What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

pc is slow loading

14 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I am having problems with my pc taking a long time to load internet explorer. There seems to be somthing running in the background but the startup menu looks fine. Virus checks are clear but I would appprciate someone checking my HiJackThis

log.Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 4:42:51 PM, on 11/1/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\brsvc01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\brss01a.exe
C:\Program Files\Eastlink Internet Security\Common\FSM32.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Eastlink Internet Security\Anti-Virus\fsgk32st.exe
C:\Program Files\Eastlink Internet Security\Common\FSMA32.EXE
C:\Program Files\Eastlink Internet Security\Anti-Virus\FSGK32.EXE
C:\Program Files\Eastlink Internet Security\Common\FSHDLL32.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Program Files\Eastlink Internet Security\FWES\Program\fsdfwd.exe
C:\Program Files\Eastlink Internet Security\Anti-Virus\fssm32.exe
C:\Program Files\Eastlink Internet Security\Anti-Virus\fsav32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Trend Micro\HijackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/?fr=fp-yie8
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.myeastlink.ca/?region=NS
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Yahoo!
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: LitmusBHO - {C6867EB7-8350-4856-877F-93CF8AE3DC9C} - C:\Program Files\Eastlink Internet Security\NRS\iescript\baselitmus.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: Browsing Protection Toolbar - {265EEE8E-3228-44D3-AEA5-F7FDF5860049} - C:\Program Files\Eastlink Internet Security\NRS\iescript\baselitmus.dll
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Eastlink Internet Security\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Eastlink Internet Security\Common\FSM32.EXE" /splash
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} - http://upload.facebook.com/controls/Facebo…toUploader3.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1204246277508
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.0…oUploader55.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} - http://wpotc.kpdsb.on.ca/activex/AxisCamControl.cab
O16 - DPF: {9E515FE4-2A60-4D08-8E96-CF9A967BE49B} (SSMEarthLink Control) - http://check.earthlinksecurity.com/SSMEarthLink.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} - http://cdn2.zone.msn.com/binFramework/v10/…ro.cab34246.cab
O16 - DPF: {BD8667B7-38D8-4C77-B580-18C3E146372C} (Creative Toolbox Plug-in) - http://ak.imgag.com/imgag/cp/install/Crusher.cab
O16 - DPF: {F127B9BA-89EA-4B04-9C67-2074A9DF61FD} - http://walmart.pnimedia.com/upload/activex…tupv2.0.0.9.cab?
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\System32\brsvc01a.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - Unknown owner - C:\Program Files\Eastlink Internet Security\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Eastlink Internet Security\FWES\Program\fsdfwd.exe
O23 - Service: FSMA - F-Secure Corporation - C:\Program Files\Eastlink Internet Security\Common\FSMA32.EXE
O23 - Service: F-Secure ORSP Client (FSORSPClient) - F-Secure Corporation - C:\Program Files\Eastlink Internet Security\ORSP Client\fsorsp.exe
O23 - Service: Google Update Service (gupdate1c9863e5073fc50) (gupdate1c9863e5073fc50) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

–
End of file - 8452 bytes
Post #2
:welcome:

Your HJT log looks ok but its outdated and we dont use it much anymore. We are now using other scanners that show us much more of whats going on on your system.

Before we run another scanner, do this.

Open IE and go to Tools > Internet Options > Advanced Tab > Reset Internet Explorer Settings > Reset…..may take a few seconds…when done , ok your way out, close IE and then restart it and see if this makes a difference.

Then do this.


Download TFC to your desktop
  • Close any open windows.
  • Double click the TFC icon to run the program
  • TFC will close all open programs itself in order to run,
  • Click the Start button to begin the process.
  • Allow TFC to run uninterrupted.
  • The program should not take long to finish it's job
  • Once its finished it should automatically reboot your machine,
  • if it doesn't, manually reboot to ensure a complete clean







Please download Malwarebytes from Here or Here

  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
    [external image: Posted Image]
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected .
  • When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
  • Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.
Post the report please







  • Download OTL to your desktop.
  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • When the window appears, underneath Output at the top change it to Minimal Output.
  • Check the boxes beside LOP Check and Purity Check.
  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt.
    Note:These logs can be located in the OTL. folder on you C:\ drive if they fail to open automatically.
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them both in.



Post the log from Malwarebytes and the log from OTL please
Post #3
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 5026

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

11/2/2010 10:51:42 PM
mbam-log-2010-11-02 (22-51-42).txt

Scan type: Quick scan
Objects scanned: 147042
Time elapsed: 20 minute(s), 4 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

OTL logfile created on: 11/2/2010 10:58:44 PM - Run 1
OTL by OldTimer - Version 3.2.17.2 Folder = C:\Documents and Settings\Robbin\My Documents
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

511.00 Mb Total Physical Memory | 202.00 Mb Available Physical Memory | 39.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 68.00% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 37.27 Gb Total Space | 17.91 Gb Free Space | 48.07% Space Free | Partition Type: NTFS
Drive D: | 7.85 Gb Total Space | 7.72 Gb Free Space | 98.29% Space Free | Partition Type: FAT32

Computer Name: OWNER-F7ZM3W4XH | User Name: Robbin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Robbin\My Documents\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Eastlink Internet Security\ORSP Client\fsorsp.exe (F-Secure Corporation)
PRC - C:\Program Files\Eastlink Internet Security\Anti-Virus\fssm32.exe (F-Secure Corporation)
PRC - C:\Program Files\Eastlink Internet Security\Anti-Virus\fsgk32.exe (F-Secure Corporation)
PRC - C:\Program Files\Eastlink Internet Security\Anti-Virus\fsav32.exe (F-Secure Corporation)
PRC - C:\Program Files\Eastlink Internet Security\Common\FSM32.EXE (F-Secure Corporation)
PRC - C:\Program Files\Eastlink Internet Security\Common\FSMA32.EXE (F-Secure Corporation)
PRC - C:\Program Files\Eastlink Internet Security\Common\FSHDLL32.EXE (F-Secure Corporation)
PRC - C:\Program Files\Eastlink Internet Security\FWES\program\fsdfwd.exe (F-Secure Corporation)
PRC - C:\Program Files\Eastlink Internet Security\Anti-Virus\fsgk32st.exe (F-Secure Corporation)
PRC - C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corporation)
PRC - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\WINDOWS\system32\BRSVC01A.EXE (brother Industries Ltd)
PRC - C:\WINDOWS\system32\BRSS01A.EXE (brother Industries Ltd)


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Robbin\My Documents\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)
MOD - C:\Program Files\Eastlink Internet Security\Spam Control\fsscoepl.dll (F-Secure Corporation)
MOD - c:\Program Files\Eastlink Internet Security\HIPS\fshook32.dll (F-Secure Corporation)


========== Win32 Services (SafeList) ==========

SRV - (HidServ) – C:\WINDOWS\System32\hidserv.dll File not found
SRV - (FSORSPClient) – C:\Program Files\Eastlink Internet Security\ORSP Client\fsorsp.exe (F-Secure Corporation)
SRV - (FSMA) – C:\Program Files\Eastlink Internet Security\Common\FSMA32.EXE (F-Secure Corporation)
SRV - (FSDFWD) – C:\Program Files\Eastlink Internet Security\FWES\Program\fsdfwd.exe (F-Secure Corporation)
SRV - (F-Secure Gatekeeper Handler Starter) – C:\Program Files\Eastlink Internet Security\Anti-Virus\fsgk32st.exe (F-Secure Corporation)
SRV - (fsssvc) – C:\Program Files\Windows Live\Family Safety\fsssvc.exe (Microsoft Corporation)
SRV - (SeaPort) – C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corporation)
SRV - (YahooAUService) – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
SRV - (ServiceLayer) – C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (Nokia.)
SRV - (KodakCCS) – C:\WINDOWS\system32\drivers\KodakCCS.exe (Eastman Kodak Company)
SRV - (Brother XP spl Service) – C:\WINDOWS\system32\BRSVC01A.EXE (brother Industries Ltd)


========== Driver Services (SafeList) ==========

DRV - (fsbts) – C:\WINDOWS\system32\Drivers\fsbts.sys ()
DRV - (F-Secure Gatekeeper) – C:\Program Files\Eastlink Internet Security\Anti-Virus\minifilter\fsgk.sys ()
DRV - (F-Secure HIPS) – C:\Program Files\Eastlink Internet Security\HIPS\drivers\fshs.sys (F-Secure Corporation)
DRV - (FSFW) – C:\WINDOWS\System32\drivers\fsdfw.sys (F-Secure Corporation)
DRV - (F-Secure Filter) – C:\Program Files\Eastlink Internet Security\Anti-Virus\win2k\fsfilter.sys ()
DRV - (F-Secure Recognizer) – C:\Program Files\Eastlink Internet Security\Anti-Virus\win2k\fsrec.sys ()
DRV - (fssfltr) – C:\WINDOWS\system32\drivers\fssfltr_tdi.sys (Microsoft Corporation)
DRV - (gameenum) – C:\WINDOWS\system32\drivers\gameenum.sys (Microsoft Corporation)
DRV - (usbaudio) USB Audio Driver (WDM) – C:\WINDOWS\system32\drivers\usbaudio.sys (Microsoft Corporation)
DRV - (LMouKE) – C:\WINDOWS\system32\drivers\LMouKE.Sys (Logitech Inc.)
DRV - (LHidFilt) – C:\WINDOWS\system32\drivers\LHidFilt.Sys (Logitech, Inc.)
DRV - (LMouFilt) – C:\WINDOWS\system32\drivers\LMouFilt.Sys (Logitech, Inc.)
DRV - (LUsbFilt) – C:\WINDOWS\system32\drivers\LUsbFilt.sys (Logitech, Inc.)
DRV - (L8042mou) – C:\WINDOWS\system32\drivers\L8042mou.Sys (Logitech Inc.)
DRV - (L8042Kbd) – C:\WINDOWS\system32\drivers\L8042Kbd.sys (Logitech Inc.)
DRV - (DcCam) – C:\WINDOWS\system32\drivers\DcCam.sys (Eastman Kodak Company)
DRV - (PD0620VID) – C:\WINDOWS\system32\drivers\P0620Vid.sys (Creative Technology Ltd.)
DRV - (Exportit) – C:\WINDOWS\system32\drivers\ExportIt.sys (Eastman Kodak Company)
DRV - (DcPTP) – C:\WINDOWS\system32\drivers\DcPtp.sys (Eastman Kodak Company)
DRV - (DcLps) – C:\WINDOWS\system32\drivers\DcLps.sys (Eastman Kodak Company)
DRV - (DCFS2K) – C:\WINDOWS\system32\drivers\DCFS2k.sys (Eastman Kodak Company)
DRV - (DcFpoint) – C:\WINDOWS\system32\drivers\DcFpoint.sys (Eastman Kodak Company)
DRV - (ati2mtag) – C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (VCR878) – C:\WINDOWS\system32\drivers\VCR878.sys (Video Communication Research Inc.)
DRV - (VIAudio) VIA AC'97 Audio Controller (WDM) – C:\WINDOWS\system32\drivers\ac97via.sys (VIA Technologies, Inc.)
DRV - (Esdpdx01) – C:\WINDOWS\system32\drivers\ESDPDX01.SYS (MK Systems CO., LTD.)
DRV - (HCF_MSFT) – C:\WINDOWS\system32\drivers\HCF_MSFT.sys (Conexant)
DRV - (sfman) Creative SoundFont Manager Driver (WDM) – C:\WINDOWS\system32\drivers\sfmanm.sys (Creative Technology Ltd.)
DRV - (emu10k1) Creative Interface Manager Driver (WDM) – C:\WINDOWS\system32\drivers\ctlfacem.sys (Creative Technology Ltd.)
DRV - (emu10k) Creative SB Live! (WDM) – C:\WINDOWS\system32\drivers\emu10k1m.sys (Creative Technology Ltd.)
DRV - (ctljystk) – C:\WINDOWS\system32\drivers\ctljystk.sys (Creative Technology Ltd.)
DRV - (rtl8029) Realtek RTL8029(AS) – C:\WINDOWS\system32\drivers\RTL8029.sys (Realtek Semiconductor Corporation)
DRV - (EL90XBC) – C:\WINDOWS\system32\drivers\el90xbc5.sys (3Com Corporation)
DRV - (atirage3) – C:\WINDOWS\system32\drivers\atimpae.sys (ATI Technologies Inc.)
DRV - (DC21x4) – C:\WINDOWS\system32\drivers\dc21x4.sys (Intel Corporation.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.myeastlink.ca/?region=NS
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Google"
FF - prefs.js..browser.search.defaulturl: "http://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q="
FF - prefs.js..browser.search.selectedEngine: "Google"

FF - HKLM\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\Eastlink Internet Security\NRS\[removed] [2010/09/07 11:27:37 | 000,000,000 | —D | M]

[2008/03/30 16:27:49 | 000,000,000 | —D | M] – C:\Documents and Settings\Robbin\Application Data\Mozilla\Firefox\Profiles\oj4dkvq9.default\extensions
[2008/03/30 16:27:49 | 000,000,000 | —D | M] (Google Toolbar for Firefox) – C:\Documents and Settings\Robbin\Application Data\Mozilla\Firefox\Profiles\oj4dkvq9.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2008/03/30 18:45:42 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2008/03/30 11:41:55 | 000,000,000 | —D | M] (Google Toolbar for Firefox) – C:\Program Files\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}

O1 HOSTS File: ([2009/02/07 14:39:23 | 000,287,058 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 www.123haustiereundmehr.com
O1 - Hosts: 127.0.0.1 123haustiereundmehr.com
O1 - Hosts: 9919 more lines…
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll (Yahoo! Inc.)
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
O2 - BHO: (Browsing Protection Class) - {C6867EB7-8350-4856-877F-93CF8AE3DC9C} - C:\Program Files\Eastlink Internet Security\NRS\iescript\baselitmus.dll (F-Secure Corporation)
O2 - BHO: (Windows Live Toolbar Helper) - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (Browsing Protection Toolbar) - {265EEE8E-3228-44D3-AEA5-F7FDF5860049} - C:\Program Files\Eastlink Internet Security\NRS\iescript\baselitmus.dll (F-Secure Corporation)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll (Yahoo! Inc.)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\ShellBrowser: (&Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (&Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [F-Secure Manager] C:\Program Files\Eastlink Internet Security\Common\FSM32.EXE (F-Secure Corporation)
O4 - HKLM..\Run: [F-Secure TNB] C:\Program Files\Eastlink Internet Security\FSGUI\TNBUtil.exe (F-Secure Corporation)
O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSimpleStartMenu = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: Intellimenus = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoClose = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLogOff = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSaveSettings = 0
O9 - Extra Button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\Eastlink Internet Security\FSPS\program\FSLSP.DLL (F-Secure Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\Eastlink Internet Security\FSPS\program\FSLSP.DLL (F-Secure Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files\Eastlink Internet Security\FSPS\program\FSLSP.DLL (F-Secure Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000035 - C:\Program Files\Eastlink Internet Security\FSPS\program\FSLSP.DLL (F-Secure Corporation)
O15 - HKCU\..Trusted Domains: facebook.com ([www] https in Trusted sites)
O15 - HKCU\..Trusted Domains: yahoo.com ([answers] http in Trusted sites)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} http://www.apple.com/qtactivex/qtplugin.cab (QuickTime Object)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://fpdownload.macromedia.com/get/shock…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\Common\yinsthelper.dll (YInstStarter Class)
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} http://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab (MSN Photo Upload Tool)
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} http://upload.facebook.com/controls/Facebo…toUploader3.cab (Reg Error: Key error.)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/microsoftu…b?1204246277508 (MUWebControl Class)
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.0…oUploader55.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} http://wpotc.kpdsb.on.ca/activex/AxisCamControl.cab (Reg Error: Key error.)
O16 - DPF: {9E515FE4-2A60-4D08-8E96-CF9A967BE49B} http://check.earthlinksecurity.com/SSMEarthLink.cab (SSMEarthLink Control)
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} http://v4.windowsupdate.microsoft.com/CAB/…8002.3658564815 (Reg Error: Key error.)
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} http://cdn2.zone.msn.com/binFramework/v10/…ro.cab34246.cab (Reg Error: Key error.)
O16 - DPF: {BD8667B7-38D8-4C77-B580-18C3E146372C} http://ak.imgag.com/imgag/cp/install/Crusher.cab (Creative Toolbox Plug-in)
O16 - DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/pub/shock…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {F127B9BA-89EA-4B04-9C67-2074A9DF61FD} http://walmart.pnimedia.com/upload/activex…tupv2.0.0.9.cab? (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\bwfile-8876480 {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll (Logitech Inc.)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll ()
O20 - Winlogon\Notify\dimsntfy: DllName - - File not found
O20 - Winlogon\Notify\WgaLogon: DllName - WgaLogon.dll - File not found
O21 - SSODL: CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} - CLSID or File not found.
O24 - Desktop WallPaper: C:\Documents and Settings\Robbin\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Robbin\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/01/01 16:15:21 | 000,000,000 | —- | M] () - C:\AUTOEXEC-BEFOREREMOVINGV7STUFF.BAT – [ NTFS ]
O32 - AutoRun File - [2002/08/24 13:18:28 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O33 - MountPoints2\{8de3f810-b77c-11d6-ad3e-806d6172696f}\Shell - "" = AutoRun
O33 - MountPoints2\{8de3f810-b77c-11d6-ad3e-806d6172696f}\Shell\AutoRun - "" = Auto&Play
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/11/02 22:57:42 | 000,576,000 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Robbin\My Documents\OTL.exe
[2010/11/02 22:07:11 | 000,446,464 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Robbin\My Documents\TFC.exe
[2010/10/29 16:38:04 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Yahoo!
[2010/10/29 14:25:32 | 000,000,000 | -H-D | C] – C:\WINDOWS\ie8
[2010/10/29 14:12:21 | 011,080,192 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ieframe.dll
[2010/10/29 13:21:39 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Robbin\Recent
[2010/10/27 19:11:37 | 000,000,000 | —D | C] – C:\Program Files\Runtime Software
[2010/10/14 13:44:19 | 000,953,856 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mfc40u.dll
[2010/10/14 13:44:18 | 000,974,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mfc42.dll
[2010/10/14 13:43:32 | 000,617,472 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\comctl32.dll
[2005/12/05 19:00:46 | 002,247,888 | —- | C] (Microsoft Corporation) – C:\Program Files\dsetup32.dll
[2005/12/05 19:00:46 | 000,484,560 | —- | C] (Microsoft Corporation) – C:\Program Files\DXSETUP.exe
[2005/12/05 19:00:46 | 000,074,448 | —- | C] (Microsoft Corporation) – C:\Program Files\DSETUP.dll

========== Files - Modified Within 30 Days ==========

[2010/11/02 23:02:02 | 000,000,886 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/11/02 22:57:52 | 000,576,000 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Robbin\My Documents\OTL.exe
[2010/11/02 22:47:05 | 000,007,062 | —- | M] () – C:\WINDOWS\Robbin8.xlb
[2010/11/02 22:43:54 | 000,595,970 | —- | M] () – C:\Documents and Settings\Robbin\My Documents\Latitude C600[1].part8 laptop.rar
[2010/11/02 22:28:08 | 000,000,696 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/11/02 22:12:23 | 000,000,868 | —- | M] () – C:\WINDOWS\tasks\Google Software Updater.job
[2010/11/02 22:12:02 | 000,000,882 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/11/02 22:11:55 | 000,012,598 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/11/02 22:11:53 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/11/02 22:11:51 | 536,403,968 | -HS- | M] () – C:\hiberfil.sys
[2010/11/02 22:07:11 | 000,446,464 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Robbin\My Documents\TFC.exe
[2010/11/02 00:03:41 | 000,000,508 | —- | M] () – C:\WINDOWS\tasks\Scheduled scanning task.job
[2010/11/01 18:52:53 | 003,859,456 | R— | M] () – C:\Documents and Settings\All Users\Documents\ESBK.mbb
[2010/11/01 18:52:51 | 002,732,032 | R— | M] () – C:\Documents and Settings\All Users\Documents\ESBK.mb
[2010/11/01 16:39:12 | 000,001,986 | —- | M] () – C:\Documents and Settings\Robbin\Desktop\HiJackThis.lnk
[2010/11/01 15:35:43 | 000,000,211 | RHS- | M] () – C:\boot.ini
[2010/10/30 03:05:10 | 000,001,393 | —- | M] () – C:\WINDOWS\imsins.BAK
[2010/10/29 16:38:01 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/10/29 14:55:32 | 000,000,815 | —- | M] () – C:\Documents and Settings\Robbin\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2010/10/28 19:12:58 | 000,054,156 | -H– | M] () – C:\WINDOWS\QTFont.qfn
[2010/10/17 14:33:35 | 000,079,872 | —- | M] () – C:\WINDOWS\Robbin.pcb
[2010/10/15 07:37:02 | 000,122,928 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2010/10/10 15:08:09 | 000,000,000 | -H– | M] () – C:\WINDOWS\System32\drivers\Msft_Kernel_LMouFilt_01005.Wdf
[2010/10/10 15:07:56 | 000,000,000 | -H– | M] () – C:\WINDOWS\System32\drivers\Msft_Kernel_LUsbFilt_01005.Wdf
[2010/10/10 15:07:52 | 000,000,000 | -H– | M] () – C:\WINDOWS\System32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
[2010/10/07 03:15:21 | 000,577,262 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/10/07 03:15:21 | 000,128,644 | —- | M] () – C:\WINDOWS\System32\perfc009.dat

========== Files Created - No Company Name ==========

[2010/11/01 16:39:12 | 000,001,986 | —- | C] () – C:\Documents and Settings\Robbin\Desktop\HiJackThis.lnk
[2010/10/29 14:29:15 | 000,001,393 | —- | C] () – C:\WINDOWS\imsins.BAK
[2010/10/10 15:08:09 | 000,000,000 | -H– | C] () – C:\WINDOWS\System32\drivers\Msft_Kernel_LMouFilt_01005.Wdf
[2010/10/10 15:07:56 | 000,000,000 | -H– | C] () – C:\WINDOWS\System32\drivers\Msft_Kernel_LUsbFilt_01005.Wdf
[2010/10/10 15:07:52 | 000,000,000 | -H– | C] () – C:\WINDOWS\System32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
[2010/07/26 20:33:33 | 000,165,376 | —- | C] () – C:\WINDOWS\System32\unrar.dll
[2009/11/15 13:28:06 | 000,204,800 | —- | C] () – C:\WINDOWS\System32\VProPage.dll
[2009/11/09 21:41:34 | 000,000,036 | —- | C] () – C:\Documents and Settings\Robbin\Local Settings\Application Data\housecall.guid.cache
[2009/08/31 15:00:22 | 000,021,504 | —- | C] () – C:\WINDOWS\System32\WBCustomizer.dll
[2009/08/31 15:00:21 | 000,185,344 | —- | C] () – C:\WINDOWS\System32\MemWarp.dll
[2009/05/03 08:54:48 | 000,000,412 | —- | C] () – C:\WINDOWS\MAXLINK.INI
[2009/04/14 23:10:32 | 000,007,552 | —- | C] () – C:\WINDOWS\System32\drivers\enodpl.sys
[2009/04/14 23:10:32 | 000,004,736 | —- | C] () – C:\WINDOWS\System32\drivers\tandpl.sys
[2009/03/28 09:48:30 | 000,041,624 | —- | C] () – C:\WINDOWS\System32\drivers\fsbts.sys
[2008/10/28 20:55:46 | 000,000,000 | —- | C] () – C:\WINDOWS\Gliftex7.INI
[2007/09/20 23:10:42 | 000,075,264 | —- | C] () – C:\WINDOWS\System32\unacev2.dll
[2007/02/04 16:29:28 | 000,000,092 | —- | C] () – C:\WINDOWS\dellstat.ini
[2007/02/04 16:29:25 | 000,000,306 | —- | C] () – C:\WINDOWS\lexstat.ini
[2006/10/02 19:54:18 | 000,000,022 | —- | C] () – C:\WINDOWS\exchng.ini
[2006/10/02 19:54:17 | 000,000,611 | —- | C] () – C:\WINDOWS\ODBC.INI
[2006/08/13 13:57:46 | 000,000,268 | —- | C] () – C:\WINDOWS\_delis32.ini
[2006/06/09 02:18:03 | 000,000,299 | —- | C] () – C:\Program Files\ Terms.html
[2006/05/10 15:42:10 | 000,001,759 | —- | C] () – C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2006/01/20 20:37:03 | 000,000,156 | —- | C] () – C:\WINDOWS\cdplayer.ini
[2006/01/18 23:30:05 | 000,002,324 | —- | C] () – C:\WINDOWS\Contour.INI
[2006/01/18 22:56:46 | 000,001,998 | —- | C] () – C:\WINDOWS\RADAR.INI
[2006/01/18 22:51:52 | 000,006,420 | —- | C] () – C:\WINDOWS\tides.ini
[2006/01/18 22:51:39 | 000,413,792 | —- | C] () – C:\WINDOWS\System32\Tbpro3w.dll
[2006/01/18 22:51:39 | 000,124,416 | —- | C] () – C:\WINDOWS\System32\Tbpro1w.dll
[2006/01/18 22:51:39 | 000,108,016 | —- | C] () – C:\WINDOWS\System32\Tbpro2w.dll
[2006/01/18 22:51:38 | 000,072,231 | —- | C] () – C:\WINDOWS\System32\Tbpro6w.dll
[2006/01/18 22:51:38 | 000,070,144 | —- | C] () – C:\WINDOWS\System32\Tbpro5w.dll
[2006/01/18 22:51:38 | 000,056,987 | —- | C] () – C:\WINDOWS\System32\Tbpro4w.dll
[2006/01/18 21:04:45 | 000,010,240 | —- | C] () – C:\WINDOWS\System32\vidx16.dll
[2006/01/18 21:04:36 | 000,000,000 | —- | C] () – C:\WINDOWS\nsrex.INI
[2006/01/18 21:02:10 | 000,018,795 | —- | C] () – C:\WINDOWS\wininit.ini
[2006/01/18 00:34:24 | 000,013,824 | —- | C] () – C:\Documents and Settings\Robbin\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2005/12/05 19:28:30 | 003,673,932 | —- | C] () – C:\Program Files\Dec2005_MDX1_x86_Archive.cab
[2005/12/05 19:28:04 | 001,358,864 | —- | C] () – C:\Program Files\Dec2005_d3dx9_28_x64.cab
[2005/12/05 19:28:02 | 000,086,925 | —- | C] () – C:\Program Files\Oct2005_xinput_x64.cab
[2005/12/05 19:28:02 | 000,046,247 | —- | C] () – C:\Program Files\Oct2005_xinput_x86.cab
[2005/12/05 19:28:02 | 000,041,888 | —- | C] () – C:\Program Files\dxdllreg_x86.cab
[2005/12/05 19:28:00 | 000,916,806 | —- | C] () – C:\Program Files\Dec2005_MDX1_x86.cab
[2005/12/05 19:27:58 | 001,080,344 | —- | C] () – C:\Program Files\Dec2005_d3dx9_28_x86.cab
[2005/12/05 19:00:46 | 000,081,092 | —- | C] () – C:\Program Files\dxupdate.cab
[2005/12/05 19:00:44 | 001,351,430 | —- | C] () – C:\Program Files\Aug2005_d3dx9_27_x64.cab
[2005/12/05 19:00:44 | 001,348,242 | —- | C] () – C:\Program Files\Apr2005_d3dx9_25_x64.cab
[2005/12/05 19:00:44 | 001,336,890 | —- | C] () – C:\Program Files\Jun2005_d3dx9_26_x64.cab
[2005/12/05 19:00:44 | 001,248,387 | —- | C] () – C:\Program Files\Feb2005_d3dx9_24_x64.cab
[2005/12/05 19:00:44 | 001,079,850 | —- | C] () – C:\Program Files\Apr2005_d3dx9_25_x86.cab
[2005/12/05 19:00:44 | 001,078,532 | —- | C] () – C:\Program Files\Aug2005_d3dx9_27_x86.cab
[2005/12/05 19:00:44 | 001,065,813 | —- | C] () – C:\Program Files\Jun2005_d3dx9_26_x86.cab
[2005/12/05 19:00:44 | 001,014,113 | —- | C] () – C:\Program Files\Feb2005_d3dx9_24_x86.cab
[2005/12/05 19:00:42 | 013,265,040 | —- | C] () – C:\Program Files\dxnt.cab
[2005/12/05 19:00:40 | 015,493,481 | —- | C] () – C:\Program Files\DirectX.cab
[2005/12/05 19:00:40 | 001,156,363 | —- | C] () – C:\Program Files\BDANT.cab
[2005/12/05 19:00:40 | 000,976,020 | —- | C] () – C:\Program Files\BDAXP.cab
[2005/12/05 19:00:40 | 000,703,080 | —- | C] () – C:\Program Files\BDA.cab
[2005/08/31 12:43:32 | 000,098,304 | —- | C] () – C:\WINDOWS\System32\resourceGeneric.dll
[2004/04/21 23:58:26 | 000,086,016 | —- | C] () – C:\WINDOWS\System32\ati2evxx.dll
[2004/01/16 10:33:41 | 000,004,346 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2004/01/01 16:34:35 | 000,000,466 | —- | C] () – C:\WINDOWS\Alcdun.ini
[2004/01/01 16:33:52 | 000,001,580 | —- | C] () – C:\WINDOWS\ALCL32.INI
[2004/01/01 16:33:52 | 000,001,016 | —- | C] () – C:\WINDOWS\AliCPOS.INI
[2004/01/01 15:59:50 | 000,363,520 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2004/01/01 13:46:36 | 000,001,602 | —- | C] () – C:\WINDOWS\System32\Oeminfo.ini
[2004/01/01 13:21:41 | 000,000,410 | —- | C] () – C:\WINDOWS\brwmark.ini
[2004/01/01 13:21:40 | 000,000,030 | —- | C] () – C:\WINDOWS\System32\brss01a.ini
[2004/01/01 13:21:38 | 000,000,052 | —- | C] () – C:\WINDOWS\BRPP2KA.INI
[2002/11/14 13:58:04 | 000,200,192 | —- | C] () – C:\WINDOWS\System32\ir50_qc.dll
[2002/11/14 13:58:04 | 000,183,808 | —- | C] () – C:\WINDOWS\System32\ir50_qcx.dll
[2002/11/14 13:58:02 | 000,755,200 | —- | C] () – C:\WINDOWS\System32\ir50_32.dll
[2002/11/14 13:58:02 | 000,338,432 | —- | C] () – C:\WINDOWS\System32\ir41_qcx.dll
[2002/11/14 13:58:02 | 000,120,320 | —- | C] () – C:\WINDOWS\System32\ir41_qc.dll
[2002/08/24 13:49:25 | 000,081,966 | —- | C] () – C:\WINDOWS\System32\VCC4Control.dll
[2002/08/24 13:38:56 | 000,241,742 | —- | C] () – C:\WINDOWS\System32\VCR878DL.dll
[2002/08/24 13:38:56 | 000,225,338 | —- | C] () – C:\WINDOWS\System32\BIOSTIMEDLL.DLL
[2002/08/24 13:38:56 | 000,217,168 | —- | C] () – C:\WINDOWS\System32\CsLilinDll.dll
[2002/08/24 13:38:56 | 000,213,058 | —- | C] () – C:\WINDOWS\System32\PelcoDll.dll
[2002/08/24 13:38:56 | 000,204,853 | —- | C] () – C:\WINDOWS\System32\CommDll.dll
[2002/08/24 13:38:56 | 000,069,632 | —- | C] () – C:\WINDOWS\System32\VCC4.dll
[2002/08/24 13:33:16 | 000,058,880 | —- | C] () – C:\WINDOWS\System32\VXRAS.DLL
[2002/08/24 13:13:53 | 000,000,058 | —- | C] () – C:\WINDOWS\brmx2001.ini
[2002/08/24 13:13:53 | 000,000,040 | —- | C] () – C:\WINDOWS\opt_1230.ini
[2002/08/24 12:12:40 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2000/09/08 17:53:50 | 000,073,839 | —- | C] () – C:\WINDOWS\System32\KodakOneTouch.dll
[2000/01/06 21:00:00 | 000,024,448 | —- | C] () – C:\WINDOWS\sysgtime.dll
[2000/01/06 21:00:00 | 000,024,448 | —- | C] () – C:\WINDOWS\System32\proclsvr.drv
[1996/11/17 00:00:00 | 000,022,016 | —- | C] () – C:\WINDOWS\System32\ODBCSTF.DLL
[1996/11/17 00:00:00 | 000,022,016 | —- | C] () – C:\WINDOWS\System32\DOCOBJ.DLL
[1996/11/17 00:00:00 | 000,012,288 | —- | C] () – C:\WINDOWS\System32\HLINKPRX.DLL

========== LOP Check ==========

[2009/05/17 18:26:54 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Avg7
[2007/02/04 16:33:51 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\BVRP Software
[2009/05/03 08:45:22 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\CanonBJ
[2009/03/28 09:38:46 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\F-Secure
[2010/09/04 14:51:25 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Fighters
[2010/03/22 20:07:27 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\fssg
[2007/07/10 19:42:14 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Grisoft
[2008/04/20 12:51:52 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Installations
[2006/05/03 19:24:11 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\JollyBear
[2007/10/07 14:36:07 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\n7-89-o9-3r-4t-r9
[2009/04/14 21:58:54 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PC Drivers HeadQuarters
[2007/06/11 20:14:12 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PC Suite
[2006/01/30 21:07:41 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PopCap
[2008/10/28 20:49:46 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Ransen Software
[2009/05/03 08:54:35 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\ScanSoft
[2006/12/22 21:18:15 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Smilebox
[2009/02/08 17:25:56 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2009/05/17 16:22:48 | 000,000,000 | —D | M] – C:\Documents and Settings\Robbin\Application Data\Canon
[2010/03/22 20:14:55 | 000,000,000 | —D | M] – C:\Documents and Settings\Robbin\Application Data\F-Secure
[2007/10/07 14:36:00 | 000,000,000 | —D | M] – C:\Documents and Settings\Robbin\Application Data\GameHouse
[2010/10/29 13:17:54 | 000,000,000 | —D | M] – C:\Documents and Settings\Robbin\Application Data\Jarte
[2007/11/24 16:29:10 | 000,000,000 | —D | M] – C:\Documents and Settings\Robbin\Application Data\LimeWire
[2007/01/15 16:23:40 | 000,000,000 | —D | M] – C:\Documents and Settings\Robbin\Application Data\Netscape
[2008/02/24 19:51:24 | 000,000,000 | —D | M] – C:\Documents and Settings\Robbin\Application Data\Nokia
[2007/06/08 02:25:21 | 000,000,000 | —D | M] – C:\Documents and Settings\Robbin\Application Data\Paltalk
[2008/02/24 20:01:38 | 000,000,000 | —D | M] – C:\Documents and Settings\Robbin\Application Data\PC Suite
[2009/05/03 08:54:41 | 000,000,000 | —D | M] – C:\Documents and Settings\Robbin\Application Data\ScanSoft
[2009/02/09 15:31:03 | 000,000,000 | —D | M] – C:\Documents and Settings\Robbin\Application Data\Smart PC Solutions
[2010/07/07 13:27:05 | 000,000,000 | —D | M] – C:\Documents and Settings\Robbin\Application Data\Uniblue
[2010/02/27 01:12:49 | 000,000,000 | —D | M] – C:\Documents and Settings\Robbin\Application Data\Windows Live Writer
[2008/03/03 15:30:29 | 000,000,000 | —D | M] – C:\Documents and Settings\Robbin\Application Data\WinPatrol
[2010/11/02 00:03:41 | 000,000,508 | —- | M] () – C:\WINDOWS\Tasks\Scheduled scanning task.job

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 112 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CB0AACC9
@Alternate Data Stream - 106 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:B63300D1

< End of report >
Post #4
OTL logfile created on: 11/2/2010 10:58:44 PM - Run 1
OTL by OldTimer - Version 3.2.17.2 Folder = C:\Documents and Settings\Robbin\My Documents
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

511.00 Mb Total Physical Memory | 202.00 Mb Available Physical Memory | 39.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 68.00% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 37.27 Gb Total Space | 17.91 Gb Free Space | 48.07% Space Free | Partition Type: NTFS
Drive D: | 7.85 Gb Total Space | 7.72 Gb Free Space | 98.29% Space Free | Partition Type: FAT32

Computer Name: OWNER-F7ZM3W4XH | User Name: Robbin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Robbin\My Documents\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Eastlink Internet Security\ORSP Client\fsorsp.exe (F-Secure Corporation)
PRC - C:\Program Files\Eastlink Internet Security\Anti-Virus\fssm32.exe (F-Secure Corporation)
PRC - C:\Program Files\Eastlink Internet Security\Anti-Virus\fsgk32.exe (F-Secure Corporation)
PRC - C:\Program Files\Eastlink Internet Security\Anti-Virus\fsav32.exe (F-Secure Corporation)
PRC - C:\Program Files\Eastlink Internet Security\Common\FSM32.EXE (F-Secure Corporation)
PRC - C:\Program Files\Eastlink Internet Security\Common\FSMA32.EXE (F-Secure Corporation)
PRC - C:\Program Files\Eastlink Internet Security\Common\FSHDLL32.EXE (F-Secure Corporation)
PRC - C:\Program Files\Eastlink Internet Security\FWES\program\fsdfwd.exe (F-Secure Corporation)
PRC - C:\Program Files\Eastlink Internet Security\Anti-Virus\fsgk32st.exe (F-Secure Corporation)
PRC - C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corporation)
PRC - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\WINDOWS\system32\BRSVC01A.EXE (brother Industries Ltd)
PRC - C:\WINDOWS\system32\BRSS01A.EXE (brother Industries Ltd)


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Robbin\My Documents\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)
MOD - C:\Program Files\Eastlink Internet Security\Spam Control\fsscoepl.dll (F-Secure Corporation)
MOD - c:\Program Files\Eastlink Internet Security\HIPS\fshook32.dll (F-Secure Corporation)


========== Win32 Services (SafeList) ==========

SRV - (HidServ) – C:\WINDOWS\System32\hidserv.dll File not found
SRV - (FSORSPClient) – C:\Program Files\Eastlink Internet Security\ORSP Client\fsorsp.exe (F-Secure Corporation)
SRV - (FSMA) – C:\Program Files\Eastlink Internet Security\Common\FSMA32.EXE (F-Secure Corporation)
SRV - (FSDFWD) – C:\Program Files\Eastlink Internet Security\FWES\Program\fsdfwd.exe (F-Secure Corporation)
SRV - (F-Secure Gatekeeper Handler Starter) – C:\Program Files\Eastlink Internet Security\Anti-Virus\fsgk32st.exe (F-Secure Corporation)
SRV - (fsssvc) – C:\Program Files\Windows Live\Family Safety\fsssvc.exe (Microsoft Corporation)
SRV - (SeaPort) – C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corporation)
SRV - (YahooAUService) – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
SRV - (ServiceLayer) – C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (Nokia.)
SRV - (KodakCCS) – C:\WINDOWS\system32\drivers\KodakCCS.exe (Eastman Kodak Company)
SRV - (Brother XP spl Service) – C:\WINDOWS\system32\BRSVC01A.EXE (brother Industries Ltd)


========== Driver Services (SafeList) ==========

DRV - (fsbts) – C:\WINDOWS\system32\Drivers\fsbts.sys ()
DRV - (F-Secure Gatekeeper) – C:\Program Files\Eastlink Internet Security\Anti-Virus\minifilter\fsgk.sys ()
DRV - (F-Secure HIPS) – C:\Program Files\Eastlink Internet Security\HIPS\drivers\fshs.sys (F-Secure Corporation)
DRV - (FSFW) – C:\WINDOWS\System32\drivers\fsdfw.sys (F-Secure Corporation)
DRV - (F-Secure Filter) – C:\Program Files\Eastlink Internet Security\Anti-Virus\win2k\fsfilter.sys ()
DRV - (F-Secure Recognizer) – C:\Program Files\Eastlink Internet Security\Anti-Virus\win2k\fsrec.sys ()
DRV - (fssfltr) – C:\WINDOWS\system32\drivers\fssfltr_tdi.sys (Microsoft Corporation)
DRV - (gameenum) – C:\WINDOWS\system32\drivers\gameenum.sys (Microsoft Corporation)
DRV - (usbaudio) USB Audio Driver (WDM) – C:\WINDOWS\system32\drivers\usbaudio.sys (Microsoft Corporation)
DRV - (LMouKE) – C:\WINDOWS\system32\drivers\LMouKE.Sys (Logitech Inc.)
DRV - (LHidFilt) – C:\WINDOWS\system32\drivers\LHidFilt.Sys (Logitech, Inc.)
DRV - (LMouFilt) – C:\WINDOWS\system32\drivers\LMouFilt.Sys (Logitech, Inc.)
DRV - (LUsbFilt) – C:\WINDOWS\system32\drivers\LUsbFilt.sys (Logitech, Inc.)
DRV - (L8042mou) – C:\WINDOWS\system32\drivers\L8042mou.Sys (Logitech Inc.)
DRV - (L8042Kbd) – C:\WINDOWS\system32\drivers\L8042Kbd.sys (Logitech Inc.)
DRV - (DcCam) – C:\WINDOWS\system32\drivers\DcCam.sys (Eastman Kodak Company)
DRV - (PD0620VID) – C:\WINDOWS\system32\drivers\P0620Vid.sys (Creative Technology Ltd.)
DRV - (Exportit) – C:\WINDOWS\system32\drivers\ExportIt.sys (Eastman Kodak Company)
DRV - (DcPTP) – C:\WINDOWS\system32\drivers\DcPtp.sys (Eastman Kodak Company)
DRV - (DcLps) – C:\WINDOWS\system32\drivers\DcLps.sys (Eastman Kodak Company)
DRV - (DCFS2K) – C:\WINDOWS\system32\drivers\DCFS2k.sys (Eastman Kodak Company)
DRV - (DcFpoint) – C:\WINDOWS\system32\drivers\DcFpoint.sys (Eastman Kodak Company)
DRV - (ati2mtag) – C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (VCR878) – C:\WINDOWS\system32\drivers\VCR878.sys (Video Communication Research Inc.)
DRV - (VIAudio) VIA AC'97 Audio Controller (WDM) – C:\WINDOWS\system32\drivers\ac97via.sys (VIA Technologies, Inc.)
DRV - (Esdpdx01) – C:\WINDOWS\system32\drivers\ESDPDX01.SYS (MK Systems CO., LTD.)
DRV - (HCF_MSFT) – C:\WINDOWS\system32\drivers\HCF_MSFT.sys (Conexant)
DRV - (sfman) Creative SoundFont Manager Driver (WDM) – C:\WINDOWS\system32\drivers\sfmanm.sys (Creative Technology Ltd.)
DRV - (emu10k1) Creative Interface Manager Driver (WDM) – C:\WINDOWS\system32\drivers\ctlfacem.sys (Creative Technology Ltd.)
DRV - (emu10k) Creative SB Live! (WDM) – C:\WINDOWS\system32\drivers\emu10k1m.sys (Creative Technology Ltd.)
DRV - (ctljystk) – C:\WINDOWS\system32\drivers\ctljystk.sys (Creative Technology Ltd.)
DRV - (rtl8029) Realtek RTL8029(AS) – C:\WINDOWS\system32\drivers\RTL8029.sys (Realtek Semiconductor Corporation)
DRV - (EL90XBC) – C:\WINDOWS\system32\drivers\el90xbc5.sys (3Com Corporation)
DRV - (atirage3) – C:\WINDOWS\system32\drivers\atimpae.sys (ATI Technologies Inc.)
DRV - (DC21x4) – C:\WINDOWS\system32\drivers\dc21x4.sys (Intel Corporation.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.myeastlink.ca/?region=NS
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Google"
FF - prefs.js..browser.search.defaulturl: "http://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q="
FF - prefs.js..browser.search.selectedEngine: "Google"

FF - HKLM\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\Eastlink Internet Security\NRS\[removed] [2010/09/07 11:27:37 | 000,000,000 | —D | M]

[2008/03/30 16:27:49 | 000,000,000 | —D | M] – C:\Documents and Settings\Robbin\Application Data\Mozilla\Firefox\Profiles\oj4dkvq9.default\extensions
[2008/03/30 16:27:49 | 000,000,000 | —D | M] (Google Toolbar for Firefox) – C:\Documents and Settings\Robbin\Application Data\Mozilla\Firefox\Profiles\oj4dkvq9.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2008/03/30 18:45:42 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2008/03/30 11:41:55 | 000,000,000 | —D | M] (Google Toolbar for Firefox) – C:\Program Files\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}

O1 HOSTS File: ([2009/02/07 14:39:23 | 000,287,058 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 www.123haustiereundmehr.com
O1 - Hosts: 127.0.0.1 123haustiereundmehr.com
O1 - Hosts: 9919 more lines…
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll (Yahoo! Inc.)
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
O2 - BHO: (Browsing Protection Class) - {C6867EB7-8350-4856-877F-93CF8AE3DC9C} - C:\Program Files\Eastlink Internet Security\NRS\iescript\baselitmus.dll (F-Secure Corporation)
O2 - BHO: (Windows Live Toolbar Helper) - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (Browsing Protection Toolbar) - {265EEE8E-3228-44D3-AEA5-F7FDF5860049} - C:\Program Files\Eastlink Internet Security\NRS\iescript\baselitmus.dll (F-Secure Corporation)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll (Yahoo! Inc.)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\ShellBrowser: (&Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (&Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [F-Secure Manager] C:\Program Files\Eastlink Internet Security\Common\FSM32.EXE (F-Secure Corporation)
O4 - HKLM..\Run: [F-Secure TNB] C:\Program Files\Eastlink Internet Security\FSGUI\TNBUtil.exe (F-Secure Corporation)
O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSimpleStartMenu = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: Intellimenus = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoClose = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLogOff = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSaveSettings = 0
O9 - Extra Button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\Eastlink Internet Security\FSPS\program\FSLSP.DLL (F-Secure Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\Eastlink Internet Security\FSPS\program\FSLSP.DLL (F-Secure Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files\Eastlink Internet Security\FSPS\program\FSLSP.DLL (F-Secure Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000035 - C:\Program Files\Eastlink Internet Security\FSPS\program\FSLSP.DLL (F-Secure Corporation)
O15 - HKCU\..Trusted Domains: facebook.com ([www] https in Trusted sites)
O15 - HKCU\..Trusted Domains: yahoo.com ([answers] http in Trusted sites)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} http://www.apple.com/qtactivex/qtplugin.cab (QuickTime Object)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://fpdownload.macromedia.com/get/shock…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\Common\yinsthelper.dll (YInstStarter Class)
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} http://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab (MSN Photo Upload Tool)
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} http://upload.facebook.com/controls/Facebo…toUploader3.cab (Reg Error: Key error.)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/microsoftu…b?1204246277508 (MUWebControl Class)
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.0…oUploader55.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} http://wpotc.kpdsb.on.ca/activex/AxisCamControl.cab (Reg Error: Key error.)
O16 - DPF: {9E515FE4-2A60-4D08-8E96-CF9A967BE49B} http://check.earthlinksecurity.com/SSMEarthLink.cab (SSMEarthLink Control)
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} http://v4.windowsupdate.microsoft.com/CAB/…8002.3658564815 (Reg Error: Key error.)
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} http://cdn2.zone.msn.com/binFramework/v10/…ro.cab34246.cab (Reg Error: Key error.)
O16 - DPF: {BD8667B7-38D8-4C77-B580-18C3E146372C} http://ak.imgag.com/imgag/cp/install/Crusher.cab (Creative Toolbox Plug-in)
O16 - DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/pub/shock…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {F127B9BA-89EA-4B04-9C67-2074A9DF61FD} http://walmart.pnimedia.com/upload/activex…tupv2.0.0.9.cab? (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\bwfile-8876480 {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll (Logitech Inc.)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll ()
O20 - Winlogon\Notify\dimsntfy: DllName - - File not found
O20 - Winlogon\Notify\WgaLogon: DllName - WgaLogon.dll - File not found
O21 - SSODL: CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} - CLSID or File not found.
O24 - Desktop WallPaper: C:\Documents and Settings\Robbin\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Robbin\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/01/01 16:15:21 | 000,000,000 | —- | M] () - C:\AUTOEXEC-BEFOREREMOVINGV7STUFF.BAT – [ NTFS ]
O32 - AutoRun File - [2002/08/24 13:18:28 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O33 - MountPoints2\{8de3f810-b77c-11d6-ad3e-806d6172696f}\Shell - "" = AutoRun
O33 - MountPoints2\{8de3f810-b77c-11d6-ad3e-806d6172696f}\Shell\AutoRun - "" = Auto&Play
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/11/02 22:57:42 | 000,576,000 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Robbin\My Documents\OTL.exe
[2010/11/02 22:07:11 | 000,446,464 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Robbin\My Documents\TFC.exe
[2010/10/29 16:38:04 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Yahoo!
[2010/10/29 14:25:32 | 000,000,000 | -H-D | C] – C:\WINDOWS\ie8
[2010/10/29 14:12:21 | 011,080,192 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ieframe.dll
[2010/10/29 13:21:39 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Robbin\Recent
[2010/10/27 19:11:37 | 000,000,000 | —D | C] – C:\Program Files\Runtime Software
[2010/10/14 13:44:19 | 000,953,856 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mfc40u.dll
[2010/10/14 13:44:18 | 000,974,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mfc42.dll
[2010/10/14 13:43:32 | 000,617,472 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\comctl32.dll
[2005/12/05 19:00:46 | 002,247,888 | —- | C] (Microsoft Corporation) – C:\Program Files\dsetup32.dll
[2005/12/05 19:00:46 | 000,484,560 | —- | C] (Microsoft Corporation) – C:\Program Files\DXSETUP.exe
[2005/12/05 19:00:46 | 000,074,448 | —- | C] (Microsoft Corporation) – C:\Program Files\DSETUP.dll

========== Files - Modified Within 30 Days ==========

[2010/11/02 23:02:02 | 000,000,886 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/11/02 22:57:52 | 000,576,000 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Robbin\My Documents\OTL.exe
[2010/11/02 22:47:05 | 000,007,062 | —- | M] () – C:\WINDOWS\Robbin8.xlb
[2010/11/02 22:43:54 | 000,595,970 | —- | M] () – C:\Documents and Settings\Robbin\My Documents\Latitude C600[1].part8 laptop.rar
[2010/11/02 22:28:08 | 000,000,696 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/11/02 22:12:23 | 000,000,868 | —- | M] () – C:\WINDOWS\tasks\Google Software Updater.job
[2010/11/02 22:12:02 | 000,000,882 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/11/02 22:11:55 | 000,012,598 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/11/02 22:11:53 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/11/02 22:11:51 | 536,403,968 | -HS- | M] () – C:\hiberfil.sys
[2010/11/02 22:07:11 | 000,446,464 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Robbin\My Documents\TFC.exe
[2010/11/02 00:03:41 | 000,000,508 | —- | M] () – C:\WINDOWS\tasks\Scheduled scanning task.job
[2010/11/01 18:52:53 | 003,859,456 | R— | M] () – C:\Documents and Settings\All Users\Documents\ESBK.mbb
[2010/11/01 18:52:51 | 002,732,032 | R— | M] () – C:\Documents and Settings\All Users\Documents\ESBK.mb
[2010/11/01 16:39:12 | 000,001,986 | —- | M] () – C:\Documents and Settings\Robbin\Desktop\HiJackThis.lnk
[2010/11/01 15:35:43 | 000,000,211 | RHS- | M] () – C:\boot.ini
[2010/10/30 03:05:10 | 000,001,393 | —- | M] () – C:\WINDOWS\imsins.BAK
[2010/10/29 16:38:01 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/10/29 14:55:32 | 000,000,815 | —- | M] () – C:\Documents and Settings\Robbin\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2010/10/28 19:12:58 | 000,054,156 | -H– | M] () – C:\WINDOWS\QTFont.qfn
[2010/10/17 14:33:35 | 000,079,872 | —- | M] () – C:\WINDOWS\Robbin.pcb
[2010/10/15 07:37:02 | 000,122,928 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2010/10/10 15:08:09 | 000,000,000 | -H– | M] () – C:\WINDOWS\System32\drivers\Msft_Kernel_LMouFilt_01005.Wdf
[2010/10/10 15:07:56 | 000,000,000 | -H– | M] () – C:\WINDOWS\System32\drivers\Msft_Kernel_LUsbFilt_01005.Wdf
[2010/10/10 15:07:52 | 000,000,000 | -H– | M] () – C:\WINDOWS\System32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
[2010/10/07 03:15:21 | 000,577,262 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/10/07 03:15:21 | 000,128,644 | —- | M] () – C:\WINDOWS\System32\perfc009.dat

========== Files Created - No Company Name ==========

[2010/11/01 16:39:12 | 000,001,986 | —- | C] () – C:\Documents and Settings\Robbin\Desktop\HiJackThis.lnk
[2010/10/29 14:29:15 | 000,001,393 | —- | C] () – C:\WINDOWS\imsins.BAK
[2010/10/10 15:08:09 | 000,000,000 | -H– | C] () – C:\WINDOWS\System32\drivers\Msft_Kernel_LMouFilt_01005.Wdf
[2010/10/10 15:07:56 | 000,000,000 | -H– | C] () – C:\WINDOWS\System32\drivers\Msft_Kernel_LUsbFilt_01005.Wdf
[2010/10/10 15:07:52 | 000,000,000 | -H– | C] () – C:\WINDOWS\System32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
[2010/07/26 20:33:33 | 000,165,376 | —- | C] () – C:\WINDOWS\System32\unrar.dll
[2009/11/15 13:28:06 | 000,204,800 | —- | C] () – C:\WINDOWS\System32\VProPage.dll
[2009/11/09 21:41:34 | 000,000,036 | —- | C] () – C:\Documents and Settings\Robbin\Local Settings\Application Data\housecall.guid.cache
[2009/08/31 15:00:22 | 000,021,504 | —- | C] () – C:\WINDOWS\System32\WBCustomizer.dll
[2009/08/31 15:00:21 | 000,185,344 | —- | C] () – C:\WINDOWS\System32\MemWarp.dll
[2009/05/03 08:54:48 | 000,000,412 | —- | C] () – C:\WINDOWS\MAXLINK.INI
[2009/04/14 23:10:32 | 000,007,552 | —- | C] () – C:\WINDOWS\System32\drivers\enodpl.sys
[2009/04/14 23:10:32 | 000,004,736 | —- | C] () – C:\WINDOWS\System32\drivers\tandpl.sys
[2009/03/28 09:48:30 | 000,041,624 | —- | C] () – C:\WINDOWS\System32\drivers\fsbts.sys
[2008/10/28 20:55:46 | 000,000,000 | —- | C] () – C:\WINDOWS\Gliftex7.INI
[2007/09/20 23:10:42 | 000,075,264 | —- | C] () – C:\WINDOWS\System32\unacev2.dll
[2007/02/04 16:29:28 | 000,000,092 | —- | C] () – C:\WINDOWS\dellstat.ini
[2007/02/04 16:29:25 | 000,000,306 | —- | C] () – C:\WINDOWS\lexstat.ini
[2006/10/02 19:54:18 | 000,000,022 | —- | C] () – C:\WINDOWS\exchng.ini
[2006/10/02 19:54:17 | 000,000,611 | —- | C] () – C:\WINDOWS\ODBC.INI
[2006/08/13 13:57:46 | 000,000,268 | —- | C] () – C:\WINDOWS\_delis32.ini
[2006/06/09 02:18:03 | 000,000,299 | —- | C] () – C:\Program Files\ Terms.html
[2006/05/10 15:42:10 | 000,001,759 | —- | C] () – C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2006/01/20 20:37:03 | 000,000,156 | —- | C] () – C:\WINDOWS\cdplayer.ini
[2006/01/18 23:30:05 | 000,002,324 | —- | C] () – C:\WINDOWS\Contour.INI
[2006/01/18 22:56:46 | 000,001,998 | —- | C] () – C:\WINDOWS\RADAR.INI
[2006/01/18 22:51:52 | 000,006,420 | —- | C] () – C:\WINDOWS\tides.ini
[2006/01/18 22:51:39 | 000,413,792 | —- | C] () – C:\WINDOWS\System32\Tbpro3w.dll
[2006/01/18 22:51:39 | 000,124,416 | —- | C] () – C:\WINDOWS\System32\Tbpro1w.dll
[2006/01/18 22:51:39 | 000,108,016 | —- | C] () – C:\WINDOWS\System32\Tbpro2w.dll
[2006/01/18 22:51:38 | 000,072,231 | —- | C] () – C:\WINDOWS\System32\Tbpro6w.dll
[2006/01/18 22:51:38 | 000,070,144 | —- | C] () – C:\WINDOWS\System32\Tbpro5w.dll
[2006/01/18 22:51:38 | 000,056,987 | —- | C] () – C:\WINDOWS\System32\Tbpro4w.dll
[2006/01/18 21:04:45 | 000,010,240 | —- | C] () – C:\WINDOWS\System32\vidx16.dll
[2006/01/18 21:04:36 | 000,000,000 | —- | C] () – C:\WINDOWS\nsrex.INI
[2006/01/18 21:02:10 | 000,018,795 | —- | C] () – C:\WINDOWS\wininit.ini
[2006/01/18 00:34:24 | 000,013,824 | —- | C] () – C:\Documents and Settings\Robbin\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2005/12/05 19:28:30 | 003,673,932 | —- | C] () – C:\Program Files\Dec2005_MDX1_x86_Archive.cab
[2005/12/05 19:28:04 | 001,358,864 | —- | C] () – C:\Program Files\Dec2005_d3dx9_28_x64.cab
[2005/12/05 19:28:02 | 000,086,925 | —- | C] () – C:\Program Files\Oct2005_xinput_x64.cab
[2005/12/05 19:28:02 | 000,046,247 | —- | C] () – C:\Program Files\Oct2005_xinput_x86.cab
[2005/12/05 19:28:02 | 000,041,888 | —- | C] () – C:\Program Files\dxdllreg_x86.cab
[2005/12/05 19:28:00 | 000,916,806 | —- | C] () – C:\Program Files\Dec2005_MDX1_x86.cab
[2005/12/05 19:27:58 | 001,080,344 | —- | C] () – C:\Program Files\Dec2005_d3dx9_28_x86.cab
[2005/12/05 19:00:46 | 000,081,092 | —- | C] () – C:\Program Files\dxupdate.cab
[2005/12/05 19:00:44 | 001,351,430 | —- | C] () – C:\Program Files\Aug2005_d3dx9_27_x64.cab
[2005/12/05 19:00:44 | 001,348,242 | —- | C] () – C:\Program Files\Apr2005_d3dx9_25_x64.cab
[2005/12/05 19:00:44 | 001,336,890 | —- | C] () – C:\Program Files\Jun2005_d3dx9_26_x64.cab
[2005/12/05 19:00:44 | 001,248,387 | —- | C] () – C:\Program Files\Feb2005_d3dx9_24_x64.cab
[2005/12/05 19:00:44 | 001,079,850 | —- | C] () – C:\Program Files\Apr2005_d3dx9_25_x86.cab
[2005/12/05 19:00:44 | 001,078,532 | —- | C] () – C:\Program Files\Aug2005_d3dx9_27_x86.cab
[2005/12/05 19:00:44 | 001,065,813 | —- | C] () – C:\Program Files\Jun2005_d3dx9_26_x86.cab
[2005/12/05 19:00:44 | 001,014,113 | —- | C] () – C:\Program Files\Feb2005_d3dx9_24_x86.cab
[2005/12/05 19:00:42 | 013,265,040 | —- | C] () – C:\Program Files\dxnt.cab
[2005/12/05 19:00:40 | 015,493,481 | —- | C] () – C:\Program Files\DirectX.cab
[2005/12/05 19:00:40 | 001,156,363 | —- | C] () – C:\Program Files\BDANT.cab
[2005/12/05 19:00:40 | 000,976,020 | —- | C] () – C:\Program Files\BDAXP.cab
[2005/12/05 19:00:40 | 000,703,080 | —- | C] () – C:\Program Files\BDA.cab
[2005/08/31 12:43:32 | 000,098,304 | —- | C] () – C:\WINDOWS\System32\resourceGeneric.dll
[2004/04/21 23:58:26 | 000,086,016 | —- | C] () – C:\WINDOWS\System32\ati2evxx.dll
[2004/01/16 10:33:41 | 000,004,346 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2004/01/01 16:34:35 | 000,000,466 | —- | C] () – C:\WINDOWS\Alcdun.ini
[2004/01/01 16:33:52 | 000,001,580 | —- | C] () – C:\WINDOWS\ALCL32.INI
[2004/01/01 16:33:52 | 000,001,016 | —- | C] () – C:\WINDOWS\AliCPOS.INI
[2004/01/01 15:59:50 | 000,363,520 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2004/01/01 13:46:36 | 000,001,602 | —- | C] () – C:\WINDOWS\System32\Oeminfo.ini
[2004/01/01 13:21:41 | 000,000,410 | —- | C] () – C:\WINDOWS\brwmark.ini
[2004/01/01 13:21:40 | 000,000,030 | —- | C] () – C:\WINDOWS\System32\brss01a.ini
[2004/01/01 13:21:38 | 000,000,052 | —- | C] () – C:\WINDOWS\BRPP2KA.INI
[2002/11/14 13:58:04 | 000,200,192 | —- | C] () – C:\WINDOWS\System32\ir50_qc.dll
[2002/11/14 13:58:04 | 000,183,808 | —- | C] () – C:\WINDOWS\System32\ir50_qcx.dll
[2002/11/14 13:58:02 | 000,755,200 | —- | C] () – C:\WINDOWS\System32\ir50_32.dll
[2002/11/14 13:58:02 | 000,338,432 | —- | C] () – C:\WINDOWS\System32\ir41_qcx.dll
[2002/11/14 13:58:02 | 000,120,320 | —- | C] () – C:\WINDOWS\System32\ir41_qc.dll
[2002/08/24 13:49:25 | 000,081,966 | —- | C] () – C:\WINDOWS\System32\VCC4Control.dll
[2002/08/24 13:38:56 | 000,241,742 | —- | C] () – C:\WINDOWS\System32\VCR878DL.dll
[2002/08/24 13:38:56 | 000,225,338 | —- | C] () – C:\WINDOWS\System32\BIOSTIMEDLL.DLL
[2002/08/24 13:38:56 | 000,217,168 | —- | C] () – C:\WINDOWS\System32\CsLilinDll.dll
[2002/08/24 13:38:56 | 000,213,058 | —- | C] () – C:\WINDOWS\System32\PelcoDll.dll
[2002/08/24 13:38:56 | 000,204,853 | —- | C] () – C:\WINDOWS\System32\CommDll.dll
[2002/08/24 13:38:56 | 000,069,632 | —- | C] () – C:\WINDOWS\System32\VCC4.dll
[2002/08/24 13:33:16 | 000,058,880 | —- | C] () – C:\WINDOWS\System32\VXRAS.DLL
[2002/08/24 13:13:53 | 000,000,058 | —- | C] () – C:\WINDOWS\brmx2001.ini
[2002/08/24 13:13:53 | 000,000,040 | —- | C] () – C:\WINDOWS\opt_1230.ini
[2002/08/24 12:12:40 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2000/09/08 17:53:50 | 000,073,839 | —- | C] () – C:\WINDOWS\System32\KodakOneTouch.dll
[2000/01/06 21:00:00 | 000,024,448 | —- | C] () – C:\WINDOWS\sysgtime.dll
[2000/01/06 21:00:00 | 000,024,448 | —- | C] () – C:\WINDOWS\System32\proclsvr.drv
[1996/11/17 00:00:00 | 000,022,016 | —- | C] () – C:\WINDOWS\System32\ODBCSTF.DLL
[1996/11/17 00:00:00 | 000,022,016 | —- | C] () – C:\WINDOWS\System32\DOCOBJ.DLL
[1996/11/17 00:00:00 | 000,012,288 | —- | C] () – C:\WINDOWS\System32\HLINKPRX.DLL

========== LOP Check ==========

[2009/05/17 18:26:54 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Avg7
[2007/02/04 16:33:51 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\BVRP Software
[2009/05/03 08:45:22 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\CanonBJ
[2009/03/28 09:38:46 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\F-Secure
[2010/09/04 14:51:25 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Fighters
[2010/03/22 20:07:27 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\fssg
[2007/07/10 19:42:14 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Grisoft
[2008/04/20 12:51:52 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Installations
[2006/05/03 19:24:11 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\JollyBear
[2007/10/07 14:36:07 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\n7-89-o9-3r-4t-r9
[2009/04/14 21:58:54 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PC Drivers HeadQuarters
[2007/06/11 20:14:12 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PC Suite
[2006/01/30 21:07:41 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PopCap
[2008/10/28 20:49:46 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Ransen Software
[2009/05/03 08:54:35 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\ScanSoft
[2006/12/22 21:18:15 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Smilebox
[2009/02/08 17:25:56 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2009/05/17 16:22:48 | 000,000,000 | —D | M] – C:\Documents and Settings\Robbin\Application Data\Canon
[2010/03/22 20:14:55 | 000,000,000 | —D | M] – C:\Documents and Settings\Robbin\Application Data\F-Secure
[2007/10/07 14:36:00 | 000,000,000 | —D | M] – C:\Documents and Settings\Robbin\Application Data\GameHouse
[2010/10/29 13:17:54 | 000,000,000 | —D | M] – C:\Documents and Settings\Robbin\Application Data\Jarte
[2007/11/24 16:29:10 | 000,000,000 | —D | M] – C:\Documents and Settings\Robbin\Application Data\LimeWire
[2007/01/15 16:23:40 | 000,000,000 | —D | M] – C:\Documents and Settings\Robbin\Application Data\Netscape
[2008/02/24 19:51:24 | 000,000,000 | —D | M] – C:\Documents and Settings\Robbin\Application Data\Nokia
[2007/06/08 02:25:21 | 000,000,000 | —D | M] – C:\Documents and Settings\Robbin\Application Data\Paltalk
[2008/02/24 20:01:38 | 000,000,000 | —D | M] – C:\Documents and Settings\Robbin\Application Data\PC Suite
[2009/05/03 08:54:41 | 000,000,000 | —D | M] – C:\Documents and Settings\Robbin\Application Data\ScanSoft
[2009/02/09 15:31:03 | 000,000,000 | —D | M] – C:\Documents and Settings\Robbin\Application Data\Smart PC Solutions
[2010/07/07 13:27:05 | 000,000,000 | —D | M] – C:\Documents and Settings\Robbin\Application Data\Uniblue
[2010/02/27 01:12:49 | 000,000,000 | —D | M] – C:\Documents and Settings\Robbin\Application Data\Windows Live Writer
[2008/03/03 15:30:29 | 000,000,000 | —D | M] – C:\Documents and Settings\Robbin\Application Data\WinPatrol
[2010/11/02 00:03:41 | 000,000,508 | —- | M] () – C:\WINDOWS\Tasks\Scheduled scanning task.job

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 112 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CB0AACC9
@Alternate Data Stream - 106 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:B63300D1

< End of report >
Post #5
Hi,

Run OTL.exe
  • Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

    :OTL
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
@Alternate Data Stream - 112 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CB0AACC9
@Alternate Data Stream - 106 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:B63300D1

:Reg

:Files

:Commands
[purity]
[emptytemp]
[RESETHOSTS]
[start explorer]
[Reboot]
  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot when it is done
  • Then post the results of the log and a new OTL log ( don't check the boxes beside LOP Check or Purity this time )


Are you still having issues ?
Post #6
All processes killed
========== OTL ==========
No active process named explorer.exe was found!
ADS C:\Documents and Settings\All Users\Application Data\TEMP:CB0AACC9 deleted successfully.
ADS C:\Documents and Settings\All Users\Application Data\TEMP:B63300D1 deleted successfully.
========== REGISTRY ==========
========== FILES ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Robbin
->Temp folder emptied: 198656 bytes
->Temporary Internet Files folder emptied: 33988765 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 615 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 12542 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 3524644182 bytes

Total Files Cleaned = 3,394.00 mb

C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

OTL by OldTimer - Version 3.2.17.2 log created on 11032010_132002

Files\Folders moved on Reboot…
File\Folder C:\Documents and Settings\Robbin\Local Settings\Temp\~DF75CD.tmp not found!
File\Folder C:\Documents and Settings\Robbin\Local Settings\Temp\~DF75EC.tmp not found!
File\Folder C:\Documents and Settings\Robbin\Local Settings\Temp\~DF76F8.tmp not found!
File\Folder C:\Documents and Settings\Robbin\Local Settings\Temp\~DF7712.tmp not found!
File\Folder C:\Documents and Settings\Robbin\Local Settings\Temp\~DF7800.tmp not found!
File\Folder C:\Documents and Settings\Robbin\Local Settings\Temp\~DF7827.tmp not found!
File\Folder C:\Documents and Settings\Robbin\Local Settings\Temp\~DF79C3.tmp not found!
File\Folder C:\Documents and Settings\Robbin\Local Settings\Temp\~DF79E2.tmp not found!
C:\Documents and Settings\Robbin\Local Settings\Temporary Internet Files\Content.IE5\WJ6PM816\like[1].htm moved successfully.
C:\Documents and Settings\Robbin\Local Settings\Temporary Internet Files\Content.IE5\DVLQCELW\iframe[1].htm moved successfully.
C:\Documents and Settings\Robbin\Local Settings\Temporary Internet Files\Content.IE5\533WNAFL\index[1].htm moved successfully.

Registry entries deleted on Reboot…

OTL logfile created on: 11/3/2010 1:33:52 PM - Run 2
OTL by OldTimer - Version 3.2.17.2 Folder = C:\Documents and Settings\Robbin\My Documents
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

511.00 Mb Total Physical Memory | 103.00 Mb Available Physical Memory | 20.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 73.00% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 37.27 Gb Total Space | 21.17 Gb Free Space | 56.80% Space Free | Partition Type: NTFS
Drive D: | 7.85 Gb Total Space | 7.72 Gb Free Space | 98.29% Space Free | Partition Type: FAT32

Computer Name: OWNER-F7ZM3W4XH | User Name: Robbin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Robbin\My Documents\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Eastlink Internet Security\ORSP Client\fsorsp.exe (F-Secure Corporation)
PRC - C:\Program Files\Eastlink Internet Security\Anti-Virus\fssm32.exe (F-Secure Corporation)
PRC - C:\Program Files\Eastlink Internet Security\Anti-Virus\fsgk32.exe (F-Secure Corporation)
PRC - C:\Program Files\Eastlink Internet Security\Anti-Virus\fsav32.exe (F-Secure Corporation)
PRC - C:\Program Files\Eastlink Internet Security\Common\FSM32.EXE (F-Secure Corporation)
PRC - C:\Program Files\Eastlink Internet Security\Common\FSMA32.EXE (F-Secure Corporation)
PRC - C:\Program Files\Eastlink Internet Security\Common\FSHDLL32.EXE (F-Secure Corporation)
PRC - C:\Program Files\Eastlink Internet Security\FWES\program\fsdfwd.exe (F-Secure Corporation)
PRC - C:\Program Files\Eastlink Internet Security\Anti-Virus\fsgk32st.exe (F-Secure Corporation)
PRC - C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corporation)
PRC - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\WINDOWS\system32\BRSVC01A.EXE (brother Industries Ltd)
PRC - C:\WINDOWS\system32\BRSS01A.EXE (brother Industries Ltd)


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Robbin\My Documents\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)
MOD - C:\Program Files\Eastlink Internet Security\Spam Control\fsscoepl.dll (F-Secure Corporation)
MOD - c:\Program Files\Eastlink Internet Security\HIPS\fshook32.dll (F-Secure Corporation)


========== Win32 Services (SafeList) ==========

SRV - (HidServ) – C:\WINDOWS\System32\hidserv.dll File not found
SRV - (FSORSPClient) – C:\Program Files\Eastlink Internet Security\ORSP Client\fsorsp.exe (F-Secure Corporation)
SRV - (FSMA) – C:\Program Files\Eastlink Internet Security\Common\FSMA32.EXE (F-Secure Corporation)
SRV - (FSDFWD) – C:\Program Files\Eastlink Internet Security\FWES\Program\fsdfwd.exe (F-Secure Corporation)
SRV - (F-Secure Gatekeeper Handler Starter) – C:\Program Files\Eastlink Internet Security\Anti-Virus\fsgk32st.exe (F-Secure Corporation)
SRV - (fsssvc) – C:\Program Files\Windows Live\Family Safety\fsssvc.exe (Microsoft Corporation)
SRV - (SeaPort) – C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corporation)
SRV - (YahooAUService) – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
SRV - (ServiceLayer) – C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (Nokia.)
SRV - (KodakCCS) – C:\WINDOWS\system32\drivers\KodakCCS.exe (Eastman Kodak Company)
SRV - (Brother XP spl Service) – C:\WINDOWS\system32\BRSVC01A.EXE (brother Industries Ltd)


========== Driver Services (SafeList) ==========

DRV - (fsbts) – C:\WINDOWS\system32\Drivers\fsbts.sys ()
DRV - (F-Secure Gatekeeper) – C:\Program Files\Eastlink Internet Security\Anti-Virus\minifilter\fsgk.sys ()
DRV - (F-Secure HIPS) – C:\Program Files\Eastlink Internet Security\HIPS\drivers\fshs.sys (F-Secure Corporation)
DRV - (FSFW) – C:\WINDOWS\System32\drivers\fsdfw.sys (F-Secure Corporation)
DRV - (F-Secure Filter) – C:\Program Files\Eastlink Internet Security\Anti-Virus\win2k\fsfilter.sys ()
DRV - (F-Secure Recognizer) – C:\Program Files\Eastlink Internet Security\Anti-Virus\win2k\fsrec.sys ()
DRV - (fssfltr) – C:\WINDOWS\system32\drivers\fssfltr_tdi.sys (Microsoft Corporation)
DRV - (gameenum) – C:\WINDOWS\system32\drivers\gameenum.sys (Microsoft Corporation)
DRV - (usbaudio) USB Audio Driver (WDM) – C:\WINDOWS\system32\drivers\usbaudio.sys (Microsoft Corporation)
DRV - (LMouKE) – C:\WINDOWS\system32\drivers\LMouKE.Sys (Logitech Inc.)
DRV - (LHidFilt) – C:\WINDOWS\system32\drivers\LHidFilt.Sys (Logitech, Inc.)
DRV - (LMouFilt) – C:\WINDOWS\system32\drivers\LMouFilt.Sys (Logitech, Inc.)
DRV - (LUsbFilt) – C:\WINDOWS\system32\drivers\LUsbFilt.sys (Logitech, Inc.)
DRV - (L8042mou) – C:\WINDOWS\system32\drivers\L8042mou.Sys (Logitech Inc.)
DRV - (L8042Kbd) – C:\WINDOWS\system32\drivers\L8042Kbd.sys (Logitech Inc.)
DRV - (DcCam) – C:\WINDOWS\system32\drivers\DcCam.sys (Eastman Kodak Company)
DRV - (PD0620VID) – C:\WINDOWS\system32\drivers\P0620Vid.sys (Creative Technology Ltd.)
DRV - (Exportit) – C:\WINDOWS\system32\drivers\ExportIt.sys (Eastman Kodak Company)
DRV - (DcPTP) – C:\WINDOWS\system32\drivers\DcPtp.sys (Eastman Kodak Company)
DRV - (DcLps) – C:\WINDOWS\system32\drivers\DcLps.sys (Eastman Kodak Company)
DRV - (DCFS2K) – C:\WINDOWS\system32\drivers\DCFS2k.sys (Eastman Kodak Company)
DRV - (DcFpoint) – C:\WINDOWS\system32\drivers\DcFpoint.sys (Eastman Kodak Company)
DRV - (ati2mtag) – C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (VCR878) – C:\WINDOWS\system32\drivers\VCR878.sys (Video Communication Research Inc.)
DRV - (VIAudio) VIA AC'97 Audio Controller (WDM) – C:\WINDOWS\system32\drivers\ac97via.sys (VIA Technologies, Inc.)
DRV - (Esdpdx01) – C:\WINDOWS\system32\drivers\ESDPDX01.SYS (MK Systems CO., LTD.)
DRV - (HCF_MSFT) – C:\WINDOWS\system32\drivers\HCF_MSFT.sys (Conexant)
DRV - (sfman) Creative SoundFont Manager Driver (WDM) – C:\WINDOWS\system32\drivers\sfmanm.sys (Creative Technology Ltd.)
DRV - (emu10k1) Creative Interface Manager Driver (WDM) – C:\WINDOWS\system32\drivers\ctlfacem.sys (Creative Technology Ltd.)
DRV - (emu10k) Creative SB Live! (WDM) – C:\WINDOWS\system32\drivers\emu10k1m.sys (Creative Technology Ltd.)
DRV - (ctljystk) – C:\WINDOWS\system32\drivers\ctljystk.sys (Creative Technology Ltd.)
DRV - (rtl8029) Realtek RTL8029(AS) – C:\WINDOWS\system32\drivers\RTL8029.sys (Realtek Semiconductor Corporation)
DRV - (EL90XBC) – C:\WINDOWS\system32\drivers\el90xbc5.sys (3Com Corporation)
DRV - (atirage3) – C:\WINDOWS\system32\drivers\atimpae.sys (ATI Technologies Inc.)
DRV - (DC21x4) – C:\WINDOWS\system32\drivers\dc21x4.sys (Intel Corporation.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.myeastlink.ca/?region=NS
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Google"
FF - prefs.js..browser.search.defaulturl: "http://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q="
FF - prefs.js..browser.search.selectedEngine: "Google"

FF - HKLM\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\Eastlink Internet Security\NRS\[removed] [2010/09/07 11:27:37 | 000,000,000 | —D | M]

[2008/03/30 16:27:49 | 000,000,000 | —D | M] – C:\Documents and Settings\Robbin\Application Data\Mozilla\Firefox\Profiles\oj4dkvq9.default\extensions
[2008/03/30 16:27:49 | 000,000,000 | —D | M] (Google Toolbar for Firefox) – C:\Documents and Settings\Robbin\Application Data\Mozilla\Firefox\Profiles\oj4dkvq9.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2008/03/30 18:45:42 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2008/03/30 11:41:55 | 000,000,000 | —D | M] (Google Toolbar for Firefox) – C:\Program Files\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}

O1 HOSTS File: ([2010/11/03 13:20:52 | 000,000,098 | —- | M]) - C:\WINDOWS\system32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll (Yahoo! Inc.)
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
O2 - BHO: (Browsing Protection Class) - {C6867EB7-8350-4856-877F-93CF8AE3DC9C} - C:\Program Files\Eastlink Internet Security\NRS\iescript\baselitmus.dll (F-Secure Corporation)
O2 - BHO: (Windows Live Toolbar Helper) - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (Browsing Protection Toolbar) - {265EEE8E-3228-44D3-AEA5-F7FDF5860049} - C:\Program Files\Eastlink Internet Security\NRS\iescript\baselitmus.dll (F-Secure Corporation)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll (Yahoo! Inc.)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\ShellBrowser: (&Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (&Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [F-Secure Manager] C:\Program Files\Eastlink Internet Security\Common\FSM32.EXE (F-Secure Corporation)
O4 - HKLM..\Run: [F-Secure TNB] C:\Program Files\Eastlink Internet Security\FSGUI\TNBUtil.exe (F-Secure Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSimpleStartMenu = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: Intellimenus = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoClose = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLogOff = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSaveSettings = 0
O9 - Extra Button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\Eastlink Internet Security\FSPS\program\FSLSP.DLL (F-Secure Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\Eastlink Internet Security\FSPS\program\FSLSP.DLL (F-Secure Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files\Eastlink Internet Security\FSPS\program\FSLSP.DLL (F-Secure Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000035 - C:\Program Files\Eastlink Internet Security\FSPS\program\FSLSP.DLL (F-Secure Corporation)
O15 - HKCU\..Trusted Domains: facebook.com ([www] https in Trusted sites)
O15 - HKCU\..Trusted Domains: yahoo.com ([answers] http in Trusted sites)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} http://www.apple.com/qtactivex/qtplugin.cab (QuickTime Object)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://fpdownload.macromedia.com/get/shock…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\Common\yinsthelper.dll (YInstStarter Class)
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} http://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab (MSN Photo Upload Tool)
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} http://upload.facebook.com/controls/Facebo…toUploader3.cab (Reg Error: Key error.)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/microsoftu…b?1204246277508 (MUWebControl Class)
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.0…oUploader55.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} http://wpotc.kpdsb.on.ca/activex/AxisCamControl.cab (Reg Error: Key error.)
O16 - DPF: {9E515FE4-2A60-4D08-8E96-CF9A967BE49B} http://check.earthlinksecurity.com/SSMEarthLink.cab (SSMEarthLink Control)
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} http://v4.windowsupdate.microsoft.com/CAB/…8002.3658564815 (Reg Error: Key error.)
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} http://cdn2.zone.msn.com/binFramework/v10/…ro.cab34246.cab (Reg Error: Key error.)
O16 - DPF: {BD8667B7-38D8-4C77-B580-18C3E146372C} http://ak.imgag.com/imgag/cp/install/Crusher.cab (Creative Toolbox Plug-in)
O16 - DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/pub/shock…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {F127B9BA-89EA-4B04-9C67-2074A9DF61FD} http://walmart.pnimedia.com/upload/activex…tupv2.0.0.9.cab? (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\bwfile-8876480 {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll (Logitech Inc.)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll ()
O20 - Winlogon\Notify\dimsntfy: DllName - - File not found
O20 - Winlogon\Notify\WgaLogon: DllName - WgaLogon.dll - File not found
O21 - SSODL: CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} - CLSID or File not found.
O24 - Desktop WallPaper: C:\Documents and Settings\Robbin\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Robbin\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/01/01 16:15:21 | 000,000,000 | —- | M] () - C:\AUTOEXEC-BEFOREREMOVINGV7STUFF.BAT – [ NTFS ]
O32 - AutoRun File - [2002/08/24 13:18:28 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O33 - MountPoints2\{8de3f810-b77c-11d6-ad3e-806d6172696f}\Shell - "" = AutoRun
O33 - MountPoints2\{8de3f810-b77c-11d6-ad3e-806d6172696f}\Shell\AutoRun - "" = Auto&Play
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/11/03 13:20:02 | 000,000,000 | —D | C] – C:\_OTL
[2010/11/02 22:57:42 | 000,576,000 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Robbin\My Documents\OTL.exe
[2010/11/02 22:07:11 | 000,446,464 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Robbin\My Documents\TFC.exe
[2010/10/29 16:38:04 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Yahoo!
[2010/10/29 14:25:32 | 000,000,000 | -H-D | C] – C:\WINDOWS\ie8
[2010/10/29 14:12:21 | 011,080,192 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ieframe.dll
[2010/10/29 13:21:39 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Robbin\Recent
[2010/10/27 19:11:37 | 000,000,000 | —D | C] – C:\Program Files\Runtime Software
[2010/10/14 13:44:19 | 000,953,856 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mfc40u.dll
[2010/10/14 13:44:18 | 000,974,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mfc42.dll
[2010/10/14 13:43:32 | 000,617,472 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\comctl32.dll
[2005/12/05 19:00:46 | 002,247,888 | —- | C] (Microsoft Corporation) – C:\Program Files\dsetup32.dll
[2005/12/05 19:00:46 | 000,484,560 | —- | C] (Microsoft Corporation) – C:\Program Files\DXSETUP.exe
[2005/12/05 19:00:46 | 000,074,448 | —- | C] (Microsoft Corporation) – C:\Program Files\DSETUP.dll

========== Files - Modified Within 30 Days ==========

[2010/11/03 13:23:06 | 000,000,868 | —- | M] () – C:\WINDOWS\tasks\Google Software Updater.job
[2010/11/03 13:22:45 | 000,000,882 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/11/03 13:22:39 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/11/03 13:22:37 | 536,403,968 | -HS- | M] () – C:\hiberfil.sys
[2010/11/03 13:20:52 | 000,000,098 | —- | M] () – C:\WINDOWS\System32\drivers\etc\Hosts
[2010/11/03 13:02:02 | 000,000,886 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/11/03 03:52:33 | 000,000,508 | —- | M] () – C:\WINDOWS\tasks\Scheduled scanning task.job
[2010/11/02 22:57:52 | 000,576,000 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Robbin\My Documents\OTL.exe
[2010/11/02 22:47:05 | 000,007,062 | —- | M] () – C:\WINDOWS\Robbin8.xlb
[2010/11/02 22:43:54 | 000,595,970 | —- | M] () – C:\Documents and Settings\Robbin\My Documents\Latitude C600[1].part8 laptop.rar
[2010/11/02 22:28:08 | 000,000,696 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/11/02 22:11:55 | 000,012,598 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/11/02 22:07:11 | 000,446,464 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Robbin\My Documents\TFC.exe
[2010/11/01 18:52:53 | 003,859,456 | R— | M] () – C:\Documents and Settings\All Users\Documents\ESBK.mbb
[2010/11/01 18:52:51 | 002,732,032 | R— | M] () – C:\Documents and Settings\All Users\Documents\ESBK.mb
[2010/11/01 16:39:12 | 000,001,986 | —- | M] () – C:\Documents and Settings\Robbin\Desktop\HiJackThis.lnk
[2010/11/01 15:35:43 | 000,000,211 | RHS- | M] () – C:\boot.ini
[2010/10/30 03:05:10 | 000,001,393 | —- | M] () – C:\WINDOWS\imsins.BAK
[2010/10/29 16:38:01 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/10/29 14:55:32 | 000,000,815 | —- | M] () – C:\Documents and Settings\Robbin\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2010/10/28 19:12:58 | 000,054,156 | -H– | M] () – C:\WINDOWS\QTFont.qfn
[2010/10/17 14:33:35 | 000,079,872 | —- | M] () – C:\WINDOWS\Robbin.pcb
[2010/10/15 07:37:02 | 000,122,928 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2010/10/10 15:08:09 | 000,000,000 | -H– | M] () – C:\WINDOWS\System32\drivers\Msft_Kernel_LMouFilt_01005.Wdf
[2010/10/10 15:07:56 | 000,000,000 | -H– | M] () – C:\WINDOWS\System32\drivers\Msft_Kernel_LUsbFilt_01005.Wdf
[2010/10/10 15:07:52 | 000,000,000 | -H– | M] () – C:\WINDOWS\System32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
[2010/10/07 03:15:21 | 000,577,262 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/10/07 03:15:21 | 000,128,644 | —- | M] () – C:\WINDOWS\System32\perfc009.dat

========== Files Created - No Company Name ==========

[2010/11/01 16:39:12 | 000,001,986 | —- | C] () – C:\Documents and Settings\Robbin\Desktop\HiJackThis.lnk
[2010/10/29 14:29:15 | 000,001,393 | —- | C] () – C:\WINDOWS\imsins.BAK
[2010/10/10 15:08:09 | 000,000,000 | -H– | C] () – C:\WINDOWS\System32\drivers\Msft_Kernel_LMouFilt_01005.Wdf
[2010/10/10 15:07:56 | 000,000,000 | -H– | C] () – C:\WINDOWS\System32\drivers\Msft_Kernel_LUsbFilt_01005.Wdf
[2010/10/10 15:07:52 | 000,000,000 | -H– | C] () – C:\WINDOWS\System32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
[2010/07/26 20:33:33 | 000,165,376 | —- | C] () – C:\WINDOWS\System32\unrar.dll
[2009/11/15 13:28:06 | 000,204,800 | —- | C] () – C:\WINDOWS\System32\VProPage.dll
[2009/11/09 21:41:34 | 000,000,036 | —- | C] () – C:\Documents and Settings\Robbin\Local Settings\Application Data\housecall.guid.cache
[2009/08/31 15:00:22 | 000,021,504 | —- | C] () – C:\WINDOWS\System32\WBCustomizer.dll
[2009/08/31 15:00:21 | 000,185,344 | —- | C] () – C:\WINDOWS\System32\MemWarp.dll
[2009/05/03 08:54:48 | 000,000,412 | —- | C] () – C:\WINDOWS\MAXLINK.INI
[2009/04/14 23:10:32 | 000,007,552 | —- | C] () – C:\WINDOWS\System32\drivers\enodpl.sys
[2009/04/14 23:10:32 | 000,004,736 | —- | C] () – C:\WINDOWS\System32\drivers\tandpl.sys
[2009/03/28 09:48:30 | 000,041,624 | —- | C] () – C:\WINDOWS\System32\drivers\fsbts.sys
[2008/10/28 20:55:46 | 000,000,000 | —- | C] () – C:\WINDOWS\Gliftex7.INI
[2007/09/20 23:10:42 | 000,075,264 | —- | C] () – C:\WINDOWS\System32\unacev2.dll
[2007/02/04 16:29:28 | 000,000,092 | —- | C] () – C:\WINDOWS\dellstat.ini
[2007/02/04 16:29:25 | 000,000,306 | —- | C] () – C:\WINDOWS\lexstat.ini
[2006/10/02 19:54:18 | 000,000,022 | —- | C] () – C:\WINDOWS\exchng.ini
[2006/10/02 19:54:17 | 000,000,611 | —- | C] () – C:\WINDOWS\ODBC.INI
[2006/08/13 13:57:46 | 000,000,268 | —- | C] () – C:\WINDOWS\_delis32.ini
[2006/06/09 02:18:03 | 000,000,299 | —- | C] () – C:\Program Files\ Terms.html
[2006/05/10 15:42:10 | 000,001,759 | —- | C] () – C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2006/01/20 20:37:03 | 000,000,156 | —- | C] () – C:\WINDOWS\cdplayer.ini
[2006/01/18 23:30:05 | 000,002,324 | —- | C] () – C:\WINDOWS\Contour.INI
[2006/01/18 22:56:46 | 000,001,998 | —- | C] () – C:\WINDOWS\RADAR.INI
[2006/01/18 22:51:52 | 000,006,420 | —- | C] () – C:\WINDOWS\tides.ini
[2006/01/18 22:51:39 | 000,413,792 | —- | C] () – C:\WINDOWS\System32\Tbpro3w.dll
[2006/01/18 22:51:39 | 000,124,416 | —- | C] () – C:\WINDOWS\System32\Tbpro1w.dll
[2006/01/18 22:51:39 | 000,108,016 | —- | C] () – C:\WINDOWS\System32\Tbpro2w.dll
[2006/01/18 22:51:38 | 000,072,231 | —- | C] () – C:\WINDOWS\System32\Tbpro6w.dll
[2006/01/18 22:51:38 | 000,070,144 | —- | C] () – C:\WINDOWS\System32\Tbpro5w.dll
[2006/01/18 22:51:38 | 000,056,987 | —- | C] () – C:\WINDOWS\System32\Tbpro4w.dll
[2006/01/18 21:04:45 | 000,010,240 | —- | C] () – C:\WINDOWS\System32\vidx16.dll
[2006/01/18 21:04:36 | 000,000,000 | —- | C] () – C:\WINDOWS\nsrex.INI
[2006/01/18 21:02:10 | 000,018,795 | —- | C] () – C:\WINDOWS\wininit.ini
[2006/01/18 00:34:24 | 000,013,824 | —- | C] () – C:\Documents and Settings\Robbin\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2005/12/05 19:28:30 | 003,673,932 | —- | C] () – C:\Program Files\Dec2005_MDX1_x86_Archive.cab
[2005/12/05 19:28:04 | 001,358,864 | —- | C] () – C:\Program Files\Dec2005_d3dx9_28_x64.cab
[2005/12/05 19:28:02 | 000,086,925 | —- | C] () – C:\Program Files\Oct2005_xinput_x64.cab
[2005/12/05 19:28:02 | 000,046,247 | —- | C] () – C:\Program Files\Oct2005_xinput_x86.cab
[2005/12/05 19:28:02 | 000,041,888 | —- | C] () – C:\Program Files\dxdllreg_x86.cab
[2005/12/05 19:28:00 | 000,916,806 | —- | C] () – C:\Program Files\Dec2005_MDX1_x86.cab
[2005/12/05 19:27:58 | 001,080,344 | —- | C] () – C:\Program Files\Dec2005_d3dx9_28_x86.cab
[2005/12/05 19:00:46 | 000,081,092 | —- | C] () – C:\Program Files\dxupdate.cab
[2005/12/05 19:00:44 | 001,351,430 | —- | C] () – C:\Program Files\Aug2005_d3dx9_27_x64.cab
[2005/12/05 19:00:44 | 001,348,242 | —- | C] () – C:\Program Files\Apr2005_d3dx9_25_x64.cab
[2005/12/05 19:00:44 | 001,336,890 | —- | C] () – C:\Program Files\Jun2005_d3dx9_26_x64.cab
[2005/12/05 19:00:44 | 001,248,387 | —- | C] () – C:\Program Files\Feb2005_d3dx9_24_x64.cab
[2005/12/05 19:00:44 | 001,079,850 | —- | C] () – C:\Program Files\Apr2005_d3dx9_25_x86.cab
[2005/12/05 19:00:44 | 001,078,532 | —- | C] () – C:\Program Files\Aug2005_d3dx9_27_x86.cab
[2005/12/05 19:00:44 | 001,065,813 | —- | C] () – C:\Program Files\Jun2005_d3dx9_26_x86.cab
[2005/12/05 19:00:44 | 001,014,113 | —- | C] () – C:\Program Files\Feb2005_d3dx9_24_x86.cab
[2005/12/05 19:00:42 | 013,265,040 | —- | C] () – C:\Program Files\dxnt.cab
[2005/12/05 19:00:40 | 015,493,481 | —- | C] () – C:\Program Files\DirectX.cab
[2005/12/05 19:00:40 | 001,156,363 | —- | C] () – C:\Program Files\BDANT.cab
[2005/12/05 19:00:40 | 000,976,020 | —- | C] () – C:\Program Files\BDAXP.cab
[2005/12/05 19:00:40 | 000,703,080 | —- | C] () – C:\Program Files\BDA.cab
[2005/08/31 12:43:32 | 000,098,304 | —- | C] () – C:\WINDOWS\System32\resourceGeneric.dll
[2004/04/21 23:58:26 | 000,086,016 | —- | C] () – C:\WINDOWS\System32\ati2evxx.dll
[2004/01/16 10:33:41 | 000,004,346 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2004/01/01 16:34:35 | 000,000,466 | —- | C] () – C:\WINDOWS\Alcdun.ini
[2004/01/01 16:33:52 | 000,001,580 | —- | C] () – C:\WINDOWS\ALCL32.INI
[2004/01/01 16:33:52 | 000,001,016 | —- | C] () – C:\WINDOWS\AliCPOS.INI
[2004/01/01 15:59:50 | 000,363,520 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2004/01/01 13:46:36 | 000,001,602 | —- | C] () – C:\WINDOWS\System32\Oeminfo.ini
[2004/01/01 13:21:41 | 000,000,410 | —- | C] () – C:\WINDOWS\brwmark.ini
[2004/01/01 13:21:40 | 000,000,030 | —- | C] () – C:\WINDOWS\System32\brss01a.ini
[2004/01/01 13:21:38 | 000,000,052 | —- | C] () – C:\WINDOWS\BRPP2KA.INI
[2002/08/24 13:49:25 | 000,081,966 | —- | C] () – C:\WINDOWS\System32\VCC4Control.dll
[2002/08/24 13:38:56 | 000,241,742 | —- | C] () – C:\WINDOWS\System32\VCR878DL.dll
[2002/08/24 13:38:56 | 000,225,338 | —- | C] () – C:\WINDOWS\System32\BIOSTIMEDLL.DLL
[2002/08/24 13:38:56 | 000,217,168 | —- | C] () – C:\WINDOWS\System32\CsLilinDll.dll
[2002/08/24 13:38:56 | 000,213,058 | —- | C] () – C:\WINDOWS\System32\PelcoDll.dll
[2002/08/24 13:38:56 | 000,204,853 | —- | C] () – C:\WINDOWS\System32\CommDll.dll
[2002/08/24 13:38:56 | 000,069,632 | —- | C] () – C:\WINDOWS\System32\VCC4.dll
[2002/08/24 13:33:16 | 000,058,880 | —- | C] () – C:\WINDOWS\System32\VXRAS.DLL
[2002/08/24 13:13:53 | 000,000,058 | —- | C] () – C:\WINDOWS\brmx2001.ini
[2002/08/24 13:13:53 | 000,000,040 | —- | C] () – C:\WINDOWS\opt_1230.ini
[2002/08/24 12:12:40 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2000/09/08 17:53:50 | 000,073,839 | —- | C] () – C:\WINDOWS\System32\KodakOneTouch.dll
[2000/01/06 21:00:00 | 000,024,448 | —- | C] () – C:\WINDOWS\sysgtime.dll
[2000/01/06 21:00:00 | 000,024,448 | —- | C] () – C:\WINDOWS\System32\proclsvr.drv
[1996/11/17 00:00:00 | 000,022,016 | —- | C] () – C:\WINDOWS\System32\ODBCSTF.DLL
[1996/11/17 00:00:00 | 000,022,016 | —- | C] () – C:\WINDOWS\System32\DOCOBJ.DLL
[1996/11/17 00:00:00 | 000,012,288 | —- | C] () – C:\WINDOWS\System32\HLINKPRX.DLL

< End of report >

It still seems to be runnning slow. I appreciate all your help! Thanks!
Post #7
Your log looks fine and Malwarebytes did not find anything bad. What we can do is scan for a rootkit type of infection that hides from most scanners. Try running this program in normal windows but if it wont run then try running it in safemode.

To Enter Safemode
  • Go to Start> Shut off your Computer> Restart
  • As the computer starts to boot-up, Tap the F8 KEY somewhat rapidly,
    this will bring up a menu.
  • Use the Up and Down Arrow Keys to scroll up to Safemode
  • Then press the Enter Key on your Keyboard
Tutorial if you need it How to boot into Safemode





[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.
  • Extract the contents of the zipped file to desktop.
  • Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

    [external image: Posted Image]
    Click the image to enlarge it
  • In the right panel, you will see several boxes that have been checked. Uncheck the following …
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and post it in your next reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries
Post #8
GMER 1.0.15.15477 - http://www.gmer.net
Rootkit scan 2010-11-03 19:01:33
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:\DOCUME~1\Robbin\LOCALS~1\Temp\pwnyipoc.sys


—- System - GMER 1.0.15 —-

SSDT \??\C:\Program Files\Eastlink Internet Security\HIPS\drivers\fshs.sys (HIPS 32-bit kernel module/F-Secure Corporation) ZwCreateProcess [0xF8788CC6]
SSDT \??\C:\Program Files\Eastlink Internet Security\HIPS\drivers\fshs.sys (HIPS 32-bit kernel module/F-Secure Corporation) ZwCreateProcessEx [0xF8788CE0]
SSDT \??\C:\Program Files\Eastlink Internet Security\HIPS\drivers\fshs.sys (HIPS 32-bit kernel module/F-Secure Corporation) ZwCreateThread [0xF8787E7C]
SSDT \??\C:\Program Files\Eastlink Internet Security\HIPS\drivers\fshs.sys (HIPS 32-bit kernel module/F-Secure Corporation) ZwLoadDriver [0xF87881AC]
SSDT \??\C:\Program Files\Eastlink Internet Security\HIPS\drivers\fshs.sys (HIPS 32-bit kernel module/F-Secure Corporation) ZwMapViewOfSection [0xF8787BBC]
SSDT \??\C:\Program Files\Eastlink Internet Security\HIPS\drivers\fshs.sys (HIPS 32-bit kernel module/F-Secure Corporation) ZwOpenSection [0xF87885DE]
SSDT \??\C:\Program Files\Eastlink Internet Security\HIPS\drivers\fshs.sys (HIPS 32-bit kernel module/F-Secure Corporation) ZwRenameKey [0xF878987C]
SSDT \??\C:\Program Files\Eastlink Internet Security\HIPS\drivers\fshs.sys (HIPS 32-bit kernel module/F-Secure Corporation) ZwSetSystemInformation [0xF878842E]
SSDT \??\C:\Program Files\Eastlink Internet Security\HIPS\drivers\fshs.sys (HIPS 32-bit kernel module/F-Secure Corporation) ZwSuspendProcess [0xF8787A3C]
SSDT \??\C:\Program Files\Eastlink Internet Security\HIPS\drivers\fshs.sys (HIPS 32-bit kernel module/F-Secure Corporation) ZwSuspendThread [0xF8787EB0]
SSDT \??\C:\Program Files\Eastlink Internet Security\HIPS\drivers\fshs.sys (HIPS 32-bit kernel module/F-Secure Corporation) ZwSystemDebugControl [0xF8788032]
SSDT \??\C:\Program Files\Eastlink Internet Security\HIPS\drivers\fshs.sys (HIPS 32-bit kernel module/F-Secure Corporation) ZwTerminateProcess [0xF8787996]
SSDT \??\C:\Program Files\Eastlink Internet Security\HIPS\drivers\fshs.sys (HIPS 32-bit kernel module/F-Secure Corporation) ZwTerminateThread [0xF8787AF6]
SSDT \??\C:\Program Files\Eastlink Internet Security\HIPS\drivers\fshs.sys (HIPS 32-bit kernel module/F-Secure Corporation) ZwWriteVirtualMemory [0xF8787F76]

Code fsdfw.sys (F-Secure Internet Shield Driver/F-Secure Corporation) IoCreateDevice

—- Kernel code sections - GMER 1.0.15 —-

.text ntoskrnl.exe!_abnormal_termination + 440 804E2AAC 12 Bytes [3C, 7A, 78, F8, B0, 7E, 78, …]
PAGE ntoskrnl.exe!IoCreateDevice 8059FACE 5 Bytes JMP F845BFFA fsdfw.sys (F-Secure Internet Shield Driver/F-Secure Corporation)
PAGENPNP NDIS.SYS!NdisRegisterProtocol F842C17F 5 Bytes JMP F845BE0C fsdfw.sys (F-Secure Internet Shield Driver/F-Secure Corporation)
PAGENPNP NDIS.SYS!NdisOpenAdapter F842C399 5 Bytes JMP F845C394 fsdfw.sys (F-Secure Internet Shield Driver/F-Secure Corporation)
PAGENPNP NDIS.SYS!NdisCloseAdapter F8436642 5 Bytes JMP F845BF18 fsdfw.sys (F-Secure Internet Shield Driver/F-Secure Corporation)
PAGENPNP NDIS.SYS!NdisDeregisterProtocol F8436821 5 Bytes JMP F845C1B0 fsdfw.sys (F-Secure Internet Shield Driver/F-Secure Corporation)
PAGENDSP NDIS.SYS!NdisReturnPackets F8439810 5 Bytes JMP F845CC0C fsdfw.sys (F-Secure Internet Shield Driver/F-Secure Corporation)
PAGENDSP NDIS.SYS!NdisRequest F843997B 5 Bytes JMP F845C5AC fsdfw.sys (F-Secure Internet Shield Driver/F-Secure Corporation)
PAGENDSP NDIS.SYS!NdisSend F843C986 5 Bytes JMP F845D58C fsdfw.sys (F-Secure Internet Shield Driver/F-Secure Corporation)
PAGENDSP NDIS.SYS!NdisSendPackets F843C9A3 5 Bytes JMP F845D65E fsdfw.sys (F-Secure Internet Shield Driver/F-Secure Corporation)
PAGENDSP NDIS.SYS!NdisTransferData F843C9BE 5 Bytes JMP F845CD0A fsdfw.sys (F-Secure Internet Shield Driver/F-Secure Corporation)
PAGENDCO NDIS.SYS!NdisCoCreateVc F8443186 5 Bytes JMP F845BE76 fsdfw.sys (F-Secure Internet Shield Driver/F-Secure Corporation)
PAGENDCO NDIS.SYS!NdisCoDeleteVc F8444557 5 Bytes JMP F845BEE4 fsdfw.sys (F-Secure Internet Shield Driver/F-Secure Corporation)
PAGENDCO NDIS.SYS!NdisCoSendPackets F8444AF1 5 Bytes JMP F845D376 fsdfw.sys (F-Secure Internet Shield Driver/F-Secure Corporation)

—- User code sections - GMER 1.0.15 —-

.text C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe[132] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 00D7000C
.text C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe[132] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes JMP 00D7100C
.text C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe[132] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00D7200C
.text C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe[132] kernel32.dll!TerminateThread 7C81CB3B 5 Bytes JMP 00D7300C
.text C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe[132] ADVAPI32.dll!CloseServiceHandle 77DE6CE5 5 Bytes JMP 00D7700C
.text C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe[132] ADVAPI32.dll!OpenServiceW 77DE6FFD 5 Bytes JMP 00D7500C
.text C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe[132] ADVAPI32.dll!ControlService 77DF4A09 5 Bytes JMP 00D7600C
.text C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe[132] ADVAPI32.dll!CreateServiceW 77E373A9 5 Bytes JMP 00D7800C
.text C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe[132] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 00D7400C
.text C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe[132] USER32.dll!DdeConnect 7E4581C3 5 Bytes JMP 00D7A00C
.text C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe[132] ole32.dll!CoCreateInstanceEx 774FF154 5 Bytes JMP 00D7900C
.text C:\Program Files\Eastlink Internet Security\Common\FSM32.EXE[144] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 0093000C
.text C:\Program Files\Eastlink Internet Security\Common\FSM32.EXE[144] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes JMP 0093100C
.text C:\WINDOWS\system32\winlogon.exe[520] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 00A4000C
.text C:\WINDOWS\system32\winlogon.exe[520] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes JMP 00A4100C
.text C:\WINDOWS\system32\winlogon.exe[520] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00A4200C
.text C:\WINDOWS\system32\winlogon.exe[520] kernel32.dll!TerminateThread 7C81CB3B 5 Bytes JMP 00A4300C
.text C:\WINDOWS\system32\winlogon.exe[520] ADVAPI32.dll!CloseServiceHandle 77DE6CE5 5 Bytes JMP 00A4700C
.text C:\WINDOWS\system32\winlogon.exe[520] ADVAPI32.dll!OpenServiceW 77DE6FFD 5 Bytes JMP 00A4500C
.text C:\WINDOWS\system32\winlogon.exe[520] ADVAPI32.dll!ControlService 77DF4A09 5 Bytes JMP 00A4600C
.text C:\WINDOWS\system32\winlogon.exe[520] ADVAPI32.dll!CreateServiceW 77E373A9 5 Bytes JMP 00A4800C
.text C:\WINDOWS\system32\winlogon.exe[520] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 00A4400C
.text C:\WINDOWS\system32\winlogon.exe[520] USER32.dll!DdeConnect 7E4581C3 5 Bytes JMP 00A4A00C
.text C:\WINDOWS\system32\winlogon.exe[520] ole32.dll!CoCreateInstanceEx 774FF154 5 Bytes JMP 00A4900C
.text C:\WINDOWS\system32\lsass.exe[576] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 00D0000C
.text C:\WINDOWS\system32\lsass.exe[576] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes JMP 00D0100C
.text C:\WINDOWS\system32\lsass.exe[576] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00D0200C
.text C:\WINDOWS\system32\lsass.exe[576] kernel32.dll!TerminateThread 7C81CB3B 5 Bytes JMP 00D0300C
.text C:\WINDOWS\system32\lsass.exe[576] ADVAPI32.dll!CloseServiceHandle 77DE6CE5 5 Bytes JMP 00D0700C
.text C:\WINDOWS\system32\lsass.exe[576] ADVAPI32.dll!OpenServiceW 77DE6FFD 5 Bytes JMP 00D0500C
.text C:\WINDOWS\system32\lsass.exe[576] ADVAPI32.dll!ControlService 77DF4A09 5 Bytes JMP 00D0600C
.text C:\WINDOWS\system32\lsass.exe[576] ADVAPI32.dll!CreateServiceW 77E373A9 5 Bytes JMP 00D0800C
.text C:\WINDOWS\system32\lsass.exe[576] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 00D0400C
.text C:\WINDOWS\system32\lsass.exe[576] USER32.dll!DdeConnect 7E4581C3 3 Bytes JMP 00D0A00C
.text C:\WINDOWS\system32\lsass.exe[576] USER32.dll!DdeConnect + 4 7E4581C7 1 Byte [82]
.text C:\WINDOWS\system32\lsass.exe[576] ole32.dll!CoCreateInstanceEx 774FF154 5 Bytes JMP 00D0900C
.text C:\WINDOWS\system32\Ati2evxx.exe[732] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 022D000C
.text C:\WINDOWS\system32\Ati2evxx.exe[732] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes JMP 022D100C
.text C:\WINDOWS\system32\Ati2evxx.exe[732] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 022D200C
.text C:\WINDOWS\system32\Ati2evxx.exe[732] kernel32.dll!TerminateThread 7C81CB3B 5 Bytes JMP 022D300C
.text C:\WINDOWS\system32\Ati2evxx.exe[732] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 022D400C
.text C:\WINDOWS\system32\Ati2evxx.exe[732] USER32.dll!DdeConnect 7E4581C3 5 Bytes JMP 022DA00C
.text C:\WINDOWS\system32\Ati2evxx.exe[732] ADVAPI32.dll!CloseServiceHandle 77DE6CE5 5 Bytes JMP 022D700C
.text C:\WINDOWS\system32\Ati2evxx.exe[732] ADVAPI32.dll!OpenServiceW 77DE6FFD 5 Bytes JMP 022D500C
.text C:\WINDOWS\system32\Ati2evxx.exe[732] ADVAPI32.dll!ControlService 77DF4A09 5 Bytes JMP 022D600C
.text C:\WINDOWS\system32\Ati2evxx.exe[732] ADVAPI32.dll!CreateServiceW 77E373A9 5 Bytes JMP 022D800C
.text C:\WINDOWS\system32\Ati2evxx.exe[732] ole32.dll!CoCreateInstanceEx 774FF154 5 Bytes JMP 022D900C
.text C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe[1068] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 02CD000C
.text C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe[1068] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes JMP 02CD100C
.text C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe[1068] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 02CD200C
.text C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe[1068] kernel32.dll!TerminateThread 7C81CB3B 5 Bytes JMP 02CD300C
.text C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe[1068] ADVAPI32.dll!CloseServiceHandle 77DE6CE5 5 Bytes JMP 02CD700C
.text C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe[1068] ADVAPI32.dll!OpenServiceW 77DE6FFD 5 Bytes JMP 02CD500C
.text C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe[1068] ADVAPI32.dll!ControlService 77DF4A09 5 Bytes JMP 02CD600C
.text C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe[1068] ADVAPI32.dll!CreateServiceW 77E373A9 5 Bytes JMP 02CD800C
.text C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe[1068] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 02CD400C
.text C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe[1068] USER32.dll!DdeConnect 7E4581C3 5 Bytes JMP 02CDA00C
.text C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe[1068] ole32.dll!CoCreateInstanceEx 774FF154 5 Bytes JMP 02CD900C
.text C:\DOCUME~1\Robbin\LOCALS~1\Temp\Temporary Directory 1 for gmer[1].zip\gmer.exe[1132] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 0038000C
.text C:\DOCUME~1\Robbin\LOCALS~1\Temp\Temporary Directory 1 for gmer[1].zip\gmer.exe[1132] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes JMP 0038100C
.text C:\DOCUME~1\Robbin\LOCALS~1\Temp\Temporary Directory 1 for gmer[1].zip\gmer.exe[1132] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 0038200C
.text C:\DOCUME~1\Robbin\LOCALS~1\Temp\Temporary Directory 1 for gmer[1].zip\gmer.exe[1132] kernel32.dll!TerminateThread 7C81CB3B 5 Bytes JMP 0038300C
.text C:\DOCUME~1\Robbin\LOCALS~1\Temp\Temporary Directory 1 for gmer[1].zip\gmer.exe[1132] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 0038400C
.text C:\DOCUME~1\Robbin\LOCALS~1\Temp\Temporary Directory 1 for gmer[1].zip\gmer.exe[1132] USER32.dll!DdeConnect 7E4581C3 5 Bytes JMP 0038900C
.text C:\DOCUME~1\Robbin\LOCALS~1\Temp\Temporary Directory 1 for gmer[1].zip\gmer.exe[1132] ADVAPI32.dll!CloseServiceHandle 77DE6CE5 5 Bytes JMP 0038700C
.text C:\DOCUME~1\Robbin\LOCALS~1\Temp\Temporary Directory 1 for gmer[1].zip\gmer.exe[1132] ADVAPI32.dll!OpenServiceW 77DE6FFD 5 Bytes JMP 0038500C
.text C:\DOCUME~1\Robbin\LOCALS~1\Temp\Temporary Directory 1 for gmer[1].zip\gmer.exe[1132] ADVAPI32.dll!ControlService 77DF4A09 5 Bytes JMP 0038600C
.text C:\DOCUME~1\Robbin\LOCALS~1\Temp\Temporary Directory 1 for gmer[1].zip\gmer.exe[1132] ADVAPI32.dll!CreateServiceW 77E373A9 5 Bytes JMP 0038800C
.text C:\DOCUME~1\Robbin\LOCALS~1\Temp\Temporary Directory 1 for gmer[1].zip\gmer.exe[1132] ole32.dll!CoCreateInstanceEx 774FF154 5 Bytes JMP 0038A00C
.text C:\WINDOWS\System32\brsvc01a.exe[1272] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 0211000C
.text C:\WINDOWS\System32\brsvc01a.exe[1272] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes JMP 0211100C
.text C:\WINDOWS\System32\brsvc01a.exe[1272] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 0211200C
.text C:\WINDOWS\System32\brsvc01a.exe[1272] kernel32.dll!TerminateThread 7C81CB3B 5 Bytes JMP 0211300C
.text C:\WINDOWS\System32\brsvc01a.exe[1272] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 0211400C
.text C:\WINDOWS\System32\brsvc01a.exe[1272] USER32.dll!DdeConnect 7E4581C3 5 Bytes JMP 0211900C
.text C:\WINDOWS\System32\brsvc01a.exe[1272] ADVAPI32.dll!CloseServiceHandle 77DE6CE5 5 Bytes JMP 0211700C
.text C:\WINDOWS\System32\brsvc01a.exe[1272] ADVAPI32.dll!OpenServiceW 77DE6FFD 5 Bytes JMP 0211500C
.text C:\WINDOWS\System32\brsvc01a.exe[1272] ADVAPI32.dll!ControlService 77DF4A09 5 Bytes JMP 0211600C
.text C:\WINDOWS\System32\brsvc01a.exe[1272] ADVAPI32.dll!CreateServiceW 77E373A9 5 Bytes JMP 0211800C
.text C:\WINDOWS\System32\brss01a.exe[1308] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 01FA000C
.text C:\WINDOWS\System32\brss01a.exe[1308] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes JMP 01FA100C
.text C:\WINDOWS\System32\brss01a.exe[1308] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 01FA200C
.text C:\WINDOWS\System32\brss01a.exe[1308] kernel32.dll!TerminateThread 7C81CB3B 5 Bytes JMP 01FA300C
.text C:\WINDOWS\System32\brss01a.exe[1308] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 01FA400C
.text C:\WINDOWS\System32\brss01a.exe[1308] USER32.dll!DdeConnect 7E4581C3 5 Bytes JMP 01FAA00C
.text C:\WINDOWS\System32\brss01a.exe[1308] ADVAPI32.dll!CloseServiceHandle 77DE6CE5 5 Bytes JMP 01FA700C
.text C:\WINDOWS\System32\brss01a.exe[1308] ADVAPI32.dll!OpenServiceW 77DE6FFD 5 Bytes JMP 01FA500C
.text C:\WINDOWS\System32\brss01a.exe[1308] ADVAPI32.dll!ControlService 77DF4A09 5 Bytes JMP 01FA600C
.text C:\WINDOWS\System32\brss01a.exe[1308] ADVAPI32.dll!CreateServiceW 77E373A9 5 Bytes JMP 01FA800C
.text C:\WINDOWS\System32\brss01a.exe[1308] ole32.dll!CoCreateInstanceEx 774FF154 5 Bytes JMP 01FA900C
.text C:\WINDOWS\system32\Ati2evxx.exe[1452] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 021D000C
.text C:\WINDOWS\system32\Ati2evxx.exe[1452] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes JMP 021D100C
.text C:\WINDOWS\system32\Ati2evxx.exe[1452] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 021D200C
.text C:\WINDOWS\system32\Ati2evxx.exe[1452] kernel32.dll!TerminateThread 7C81CB3B 5 Bytes JMP 021D300C
.text C:\WINDOWS\system32\Ati2evxx.exe[1452] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 021D400C
.text C:\WINDOWS\system32\Ati2evxx.exe[1452] USER32.dll!DdeConnect 7E4581C3 5 Bytes JMP 021DA00C
.text C:\WINDOWS\system32\Ati2evxx.exe[1452] ADVAPI32.dll!CloseServiceHandle 77DE6CE5 5 Bytes JMP 021D700C
.text C:\WINDOWS\system32\Ati2evxx.exe[1452] ADVAPI32.dll!OpenServiceW 77DE6FFD 5 Bytes JMP 021D500C
.text C:\WINDOWS\system32\Ati2evxx.exe[1452] ADVAPI32.dll!ControlService 77DF4A09 5 Bytes JMP 021D600C
.text C:\WINDOWS\system32\Ati2evxx.exe[1452] ADVAPI32.dll!CreateServiceW 77E373A9 5 Bytes JMP 021D800C
.text C:\WINDOWS\system32\Ati2evxx.exe[1452] ole32.dll!CoCreateInstanceEx 774FF154 5 Bytes JMP 021D900C
.text C:\WINDOWS\Explorer.EXE[1520] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 00F4000C
.text C:\WINDOWS\Explorer.EXE[1520] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes JMP 00F4100C
.text C:\WINDOWS\Explorer.EXE[1520] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00F4200C
.text C:\WINDOWS\Explorer.EXE[1520] kernel32.dll!TerminateThread 7C81CB3B 5 Bytes JMP 00F4300C
.text C:\WINDOWS\Explorer.EXE[1520] ADVAPI32.dll!CloseServiceHandle 77DE6CE5 5 Bytes JMP 00F4700C
.text C:\WINDOWS\Explorer.EXE[1520] ADVAPI32.dll!OpenServiceW 77DE6FFD 5 Bytes JMP 00F4500C
.text C:\WINDOWS\Explorer.EXE[1520] ADVAPI32.dll!ControlService 77DF4A09 5 Bytes JMP 00F4600C
.text C:\WINDOWS\Explorer.EXE[1520] ADVAPI32.dll!CreateServiceW 77E373A9 5 Bytes JMP 00F4800C
.text C:\WINDOWS\Explorer.EXE[1520] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 00F4400C
.text C:\WINDOWS\Explorer.EXE[1520] USER32.dll!DdeConnect 7E4581C3 5 Bytes JMP 00F4A00C
.text C:\WINDOWS\Explorer.EXE[1520] ole32.dll!CoCreateInstanceEx 774FF154 5 Bytes JMP 00F4900C
.text C:\WINDOWS\system32\wuauclt.exe[1776] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 00D1000C
.text C:\WINDOWS\system32\wuauclt.exe[1776] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes JMP 00D1100C
.text C:\WINDOWS\system32\wuauclt.exe[1776] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00D1200C
.text C:\WINDOWS\system32\wuauclt.exe[1776] kernel32.dll!TerminateThread 7C81CB3B 5 Bytes JMP 00D1300C
.text C:\WINDOWS\system32\wuauclt.exe[1776] ole32.dll!CoCreateInstanceEx 774FF154 5 Bytes JMP 00D1900C
.text C:\WINDOWS\system32\wuauclt.exe[1776] ADVAPI32.dll!CloseServiceHandle 77DE6CE5 5 Bytes JMP 00D1700C
.text C:\WINDOWS\system32\wuauclt.exe[1776] ADVAPI32.dll!OpenServiceW 77DE6FFD 5 Bytes JMP 00D1500C
.text C:\WINDOWS\system32\wuauclt.exe[1776] ADVAPI32.dll!ControlService 77DF4A09 5 Bytes JMP 00D1600C
.text C:\WINDOWS\system32\wuauclt.exe[1776] ADVAPI32.dll!CreateServiceW 77E373A9 5 Bytes JMP 00D1800C
.text C:\WINDOWS\system32\wuauclt.exe[1776] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 00D1400C
.text C:\WINDOWS\system32\wuauclt.exe[1776] USER32.dll!DdeConnect 7E4581C3 5 Bytes JMP 00D1A00C
.text C:\Program Files\Java\jre6\bin\jqs.exe[1984] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 0363000C
.text C:\Program Files\Java\jre6\bin\jqs.exe[1984] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes JMP 0363100C
.text C:\Program Files\Java\jre6\bin\jqs.exe[1984] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 0363200C
.text C:\Program Files\Java\jre6\bin\jqs.exe[1984] kernel32.dll!TerminateThread 7C81CB3B 5 Bytes JMP 0363300C
.text C:\Program Files\Java\jre6\bin\jqs.exe[1984] ADVAPI32.dll!CloseServiceHandle 77DE6CE5 5 Bytes JMP 0363700C
.text C:\Program Files\Java\jre6\bin\jqs.exe[1984] ADVAPI32.dll!OpenServiceW 77DE6FFD 5 Bytes JMP 0363500C
.text C:\Program Files\Java\jre6\bin\jqs.exe[1984] ADVAPI32.dll!ControlService 77DF4A09 5 Bytes JMP 0363600C
.text C:\Program Files\Java\jre6\bin\jqs.exe[1984] ADVAPI32.dll!CreateServiceW 77E373A9 5 Bytes JMP 0363800C
.text C:\Program Files\Java\jre6\bin\jqs.exe[1984] ole32.dll!CoCreateInstanceEx 774FF154 5 Bytes JMP 0363900C
.text C:\Program Files\Java\jre6\bin\jqs.exe[1984] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 0363400C
.text C:\Program Files\Java\jre6\bin\jqs.exe[1984] USER32.dll!DdeConnect 7E4581C3 5 Bytes JMP 0363A00C
.text C:\WINDOWS\System32\alg.exe[2352] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 00AD000C
.text C:\WINDOWS\System32\alg.exe[2352] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes JMP 00AD100C
.text C:\WINDOWS\System32\alg.exe[2352] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00AD200C
.text C:\WINDOWS\System32\alg.exe[2352] kernel32.dll!TerminateThread 7C81CB3B 5 Bytes JMP 00AD300C
.text C:\WINDOWS\System32\alg.exe[2352] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 00AD400C
.text C:\WINDOWS\System32\alg.exe[2352] USER32.dll!DdeConnect 7E4581C3 5 Bytes JMP 00ADA00C
.text C:\WINDOWS\System32\alg.exe[2352] ADVAPI32.dll!CloseServiceHandle 77DE6CE5 5 Bytes JMP 00AD700C
.text C:\WINDOWS\System32\alg.exe[2352] ADVAPI32.dll!OpenServiceW 77DE6FFD 5 Bytes JMP 00AD500C
.text C:\WINDOWS\System32\alg.exe[2352] ADVAPI32.dll!ControlService 77DF4A09 5 Bytes JMP 00AD600C
.text C:\WINDOWS\System32\alg.exe[2352] ADVAPI32.dll!CreateServiceW 77E373A9 5 Bytes JMP 00AD800C
.text C:\WINDOWS\System32\alg.exe[2352] ole32.dll!CoCreateInstanceEx 774FF154 5 Bytes JMP 00AD900C
.text C:\Program Files\Internet Explorer\iexplore.exe[2500] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 009B000C
.text C:\Program Files\Internet Explorer\iexplore.exe[2500] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes JMP 009B100C
.text C:\Program Files\Internet Explorer\iexplore.exe[2500] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 009B200C
.text C:\Program Files\Internet Explorer\iexplore.exe[2500] kernel32.dll!TerminateThread 7C81CB3B 5 Bytes JMP 009B300C
.text C:\Program Files\Internet Explorer\iexplore.exe[2500] ADVAPI32.dll!CloseServiceHandle 77DE6CE5 5 Bytes JMP 009B700C
.text C:\Program Files\Internet Explorer\iexplore.exe[2500] ADVAPI32.dll!OpenServiceW 77DE6FFD 5 Bytes JMP 009B500C
.text C:\Program Files\Internet Explorer\iexplore.exe[2500] ADVAPI32.dll!ControlService 77DF4A09 5 Bytes JMP 009B600C
.text C:\Program Files\Internet Explorer\iexplore.exe[2500] ADVAPI32.dll!CreateServiceW 77E373A9 5 Bytes JMP 009B800C
.text C:\Program Files\Internet Explorer\iexplore.exe[2500] USER32.dll!DialogBoxParamW 7E4247AB 5 Bytes JMP 3E2154F5 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2500] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 009B400C
.text C:\Program Files\Internet Explorer\iexplore.exe[2500] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 3E2EDB24 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2500] USER32.dll!DialogBoxIndirectParamW 7E432072 5 Bytes JMP 3E3E5027 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2500] USER32.dll!MessageBoxIndirectA 7E43A082 5 Bytes JMP 3E3E4F59 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2500] USER32.dll!DialogBoxParamA 7E43B144 5 Bytes JMP 3E3E4FC4 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2500] USER32.dll!MessageBoxExW 7E450838 5 Bytes JMP 3E3E4E2A C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2500] USER32.dll!MessageBoxExA 7E45085C 5 Bytes JMP 3E3E4E8C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2500] USER32.dll!DialogBoxIndirectParamA 7E456D7D 5 Bytes JMP 3E3E508A C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2500] USER32.dll!DdeConnect 7E4581C3 5 Bytes JMP 009BA00C
.text C:\Program Files\Internet Explorer\iexplore.exe[2500] USER32.dll!MessageBoxIndirectW 7E4664D5 5 Bytes JMP 3E3E4EEE C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[2500] ole32.dll!CoCreateInstanceEx 774FF154 5 Bytes JMP 009B900C
.text C:\Program Files\Internet Explorer\iexplore.exe[3848] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 009B000C
.text C:\Program Files\Internet Explorer\iexplore.exe[3848] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes JMP 009B100C
.text C:\Program Files\Internet Explorer\iexplore.exe[3848] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 009B200C
.text C:\Program Files\Internet Explorer\iexplore.exe[3848] kernel32.dll!TerminateThread 7C81CB3B 5 Bytes JMP 009B300C
.text C:\Program Files\Internet Explorer\iexplore.exe[3848] ADVAPI32.dll!CloseServiceHandle 77DE6CE5 5 Bytes JMP 009B700C
.text C:\Program Files\Internet Explorer\iexplore.exe[3848] ADVAPI32.dll!OpenServiceW 77DE6FFD 5 Bytes JMP 009B500C
.text C:\Program Files\Internet Explorer\iexplore.exe[3848] ADVAPI32.dll!ControlService 77DF4A09 5 Bytes JMP 009B600C
.text C:\Program Files\Internet Explorer\iexplore.exe[3848] ADVAPI32.dll!CreateServiceW 77E373A9 5 Bytes JMP 009B800C
.text C:\Program Files\Internet Explorer\iexplore.exe[3848] USER32.dll!DialogBoxParamW 7E4247AB 5 Bytes JMP 3E2154F5 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3848] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 3E2E9ACD C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3848] USER32.dll!CallNextHookEx 7E42B3C6 5 Bytes JMP 3E2DD12D C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3848] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 3E2EDB24 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3848] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 3E254656 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3848] USER32.dll!DialogBoxIndirectParamW 7E432072 5 Bytes JMP 3E3E5027 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3848] USER32.dll!MessageBoxIndirectA 7E43A082 5 Bytes JMP 3E3E4F59 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3848] USER32.dll!DialogBoxParamA 7E43B144 5 Bytes JMP 3E3E4FC4 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3848] USER32.dll!MessageBoxExW 7E450838 5 Bytes JMP 3E3E4E2A C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3848] USER32.dll!MessageBoxExA 7E45085C 5 Bytes JMP 3E3E4E8C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3848] USER32.dll!DialogBoxIndirectParamA 7E456D7D 5 Bytes JMP 3E3E508A C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3848] USER32.dll!DdeConnect 7E4581C3 5 Bytes JMP 009BA00C
.text C:\Program Files\Internet Explorer\iexplore.exe[3848] USER32.dll!MessageBoxIndirectW 7E4664D5 5 Bytes JMP 3E3E4EEE C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3848] ole32.dll!CoCreateInstanceEx 774FF154 5 Bytes JMP 009B900C
.text C:\Program Files\Internet Explorer\iexplore.exe[3848] ole32.dll!CoCreateInstance 774FF1AC 5 Bytes JMP 3E2EDB80 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[3848] ole32.dll!OleLoadFromStream 7752981B 5 Bytes JMP 3E3E538F C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

—- Devices - GMER 1.0.15 —-

Device \Driver\Tcpip \Device\Ip fsdfw.sys (F-Secure Internet Shield Driver/F-Secure Corporation)
Device \Driver\Tcpip \Device\Tcp fsdfw.sys (F-Secure Internet Shield Driver/F-Secure Corporation)

AttachedDevice \Driver\Tcpip \Device\Tcp fssfltr_tdi.sys (Family Safety Filter Driver (TDI)/Microsoft Corporation)

Device \Driver\Tcpip \Device\Udp fsdfw.sys (F-Secure Internet Shield Driver/F-Secure Corporation)
Device \Driver\Tcpip \Device\RawIp fsdfw.sys (F-Secure Internet Shield Driver/F-Secure Corporation)
Device \Driver\Tcpip \Device\IPMULTICAST fsdfw.sys (F-Secure Internet Shield Driver/F-Secure Corporation)

AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

Device \FileSystem\Cdfs \Cdfs EDA7A400

—- Disk sectors - GMER 1.0.15 —-

Disk \Device\Harddisk0\DR0 sector 00 (MBR): rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sector 62: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sector 63: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sectors 78165104 (+255): rootkit-like behavior;

—- EOF - GMER 1.0.15 —-
Post #9
Hi,

Lets check further

Download MBRCheck.exe to your desktop.
  • Be sure to disable your security programs
  • Double click on the file to run it
  • A window will open on your desktop
  • if an unknown bootcode is found you will have further options available to you, at this time press N then press Enter twice.
  • If nothing unusual is found just press Enter
  • A .txt file named MBRCheck_mm.dd.yy_hh.mm.ss should appear on your desktop.
  • Please post the contents of that file.
Post #10
MBRCheck, version 1.2.3 © 2010, AD Command-line: Windows Version: Windows XP Professional Windows Information: Service Pack 3 (build 2600) Logical Drives Mask: 0x0000003d Kernel Drivers (total 131): 0x804D7000 \WINDOWS\system32\ntoskrnl.exe 0x806EE000 \WINDOWS\system32\hal.dll 0xF8AF6000 \WINDOWS\system32\KDCOM.DLL 0xF8A06000 \WINDOWS\system32\BOOTVID.dll 0xF85A7000 ACPI.sys 0xF8AF8000 \WINDOWS\System32\DRIVERS\WMILIB.SYS 0xF8596000 pci.sys 0xF85F6000 isapnp.sys 0xF8AFA000 viaide.sys 0xF8876000 \WINDOWS\System32\DRIVERS\PCIIDEX.SYS 0xF8606000 MountMgr.sys 0xF8577000 ftdisk.sys 0xF8AFC000 dmload.sys 0xF8551000 dmio.sys 0xF887E000 PartMgr.sys 0xF8616000 VolSnap.sys 0xF8539000 atapi.sys 0xF8626000 disk.sys 0xF8636000 \WINDOWS\System32\DRIVERS\CLASSPNP.SYS 0xF8519000 fltmgr.sys 0xF8507000 sr.sys 0xF8886000 PxHelp20.sys 0xF84F0000 KSecDD.sys 0xF8463000 Ntfs.sys 0xF8451000 fsdfw.sys 0xF8424000 \WINDOWS\System32\drivers\NDIS.SYS 0xF8646000 viaagp.sys 0xF840A000 Mup.sys 0xF8656000 fsbts.sys 0xF7BA7000 \SystemRoot\System32\DRIVERS\p3.sys 0xF7ABA000 \SystemRoot\System32\DRIVERS\ati2mtag.sys 0xF7AA6000 \SystemRoot\System32\DRIVERS\VIDEOPRT.SYS 0xF7B87000 \SystemRoot\System32\DRIVERS\cdrom.sys 0xF8686000 \SystemRoot\System32\DRIVERS\redbook.sys 0xF7A83000 \SystemRoot\System32\DRIVERS\ks.sys 0xF86A6000 \SystemRoot\System32\DRIVERS\imapi.sys 0xF8946000 \SystemRoot\System32\DRIVERS\usbuhci.sys 0xF7A5F000 \SystemRoot\System32\DRIVERS\USBPORT.SYS 0xF7A4A000 \SystemRoot\system32\drivers\ac97via.sys 0xF7A26000 \SystemRoot\system32\drivers\portcls.sys 0xF86C6000 \SystemRoot\system32\drivers\drmk.sys 0xF86E6000 \SystemRoot\System32\DRIVERS\dc21x4.sys 0xF7948000 \SystemRoot\System32\DRIVERS\HCF_MSFT.sys 0xF895E000 \SystemRoot\System32\Drivers\Modem.SYS 0xF896E000 \SystemRoot\System32\DRIVERS\fdc.sys 0xF8716000 \SystemRoot\System32\DRIVERS\serial.sys 0xF8AF2000 \SystemRoot\System32\DRIVERS\serenum.sys 0xF7307000 \SystemRoot\System32\DRIVERS\parport.sys 0xF8726000 \SystemRoot\System32\DRIVERS\i8042prt.sys 0xF83DE000 \SystemRoot\system32\DRIVERS\L8042Kbd.sys 0xF897E000 \SystemRoot\System32\DRIVERS\kbdclass.sys 0xF8BF3000 \SystemRoot\System32\DRIVERS\audstub.sys 0xF8746000 \SystemRoot\System32\DRIVERS\rasl2tp.sys 0xF83DA000 \SystemRoot\System32\DRIVERS\ndistapi.sys 0xF72F0000 \SystemRoot\System32\DRIVERS\ndiswan.sys 0xF8766000 \SystemRoot\System32\DRIVERS\raspppoe.sys 0xF8776000 \SystemRoot\System32\DRIVERS\raspptp.sys 0xF898E000 \SystemRoot\System32\DRIVERS\TDI.SYS 0xF72DF000 \SystemRoot\System32\DRIVERS\psched.sys 0xF8796000 \SystemRoot\System32\DRIVERS\msgpc.sys 0xF899E000 \SystemRoot\System32\DRIVERS\ptilink.sys 0xF89AE000 \SystemRoot\System32\DRIVERS\raspti.sys 0xF7287000 \SystemRoot\System32\DRIVERS\rdpdr.sys 0xF87C6000 \SystemRoot\System32\DRIVERS\termdd.sys 0xF89BE000 \SystemRoot\System32\DRIVERS\mouclass.sys 0xF8B30000 \SystemRoot\System32\DRIVERS\swenum.sys 0xF7229000 \SystemRoot\System32\DRIVERS\update.sys 0xF8A8E000 \SystemRoot\System32\DRIVERS\mssmbios.sys 0xF87F6000 \SystemRoot\System32\Drivers\NDProxy.SYS 0xF8846000 \SystemRoot\System32\DRIVERS\usbhub.sys 0xF8B34000 \SystemRoot\System32\DRIVERS\USBD.SYS 0xF8ABA000 \SystemRoot\System32\DRIVERS\gameenum.sys 0xF89CE000 \SystemRoot\System32\DRIVERS\flpydisk.sys 0xF8B5C000 \SystemRoot\System32\Drivers\Fs_Rec.SYS 0xF7BF7000 \SystemRoot\system32\DRIVERS\DcCam.sys 0xEF0B3000 \SystemRoot\system32\DRIVERS\EXPORTIT.SYS 0xF8C81000 \SystemRoot\System32\Drivers\Null.SYS 0xF8B64000 \SystemRoot\System32\Drivers\Beep.SYS 0xF89EE000 \SystemRoot\System32\drivers\vga.sys 0xF8B6A000 \SystemRoot\System32\Drivers\mnmdd.SYS 0xF8B70000 \SystemRoot\System32\DRIVERS\RDPCDD.sys 0xF89F6000 \SystemRoot\System32\Drivers\Msfs.SYS 0xF889E000 \SystemRoot\System32\Drivers\Npfs.SYS 0xF8ADA000 \SystemRoot\System32\DRIVERS\rasacd.sys 0xEF080000 \SystemRoot\System32\DRIVERS\ipsec.sys 0xEF069000 \SystemRoot\system32\DRIVERS\P0620Vid.sys 0xF7BD7000 \SystemRoot\system32\DRIVERS\STREAM.SYS 0xEF010000 \SystemRoot\System32\DRIVERS\tcpip.sys 0xF88BE000 \SystemRoot\System32\Drivers\LUsbFilt.Sys 0xF8696000 \SystemRoot\System32\Drivers\WDFLDR.SYS 0xEEFE8000 \SystemRoot\System32\DRIVERS\netbt.sys 0xEEF6D000 \SystemRoot\system32\DRIVERS\Wdf01000.sys 0xEEF47000 \SystemRoot\System32\DRIVERS\ipnat.sys 0xF8706000 \SystemRoot\System32\DRIVERS\wanarp.sys 0xEEF25000 \SystemRoot\System32\drivers\afd.sys 0xF8AEE000 \SystemRoot\System32\DRIVERS\hidusb.sys 0xF8756000 \SystemRoot\System32\DRIVERS\HIDCLASS.SYS 0xF88DE000 \SystemRoot\System32\DRIVERS\HIDPARSE.SYS 0xF8786000 \SystemRoot\System32\DRIVERS\netbios.sys 0xEEEFA000 \SystemRoot\System32\DRIVERS\rdbss.sys 0xEEE8A000 \SystemRoot\System32\DRIVERS\mrxsmb.sys 0xF87D6000 \SystemRoot\System32\Drivers\Fips.SYS 0xF87E6000 \??\C:\Program Files\Eastlink Internet Security\HIPS\drivers\fshs.sys 0xEEE3E000 \SystemRoot\System32\Drivers\Fastfat.SYS 0xF88EE000 \SystemRoot\system32\DRIVERS\LHidFilt.Sys 0xF7225000 \SystemRoot\System32\DRIVERS\mouhid.sys 0xF88F6000 \SystemRoot\system32\DRIVERS\LMouFilt.Sys 0xEEE26000 \SystemRoot\System32\Drivers\dump_atapi.sys 0xF8B90000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS 0xBF800000 \SystemRoot\System32\win32k.sys 0xF8AD6000 \SystemRoot\System32\drivers\Dxapi.sys 0xF891E000 \SystemRoot\System32\watchdog.sys 0xBF000000 \SystemRoot\System32\drivers\dxg.sys 0xF8C3E000 \SystemRoot\System32\drivers\dxgthk.sys 0xBF012000 \SystemRoot\System32\ati2dvag.dll 0xBF049000 \SystemRoot\System32\ati2cqag.dll 0xBF083000 \SystemRoot\System32\ati3d1ag.dll 0xBFFA0000 \SystemRoot\System32\ATMFD.DLL 0xF8736000 \SystemRoot\system32\drivers\dcfs2k.sys 0xEEDE6000 \SystemRoot\system32\DRIVERS\fssfltr_tdi.sys 0xEED0E000 \SystemRoot\System32\DRIVERS\ndisuio.sys 0xEE8E9000 \SystemRoot\system32\drivers\wdmaud.sys 0xEEA76000 \SystemRoot\system32\drivers\sysaudio.sys 0xEE7A6000 \SystemRoot\System32\DRIVERS\mrxdav.sys 0xF8B6E000 \SystemRoot\System32\Drivers\ParVdm.SYS 0xEE60E000 \SystemRoot\System32\DRIVERS\srv.sys 0xEE1DC000 \??\C:\Program Files\Eastlink Internet Security\Anti-Virus\minifilter\fsgk.sys 0xEE14B000 \SystemRoot\System32\Drivers\HTTP.sys 0xEE32E000 \??\C:\WINDOWS\System32\Drivers\ESDPDX01.SYS 0xED9A1000 \SystemRoot\system32\drivers\kmixer.sys 0x7C900000 \WINDOWS\system32\ntdll.dll Processes (total 42): 0 System Idle Process 4 System 440 C:\WINDOWS\system32\smss.exe 496 csrss.exe 520 C:\WINDOWS\system32\winlogon.exe 564 C:\WINDOWS\system32\services.exe 576 C:\WINDOWS\system32\lsass.exe 732 C:\WINDOWS\system32\ati2evxx.exe 744 C:\WINDOWS\system32\svchost.exe 800 svchost.exe 868 C:\WINDOWS\system32\svchost.exe 916 svchost.exe 952 svchost.exe 1260 C:\WINDOWS\system32\BRSVC01A.EXE 1280 C:\WINDOWS\system32\spoolsv.exe 1292 C:\WINDOWS\system32\BRSS01A.EXE 1436 C:\WINDOWS\system32\ati2evxx.exe 1504 C:\WINDOWS\explorer.exe 1728 C:\Program Files\Eastlink Internet Security\Common\FSM32.EXE 1736 C:\Program Files\QuickTime\qttask.exe 1804 svchost.exe 1868 C:\Program Files\Eastlink Internet Security\Anti-Virus\fsgk32st.exe 1900 C:\Program Files\Eastlink Internet Security\Common\FSMA32.EXE 1984 C:\Program Files\Eastlink Internet Security\Common\FSHDLL32.EXE 132 C:\Program Files\Java\jre6\bin\jqs.exe 236 C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe 348 C:\WINDOWS\system32\svchost.exe 1080 C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe 2252 fsorsp.exe 2272 C:\Program Files\Eastlink Internet Security\FWES\program\fsdfwd.exe 2656 alg.exe 3356 C:\WINDOWS\system32\wuauclt.exe 2924 C:\Program Files\Internet Explorer\iexplore.exe 3104 C:\Program Files\Internet Explorer\iexplore.exe 2880 C:\Program Files\Internet Explorer\iexplore.exe 1232 C:\Program Files\Internet Explorer\iexplore.exe 3408 C:\Program Files\Eastlink Internet Security\Anti-Virus\fsgk32.exe 3484 C:\Program Files\Eastlink Internet Security\Anti-Virus\fssm32.exe 3596 C:\Program Files\Eastlink Internet Security\Anti-Virus\fsav32.exe 2464 C:\WINDOWS\system32\wuauclt.exe 2920 C:\WINDOWS\system32\wscntfy.exe 3192 C:\Documents and Settings\Robbin\Local Settings\Temporary Internet Files\Content.IE5\XM6ZH4EG\MBRCheck[1].exe \\.\C: –> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS) \\.\D: –> \\.\PhysicalDrive1 at offset 0x00000000`00007e00 (FAT32) PhysicalDrive0 Model Number: WDCWD400JB-00ENA0, Rev: 05.03E05 PhysicalDrive1 Model Number: FUJITSUMPE3084AE, Rev: EE-C0-23 Size Device Name MBR Status ——————————————– 37 GB \\.\PhysicalDrive0 Windows XP MBR code detected SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A 7 GB \\.\PhysicalDrive1 Unknown MBR code SHA1: A34BDE97CAD677E44DCB5C5873475582450A84F8 Found non-standard or infected MBR. Enter 'Y' and hit ENTER for more options, or 'N' to exit: Done!
Post #11 last edited
Hi,

Your Master Boot Record could be infected , what I need is the dump of that file

Double click on MBRCheck.exe to run it,
  • type in Y and press Enter when asked if you wish to see more options
  • Type in 1 to "Dump the MBR of a physical disk to file" and press Enter
  • Type in 0 to select your disk and press Enter
  • Type in dump.txt as the file name and press Enter
  • Type in -1 to exit and press Enter.
Please attach dump.txt to your next reply for me.
Post #12
MBRCheck, version 1.2.3 © 2010, AD Command-line: Windows Version: Windows XP Professional Windows Information: Service Pack 3 (build 2600) Logical Drives Mask: 0x0000003d Kernel Drivers (total 131): 0x804D7000 \WINDOWS\system32\ntoskrnl.exe 0x806EE000 \WINDOWS\system32\hal.dll 0xF8AF6000 \WINDOWS\system32\KDCOM.DLL 0xF8A06000 \WINDOWS\system32\BOOTVID.dll 0xF85A7000 ACPI.sys 0xF8AF8000 \WINDOWS\System32\DRIVERS\WMILIB.SYS 0xF8596000 pci.sys 0xF85F6000 isapnp.sys 0xF8AFA000 viaide.sys 0xF8876000 \WINDOWS\System32\DRIVERS\PCIIDEX.SYS 0xF8606000 MountMgr.sys 0xF8577000 ftdisk.sys 0xF8AFC000 dmload.sys 0xF8551000 dmio.sys 0xF887E000 PartMgr.sys 0xF8616000 VolSnap.sys 0xF8539000 atapi.sys 0xF8626000 disk.sys 0xF8636000 \WINDOWS\System32\DRIVERS\CLASSPNP.SYS 0xF8519000 fltmgr.sys 0xF8507000 sr.sys 0xF8886000 PxHelp20.sys 0xF84F0000 KSecDD.sys 0xF8463000 Ntfs.sys 0xF8451000 fsdfw.sys 0xF8424000 \WINDOWS\System32\drivers\NDIS.SYS 0xF8646000 viaagp.sys 0xF840A000 Mup.sys 0xF8656000 fsbts.sys 0xF7BA7000 \SystemRoot\System32\DRIVERS\p3.sys 0xF7ABA000 \SystemRoot\System32\DRIVERS\ati2mtag.sys 0xF7AA6000 \SystemRoot\System32\DRIVERS\VIDEOPRT.SYS 0xF7B87000 \SystemRoot\System32\DRIVERS\cdrom.sys 0xF8686000 \SystemRoot\System32\DRIVERS\redbook.sys 0xF7A83000 \SystemRoot\System32\DRIVERS\ks.sys 0xF86A6000 \SystemRoot\System32\DRIVERS\imapi.sys 0xF8946000 \SystemRoot\System32\DRIVERS\usbuhci.sys 0xF7A5F000 \SystemRoot\System32\DRIVERS\USBPORT.SYS 0xF7A4A000 \SystemRoot\system32\drivers\ac97via.sys 0xF7A26000 \SystemRoot\system32\drivers\portcls.sys 0xF86C6000 \SystemRoot\system32\drivers\drmk.sys 0xF86E6000 \SystemRoot\System32\DRIVERS\dc21x4.sys 0xF7948000 \SystemRoot\System32\DRIVERS\HCF_MSFT.sys 0xF895E000 \SystemRoot\System32\Drivers\Modem.SYS 0xF896E000 \SystemRoot\System32\DRIVERS\fdc.sys 0xF8716000 \SystemRoot\System32\DRIVERS\serial.sys 0xF8AF2000 \SystemRoot\System32\DRIVERS\serenum.sys 0xF7307000 \SystemRoot\System32\DRIVERS\parport.sys 0xF8726000 \SystemRoot\System32\DRIVERS\i8042prt.sys 0xF83DE000 \SystemRoot\system32\DRIVERS\L8042Kbd.sys 0xF897E000 \SystemRoot\System32\DRIVERS\kbdclass.sys 0xF8BF3000 \SystemRoot\System32\DRIVERS\audstub.sys 0xF8746000 \SystemRoot\System32\DRIVERS\rasl2tp.sys 0xF83DA000 \SystemRoot\System32\DRIVERS\ndistapi.sys 0xF72F0000 \SystemRoot\System32\DRIVERS\ndiswan.sys 0xF8766000 \SystemRoot\System32\DRIVERS\raspppoe.sys 0xF8776000 \SystemRoot\System32\DRIVERS\raspptp.sys 0xF898E000 \SystemRoot\System32\DRIVERS\TDI.SYS 0xF72DF000 \SystemRoot\System32\DRIVERS\psched.sys 0xF8796000 \SystemRoot\System32\DRIVERS\msgpc.sys 0xF899E000 \SystemRoot\System32\DRIVERS\ptilink.sys 0xF89AE000 \SystemRoot\System32\DRIVERS\raspti.sys 0xF7287000 \SystemRoot\System32\DRIVERS\rdpdr.sys 0xF87C6000 \SystemRoot\System32\DRIVERS\termdd.sys 0xF89BE000 \SystemRoot\System32\DRIVERS\mouclass.sys 0xF8B30000 \SystemRoot\System32\DRIVERS\swenum.sys 0xF7229000 \SystemRoot\System32\DRIVERS\update.sys 0xF8A8E000 \SystemRoot\System32\DRIVERS\mssmbios.sys 0xF87F6000 \SystemRoot\System32\Drivers\NDProxy.SYS 0xF8846000 \SystemRoot\System32\DRIVERS\usbhub.sys 0xF8B34000 \SystemRoot\System32\DRIVERS\USBD.SYS 0xF8ABA000 \SystemRoot\System32\DRIVERS\gameenum.sys 0xF89CE000 \SystemRoot\System32\DRIVERS\flpydisk.sys 0xF8B5C000 \SystemRoot\System32\Drivers\Fs_Rec.SYS 0xF7BF7000 \SystemRoot\system32\DRIVERS\DcCam.sys 0xEF0B3000 \SystemRoot\system32\DRIVERS\EXPORTIT.SYS 0xF8C81000 \SystemRoot\System32\Drivers\Null.SYS 0xF8B64000 \SystemRoot\System32\Drivers\Beep.SYS 0xF89EE000 \SystemRoot\System32\drivers\vga.sys 0xF8B6A000 \SystemRoot\System32\Drivers\mnmdd.SYS 0xF8B70000 \SystemRoot\System32\DRIVERS\RDPCDD.sys 0xF89F6000 \SystemRoot\System32\Drivers\Msfs.SYS 0xF889E000 \SystemRoot\System32\Drivers\Npfs.SYS 0xF8ADA000 \SystemRoot\System32\DRIVERS\rasacd.sys 0xEF080000 \SystemRoot\System32\DRIVERS\ipsec.sys 0xEF069000 \SystemRoot\system32\DRIVERS\P0620Vid.sys 0xF7BD7000 \SystemRoot\system32\DRIVERS\STREAM.SYS 0xEF010000 \SystemRoot\System32\DRIVERS\tcpip.sys 0xF88BE000 \SystemRoot\System32\Drivers\LUsbFilt.Sys 0xF8696000 \SystemRoot\System32\Drivers\WDFLDR.SYS 0xEEFE8000 \SystemRoot\System32\DRIVERS\netbt.sys 0xEEF6D000 \SystemRoot\system32\DRIVERS\Wdf01000.sys 0xEEF47000 \SystemRoot\System32\DRIVERS\ipnat.sys 0xF8706000 \SystemRoot\System32\DRIVERS\wanarp.sys 0xEEF25000 \SystemRoot\System32\drivers\afd.sys 0xF8AEE000 \SystemRoot\System32\DRIVERS\hidusb.sys 0xF8756000 \SystemRoot\System32\DRIVERS\HIDCLASS.SYS 0xF88DE000 \SystemRoot\System32\DRIVERS\HIDPARSE.SYS 0xF8786000 \SystemRoot\System32\DRIVERS\netbios.sys 0xEEEFA000 \SystemRoot\System32\DRIVERS\rdbss.sys 0xEEE8A000 \SystemRoot\System32\DRIVERS\mrxsmb.sys 0xF87D6000 \SystemRoot\System32\Drivers\Fips.SYS 0xF87E6000 \??\C:\Program Files\Eastlink Internet Security\HIPS\drivers\fshs.sys 0xEEE3E000 \SystemRoot\System32\Drivers\Fastfat.SYS 0xF88EE000 \SystemRoot\system32\DRIVERS\LHidFilt.Sys 0xF7225000 \SystemRoot\System32\DRIVERS\mouhid.sys 0xF88F6000 \SystemRoot\system32\DRIVERS\LMouFilt.Sys 0xEEE26000 \SystemRoot\System32\Drivers\dump_atapi.sys 0xF8B90000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS 0xBF800000 \SystemRoot\System32\win32k.sys 0xF8AD6000 \SystemRoot\System32\drivers\Dxapi.sys 0xF891E000 \SystemRoot\System32\watchdog.sys 0xBF000000 \SystemRoot\System32\drivers\dxg.sys 0xF8C3E000 \SystemRoot\System32\drivers\dxgthk.sys 0xBF012000 \SystemRoot\System32\ati2dvag.dll 0xBF049000 \SystemRoot\System32\ati2cqag.dll 0xBF083000 \SystemRoot\System32\ati3d1ag.dll 0xBFFA0000 \SystemRoot\System32\ATMFD.DLL 0xF8736000 \SystemRoot\system32\drivers\dcfs2k.sys 0xEEDE6000 \SystemRoot\system32\DRIVERS\fssfltr_tdi.sys 0xEED0E000 \SystemRoot\System32\DRIVERS\ndisuio.sys 0xEE8E9000 \SystemRoot\system32\drivers\wdmaud.sys 0xEEA76000 \SystemRoot\system32\drivers\sysaudio.sys 0xEE7A6000 \SystemRoot\System32\DRIVERS\mrxdav.sys 0xF8B6E000 \SystemRoot\System32\Drivers\ParVdm.SYS 0xEE60E000 \SystemRoot\System32\DRIVERS\srv.sys 0xEE1DC000 \??\C:\Program Files\Eastlink Internet Security\Anti-Virus\minifilter\fsgk.sys 0xEE14B000 \SystemRoot\System32\Drivers\HTTP.sys 0xEE32E000 \??\C:\WINDOWS\System32\Drivers\ESDPDX01.SYS 0xED9A1000 \SystemRoot\system32\drivers\kmixer.sys 0x7C900000 \WINDOWS\system32\ntdll.dll Processes (total 42): 0 System Idle Process 4 System 440 C:\WINDOWS\system32\smss.exe 496 csrss.exe 520 C:\WINDOWS\system32\winlogon.exe 564 C:\WINDOWS\system32\services.exe 576 C:\WINDOWS\system32\lsass.exe 732 C:\WINDOWS\system32\ati2evxx.exe 744 C:\WINDOWS\system32\svchost.exe 800 svchost.exe 868 C:\WINDOWS\system32\svchost.exe 916 svchost.exe 952 svchost.exe 1260 C:\WINDOWS\system32\BRSVC01A.EXE 1280 C:\WINDOWS\system32\spoolsv.exe 1292 C:\WINDOWS\system32\BRSS01A.EXE 1436 C:\WINDOWS\system32\ati2evxx.exe 1504 C:\WINDOWS\explorer.exe 1728 C:\Program Files\Eastlink Internet Security\Common\FSM32.EXE 1736 C:\Program Files\QuickTime\qttask.exe 1804 svchost.exe 1868 C:\Program Files\Eastlink Internet Security\Anti-Virus\fsgk32st.exe 1900 C:\Program Files\Eastlink Internet Security\Common\FSMA32.EXE 1984 C:\Program Files\Eastlink Internet Security\Common\FSHDLL32.EXE 132 C:\Program Files\Java\jre6\bin\jqs.exe 236 C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe 348 C:\WINDOWS\system32\svchost.exe 1080 C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe 2252 fsorsp.exe 2272 C:\Program Files\Eastlink Internet Security\FWES\program\fsdfwd.exe 2656 alg.exe 3356 C:\WINDOWS\system32\wuauclt.exe 2924 C:\Program Files\Internet Explorer\iexplore.exe 3104 C:\Program Files\Internet Explorer\iexplore.exe 2880 C:\Program Files\Internet Explorer\iexplore.exe 1232 C:\Program Files\Internet Explorer\iexplore.exe 3408 C:\Program Files\Eastlink Internet Security\Anti-Virus\fsgk32.exe 3484 C:\Program Files\Eastlink Internet Security\Anti-Virus\fssm32.exe 3596 C:\Program Files\Eastlink Internet Security\Anti-Virus\fsav32.exe 2464 C:\WINDOWS\system32\wuauclt.exe 2920 C:\WINDOWS\system32\wscntfy.exe 3192 C:\Documents and Settings\Robbin\Local Settings\Temporary Internet Files\Content.IE5\XM6ZH4EG\MBRCheck[1].exe \\.\C: –> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS) \\.\D: –> \\.\PhysicalDrive1 at offset 0x00000000`00007e00 (FAT32) PhysicalDrive0 Model Number: WDCWD400JB-00ENA0, Rev: 05.03E05 PhysicalDrive1 Model Number: FUJITSUMPE3084AE, Rev: EE-C0-23 Size Device Name MBR Status ——————————————– 37 GB \\.\PhysicalDrive0 Windows XP MBR code detected SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A 7 GB \\.\PhysicalDrive1 Unknown MBR code SHA1: A34BDE97CAD677E44DCB5C5873475582450A84F8 Found non-standard or infected MBR. Enter 'Y' and hit ENTER for more options, or 'N' to exit: Done!
Post #13
You posted the original file, I need to see the dump file so I can send it to be analyzed. Follow the directions in my post and attach it please
Post #14
3ÀŽÐ¼ |ûPPü¾|¿PW¹åó¤Ë½¾±8n | uƒÅâôÍ‹õƒÆIt8,tö µ´‹ð¬< tü» ´ÍëòˆNèF s*þF€~ t €~ t ¶uÒ€FƒFƒV è! s ¶뼁>þ}Uªt €~ tÈ ·ë©‹üW‹õË¿ ŠV ´Ír#ŠÁ$?˜ŠÞŠüC÷ã‹Ñ†Ö±ÒîB÷â9V w#r9Fs¸» |‹N‹V ÍsQOtN2äŠV ÍëäŠV `»ªU´AÍr6ûUªu0öÁt+a`j j ÿv ÿvj h |jj´B‹ôÍaasOt 2äŠV ÍëÖaùÃInvalid partition table Error loading operating system Missing operating system

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI