdrom.sys
0xF76B7000 \SystemRoot\system32\DRIVERS\redbook.sys
0xBA46E000 \SystemRoot\system32\DRIVERS\ks.sys
0xF7757000 \SystemRoot\System32\Drivers\GEARAspiWDM.sys
0xF76C7000 \SystemRoot\system32\DRIVERS\imapi.sys
0xBA3A6000 \SystemRoot\system32\drivers\cmuda.sys
0xBA382000 \SystemRoot\system32\drivers\portcls.sys
0xF76D7000 \SystemRoot\system32\drivers\drmk.sys
0xF7A9D000 \SystemRoot\system32\DRIVERS\audstub.sys
0xF798D000 \SystemRoot\System32\Drivers\RootMdm.sys
0xF76E7000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0xBA720000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0xBA36B000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0xF76F7000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0xF7587000 \SystemRoot\system32\DRIVERS\raspptp.sys
0xF775F000 \SystemRoot\system32\DRIVERS\TDI.SYS
0xF7767000 \SystemRoot\system32\DRIVERS\ptilink.sys
0xF776F000 \SystemRoot\system32\DRIVERS\raspti.sys
0xF7777000 \SystemRoot\system32\DRIVERS\RimSerial.sys
0xF7577000 \SystemRoot\system32\DRIVERS\termdd.sys
0xF777F000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0xF7787000 \SystemRoot\system32\DRIVERS\mouclass.sys
0xF798F000 \SystemRoot\system32\DRIVERS\swenum.sys
0xBA21D000 \SystemRoot\system32\DRIVERS\update.sys
0xBA714000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0xF7567000 \SystemRoot\system32\DRIVERS\zumbus.sys
0xF7557000 \SystemRoot\system32\DRIVERS\WDFLDR.SYS
0xBA1A1000 \SystemRoot\System32\Drivers\wdf01000.sys
0xF7547000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xF7527000 \SystemRoot\system32\DRIVERS\usbhub.sys
0xF7991000 \SystemRoot\system32\DRIVERS\USBD.SYS
0xF778F000 \SystemRoot\system32\DRIVERS\flpydisk.sys
0xF7993000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xF7A74000 \SystemRoot\System32\Drivers\Null.SYS
0xF7995000 \SystemRoot\System32\Drivers\Beep.SYS
0xF779F000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0xF77A7000 \SystemRoot\System32\drivers\vga.sys
0xF7997000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xF7999000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xF77AF000 \SystemRoot\System32\Drivers\Msfs.SYS
0xF77B7000 \SystemRoot\System32\Drivers\Npfs.SYS
0xBA6E4000 \SystemRoot\system32\DRIVERS\rasacd.sys
0xB20BC000 \SystemRoot\system32\DRIVERS\ipsec.sys
0xF74F7000 \SystemRoot\system32\DRIVERS\msgpc.sys
0xB2063000 \SystemRoot\system32\DRIVERS\tcpip.sys
0xB1FE4000 \SystemRoot\System32\Drivers\NAV\1108000.005\SYMTDI.SYS
0xB1FBE000 \SystemRoot\system32\DRIVERS\ipnat.sys
0xBA7C8000 \SystemRoot\system32\DRIVERS\wanarp.sys
0xB1F99000 \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS
0xB1F1C000 \SystemRoot\system32\DRIVERS\netbt.sys
0xB1EFA000 \SystemRoot\System32\drivers\afd.sys
0xBA7B8000 \SystemRoot\system32\DRIVERS\netbios.sys
0xB1E3B000 \SystemRoot\system32\drivers\NAV\1108000.005\Ironx86.SYS
0xBA7A8000 \SystemRoot\system32\drivers\NAV\1108000.005\SRTSPX.SYS
0xB1E10000 \SystemRoot\system32\DRIVERS\rdbss.sys
0xF77C7000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0xB1DA0000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xBA798000 \SystemRoot\System32\Drivers\Fips.SYS
0xB1D42000 \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys
0xB1D25000 \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys
0xB1CA6000 \SystemRoot\system32\drivers\NAV\1108000.005\ccHPx86.sys
0xB1BFA000 \??\C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_17.0.0.136\Definitions\BASHDefs\20100901.003\BHDrvx86.sys
0xBA6C8000 \SystemRoot\system32\DRIVERS\usbscan.sys
0xF77D7000 \SystemRoot\system32\DRIVERS\usbprint.sys
0xF77DF000 \SystemRoot\system32\DRIVERS\HPZius12.sys
0xBA778000 \SystemRoot\system32\DRIVERS\HPZid412.sys
0xBA6BC000 \SystemRoot\system32\DRIVERS\HPZipr12.sys
0xBA6AC000 \SystemRoot\system32\DRIVERS\hidusb.sys
0xBA768000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0xBA6A8000 \SystemRoot\system32\DRIVERS\mouhid.sys
0xF77EF000 \SystemRoot\system32\DRIVERS\point32.sys
0xBA6A4000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0xBA758000 \SystemRoot\System32\Drivers\Cdfs.SYS
0xB1B6A000 \SystemRoot\System32\Drivers\dump_atapi.sys
0xF79C5000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
0xBF800000 \SystemRoot\System32\win32k.sys
0xB1BEA000 \SystemRoot\System32\drivers\Dxapi.sys
0xF7797000 \SystemRoot\System32\watchdog.sys
0xBF000000 \SystemRoot\System32\drivers\dxg.sys
0xF7AAF000 \SystemRoot\System32\drivers\dxgthk.sys
0xBF020000 \SystemRoot\System32\ialmdnt5.dll
0xBF012000 \SystemRoot\System32\ialmrnt5.dll
0xBF042000 \SystemRoot\System32\ialmdev5.DLL
0xBF077000 \SystemRoot\System32\ialmdd5.DLL
0xBFFA0000 \SystemRoot\System32\ATMFD.DLL
0xB1EEA000 \SystemRoot\system32\DRIVERS\tifsfilt.sys
0xB1A1C000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0xB16D7000 \SystemRoot\system32\drivers\wdmaud.sys
0xB1964000 \SystemRoot\system32\drivers\sysaudio.sys
0xB14A2000 \SystemRoot\system32\DRIVERS\mrxdav.sys
0xF79F5000 \SystemRoot\System32\Drivers\ParVdm.SYS
0xB135B000 \SystemRoot\system32\DRIVERS\srv.sys
0xB11B9000 \SystemRoot\system32\DRIVERS\secdrv.sys
0xB0AF0000 \SystemRoot\System32\Drivers\HTTP.sys
0xB0A21000 \SystemRoot\System32\Drivers\NAV\1108000.005\SRTSP.SYS
0xB1BCA000 \??\C:\DOCUME~1\jschmitz\LOCALS~1\Temp\catchme.sys
0xF79D3000 \??\C:\WINDOWS\system32\Drivers\PROCEXP113.SYS
0xB1BB2000 \??\C:\DOCUME~1\jschmitz\LOCALS~1\Temp\mbr.sys
0xB011F000 \??\C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_17.0.0.136\Definitions\IPSDefs\20100924.001\IDSxpx86.sys
0xAFFD3000 \??\C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_17.0.0.136\Definitions\VirusDefs\20100926.003\NAVEX15.SYS
0xAFFBF000 \??\C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_17.0.0.136\Definitions\VirusDefs\20100926.003\NAVENG.SYS
0xAFF55000 \SystemRoot\system32\drivers\kmixer.sys
0x7C900000 \WINDOWS\System32\ntdll.dll

Processes (total 47):
0 System Idle Process
4 System
480 C:\WINDOWS\System32\smss.exe
536 csrss.exe
560 C:\WINDOWS\System32\WINLOGON.EXE
604 C:\WINDOWS\System32\SERVICES.EXE
616 C:\WINDOWS\System32\LSASS.EXE
764 C:\WINDOWS\System32\SVCHOST.EXE
812 SVCHOST.EXE
896 C:\WINDOWS\System32\SVCHOST.EXE
968 C:\WINDOWS\System32\SVCHOST.EXE
1088 SVCHOST.EXE
1152 SVCHOST.EXE
1460 C:\WINDOWS\System32\spoolsv.exe
2016 SVCHOST.EXE
228 C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
264 C:\Program Files\Bonjour\mDNSResponder.exe
312 C:\Program Files\Java\jre6\bin\jqs.exe
440 C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe
500 C:\Program Files\Norton AntiVirus\Engine\17.8.0.5\ccSvcHst.exe
496 C:\Program Files\Microsoft IntelliType Pro\itype.exe
512 C:\Program Files\Microsoft IntelliPoint\ipoint.exe
864 C:\Program Files\Common Files\Seagate\Schedule2\schedhlp.exe
924 C:\WINDOWS\System32\igfxtray.exe
980 C:\WINDOWS\System32\hkcmd.exe
948 C:\WINDOWS\System32\igfxpers.exe
1024 C:\Program Files\iTunes\iTunesHelper.exe
1176 C:\Program Files\QuickTime\QTTask.exe
1236 C:\Program Files\Common Files\Java\Java Update\jusched.exe
1256 C:\WINDOWS\System32\ctfmon.exe
1484 C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
1568 C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe
1792 C:\Program Files\Common Files\Seagate\Schedule2\schedul2.exe
1840 C:\WINDOWS\System32\SVCHOST.EXE
1888 C:\WINDOWS\System32\ZuneBusEnum.exe
2128 C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
2508 C:\Program Files\iPod\BIN\iPodService.exe
2980 C:\WINDOWS\System32\HPZipm12.exe
3120 alg.exe
3220 C:\Program Files\Norton AntiVirus\Engine\17.8.0.5\ccSvcHst.exe
1776 C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoSTS08.exe
3264 C:\WINDOWS\EXPLORER.EXE
2924 C:\Program Files\Internet Explorer\iexplore.exe
4020 C:\Program Files\Internet Explorer\iexplore.exe
2340 C:\Program Files\Internet Explorer\iexplore.exe
2184 wmiprvse.exe
1364 C:\Documents and Settings\jschmitz\Desktop\AntiSpy\MBRCheck.exe

\\.\C: –> \\.\PhysicalDrive1 at offset 0x00000000`00007e00 (FAT32)
\\.\F: –> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (FAT32)

PhysicalDrive1 Model Number: ST3500418AS, Rev: CC37
PhysicalDrive0 Model Number: IBM-DTLA-307030, Rev: TX4OA60A

Size Device Name MBR Status
——————————————–
465 GB \\.\PhysicalDrive1 Unknown MBR code
SHA1: 597401A4CE7D05F1E68A3BD6A0720148E5DB5F61
28 GB \\.\PhysicalDrive0 Unknown MBR code
SHA1: 597401A4CE7D05F1E68A3BD6A0720148E5DB5F61

Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:
Options:
[1] Dump the MBR of a physical disk to file.
[2] Restore the MBR of a physical disk with a standard boot code.
[3] Exit.

Enter your choice: Enter the physical disk number to dump (0-99, -1 to exit): 0Dumping \\.\PhysicalDisk0…
Enter filename to dump to: DUMP.TXTDumped successfully!

Enter the physical disk number to dump (0-99, -1 to exit): -1

Done!

dump2.txt

MBRCheck, version 1.2.3
© 2010, AD

Command-line:
Windows Version: Windows XP Home Edition
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x0000003d

Kernel Drivers (total 149):
0x804D7000 \WINDOWS\system32\ntoskrnl.exe
0x806EE000 \WINDOWS\system32\hal.dll
0xF7987000 \WINDOWS\system32\KDCOM.DLL
0xF7897000 \WINDOWS\system32\BOOTVID.dll
0xF75A8000 ACPI.sys
0xF7989000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
0xF7597000 pci.sys
0xF75F7000 isapnp.sys
0xF7A4F000 pciide.sys
0xF7707000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
0xF798B000 intelide.sys
0xF7607000 MountMgr.sys
0xF74D8000 ftdisk.sys
0xF770F000 PartMgr.sys
0xF7617000 VolSnap.sys
0xF74C0000 atapi.sys
0xF749B000 tffsport.sys
0xF7627000 disk.sys
0xF7637000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
0xF747B000 fltmgr.sys
0xF7425000 SYMDS.SYS
0xF7413000 sr.sys
0xF7647000 Lbd.sys
0xF786A000 SYMEFA.SYS
0xF7657000 PxHelp20.sys
0xF7846000 Fastfat.sys
0xF782F000 KSecDD.sys
0xF7400000 WudfPf.sys
0xF795A000 NDIS.sys
0xF7B74000 timntr.sys
0xF7B1B000 tdrpman.sys
0xF7A30000 snapman.sys
0xF7A16000 Mup.sys
0xF7687000 \SystemRoot\system32\DRIVERS\intelppm.sys
0xBA55A000 \SystemRoot\system32\DRIVERS\ialmnt5.sys
0xBA546000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
0xF7737000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0xBA522000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0xF773F000 \SystemRoot\system32\DRIVERS\usbehci.sys
0xBA4FA000 \SystemRoot\system32\DRIVERS\e100b325.sys
0xBA4A5000 \SystemRoot\system32\DRIVERS\es56tpi.sys
0xF7747000 \SystemRoot\System32\Drivers\Modem.SYS
0xF774F000 \SystemRoot\system32\DRIVERS\fdc.sys
0xF7697000 \SystemRoot\system32\DRIVERS\serial.sys
0xBA728000 \SystemRoot\system32\DRIVERS\serenum.sys
0xBA491000 \SystemRoot\system32\DRIVERS\parport.sys
0xF76A7000 \SystemRoot\system32\DRIVERS\cdrom.sys
0xF76B7000 \SystemRoot\system32\DRIVERS\redbook.sys
0xBA46E000 \SystemRoot\system32\DRIVERS\ks.sys
0xF7757000 \SystemRoot\System32\Drivers\GEARAspiWDM.sys
0xF76C7000 \SystemRoot\system32\DRIVERS\imapi.sys
0xBA3A6000 \SystemRoot\system32\drivers\cmuda.sys
0xBA382000 \SystemRoot\system32\drivers\portcls.sys
0xF76D7000 \SystemRoot\system32\drivers\drmk.sys
0xF7A9D000 \SystemRoot\system32\DRIVERS\audstub.sys
0xF798D000 \SystemRoot\System32\Drivers\RootMdm.sys
0xF76E7000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0xBA720000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0xBA36B000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0xF76F7000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0xF7587000 \SystemRoot\system32\DRIVERS\raspptp.sys
0xF775F000 \SystemRoot\system32\DRIVERS\TDI.SYS
0xF7767000 \SystemRoot\system32\DRIVERS\ptilink.sys
0xF776F000 \SystemRoot\system32\DRIVERS\raspti.sys
0xF7777000 \SystemRoot\system32\DRIVERS\RimSerial.sys
0xF7577000 \SystemRoot\system32\DRIVERS\termdd.sys
0xF777F000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0xF7787000 \SystemRoot\system32\DRIVERS\mouclass.sys
0xF798F000 \SystemRoot\system32\DRIVERS\swenum.sys
0xBA21D000 \SystemRoot\system32\DRIVERS\update.sys
0xBA714000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0xF7567000 \SystemRoot\system32\DRIVERS\zumbus.sys
0xF7557000 \SystemRoot\system32\DRIVERS\WDFLDR.SYS
0xBA1A1000 \SystemRoot\System32\Drivers\wdf01000.sys
0xF7547000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xF7527000 \SystemRoot\system32\DRIVERS\usbhub.sys
0xF7991000 \SystemRoot\system32\DRIVERS\USBD.SYS
0xF778F000 \SystemRoot\system32\DRIVERS\flpydisk.sys
0xF7993000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xF7A74000 \SystemRoot\System32\Drivers\Null.SYS
0xF7995000 \SystemRoot\System32\Drivers\Beep.SYS
0xF779F000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0xF77A7000 \SystemRoot\System32\drivers\vga.sys
0xF7997000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xF7999000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xF77AF000 \SystemRoot\System32\Drivers\Msfs.SYS
0xF77B7000 \SystemRoot\System32\Drivers\Npfs.SYS
0xBA6E4000 \SystemRoot\system32\DRIVERS\rasacd.sys
0xB20BC000 \SystemRoot\system32\DRIVERS\ipsec.sys
0xF74F7000 \SystemRoot\system32\DRIVERS\msgpc.sys
0xB2063000 \SystemRoot\system32\DRIVERS\tcpip.sys
0xB1FE4000 \SystemRoot\System32\Drivers\NAV\1108000.005\SYMTDI.SYS
0xB1FBE000 \SystemRoot\system32\DRIVERS\ipnat.sys
0xBA7C8000 \SystemRoot\system32\DRIVERS\wanarp.sys
0xB1F99000 \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS
0xB1F1C000 \SystemRoot\system32\DRIVERS\netbt.sys
0xB1EFA000 \SystemRoot\System32\drivers\afd.sys
0xBA7B8000 \SystemRoot\system32\DRIVERS\netbios.sys
0xB1E3B000 \SystemRoot\system32\drivers\NAV\1108000.005\Ironx86.SYS
0xBA7A8000 \SystemRoot\system32\drivers\NAV\1108000.005\SRTSPX.SYS
0xB1E10000 \SystemRoot\system32\DRIVERS\rdbss.sys
0xF77C7000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0xB1DA0000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xBA798000 \SystemRoot\System32\Drivers\Fips.SYS
0xB1D42000 \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys
0xB1D25000 \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys
0xB1CA6000 \SystemRoot\system32\drivers\NAV\1108000.005\ccHPx86.sys
0xB1BFA000 \??\C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_17.0.0.136\Definitions\BASHDefs\20100901.003\BHDrvx86.sys
0xBA6C8000 \SystemRoot\system32\DRIVERS\usbscan.sys
0xF77D7000 \SystemRoot\system32\DRIVERS\usbprint.sys
0xF77DF000 \SystemRoot\system32\DRIVERS\HPZius12.sys
0xBA778000 \SystemRoot\system32\DRIVERS\HPZid412.sys
0xBA6BC000 \SystemRoot\system32\DRIVERS\HPZipr12.sys
0xBA6AC000 \SystemRoot\system32\DRIVERS\hidusb.sys
0xBA768000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0xBA6A8000 \SystemRoot\system32\DRIVERS\mouhid.sys
0xF77EF000 \SystemRoot\system32\DRIVERS\point32.sys
0xBA6A4000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0xBA758000 \SystemRoot\System32\Drivers\Cdfs.SYS
0xB1B6A000 \SystemRoot\System32\Drivers\dump_atapi.sys
0xF79C5000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
0xBF800000 \SystemRoot\System32\win32k.sys
0xB1BEA000 \SystemRoot\System32\drivers\Dxapi.sys
0xF7797000 \SystemRoot\System32\watchdog.sys
0xBF000000 \SystemRoot\System32\drivers\dxg.sys
0xF7AAF000 \SystemRoot\System32\drivers\dxgthk.sys
0xBF020000 \SystemRoot\System32\ialmdnt5.dll
0xBF012000 \SystemRoot\System32\ialmrnt5.dll
0xBF042000 \SystemRoot\System32\ialmdev5.DLL
0xBF077000 \SystemRoot\System32\ialmdd5.DLL
0xBFFA0000 \SystemRoot\System32\ATMFD.DLL
0xB1EEA000 \SystemRoot\system32\DRIVERS\tifsfilt.sys
0xB1A1C000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0xB16D7000 \SystemRoot\system32\drivers\wdmaud.sys
0xB1964000 \SystemRoot\system32\drivers\sysaudio.sys
0xB14A2000 \SystemRoot\system32\DRIVERS\mrxdav.sys
0xF79F5000 \SystemRoot\System32\Drivers\ParVdm.SYS
0xB135B000 \SystemRoot\system32\DRIVERS\srv.sys
0xB11B9000 \SystemRoot\system32\DRIVERS\secdrv.sys
0xB0AF0000 \SystemRoot\System32\Drivers\HTTP.sys
0xB0A21000 \SystemRoot\System32\Drivers\NAV\1108000.005\SRTSP.SYS
0xB1BCA000 \??\C:\DOCUME~1\jschmitz\LOCALS~1\Temp\catchme.sys
0xF79D3000 \??\C:\WINDOWS\system32\Drivers\PROCEXP113.SYS
0xB1BB2000 \??\C:\DOCUME~1\jschmitz\LOCALS~1\Temp\mbr.sys
0xB011F000 \??\C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_17.0.0.136\Definitions\IPSDefs\20100924.001\IDSxpx86.sys
0xAFFD3000 \??\C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_17.0.0.136\Definitions\VirusDefs\20100926.003\NAVEX15.SYS
0xAFFBF000 \??\C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_17.0.0.136\Definitions\VirusDefs\20100926.003\NAVENG.SYS
0xAFF55000 \SystemRoot\system32\drivers\kmixer.sys
0x7C900000 \WINDOWS\System32\ntdll.dll

Processes (total 46):
0 System Idle Process
4 System
480 C:\WINDOWS\System32\smss.exe
536 csrss.exe
560 C:\WINDOWS\System32\WINLOGON.EXE
604 C:\WINDOWS\System32\SERVICES.EXE
616 C:\WINDOWS\System32\LSASS.EXE
764 C:\WINDOWS\System32\SVCHOST.EXE
812 SVCHOST.EXE
896 C:\WINDOWS\System32\SVCHOST.EXE
968 C:\WINDOWS\System32\SVCHOST.EXE
1088 SVCHOST.EXE
1152 SVCHOST.EXE
1460 C:\WINDOWS\System32\spoolsv.exe
2016 SVCHOST.EXE
228 C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
264 C:\Program Files\Bonjour\mDNSResponder.exe
312 C:\Program Files\Java\jre6\bin\jqs.exe
440 C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe
500 C:\Program Files\Norton AntiVirus\Engine\17.8.0.5\ccSvcHst.exe
496 C:\Program Files\Microsoft IntelliType Pro\itype.exe
512 C:\Program Files\Microsoft IntelliPoint\ipoint.exe
864 C:\Program Files\Common Files\Seagate\Schedule2\schedhlp.exe
924 C:\WINDOWS\System32\igfxtray.exe
980 C:\WINDOWS\System32\hkcmd.exe
948 C:\WINDOWS\System32\igfxpers.exe
1024 C:\Program Files\iTunes\iTunesHelper.exe
1176 C:\Program Files\QuickTime\QTTask.exe
1236 C:\Program Files\Common Files\Java\Java Update\jusched.exe
1256 C:\WINDOWS\System32\ctfmon.exe
1484 C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
1568 C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe
1792 C:\Program Files\Common Files\Seagate\Schedule2\schedul2.exe
1840 C:\WINDOWS\System32\SVCHOST.EXE
1888 C:\WINDOWS\System32\ZuneBusEnum.exe
2128 C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
2508 C:\Program Files\iPod\BIN\iPodService.exe
2980 C:\WINDOWS\System32\HPZipm12.exe
3120 alg.exe
3220 C:\Program Files\Norton AntiVirus\Engine\17.8.0.5\ccSvcHst.exe
1776 C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoSTS08.exe
3264 C:\WINDOWS\EXPLORER.EXE
2924 C:\Program Files\Internet Explorer\iexplore.exe
4020 C:\Program Files\Internet Explorer\iexplore.exe
2184 wmiprvse.exe
1344 C:\Documents and Settings\jschmitz\Desktop\AntiSpy\MBRCheck.exe

\\.\C: –> \\.\PhysicalDrive1 at offset 0x00000000`00007e00 (FAT32)
\\.\F: –> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (FAT32)

PhysicalDrive1 Model Number: ST3500418AS, Rev: CC37
PhysicalDrive0 Model Number: IBM-DTLA-307030, Rev: TX4OA60A

Size Device Name MBR Status
——————————————–
465 GB \\.\PhysicalDrive1 Unknown MBR code
SHA1: 597401A4CE7D05F1E68A3BD6A0720148E5DB5F61
28 GB \\.\PhysicalDrive0 Unknown MBR code
SHA1: 597401A4CE7D05F1E68A3BD6A0720148E5DB5F61

Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:
Options:
[1] Dump the MBR of a physical disk to file.
[2] Restore the MBR of a physical disk with a standard boot code.
[3] Exit.

Enter your choice: Enter the physical disk number to dump (0-99, -1 to exit): 1Dumping \\.\PhysicalDisk1…
Enter filename to dump to: DUMP2.TXTDumped successfully!

Enter the physical disk number to dump (0-99, -1 to exit): -1

Done!

Kasperky Scan Results

——————————————————————————–
KASPERSKY ONLINE SCANNER 7.0: scan report
Tuesday, September 28, 2010
Operating system: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Monday, September 27, 2010 00:49:23
Records in database: 4242868
——————————————————————————–

Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes

Scan area - My Computer:
A:\
C:\
D:\
E:\
F:\

Scan statistics:
Objects scanned: 162335
Threats found: 0
Infected objects found: 0
Suspicious objects found: 0
Scan duration: 06:58:33

No threats found. Scanned area is clean.

Selected area has been scanned.

Satchfan

Post #10September 29, 2010, 10:48 AM UTC

Jeff S

These were not the correct text files: please locate the dump.txt and dump2.txt files, which are located in the same place you ran MBRCheck from, ie in the AntiSpy folder:

C:\Documents and Settings\jschmitz\Desktop\AntiSpy\dump.txt
C:\Documents and Settings\jschmitz\Desktop\AntiSpy\dump2.txt

The constant checking after reboot could be because of a “dirty” bit being found on your hard drive. • Click on Start, Run, type in cmd
• Press Enter
• Type or paste the following line:
fsutil dirty query C:
• Press Enter
This "should" tell you that the bit is set to "dirty".• Repeat the above but this time type in:
fsutil dirty query F:
• Press Enter
Please let me know what it says after each and include the two dump files.

Thanks

Satchfan

Jeff S

Post #11September 30, 2010, 3:46 AM UTC

Volume -C: is NOT dirty
Volume -F: is Dirty

When I open dump.txt & dump2.txt with Notepad, it appears as jibberish. Here they are anyway:

dump.txt

3ÀŽÐ¼ |ûPPü¾|¿PW¹åó¤Ë¾¾±8,| uƒÆâõÍ‹‹îƒÆIt8,tö¾N¬< tú» ´Íëò‰F%–ŠF´<t´<t:Äu+@ÆF%u$»ªUP´AÍXrûUªuöÁtŠàˆV$Ç¡ëˆf¿
¸‹Ü3Éƒÿ‹N%NÍr)¾u>þ}UªtZƒïÚ…öuƒ¾?ëŠ˜‘R™FV
è ZëÕOtä3ÀÍë¸ V3öVVRPSQ¾ V‹ôPR¸ BŠV$ÍZXdr
@uB€Çâ÷ø^ÃëtInvalid partition table. Setup cannot continue. Error loading operating system. Setup cannot continue. ‹üW‹õË ÜÜ € þÿþ? YÐ“ Uª

dump2.txt

3ÀŽÐ¼ |ûPPü¾|¿PW¹åó¤Ë¾¾±8,| uƒÆâõÍ‹‹îƒÆIt8,tö¾N¬< tú» ´Íëò‰F%–ŠF´<t´<t:Äu+@ÆF%u$»ªUP´AÍXrûUªuöÁtŠàˆV$Ç¡ëˆf¿
¸‹Ü3Éƒÿ‹N%NÍr)¾u>þ}UªtZƒïÚ…öuƒ¾?ëŠ˜‘R™FV
è ZëÕOtä3ÀÍë¸ V3öVVRPSQ¾ V‹ôPR¸ BŠV$ÍZXdr
@uB€Çâ÷ø^ÃëtInvalid partition table. Setup cannot continue. Error loading operating system. Setup cannot continue. ‹üW‹õË (Ÿ
R € þÿÿ? L8: Uª

Jeff S

Post #12September 30, 2010, 4:09 AM UTC

Volume -C: is NOT dirty
Volume -F: is Dirty

When I open dump.txt & dump2.txt with Notepad at the location you specified (C:\Documents and Settings\jschmitz\Desktop\AntiSpy\dump.txt and C:\Documents and Settings\jschmitz\Desktop\AntiSpy\dump2.txt), they appear as jibberish. When I run the MBR Check, a .txt file is also saved to my desktop (which IS readable). I'll include both for your consideration:

dump.txt

3ÀŽÐ¼ |ûPPü¾|¿PW¹åó¤Ë¾¾±8,| uƒÆâõÍ‹‹îƒÆIt8,tö¾N¬< tú» ´Íëò‰F%–ŠF´<t´<t:Äu+@ÆF%u$»ªUP´AÍXrûUªuöÁtŠàˆV$Ç¡ëˆf¿
¸‹Ü3Éƒÿ‹N%NÍr)¾u>þ}UªtZƒïÚ…öuƒ¾?ëŠ˜‘R™FV
è ZëÕOtä3ÀÍë¸ V3öVVRPSQ¾ V‹ôPR¸ BŠV$ÍZXdr
@uB€Çâ÷ø^ÃëtInvalid partition table. Setup cannot continue. Error loading operating system. Setup cannot continue. ‹üW‹õË ÜÜ € þÿþ? YÐ“ Uª

dump2.txt

3ÀŽÐ¼ |ûPPü¾|¿PW¹åó¤Ë¾¾±8,| uƒÆâõÍ‹‹îƒÆIt8,tö¾N¬< tú» ´Íëò‰F%–ŠF´<t´<t:Äu+@ÆF%u$»ªUP´AÍXrûUªuöÁtŠàˆV$Ç¡ëˆf¿
¸‹Ü3Éƒÿ‹N%NÍr)¾u>þ}UªtZƒïÚ…öuƒ¾?ëŠ˜‘R™FV
è ZëÕOtä3ÀÍë¸ V3öVVRPSQ¾ V‹ôPR¸ BŠV$ÍZXdr
@uB€Çâ÷ø^ÃëtInvalid partition table. Setup cannot continue. Error loading operating system. Setup cannot continue. ‹üW‹õË (Ÿ
R € þÿÿ? L8: Uª

MBRCheck disk 0

MBRCheck, version 1.2.3
© 2010, AD

Command-line:
Windows Version: Windows XP Home Edition
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x0000003d

Kernel Drivers (total 146):
0x804D7000 \WINDOWS\system32\ntoskrnl.exe
0x806EE000 \WINDOWS\system32\hal.dll
0xF7987000 \WINDOWS\system32\KDCOM.DLL
0xF7897000 \WINDOWS\system32\BOOTVID.dll
0xF75A8000 ACPI.sys
0xF7989000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
0xF7597000 pci.sys
0xF75F7000 isapnp.sys
0xF7A4F000 pciide.sys
0xF7707000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
0xF798B000 intelide.sys
0xF7607000 MountMgr.sys
0xF74D8000 ftdisk.sys
0xF770F000 PartMgr.sys
0xF7617000 VolSnap.sys
0xF74C0000 atapi.sys
0xF749B000 tffsport.sys
0xF7627000 disk.sys
0xF7637000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
0xF747B000 fltmgr.sys
0xF7425000 SYMDS.SYS
0xF7413000 sr.sys
0xF7647000 Lbd.sys
0xF786A000 SYMEFA.SYS
0xF7657000 PxHelp20.sys
0xF7846000 Fastfat.sys
0xF782F000 KSecDD.sys
0xF7400000 WudfPf.sys
0xF795A000 NDIS.sys
0xF7B74000 timntr.sys
0xF7B1B000 tdrpman.sys
0xF7A30000 snapman.sys
0xF7A16000 Mup.sys
0xF7687000 \SystemRoot\system32\DRIVERS\intelppm.sys
0xBA55A000 \SystemRoot\system32\DRIVERS\ialmnt5.sys
0xBA546000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
0xF7737000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0xBA522000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0xF773F000 \SystemRoot\system32\DRIVERS\usbehci.sys
0xBA4FA000 \SystemRoot\system32\DRIVERS\e100b325.sys
0xBA4A5000 \SystemRoot\system32\DRIVERS\es56tpi.sys
0xF7747000 \SystemRoot\System32\Drivers\Modem.SYS
0xF774F000 \SystemRoot\system32\DRIVERS\fdc.sys
0xF7697000 \SystemRoot\system32\DRIVERS\serial.sys
0xBA728000 \SystemRoot\system32\DRIVERS\serenum.sys
0xBA491000 \SystemRoot\system32\DRIVERS\parport.sys
0xF76A7000 \SystemRoot\system32\DRIVERS\cdrom.sys
0xF76B7000 \SystemRoot\system32\DRIVERS\redbook.sys
0xBA46E000 \SystemRoot\system32\DRIVERS\ks.sys
0xF7757000 \SystemRoot\System32\Drivers\GEARAspiWDM.sys
0xF76C7000 \SystemRoot\system32\DRIVERS\imapi.sys
0xBA3A6000 \SystemRoot\system32\drivers\cmuda.sys
0xBA382000 \SystemRoot\system32\drivers\portcls.sys
0xF76D7000 \SystemRoot\system32\drivers\drmk.sys
0xF7A9D000 \SystemRoot\system32\DRIVERS\audstub.sys
0xF798D000 \SystemRoot\System32\Drivers\RootMdm.sys
0xF76E7000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0xBA720000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0xBA36B000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0xF76F7000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0xF7587000 \SystemRoot\system32\DRIVERS\raspptp.sys
0xF775F000 \SystemRoot\system32\DRIVERS\TDI.SYS
0xF7767000 \SystemRoot\system32\DRIVERS\ptilink.sys
0xF776F000 \SystemRoot\system32\DRIVERS\raspti.sys
0xF7777000 \SystemRoot\system32\DRIVERS\RimSerial.sys
0xF7577000 \SystemRoot\system32\DRIVERS\termdd.sys
0xF777F000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0xF7787000 \SystemRoot\system32\DRIVERS\mouclass.sys
0xF798F000 \SystemRoot\system32\DRIVERS\swenum.sys
0xBA21D000 \SystemRoot\system32\DRIVERS\update.sys
0xBA714000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0xF7567000 \SystemRoot\system32\DRIVERS\zumbus.sys
0xF7557000 \SystemRoot\system32\DRIVERS\WDFLDR.SYS
0xBA1A1000 \SystemRoot\System32\Drivers\wdf01000.sys
0xF7547000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xF7527000 \SystemRoot\system32\DRIVERS\usbhub.sys
0xF7991000 \SystemRoot\system32\DRIVERS\USBD.SYS
0xF778F000 \SystemRoot\system32\DRIVERS\flpydisk.sys
0xF7993000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xF7A72000 \SystemRoot\System32\Drivers\Null.SYS
0xF7995000 \SystemRoot\System32\Drivers\Beep.SYS
0xF779F000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0xF77A7000 \SystemRoot\System32\drivers\vga.sys
0xF7997000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xF7999000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xF77AF000 \SystemRoot\System32\Drivers\Msfs.SYS
0xF77B7000 \SystemRoot\System32\Drivers\Npfs.SYS
0xBA6E4000 \SystemRoot\system32\DRIVERS\rasacd.sys
0xB20BC000 \SystemRoot\system32\DRIVERS\ipsec.sys
0xF74F7000 \SystemRoot\system32\DRIVERS\msgpc.sys
0xB2063000 \SystemRoot\system32\DRIVERS\tcpip.sys
0xB1FE4000 \SystemRoot\System32\Drivers\NAV\1108000.005\SYMTDI.SYS
0xB1FBE000 \SystemRoot\system32\DRIVERS\ipnat.sys
0xBA7C8000 \SystemRoot\system32\DRIVERS\wanarp.sys
0xB1F99000 \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS
0xB1F1C000 \SystemRoot\system32\DRIVERS\netbt.sys
0xB1EFA000 \SystemRoot\System32\drivers\afd.sys
0xBA7B8000 \SystemRoot\system32\DRIVERS\netbios.sys
0xB1E3B000 \SystemRoot\system32\drivers\NAV\1108000.005\Ironx86.SYS
0xBA7A8000 \SystemRoot\system32\drivers\NAV\1108000.005\SRTSPX.SYS
0xB1E10000 \SystemRoot\system32\DRIVERS\rdbss.sys
0xB1DA0000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xBA798000 \SystemRoot\System32\Drivers\Fips.SYS
0xB1D42000 \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys
0xB1D25000 \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys
0xF77CF000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0xB1CA6000 \SystemRoot\system32\drivers\NAV\1108000.005\ccHPx86.sys
0xB1BFA000 \??\C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_17.0.0.136\Definitions\BASHDefs\20100901.003\BHDrvx86.sys
0xBA6C8000 \SystemRoot\system32\DRIVERS\usbscan.sys
0xF77D7000 \SystemRoot\system32\DRIVERS\usbprint.sys
0xF77DF000 \SystemRoot\system32\DRIVERS\HPZius12.sys
0xBA778000 \SystemRoot\system32\DRIVERS\HPZid412.sys
0xBA6BC000 \SystemRoot\system32\DRIVERS\HPZipr12.sys
0xBA6AC000 \SystemRoot\system32\DRIVERS\hidusb.sys
0xBA768000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0xBA6A8000 \SystemRoot\system32\DRIVERS\mouhid.sys
0xF77EF000 \SystemRoot\system32\DRIVERS\point32.sys
0xBA6A4000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0xB1E7A000 \SystemRoot\System32\Drivers\Cdfs.SYS
0xB1B6A000 \SystemRoot\System32\Drivers\dump_atapi.sys
0xF79B5000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
0xBF800000 \SystemRoot\System32\win32k.sys
0xB1BD2000 \SystemRoot\System32\drivers\Dxapi.sys
0xB1BAA000 \SystemRoot\System32\watchdog.sys
0xBF000000 \SystemRoot\System32\drivers\dxg.sys
0xF7AC0000 \SystemRoot\System32\drivers\dxgthk.sys
0xBF020000 \SystemRoot\System32\ialmdnt5.dll
0xBF012000 \SystemRoot\System32\ialmrnt5.dll
0xBF042000 \SystemRoot\System32\ialmdev5.DLL
0xBF077000 \SystemRoot\System32\ialmdd5.DLL
0xBFFA0000 \SystemRoot\System32\ATMFD.DLL
0xBA2EB000 \SystemRoot\system32\DRIVERS\tifsfilt.sys
0xB1A36000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0xB16EB000 \SystemRoot\system32\drivers\wdmaud.sys
0xB1822000 \SystemRoot\system32\drivers\sysaudio.sys
0xB14DE000 \SystemRoot\system32\DRIVERS\mrxdav.sys
0xF79EB000 \SystemRoot\System32\Drivers\ParVdm.SYS
0xB140F000 \SystemRoot\system32\DRIVERS\srv.sys
0xB12CF000 \SystemRoot\system32\DRIVERS\secdrv.sys
0xB0DB6000 \SystemRoot\System32\Drivers\HTTP.sys
0xB1ADA000 \??\C:\Program Files\MSI\PC Alert 4\NTGLM7X.sys
0xB0556000 \SystemRoot\System32\Drivers\NAV\1108000.005\SRTSP.SYS
0xAFCC8000 \??\C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_17.0.0.136\Definitions\IPSDefs\20100929.001\IDSxpx86.sys
0xAFB7A000 \??\C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_17.0.0.136\Definitions\VirusDefs\20100929.021\NAVEX15.SYS
0xAFB66000 \??\C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_17.0.0.136\Definitions\VirusDefs\20100929.021\NAVENG.SYS
0x7C900000 \WINDOWS\System32\ntdll.dll

Processes (total 50):
0 System Idle Process
4 System
480 C:\WINDOWS\System32\smss.exe
536 csrss.exe
560 C:\WINDOWS\System32\winlogon.exe
604 C:\WINDOWS\System32\services.exe
616 C:\WINDOWS\System32\lsass.exe
768 C:\WINDOWS\System32\svchost.exe
824 svchost.exe
928 C:\WINDOWS\System32\svchost.exe
964 C:\WINDOWS\System32\svchost.exe
1088 svchost.exe
1152 svchost.exe
1364 C:\WINDOWS\Explorer.EXE
1436 C:\WINDOWS\System32\spoolsv.exe
2012 svchost.exe
228 C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
276 C:\Program Files\Bonjour\mDNSResponder.exe
312 C:\Program Files\Java\jre6\bin\jqs.exe
428 C:\Program Files\Norton AntiVirus\Engine\17.8.0.5\ccSvcHst.exe
756 C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe
904 C:\Program Files\Microsoft IntelliType Pro\itype.exe
920 C:\Program Files\Microsoft IntelliPoint\ipoint.exe
1004 C:\Program Files\Common Files\Seagate\Schedule2\schedhlp.exe
1000 C:\WINDOWS\System32\igfxtray.exe
1008 C:\WINDOWS\System32\hkcmd.exe
872 C:\WINDOWS\System32\igfxpers.exe
660 C:\Program Files\iTunes\iTunesHelper.exe
1232 C:\Program Files\Common Files\Java\Java Update\jusched.exe
1328 C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
1348 C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe
1676 C:\Program Files\Common Files\Seagate\Schedule2\schedul2.exe
1740 C:\WINDOWS\System32\svchost.exe
1732 C:\WINDOWS\System32\ZuneBusEnum.exe
2328 C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
2468 C:\Program Files\iPod\bin\iPodService.exe
2684 wmiprvse.exe
2956 C:\Program Files\MSI\PC Alert 4\PCAlert4.exe
2968 C:\WINDOWS\System32\HPZipm12.exe
2984 alg.exe
3288 C:\Program Files\Norton AntiVirus\Engine\17.8.0.5\ccSvcHst.exe
3644 C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoSTS08.exe
2940 C:\Program Files\Internet Explorer\iexplore.exe
1964 C:\WINDOWS\System32\ctfmon.exe
596 C:\Program Files\Internet Explorer\iexplore.exe
2884 C:\WINDOWS\System32\wscntfy.exe
3440 C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
1820 unsecapp.exe
3300 C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
4016 C:\Documents and Settings\jschmitz\Desktop\AntiSpy\MBRCheck.exe

\\.\C: –> \\.\PhysicalDrive1 at offset 0x00000000`00007e00 (FAT32)
\\.\F: –> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (FAT32)

PhysicalDrive1 Model Number: ST3500418AS, Rev: CC37
PhysicalDrive0 Model Number: IBM-DTLA-307030, Rev: TX4OA60A

Size Device Name MBR Status
——————————————–
465 GB \\.\PhysicalDrive1 Unknown MBR code
SHA1: 597401A4CE7D05F1E68A3BD6A0720148E5DB5F61
28 GB \\.\PhysicalDrive0 Unknown MBR code
SHA1: 597401A4CE7D05F1E68A3BD6A0720148E5DB5F61

Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:
Options:
[1] Dump the MBR of a physical disk to file.
[2] Restore the MBR of a physical disk with a standard boot code.
[3] Exit.

Enter your choice: Enter the physical disk number to dump (0-99, -1 to exit): 0Dumping \\.\PhysicalDisk0…
Enter filename to dump to: dump.txtDumped successfully!

Enter the physical disk number to dump (0-99, -1 to exit): -1

Done!

MBRCheck disk 1

MBRCheck, version 1.2.3
© 2010, AD

Command-line:
Windows Version: Windows XP Home Edition
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x0000003d

Kernel Drivers (total 146):
0x804D7000 \WINDOWS\system32\ntoskrnl.exe
0x806EE000 \WINDOWS\system32\hal.dll
0xF7987000 \WINDOWS\system32\KDCOM.DLL
0xF7897000 \WINDOWS\system32\BOOTVID.dll
0xF75A8000 ACPI.sys
0xF7989000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
0xF7597000 pci.sys
0xF75F7000 isapnp.sys
0xF7A4F000 pciide.sys
0xF7707000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
0xF798B000 intelide.sys
0xF7607000 MountMgr.sys
0xF74D8000 ftdisk.sys
0xF770F000 PartMgr.sys
0xF7617000 VolSnap.sys
0xF74C0000 atapi.sys
0xF749B000 tffsport.sys
0xF7627000 disk.sys
0xF7637000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
0xF747B000 fltmgr.sys
0xF7425000 SYMDS.SYS
0xF7413000 sr.sys
0xF7647000 Lbd.sys
0xF786A000 SYMEFA.SYS
0xF7657000 PxHelp20.sys
0xF7846000 Fastfat.sys
0xF782F000 KSecDD.sys
0xF7400000 WudfPf.sys
0xF795A000 NDIS.sys
0xF7B74000 timntr.sys
0xF7B1B000 tdrpman.sys
0xF7A30000 snapman.sys
0xF7A16000 Mup.sys
0xF7687000 \SystemRoot\system32\DRIVERS\intelppm.sys
0xBA55A000 \SystemRoot\system32\DRIVERS\ialmnt5.sys
0xBA546000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
0xF7737000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0xBA522000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0xF773F000 \SystemRoot\system32\DRIVERS\usbehci.sys
0xBA4FA000 \SystemRoot\system32\DRIVERS\e100b325.sys
0xBA4A5000 \SystemRoot\system32\DRIVERS\es56tpi.sys
0xF7747000 \SystemRoot\System32\Drivers\Modem.SYS
0xF774F000 \SystemRoot\system32\DRIVERS\fdc.sys
0xF7697000 \SystemRoot\system32\DRIVERS\serial.sys
0xBA728000 \SystemRoot\system32\DRIVERS\serenum.sys
0xBA491000 \SystemRoot\system32\DRIVERS\parport.sys
0xF76A7000 \SystemRoot\system32\DRIVERS\cdrom.sys
0xF76B7000 \SystemRoot\system32\DRIVERS\redbook.sys
0xBA46E000 \SystemRoot\system32\DRIVERS\ks.sys
0xF7757000 \SystemRoot\System32\Drivers\GEARAspiWDM.sys
0xF76C7000 \SystemRoot\system32\DRIVERS\imapi.sys
0xBA3A6000 \SystemRoot\system32\drivers\cmuda.sys
0xBA382000 \SystemRoot\system32\drivers\portcls.sys
0xF76D7000 \SystemRoot\system32\drivers\drmk.sys
0xF7A9D000 \SystemRoot\system32\DRIVERS\audstub.sys
0xF798D000 \SystemRoot\System32\Drivers\RootMdm.sys
0xF76E7000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0xBA720000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0xBA36B000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0xF76F7000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0xF7587000 \SystemRoot\system32\DRIVERS\raspptp.sys
0xF775F000 \SystemRoot\system32\DRIVERS\TDI.SYS
0xF7767000 \SystemRoot\system32\DRIVERS\ptilink.sys
0xF776F000 \SystemRoot\system32\DRIVERS\raspti.sys
0xF7777000 \SystemRoot\system32\DRIVERS\RimSerial.sys
0xF7577000 \SystemRoot\system32\DRIVERS\termdd.sys
0xF777F000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0xF7787000 \SystemRoot\system32\DRIVERS\mouclass.sys
0xF798F000 \SystemRoot\system32\DRIVERS\swenum.sys
0xBA21D000 \SystemRoot\system32\DRIVERS\update.sys
0xBA714000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0xF7567000 \SystemRoot\system32\DRIVERS\zumbus.sys
0xF7557000 \SystemRoot\system32\DRIVERS\WDFLDR.SYS
0xBA1A1000 \SystemRoot\System32\Drivers\wdf01000.sys
0xF7547000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xF7527000 \SystemRoot\system32\DRIVERS\usbhub.sys
0xF7991000 \SystemRoot\system32\DRIVERS\USBD.SYS
0xF778F000 \SystemRoot\system32\DRIVERS\flpydisk.sys
0xF7993000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xF7A72000 \SystemRoot\System32\Drivers\Null.SYS
0xF7995000 \SystemRoot\System32\Drivers\Beep.SYS
0xF779F000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0xF77A7000 \SystemRoot\System32\drivers\vga.sys
0xF7997000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xF7999000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xF77AF000 \SystemRoot\System32\Drivers\Msfs.SYS
0xF77B7000 \SystemRoot\System32\Drivers\Npfs.SYS
0xBA6E4000 \SystemRoot\system32\DRIVERS\rasacd.sys
0xB20BC000 \SystemRoot\system32\DRIVERS\ipsec.sys
0xF74F7000 \SystemRoot\system32\DRIVERS\msgpc.sys
0xB2063000 \SystemRoot\system32\DRIVERS\tcpip.sys
0xB1FE4000 \SystemRoot\System32\Drivers\NAV\1108000.005\SYMTDI.SYS
0xB1FBE000 \SystemRoot\system32\DRIVERS\ipnat.sys
0xBA7C8000 \SystemRoot\system32\DRIVERS\wanarp.sys
0xB1F99000 \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS
0xB1F1C000 \SystemRoot\system32\DRIVERS\netbt.sys
0xB1EFA000 \SystemRoot\System32\drivers\afd.sys
0xBA7B8000 \SystemRoot\system32\DRIVERS\netbios.sys
0xB1E3B000 \SystemRoot\system32\drivers\NAV\1108000.005\Ironx86.SYS
0xBA7A8000 \SystemRoot\system32\drivers\NAV\1108000.005\SRTSPX.SYS
0xB1E10000 \SystemRoot\system32\DRIVERS\rdbss.sys
0xB1DA0000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xBA798000 \SystemRoot\System32\Drivers\Fips.SYS
0xB1D42000 \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys
0xB1D25000 \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys
0xF77CF000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0xB1CA6000 \SystemRoot\system32\drivers\NAV\1108000.005\ccHPx86.sys
0xB1BFA000 \??\C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_17.0.0.136\Definitions\BASHDefs\20100901.003\BHDrvx86.sys
0xBA6C8000 \SystemRoot\system32\DRIVERS\usbscan.sys
0xF77D7000 \SystemRoot\system32\DRIVERS\usbprint.sys
0xF77DF000 \SystemRoot\system32\DRIVERS\HPZius12.sys
0xBA778000 \SystemRoot\system32\DRIVERS\HPZid412.sys
0xBA6BC000 \SystemRoot\system32\DRIVERS\HPZipr12.sys
0xBA6AC000 \SystemRoot\system32\DRIVERS\hidusb.sys
0xBA768000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0xBA6A8000 \SystemRoot\system32\DRIVERS\mouhid.sys
0xF77EF000 \SystemRoot\system32\DRIVERS\point32.sys
0xBA6A4000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0xB1E7A000 \SystemRoot\System32\Drivers\Cdfs.SYS
0xB1B6A000 \SystemRoot\System32\Drivers\dump_atapi.sys
0xF79B5000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
0xBF800000 \SystemRoot\System32\win32k.sys
0xB1BD2000 \SystemRoot\System32\drivers\Dxapi.sys
0xB1BAA000 \SystemRoot\System32\watchdog.sys
0xBF000000 \SystemRoot\System32\drivers\dxg.sys
0xF7AC0000 \SystemRoot\System32\drivers\dxgthk.sys
0xBF020000 \SystemRoot\System32\ialmdnt5.dll
0xBF012000 \SystemRoot\System32\ialmrnt5.dll
0xBF042000 \SystemRoot\System32\ialmdev5.DLL
0xBF077000 \SystemRoot\System32\ialmdd5.DLL
0xBFFA0000 \SystemRoot\System32\ATMFD.DLL
0xBA2EB000 \SystemRoot\system32\DRIVERS\tifsfilt.sys
0xB1A36000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0xB16EB000 \SystemRoot\system32\drivers\wdmaud.sys
0xB1822000 \SystemRoot\system32\drivers\sysaudio.sys
0xB14DE000 \SystemRoot\system32\DRIVERS\mrxdav.sys
0xF79EB000 \SystemRoot\System32\Drivers\ParVdm.SYS
0xB140F000 \SystemRoot\system32\DRIVERS\srv.sys
0xB12CF000 \SystemRoot\system32\DRIVERS\secdrv.sys
0xB0DB6000 \SystemRoot\System32\Drivers\HTTP.sys
0xB1ADA000 \??\C:\Program Files\MSI\PC Alert 4\NTGLM7X.sys
0xB0556000 \SystemRoot\System32\Drivers\NAV\1108000.005\SRTSP.SYS
0xAFCC8000 \??\C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_17.0.0.136\Definitions\IPSDefs\20100929.001\IDSxpx86.sys
0xAFB7A000 \??\C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_17.0.0.136\Definitions\VirusDefs\20100929.021\NAVEX15.SYS
0xAFB66000 \??\C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_17.0.0.136\Definitions\VirusDefs\20100929.021\NAVENG.SYS
0x7C900000 \WINDOWS\System32\ntdll.dll

Processes (total 50):
0 System Idle Process
4 System
480 C:\WINDOWS\System32\smss.exe
536 csrss.exe
560 C:\WINDOWS\System32\winlogon.exe
604 C:\WINDOWS\System32\services.exe
616 C:\WINDOWS\System32\lsass.exe
768 C:\WINDOWS\System32\svchost.exe
824 svchost.exe
928 C:\WINDOWS\System32\svchost.exe
964 C:\WINDOWS\System32\svchost.exe
1088 svchost.exe
1152 svchost.exe
1364 C:\WINDOWS\Explorer.EXE
1436 C:\WINDOWS\System32\spoolsv.exe
2012 svchost.exe
228 C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
276 C:\Program Files\Bonjour\mDNSResponder.exe
312 C:\Program Files\Java\jre6\bin\jqs.exe
428 C:\Program Files\Norton AntiVirus\Engine\17.8.0.5\ccSvcHst.exe
756 C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe
904 C:\Program Files\Microsoft IntelliType Pro\itype.exe
920 C:\Program Files\Microsoft IntelliPoint\ipoint.exe
1004 C:\Program Files\Common Files\Seagate\Schedule2\schedhlp.exe
1000 C:\WINDOWS\System32\igfxtray.exe
1008 C:\WINDOWS\System32\hkcmd.exe
872 C:\WINDOWS\System32\igfxpers.exe
660 C:\Program Files\iTunes\iTunesHelper.exe
1232 C:\Program Files\Common Files\Java\Java Update\jusched.exe
1328 C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
1348 C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe
1676 C:\Program Files\Common Files\Seagate\Schedule2\schedul2.exe
1740 C:\WINDOWS\System32\svchost.exe
1732 C:\WINDOWS\System32\ZuneBusEnum.exe
2328 C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
2468 C:\Program Files\iPod\bin\iPodService.exe
2684 wmiprvse.exe
2956 C:\Program Files\MSI\PC Alert 4\PCAlert4.exe
2968 C:\WINDOWS\System32\HPZipm12.exe
2984 alg.exe
3288 C:\Program Files\Norton AntiVirus\Engine\17.8.0.5\ccSvcHst.exe
3644 C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoSTS08.exe
2940 C:\Program Files\Internet Explorer\iexplore.exe
1964 C:\WINDOWS\System32\ctfmon.exe
596 C:\Program Files\Internet Explorer\iexplore.exe
2884 C:\WINDOWS\System32\wscntfy.exe
3440 C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
1820 unsecapp.exe
3300 C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
3396 C:\Documents and Settings\jschmitz\Desktop\AntiSpy\MBRCheck.exe

\\.\C: –> \\.\PhysicalDrive1 at offset 0x00000000`00007e00 (FAT32)
\\.\F: –> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (FAT32)

PhysicalDrive1 Model Number: ST3500418AS, Rev: CC37
PhysicalDrive0 Model Number: IBM-DTLA-307030, Rev: TX4OA60A

Size Device Name MBR Status
——————————————–
465 GB \\.\PhysicalDrive1 Unknown MBR code
SHA1: 597401A4CE7D05F1E68A3BD6A0720148E5DB5F61
28 GB \\.\PhysicalDrive0 Unknown MBR code
SHA1: 597401A4CE7D05F1E68A3BD6A0720148E5DB5F61

Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:
Options:
[1] Dump the MBR of a physical disk to file.
[2] Restore the MBR of a physical disk with a standard boot code.
[3] Exit.

Enter your choice: Enter the physical disk number to dump (0-99, -1 to exit): 1Dumping \\.\PhysicalDisk1…
Enter filename to dump to: dump2.txtDumped successfully!

Enter the physical disk number to dump (0-99, -1 to exit): -1

Done!

Satchfan

Post #13October 1, 2010, 1:17 PM UTC last edited October 1, 2010, 4:24 PM UTC

Jeff S

Please do the following:
• Click on Start, Run, type in cmd
• Press Enter
• Type or paste the following line:
chkdsk F: / f /r
• Press Enter - • A message will appear that says: "chkdsk cannot run because the volume is in use by another process. Would you like to schedule this volume to be checked the next time the system restarts? "
• Type y (for "yes") and then press Enter - A message will appear that will say: "This volume will be checked the next time the system restarts"
• Type exit and then press Enter to close the MS-DOS-style black screen window
• Reboot the computer as you normally would and chkdsk will automatically begin running after your reboot
While chkdsk is running, you will see a light blue window with a dark blue band at the top and bottom. Chkdsk will display the specific stage it is checking as well as the percentage of completion of the stage. You cannot do anything else on your computer while chkdsk is running. When chkdsk is finished, it will automatically reboot (restart) your computer.

This may take some time so don’t stop it until it or turn off your machine while it is running.

When it’s finished, reboot.

Can you also “attach” the dump files, (the two “Gibberish” ones), instead of copying and pasting them.

To attach them, when you have clicked on “Reply”, at the bottom right, click on Browse and locate dump.txt then click on Upload: repeat this for dumpt2.txt.

Also, please can you tell me the make and model of your computer, eg Dell Studio, Acer Aspire etc or if it is custom-built.

Thanks

Satchfan

Jeff S

Post #14October 2, 2010, 7:26 PM UTC

My computer is custom-built on an MSI mainboard. I copied & pasted the chkdsk command you specified and got the following results:

Microsoft Windows XP [Version 5.1.2600]
© Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\jschmitz>chkdsk F: / f /r
Invalid parameter - /

C:\Documents and Settings\jschmitz>

dump.txt and dump2.txt are attached as requested.

Attachments:

Satchfan

Post #15October 3, 2010, 3:56 PM UTC

Hi Jeff S

Thank you for attaching the “dump” files

Could you please run Chkdsk again following the previous instructions but copy and paste in the text below, (an extra space in the previous one prevented it from running properly, my fault, not yours):

chkdsk F: /f /r

Thanks

Satchfan

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

SLLLLOOOOWWWW....

✨ Ask AI

Ask AI