What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

progroup.prorat?

22 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hello, thanks for looking at my post.
A recent spybotsd scan found progroup.prorat on my computer. I checked the box to fix it and, upon scanning again, the result was all clear. I googled prorat and read a couple of things that make me worry as I spend a lot of time playing browser games at a particular website community where my lack of experience can sometimes be an issue. Over a period of months there have been a lot of little things…like sudden periods of really high cpu usage, once or twice there was suddenly way too many instances of svhost listed in process explorer but, I don't know enough to be able to identify what the hell was happening… now and then, out of the blue while performing tasks that I regularly do, I get an error message saying that I don't have the required permission. More recently, while online, my computer will simply lock up, from time to time - everything freezes and I can't even make task manager open so, I have to reboot without closing everything, first.
I have included a hjt log below and, because I mentioned it, I added the spybotsd log as an attachment in case you needed to see that, too. I hope that was okay to do.
I already mentioned my lack of experience, I'm going to try very hard not to be a pain in the rear.
Thanks again.

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 9:01:31 AM, on 12/4/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Tall Emu\Online Armor\OAcat.exe
C:\Program Files\Tall Emu\Online Armor\oasrv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Tall Emu\Online Armor\oaui.exe
C:\Program Files\Tall Emu\Online Armor\OAhlp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [@OnlineArmor GUI] "C:\Program Files\Tall Emu\Online Armor\oaui.exe"
O15 - Trusted Zone: http://www.eset.com.au
O15 - Trusted Zone: http://explore.live.com
O15 - Trusted Zone: *.mozilla.com
O15 - Trusted Zone: http://download.windowsupdate.com
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1278136636609
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1278138757015
O17 - HKLM\System\CCS\Services\Tcpip\..\{6741A7CF-2875-4B6A-AEE5-EC2D660FC59F}: NameServer = 202.124.65.22 202.124.65.18
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Online Armor Helper Service (OAcat) - Unknown owner - C:\Program Files\Tall Emu\Online Armor\OAcat.exe
O23 - Service: Online Armor (SvcOnlineArmor) - Unknown owner - C:\Program Files\Tall Emu\Online Armor\oasrv.exe

–
End of file - 3043 bytes

Attachments:

Post #2
Hello there, winona

:welcome:

I'm Conspire, I'll be glad to help you with your computer problems.

Please observe these rules while we work:
  • Read the entire procedure
  • It is important to perform ALL actions in sequence.
  • If you don't know, stop and ask! Don't keep going on.
  • Please reply to this thread. Do not start a new topic.
  • Stick with me till you're given the all clear.
  • Remember, absence of symptoms does not mean the infection is all gone.
  • Don't attempt to clean your computer with any tools other than the ones I ask you to use during the cleanup process.
Please be advised, as I am still in training, all my replies to you will be checked for accuracy by one of our experts to ensure that I am giving you the best possible advise.
This may cause a delay, but I will do my best to keep it as short as possible.

Please bear with me, I will post back to you as soon as I can.

IMPORTANT NOTE : Please do not delete anything unless instructed to.

**In any case where you happen to be busy or unable to give us a reply, we would be more than grateful if you keep us informed in advance and we will be more than happy to wait. Failure to do so we will have your thread closed in THREE(3) days. :)
Post #3
Hello there,

Download OTL to your Desktop
  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • Click on Minimal Output at the top
  • Download the following file scan.txt to your Desktop. Click here to download it. You may need to right click on it and select "Save"
  • Double click inside the Custom Scan box at the bottom
  • A window will appear saying "Click OK to load a custom scan from a file or Cancel to cancel"
  • Click the OK button and navigate to the file scan.txt which we just saved to your desktop
  • Select scan.txt and click Open. Writing will now appear under the Custom Scan box
  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan won't take long.
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time and post them in your topic
===================================================

[external image: Posted Image]
  • Please download GMER from one of the following locations, and save it to your desktop:
  • Main Mirror
    This version will download a randomly named file (Recommended)
  • Zip Mirror
    This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.
  • Extract the contents of the zipped file to desktop (applicable only to Zip mirror) .
  • Double click [external image: Posted Image] or [external image: Posted Image] on your desktop.
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.
    [external image: Posted Image]

    [external image: Posted Image]
    Click the image to enlarge it
  • In the right panel, you will see several boxes that have been checked. Uncheck the following …
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and attach it in your reply.
**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

===================================================

Download Security Check by screen317 from here or here.
  • Save it to your Desktop.
  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt; please post the contents of that document.
===================================================

On your next reply please post :
OTL log
GMER log
Checkup log

Good Day!
Post #4
Hey and thanks so much for your time and patience :) When I click to get the scan.txt for OTL, I get a Geeks to Go forum index…? I'll leave out the OTL until I hear back from you and sort the other two, right now. winona
Post #5
gmer:

GMER 1.0.15.15530 - http://www.gmer.net
Rootkit scan 2010-12-06 19:51:19
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP3T0L0-7 WDC_WD2000JS-55NCB1 rev.10.02E01
Running: nhhq04uw.exe; Driver: C:\DOCUME~1\peta\LOCALS~1\Temp\awndifow.sys


—- System - GMER 1.0.15 —-

SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwAllocateVirtualMemory [0xF6B823E0]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwAssignProcessToJobObject [0xF6B82C10]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwConnectPort [0xF6B80300]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwCreateFile [0xF6B8FDD0]
SSDT F8B88896 ZwCreateKey
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwCreatePort [0xF6B7FE40]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwCreateProcess [0xF6B7CB80]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwCreateProcessEx [0xF6B7CF90]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwCreateSection [0xF6B7C440]
SSDT F8B8888C ZwCreateThread
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwDebugActiveProcess [0xF6B7F0F0]
SSDT F8B8889B ZwDeleteKey
SSDT F8B888A5 ZwDeleteValueKey
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwDuplicateObject [0xF6B7FC50]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwLoadDriver [0xF6B81A00]
SSDT F8B888AA ZwLoadKey
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwOpenFile [0xF6B90450]
SSDT F8B88878 ZwOpenProcess
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwOpenSection [0xF6B7C860]
SSDT F8B8887D ZwOpenThread
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwProtectVirtualMemory [0xF6B82860]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwQueryDirectoryFile [0xF6B81F80]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwQueueApcThread [0xF6B82DB0]
SSDT F8B888B4 ZwReplaceKey
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwRequestPort [0xF6B80F00]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwRequestWaitReplyPort [0xF6B81500]
SSDT F8B888AF ZwRestoreKey
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwResumeThread [0xF6B7F8A0]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwSecureConnectPort [0xF6B806F0]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwSetContextThread [0xF6B7EED0]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwSetSystemInformation [0xF6B7F290]
SSDT F8B888A0 ZwSetValueKey
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwShutdownSystem [0xF6B818E0]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwSuspendProcess [0xF6B7FA80]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwSuspendThread [0xF6B7F690]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwSystemDebugControl [0xF6B7F4A0]
SSDT F8B88887 ZwTerminateProcess
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwTerminateThread [0xF6B7ECC0]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwUnloadDriver [0xF6B81D10]
SSDT \??\C:\WINDOWS\system32\drivers\OADriver.sys (OA Helper Driver/Tall Emu) ZwWriteVirtualMemory [0xF6B82A30]

—- Kernel code sections - GMER 1.0.15 —-

.text ntoskrnl.exe!ZwYieldExecution + 12E 804E4988 12 Bytes [40, FE, B7, F6, 80, CB, B7, …]
.text ntoskrnl.exe!ZwYieldExecution + 46A 804E4CC4 12 Bytes [80, FA, B7, F6, 90, F6, B7, …] {CMP DL, 0xb7; NOT BYTE [EAX-0x5f09480a]; HLT ; MOV BH, 0xf6}
init C:\WINDOWS\system32\drivers\senfilt.sys entry point in "init" section [0xF7FEFF80]

—- User code sections - GMER 1.0.15 —-

.text C:\Program Files\Avira\AntiVir Desktop\avgnt.exe[152] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 00D10001
.text C:\Program Files\Avira\AntiVir Desktop\avgnt.exe[152] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\Avira\AntiVir Desktop\avgnt.exe[152] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 5F040F5A
.text C:\Program Files\Avira\AntiVir Desktop\avgnt.exe[152] kernel32.dll!FreeLibrary + 15 7C80AC93 4 Bytes CALL 71B0003D
.text C:\Program Files\Avira\AntiVir Desktop\avgnt.exe[152] USER32.dll!ExitWindowsEx 7E45A275 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\Avira\AntiVir Desktop\avgnt.exe[152] ADVAPI32.dll!CreateServiceA 77E37211 6 Bytes JMP 5F130F5A
.text C:\Program Files\Avira\AntiVir Desktop\avgnt.exe[152] ADVAPI32.dll!CreateServiceW 77E373A9 6 Bytes JMP 5F160F5A
.text C:\Program Files\Avira\AntiVir Desktop\avgnt.exe[152] IPHLPAPI.DLL!IcmpSendEcho2 76D6B73C 6 Bytes JMP 5F100F5A
.text C:\Program Files\Tall Emu\Online Armor\oaui.exe[188] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 015D0001
.text C:\Program Files\Tall Emu\Online Armor\oaui.exe[188] kernel32.dll!FreeLibrary + 15 7C80AC93 4 Bytes CALL 71B0003D
.text C:\Program Files\Tall Emu\Online Armor\oaui.exe[188] user32.dll!LoadStringW 7E419E36 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\Tall Emu\Online Armor\oaui.exe[188] user32.dll!LoadStringA 7E42C908 6 Bytes JMP 5F040F5A
.text C:\Program Files\Tall Emu\Online Armor\OAhlp.exe[316] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 01260001
.text C:\Program Files\Tall Emu\Online Armor\OAhlp.exe[316] kernel32.dll!FreeLibrary + 15 7C80AC93 4 Bytes CALL 71B0003D
.text C:\Program Files\Tall Emu\Online Armor\OAhlp.exe[316] user32.dll!LoadStringW 7E419E36 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\Tall Emu\Online Armor\OAhlp.exe[316] user32.dll!LoadStringA 7E42C908 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\system32\csrss.exe[344] KERNEL32.dll!FreeLibrary + 15 7C80AC93 4 Bytes CALL 71AF003D
.text C:\WINDOWS\system32\winlogon.exe[368] kernel32.dll!FreeLibrary + 15 7C80AC93 4 Bytes CALL 71AF003D
.text C:\WINDOWS\system32\services.exe[412] kernel32.dll!FreeLibrary + 15 7C80AC93 4 Bytes CALL 71AF003D
.text C:\WINDOWS\system32\lsass.exe[424] kernel32.dll!FreeLibrary + 15 7C80AC93 4 Bytes CALL 71AF003D
.text C:\WINDOWS\system32\svchost.exe[612] kernel32.dll!FreeLibrary + 15 7C80AC93 4 Bytes CALL 71AF003D
.text …
.text C:\Program Files\Tall Emu\Online Armor\oasrv.exe[880] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 00DD0001
.text C:\Program Files\Tall Emu\Online Armor\oasrv.exe[880] user32.dll!LoadStringW 7E419E36 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\Tall Emu\Online Armor\oasrv.exe[880] user32.dll!LoadStringA 7E42C908 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\Explorer.EXE[1064] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 01E00001
.text C:\WINDOWS\Explorer.EXE[1064] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 5F0A0F5A
.text C:\WINDOWS\Explorer.EXE[1064] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 5F040F5A
.text C:\WINDOWS\Explorer.EXE[1064] kernel32.dll!FreeLibrary + 15 7C80AC93 4 Bytes CALL 71AF003D
.text C:\WINDOWS\Explorer.EXE[1064] ADVAPI32.dll!CreateServiceA 77E37211 6 Bytes JMP 5F130F5A
.text C:\WINDOWS\Explorer.EXE[1064] ADVAPI32.dll!CreateServiceW 77E373A9 6 Bytes JMP 5F160F5A
.text C:\WINDOWS\Explorer.EXE[1064] USER32.dll!ExitWindowsEx 7E45A275 6 Bytes JMP 5F0D0F5A
.text C:\WINDOWS\Explorer.EXE[1064] IPHLPAPI.DLL!IcmpSendEcho2 76D6B73C 6 Bytes JMP 5F100F5A
.text C:\Documents and Settings\peta\My Documents\Downloads\OTL.exe[2012] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 00E60001
.text C:\Documents and Settings\peta\My Documents\Downloads\OTL.exe[2012] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 5F0A0F5A
.text C:\Documents and Settings\peta\My Documents\Downloads\OTL.exe[2012] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 5F040F5A
.text C:\Documents and Settings\peta\My Documents\Downloads\OTL.exe[2012] kernel32.dll!FreeLibrary + 15 7C80AC93 4 Bytes CALL 71B0003D
.text C:\Documents and Settings\peta\My Documents\Downloads\OTL.exe[2012] user32.dll!ExitWindowsEx 7E45A275 6 Bytes JMP 5F0D0F5A
.text C:\Documents and Settings\peta\My Documents\Downloads\OTL.exe[2012] advapi32.dll!CreateServiceA 77E37211 6 Bytes JMP 5F130F5A
.text C:\Documents and Settings\peta\My Documents\Downloads\OTL.exe[2012] advapi32.dll!CreateServiceW 77E373A9 6 Bytes JMP 5F160F5A
.text C:\Documents and Settings\peta\My Documents\Downloads\OTL.exe[2012] IPHLPAPI.DLL!IcmpSendEcho2 76D6B73C 6 Bytes JMP 5F100F5A
.text C:\Program Files\Mozilla Firefox\firefox.exe[3152] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 004013F0 C:\Program Files\Mozilla Firefox\firefox.exe (Firefox/Mozilla Corporation)
.text C:\Program Files\Mozilla Firefox\firefox.exe[3152] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 011E0001
.text C:\Program Files\Mozilla Firefox\firefox.exe[3152] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\Mozilla Firefox\firefox.exe[3152] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 5F040F5A
.text C:\Program Files\Mozilla Firefox\firefox.exe[3152] kernel32.dll!FreeLibrary + 15 7C80AC93 4 Bytes CALL 71B0003D
.text C:\Program Files\Mozilla Firefox\firefox.exe[3152] ADVAPI32.dll!CreateServiceA 77E37211 6 Bytes JMP 5F130F5A
.text C:\Program Files\Mozilla Firefox\firefox.exe[3152] ADVAPI32.dll!CreateServiceW 77E373A9 6 Bytes JMP 5F160F5A
.text C:\Program Files\Mozilla Firefox\firefox.exe[3152] USER32.dll!ExitWindowsEx 7E45A275 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\Mozilla Firefox\firefox.exe[3152] IPHLPAPI.DLL!IcmpSendEcho2 76D6B73C 6 Bytes JMP 5F100F5A
.text C:\Documents and Settings\peta\Desktop\nhhq04uw.exe[3832] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 00D00001
.text C:\Documents and Settings\peta\Desktop\nhhq04uw.exe[3832] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 5F0A0F5A
.text C:\Documents and Settings\peta\Desktop\nhhq04uw.exe[3832] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 5F040F5A
.text C:\Documents and Settings\peta\Desktop\nhhq04uw.exe[3832] kernel32.dll!FreeLibrary + 15 7C80AC93 4 Bytes CALL 71B0003D
.text C:\Documents and Settings\peta\Desktop\nhhq04uw.exe[3832] user32.dll!ExitWindowsEx 7E45A275 6 Bytes JMP 5F0D0F5A
.text C:\Documents and Settings\peta\Desktop\nhhq04uw.exe[3832] advapi32.dll!CreateServiceA 77E37211 6 Bytes JMP 5F130F5A
.text C:\Documents and Settings\peta\Desktop\nhhq04uw.exe[3832] advapi32.dll!CreateServiceW 77E373A9 6 Bytes JMP 5F160F5A
.text C:\Documents and Settings\peta\Desktop\nhhq04uw.exe[3832] IPHLPAPI.DLL!IcmpSendEcho2 76D6B73C 6 Bytes JMP 5F100F5A

—- Devices - GMER 1.0.15 —-

Device \Driver\Tcpip \Device\Ip OAmon.sys (TDI Helper Driver/Tall Emu)
Device \Driver\Tcpip \Device\Tcp OAmon.sys (TDI Helper Driver/Tall Emu)
Device \Driver\Tcpip \Device\Udp OAmon.sys (TDI Helper Driver/Tall Emu)
Device \Driver\Tcpip \Device\RawIp OAmon.sys (TDI Helper Driver/Tall Emu)
Device \Driver\Tcpip \Device\IPMULTICAST OAmon.sys (TDI Helper Driver/Tall Emu)

—- EOF - GMER 1.0.15 —-



Security Check (checkup.txt):

Results of screen317's Security Check version 0.99.6
Windows XP Service Pack 3
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:
Windows Security Center service is not running! This report may not be accurate!
Avira AntiVir Personal - Free Antivirus
Online Armor 4.0
Avira successfully updated!
```````````````````````````````
Anti-malware/Other Utilities Check:
MVPS Hosts File
Malwarebytes' Anti-Malware
CCleaner
Java™ 6 Update 21
Out of date Java installed!
Adobe Flash Player 10.1.102.64
Mozilla Firefox (3.6.10) Firefox Out of Date!
````````````````````````````````
Process Check:
objlist.exe by Laurent
Avira Antivir avgnt.exe
Avira Antivir avguard.exe
Tall Emu Online Armor OAcat.exe
Tall Emu Online Armor oasrv.exe
Tall Emu Online Armor oaui.exe
Tall Emu Online Armor OAhlp.exe
````````````````````````````````
DNS Vulnerability Check:
GREAT! (Not vulnerable to DNS cache poisoning)

``````````End of Log````````````


When I hear from you about the OTL scan.txt, I will follow with the result.
winona
Post #7
I sorted it. Sorry about that. Here is the result from OTL:

OTL logfile created on: 12/6/2010 9:05:31 PM - Run 1
OTL by OldTimer - Version 3.2.17.3 Folder = C:\Documents and Settings\peta\Desktop\what the tech
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

511.00 Mb Total Physical Memory | 353.00 Mb Available Physical Memory | 69.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 75.00% Paging File free
Paging file location(s): c:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 186.30 Gb Total Space | 175.81 Gb Free Space | 94.37% Space Free | Partition Type: NTFS
Drive H: | 43.48 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: N-0741399D962E4 | User Name: peta | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\peta\desktop\what the tech\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Tall Emu\Online Armor\oahlp.exe (Tall Emu)
PRC - C:\Program Files\Tall Emu\Online Armor\oaui.exe (Tall Emu)
PRC - C:\Program Files\Tall Emu\Online Armor\oasrv.exe (Tall Emu)
PRC - C:\Program Files\Tall Emu\Online Armor\oacat.exe (Tall Emu)
PRC - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\peta\desktop\what the tech\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)
MOD - C:\Program Files\Tall Emu\Online Armor\oawatch.dll (Tall Emu)
MOD - C:\WINDOWS\system32\wsock32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\wtsapi32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\winsta.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\iphlpapi.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (WMPNetworkSvc) – File not found
SRV - (ose) – C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE File not found
SRV - (odserv) – C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE File not found
SRV - (HidServ) – C:\WINDOWS\System32\hidserv.dll File not found
SRV - (AppMgmt) – C:\WINDOWS\System32\appmgmts.dll File not found
SRV - (VmbService) – C:\Program Files\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe (Vodafone)
SRV - (SvcOnlineArmor) – C:\Program Files\Tall Emu\Online Armor\oasrv.exe (Tall Emu)
SRV - (OAcat) – C:\Program Files\Tall Emu\Online Armor\OAcat.exe (Tall Emu)
SRV - (AntiVirService) – C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AntiVirSchedulerService) – C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (YahooAUService) – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
SRV - (SoundMAX Agent Service (default)) – C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe (Analog Devices, Inc.)


========== Driver Services (SafeList) ==========

DRV - (massfilter) – C:\WINDOWS\system32\drivers\massfilter.sys (MBB Incorporated)
DRV - (ZTEusbnet) – C:\WINDOWS\system32\drivers\ZTEusbnet.sys (ZTE Corporation)
DRV - (ZTEusbvoice) – C:\WINDOWS\system32\drivers\zteusbvoice.sys (ZTE Incorporated)
DRV - (ZTEusbser6k) – C:\WINDOWS\system32\drivers\ZTEusbser6k.sys (ZTE Incorporated)
DRV - (ZTEusbnmea) – C:\WINDOWS\system32\drivers\ZTEusbnmea.sys (ZTE Incorporated)
DRV - (ZTEusbmdm6k) – C:\WINDOWS\system32\drivers\ZTEusbmdm6k.sys (ZTE Incorporated)
DRV - (OAmon) – C:\WINDOWS\system32\drivers\OAmon.sys (Tall Emu)
DRV - (OAnet) – C:\WINDOWS\system32\drivers\OAnet.sys (Tall Emu Pty Ltd)
DRV - (OADevice) – C:\WINDOWS\system32\drivers\OADriver.sys (Tall Emu)
DRV - (vodafone_K3805-z_dc_enum) – C:\WINDOWS\system32\drivers\vodafone_K3805-z_dc_enum.sys (Vodafone)
DRV - (avipbb) – C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH)
DRV - (SASDIFSV) – C:\Program Files\SUPERAntiSpyware\sasdifsv.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (avgntflt) – C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH)
DRV - (pavboot) – C:\WINDOWS\system32\drivers\pavboot.sys (Panda Security, S.L.)
DRV - (avgio) – C:\Program Files\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (ssmdrv) – C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (usbaudio) USB Audio Driver (WDM) – C:\WINDOWS\system32\drivers\USBAUDIO.sys (Microsoft Corporation)
DRV - (BANTExt) – C:\WINDOWS\System32\Drivers\BANTExt.sys ()
DRV - (k750obex) – C:\WINDOWS\system32\drivers\k750obex.sys (MCCI)
DRV - (k750mgmt) – C:\WINDOWS\system32\drivers\k750mgmt.sys (MCCI)
DRV - (k750mdm) – C:\WINDOWS\system32\drivers\k750mdm.sys (MCCI)
DRV - (k750mdfl) – C:\WINDOWS\system32\drivers\k750mdfl.sys (MCCI)
DRV - (k750bus) Sony Ericsson 750 driver (WDM) – C:\WINDOWS\system32\drivers\k750bus.sys (MCCI)
DRV - (sf) – C:\WINDOWS\system32\drivers\sf.sys (Sonic Focus, Inc)
DRV - (nv) – C:\WINDOWS\system32\drivers\nv4_mini.sys (NVIDIA Corporation)
DRV - (senfilt) – C:\WINDOWS\system32\drivers\senfilt.sys (Sensaura)
DRV - (ovt519) – C:\WINDOWS\system32\drivers\ov519vid.sys (OmniVision Technologies, Inc.)
DRV - (MidiSyn) – C:\WINDOWS\system32\drivers\MidiSyn.sys (Analog Devices Inc)
DRV - (Edspport) – C:\WINDOWS\system32\drivers\es56hpi.sys (ESS Technology, Inc.)
DRV - (ac97intc) Intel® 82801 Audio Driver Install Service (WDM) – C:\WINDOWS\system32\drivers\ac97intc.sys (Intel Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://home.microsoft.com/search/search.asp

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://home.microsoft.com/search/search.asp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = [Binary data over 100 bytes]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.update: false
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.kongregate.com/games/caesary/caesary"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: [removed]:1.0.4
FF - prefs.js..extensions.enabledItems: {5C655500-E712-41e7-9349-CE462F844B19}:0.4.5
FF - prefs.js..extensions.enabledItems: {71328583-3CA7-4809-B4BA-570A85818FBB}:0.6.3
FF - prefs.js..extensions.enabledItems: {73a6fe31-595d-460b-a920-fcc0f8843232}:2.0.1
FF - prefs.js..extensions.enabledItems: {9669CC8F-B388-42FE-86F4-CB5E7F5A8BDC}:6.0.4
FF - prefs.js..extensions.enabledItems: {dd3d7613-0246-469d-bc65-2a3cc1668adc}:0.7.1.1
FF - prefs.js..extensions.enabledItems: {E2883E8F-472F-4fb0-9522-AC9BF37916A7}:[removed]
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.8.20100408.6
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.2.2
FF - prefs.js..extensions.enabledItems: {1ebc69c0-92ff-11dc-8314-0800200c9a66}:[removed]
FF - prefs.js..extensions.enabledItems: {29852C08-1E91-4889-A6BF-C77F91D6A8F3}:1.8.63
FF - prefs.js..network.proxy.type: 4

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/11/23 07:43:01 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/09/30 03:09:03 | 000,000,000 | —D | M]

[2010/07/03 13:51:12 | 000,000,000 | —D | M] – C:\Documents and Settings\peta\Application Data\Mozilla\Extensions
[2010/11/21 18:52:35 | 000,000,000 | —D | M] – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions
[2010/08/22 08:05:15 | 000,000,000 | —D | M] (Screengrab) – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\{02450954-cdd9-410f-b1da-db804e18c671}(2)
[2010/09/13 13:01:20 | 000,000,000 | —D | M] (IE Tab 2 (FF 3.6+)) – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\{1BC9BA34-1EED-42ca-A505-6D2F1A935BBB}
[2010/08/28 17:38:30 | 000,000,000 | —D | M] (Gnome Classic) – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\{1ebc69c0-92ff-11dc-8314-0800200c9a66}
[2010/08/28 17:57:30 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\{29852C08-1E91-4889-A6BF-C77F91D6A8F3}
[2010/07/18 10:37:30 | 000,000,000 | —D | M] (Quick Translator) – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\{5C655500-E712-41e7-9349-CE462F844B19}
[2010/09/10 20:00:27 | 000,000,000 | —D | M] (Speed Dial) – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\{64161300-e22b-11db-8314-0800200c9a66}
[2010/08/14 15:08:00 | 000,000,000 | —D | M] (CacheViewer) – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\{71328583-3CA7-4809-B4BA-570A85818FBB}
[2010/08/14 15:08:03 | 000,000,000 | —D | M] (NoScript) – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}
[2010/08/22 08:04:43 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\{75623d5d-4683-402a-b610-ac4bab767c86}
[2010/08/22 08:04:43 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\{8965bb4b-c2ca-2b84-6b49-7afb2760518c}
[2010/08/22 08:04:44 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\{8F6A6FD9-0619-459f-B9D0-81DE065D4E21}
[2010/09/10 19:45:17 | 000,000,000 | —D | M] (MR Tech Toolkit) – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\{9669CC8F-B388-42FE-86F4-CB5E7F5A8BDC}
[2010/09/18 02:13:26 | 000,000,000 | —D | M] (Adblock Plus) – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010/08/22 08:04:43 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\{d8b271a6-6ed3-427d-b600-1b674e00e6ec}
[2010/08/31 13:55:29 | 000,000,000 | —D | M] (BlockSite) – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\{dd3d7613-0246-469d-bc65-2a3cc1668adc}
[2010/09/04 13:24:23 | 000,000,000 | —D | M] (Adobe DLM (powered by getPlus®)) – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
[2010/08/08 20:47:28 | 000,000,000 | —D | M] (Greasemonkey) – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2010/08/22 08:04:42 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\{ef62e1ce-d2a4-4cdd-b7ec-92b120366b66}
[2010/08/22 08:04:42 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\{FDD8ECF0-451A-414D-8C8F-7B7F78B0ECD3}
[2010/08/22 08:05:12 | 000,000,000 | —D | M] – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\bizdom@wizbites(2).com
[2010/08/07 15:36:46 | 000,000,000 | —D | M] – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\[removed]
[2010/09/13 13:01:22 | 000,000,000 | —D | M] – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\[removed]
[2010/08/22 08:04:43 | 000,000,000 | —D | M] – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\[removed]
[2010/09/07 18:55:20 | 000,000,000 | —D | M] – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\PlacesCleaner@sto(2).tw
[2010/08/22 08:05:15 | 000,000,000 | —D | M] – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\VacuumPlacesImproved@lultimouomo-gmail(2).com
[2010/08/08 22:18:30 | 000,002,377 | —- | M] () – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\searchplugins\kongregate.xml
[2010/11/21 18:52:35 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2010/09/07 19:40:51 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/07/03 13:41:41 | 000,411,368 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll

O1 HOSTS File: ([2010/12/03 01:05:48 | 000,426,615 | R— | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 127.0.0.1 1-domains-registrations.com
O1 - Hosts: 127.0.0.1 www.1-domains-registrations.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 14693 more lines…
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O4 - HKLM..\Run: [@OnlineArmor GUI] C:\Program Files\Tall Emu\Online Armor\oaui.exe (Tall Emu)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O15 - HKCU\..Trusted Domains: eset.com.au ([www] http in Trusted sites)
O15 - HKCU\..Trusted Domains: live.com ([explore] http in Trusted sites)
O15 - HKCU\..Trusted Domains: microsoft.com ([*.update] http in Trusted sites)
O15 - HKCU\..Trusted Domains: microsoft.com ([*.update] https in Trusted sites)
O15 - HKCU\..Trusted Domains: microsoft.com ([go] http in Trusted sites)
O15 - HKCU\..Trusted Domains: microsoft.com ([update] http in Trusted sites)
O15 - HKCU\..Trusted Domains: microsoft.com ([update] https in Trusted sites)
O15 - HKCU\..Trusted Domains: mozilla.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: windowsupdate.com ([download] http in Trusted sites)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/…b?1278136636609 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/microsoftu…b?1278138757015 (MUWebControl Class)
O18 - Protocol\Handler\belarc {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files\Belarc\Advisor\System\BAVoilaX.dll (Belarc, Inc.)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - Reg Error: Key error. File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - CLSID or File not found.
O24 - Desktop WallPaper: C:\Documents and Settings\peta\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\peta\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {4F07DA45-8170-4859-9B5F-037EF2970034} - C:\Program Files\Tall Emu\Online Armor\oaevent.dll (Tall Emu)
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/07/03 06:04:52 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2010/06/26 01:16:32 | 000,000,118 | R— | M] () - H:\autorun.inf – [ CDFS ]
O33 - MountPoints2\{cb628957-e9ee-11df-b52b-ff2579a219ff}\Shell - "" = AutoRun
O33 - MountPoints2\{cb628957-e9ee-11df-b52b-ff2579a219ff}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{cb628957-e9ee-11df-b52b-ff2579a219ff}\Shell\AutoRun\command - "" = F:\setup_vmb_lite.exe – File not found
O33 - MountPoints2\{cb62895c-e9ee-11df-b52b-e753b9f80bbb}\Shell - "" = AutoRun
O33 - MountPoints2\{cb62895c-e9ee-11df-b52b-e753b9f80bbb}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{cb62895c-e9ee-11df-b52b-e753b9f80bbb}\Shell\AutoRun\command - "" = H:\setup_vmb_lite.exe – [2010/06/24 21:02:49 | 000,274,432 | R— | M] (Vodafone)
O33 - MountPoints2\F\Shell - "" = AutoRun
O33 - MountPoints2\F\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\setup_vmb_lite.exe – File not found
O33 - MountPoints2\H\Shell - "" = AutoRun
O33 - MountPoints2\H\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\H\Shell\AutoRun\command - "" = H:\setup_vmb_lite.exe – [2010/06/24 21:02:49 | 000,274,432 | R— | M] (Vodafone)
O34 - HKLM BootExecute: (��콈ʫ뱝粑) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - C:\WINDOWS\System32\appmgmts.dll File not found
NetSvcs: HidServ - C:\WINDOWS\System32\hidserv.dll File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)

MsConfig - Services: "VmbService"
MsConfig - Services: "SoundMAX Agent Service (default)"
MsConfig - Services: "JavaQuickStarterService"
MsConfig - Services: "AntiVirService"
MsConfig - Services: "AntiVirSchedulerService"
MsConfig - StartUpReg: MobileBroadband - hkey= - key= - C:\Program Files\Vodafone\Vodafone Mobile Broadband\Bin\MobileBroadband.exe (Vodafone)
MsConfig - StartUpReg: MPlayer2_FixUp - hkey= - key= - C:\WINDOWS\inf\unregmp2.exe (Microsoft Corporation)
MsConfig - State: "system.ini" - 0
MsConfig - State: "win.ini" - 0
MsConfig - State: "bootini" - 0
MsConfig - State: "services" - 1
MsConfig - State: "startup" - 0

SafeBootMin: AppMgmt - C:\WINDOWS\System32\appmgmts.dll File not found
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: sermouse.sys - Driver
SafeBootMin: sr.sys - FSFilter System Recovery
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vds - Service
SafeBootMin: vga.sys - Driver
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: AppMgmt - C:\WINDOWS\System32\appmgmts.dll File not found
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: hitmanpro35 - Reg Error: Value error.
SafeBootNet: hitmanpro35.sys - Reg Error: Value error.
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: sermouse.sys - Driver
SafeBootNet: sr.sys - FSFilter System Recovery
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vga.sys - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vector Graphics Rendering (VML)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML Data Binding for Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Advanced Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - MailNews
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5056b317-8d4c-43ee-8543-b9d1e234b8f4} - Security Update for Windows XP (KB923789)
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - Messenger
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework
ActiveX: {73fa19d0-2d75-11d2-995d-00c04f98bbc9} - Web Folders
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Task Scheduler
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Shockwave Flash
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - Reg Error: Value error.
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {EF289A85-8E57-408d-BE47-73B55609861A} - RootsUpdate
ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

========== Files/Folders - Created Within 30 Days ==========

[2010/12/06 20:02:09 | 000,000,000 | —D | C] – C:\Documents and Settings\peta\Desktop\what the tech
[2010/12/05 20:25:15 | 000,000,000 | RH-D | C] – C:\Documents and Settings\peta\Recent
[2010/12/04 09:00:17 | 000,000,000 | —D | C] – C:\Program Files\Trend Micro
[2010/12/03 00:47:06 | 000,000,000 | —D | C] – C:\Program Files\Spybot - Search & Destroy
[2010/12/03 00:47:06 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
[2010/11/23 16:29:08 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Help
[2010/11/23 16:29:08 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Application Data\Help
[2010/11/23 16:16:38 | 000,000,000 | —D | C] – C:\Documents and Settings\peta\Local Settings\Application Data\Identities
[2010/11/23 13:36:44 | 000,201,216 | —- | C] (Lexmark International, Inc.) – C:\WINDOWS\System32\LEXP2P32.DLL
[2010/11/23 13:36:43 | 000,196,096 | —- | C] (Lexmark International, Inc.) – C:\WINDOWS\System32\LEX2KUSB.DLL
[2010/11/23 13:36:43 | 000,147,456 | —- | C] (Lexmark International, Inc.) – C:\WINDOWS\System32\LEXBCE.DLL
[2010/11/23 13:36:38 | 000,192,512 | —- | C] (Lexmark International, Inc.) – C:\WINDOWS\System32\LEXLMPM.DLL
[2010/11/23 13:36:25 | 000,015,104 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\usbscan.sys
[2010/11/23 13:36:21 | 000,087,040 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wiafbdrv.dll
[2010/11/23 13:36:21 | 000,087,040 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wiafbdrv.dll
[2010/11/23 13:35:31 | 000,025,856 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\usbprint.sys
[2010/11/23 13:31:05 | 000,299,520 | —- | C] (InstallShield Corporation, Inc.) – C:\WINDOWS\uninst.exe
[2010/11/23 13:31:00 | 000,000,000 | —D | C] – C:\Documents and Settings\peta\WINDOWS
[2010/11/23 12:51:53 | 000,000,000 | —D | C] – C:\Documents and Settings\peta\Local Settings\Application Data\ApplicationHistory
[2010/11/22 22:06:55 | 000,014,640 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\spmsg.dll
[2010/11/22 22:06:07 | 000,000,000 | —D | C] – C:\Program Files\Windows Media Connect 2
[2010/11/22 22:02:55 | 000,000,000 | —D | C] – C:\WINDOWS\System32\drivers\UMDF
[2010/11/22 22:02:55 | 000,000,000 | —D | C] – C:\WINDOWS\System32\LogFiles
[2010/11/21 21:29:59 | 000,000,000 | —D | C] – C:\WINDOWS\.jagex_cache_32
[2010/11/11 17:52:04 | 000,000,000 | —D | C] – C:\WINDOWS\RegisteredPackages
[2010/11/11 17:51:05 | 002,388,176 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx9_30.dll
[2010/11/11 17:51:03 | 002,323,664 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx9_28.dll
[2010/11/10 16:30:08 | 000,000,000 | —D | C] – C:\Documents and Settings\peta\Application Data\FLEXnet
[2010/11/10 14:08:18 | 000,009,216 | R— | C] (MBB Incorporated) – C:\WINDOWS\System32\drivers\massfilter.sys
[2010/11/08 19:16:08 | 000,114,688 | R— | C] (ZTE Corporation) – C:\WINDOWS\System32\drivers\ZTEusbnet.sys
[2010/11/08 19:15:53 | 000,105,856 | R— | C] (ZTE Incorporated) – C:\WINDOWS\System32\drivers\ZTEusbmdm6k.sys
[2010/11/08 19:15:49 | 000,105,856 | R— | C] (ZTE Incorporated) – C:\WINDOWS\System32\drivers\zteusbvoice.sys
[2010/11/08 19:15:45 | 000,105,856 | R— | C] (ZTE Incorporated) – C:\WINDOWS\System32\drivers\ZTEusbnmea.sys
[2010/11/08 19:15:40 | 000,105,856 | R— | C] (ZTE Incorporated) – C:\WINDOWS\System32\drivers\ZTEusbser6k.sys
[2010/11/08 19:15:32 | 000,000,000 | —D | C] – C:\Documents and Settings\peta\Application Data\Vodafone
[2010/11/08 19:14:52 | 000,016,928 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\spmsgXP_2k3.dll
[2010/11/08 19:14:29 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Application Data\Vodafone
[2010/11/08 19:14:02 | 000,000,000 | —D | C] – C:\Program Files\Vodafone
[2010/11/08 19:14:02 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\FLEXnet
[2010/11/08 19:01:47 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Vodafone
[2010/11/08 18:56:08 | 000,000,000 | R-SD | C] – C:\WINDOWS\assembly
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/12/05 20:22:26 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/12/05 20:22:21 | 535,613,440 | -HS- | M] () – C:\hiberfil.sys
[2010/12/05 09:01:32 | 000,013,672 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/12/03 01:05:48 | 000,426,615 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2010/12/03 00:54:23 | 000,426,615 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20101203-010548.backup
[2010/11/25 06:13:05 | 000,455,064 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/11/25 06:13:05 | 000,069,252 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2010/11/25 06:11:29 | 000,000,167 | —- | M] () – C:\__mfdel.bat
[2010/11/23 20:55:29 | 000,000,311 | —- | M] () – C:\WINDOWS\lexstat.ini
[2010/11/23 12:41:36 | 000,000,310 | —- | M] () – C:\WINDOWS\System32\mformlite.cfg
[2010/11/23 10:19:03 | 000,626,688 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\msvcr80.dll
[2010/11/22 22:03:04 | 000,000,000 | -H– | M] () – C:\WINDOWS\System32\drivers\UMDF\MsftWdf_user_01_00_00.Wdf
[2010/11/21 22:55:13 | 000,000,099 | —- | M] () – C:\Documents and Settings\peta\jagex_runescape_preferences2.dat
[2010/11/21 22:10:58 | 000,000,046 | —- | M] () – C:\Documents and Settings\peta\jagex_runescape_preferences.dat
[2010/11/21 19:13:08 | 000,153,976 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2010/11/11 17:52:27 | 000,316,640 | —- | M] () – C:\WINDOWS\WMSysPr9.prx
[2010/11/10 15:36:21 | 000,000,582 | —- | M] () – C:\Documents and Settings\All Users\Desktop\vodafone.lnk
[2010/11/10 15:28:35 | 000,000,211 | -HS- | M] () – C:\boot.ini
[2010/11/08 19:15:00 | 000,000,000 | -H– | M] () – C:\WINDOWS\System32\drivers\Msft_Kernel_vodafone_K3805-z_dc_enum_01009.Wdf
[2010/11/08 19:14:59 | 000,000,000 | -H– | M] () – C:\WINDOWS\System32\drivers\MsftWdf_Kernel_01009_Coinstaller_Critical.Wdf
[2010/11/08 18:50:09 | 000,016,968 | —- | M] () – C:\WINDOWS\System32\drivers\hitmanpro35.sys
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/12/05 20:22:21 | 535,613,440 | -HS- | C] () – C:\hiberfil.sys
[2010/11/25 06:11:29 | 000,000,167 | —- | C] () – C:\__mfdel.bat
[2010/11/23 13:37:16 | 000,000,311 | —- | C] () – C:\WINDOWS\lexstat.ini
[2010/11/23 12:41:36 | 000,000,310 | —- | C] () – C:\WINDOWS\System32\mformlite.cfg
[2010/11/22 22:03:04 | 000,000,000 | -H– | C] () – C:\WINDOWS\System32\drivers\UMDF\MsftWdf_user_01_00_00.Wdf
[2010/11/21 21:33:03 | 000,000,099 | —- | C] () – C:\Documents and Settings\peta\jagex_runescape_preferences2.dat
[2010/11/21 21:30:11 | 000,000,046 | —- | C] () – C:\Documents and Settings\peta\jagex_runescape_preferences.dat
[2010/11/10 15:36:21 | 000,000,582 | —- | C] () – C:\Documents and Settings\All Users\Desktop\vodafone.lnk
[2010/11/08 19:15:00 | 000,000,000 | -H– | C] () – C:\WINDOWS\System32\drivers\Msft_Kernel_vodafone_K3805-z_dc_enum_01009.Wdf
[2010/11/08 19:14:59 | 000,000,000 | -H– | C] () – C:\WINDOWS\System32\drivers\MsftWdf_Kernel_01009_Coinstaller_Critical.Wdf
[2010/11/07 05:55:32 | 000,016,968 | —- | C] () – C:\WINDOWS\System32\drivers\hitmanpro35.sys
[2010/10/30 16:49:16 | 000,003,584 | —- | C] () – C:\Documents and Settings\peta\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/07/18 22:32:24 | 000,219,136 | —- | C] () – C:\WINDOWS\sqlite3_engine.dll
[2010/07/18 22:32:20 | 000,219,136 | —- | C] () – C:\WINDOWS\System32\sqlite3_engine.dll
[2010/07/16 19:25:56 | 000,000,144 | —- | C] () – C:\WINDOWS\Eudcedit.ini
[2010/07/16 12:12:30 | 000,000,036 | —- | C] () – C:\Documents and Settings\peta\Local Settings\Application Data\housecall.guid.cache
[2010/07/11 19:41:32 | 000,000,140 | -HS- | C] () – C:\WINDOWS\WSYS049.SYS
[2010/07/10 11:52:24 | 000,003,840 | —- | C] () – C:\WINDOWS\System32\drivers\BANTExt.sys
[2010/07/10 08:26:45 | 000,000,030 | —- | C] () – C:\WINDOWS\System32\drivers\service.ini
[2010/07/10 08:24:22 | 000,000,044 | —- | C] () – C:\WINDOWS\System32\msssc.dll
[2010/07/10 08:21:04 | 000,002,124 | —- | C] () – C:\WINDOWS\Ascd_tmp.ini
[2010/07/10 08:20:55 | 000,005,824 | —- | C] () – C:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[2010/07/03 13:51:28 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2010/06/21 18:05:34 | 000,157,470 | R— | C] () – C:\Documents and Settings\All Users\Application Data\DeviceManager.xml.rc4

< End of report >


OTL Extras logfile created on: 12/6/2010 9:05:31 PM - Run 1
OTL by OldTimer - Version 3.2.17.3 Folder = C:\Documents and Settings\peta\Desktop\what the tech
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

511.00 Mb Total Physical Memory | 353.00 Mb Available Physical Memory | 69.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 75.00% Paging File free
Paging file location(s): c:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 186.30 Gb Total Space | 175.81 Gb Free Space | 94.37% Space Free | Partition Type: NTFS
Drive H: | 43.48 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: N-0741399D962E4 | User Name: peta | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
htmlfile – Reg Error: Key error.
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [hitmanpro] – "C:\Program Files\Hitman Pro 3.5\HitmanPro35.exe" "%1\"
Directory [OpenNew] – cmd.exe /k cd %1 (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
"ANTIVIRUSDISABLENOTIFY" = 0
"FIREWALLDISABLENOTIFY" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008
"80:TCP" = 80:TCP:*:Enabled:vs http
"80:UDP" = 80:UDP:*:Enabled:vs http

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Mozilla Firefox\firefox.exe" = C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:firefox – (Mozilla Corporation)
"C:\Program Files\Analog Devices\SoundMAX\SMax4Wiz.exe" = C:\Program Files\Analog Devices\SoundMAX\SMax4Wiz.exe:*:Enabled:AudioWizard – (Analog Devices, Inc.)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java™ 6 Update 21
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{6C29152D-3FF9-43B2-84E4-9B35FC0BF5C2}" = Vodafone Mobile Broadband Lite
"{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}" = Microsoft .NET Framework 2.0
"{7E20EFE6-E604-48C6-8B39-BA4742F2CDB4}" = Zune Desktop Theme
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
"{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX
"ActiveScan 2.0" = Panda ActiveScan 2.0
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"Belarc Advisor" = Belarc Advisor 8.1
"CCleaner" = CCleaner
"FreeFixer0.58" = FreeFixer
"Game Booster_is1" = Game Booster
"Glary Utilities_is1" = Glary Utilities 2.27.0.982
"HitmanPro35" = Hitman Pro 3.5
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie8" = Windows Internet Explorer 8
"Index Dat Spy_is1" = Index Dat Spy 2.1.0
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 2.0" = Microsoft .NET Framework 2.0
"Mozilla Firefox (3.6.10)" = Mozilla Firefox (3.6.10)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"Neat Image_is1" = Neat Image v6 Demo (with plug-in)
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"OnlineArmor_is1" = Online Armor 4.0
"Revo Uninstaller" = Revo Uninstaller 1.89
"VGA USB Camera" = VGA USB Camera
"Wdf01009" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"Wipe" = Wipe
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"Yahoo! Software Update" = Yahoo! Software Update
"Yahoo!7 Messenger" = Yahoo!7 Messenger

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"PhotoFiltre" = PhotoFiltre

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 12/2/2010 12:43:28 PM | Computer Name = N-0741399D962E4 | Source = EventSystem | ID = 4609
Description = The COM+ Event System detected a bad return code during its internal
processing. HRESULT was 80070422 from line 44 of d:\comxp_sp3\com\com1x\src\events\tier1\eventsystemobj.cpp.
Please contact Microsoft Product Support Services to report this erro

Error - 12/2/2010 12:43:28 PM | Computer Name = N-0741399D962E4 | Source = VSS | ID = 8193
Description = Volume Shadow Copy Service error: Unexpected error calling routine
CoCreateInstance. hr = 0x80040206.

Error - 12/2/2010 12:43:51 PM | Computer Name = N-0741399D962E4 | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: The server name or address could not be resolved

Error - 12/2/2010 12:44:23 PM | Computer Name = N-0741399D962E4 | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: The server name or address could not be resolved

Error - 12/2/2010 12:44:23 PM | Computer Name = N-0741399D962E4 | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This network connection does not exist.

Error - 12/2/2010 12:44:45 PM | Computer Name = N-0741399D962E4 | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: The server name or address could not be resolved

Error - 12/2/2010 2:59:50 PM | Computer Name = N-0741399D962E4 | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This operation returned because the timeout period expired.

Error - 12/2/2010 3:00:50 PM | Computer Name = N-0741399D962E4 | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This operation returned because the timeout period expired.

Error - 12/5/2010 8:22:54 AM | Computer Name = N-0741399D962E4 | Source = EventSystem | ID = 4609
Description = The COM+ Event System detected a bad return code during its internal
processing. HRESULT was 80070422 from line 44 of d:\comxp_sp3\com\com1x\src\events\tier1\eventsystemobj.cpp.
Please contact Microsoft Product Support Services to report this erro

Error - 12/5/2010 8:22:54 AM | Computer Name = N-0741399D962E4 | Source = VSS | ID = 8193
Description = Volume Shadow Copy Service error: Unexpected error calling routine
CoCreateInstance. hr = 0x80040206.

[ System Events ]
Error - 12/4/2010 9:02:35 PM | Computer Name = N-0741399D962E4 | Source = Service Control Manager | ID = 7023
Description = The System Restore Service service terminated with the following error:
%%2

Error - 12/4/2010 9:02:35 PM | Computer Name = N-0741399D962E4 | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
AFD avgio avipbb BANTExt Fips intelppm IPSec MRxSmb NetBIOS NetBT OADevice OAmon OAnet pavboot
RasAcd
Rdbss
SASDIFSV
sf
ssmdrv
Tcpip

Error - 12/4/2010 9:09:42 PM | Computer Name = N-0741399D962E4 | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service netman with
arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}

Error - 12/5/2010 8:19:26 AM | Computer Name = N-0741399D962E4 | Source = DCOM | ID = 10005
Description = DCOM got error "%1058" attempting to start the service EventSystem
with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 12/5/2010 8:22:54 AM | Computer Name = N-0741399D962E4 | Source = SRService | ID = 104
Description = The System Restore initialization process failed.

Error - 12/5/2010 8:22:54 AM | Computer Name = N-0741399D962E4 | Source = DCOM | ID = 10005
Description = DCOM got error "%1058" attempting to start the service EventSystem
with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 12/5/2010 8:23:08 AM | Computer Name = N-0741399D962E4 | Source = DCOM | ID = 10005
Description = DCOM got error "%1058" attempting to start the service EventSystem
with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 12/5/2010 8:24:12 AM | Computer Name = N-0741399D962E4 | Source = Service Control Manager | ID = 7001
Description = The System Event Notification service depends on the COM+ Event System
service which failed to start because of the following error: %%1058

Error - 12/5/2010 8:24:12 AM | Computer Name = N-0741399D962E4 | Source = Service Control Manager | ID = 7023
Description = The System Restore Service service terminated with the following error:
%%2

Error - 12/5/2010 8:24:12 AM | Computer Name = N-0741399D962E4 | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
SASDIFSV


< End of report >
Post #9
Hi,

You did not actually have the custom scans script pasted. Copy those below and paste it into the Custom Scan box and follow the same set of instructions given.
netsvcs
drivers32
%SYSTEMDRIVE%\*.*
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\Fonts\*.exe
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.jpg
%systemroot%\*.png
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\System32\config\*.sav
%PROGRAMFILES%\bak. /s
%systemroot%\system32\bak. /s
%ALLUSERSPROFILE%\Start Menu\*.lnk /x
%systemroot%\system32\config\systemprofile\*.dat /x
%systemroot%\*.config
%systemroot%\system32\*.db
%PROGRAMFILES%\Internet Explorer\*.dat
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
%USERPROFILE%\Desktop\*.exe
%PROGRAMFILES%\Common Files\*.*
%systemroot%\*.src
%systemroot%\install\*.*
%systemroot%\system32\DLL\*.*
%systemroot%\system32\HelpFiles\*.*
%systemroot%\system32\rundll\*.*
%systemroot%\winn32\*.*
%systemroot%\Java\*.*
%systemroot%\system32\test\*.*
%systemroot%\system32\Rundll32\*.*
%systemroot%\AppPatch\Custom\*.*
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager
Post #10
Embarrassment :)
OTL:

OTL logfile created on: 12/7/2010 3:12:04 PM - Run 2
OTL by OldTimer - Version 3.2.17.3 Folder = C:\Documents and Settings\peta\Desktop\what the tech
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

511.00 Mb Total Physical Memory | 349.00 Mb Available Physical Memory | 68.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 77.00% Paging File free
Paging file location(s): c:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 186.30 Gb Total Space | 175.71 Gb Free Space | 94.32% Space Free | Partition Type: NTFS
Drive H: | 43.48 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: N-0741399D962E4 | User Name: peta | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\peta\desktop\what the tech\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Tall Emu\Online Armor\oahlp.exe (Tall Emu)
PRC - C:\Program Files\Tall Emu\Online Armor\oaui.exe (Tall Emu)
PRC - C:\Program Files\Tall Emu\Online Armor\oasrv.exe (Tall Emu)
PRC - C:\Program Files\Tall Emu\Online Armor\oacat.exe (Tall Emu)
PRC - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\peta\desktop\what the tech\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)
MOD - C:\Program Files\Tall Emu\Online Armor\oawatch.dll (Tall Emu)
MOD - C:\WINDOWS\system32\wsock32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\wtsapi32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\winsta.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\iphlpapi.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (WMPNetworkSvc) – File not found
SRV - (ose) – C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE File not found
SRV - (odserv) – C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE File not found
SRV - (HidServ) – C:\WINDOWS\System32\hidserv.dll File not found
SRV - (AppMgmt) – C:\WINDOWS\System32\appmgmts.dll File not found
SRV - (VmbService) – C:\Program Files\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe (Vodafone)
SRV - (SvcOnlineArmor) – C:\Program Files\Tall Emu\Online Armor\oasrv.exe (Tall Emu)
SRV - (OAcat) – C:\Program Files\Tall Emu\Online Armor\OAcat.exe (Tall Emu)
SRV - (AntiVirService) – C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AntiVirSchedulerService) – C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (YahooAUService) – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
SRV - (SoundMAX Agent Service (default)) – C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe (Analog Devices, Inc.)


========== Driver Services (SafeList) ==========

DRV - (massfilter) – C:\WINDOWS\system32\drivers\massfilter.sys (MBB Incorporated)
DRV - (ZTEusbnet) – C:\WINDOWS\system32\drivers\ZTEusbnet.sys (ZTE Corporation)
DRV - (ZTEusbvoice) – C:\WINDOWS\system32\drivers\zteusbvoice.sys (ZTE Incorporated)
DRV - (ZTEusbser6k) – C:\WINDOWS\system32\drivers\ZTEusbser6k.sys (ZTE Incorporated)
DRV - (ZTEusbnmea) – C:\WINDOWS\system32\drivers\ZTEusbnmea.sys (ZTE Incorporated)
DRV - (ZTEusbmdm6k) – C:\WINDOWS\system32\drivers\ZTEusbmdm6k.sys (ZTE Incorporated)
DRV - (OAmon) – C:\WINDOWS\system32\drivers\OAmon.sys (Tall Emu)
DRV - (OAnet) – C:\WINDOWS\system32\drivers\OAnet.sys (Tall Emu Pty Ltd)
DRV - (OADevice) – C:\WINDOWS\system32\drivers\OADriver.sys (Tall Emu)
DRV - (vodafone_K3805-z_dc_enum) – C:\WINDOWS\system32\drivers\vodafone_K3805-z_dc_enum.sys (Vodafone)
DRV - (avipbb) – C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH)
DRV - (SASDIFSV) – C:\Program Files\SUPERAntiSpyware\sasdifsv.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (avgntflt) – C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH)
DRV - (pavboot) – C:\WINDOWS\system32\drivers\pavboot.sys (Panda Security, S.L.)
DRV - (avgio) – C:\Program Files\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (ssmdrv) – C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (usbaudio) USB Audio Driver (WDM) – C:\WINDOWS\system32\drivers\USBAUDIO.sys (Microsoft Corporation)
DRV - (BANTExt) – C:\WINDOWS\System32\Drivers\BANTExt.sys ()
DRV - (k750obex) – C:\WINDOWS\system32\drivers\k750obex.sys (MCCI)
DRV - (k750mgmt) – C:\WINDOWS\system32\drivers\k750mgmt.sys (MCCI)
DRV - (k750mdm) – C:\WINDOWS\system32\drivers\k750mdm.sys (MCCI)
DRV - (k750mdfl) – C:\WINDOWS\system32\drivers\k750mdfl.sys (MCCI)
DRV - (k750bus) Sony Ericsson 750 driver (WDM) – C:\WINDOWS\system32\drivers\k750bus.sys (MCCI)
DRV - (sf) – C:\WINDOWS\system32\drivers\sf.sys (Sonic Focus, Inc)
DRV - (nv) – C:\WINDOWS\system32\drivers\nv4_mini.sys (NVIDIA Corporation)
DRV - (senfilt) – C:\WINDOWS\system32\drivers\senfilt.sys (Sensaura)
DRV - (ovt519) – C:\WINDOWS\system32\drivers\ov519vid.sys (OmniVision Technologies, Inc.)
DRV - (MidiSyn) – C:\WINDOWS\system32\drivers\MidiSyn.sys (Analog Devices Inc)
DRV - (Edspport) – C:\WINDOWS\system32\drivers\es56hpi.sys (ESS Technology, Inc.)
DRV - (ac97intc) Intel® 82801 Audio Driver Install Service (WDM) – C:\WINDOWS\system32\drivers\ac97intc.sys (Intel Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://home.microsoft.com/search/search.asp

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://home.microsoft.com/search/search.asp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = [Binary data over 100 bytes]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.update: false
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.kongregate.com/games/caesary/caesary"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: [removed]:1.0.4
FF - prefs.js..extensions.enabledItems: {5C655500-E712-41e7-9349-CE462F844B19}:0.4.5
FF - prefs.js..extensions.enabledItems: {71328583-3CA7-4809-B4BA-570A85818FBB}:0.6.3
FF - prefs.js..extensions.enabledItems: {73a6fe31-595d-460b-a920-fcc0f8843232}:2.0.1
FF - prefs.js..extensions.enabledItems: {9669CC8F-B388-42FE-86F4-CB5E7F5A8BDC}:6.0.4
FF - prefs.js..extensions.enabledItems: {dd3d7613-0246-469d-bc65-2a3cc1668adc}:0.7.1.1
FF - prefs.js..extensions.enabledItems: {E2883E8F-472F-4fb0-9522-AC9BF37916A7}:[removed]
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.8.20100408.6
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.2.2
FF - prefs.js..extensions.enabledItems: {1ebc69c0-92ff-11dc-8314-0800200c9a66}:[removed]
FF - prefs.js..extensions.enabledItems: {29852C08-1E91-4889-A6BF-C77F91D6A8F3}:1.8.63
FF - prefs.js..network.proxy.type: 4

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/12/07 04:36:14 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/12/07 04:36:14 | 000,000,000 | —D | M]

[2010/07/03 13:51:12 | 000,000,000 | —D | M] – C:\Documents and Settings\peta\Application Data\Mozilla\Extensions
[2010/11/21 18:52:35 | 000,000,000 | —D | M] – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions
[2010/08/22 08:05:15 | 000,000,000 | —D | M] (Screengrab) – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\{02450954-cdd9-410f-b1da-db804e18c671}(2)
[2010/09/13 13:01:20 | 000,000,000 | —D | M] (IE Tab 2 (FF 3.6+)) – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\{1BC9BA34-1EED-42ca-A505-6D2F1A935BBB}
[2010/08/28 17:38:30 | 000,000,000 | —D | M] (Gnome Classic) – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\{1ebc69c0-92ff-11dc-8314-0800200c9a66}
[2010/08/28 17:57:30 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\{29852C08-1E91-4889-A6BF-C77F91D6A8F3}
[2010/07/18 10:37:30 | 000,000,000 | —D | M] (Quick Translator) – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\{5C655500-E712-41e7-9349-CE462F844B19}
[2010/09/10 20:00:27 | 000,000,000 | —D | M] (Speed Dial) – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\{64161300-e22b-11db-8314-0800200c9a66}
[2010/08/14 15:08:00 | 000,000,000 | —D | M] (CacheViewer) – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\{71328583-3CA7-4809-B4BA-570A85818FBB}
[2010/08/14 15:08:03 | 000,000,000 | —D | M] (NoScript) – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}
[2010/08/22 08:04:43 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\{75623d5d-4683-402a-b610-ac4bab767c86}
[2010/08/22 08:04:43 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\{8965bb4b-c2ca-2b84-6b49-7afb2760518c}
[2010/08/22 08:04:44 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\{8F6A6FD9-0619-459f-B9D0-81DE065D4E21}
[2010/09/10 19:45:17 | 000,000,000 | —D | M] (MR Tech Toolkit) – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\{9669CC8F-B388-42FE-86F4-CB5E7F5A8BDC}
[2010/09/18 02:13:26 | 000,000,000 | —D | M] (Adblock Plus) – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010/08/22 08:04:43 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\{d8b271a6-6ed3-427d-b600-1b674e00e6ec}
[2010/08/31 13:55:29 | 000,000,000 | —D | M] (BlockSite) – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\{dd3d7613-0246-469d-bc65-2a3cc1668adc}
[2010/09/04 13:24:23 | 000,000,000 | —D | M] (Adobe DLM (powered by getPlus®)) – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
[2010/08/08 20:47:28 | 000,000,000 | —D | M] (Greasemonkey) – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2010/08/22 08:04:42 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\{ef62e1ce-d2a4-4cdd-b7ec-92b120366b66}
[2010/08/22 08:04:42 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\{FDD8ECF0-451A-414D-8C8F-7B7F78B0ECD3}
[2010/08/22 08:05:12 | 000,000,000 | —D | M] – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\bizdom@wizbites(2).com
[2010/08/07 15:36:46 | 000,000,000 | —D | M] – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\[removed]
[2010/09/13 13:01:22 | 000,000,000 | —D | M] – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\[removed]
[2010/08/22 08:04:43 | 000,000,000 | —D | M] – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\[removed]
[2010/09/07 18:55:20 | 000,000,000 | —D | M] – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\PlacesCleaner@sto(2).tw
[2010/08/22 08:05:15 | 000,000,000 | —D | M] – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\VacuumPlacesImproved@lultimouomo-gmail(2).com
[2010/08/08 22:18:30 | 000,002,377 | —- | M] () – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\searchplugins\kongregate.xml
[2010/11/21 18:52:35 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2010/09/07 19:40:51 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/07/03 13:41:41 | 000,411,368 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll

O1 HOSTS File: ([2010/12/03 01:05:48 | 000,426,615 | R— | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 127.0.0.1 1-domains-registrations.com
O1 - Hosts: 127.0.0.1 www.1-domains-registrations.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 14693 more lines…
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O4 - HKLM..\Run: [@OnlineArmor GUI] C:\Program Files\Tall Emu\Online Armor\oaui.exe (Tall Emu)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O15 - HKCU\..Trusted Domains: eset.com.au ([www] http in Trusted sites)
O15 - HKCU\..Trusted Domains: live.com ([explore] http in Trusted sites)
O15 - HKCU\..Trusted Domains: microsoft.com ([*.update] http in Trusted sites)
O15 - HKCU\..Trusted Domains: microsoft.com ([*.update] https in Trusted sites)
O15 - HKCU\..Trusted Domains: microsoft.com ([go] http in Trusted sites)
O15 - HKCU\..Trusted Domains: microsoft.com ([update] http in Trusted sites)
O15 - HKCU\..Trusted Domains: microsoft.com ([update] https in Trusted sites)
O15 - HKCU\..Trusted Domains: mozilla.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: windowsupdate.com ([download] http in Trusted sites)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/…b?1278136636609 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/microsoftu…b?1278138757015 (MUWebControl Class)
O18 - Protocol\Handler\belarc {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files\Belarc\Advisor\System\BAVoilaX.dll (Belarc, Inc.)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - Reg Error: Key error. File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - CLSID or File not found.
O24 - Desktop WallPaper: C:\Documents and Settings\peta\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\peta\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {4F07DA45-8170-4859-9B5F-037EF2970034} - C:\Program Files\Tall Emu\Online Armor\oaevent.dll (Tall Emu)
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/07/03 06:04:52 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2010/06/26 01:16:32 | 000,000,118 | R— | M] () - H:\autorun.inf – [ CDFS ]
O33 - MountPoints2\{cb628957-e9ee-11df-b52b-ff2579a219ff}\Shell - "" = AutoRun
O33 - MountPoints2\{cb628957-e9ee-11df-b52b-ff2579a219ff}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{cb628957-e9ee-11df-b52b-ff2579a219ff}\Shell\AutoRun\command - "" = F:\setup_vmb_lite.exe – File not found
O33 - MountPoints2\{cb62895c-e9ee-11df-b52b-e753b9f80bbb}\Shell - "" = AutoRun
O33 - MountPoints2\{cb62895c-e9ee-11df-b52b-e753b9f80bbb}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{cb62895c-e9ee-11df-b52b-e753b9f80bbb}\Shell\AutoRun\command - "" = H:\setup_vmb_lite.exe – [2010/06/24 21:02:49 | 000,274,432 | R— | M] (Vodafone)
O33 - MountPoints2\F\Shell - "" = AutoRun
O33 - MountPoints2\F\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\setup_vmb_lite.exe – File not found
O33 - MountPoints2\H\Shell - "" = AutoRun
O33 - MountPoints2\H\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\H\Shell\AutoRun\command - "" = H:\setup_vmb_lite.exe – [2010/06/24 21:02:49 | 000,274,432 | R— | M] (Vodafone)
O34 - HKLM BootExecute: (콈ʫ뱝粑) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - C:\WINDOWS\System32\appmgmts.dll File not found
NetSvcs: HidServ - C:\WINDOWS\System32\hidserv.dll File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)

CREATERESTOREPOINT
Error starting restore point: System Restore is disabled.
Error closing restore point: System Restore is disabled.

========== Files/Folders - Created Within 30 Days ==========

[2010/12/07 04:31:07 | 000,000,000 | RH-D | C] – C:\Documents and Settings\peta\Recent
[2010/12/06 20:02:09 | 000,000,000 | —D | C] – C:\Documents and Settings\peta\Desktop\what the tech
[2010/12/04 09:00:17 | 000,000,000 | —D | C] – C:\Program Files\Trend Micro
[2010/12/03 00:47:06 | 000,000,000 | —D | C] – C:\Program Files\Spybot - Search & Destroy
[2010/12/03 00:47:06 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
[2010/11/23 16:29:08 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Help
[2010/11/23 16:29:08 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Application Data\Help
[2010/11/23 16:16:38 | 000,000,000 | —D | C] – C:\Documents and Settings\peta\Local Settings\Application Data\Identities
[2010/11/23 13:36:44 | 000,201,216 | —- | C] (Lexmark International, Inc.) – C:\WINDOWS\System32\LEXP2P32.DLL
[2010/11/23 13:36:43 | 000,196,096 | —- | C] (Lexmark International, Inc.) – C:\WINDOWS\System32\LEX2KUSB.DLL
[2010/11/23 13:36:43 | 000,147,456 | —- | C] (Lexmark International, Inc.) – C:\WINDOWS\System32\LEXBCE.DLL
[2010/11/23 13:36:38 | 000,192,512 | —- | C] (Lexmark International, Inc.) – C:\WINDOWS\System32\LEXLMPM.DLL
[2010/11/23 13:36:25 | 000,015,104 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\usbscan.sys
[2010/11/23 13:36:21 | 000,087,040 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wiafbdrv.dll
[2010/11/23 13:36:21 | 000,087,040 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wiafbdrv.dll
[2010/11/23 13:35:31 | 000,025,856 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\usbprint.sys
[2010/11/23 13:31:05 | 000,299,520 | —- | C] (InstallShield Corporation, Inc.) – C:\WINDOWS\uninst.exe
[2010/11/23 13:31:00 | 000,000,000 | —D | C] – C:\Documents and Settings\peta\WINDOWS
[2010/11/23 12:51:53 | 000,000,000 | —D | C] – C:\Documents and Settings\peta\Local Settings\Application Data\ApplicationHistory
[2010/11/22 22:06:55 | 000,014,640 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\spmsg.dll
[2010/11/22 22:06:07 | 000,000,000 | —D | C] – C:\Program Files\Windows Media Connect 2
[2010/11/22 22:02:55 | 000,000,000 | —D | C] – C:\WINDOWS\System32\drivers\UMDF
[2010/11/22 22:02:55 | 000,000,000 | —D | C] – C:\WINDOWS\System32\LogFiles
[2010/11/21 21:29:59 | 000,000,000 | —D | C] – C:\WINDOWS\.jagex_cache_32
[2010/11/11 17:52:04 | 000,000,000 | —D | C] – C:\WINDOWS\RegisteredPackages
[2010/11/11 17:51:05 | 002,388,176 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx9_30.dll
[2010/11/11 17:51:03 | 002,323,664 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx9_28.dll
[2010/11/10 16:30:08 | 000,000,000 | —D | C] – C:\Documents and Settings\peta\Application Data\FLEXnet
[2010/11/10 14:08:18 | 000,009,216 | R— | C] (MBB Incorporated) – C:\WINDOWS\System32\drivers\massfilter.sys
[2010/11/08 19:16:08 | 000,114,688 | R— | C] (ZTE Corporation) – C:\WINDOWS\System32\drivers\ZTEusbnet.sys
[2010/11/08 19:15:53 | 000,105,856 | R— | C] (ZTE Incorporated) – C:\WINDOWS\System32\drivers\ZTEusbmdm6k.sys
[2010/11/08 19:15:49 | 000,105,856 | R— | C] (ZTE Incorporated) – C:\WINDOWS\System32\drivers\zteusbvoice.sys
[2010/11/08 19:15:45 | 000,105,856 | R— | C] (ZTE Incorporated) – C:\WINDOWS\System32\drivers\ZTEusbnmea.sys
[2010/11/08 19:15:40 | 000,105,856 | R— | C] (ZTE Incorporated) – C:\WINDOWS\System32\drivers\ZTEusbser6k.sys
[2010/11/08 19:15:32 | 000,000,000 | —D | C] – C:\Documents and Settings\peta\Application Data\Vodafone
[2010/11/08 19:14:52 | 000,016,928 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\spmsgXP_2k3.dll
[2010/11/08 19:14:29 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Application Data\Vodafone
[2010/11/08 19:14:02 | 000,000,000 | —D | C] – C:\Program Files\Vodafone
[2010/11/08 19:14:02 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\FLEXnet
[2010/11/08 19:01:47 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Vodafone
[2010/11/08 18:56:08 | 000,000,000 | R-SD | C] – C:\WINDOWS\assembly
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/12/07 04:28:26 | 000,013,672 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/12/07 04:28:23 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/12/07 04:28:18 | 535,613,440 | -HS- | M] () – C:\hiberfil.sys
[2010/12/03 01:05:48 | 000,426,615 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2010/12/03 00:54:23 | 000,426,615 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20101203-010548.backup
[2010/11/25 06:13:05 | 000,455,064 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/11/25 06:13:05 | 000,069,252 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2010/11/25 06:11:29 | 000,000,167 | —- | M] () – C:\__mfdel.bat
[2010/11/23 20:55:29 | 000,000,311 | —- | M] () – C:\WINDOWS\lexstat.ini
[2010/11/23 12:41:36 | 000,000,310 | —- | M] () – C:\WINDOWS\System32\mformlite.cfg
[2010/11/23 10:19:03 | 000,626,688 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\msvcr80.dll
[2010/11/22 22:03:04 | 000,000,000 | -H– | M] () – C:\WINDOWS\System32\drivers\UMDF\MsftWdf_user_01_00_00.Wdf
[2010/11/21 22:55:13 | 000,000,099 | —- | M] () – C:\Documents and Settings\peta\jagex_runescape_preferences2.dat
[2010/11/21 22:10:58 | 000,000,046 | —- | M] () – C:\Documents and Settings\peta\jagex_runescape_preferences.dat
[2010/11/21 19:13:08 | 000,153,976 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2010/11/11 17:52:27 | 000,316,640 | —- | M] () – C:\WINDOWS\WMSysPr9.prx
[2010/11/10 15:36:21 | 000,000,582 | —- | M] () – C:\Documents and Settings\All Users\Desktop\vodafone.lnk
[2010/11/10 15:28:35 | 000,000,211 | -HS- | M] () – C:\boot.ini
[2010/11/08 19:15:00 | 000,000,000 | -H– | M] () – C:\WINDOWS\System32\drivers\Msft_Kernel_vodafone_K3805-z_dc_enum_01009.Wdf
[2010/11/08 19:14:59 | 000,000,000 | -H– | M] () – C:\WINDOWS\System32\drivers\MsftWdf_Kernel_01009_Coinstaller_Critical.Wdf
[2010/11/08 18:50:09 | 000,016,968 | —- | M] () – C:\WINDOWS\System32\drivers\hitmanpro35.sys
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/12/05 20:22:21 | 535,613,440 | -HS- | C] () – C:\hiberfil.sys
[2010/11/25 06:11:29 | 000,000,167 | —- | C] () – C:\__mfdel.bat
[2010/11/23 13:37:16 | 000,000,311 | —- | C] () – C:\WINDOWS\lexstat.ini
[2010/11/23 12:41:36 | 000,000,310 | —- | C] () – C:\WINDOWS\System32\mformlite.cfg
[2010/11/22 22:03:04 | 000,000,000 | -H– | C] () – C:\WINDOWS\System32\drivers\UMDF\MsftWdf_user_01_00_00.Wdf
[2010/11/21 21:33:03 | 000,000,099 | —- | C] () – C:\Documents and Settings\peta\jagex_runescape_preferences2.dat
[2010/11/21 21:30:11 | 000,000,046 | —- | C] () – C:\Documents and Settings\peta\jagex_runescape_preferences.dat
[2010/11/10 15:36:21 | 000,000,582 | —- | C] () – C:\Documents and Settings\All Users\Desktop\vodafone.lnk
[2010/11/08 19:15:00 | 000,000,000 | -H– | C] () – C:\WINDOWS\System32\drivers\Msft_Kernel_vodafone_K3805-z_dc_enum_01009.Wdf
[2010/11/08 19:14:59 | 000,000,000 | -H– | C] () – C:\WINDOWS\System32\drivers\MsftWdf_Kernel_01009_Coinstaller_Critical.Wdf
[2010/11/07 05:55:32 | 000,016,968 | —- | C] () – C:\WINDOWS\System32\drivers\hitmanpro35.sys
[2010/10/30 16:49:16 | 000,003,584 | —- | C] () – C:\Documents and Settings\peta\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/07/18 22:32:24 | 000,219,136 | —- | C] () – C:\WINDOWS\sqlite3_engine.dll
[2010/07/18 22:32:20 | 000,219,136 | —- | C] () – C:\WINDOWS\System32\sqlite3_engine.dll
[2010/07/16 19:25:56 | 000,000,144 | —- | C] () – C:\WINDOWS\Eudcedit.ini
[2010/07/16 12:12:30 | 000,000,036 | —- | C] () – C:\Documents and Settings\peta\Local Settings\Application Data\housecall.guid.cache
[2010/07/11 19:41:32 | 000,000,140 | -HS- | C] () – C:\WINDOWS\WSYS049.SYS
[2010/07/10 11:52:24 | 000,003,840 | —- | C] () – C:\WINDOWS\System32\drivers\BANTExt.sys
[2010/07/10 08:26:45 | 000,000,030 | —- | C] () – C:\WINDOWS\System32\drivers\service.ini
[2010/07/10 08:24:22 | 000,000,044 | —- | C] () – C:\WINDOWS\System32\msssc.dll
[2010/07/10 08:21:04 | 000,002,124 | —- | C] () – C:\WINDOWS\Ascd_tmp.ini
[2010/07/10 08:20:55 | 000,005,824 | —- | C] () – C:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[2010/07/03 13:51:28 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2010/06/21 18:05:34 | 000,157,470 | R— | C] () – C:\Documents and Settings\All Users\Application Data\DeviceManager.xml.rc4

========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2010/07/03 06:04:52 | 000,000,000 | —- | M] () – C:\AUTOEXEC.BAT
[2010/11/10 15:28:35 | 000,000,211 | -HS- | M] () – C:\boot.ini
[2010/07/03 06:04:52 | 000,000,000 | —- | M] () – C:\CONFIG.SYS
[2010/12/07 04:28:18 | 535,613,440 | -HS- | M] () – C:\hiberfil.sys
[2010/07/03 06:04:52 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2010/07/03 06:04:52 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2004/08/04 20:00:00 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2010/07/07 13:14:11 | 000,250,048 | RHS- | M] () – C:\ntldr
[2010/12/07 04:28:17 | 805,306,368 | -HS- | M] () – C:\pagefile.sys
[2010/11/25 06:11:29 | 000,000,167 | —- | M] () – C:\__mfdel.bat

< %systemroot%\Fonts\*.com >

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2010/07/03 07:07:09 | 000,000,067 | -HS- | M] () – C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2010/07/03 14:59:06 | 000,262,144 | —- | M] () – C:\WINDOWS\system32\config\default.sav
[2010/07/03 06:53:31 | 000,262,144 | —- | M] () – C:\WINDOWS\system32\config\security.sav
[2010/07/03 14:59:06 | 008,650,752 | —- | M] () – C:\WINDOWS\system32\config\software.sav
[2010/07/03 14:59:06 | 003,145,728 | —- | M] () – C:\WINDOWS\system32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2010/07/07 13:20:11 | 000,000,272 | -HS- | M] () – C:\Documents and Settings\All Users\Start Menu\desktop.ini

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2010/07/07 15:22:13 | 000,000,119 | -HS- | M] () – C:\Documents and Settings\peta\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
[2010/07/03 06:08:33 | 000,000,079 | —- | M] () – C:\Documents and Settings\peta\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

< %USERPROFILE%\Desktop\*.exe >

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-10-22 14:01:34

< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager >
"CriticalSectionTimeout" = 2592000
"EnableMCA" = 1
"EnableMCE" = 0
"ExcludeFromKnownDlls" = [binary data]
"GlobalFlag" = 0
"HeapDeCommitFreeBlockThreshold" = 0
"HeapDeCommitTotalFreeThreshold" = 0
"HeapSegmentCommit" = 0
"HeapSegmentReserve" = 0
"ObjectDirectories" = \Windows\RPC Control [binary data]
"ProtectionMode" = 1
"ResourceTimeoutCount" = 648000
"ProcessorControl" = 2
"RegisteredProcessors" = 1
"LicensedProcessors" = 1
"BootExecute" = FE FF FF FF 48 CF AB 02 5D BC 91 7C 00 00 00 00 [binary data]
"PendingFileRenameOperations" = [Binary data over 100 bytes]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatibility]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\AppPatches]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\DOS Devices]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Executive]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\FileRenameOperations]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\kernel]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Power]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SFC]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\WPA]

< End of report >
Post #11
Hi,

No signs of malware present in your log, it may be hidden and we shall take a deeper look on it.

Did you disable system restore yourself? Please let me know if you can enable it.

Steps to turn on System Restore

1. Click Start, right-click My Computer, and then click Properties.
2. In the System Properties dialog box, click the System Restore tab.
3. Click to clear the Turn off System Restore check box. Or, click the Turn off System Restore on all drives check box.
4. Click OK.

===================================================

Scan With RootKitUnHooker

  • Please Download Rootkit Unhooker and save it to your desktop.
  • Now double-click on RKUnhookerLE.exe to run it.
  • Click the Report tab, then click Scan.
  • Check (Tick) Drivers and Stealth
  • Uncheck the rest. then click OK
  • When prompted to Select Disks for Scan, make sure C:\ is checked and click OK
  • Wait till the scanner has finished and then click File > Save Report.
  • Save the report somewhere where you can find it. Click Close.
  • Copy the entire contents of the report and paste it in your next reply.

Note** you may get the following warning, just click OK and continue.

"Rootkit Unhooker has detected a parasite inside itself!
It is recommended to remove parasite, okay?"

===================================================

Please download MBRCheck.exe to your desktop.
  • Be sure to disable your security programs
  • Double click on the file to run it (Vista and Windows 7 users will have to confirm the UAC prompt)
  • A window will open on your desktop
  • if an unknown bootcode is found you will have further options available to you, at this time press N then press Enter twice.
  • If nothing unusual is found just press Enter
  • A .txt file named MBRCheck_mm.dd.yy_hh.mm.ss should appear on your desktop.
  • Please post the contents of that file.
===================================================

On your next reply please post :
RKU log
MBRCheck log

Good Day!
Post #12
Rootkit Unhooker: RkUnhooker report generator v0.7 ============================================== Rootkit Unhooker kernel version: 3.7.300.505 ============================================== Windows Major Version: 5 Windows Minor Version: 1 Windows Build Number: 2600 ============================================== >Drivers Driver: C:\WINDOWS\System32\nv4_disp.dll Address: 0xBF012000 Size: 4276224 bytes Driver: C:\WINDOWS\system32\ntoskrnl.exe Address: 0x804D7000 Size: 2260992 bytes Driver: PnpManager Address: 0x804D7000 Size: 2260992 bytes Driver: RAW Address: 0x804D7000 Size: 2260992 bytes Driver: WMIxWDM Address: 0x804D7000 Size: 2260992 bytes Driver: C:\WINDOWS\system32\DRIVERS\nv4_mini.sys Address: 0xF83BD000 Size: 1900544 bytes Driver: Win32k Address: 0xBF800000 Size: 1855488 bytes Driver: C:\WINDOWS\System32\win32k.sys Address: 0xBF800000 Size: 1855488 bytes Driver: C:\WINDOWS\system32\DRIVERS\es56hpi.sys Address: 0xF82F3000 Size: 598016 bytes Driver: Ntfs.sys Address: 0xF861C000 Size: 577536 bytes Driver: C:\WINDOWS\System32\Drivers\wdf01000.sys Address: 0xF8040000 Size: 462848 bytes Driver: C:\WINDOWS\system32\DRIVERS\mrxsmb.sys Address: 0xF6D35000 Size: 458752 bytes Driver: C:\WINDOWS\system32\drivers\senfilt.sys Address: 0xF81DA000 Size: 385024 bytes Driver: C:\WINDOWS\system32\DRIVERS\update.sys Address: 0xF80C5000 Size: 385024 bytes Driver: C:\WINDOWS\system32\DRIVERS\tcpip.sys Address: 0xF6E64000 Size: 364544 bytes Driver: C:\WINDOWS\system32\drivers\OADriver.sys Address: 0xF6DA5000 Size: 303104 bytes Driver: C:\WINDOWS\System32\ATMFD.DLL Address: 0xBFFA0000 Size: 286720 bytes Driver: C:\WINDOWS\System32\Drivers\HTTP.sys Address: 0xF58CE000 Size: 266240 bytes Driver: C:\WINDOWS\system32\drivers\smwdm.sys Address: 0xF827C000 Size: 262144 bytes Driver: ACPI.sys Address: 0xF8728000 Size: 188416 bytes Driver: NDIS.sys Address: 0xF85EF000 Size: 184320 bytes Driver: C:\WINDOWS\system32\drivers\kmixer.sys Address: 0xF5143000 Size: 176128 bytes Driver: C:\WINDOWS\system32\DRIVERS\rdbss.sys Address: 0xF6DEF000 Size: 176128 bytes Driver: C:\WINDOWS\system32\DRIVERS\netbt.sys Address: 0xF6E3C000 Size: 163840 bytes Driver: C:\WINDOWS\system32\drivers\portcls.sys Address: 0xF8258000 Size: 147456 bytes Driver: C:\WINDOWS\system32\DRIVERS\USBPORT.SYS Address: 0xF8385000 Size: 147456 bytes Driver: C:\WINDOWS\system32\DRIVERS\ks.sys Address: 0xF82BC000 Size: 143360 bytes Driver: C:\WINDOWS\System32\drivers\afd.sys Address: 0xF6E1A000 Size: 139264 bytes Driver: C:\WINDOWS\system32\DRIVERS\avipbb.sys Address: 0xF6D13000 Size: 139264 bytes Driver: ACPI_HAL Address: 0x806FF000 Size: 134400 bytes Driver: C:\WINDOWS\system32\hal.dll Address: 0x806FF000 Size: 134400 bytes Driver: C:\WINDOWS\system32\drivers\aeaudio.sys Address: 0xF8238000 Size: 131072 bytes Driver: fltmgr.sys Address: 0xF86C0000 Size: 131072 bytes Driver: ftdisk.sys Address: 0xF86F8000 Size: 126976 bytes Driver: Mup.sys Address: 0xF85D5000 Size: 106496 bytes Driver: C:\WINDOWS\system32\DRIVERS\ZTEusbmdm6k.sys Address: 0xF52D6000 Size: 106496 bytes Driver: C:\WINDOWS\system32\DRIVERS\ZTEusbnmea.sys Address: 0xF533D000 Size: 106496 bytes Driver: C:\WINDOWS\system32\DRIVERS\ZTEusbser6k.sys Address: 0xF5368000 Size: 106496 bytes Driver: C:\WINDOWS\system32\DRIVERS\ZTEusbvoice.sys Address: 0xF5312000 Size: 106496 bytes Driver: atapi.sys Address: 0xF86E0000 Size: 98304 bytes Driver: C:\WINDOWS\System32\Drivers\dump_atapi.sys Address: 0xF6C33000 Size: 98304 bytes Driver: KSecDD.sys Address: 0xF86A9000 Size: 94208 bytes Driver: C:\WINDOWS\system32\DRIVERS\ndiswan.sys Address: 0xF81C3000 Size: 94208 bytes Driver: C:\WINDOWS\system32\DRIVERS\avgntflt.sys Address: 0xF5CBE000 Size: 86016 bytes Driver: C:\WINDOWS\system32\drivers\wdmaud.sys Address: 0xF5961000 Size: 86016 bytes Driver: C:\WINDOWS\system32\DRIVERS\parport.sys Address: 0xF82DF000 Size: 81920 bytes Driver: C:\WINDOWS\system32\DRIVERS\VIDEOPRT.SYS Address: 0xF83A9000 Size: 81920 bytes Driver: C:\WINDOWS\system32\DRIVERS\vodafone_K3805-z_dc_enum.sys Address: 0xF80B1000 Size: 81920 bytes Driver: C:\WINDOWS\system32\DRIVERS\ipsec.sys Address: 0xF6EBD000 Size: 77824 bytes Driver: C:\WINDOWS\System32\drivers\dxg.sys Address: 0xBF000000 Size: 73728 bytes Driver: pci.sys Address: 0xF8717000 Size: 69632 bytes Driver: C:\WINDOWS\System32\Drivers\Cdfs.SYS Address: 0xF8977000 Size: 65536 bytes Driver: C:\WINDOWS\system32\DRIVERS\cdrom.sys Address: 0xF8847000 Size: 65536 bytes Driver: ohci1394.sys Address: 0xF8787000 Size: 65536 bytes Driver: C:\WINDOWS\system32\DRIVERS\serial.sys Address: 0xF8837000 Size: 65536 bytes Driver: C:\WINDOWS\system32\drivers\drmk.sys Address: 0xF8877000 Size: 61440 bytes Driver: C:\WINDOWS\system32\DRIVERS\redbook.sys Address: 0xF8857000 Size: 61440 bytes Driver: C:\WINDOWS\system32\drivers\sysaudio.sys Address: 0xF5AAE000 Size: 61440 bytes Driver: C:\WINDOWS\system32\DRIVERS\usbhub.sys Address: 0xF88E7000 Size: 61440 bytes Driver: C:\WINDOWS\system32\DRIVERS\1394BUS.SYS Address: 0xF8797000 Size: 57344 bytes Driver: C:\WINDOWS\system32\DRIVERS\WDFLDR.SYS Address: 0xF88C7000 Size: 57344 bytes Driver: C:\WINDOWS\system32\DRIVERS\CLASSPNP.SYS Address: 0xF87D7000 Size: 53248 bytes Driver: C:\WINDOWS\system32\DRIVERS\i8042prt.sys Address: 0xF8827000 Size: 53248 bytes Driver: C:\WINDOWS\system32\DRIVERS\rasl2tp.sys Address: 0xF8887000 Size: 53248 bytes Driver: VolSnap.sys Address: 0xF87B7000 Size: 53248 bytes Driver: C:\WINDOWS\system32\DRIVERS\raspptp.sys Address: 0xF88A7000 Size: 49152 bytes Driver: agp440.sys Address: 0xF87E7000 Size: 45056 bytes Driver: C:\WINDOWS\System32\Drivers\Fips.SYS Address: 0xF8947000 Size: 45056 bytes Driver: C:\WINDOWS\system32\DRIVERS\imapi.sys Address: 0xF8867000 Size: 45056 bytes Driver: MountMgr.sys Address: 0xF87A7000 Size: 45056 bytes Driver: C:\WINDOWS\system32\DRIVERS\raspppoe.sys Address: 0xF8897000 Size: 45056 bytes Driver: isapnp.sys Address: 0xF8777000 Size: 40960 bytes Driver: C:\WINDOWS\System32\Drivers\NDProxy.SYS Address: 0xF88D7000 Size: 40960 bytes Driver: C:\WINDOWS\system32\DRIVERS\termdd.sys Address: 0xF88B7000 Size: 40960 bytes Driver: disk.sys Address: 0xF87C7000 Size: 36864 bytes Driver: C:\WINDOWS\system32\DRIVERS\HIDCLASS.SYS Address: 0xF8937000 Size: 36864 bytes Driver: C:\WINDOWS\system32\DRIVERS\intelppm.sys Address: 0xF8817000 Size: 36864 bytes Driver: C:\WINDOWS\system32\DRIVERS\msgpc.sys Address: 0xF8907000 Size: 36864 bytes Driver: C:\WINDOWS\system32\DRIVERS\netbios.sys Address: 0xF8927000 Size: 36864 bytes Driver: C:\WINDOWS\system32\drivers\OAnet.sys Address: 0xF88F7000 Size: 36864 bytes Driver: C:\WINDOWS\system32\DRIVERS\wanarp.sys Address: 0xF8917000 Size: 36864 bytes Driver: C:\WINDOWS\System32\Drivers\Modem.SYS Address: 0xF8A6F000 Size: 32768 bytes Driver: C:\WINDOWS\System32\Drivers\Npfs.SYS Address: 0xF8B57000 Size: 32768 bytes Driver: C:\WINDOWS\system32\drivers\OAmon.sys Address: 0xF8B6F000 Size: 32768 bytes Driver: C:\WINDOWS\system32\drivers\sf.sys Address: 0xF8AA7000 Size: 32768 bytes Driver: C:\WINDOWS\system32\DRIVERS\usbccgp.sys Address: 0xF8B77000 Size: 32768 bytes Driver: C:\WINDOWS\system32\DRIVERS\usbehci.sys Address: 0xF8A5F000 Size: 32768 bytes Driver: C:\WINDOWS\system32\DRIVERS\HIDPARSE.SYS Address: 0xF8A4F000 Size: 28672 bytes Driver: C:\WINDOWS\System32\Drivers\PCIIDEX.SYS Address: 0xF89F7000 Size: 28672 bytes Driver: C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS Address: 0xF8A17000 Size: 28672 bytes Driver: C:\WINDOWS\system32\DRIVERS\kbdclass.sys Address: 0xF8A7F000 Size: 24576 bytes Driver: C:\WINDOWS\system32\DRIVERS\mouclass.sys Address: 0xF8AEF000 Size: 24576 bytes Driver: pavboot.sys Address: 0xF8A07000 Size: 24576 bytes Driver: C:\WINDOWS\System32\Drivers\rkhdrv40.SYS Address: 0xF8B2F000 Size: 24576 bytes Driver: C:\WINDOWS\system32\DRIVERS\ssmdrv.sys Address: 0xF8B7F000 Size: 24576 bytes Driver: C:\WINDOWS\system32\DRIVERS\usbuhci.sys Address: 0xF8A57000 Size: 24576 bytes Driver: C:\WINDOWS\System32\drivers\vga.sys Address: 0xF8B37000 Size: 24576 bytes Driver: C:\WINDOWS\System32\Drivers\Msfs.SYS Address: 0xF8B47000 Size: 20480 bytes Driver: PartMgr.sys Address: 0xF89FF000 Size: 20480 bytes Driver: C:\WINDOWS\system32\DRIVERS\ptilink.sys Address: 0xF8AD7000 Size: 20480 bytes Driver: C:\WINDOWS\system32\DRIVERS\raspti.sys Address: 0xF8AE7000 Size: 20480 bytes Driver: C:\WINDOWS\system32\DRIVERS\TDI.SYS Address: 0xF8AC7000 Size: 20480 bytes Driver: C:\WINDOWS\System32\watchdog.sys Address: 0xF8A9F000 Size: 20480 bytes Driver: C:\WINDOWS\system32\DRIVERS\asyncmac.sys Address: 0xF53FD000 Size: 16384 bytes Driver: C:\WINDOWS\system32\DRIVERS\mssmbios.sys Address: 0xF8C3B000 Size: 16384 bytes Driver: C:\WINDOWS\system32\DRIVERS\ndisuio.sys Address: 0xF5CF3000 Size: 16384 bytes Driver: C:\WINDOWS\system32\DRIVERS\serenum.sys Address: 0xF8C0B000 Size: 16384 bytes Driver: C:\WINDOWS\system32\BOOTVID.dll Address: 0xF8B87000 Size: 12288 bytes Driver: C:\WINDOWS\System32\drivers\Dxapi.sys Address: 0xF8018000 Size: 12288 bytes Driver: C:\WINDOWS\system32\DRIVERS\hidusb.sys Address: 0xF8C03000 Size: 12288 bytes Driver: C:\WINDOWS\system32\DRIVERS\mouhid.sys Address: 0xF8C0F000 Size: 12288 bytes Driver: C:\WINDOWS\system32\DRIVERS\ndistapi.sys Address: 0xF8C27000 Size: 12288 bytes Driver: C:\WINDOWS\system32\DRIVERS\rasacd.sys Address: 0xF85A9000 Size: 12288 bytes Driver: C:\Program Files\Avira\AntiVir Desktop\avgio.sys Address: 0xF8CA5000 Size: 8192 bytes Driver: C:\WINDOWS\System32\Drivers\Beep.SYS Address: 0xF8C97000 Size: 8192 bytes Driver: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS Address: 0xF8CAB000 Size: 8192 bytes Driver: C:\WINDOWS\System32\Drivers\Fs_Rec.SYS Address: 0xF8C93000 Size: 8192 bytes Driver: intelide.sys Address: 0xF8C7B000 Size: 8192 bytes Driver: C:\WINDOWS\system32\KDCOM.DLL Address: 0xF8C77000 Size: 8192 bytes Driver: C:\WINDOWS\System32\Drivers\mnmdd.SYS Address: 0xF8C9B000 Size: 8192 bytes Driver: C:\WINDOWS\System32\Drivers\ParVdm.SYS Address: 0xF8CC9000 Size: 8192 bytes Driver: C:\WINDOWS\System32\DRIVERS\RDPCDD.sys Address: 0xF8C9F000 Size: 8192 bytes Driver: C:\WINDOWS\system32\DRIVERS\swenum.sys Address: 0xF8C83000 Size: 8192 bytes Driver: C:\WINDOWS\system32\DRIVERS\USBD.SYS Address: 0xF8C8F000 Size: 8192 bytes Driver: C:\WINDOWS\system32\DRIVERS\WMILIB.SYS Address: 0xF8C79000 Size: 8192 bytes Driver: C:\WINDOWS\system32\DRIVERS\audstub.sys Address: 0xF8DF7000 Size: 4096 bytes Driver: C:\WINDOWS\System32\Drivers\BANTExt.sys Address: 0xF8DBE000 Size: 4096 bytes Driver: C:\WINDOWS\System32\drivers\dxgthk.sys Address: 0xF8E7B000 Size: 4096 bytes Driver: C:\WINDOWS\System32\Drivers\Null.SYS Address: 0xF8D9E000 Size: 4096 bytes Driver: PCIIde.sys Address: 0xF8D3F000 Size: 4096 bytes ============================================== >Stealth MBR: MBRCheck, version 1.2.3 © 2010, AD Command-line: Windows Version: Windows XP Home Edition Windows Information: Service Pack 3 (build 2600) Logical Drives Mask: 0x0000009c Kernel Drivers (total 125): 0x804D7000 \WINDOWS\system32\ntoskrnl.exe 0x806FF000 \WINDOWS\system32\hal.dll 0xF8C77000 \WINDOWS\system32\KDCOM.DLL 0xF8B87000 \WINDOWS\system32\BOOTVID.dll 0xF8728000 ACPI.sys 0xF8C79000 \WINDOWS\system32\DRIVERS\WMILIB.SYS 0xF8717000 pci.sys 0xF8777000 isapnp.sys 0xF8787000 ohci1394.sys 0xF8797000 \WINDOWS\system32\DRIVERS\1394BUS.SYS 0xF8D3F000 PCIIde.sys 0xF89F7000 \WINDOWS\System32\Drivers\PCIIDEX.SYS 0xF8C7B000 intelide.sys 0xF87A7000 MountMgr.sys 0xF86F8000 ftdisk.sys 0xF89FF000 PartMgr.sys 0xF8A07000 pavboot.sys 0xF87B7000 VolSnap.sys 0xF86E0000 atapi.sys 0xF87C7000 disk.sys 0xF87D7000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS 0xF86C0000 fltmgr.sys 0xF86A9000 KSecDD.sys 0xF861C000 Ntfs.sys 0xF85EF000 NDIS.sys 0xF85D5000 Mup.sys 0xF87E7000 agp440.sys 0xF8817000 \SystemRoot\system32\DRIVERS\intelppm.sys 0xF83BD000 \SystemRoot\system32\DRIVERS\nv4_mini.sys 0xF83A9000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS 0xF8A57000 \SystemRoot\system32\DRIVERS\usbuhci.sys 0xF8385000 \SystemRoot\system32\DRIVERS\USBPORT.SYS 0xF8A5F000 \SystemRoot\system32\DRIVERS\usbehci.sys 0xF82F3000 \SystemRoot\system32\DRIVERS\es56hpi.sys 0xF8A6F000 \SystemRoot\System32\Drivers\Modem.SYS 0xF8827000 \SystemRoot\system32\DRIVERS\i8042prt.sys 0xF8A7F000 \SystemRoot\system32\DRIVERS\kbdclass.sys 0xF8837000 \SystemRoot\system32\DRIVERS\serial.sys 0xF8C0B000 \SystemRoot\system32\DRIVERS\serenum.sys 0xF82DF000 \SystemRoot\system32\DRIVERS\parport.sys 0xF8847000 \SystemRoot\system32\DRIVERS\cdrom.sys 0xF8857000 \SystemRoot\system32\DRIVERS\redbook.sys 0xF82BC000 \SystemRoot\system32\DRIVERS\ks.sys 0xF8867000 \SystemRoot\system32\DRIVERS\imapi.sys 0xF827C000 \SystemRoot\system32\drivers\smwdm.sys 0xF8258000 \SystemRoot\system32\drivers\portcls.sys 0xF8877000 \SystemRoot\system32\drivers\drmk.sys 0xF8238000 \SystemRoot\system32\drivers\aeaudio.sys 0xF81DA000 \SystemRoot\system32\drivers\senfilt.sys 0xF8AA7000 \SystemRoot\system32\drivers\sf.sys 0xF8DF7000 \SystemRoot\system32\DRIVERS\audstub.sys 0xF8887000 \SystemRoot\system32\DRIVERS\rasl2tp.sys 0xF8C27000 \SystemRoot\system32\DRIVERS\ndistapi.sys 0xF81C3000 \SystemRoot\system32\DRIVERS\ndiswan.sys 0xF8897000 \SystemRoot\system32\DRIVERS\raspppoe.sys 0xF88A7000 \SystemRoot\system32\DRIVERS\raspptp.sys 0xF8AC7000 \SystemRoot\system32\DRIVERS\TDI.SYS 0xF8AD7000 \SystemRoot\system32\DRIVERS\ptilink.sys 0xF8AE7000 \SystemRoot\system32\DRIVERS\raspti.sys 0xF88B7000 \SystemRoot\system32\DRIVERS\termdd.sys 0xF8AEF000 \SystemRoot\system32\DRIVERS\mouclass.sys 0xF8C83000 \SystemRoot\system32\DRIVERS\swenum.sys 0xF80C5000 \SystemRoot\system32\DRIVERS\update.sys 0xF8C3B000 \SystemRoot\system32\DRIVERS\mssmbios.sys 0xF80B1000 \SystemRoot\system32\DRIVERS\vodafone_K3805-z_dc_enum.sys 0xF88C7000 \SystemRoot\system32\DRIVERS\WDFLDR.SYS 0xF8040000 \SystemRoot\System32\Drivers\wdf01000.sys 0xF88D7000 \SystemRoot\System32\Drivers\NDProxy.SYS 0xF88E7000 \SystemRoot\system32\DRIVERS\usbhub.sys 0xF8C8F000 \SystemRoot\system32\DRIVERS\USBD.SYS 0xF8C93000 \SystemRoot\System32\Drivers\Fs_Rec.SYS 0xF8D9E000 \SystemRoot\System32\Drivers\Null.SYS 0xF8C97000 \SystemRoot\System32\Drivers\Beep.SYS 0xF8B37000 \SystemRoot\System32\drivers\vga.sys 0xF8C9B000 \SystemRoot\System32\Drivers\mnmdd.SYS 0xF8C9F000 \SystemRoot\System32\DRIVERS\RDPCDD.sys 0xF8B47000 \SystemRoot\System32\Drivers\Msfs.SYS 0xF8B57000 \SystemRoot\System32\Drivers\Npfs.SYS 0xF85A9000 \SystemRoot\system32\DRIVERS\rasacd.sys 0xF88F7000 \??\C:\WINDOWS\system32\drivers\OAnet.sys 0xF6EBD000 \SystemRoot\system32\DRIVERS\ipsec.sys 0xF8907000 \SystemRoot\system32\DRIVERS\msgpc.sys 0xF6E64000 \SystemRoot\system32\DRIVERS\tcpip.sys 0xF8B6F000 \??\C:\WINDOWS\system32\drivers\OAmon.sys 0xF8917000 \SystemRoot\system32\DRIVERS\wanarp.sys 0xF6E3C000 \SystemRoot\system32\DRIVERS\netbt.sys 0xF6E1A000 \SystemRoot\System32\drivers\afd.sys 0xF8927000 \SystemRoot\system32\DRIVERS\netbios.sys 0xF8B7F000 \SystemRoot\system32\DRIVERS\ssmdrv.sys 0xF6DEF000 \SystemRoot\system32\DRIVERS\rdbss.sys 0xF6DA5000 \??\C:\WINDOWS\system32\drivers\OADriver.sys 0xF8C03000 \SystemRoot\system32\DRIVERS\hidusb.sys 0xF8937000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS 0xF8A4F000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS 0xF6D35000 \SystemRoot\system32\DRIVERS\mrxsmb.sys 0xF8947000 \SystemRoot\System32\Drivers\Fips.SYS 0xF8DBE000 \SystemRoot\System32\Drivers\BANTExt.sys 0xF8C0F000 \SystemRoot\system32\DRIVERS\mouhid.sys 0xF6D13000 \SystemRoot\system32\DRIVERS\avipbb.sys 0xF8CA5000 \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys 0xF8977000 \SystemRoot\System32\Drivers\Cdfs.SYS 0xF6C33000 \SystemRoot\System32\Drivers\dump_atapi.sys 0xF8CAB000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS 0xBF800000 \SystemRoot\System32\win32k.sys 0xF8018000 \SystemRoot\System32\drivers\Dxapi.sys 0xF8A9F000 \SystemRoot\System32\watchdog.sys 0xBF000000 \SystemRoot\System32\drivers\dxg.sys 0xF8E7B000 \SystemRoot\System32\drivers\dxgthk.sys 0xBF012000 \SystemRoot\System32\nv4_disp.dll 0xBFFA0000 \SystemRoot\System32\ATMFD.DLL 0xF5CBE000 \SystemRoot\system32\DRIVERS\avgntflt.sys 0xF5CF3000 \SystemRoot\system32\DRIVERS\ndisuio.sys 0xF5961000 \SystemRoot\system32\drivers\wdmaud.sys 0xF5AAE000 \SystemRoot\system32\drivers\sysaudio.sys 0xF8CC9000 \SystemRoot\System32\Drivers\ParVdm.SYS 0xF58CE000 \SystemRoot\System32\Drivers\HTTP.sys 0xF8B77000 \SystemRoot\system32\DRIVERS\usbccgp.sys 0xF5368000 \SystemRoot\system32\DRIVERS\ZTEusbser6k.sys 0xF533D000 \SystemRoot\system32\DRIVERS\ZTEusbnmea.sys 0xF5312000 \SystemRoot\system32\DRIVERS\ZTEusbvoice.sys 0xF52D6000 \SystemRoot\system32\DRIVERS\ZTEusbmdm6k.sys 0xF8A17000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS 0xF53FD000 \SystemRoot\system32\DRIVERS\asyncmac.sys 0xF5143000 \SystemRoot\system32\drivers\kmixer.sys 0x7C900000 \WINDOWS\system32\ntdll.dll Processes (total 23): 0 System Idle Process 4 System 296 C:\WINDOWS\system32\smss.exe 344 csrss.exe 368 C:\WINDOWS\system32\winlogon.exe 412 C:\WINDOWS\system32\services.exe 424 C:\WINDOWS\system32\lsass.exe 616 C:\WINDOWS\system32\svchost.exe 660 svchost.exe 716 C:\WINDOWS\system32\svchost.exe 856 C:\Program Files\Tall Emu\Online Armor\oacat.exe 888 C:\Program Files\Tall Emu\Online Armor\oasrv.exe 1068 C:\WINDOWS\explorer.exe 1160 C:\Program Files\Avira\AntiVir Desktop\sched.exe 1264 svchost.exe 1276 C:\Program Files\Avira\AntiVir Desktop\avguard.exe 1324 C:\WINDOWS\system32\svchost.exe 1348 C:\WINDOWS\system32\svchost.exe 1552 C:\Program Files\Avira\AntiVir Desktop\avshadow.exe 1016 C:\Program Files\Avira\AntiVir Desktop\avgnt.exe 1172 C:\Program Files\Tall Emu\Online Armor\oaui.exe 1572 C:\Program Files\Tall Emu\Online Armor\oahlp.exe 1964 C:\Documents and Settings\peta\desktop\MBRCheck.exe \\.\C: –> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS) PhysicalDrive0 Model Number: WDCWD2000JS-55NCB1, Rev: 10.02E01 Size Device Name MBR Status ——————————————– 186 GB \\.\PhysicalDrive0 Windows XP MBR code detected SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A Done! Thank you. What next? winona
Post #13
Also, I forgot to mention that I was unable to restart system restore. I don't recall turning it off to begin with. Each time I try to open it, I get the same message that system restore is unable to protect my computer, restart and try enabling it again. This is what the event viewer says: Event Type: Error Event Source: Service Control Manager Event Category: None Event ID: 7023 Description: The System Restore Service service terminated with the following error: The system cannot find the file specified. Also, while playing games yesterday, I had a bsd. Of course I have no idea if that was related to anything here - there was nothing out of the ordinary happening beforehand… I did write down what was on the screen but, I'm such a tool that I can't read my writing, now. All I can make out is, "IRQL_NOT_LESS_OR_EQUAL" and, 0x804E2427. Thanks, again. winona
Post #14
Hi winona,

Conspire is having internet problems at the moment. I'll assist you until he can get that resolved.

Next, create this batch file.

Open a new Notepad session
  • Click the Start button, click run
  • in the run box type notepad
  • click ok
  • In the notepad, Click "Format" and be certain that Word Wrap is not checked.
  • Copy and paste all the text in the code box below into the Notepad.
Do Not copy the word CODE

@echo off
reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager" /v BootExecute > result.txt
start result.txt
del %0

In the notepad
  • Click File, Save as…, and set the Save in to your Desktop
  • In the filename box, type (including quotation marks) as the filename: "bat.bat"
  • Click save

You will have a new file on your desktop called myfix.bat with an icon that looks like this 📎bat.PNG

Double click bat.bat to run it.

A notepad named result.txt will open,(it can also be found on the desktop), please post it's contents.


Next

Please run this quick little scan

  • Double click on OTL.exe to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • When the window appears, click the None button near the top (it may looked greyed out)
  • In the window under Custom Scans/Fixes copy and paste the following


    /md5start
    volsnap.*
    /md5stop

  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open a notepad window, OTL.Txt. Please post this log.

Please post back with
  • result.txt
  • OTL.txt

Thanks
Post #15
Thanks very much for your time and attention. Here are the two logs you asked for.

result.txt:


! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager
BootExecute REG_MULTI_SZ ?? \0\0


OTL.Txt

OTL logfile created on: 12/10/2010 8:35:04 AM - Run 4
OTL by OldTimer - Version 3.2.17.3 Folder = C:\Documents and Settings\peta\Desktop\what the tech
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

511.00 Mb Total Physical Memory | 388.00 Mb Available Physical Memory | 76.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 77.00% Paging File free
Paging file location(s): c:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 186.30 Gb Total Space | 175.11 Gb Free Space | 93.99% Space Free | Partition Type: NTFS
Drive H: | 43.48 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: N-0741399D962E4 | User Name: peta | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\peta\desktop\what the tech\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)
MOD - C:\Program Files\Tall Emu\Online Armor\oawatch.dll (Tall Emu)
MOD - C:\WINDOWS\system32\wsock32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\wtsapi32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\winsta.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\iphlpapi.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (WMPNetworkSvc) – File not found
SRV - (ose) – C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE File not found
SRV - (odserv) – C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE File not found
SRV - (HidServ) – C:\WINDOWS\System32\hidserv.dll File not found
SRV - (AppMgmt) – C:\WINDOWS\System32\appmgmts.dll File not found
SRV - (VmbService) – C:\Program Files\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe (Vodafone)
SRV - (SvcOnlineArmor) – C:\Program Files\Tall Emu\Online Armor\oasrv.exe (Tall Emu)
SRV - (OAcat) – C:\Program Files\Tall Emu\Online Armor\OAcat.exe (Tall Emu)
SRV - (AntiVirService) – C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AntiVirSchedulerService) – C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (YahooAUService) – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
SRV - (SoundMAX Agent Service (default)) – C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe (Analog Devices, Inc.)


========== Driver Services (SafeList) ==========

DRV - (massfilter) – C:\WINDOWS\system32\drivers\massfilter.sys (MBB Incorporated)
DRV - (ZTEusbnet) – C:\WINDOWS\system32\drivers\ZTEusbnet.sys (ZTE Corporation)
DRV - (ZTEusbvoice) – C:\WINDOWS\system32\drivers\zteusbvoice.sys (ZTE Incorporated)
DRV - (ZTEusbser6k) – C:\WINDOWS\system32\drivers\ZTEusbser6k.sys (ZTE Incorporated)
DRV - (ZTEusbnmea) – C:\WINDOWS\system32\drivers\ZTEusbnmea.sys (ZTE Incorporated)
DRV - (ZTEusbmdm6k) – C:\WINDOWS\system32\drivers\ZTEusbmdm6k.sys (ZTE Incorporated)
DRV - (OAmon) – C:\WINDOWS\system32\drivers\OAmon.sys (Tall Emu)
DRV - (OAnet) – C:\WINDOWS\system32\drivers\OAnet.sys (Tall Emu Pty Ltd)
DRV - (OADevice) – C:\WINDOWS\system32\drivers\OADriver.sys (Tall Emu)
DRV - (vodafone_K3805-z_dc_enum) – C:\WINDOWS\system32\drivers\vodafone_K3805-z_dc_enum.sys (Vodafone)
DRV - (avipbb) – C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH)
DRV - (SASDIFSV) – C:\Program Files\SUPERAntiSpyware\sasdifsv.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (avgntflt) – C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH)
DRV - (pavboot) – C:\WINDOWS\system32\drivers\pavboot.sys (Panda Security, S.L.)
DRV - (avgio) – C:\Program Files\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (ssmdrv) – C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (usbaudio) USB Audio Driver (WDM) – C:\WINDOWS\system32\drivers\USBAUDIO.sys (Microsoft Corporation)
DRV - (BANTExt) – C:\WINDOWS\System32\Drivers\BANTExt.sys ()
DRV - (k750obex) – C:\WINDOWS\system32\drivers\k750obex.sys (MCCI)
DRV - (k750mgmt) – C:\WINDOWS\system32\drivers\k750mgmt.sys (MCCI)
DRV - (k750mdm) – C:\WINDOWS\system32\drivers\k750mdm.sys (MCCI)
DRV - (k750mdfl) – C:\WINDOWS\system32\drivers\k750mdfl.sys (MCCI)
DRV - (k750bus) Sony Ericsson 750 driver (WDM) – C:\WINDOWS\system32\drivers\k750bus.sys (MCCI)
DRV - (sf) – C:\WINDOWS\system32\drivers\sf.sys (Sonic Focus, Inc)
DRV - (nv) – C:\WINDOWS\system32\drivers\nv4_mini.sys (NVIDIA Corporation)
DRV - (senfilt) – C:\WINDOWS\system32\drivers\senfilt.sys (Sensaura)
DRV - (ovt519) – C:\WINDOWS\system32\drivers\ov519vid.sys (OmniVision Technologies, Inc.)
DRV - (MidiSyn) – C:\WINDOWS\system32\drivers\MidiSyn.sys (Analog Devices Inc)
DRV - (Edspport) – C:\WINDOWS\system32\drivers\es56hpi.sys (ESS Technology, Inc.)
DRV - (ac97intc) Intel® 82801 Audio Driver Install Service (WDM) – C:\WINDOWS\system32\drivers\ac97intc.sys (Intel Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://home.microsoft.com/search/search.asp

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://home.microsoft.com/search/search.asp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = [Binary data over 100 bytes]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.update: false
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.kongregate.com/games/caesary/caesary"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: [removed]:1.0.4
FF - prefs.js..extensions.enabledItems: {5C655500-E712-41e7-9349-CE462F844B19}:0.4.5
FF - prefs.js..extensions.enabledItems: {71328583-3CA7-4809-B4BA-570A85818FBB}:0.6.3
FF - prefs.js..extensions.enabledItems: {73a6fe31-595d-460b-a920-fcc0f8843232}:2.0.1
FF - prefs.js..extensions.enabledItems: {9669CC8F-B388-42FE-86F4-CB5E7F5A8BDC}:6.0.4
FF - prefs.js..extensions.enabledItems: {dd3d7613-0246-469d-bc65-2a3cc1668adc}:0.7.1.1
FF - prefs.js..extensions.enabledItems: {E2883E8F-472F-4fb0-9522-AC9BF37916A7}:[removed]
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.8.20100408.6
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.2.2
FF - prefs.js..extensions.enabledItems: {1ebc69c0-92ff-11dc-8314-0800200c9a66}:[removed]
FF - prefs.js..extensions.enabledItems: {29852C08-1E91-4889-A6BF-C77F91D6A8F3}:1.8.63
FF - prefs.js..network.proxy.type: 4

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/12/07 04:36:14 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/12/07 04:36:14 | 000,000,000 | —D | M]

[2010/07/03 13:51:12 | 000,000,000 | —D | M] – C:\Documents and Settings\peta\Application Data\Mozilla\Extensions
[2010/12/07 20:14:27 | 000,000,000 | —D | M] – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions
[2010/08/22 08:05:15 | 000,000,000 | —D | M] (Screengrab) – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\{02450954-cdd9-410f-b1da-db804e18c671}(2)
[2010/09/13 13:01:20 | 000,000,000 | —D | M] (IE Tab 2 (FF 3.6+)) – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\{1BC9BA34-1EED-42ca-A505-6D2F1A935BBB}
[2010/08/28 17:38:30 | 000,000,000 | —D | M] (Gnome Classic) – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\{1ebc69c0-92ff-11dc-8314-0800200c9a66}
[2010/08/28 17:57:30 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\{29852C08-1E91-4889-A6BF-C77F91D6A8F3}
[2010/07/18 10:37:30 | 000,000,000 | —D | M] (Quick Translator) – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\{5C655500-E712-41e7-9349-CE462F844B19}
[2010/09/10 20:00:27 | 000,000,000 | —D | M] (Speed Dial) – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\{64161300-e22b-11db-8314-0800200c9a66}
[2010/08/14 15:08:00 | 000,000,000 | —D | M] (CacheViewer) – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\{71328583-3CA7-4809-B4BA-570A85818FBB}
[2010/08/14 15:08:03 | 000,000,000 | —D | M] (NoScript) – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}
[2010/08/22 08:04:43 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\{75623d5d-4683-402a-b610-ac4bab767c86}
[2010/08/22 08:04:43 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\{8965bb4b-c2ca-2b84-6b49-7afb2760518c}
[2010/08/22 08:04:44 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\{8F6A6FD9-0619-459f-B9D0-81DE065D4E21}
[2010/09/10 19:45:17 | 000,000,000 | —D | M] (MR Tech Toolkit) – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\{9669CC8F-B388-42FE-86F4-CB5E7F5A8BDC}
[2010/09/18 02:13:26 | 000,000,000 | —D | M] (Adblock Plus) – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010/08/22 08:04:43 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\{d8b271a6-6ed3-427d-b600-1b674e00e6ec}
[2010/08/31 13:55:29 | 000,000,000 | —D | M] (BlockSite) – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\{dd3d7613-0246-469d-bc65-2a3cc1668adc}
[2010/09/04 13:24:23 | 000,000,000 | —D | M] (Adobe DLM (powered by getPlus®)) – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
[2010/08/08 20:47:28 | 000,000,000 | —D | M] (Greasemonkey) – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2010/08/22 08:04:42 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\{ef62e1ce-d2a4-4cdd-b7ec-92b120366b66}
[2010/08/22 08:04:42 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\{FDD8ECF0-451A-414D-8C8F-7B7F78B0ECD3}
[2010/08/22 08:05:12 | 000,000,000 | —D | M] – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\bizdom@wizbites(2).com
[2010/08/07 15:36:46 | 000,000,000 | —D | M] – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\[removed]
[2010/09/13 13:01:22 | 000,000,000 | —D | M] – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\[removed]
[2010/08/22 08:04:43 | 000,000,000 | —D | M] – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\[removed]
[2010/09/07 18:55:20 | 000,000,000 | —D | M] – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\PlacesCleaner@sto(2).tw
[2010/08/22 08:05:15 | 000,000,000 | —D | M] – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\extensions\VacuumPlacesImproved@lultimouomo-gmail(2).com
[2010/08/08 22:18:30 | 000,002,377 | —- | M] () – C:\Documents and Settings\peta\Application Data\Mozilla\Firefox\Profiles\q47izuer.default\searchplugins\kongregate.xml
[2010/12/07 20:14:27 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2010/09/07 19:40:51 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/07/03 13:41:41 | 000,411,368 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll

O1 HOSTS File: ([2010/12/03 01:05:48 | 000,426,615 | R— | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 127.0.0.1 1-domains-registrations.com
O1 - Hosts: 127.0.0.1 www.1-domains-registrations.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 14693 more lines…
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O4 - HKLM..\Run: [@OnlineArmor GUI] C:\Program Files\Tall Emu\Online Armor\OAui.exe (Tall Emu)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O15 - HKCU\..Trusted Domains: eset.com.au ([www] http in Trusted sites)
O15 - HKCU\..Trusted Domains: live.com ([explore] http in Trusted sites)
O15 - HKCU\..Trusted Domains: microsoft.com ([*.update] http in Trusted sites)
O15 - HKCU\..Trusted Domains: microsoft.com ([*.update] https in Trusted sites)
O15 - HKCU\..Trusted Domains: microsoft.com ([go] http in Trusted sites)
O15 - HKCU\..Trusted Domains: microsoft.com ([update] http in Trusted sites)
O15 - HKCU\..Trusted Domains: microsoft.com ([update] https in Trusted sites)
O15 - HKCU\..Trusted Domains: mozilla.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: windowsupdate.com ([download] http in Trusted sites)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/…b?1278136636609 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/microsoftu…b?1278138757015 (MUWebControl Class)
O18 - Protocol\Handler\belarc {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files\Belarc\Advisor\System\BAVoilaX.dll (Belarc, Inc.)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - Reg Error: Key error. File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - CLSID or File not found.
O24 - Desktop WallPaper: C:\Documents and Settings\peta\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\peta\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {4F07DA45-8170-4859-9B5F-037EF2970034} - C:\Program Files\Tall Emu\Online Armor\oaevent.dll (Tall Emu)
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/07/03 06:04:52 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2010/06/26 01:16:32 | 000,000,118 | R— | M] () - H:\autorun.inf – [ CDFS ]
O33 - MountPoints2\{cb628957-e9ee-11df-b52b-ff2579a219ff}\Shell - "" = AutoRun
O33 - MountPoints2\{cb628957-e9ee-11df-b52b-ff2579a219ff}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{cb628957-e9ee-11df-b52b-ff2579a219ff}\Shell\AutoRun\command - "" = F:\setup_vmb_lite.exe – File not found
O33 - MountPoints2\{cb62895c-e9ee-11df-b52b-e753b9f80bbb}\Shell - "" = AutoRun
O33 - MountPoints2\{cb62895c-e9ee-11df-b52b-e753b9f80bbb}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{cb62895c-e9ee-11df-b52b-e753b9f80bbb}\Shell\AutoRun\command - "" = H:\setup_vmb_lite.exe – [2010/06/24 21:02:49 | 000,274,432 | R— | M] (Vodafone)
O33 - MountPoints2\F\Shell - "" = AutoRun
O33 - MountPoints2\F\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\setup_vmb_lite.exe – File not found
O33 - MountPoints2\H\Shell - "" = AutoRun
O33 - MountPoints2\H\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\H\Shell\AutoRun\command - "" = H:\setup_vmb_lite.exe – [2010/06/24 21:02:49 | 000,274,432 | R— | M] (Vodafone)
O34 - HKLM BootExecute: (콈ʫ뱝粑) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/12/09 12:34:11 | 000,000,000 | RH-D | C] – C:\Documents and Settings\peta\Recent
[2010/12/08 22:10:02 | 000,000,000 | —D | C] – C:\RkUnhooker
[2010/12/07 19:24:28 | 000,000,000 | —D | C] – C:\WINDOWS\TEMP
[2010/12/07 18:34:56 | 000,000,000 | —D | C] – C:\WINDOWS\System32\XPSViewer
[2010/12/07 18:34:52 | 000,000,000 | —D | C] – C:\Program Files\MSBuild
[2010/12/07 18:34:38 | 000,000,000 | —D | C] – C:\Program Files\Reference Assemblies
[2010/12/07 18:34:00 | 000,597,504 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\printfilterpipelinesvc.exe
[2010/12/07 18:34:00 | 000,575,488 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\xpsshhdr.dll
[2010/12/07 18:34:00 | 000,117,760 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\prntvpt.dll
[2010/12/07 18:34:00 | 000,089,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\filterpipelineprintproc.dll
[2010/12/07 18:33:59 | 001,676,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xpssvcs.dll
[2010/12/07 18:33:59 | 001,676,288 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\xpssvcs.dll
[2010/12/07 18:33:58 | 000,000,000 | —D | C] – C:\8827119d00aeaa12ea
[2010/12/06 20:02:09 | 000,000,000 | —D | C] – C:\Documents and Settings\peta\Desktop\what the tech
[2010/12/04 09:00:17 | 000,000,000 | —D | C] – C:\Program Files\Trend Micro
[2010/12/03 00:47:06 | 000,000,000 | —D | C] – C:\Program Files\Spybot - Search & Destroy
[2010/12/03 00:47:06 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
[2010/11/23 16:29:08 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Help
[2010/11/23 16:29:08 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Application Data\Help
[2010/11/23 16:16:38 | 000,000,000 | —D | C] – C:\Documents and Settings\peta\Local Settings\Application Data\Identities
[2010/11/23 13:36:44 | 000,201,216 | —- | C] (Lexmark International, Inc.) – C:\WINDOWS\System32\LEXP2P32.DLL
[2010/11/23 13:36:43 | 000,196,096 | —- | C] (Lexmark International, Inc.) – C:\WINDOWS\System32\LEX2KUSB.DLL
[2010/11/23 13:36:43 | 000,147,456 | —- | C] (Lexmark International, Inc.) – C:\WINDOWS\System32\LEXBCE.DLL
[2010/11/23 13:36:38 | 000,192,512 | —- | C] (Lexmark International, Inc.) – C:\WINDOWS\System32\LEXLMPM.DLL
[2010/11/23 13:36:25 | 000,015,104 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\usbscan.sys
[2010/11/23 13:36:21 | 000,087,040 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\wiafbdrv.dll
[2010/11/23 13:36:21 | 000,087,040 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wiafbdrv.dll
[2010/11/23 13:35:31 | 000,025,856 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\usbprint.sys
[2010/11/23 13:31:05 | 000,299,520 | —- | C] (InstallShield Corporation, Inc.) – C:\WINDOWS\uninst.exe
[2010/11/23 13:31:00 | 000,000,000 | —D | C] – C:\Documents and Settings\peta\WINDOWS
[2010/11/23 12:51:53 | 000,000,000 | —D | C] – C:\Documents and Settings\peta\Local Settings\Application Data\ApplicationHistory
[2010/11/22 22:06:55 | 000,017,272 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\spmsg.dll
[2010/11/22 22:06:07 | 000,000,000 | —D | C] – C:\Program Files\Windows Media Connect 2
[2010/11/22 22:02:55 | 000,000,000 | —D | C] – C:\WINDOWS\System32\drivers\UMDF
[2010/11/22 22:02:55 | 000,000,000 | —D | C] – C:\WINDOWS\System32\LogFiles
[2010/11/21 21:29:59 | 000,000,000 | —D | C] – C:\WINDOWS\.jagex_cache_32
[2010/11/11 17:52:04 | 000,000,000 | —D | C] – C:\WINDOWS\RegisteredPackages
[2010/11/11 17:51:05 | 002,388,176 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx9_30.dll
[2010/11/11 17:51:03 | 002,323,664 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx9_28.dll
[2010/11/10 16:30:08 | 000,000,000 | —D | C] – C:\Documents and Settings\peta\Application Data\FLEXnet
[2010/11/10 14:08:18 | 000,009,216 | R— | C] (MBB Incorporated) – C:\WINDOWS\System32\drivers\massfilter.sys
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/12/09 14:19:22 | 000,988,981 | —- | M] () – C:\Documents and Settings\peta\Desktop\monk related.jpg
[2010/12/09 12:35:07 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/12/09 12:35:03 | 535,613,440 | -HS- | M] () – C:\hiberfil.sys
[2010/12/07 20:06:51 | 000,495,124 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/12/07 20:06:51 | 000,077,968 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2010/12/07 19:36:11 | 000,013,672 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/12/07 19:24:14 | 000,157,160 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2010/12/03 01:05:48 | 000,426,615 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2010/12/03 00:54:23 | 000,426,615 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts.20101203-010548.backup
[2010/11/25 06:11:29 | 000,000,167 | —- | M] () – C:\__mfdel.bat
[2010/11/23 20:55:29 | 000,000,311 | —- | M] () – C:\WINDOWS\lexstat.ini
[2010/11/23 12:41:36 | 000,000,310 | —- | M] () – C:\WINDOWS\System32\mformlite.cfg
[2010/11/23 10:19:03 | 000,626,688 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\msvcr80.dll
[2010/11/22 22:03:04 | 000,000,000 | -H– | M] () – C:\WINDOWS\System32\drivers\UMDF\MsftWdf_user_01_00_00.Wdf
[2010/11/21 22:55:13 | 000,000,099 | —- | M] () – C:\Documents and Settings\peta\jagex_runescape_preferences2.dat
[2010/11/21 22:10:58 | 000,000,046 | —- | M] () – C:\Documents and Settings\peta\jagex_runescape_preferences.dat
[2010/11/11 17:52:27 | 000,316,640 | —- | M] () – C:\WINDOWS\WMSysPr9.prx
[2010/11/10 15:36:21 | 000,000,582 | —- | M] () – C:\Documents and Settings\All Users\Desktop\vodafone.lnk
[2010/11/10 15:28:35 | 000,000,211 | -HS- | M] () – C:\boot.ini
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/12/09 14:19:18 | 000,988,981 | —- | C] () – C:\Documents and Settings\peta\Desktop\monk related.jpg
[2010/12/05 20:22:21 | 535,613,440 | -HS- | C] () – C:\hiberfil.sys
[2010/11/25 06:11:29 | 000,000,167 | —- | C] () – C:\__mfdel.bat
[2010/11/23 13:37:16 | 000,000,311 | —- | C] () – C:\WINDOWS\lexstat.ini
[2010/11/23 12:41:36 | 000,000,310 | —- | C] () – C:\WINDOWS\System32\mformlite.cfg
[2010/11/22 22:03:04 | 000,000,000 | -H– | C] () – C:\WINDOWS\System32\drivers\UMDF\MsftWdf_user_01_00_00.Wdf
[2010/11/21 21:33:03 | 000,000,099 | —- | C] () – C:\Documents and Settings\peta\jagex_runescape_preferences2.dat
[2010/11/21 21:30:11 | 000,000,046 | —- | C] () – C:\Documents and Settings\peta\jagex_runescape_preferences.dat
[2010/11/10 15:36:21 | 000,000,582 | —- | C] () – C:\Documents and Settings\All Users\Desktop\vodafone.lnk
[2010/11/07 05:55:32 | 000,016,968 | —- | C] () – C:\WINDOWS\System32\drivers\hitmanpro35.sys
[2010/10/30 16:49:16 | 000,003,584 | —- | C] () – C:\Documents and Settings\peta\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/07/18 22:32:24 | 000,219,136 | —- | C] () – C:\WINDOWS\sqlite3_engine.dll
[2010/07/18 22:32:20 | 000,219,136 | —- | C] () – C:\WINDOWS\System32\sqlite3_engine.dll
[2010/07/16 19:25:56 | 000,000,144 | —- | C] () – C:\WINDOWS\Eudcedit.ini
[2010/07/16 12:12:30 | 000,000,036 | —- | C] () – C:\Documents and Settings\peta\Local Settings\Application Data\housecall.guid.cache
[2010/07/11 19:41:32 | 000,000,140 | -HS- | C] () – C:\WINDOWS\WSYS049.SYS
[2010/07/10 11:52:24 | 000,003,840 | —- | C] () – C:\WINDOWS\System32\drivers\BANTExt.sys
[2010/07/10 08:26:45 | 000,000,030 | —- | C] () – C:\WINDOWS\System32\drivers\service.ini
[2010/07/10 08:24:22 | 000,000,044 | —- | C] () – C:\WINDOWS\System32\msssc.dll
[2010/07/10 08:21:04 | 000,002,124 | —- | C] () – C:\WINDOWS\Ascd_tmp.ini
[2010/07/10 08:20:55 | 000,005,824 | —- | C] () – C:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[2010/07/03 13:51:28 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2010/06/21 18:05:34 | 000,157,470 | R— | C] () – C:\Documents and Settings\All Users\Application Data\DeviceManager.xml.rc4

========== Custom Scans ==========



< MD5 for: VOLSNAP.INF >
[2004/08/04 20:00:00 | 000,001,095 | —- | M] () MD5=1C43F4D998567C9D2463E18669F33A3C – C:\WINDOWS\inf\volsnap.inf

< MD5 for: VOLSNAP.PNF >
[2010/07/03 07:00:28 | 000,004,964 | —- | M] () MD5=134C4158CC7E8A992810CCF28FFDA06E – C:\WINDOWS\inf\volsnap.PNF

< MD5 for: VOLSNAP.SYS >
[2008/04/14 02:41:01 | 000,052,352 | —- | M] (Microsoft Corporation) MD5=4C8FCB5CC53AAB716D810740FE59D025 – C:\WINDOWS\ServicePackFiles\i386\volsnap.sys
[2008/04/14 02:41:01 | 000,052,352 | —- | M] (Microsoft Corporation) MD5=4C8FCB5CC53AAB716D810740FE59D025 – C:\WINDOWS\system32\drivers\volsnap.sys
[2004/08/04 20:00:00 | 000,052,352 | —- | M] (Microsoft Corporation) MD5=EE4660083DEBA849FF6C485D944B379B – C:\WINDOWS\$NtServicePackUninstall$\volsnap.sys

< End of report >


I hope I did that correctly.
winona

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI