Need Help Cleaning PC

Hi I had made a thread earlier, but it was locked because I didn't respond within 3 days. Here's the original post + OTL & GMER reports. Thanks!


———————————————————————————–


Hello, thank you to anyone who is willing to help me. My computer hasn't been running like it used to in a long time. Now its worse then ever. It's time I got it all squared away with. Everyone I restart my computer, I'll get a black screen until I Ctrl+Alt+Dlt and close down the service LVComSer.exe or whatever it is. Here's my Hijack this log. —–



Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 6:51:57 PM, on 11/30/2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.21183)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Steam\Steam.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Trend Micro\HijackThis\HiJackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O1 - Hosts: ::1 localhost
O1 - Hosts: 91.212.127.226 os-guardpro.com
O1 - Hosts: 91.212.127.226 www.os-guardpro.com
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [Tzezamajuxuges] rundll32.exe "C:\WINDOWS\agojevul.dll",Startup
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.EXE /auto
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-18\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'Default user')
O4 - S-1-5-18 Startup: setup_9.0.0.722_01.12.2010_00-16.lnk = C:\Documents and Settings\Administrator\Desktop\Virus Removal Tool\setup_9.0.0.722_01.12.2010_00-16\startup.exe (User 'SYSTEM')
O4 - S-1-5-18 Startup: wwwpos32.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: setup_9.0.0.722_01.12.2010_00-16.lnk = C:\Documents and Settings\Administrator\Desktop\Virus Removal Tool\setup_9.0.0.722_01.12.2010_00-16\startup.exe (User 'Default user')
O4 - .DEFAULT Startup: wwwpos32.exe (User 'Default user')
O4 - Startup: setup_9.0.0.722_01.12.2010_00-16.lnk = C:\Documents and Settings\Administrator\Desktop\Virus Removal Tool\setup_9.0.0.722_01.12.2010_00-16\startup.exe
O4 - Startup: wwwpos32.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - Cmdmapping - (no file) (HKCU)
O9 - Extra button: UltimateBet - {1FBA04EE-3024-11d2-8F1F-0000F87ABD16} - C:\WINDOWS\system32\shdocvw.dll (HKCU)
O9 - Extra 'Tools' menuitem: UltimateBet - {1FBA04EE-3024-11d2-8F1F-0000F87ABD16} - C:\WINDOWS\system32\shdocvw.dll (HKCU)
O16 - DPF: {4E218431-2F07-40BD-A9D3-035324C1F13F} (DyynoX Class) - http://webserver.dyyno.com/DyynoClient/DyynoCAB.CAB
O16 - DPF: {EF0D1A14-1033-41A2-A589-240C01EDC078} (PPLive Lite Class) - http://dl.pplive.com/PluginSetup.cab
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

OTL Log


OTL logfile created on: 12/5/2010 12:53:42 PM - Run 1
OTL by OldTimer - Version 3.2.17.3 Folder = C:\Documents and Settings\Administrator\My Documents\Downloads
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 72.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 90.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 298.08 Gb Total Space | 118.15 Gb Free Space | 39.64% Space Free | Partition Type: NTFS

Computer Name: BRUM | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Administrator\My Documents\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe (Google Inc.)
PRC - C:\Program Files\Steam\Steam.exe (Valve Corporation)
PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe (ESET)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\AIM\aim.exe (America Online, Inc.)


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Administrator\My Documents\Downloads\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\agojevul.dll ()


========== Win32 Services (SafeList) ==========

SRV - (Apple Mobile Device) – C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (EhttpSrv) – C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe (ESET)
SRV - (ekrn) – C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe (ESET)
SRV - (LVSrvLauncher) – C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe (Logitech Inc.)
SRV - (LVPrcSrv) – C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe (Logitech Inc.)
SRV - (LVCOMSer) – C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe (Logitech Inc.)


========== Driver Services (SafeList) ==========

DRV - (RTLWUSB) – C:\WINDOWS\System32\DRIVERS\wg111v2.sys File not found
DRV - (AmdLLD) – C:\WINDOWS\System32\DRIVERS\AmdLLD.sys File not found
DRV - (dxdiag) – C:\Documents and Settings\Administrator\Local Settings\temp\dxdiag.sys ()
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) – C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (Monfilt) – C:\WINDOWS\system32\drivers\Monfilt.sys (Creative Technology Ltd.)
DRV - (Ambfilt) – C:\WINDOWS\system32\drivers\Ambfilt.sys (Creative)
DRV - (34042852) – C:\WINDOWS\system32\DRIVERS\34042852.sys (Kaspersky Lab)
DRV - (setup_9.0.0.722_01.12.2010_00-16drv) – C:\WINDOWS\system32\drivers\3404285.sys (Kaspersky Lab)
DRV - (34042851) – C:\WINDOWS\system32\drivers\34042851.sys (Kaspersky Lab)
DRV - (gmer) – C:\WINDOWS\system32\drivers\gmer.sys (GMER)
DRV - (nv) – C:\WINDOWS\system32\drivers\nv4_mini.sys (NVIDIA Corporation)
DRV - (epfwtdir) – C:\WINDOWS\system32\drivers\epfwtdir.sys ()
DRV - (easdrv) – C:\WINDOWS\system32\drivers\easdrv.sys (ESET)
DRV - (eamon) – C:\WINDOWS\system32\drivers\eamon.sys (ESET)
DRV - (FilterService) – C:\WINDOWS\system32\drivers\lvuvcflt.sys (Logitech Inc.)
DRV - (LVUVC) Logitech QuickCam S5500(UVC) – C:\WINDOWS\system32\drivers\lvuvc.sys (Logitech Inc.)
DRV - (LVUSBSta) – C:\WINDOWS\system32\drivers\LVUSBSta.sys (Logitech Inc.)
DRV - (LVRS) – C:\WINDOWS\system32\drivers\lvrs.sys (Logitech Inc.)
DRV - (LVPr2Mon) – C:\WINDOWS\system32\drivers\LVPr2Mon.sys ()
DRV - (LVcKap) – C:\WINDOWS\system32\drivers\Lvckap.sys (Logitech Inc.)
DRV - (HDAudBus) – C:\WINDOWS\system32\drivers\hdaudbus.sys (Windows ® Server 2003 DDK provider)
DRV - (ATITool) – C:\WINDOWS\system32\drivers\ATITool.sys ()
DRV - (RTLE8023xp) – C:\WINDOWS\system32\drivers\Rtenicxp.sys (Realtek Semiconductor Corporation )
DRV - (usbaudio) USB Audio Driver (WDM) – C:\WINDOWS\system32\drivers\USBAUDIO.sys (Microsoft Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,AlwaysUseDefaultPrinter = yes
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.google.com/"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.2.1
FF - prefs.js..extensions.enabledItems: [removed]:1.11.6
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.8.20100211.5
FF - prefs.js..extensions.enabledItems: [removed]:1.0.0.%(version)s
FF - prefs.js..extensions.enabledItems: {46551EC9-40F0-4e47-8E18-8E5CF550CFB8}:1.0.8
FF - prefs.js..extensions.enabledItems: {975D3128-E174-44F8-B0BB-C509D87032F2}:1.9.1
FF - prefs.js..extensions.enabledItems: vshare@toolbar:1.0.0
FF - prefs.js..extensions.enabledItems: {5c8bfb7c-9a54-11dc-8314-0800200c9a66}:3.6.3
FF - prefs.js..extensions.enabledItems: {c1dffba0-628e-11d9-9669-0800200c9a66}:3.5.0

FF - HKLM\software\mozilla\Firefox\Extensions\\{975D3128-E174-44F8-B0BB-C509D87032F2}: C:\Documents and Settings\Administrator\Local Settings\Application Data\{975D3128-E174-44F8-B0BB-C509D87032F2} [2010/02/03 04:13:57 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.13\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/09/16 14:47:39 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.13\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/09/16 14:47:39 | 000,000,000 | —D | M]

[2008/09/07 19:31:43 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Mozilla\Extensions
[2010/10/17 12:48:13 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\n3x1lb06.default\extensions
[2010/02/27 02:48:25 | 000,000,000 | —D | M] (Stylish) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\n3x1lb06.default\extensions\{46551EC9-40F0-4e47-8E18-8E5CF550CFB8}
[2010/02/27 02:48:00 | 000,000,000 | —D | M] (Aero Fox) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\n3x1lb06.default\extensions\{5c8bfb7c-9a54-11dc-8314-0800200c9a66}
[2009/09/26 15:39:09 | 000,000,000 | —D | M] (PitchDark) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\n3x1lb06.default\extensions\{c1dffba0-628e-11d9-9669-0800200c9a66}
[2010/07/24 11:24:12 | 000,000,000 | —D | M] (Adblock Plus) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\n3x1lb06.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010/02/27 02:48:17 | 000,000,000 | —D | M] (Greasemonkey) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\n3x1lb06.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2010/02/27 02:48:06 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\n3x1lb06.default\extensions\[removed]
[2010/02/27 02:48:09 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\n3x1lb06.default\extensions\[removed]-trash
[2010/10/17 12:48:11 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\n3x1lb06.default\extensions\staged-xpis
[2010/10/17 12:48:11 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\n3x1lb06.default\extensions\vshare@toolbar
[2010/02/27 02:48:02 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\n3x1lb06.default\extensions\{5c8bfb7c-9a54-11dc-8314-0800200c9a66}\chrome\mac\browser\extensions
[2010/02/27 02:48:02 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\n3x1lb06.default\extensions\{5c8bfb7c-9a54-11dc-8314-0800200c9a66}\chrome\mac\mozapps\extensions
[2010/02/27 02:48:02 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\n3x1lb06.default\extensions\{5c8bfb7c-9a54-11dc-8314-0800200c9a66}\chrome\win\browser\extensions
[2010/02/27 02:48:02 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\n3x1lb06.default\extensions\{5c8bfb7c-9a54-11dc-8314-0800200c9a66}\chrome\win\mozapps\extensions
[2010/10/17 12:48:13 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2005/12/05 20:31:00 | 000,114,688 | —- | M] () – C:\Program Files\Mozilla Firefox\plugins\npmozax.dll

O1 HOSTS File: ([2010/02/20 05:47:50 | 000,000,108 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O1 - Hosts: 91.212.127.226 os-guardpro.com
O1 - Hosts: 91.212.127.226 www.os-guardpro.com
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [Tzezamajuxuges] C:\WINDOWS\agojevul.DLL ()
O4 - Startup: C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\setup_9.0.0.722_01.12.2010_00-16.lnk = C:\Documents and Settings\Administrator\Desktop\Virus Removal Tool\setup_9.0.0.722_01.12.2010_00-16\startup.exe File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\control panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideLegacyLogonScripts = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideLogoffScripts = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunLogonScriptSync = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunStartupScriptSync = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideStartupScripts = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\restrictions present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMHelp = 01 00 00 00 [binary data]
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoWinKeys = 01 00 00 00 [binary data]
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideLegacyLogonScripts = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideLogoffScripts = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideStartupScripts = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunLogonScriptSync = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunStartupScriptSync = 0
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll (Sun Microsystems, Inc.)
O9 - Extra Button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe (America Online, Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} http://download.microsoft.com/download/F/6…922/wmv9VCM.CAB (Reg Error: Key error.)
O16 - DPF: {4E218431-2F07-40BD-A9D3-035324C1F13F} http://webserver.dyyno.com/DyynoClient/DyynoCAB.CAB (DyynoX Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {EF0D1A14-1033-41A2-A589-240C01EDC078} http://dl.pplive.com/PluginSetup.cab (PPLive Lite Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed] [removed]
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007/01/01 02:04:18 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKCU\…exe [@ = exefile] – Reg Error: Key error. File not found

NetSvcs: 6to4 - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)
Drivers32: vidc.ffds - C:\Program Files\Combined Community Codec Pack\Filters\FFDShow\ff_vfw.dll ()
Drivers32: VIDC.I420 - C:\WINDOWS\System32\lvcodec2.dll (Logitech Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: VIDC.WMV3 - C:\WINDOWS\System32\wmv9vcm.dll (Microsoft Corporation)
Drivers32: vidc.XVID - C:\WINDOWS\System32\xvidvfw.dll ()
Drivers32: vidc.yv12 - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (16902109354000384)

========== Files/Folders - Created Within 30 Days ==========

[2010/12/01 14:13:53 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Local Settings\Application Data\PCHealth
[2010/11/30 22:22:04 | 000,000,000 | —D | C] – C:\WINDOWS\System32\MpEngineStore
[2010/11/30 18:41:41 | 000,315,408 | —- | C] (Kaspersky Lab) – C:\WINDOWS\System32\drivers\3404285.sys
[2010/11/30 18:41:41 | 000,128,016 | —- | C] (Kaspersky Lab) – C:\WINDOWS\System32\drivers\34042851.sys
[2010/11/30 18:41:41 | 000,037,392 | —- | C] (Kaspersky Lab) – C:\WINDOWS\System32\drivers\34042852.sys
[2010/11/30 18:41:02 | 000,000,000 | —D | C] – C:\Program Files\Trend Micro
[2008/02/09 19:37:53 | 000,047,360 | —- | C] (VSO Software) – C:\Documents and Settings\Administrator\Application Data\pcouffin.sys
[21 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/12/05 12:56:00 | 000,001,010 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1060284298-1078145449-725345543-500UA.job
[2010/12/05 12:55:41 | 000,840,192 | —- | M] () – C:\WINDOWS\System32\drivers\ikipopc.sys
[2010/12/05 12:55:41 | 000,565,248 | —- | M] () – C:\WINDOWS\System32\drivers\rhvcczo.sys
[2010/12/04 22:56:00 | 000,000,958 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1060284298-1078145449-725345543-500Core.job
[2010/12/03 23:45:11 | 000,004,502 | R— | M] () – C:\Documents and Settings\Administrator\Desktop\c.cfg
[2010/12/03 23:24:26 | 000,000,165 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\u.cfg
[2010/12/03 23:22:51 | 000,000,110 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\a.cfg
[2010/12/03 15:56:31 | 000,000,000 | —- | M] () – C:\WINDOWS\Nfaqez.bin
[2010/12/03 14:44:26 | 000,182,844 | —- | M] () – C:\WINDOWS\System32\nvapps.xml
[2010/12/03 14:44:15 | 000,002,206 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/12/03 14:44:14 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/12/02 15:56:24 | 000,002,344 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Google Chrome.lnk
[2010/12/02 15:56:24 | 000,002,322 | —- | M] () – C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2010/12/01 21:16:06 | 000,000,120 | —- | M] () – C:\WINDOWS\Fjedim.dat
[2010/11/30 22:56:35 | 000,133,280 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2010/11/30 22:23:03 | 000,001,393 | —- | M] () – C:\WINDOWS\imsins.BAK
[2010/11/30 22:22:04 | 000,000,947 | —- | M] () – C:\WINDOWS\System32\MRT.INI
[2010/11/30 20:48:14 | 000,000,293 | RHS- | M] () – C:\boot.ini
[2010/11/30 20:41:15 | 000,001,324 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/11/30 18:42:24 | 000,002,274 | —- | M] () – C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\setup_9.0.0.722_01.12.2010_00-16.lnk
[2010/11/26 08:58:00 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/11/11 17:31:59 | 000,432,356 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/11/11 17:31:59 | 000,067,312 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2010/11/07 09:17:09 | 000,001,189 | —- | M] () – C:\Documents and Settings\Administrator\Application Data\vso_ts_preview.xml
[21 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/12/05 03:06:32 | 171,866,883 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\f0rest-vs-attax.dem
[2010/12/05 03:06:23 | 060,723,925 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\f0rest-vs-sk-inferno2-t.dem
[2010/12/05 03:06:19 | 051,187,405 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\f0rest-vs-sk-inferno2-ct.dem
[2010/12/05 01:26:43 | 149,467,933 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\cevo5-jmc_vs_x3o-train.dem
[2010/12/05 01:26:36 | 058,113,872 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\cal-zex_vs_u5-d2-ct.dem
[2010/12/05 01:26:25 | 122,935,807 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\v2r-h5m_vs_d2x-d2.dem
[2010/12/04 06:09:41 | 103,877,317 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\v3x-inferno-group.dem
[2010/12/03 01:52:08 | 000,000,165 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\u.cfg
[2010/11/30 22:18:06 | 000,001,393 | —- | C] () – C:\WINDOWS\imsins.BAK
[2010/11/30 18:42:24 | 000,002,274 | —- | C] () – C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\setup_9.0.0.722_01.12.2010_00-16.lnk
[2010/11/28 16:35:09 | 000,004,502 | R— | C] () – C:\Documents and Settings\Administrator\Desktop\c.cfg
[2010/11/28 16:35:09 | 000,000,110 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\a.cfg
[2010/10/06 13:51:32 | 000,840,192 | —- | C] () – C:\WINDOWS\System32\drivers\ikipopc.sys
[2010/09/04 12:45:25 | 000,001,189 | —- | C] () – C:\Documents and Settings\Administrator\Application Data\vso_ts_preview.xml
[2010/07/21 12:20:06 | 000,565,248 | —- | C] () – C:\WINDOWS\System32\drivers\rhvcczo.sys
[2010/02/20 01:56:32 | 000,014,344 | -HS- | C] () – C:\Documents and Settings\Administrator\Local Settings\Application Data\v66l66MW5Tq
[2010/02/01 01:37:48 | 000,000,032 | —- | C] () – C:\Documents and Settings\NetworkService\Application Data\anvkgp.dat
[2010/02/01 01:37:40 | 000,000,008 | —- | C] () – C:\Documents and Settings\Administrator\Application Data\avdrn.dat
[2009/10/17 13:39:41 | 000,000,947 | —- | C] () – C:\WINDOWS\System32\MRT.INI
[2008/12/13 20:34:24 | 000,000,250 | —- | C] () – C:\WINDOWS\gmer.ini
[2008/12/13 20:34:23 | 000,884,736 | —- | C] () – C:\WINDOWS\gmer.dll
[2008/12/11 13:20:20 | 000,000,543 | —- | C] () – C:\WINDOWS\wininit.ini
[2008/11/30 15:07:03 | 000,000,754 | —- | C] () – C:\WINDOWS\WORDPAD.INI
[2008/11/23 20:47:47 | 000,000,262 | —- | C] () – C:\WINDOWS\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini
[2008/11/06 13:52:00 | 001,163,208 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2008/10/18 17:57:27 | 000,002,062 | —- | C] () – C:\WINDOWS\kaillera.ini
[2008/09/16 00:08:19 | 000,066,482 | R— | C] () – C:\WINDOWS\System32\lvcoinst.ini
[2008/05/02 20:46:00 | 001,703,936 | —- | C] () – C:\WINDOWS\System32\nvwdmcpl.dll
[2008/05/02 20:46:00 | 001,486,848 | —- | C] () – C:\WINDOWS\System32\nview.dll
[2008/05/02 20:46:00 | 001,019,904 | —- | C] () – C:\WINDOWS\System32\nvwimg.dll
[2008/05/02 20:46:00 | 000,466,944 | —- | C] () – C:\WINDOWS\System32\nvshell.dll
[2008/05/02 20:46:00 | 000,286,720 | —- | C] () – C:\WINDOWS\System32\nvnt4cpl.dll
[2008/04/06 08:02:38 | 000,000,395 | —- | C] () – C:\WINDOWS\asr.INI
[2008/03/31 16:25:46 | 000,831,488 | —- | C] () – C:\WINDOWS\System32\divx_xx0a.dll
[2008/03/21 15:30:08 | 003,596,288 | —- | C] () – C:\WINDOWS\System32\qt-dx331.dll
[2008/03/21 15:28:20 | 000,012,288 | —- | C] () – C:\WINDOWS\System32\DivXWMPExtType.dll
[2008/03/13 16:52:18 | 000,033,800 | —- | C] () – C:\WINDOWS\System32\drivers\epfwtdir.sys
[2008/02/09 19:49:58 | 000,010,752 | —- | C] () – C:\WINDOWS\System32\BASSMOD.dll
[2008/02/09 19:37:58 | 000,000,034 | —- | C] () – C:\Documents and Settings\Administrator\Application Data\pcouffin.log
[2008/02/09 19:37:53 | 000,087,608 | —- | C] () – C:\Documents and Settings\Administrator\Application Data\ezpinst.exe
[2008/02/09 19:37:53 | 000,001,144 | —- | C] () – C:\Documents and Settings\Administrator\Application Data\pcouffin.inf
[2008/02/09 19:37:53 | 000,001,074 | —- | C] () – C:\Documents and Settings\Administrator\Application Data\pcouffin.cat
[2008/02/05 18:20:08 | 000,025,624 | —- | C] () – C:\WINDOWS\System32\drivers\LVPr2Mon.sys
[2008/01/21 00:34:11 | 000,000,000 | —- | C] () – C:\WINDOWS\iPlayer.INI
[2007/11/21 22:16:57 | 000,138,944 | —- | C] () – C:\WINDOWS\System32\drivers\PnkBstrK.sys
[2007/10/12 12:48:27 | 000,002,385 | —- | C] () – C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2007/08/28 19:07:55 | 000,765,952 | —- | C] () – C:\WINDOWS\System32\xvidcore.dll
[2007/08/28 19:07:55 | 000,180,224 | —- | C] () – C:\WINDOWS\System32\xvidvfw.dll
[2007/08/15 11:12:29 | 000,033,792 | —- | C] () – C:\Documents and Settings\Administrator\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007/05/25 04:35:36 | 000,152,576 | —- | C] () – C:\WINDOWS\agojevul.dll
[2007/03/10 18:10:14 | 000,958,464 | —- | C] () – C:\WINDOWS\System32\VSFilter.dll
[2006/12/31 20:58:49 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2006/11/10 08:08:50 | 000,024,064 | —- | C] () – C:\WINDOWS\System32\drivers\ATITool.sys
[2002/10/06 13:42:56 | 000,237,568 | —- | C] () – C:\WINDOWS\System32\OggDS.dll
[2002/10/04 18:04:24 | 000,921,600 | —- | C] () – C:\WINDOWS\System32\VorbisEnc.dll
[2002/10/04 18:04:24 | 000,188,416 | —- | C] () – C:\WINDOWS\System32\vorbis.dll
[2002/10/04 18:04:16 | 000,045,056 | —- | C] () – C:\WINDOWS\System32\ogg.dll
[2002/05/15 18:38:40 | 000,091,136 | —- | C] () – C:\WINDOWS\System32\mp4fil32.dll
[2002/04/19 09:23:26 | 000,106,137 | —- | C] () – C:\WINDOWS\System32\libpostproc.dll
[2002/04/19 08:51:04 | 000,211,760 | —- | C] () – C:\WINDOWS\System32\libavcodec.dll
[2002/01/25 07:04:50 | 000,005,440 | —- | C] () – C:\WINDOWS\System32\mciwa16.dll
[2002/01/25 07:04:50 | 000,000,221 | —- | C] () – C:\WINDOWS\System32\pspsbext.ini
[2002/01/25 07:04:50 | 000,000,221 | —- | C] () – C:\WINDOWS\System32\pspfidrv.ini
[2002/01/25 07:04:50 | 000,000,221 | —- | C] () – C:\WINDOWS\System32\pspfbase.ini
[2002/01/25 07:04:50 | 000,000,221 | —- | C] () – C:\WINDOWS\System32\pspaudrv.ini
[2002/01/25 07:04:50 | 000,000,221 | —- | C] () – C:\WINDOWS\System32\pspapdrv.ini
[2002/01/25 07:04:50 | 000,000,221 | —- | C] () – C:\WINDOWS\System32\mciwaw95.ini
[2002/01/25 07:04:50 | 000,000,221 | —- | C] () – C:\WINDOWS\System32\mcipspwa.ini
[2002/01/25 07:04:50 | 000,000,221 | —- | C] () – C:\WINDOWS\System32\mcipspct.ini
[2002/01/25 07:04:50 | 000,000,220 | —- | C] () – C:\WINDOWS\System32\pspwave.ini
[2002/01/25 07:04:50 | 000,000,219 | —- | C] () – C:\WINDOWS\System32\pspdss.ini
[2002/01/25 07:04:50 | 000,000,219 | —- | C] () – C:\WINDOWS\System32\pspddi.ini

========== LOP Check ==========

[2007/08/07 03:42:37 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Aim
[2008/06/26 17:59:04 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\eBookPro6
[2010/05/26 15:32:49 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Facebook
[2009/01/08 19:27:08 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\FileZilla
[2009/09/26 15:24:50 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\FrostWire
[2009/01/19 02:37:17 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\GetRightToGo
[2008/04/21 19:56:20 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\HLSW
[2009/10/07 11:31:16 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\id Software
[2008/09/16 00:07:16 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Leadertech
[2009/03/04 15:03:03 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\LimeWire
[2008/12/14 20:32:08 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\OpenOffice.org
[2008/10/26 08:44:57 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\PPLive
[2010/06/15 01:09:41 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Sony Online Entertainment
[2009/09/20 12:11:52 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\UltimateBet
[2010/02/20 05:42:24 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Uniblue
[2010/12/01 21:59:59 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\uTorrent
[2007/08/09 16:16:51 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Viewpoint
[2010/11/07 09:17:09 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Vso
[2010/02/10 22:12:13 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\61638933
[2008/12/12 12:14:27 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\ESET
[2009/10/07 11:31:11 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\id Software
[2008/10/26 08:38:53 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Jlcm
[2008/02/19 14:27:37 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\NCH Swift Sound
[2008/11/25 17:38:46 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PPLive
[2010/02/20 05:46:45 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SITEguard
[2010/02/22 19:09:39 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\STOPzilla!
[2010/07/07 17:15:16 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2008/12/15 18:53:13 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Viewpoint
[2010/09/05 06:49:21 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\vsosdk
[2010/05/07 23:20:30 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2009/06/29 18:10:00 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2007/01/01 02:04:18 | 000,000,000 | —- | M] () – C:\AUTOEXEC.BAT
[2007/08/07 15:15:34 | 000,000,221 | —- | M] () – C:\Boot.bak
[2010/11/30 20:48:14 | 000,000,293 | RHS- | M] () – C:\boot.ini
[2004/08/03 23:00:00 | 000,260,272 | —- | M] () – C:\cmldr
[2008/12/14 16:01:50 | 000,025,244 | —- | M] () – C:\ComboFix.txt
[2007/01/01 02:04:18 | 000,000,000 | —- | M] () – C:\CONFIG.SYS
[2007/01/01 02:04:18 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2007/01/01 02:04:18 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2005/06/14 09:00:00 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2005/06/14 09:00:00 | 000,250,032 | RHS- | M] () – C:\ntldr
[2010/12/03 14:44:11 | 2145,386,496 | -HS- | M] () – C:\pagefile.sys
[2008/11/25 17:38:46 | 1073,741,824 | -H– | M] () – C:\pfsvoddata.bbv
[2008/10/28 17:23:14 | 000,000,268 | -H– | M] () – C:\sqmdata00.sqm
[2008/10/28 17:28:19 | 000,000,268 | -H– | M] () – C:\sqmdata01.sqm
[2008/10/28 17:52:22 | 000,000,268 | -H– | M] () – C:\sqmdata02.sqm
[2008/10/28 18:03:09 | 000,000,268 | -H– | M] () – C:\sqmdata03.sqm
[2008/10/30 19:05:55 | 000,000,268 | -H– | M] () – C:\sqmdata04.sqm
[2008/10/30 19:12:02 | 000,000,268 | -H– | M] () – C:\sqmdata05.sqm
[2008/12/10 11:05:25 | 000,000,268 | -H– | M] () – C:\sqmdata06.sqm
[2009/01/24 21:14:48 | 000,000,268 | -H– | M] () – C:\sqmdata07.sqm
[2009/01/25 00:44:36 | 000,000,268 | -H– | M] () – C:\sqmdata08.sqm
[2009/02/07 11:49:46 | 000,000,268 | -H– | M] () – C:\sqmdata09.sqm
[2009/04/11 06:36:25 | 000,000,268 | -H– | M] () – C:\sqmdata10.sqm
[2009/04/24 17:03:35 | 000,000,268 | -H– | M] () – C:\sqmdata11.sqm
[2009/05/16 14:50:02 | 000,000,268 | -H– | M] () – C:\sqmdata12.sqm
[2009/05/16 14:52:45 | 000,000,268 | -H– | M] () – C:\sqmdata13.sqm
[2009/06/12 22:07:10 | 000,000,268 | -H– | M] () – C:\sqmdata14.sqm
[2009/07/02 21:02:02 | 000,000,268 | -H– | M] () – C:\sqmdata15.sqm
[2009/08/20 20:05:41 | 000,000,268 | -H– | M] () – C:\sqmdata16.sqm
[2009/08/29 08:44:46 | 000,000,268 | -H– | M] () – C:\sqmdata17.sqm
[2008/10/21 19:56:25 | 000,000,268 | -H– | M] () – C:\sqmdata18.sqm
[2008/10/28 11:10:46 | 000,000,268 | -H– | M] () – C:\sqmdata19.sqm
[2008/10/28 17:23:14 | 000,000,244 | -H– | M] () – C:\sqmnoopt00.sqm
[2008/10/28 17:28:19 | 000,000,244 | -H– | M] () – C:\sqmnoopt01.sqm
[2008/10/28 17:52:22 | 000,000,244 | -H– | M] () – C:\sqmnoopt02.sqm
[2008/10/28 18:03:09 | 000,000,244 | -H– | M] () – C:\sqmnoopt03.sqm
[2008/10/30 19:05:55 | 000,000,244 | -H– | M] () – C:\sqmnoopt04.sqm
[2008/10/30 19:12:02 | 000,000,244 | -H– | M] () – C:\sqmnoopt05.sqm
[2008/12/10 11:05:25 | 000,000,244 | -H– | M] () – C:\sqmnoopt06.sqm
[2009/01/24 21:14:48 | 000,000,244 | -H– | M] () – C:\sqmnoopt07.sqm
[2009/01/25 00:44:36 | 000,000,244 | -H– | M] () – C:\sqmnoopt08.sqm
[2009/02/07 11:49:46 | 000,000,244 | -H– | M] () – C:\sqmnoopt09.sqm
[2009/04/11 06:36:25 | 000,000,244 | -H– | M] () – C:\sqmnoopt10.sqm
[2009/04/24 17:03:35 | 000,000,244 | -H– | M] () – C:\sqmnoopt11.sqm
[2009/05/16 14:50:02 | 000,000,244 | -H– | M] () – C:\sqmnoopt12.sqm
[2009/05/16 14:52:45 | 000,000,244 | -H– | M] () – C:\sqmnoopt13.sqm
[2009/06/12 22:07:10 | 000,000,244 | -H– | M] () – C:\sqmnoopt14.sqm
[2009/07/02 21:02:02 | 000,000,244 | -H– | M] () – C:\sqmnoopt15.sqm
[2009/08/20 20:05:41 | 000,000,244 | -H– | M] () – C:\sqmnoopt16.sqm
[2009/08/29 08:44:46 | 000,000,244 | -H– | M] () – C:\sqmnoopt17.sqm
[2008/10/21 19:56:25 | 000,000,244 | -H– | M] () – C:\sqmnoopt18.sqm
[2008/10/28 11:10:46 | 000,000,244 | -H– | M] () – C:\sqmnoopt19.sqm

< %systemroot%\Fonts\*.com >
[2006/06/29 13:58:52 | 000,030,808 | —- | M] () – C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont
[2006/04/18 14:39:28 | 000,026,040 | —- | M] () – C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 13:53:56 | 000,026,489 | —- | M] () – C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 14:39:28 | 000,029,779 | —- | M] () – C:\WINDOWS\Fonts\GlobalSerif.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2007/01/01 02:04:02 | 000,000,067 | -HS- | M] () – C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/07/06 05:50:03 | 000,597,504 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2006/12/31 20:57:09 | 000,094,208 | —- | M] () – C:\WINDOWS\system32\config\default.sav
[2006/12/31 20:57:09 | 000,659,456 | —- | M] () – C:\WINDOWS\system32\config\software.sav
[2006/12/31 20:57:09 | 000,905,216 | —- | M] () – C:\WINDOWS\system32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2007/01/01 02:04:21 | 000,000,294 | -HS- | M] () – C:\Documents and Settings\All Users\Start Menu\desktop.ini

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2007/01/01 02:06:49 | 000,000,060 | -HS- | M] () – C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
[2007/01/01 02:06:49 | 000,000,079 | —- | M] () – C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

< %USERPROFILE%\Desktop\*.exe >

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >

< %systemroot%\ADDINS\*.* >

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2007/01/01 02:06:49 | 000,000,122 | -HS- | M] () – C:\Documents and Settings\Administrator\Favorites\Desktop.ini
[2008/02/19 14:27:34 | 000,000,452 | —- | M] () – C:\Documents and Settings\Administrator\Favorites\NCH Audio and Telephony Software.lnk

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >
[2007/01/01 02:26:59 | 000,000,406 | RHS- | M] () – C:\Documents and Settings\All Users\ntuser.pol

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >
[2007/08/07 03:19:51 | 000,000,067 | -HS- | M] () – C:\Documents and Settings\Administrator\Cookies\desktop.ini
[2010/12/05 12:33:49 | 000,049,152 | -HS- | M] () – C:\Documents and Settings\Administrator\Cookies\index.dat

< %SystemRoot%\system32\fonts\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-12-03 07:14:13

========== Alternate Data Streams ==========

@Alternate Data Stream - 159 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D1B5B4F1
@Alternate Data Stream - 103 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2

< End of report >

OTL Extras


OTL Extras logfile created on: 12/5/2010 12:53:42 PM - Run 1
OTL by OldTimer - Version 3.2.17.3 Folder = C:\Documents and Settings\Administrator\My Documents\Downloads
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 72.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 90.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 298.08 Gb Total Space | 118.15 Gb Free Space | 39.64% Space Free | Partition Type: NTFS

Computer Name: BRUM | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.exe [@ = exefile] – Reg Error: Key error. File not found
.html [@ = ChromeHTML] – Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
htmlfile – Reg Error: Key error.
http [open] – "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
https [open] – "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"FirewallDisableNotify" = 1
"AntiVirusOverride" = 1
"FirewallOverride" = 1
"AntiVirusDisableNotify" = 1
"UpdatesDisableNotify" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"80:TCP" = 80:TCP:*:Enabled:Promo
"53:UDP" = 53:UDP:*:Enabled:Promo

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\AIM\aim.exe" = C:\Program Files\AIM\aim.exe:*:Enabled:AOL Instant Messenger – (America Online, Inc.)
"C:\Program Files\Octoshape Streaming Services\Administrator\OctoshapeClient.exe" = C:\Program Files\Octoshape Streaming Services\Administrator\OctoshapeClient.exe:*:Enabled:OctoshapeClient – ()
"C:\Program Files\mIRC\mirc.exe" = C:\Program Files\mIRC\mirc.exe:*:Enabled:mIRC – (mIRC Co. Ltd.)
"C:\Program Files\Steam\steamapps\trevyp0o\counter-strike\hl.exe" = C:\Program Files\Steam\steamapps\trevyp0o\counter-strike\hl.exe:*:Enabled:Half-Life Launcher – (Valve)
"C:\Program Files\uTorrent\uTorrent.exe" = C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent – File not found
"C:\Program Files\LimeWire\LimeWire.exe" = C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire – File not found
"C:\Program Files\Ventrilo\Ventrilo.exe" = C:\Program Files\Ventrilo\Ventrilo.exe:*:Enabled:Ventrilo.exe – ()
"C:\Program Files\Viewpoint\Common\ViewpointService.exe" = C:\Program Files\Viewpoint\Common\ViewpointService.exe:*:Enabled:ViewpointService – File not found
"C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe" = C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe:*:Enabled:ekrn – (ESET)
"C:\WINDOWS\system32\cscript.exe" = C:\WINDOWS\system32\cscript.exe:*:Enabled:cscript – (Microsoft Corporation)
"C:\Program Files\Steam\steamapps\common\call of duty 4\iw3sp.exe" = C:\Program Files\Steam\steamapps\common\call of duty 4\iw3sp.exe:*:Enabled:Call of Duty 4: Modern Warfare – File not found
"C:\Program Files\Steam\steamapps\common\call of duty 4\iw3mp.exe" = C:\Program Files\Steam\steamapps\common\call of duty 4\iw3mp.exe:*:Enabled:Call of Duty 4: Modern Warfare – File not found
"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes – (Apple Inc.)
"C:\WINDOWS\Temp\_ex-08.exe" = C:\WINDOWS\Temp\_ex-08.exe:*:Enabled:Promo – File not found


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{146E206D-7D2C-493A-B431-1F1D16E822AF}" = MobileMe Control Panel
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}" = QuickTime
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java™ 6 Update 7
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{553255F3-78FD-40F1-A6F8-6882140265FE}" = Apple Application Support
"{5ECB3A3C-980B-4D12-9724-25DCB07A1F47}" = iTunes
"{6444D9D9-CD6C-4464-B970-55C606C944DC}" = Logitech QuickCam
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{789289CA-F73A-4A16-A331-54D498CE069F}" = Ventrilo Client
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{7CCEBC24-62DB-4280-A8EC-BFA49F167920}" = Software Update for Web Folders
"{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}" = Windows Live Essentials
"{86A6E235-C08F-4A14-B14C-793C7D8844A0}" = ESET NOD32 Antivirus
"{86D6A20D-3910-4441-A3E5-EB6977251C86}" = Samsung USB Driver
"{8A253629-0511-4854-8B4E-46E57E66005C}" = Bonjour
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{9422C8EA-B0C6-4197-B8FC-DC797658CA00}" = Windows Live Sign-in Assistant
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9DE1BE03-AFE2-4CDB-BFEB-D06D736CD01A}" = Apple Mobile Device Support
"{9FDCD01E-9926-4399-8BB9-74EEBE604C11}" = Quake Live Mozilla Plugin
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A67BB21E-D419-45BB-AB86-7D87D14BBCE2}" = Safari
"{A85FD55B-891B-4314-97A5-EA96C0BD80B5}" = Windows Live Messenger
"{AC76BA86-7AD7-1033-7B44-A81000000003}" = Adobe Reader 8.1.1
"{AEC0CEBC-0FC7-4716-8222-1C4A742719B1}" = Samsung Master
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{BB360AE2-CF24-420B-8E31-7597E9499DD2}" = Zoom Cable Modem
"{BB406CEB-6207-4512-9BB2-89950DC9D6B6}_is1" = ConvertXtoDVD [removed]
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C9BED750-1211-4480-B1A5-718A3BE15525}" = REALTEK GbE & FE Ethernet PCI-E NIC Driver
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D4C9692E-4EFA-4DA0-8B7F-9439466D9E31}" = Full Tilt Poker
"{DB6AB705-C9BD-40E3-8929-2EA57F36A4FF}_is1" = ConvertXtoDVD 4.0.12.327
"{ED00D08A-3C5F-488D-93A0-A04F21F23956}" = Windows Live Communications Platform
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call
"Ad-Aware SE Professional" = Ad-Aware SE Professional
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"AOL Instant Messenger" = AOL Instant Messenger
"ATITool" = ATITool Overclocking Utility
"AVI Codec Pack" = AVI Codec Pack
"CCleaner" = CCleaner (remove only)
"CMN_Deploy_0" = CMN3
"Combined Community Codec Pack_is1" = Combined Community Codec Pack 2008-01-24
"ExpressBurn" = Express Burn
"HashCheck Shell Extension" = HashCheck Shell Extension (x86-32)
"HijackThis" = HijackThis 2.0.2
"HLSW_is1" = HLSW v1.2.1
"JAIELangPack" = Japanese Language Support
"lvdrivers_11.70" = Logitech QuickCam Driver Package
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft.Net.Client.3.5" = Microsoft .NET Framework Client Profile - PREVIEW
"mIRC" = mIRC
"Mozilla Firefox (3.5.13)" = Mozilla Firefox (3.5.13)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NVIDIA Drivers" = NVIDIA Drivers
"PunkBusterSvc" = PunkBuster Services
"RealAlt_is1" = Real Alternative 1.52
"Registry Mechanic_is1" = Registry Mechanic 6.0
"Spybot - Search & Destroy_is1" = Spybot - Search & Destroy 1.4
"Steam App 10" = Counter-Strike
"Steam App 240" = Counter-Strike: Source
"Tweak UI 2.10" = Tweak UI
"Veetle TV" = Veetle TV 0.9.18
"VLC media player" = VideoLAN VLC media player 0.8.6c
"WIC" = Windows Imaging Component
"Winamp" = Winamp
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR archiver
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"Xvid_is1" = Xvid 1.1.3 final uninstall

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Facebook Plug-In" = Facebook Plug-In
"FileZilla Client" = FileZilla Client 3.0.5.2
"Google Chrome" = Google Chrome
"Move Media Player" = Move Media Player
"Octoshape add-in for Adobe Flash Player" = Octoshape add-in for Adobe Flash Player
"Octoshape Streaming Services" = Octoshape Streaming Services
"UltimateBet" = UltimateBet
"uTorrent" = µTorrent

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 11/30/2010 11:18:00 PM | Computer Name = BRUM | Source = HotFixInstaller | ID = 5000
Description = EventType visualstudio8setup, P1 microsoft .net framework 3.0-kb982168,
P2 1033, P3 1601, P4 msi, P5 f, P6 9.0.40215.0, P7 install, P8 x86, P9 xp, P10
0.

Error - 11/30/2010 11:19:53 PM | Computer Name = BRUM | Source = HotFixInstaller | ID = 5000
Description = EventType visualstudio8setup, P1 microsoft .net framework 2.0-kb976576,
P2 1033, P3 1601, P4 msi, P5 f, P6 9.0.40302.0, P7 install, P8 x86, P9 xp, P10
0.

Error - 12/1/2010 3:15:01 PM | Computer Name = BRUM | Source = Bonjour Service | ID = 100
Description = 348: ERROR: read_msg errno 10054 (An existing connection was forcibly
closed by the remote host.)

Error - 12/1/2010 3:15:01 PM | Computer Name = BRUM | Source = Bonjour Service | ID = 100
Description = 360: ERROR: read_msg errno 10054 (An existing connection was forcibly
closed by the remote host.)

Error - 12/1/2010 3:15:01 PM | Computer Name = BRUM | Source = Bonjour Service | ID = 100
Description = 372: ERROR: read_msg errno 10054 (An existing connection was forcibly
closed by the remote host.)

Error - 12/1/2010 3:15:01 PM | Computer Name = BRUM | Source = Bonjour Service | ID = 100
Description = 384: ERROR: read_msg errno 10054 (An existing connection was forcibly
closed by the remote host.)

Error - 12/1/2010 3:15:01 PM | Computer Name = BRUM | Source = Bonjour Service | ID = 100
Description = 396: ERROR: read_msg errno 10054 (An existing connection was forcibly
closed by the remote host.)

Error - 12/3/2010 3:12:57 AM | Computer Name = BRUM | Source = HotFixInstaller | ID = 5000
Description = EventType visualstudio8setup, P1 microsoft .net framework 2.0-kb979909,
P2 1033, P3 1601, P4 msi, P5 f, P6 9.0.40302.0, P7 install, P8 x86, P9 xp, P10
0.

Error - 12/3/2010 3:13:36 AM | Computer Name = BRUM | Source = HotFixInstaller | ID = 5000
Description = EventType visualstudio8setup, P1 microsoft .net framework 3.0-kb982168,
P2 1033, P3 1601, P4 msi, P5 f, P6 9.0.40215.0, P7 install, P8 x86, P9 xp, P10
0.

Error - 12/3/2010 3:14:13 AM | Computer Name = BRUM | Source = HotFixInstaller | ID = 5000
Description = EventType visualstudio8setup, P1 microsoft .net framework 2.0-kb976576,
P2 1033, P3 1601, P4 msi, P5 f, P6 9.0.40302.0, P7 install, P8 x86, P9 xp, P10
0.

[ System Events ]
Error - 12/1/2010 10:23:29 PM | Computer Name = BRUM | Source = Service Control Manager | ID = 7034
Description = The PnkBstrA service terminated unexpectedly. It has done this 1
time(s).

Error - 12/3/2010 3:12:57 AM | Computer Name = BRUM | Source = Windows Update Agent | ID = 20
Description = Installation Failure: Windows failed to install the following update
with error 0x80070643: Microsoft .NET Framework 3.5 SP1 and .NET Framework 2.0
SP2 Security Update for Windows 2000, Windows Server 2003, and Windows XP x86 (KB979909).

Error - 12/3/2010 3:13:36 AM | Computer Name = BRUM | Source = Windows Update Agent | ID = 20
Description = Installation Failure: Windows failed to install the following update
with error 0x80070643: Microsoft .NET Framework 3.5 SP1 Update for Windows Server
2003 and Windows XP x86 (KB982168).

Error - 12/3/2010 3:14:13 AM | Computer Name = BRUM | Source = Windows Update Agent | ID = 20
Description = Installation Failure: Windows failed to install the following update
with error 0x80070643: Microsoft .NET Framework 3.5 SP1 and .NET Framework 2.0
SP2 Update for Windows Server 2003 and Windows XP x86 (KB982524).

Error - 12/5/2010 12:49:16 PM | Computer Name = BRUM | Source = Service Control Manager | ID = 7031
Description = The Apple Mobile Device service terminated unexpectedly. It has done
this 1 time(s). The following corrective action will be taken in 60000 milliseconds:
Restart the service.

Error - 12/5/2010 12:49:19 PM | Computer Name = BRUM | Source = Service Control Manager | ID = 7034
Description = The Bonjour Service service terminated unexpectedly. It has done
this 1 time(s).

Error - 12/5/2010 12:49:28 PM | Computer Name = BRUM | Source = Service Control Manager | ID = 7034
Description = The PnkBstrA service terminated unexpectedly. It has done this 1
time(s).

Error - 12/5/2010 12:49:32 PM | Computer Name = BRUM | Source = Service Control Manager | ID = 7034
Description = The Process Monitor service terminated unexpectedly. It has done
this 1 time(s).

Error - 12/5/2010 1:32:22 PM | Computer Name = BRUM | Source = Service Control Manager | ID = 7031
Description = The Apple Mobile Device service terminated unexpectedly. It has done
this 2 time(s). The following corrective action will be taken in 60000 milliseconds:
Restart the service.

Error - 12/5/2010 1:32:38 PM | Computer Name = BRUM | Source = Service Control Manager | ID = 7031
Description = The Eset Service service terminated unexpectedly. It has done this
1 time(s). The following corrective action will be taken in 0 milliseconds: Restart
the service.


< End of report >


——————————————————————————————————————–


GMER Log


GMER 1.0.15.15530 - http://www.gmer.net
Rootkit scan 2010-12-05 14:24:58
Windows 5.1.2600 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-16 ST3320620AS rev.3.AAK
Running: gmer.exe; Driver: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\pxtdqpoc.sys


—- System - GMER 1.0.15 —-

Code \??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\dxdiag.sys ZwReadVirtualMemory [0xB590E6EC]

—- Kernel code sections - GMER 1.0.15 —-

PAGE ntkrnlpa.exe!ZwReadVirtualMemory 805B30C6 7 Bytes JMP B590E6F0 \??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\dxdiag.sys
.text ikipopc.sys B9E96000 17 Bytes JMP B9EEBD0B ikipopc.sys
.text ikipopc.sys B9E96013 74 Bytes CALL B56A48A1
.text ikipopc.sys B9E9605E 42 Bytes JMP B9E984FA ikipopc.sys
.text ikipopc.sys B9E96089 223 Bytes [2C, 9C, FF, 74, 24, 30, 8F, …]
.text ikipopc.sys B9E96169 37 Bytes [6D, 00, 60, 8D, 64, 24, 24, …]
.text …
? C:\WINDOWS\system32\drivers\ikipopc.sys A device attached to the system is not functioning.
? C:\WINDOWS\system32\drivers\rhvcczo.sys A device attached to the system is not functioning.
PAGE Ntfs.sys B9CF9E55 4 Bytes CALL 8A640509
.text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xB8FDE360, 0x372FAD, 0xE8000020]
DXDIAG C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\dxdiag.sys unknown last code section [0xB5912000, 0x89F4, 0xE0000060]

—- User code sections - GMER 1.0.15 —-

.text C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtCreateFile + 6 7C90D0B4 4 Bytes [28, 00, 16, 00]
.text C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtCreateFile + B 7C90D0B9 1 Byte [E2]
.text C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtMapViewOfSection + 6 7C90D524 1 Byte [28]
.text C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtMapViewOfSection + 6 7C90D524 4 Bytes [28, 03, 16, 00]
.text C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtMapViewOfSection + B 7C90D529 1 Byte [E2]
.text C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtOpenFile + 6 7C90D5A4 4 Bytes [68, 00, 16, 00]
.text C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtOpenFile + B 7C90D5A9 1 Byte [E2]
.text C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtOpenProcess + 6 7C90D604 4 Bytes [A8, 01, 16, 00]
.text C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtOpenProcess + B 7C90D609 1 Byte [E2]
.text C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtOpenProcessToken + 6 7C90D614 4 Bytes CALL 7B90EC1A
.text C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtOpenProcessToken + B 7C90D619 1 Byte [E2]
.text C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtOpenProcessTokenEx + 6 7C90D624 4 Bytes [A8, 02, 16, 00]
.text C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtOpenProcessTokenEx + B 7C90D629 1 Byte [E2]
.text C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtOpenThread + 6 7C90D664 4 Bytes [68, 01, 16, 00]
.text C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtOpenThread + B 7C90D669 1 Byte [E2]
.text C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtOpenThreadToken + 6 7C90D674 4 Bytes [68, 02, 16, 00]
.text C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtOpenThreadToken + B 7C90D679 1 Byte [E2]
.text C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtOpenThreadTokenEx + 6 7C90D684 4 Bytes CALL 7B90EC8B
.text C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtOpenThreadTokenEx + B 7C90D689 1 Byte [E2]
.text C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtQueryAttributesFile + 6 7C90D714 4 Bytes [A8, 00, 16, 00]
.text C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtQueryAttributesFile + B 7C90D719 1 Byte [E2]
.text C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtQueryFullAttributesFile + 6 7C90D7B4 4 Bytes CALL 7B90EDB9
.text C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtQueryFullAttributesFile + B 7C90D7B9 1 Byte [E2]
.text C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtSetInformationFile + 6 7C90DC64 4 Bytes [28, 01, 16, 00]
.text C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtSetInformationFile + B 7C90DC69 1 Byte [E2]
.text C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtSetInformationThread + 6 7C90DCB4 4 Bytes [28, 02, 16, 00]
.text C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtSetInformationThread + B 7C90DCB9 1 Byte [E2]
.text C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtUnmapViewOfSection + 6 7C90DF14 1 Byte [68]
.text C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtUnmapViewOfSection + 6 7C90DF14 4 Bytes [68, 03, 16, 00]
.text C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2980] ntdll.dll!NtUnmapViewOfSection + B 7C90DF19 1 Byte [E2]
.text C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[3044] kernel32.dll!SetUnhandledExceptionFilter 7C844915 4 Bytes [C2, 04, 00, 00]

—- Devices - GMER 1.0.15 —-

Device \FileSystem\Ntfs \Ntfs 8A662580

AttachedDevice \FileSystem\Ntfs \Ntfs eamon.sys (Amon monitor/ESET)

Device \Driver\Tcpip \Device\Ip 8A23FF78
Device \Driver\Tcpip \Device\Tcp 8A23FF78

AttachedDevice \Driver\Tcpip \Device\Tcp epfwtdir.sys
AttachedDevice \Driver\Tcpip \Device\Tcp 8A19E460

Device \Driver\Tcpip \Device\Udp 8A23FF78
Device \Driver\Tcpip \Device\RawIp 8A23FF78
Device \Driver\Tcpip \Device\IPMULTICAST 8A23FF78
Device \Driver\epfwtdir \Device\EpfwRedirector 8A19E460

—- Services - GMER 1.0.15 —-

Service (*** hidden *** ) [BOOT] ikipopc <– ROOTKIT !!!
Service (*** hidden *** ) [BOOT] rhvcczo <– ROOTKIT !!!

—- Registry - GMER 1.0.15 —-

Reg HKLM\SYSTEM\CurrentControlSet\Services\ikipopc@Type 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\ikipopc@Start 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\ikipopc@ErrorControl 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\ikipopc@Group Boot Bus Extender
Reg HKLM\SYSTEM\CurrentControlSet\Services\ikipopc@{bd5df174-9da0-3d1b-add4-0c0173a340a0} 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\rhvcczo@Type 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\rhvcczo@Start 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\rhvcczo@ErrorControl 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\rhvcczo@Group Boot Bus Extender
Reg HKLM\SYSTEM\ControlSet002\Services\ikipopc@Type 1
Reg HKLM\SYSTEM\ControlSet002\Services\ikipopc@Start 0
Reg HKLM\SYSTEM\ControlSet002\Services\ikipopc@ErrorControl 0
Reg HKLM\SYSTEM\ControlSet002\Services\ikipopc@Group Boot Bus Extender
Reg HKLM\SYSTEM\ControlSet002\Services\ikipopc@{bd5df174-9da0-3d1b-add4-0c0173a340a0} 1
Reg HKLM\SYSTEM\ControlSet002\Services\rhvcczo@Type 1
Reg HKLM\SYSTEM\ControlSet002\Services\rhvcczo@Start 0
Reg HKLM\SYSTEM\ControlSet002\Services\rhvcczo@ErrorControl 0
Reg HKLM\SYSTEM\ControlSet002\Services\rhvcczo@Group Boot Bus Extender

—- EOF - GMER 1.0.15 —-


I hope I did everything right. Thanks to whomever helps me from here on out.

Please download TDSSKiller.zip

• Extract it to your desktop
• Double click TDSSKiller.exe
• Press Start Scan
  
  • Only if Malicious objects are found then ensure Cure is selected
    If suspicious objects are found select skip
  • Then click Continue > Reboot now
• Copy and paste the log in your next reply
  
  • A copy of the log will be saved automatically to the root of the drive (typically C:\)