Spyware / Malware / Virus Removal

slow internet response and about blank

13 min read

Looking for the outcome? Ask AI

flower4496 Topic Starter

Post #1December 29, 2010, 5:02 PM UTC

my internet response slows and even freezes and sometimes when I click on a link about:blank shows in the toolbar instead of the website and the thing freezes.

I am running google chrome with windows xp

Here is my hijack this log. thanks for your help.

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 11:48:40 AM, on 12/29/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.17093)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Norton AntiVirus\Norton AntiVirus\Engine\18.5.0.125\ccSvcHst.exe
C:\Program Files\Norton AntiVirus\Norton AntiVirus\Engine\18.5.0.125\ccSvcHst.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\Leon & Rose\Local Settings\Application Data\Google\Update\1.2.183.39\GoogleCrashHandler.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\WINDOWS\system32\cidaemon.exe
C:\AntiSpyware\hijackthis\HijackThis.exe
C:\Documents and Settings\Leon & Rose\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Leon & Rose\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
F:\My Documents\Downloads\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton AntiVirus\Norton AntiVirus\Engine\18.5.0.125\IPS\IPSBHO.DLL
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Leon & Rose\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - Global Startup: SoftStuff Wallpaper Changer.lnk = C:\Program Files\SoftStuff\softstrt.exe
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O15 - Trusted Zone: http://*.ameritrade.com
O15 - Trusted Zone: http://www.herbalink.com
O16 - DPF: YExplorer1_8US.CAB - http://photos.groups.yahoo.com/ocx/us/yexplorer1_8us.cab
O16 - DPF: {230C3D02-DA27-11D2-8612-00A0C93EEA3C} (SAXFile FileUpload ActiveX Control) - http://www.winkflash.com/photo/loaders/SAXFile.cab
O16 - DPF: {315B0BFB-2BD4-481B-80A3-A9B80727C61B} (WebIQ Engine Application Object) - http://webiq005.webiqonline.com/WebIQ/Data…6-6D5536C585C9}
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab
O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://fb.familylink.com/we_are_related/st…geUploader5.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo…otoUploader.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1098888781197
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.winkflash.com/photo/loaders/ImageUploader4.cab
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.0…oUploader55.cab
O16 - DPF: {8E28B3A9-FE83-45D1-B657-D5426B81A121} (CustomerCtrl Class) - http://cs6b.instantservice.com/jars/customerxsigned41.cab
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/…tiveXPlugin.cab
O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://photos.groups.yahoo.com/ocx/us/yexplorer1_9us.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://optionsxpressevents.webex.com/clien…bex/ieatgpc.cab
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by107fd.bay107.hotmail.msn.com/activex/HMAtchmt.ocx
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: Norton AntiVirus (NAV) - Symantec Corporation - C:\Program Files\Norton AntiVirus\Norton AntiVirus\Engine\18.5.0.125\ccSvcHst.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

–
End of file - 7318 bytes

Conspire

Post #2December 30, 2010, 3:43 PM UTC

**In any case where you happen to be busy or unable to give us a reply, we would be more than grateful if you keep us informed in advance and we will be more than happy to wait. Failure to do so we will have your thread closed in THREE(3) days.

Hello there, flower4496

I'm Conspire, I'll be glad to help you with your computer problems.

Please observe these rules while we work:

Read the entire procedure
It is important to perform ALL actions in sequence.
If you don't know, stop and ask! Don't keep going on.
Please reply to this thread. Do not start a new topic.
Stick with me till you're given the all clear.
Remember, absence of symptoms does not mean the infection is all gone.
Don't attempt to clean your computer with any tools other than the ones I ask you to use during the cleanup process.

Please be advised, as I am still in training, all my replies to you will be checked for accuracy by one of our experts to ensure that I am giving you the best possible advise.
This may cause a delay, but I will do my best to keep it as short as possible.

Please bear with me, I will post back to you as soon as I can.

IMPORTANT NOTE : Please do not delete anything unless instructed to.

Conspire

Post #3January 1, 2011, 12:57 PM UTC

Hello there,

Download OTL to your desktop.

Right click on OTL.exe and click "Run as Adminstrator" to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output
Check the boxes beside LOP Check and Purity Check.

In the window under Custom Scans/Fixes copy and paste the following

netsvcs
%SYSTEMDRIVE%\*.*
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\Fonts\*.exe
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg 
%systemroot%\*.jpg 
%systemroot%\*.png 
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\System32\config\*.sav 
%PROGRAMFILES%\bak. /s
%systemroot%\system32\bak. /s
%ALLUSERSPROFILE%\Start Menu\*.lîk /x 
%systemroot%\system32\config\systemprofile\*.dat /x
%systemroot%\*.config
%systemroot%\system32\*.db
%PROGRAMFILES%\Internet Explorer\*.dat
%APPDATA%\Mikzosoft\Internet Explorer\Quick Launch\*.lnk /x
%USERPROFILE%\Deskuop\*.exe
%PROGRAMFILES%\Common Files\*.*
%systemroot%\*.src
%systemroot%\install\*.*
%systemroot%\system32\DLL\*.*
%systemroot%\system32\HelpFiles\*.*
%systemroot%\system32\rundll\*.*
%systemroot%\winn32\*.*
%systemroot%\Java\*.*
%systemroot%\system32\test\*.*
%systemroot%\system32\Rundll32\*.* 
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs

Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.

Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them all in.

===================================================

Scan With RootKitUnHooker

Please choose one link and download Rootkit Unhooker and save it to your desktop.
Link 1
Link 2
Link 3
Now double-click on RKUnhookerLE.exe to run it.
Click the Report tab, then click Scan.
Check (Tick) Drivers and Stealth
Uncheck the rest. then click OK
When prompted to Select Disks for Scan, make sure C:\ is checked and click OK
Wait till the scanner has finished and then click File > Save Report.
Save the report somewhere where you can find it. Click Close.
Copy the entire contents of the report and paste it in your next reply.

Note** you may get the following warning, just click OK and continue.

"Rootkit Unhooker has detected a parasite inside itself!
It is recommended to remove parasite, okay?"

===================================================

Download Security Check by screen317 from here or here.

Save it to your Desktop.
Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.

===================================================

On your next reply please post :
OTL log
RKU log
Checkup log

Let me know if you have any problems in performing with the steps above or any questions you may have.

Good Day!

flower4496

Post #4January 4, 2011, 2:27 AM UTC

Thank you for any help you can give.

Here are the OTL, RKU logs. The Checkup log came back blank. The Security Check program kept saying the system cannot find the path specified.

OTL

OTL logfile created on: 1/3/2011 9:03:24 PM - Run 1
OTL by OldTimer - Version 3.2.20.1 Folder = F:\My Documents\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

383.00 Mb Total Physical Memory | 126.00 Mb Available Physical Memory | 33.00% Memory free
919.00 Mb Paging File | 409.00 Mb Available in Paging File | 44.00% Paging File free
Paging file location(s): C:\pagefile.sys 574 1200 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 149.05 Gb Total Space | 137.85 Gb Free Space | 92.49% Space Free | Partition Type: NTFS
Drive F: | 74.51 Gb Total Space | 65.37 Gb Free Space | 87.74% Space Free | Partition Type: FAT32

Computer Name: PROFESSIONAL | User Name: Leon & Rose | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Leon & Rose\Local Settings\Application Data\Google\Chrome\Application\chrome.exe File not found
PRC - F:\My Documents\Downloads\OTL.exe (OldTimer Tools)

========== Modules (SafeList) ==========

MOD - F:\My Documents\Downloads\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

========== Driver Services (SafeList) ==========

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Search Bar = http://search.msn.com/spbasic.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page_bak = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Data = C3 17 11 E0 B2 A4 AC 29 3E F1 D7 B3 41 B1 2A 69 EF FE DE 71 3C 18 BA 0A F9 AA 17 17 FE 78 [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\software\mozilla\Firefox\extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\IPSFFPlgn\ [2010/12/28 11:37:41 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/11/18 09:44:13 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/11/18 09:43:13 | 000,000,000 | —D | M]

[2010/11/18 09:43:13 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions

O1 HOSTS File: ([2008/11/01 12:28:57 | 000,220,411 | —- | M]) - C:\WINDOWS\system32\drivers\etc\HOSTS
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 abcsearch.com #[IE-SpyAd]
O1 - Hosts: 127.0.0.1 admin.abcsearch.com
O1 - Hosts: 127.0.0.1 www3.abcsearch.com #[Browseraid]
O1 - Hosts: 127.0.0.1 www.abcsearch.com
O1 - Hosts: 127.0.0.1 absoluagency.com #[Trojan.StartPage.H]
O1 - Hosts: 127.0.0.1 acestats.com
O1 - Hosts: 127.0.0.1 www.acestats.com
O1 - Hosts: 127.0.0.1 www.activesearch.com #[Adware.ActiveSearch]
O1 - Hosts: 127.0.0.1 actualnames.com #[Parasite.ActualNames][Spyware.ActualNames]
O1 - Hosts: 127.0.0.1 www.actualnames.com
O1 - Hosts: 127.0.0.1 ad-up.com
O1 - Hosts: 127.0.0.1 www.ad-up.com
O1 - Hosts: 127.0.0.1 adatom.com
O1 - Hosts: 127.0.0.1 aesp.adatom.com
O1 - Hosts: 127.0.0.1 adbest.com #[IE-SpyAd]
O1 - Hosts: 127.0.0.1 www.adcipta.net #[W32/Malware]
O1 - Hosts: 127.0.0.1 adserv.adbonus.com #[IE-SpyAd]
O1 - Hosts: 127.0.0.1 www.adbonus.com
O1 - Hosts: 127.0.0.1 media.adcentriconline.com #[IE-SpyAd]
O1 - Hosts: 127.0.0.1 ad2.adcept.net
O1 - Hosts: 127.0.0.1 ad3.adcept.net
O1 - Hosts: 127.0.0.1 www.adcept.net #[IE-SpyAd]
O1 - Hosts: 127.0.0.1 adcomplete.com #[IE-SpyAd]
O1 - Hosts: 127.0.0.1 www.adcomplete.com
O1 - Hosts: 6051 more lines…
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton AntiVirus\Norton AntiVirus\Engine\18.5.0.125\ips\ipsbho.dll (Symantec Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {4E7BD74F-2B8D-469E-A1F6-FC7EB590A97D} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {63CC63C6-1AE1-491C-B96A-812A7950A1EC} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {C4069E3A-68F1-403E-B40E-20066696354B} - No CLSID value found.
O4 - HKLM..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe (Hewlett-Packard)
O4 - HKLM..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe (HP)
O4 - HKLM..\Run: [Symantec PIF AlertEng] C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe (Symantec Corporation)
O4 - HKCU..\Run: [Google Update] C:\Documents and Settings\Leon & Rose\Local Settings\Application Data\Google\Update\GoogleUpdate.exe File not found
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\SoftStuff Wallpaper Changer.lnk = C:\Program Files\SoftStuff\softstrt.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra Button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe (PokerStars)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation)
O15 - HKCU\..Trusted Domains: ameritrade.com ([]http in Trusted sites)
O15 - HKCU\..Trusted Domains: brokersxpress.com ([www] https in Trusted sites)
O15 - HKCU\..Trusted Domains: herbalink.com ([www] http in Trusted sites)
O15 - HKCU\..Trusted Domains: optionsxpress.com ([www] https in Trusted sites)
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} http://office.microsoft.com/templates/ieawsdc.cab (Microsoft Office Template and Media Control)
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} http://download.microsoft.com/download/e/4…/OGAControl.cab (Office Genuine Advantage Validation Tool)
O16 - DPF: {230C3D02-DA27-11D2-8612-00A0C93EEA3C} http://www.winkflash.com/photo/loaders/SAXFile.cab (SAXFile FileUpload ActiveX Control)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://fpdownload.macromedia.com/pub/shock…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {315B0BFB-2BD4-481B-80A3-A9B80727C61B} http://webiq005.webiqonline.com/WebIQ/Data…6-6D5536C585C9} (WebIQ Engine Application Object)
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} http://office.microsoft.com/officeupdate/content/opuc.cab (Office Update Installation Engine)
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} http://gfx1.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab (MSN Photo Upload Tool)
O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} http://fb.familylink.com/we_are_related/st…geUploader5.cab (Image Uploader Control)
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} http://upload.facebook.com/controls/Facebo…otoUploader.cab (Facebook Photo Uploader Control)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://v5.windowsupdate.microsoft.com/v5co…b?1098888781197 (WUWebControl Class)
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} https://webdl.symantec.com/activex/symdlmgr.cab (Symantec Download Manager)
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} http://www.winkflash.com/photo/loaders/ImageUploader4.cab (Image Uploader Control)
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.0…oUploader55.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {8E28B3A9-FE83-45D1-B657-D5426B81A121} http://cs6b.instantservice.com/jars/customerxsigned41.cab (CustomerCtrl Class)
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} http://www.sibelius.com/download/software/…tiveXPlugin.cab (ScorchPlugin Class)
O16 - DPF: {C7DB51B4-BCF7-4923-8874-7F1A0DC92277} http://office.microsoft.com/officeupdate/content/opuc4.cab (Office Update Installation Engine)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} http://photos.groups.yahoo.com/ocx/us/yexplorer1_9us.cab (PhotosCtrl Class)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/pub/shock…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} https://optionsxpressevents.webex.com/clien…bex/ieatgpc.cab (GpcContainer Class)
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} http://by107fd.bay107.hotmail.msn.com/activex/HMAtchmt.ocx (Hotmail Attachments Control)
O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O16 - DPF: YExplorer1_8US.CAB http://photos.groups.yahoo.com/ocx/us/yexplorer1_8us.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed] [removed]
O18 - Protocol\Handler\cetihpz {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Program Files\HP\hpcoretech\comp\hpuiprot.dll (Hewlett-Packard Company)
O18 - Protocol\Handler\ic32pp {BBCA9F81-8F4F-11D2-90FF-0080C83D3571} - C:\WINDOWS\wc98pp.dll ()
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\WINDOWS\web\wallpaper\Bliss.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\web\wallpaper\Bliss.bmp
O30 - LSA: Authentication Packages - (nwprovau) - C:\WINDOWS\System32\nwprovau.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2003/08/09 12:10:11 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O33 - MountPoints2\{b604cc28-d672-11dc-84c7-0050bab685e1}\Shell - "" = AutoRun
O33 - MountPoints2\{b604cc28-d672-11dc-84c7-0050bab685e1}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{b604cc28-d672-11dc-84c7-0050bab685e1}\Shell\AutoRun\command - "" = G:\LaunchU3.exe – File not found
O33 - MountPoints2\{b8218f00-b765-11df-85c1-f3fb67a08e1b}\Shell - "" = AutoRun
O33 - MountPoints2\{b8218f00-b765-11df-85c1-f3fb67a08e1b}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{b8218f00-b765-11df-85c1-f3fb67a08e1b}\Shell\AutoRun\command - "" = G:\LaunchU3.exe – File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (lsdelete) - C:\WINDOWS\System32\lsdelete.exe ()
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: HidServ - C:\WINDOWS\System32\hidserv.dll File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - C:\WINDOWS\system32\iprip.dll (Microsoft Corporation)
NetSvcs: Irmon - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: Ip6FwHlp - File not found

========== Files/Folders - Created Within 30 Days ==========

[2010/12/16 10:43:07 | 000,000,000 | —D | C] – F:\My Documents\Momsnowrem2010
[2010/09/09 06:43:42 | 133,582,520 | —- | C] (Lavasoft ) – C:\Program Files\Ad-AwareInstall.exe
[2003/12/09 13:16:52 | 000,442,368 | —- | C] ( ) – C:\WINDOWS\System32\comintfs.dll
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[251 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/01/03 20:36:01 | 000,001,002 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1960408961-1580818891-1060284298-1003UA.job
[2011/01/03 12:36:02 | 000,000,950 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1960408961-1580818891-1060284298-1003Core.job
[2011/01/03 10:51:32 | 000,000,073 | —- | M] () – C:\WINDOWS\efaxview.ini
[2011/01/02 07:59:57 | 000,000,472 | —- | M] () – C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2011/01/01 10:16:29 | 000,013,646 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2011/01/01 03:19:46 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/12/31 07:06:27 | 000,817,948 | —- | M] () – C:\WINDOWS\System32\drivers\NAV\1205000.07D\Cat.DB
[2010/12/28 11:37:13 | 000,002,100 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Norton AntiVirus.LNK
[2010/12/26 10:27:27 | 000,000,116 | —- | M] () – C:\WINDOWS\NeroDigital.ini
[2010/12/17 14:13:01 | 000,277,352 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2010/12/17 13:49:27 | 000,001,393 | —- | M] () – C:\WINDOWS\imsins.BAK
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[251 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/09/07 07:22:32 | 000,014,848 | —- | C] () – C:\WINDOWS\System32\EuEpmGdi.dll
[2010/09/07 07:22:31 | 000,013,192 | —- | C] () – C:\WINDOWS\System32\epmntdrv.sys
[2010/09/07 07:22:31 | 000,008,456 | —- | C] () – C:\WINDOWS\System32\EuGdiDrv.sys
[2008/10/22 10:27:16 | 000,003,920 | —- | C] () – C:\Documents and Settings\All Users\Application Data\LUUnInstall.LiveUpdate
[2008/06/24 08:33:01 | 000,001,755 | —- | C] () – C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2008/02/04 17:23:10 | 000,693,792 | —- | C] () – C:\WINDOWS\System32\OGACheckControl.DLL
[2007/05/11 07:38:37 | 000,000,000 | —- | C] () – C:\WINDOWS\webica.ini
[2007/02/24 11:23:25 | 000,000,028 | —- | C] () – C:\WINDOWS\pdf995.ini
[2007/02/18 17:41:59 | 000,000,142 | —- | C] () – C:\WINDOWS\wpd99.drv
[2007/02/18 17:41:23 | 000,051,716 | —- | C] () – C:\WINDOWS\System32\pdf995mon.dll
[2006/08/21 08:03:54 | 000,000,023 | —- | C] () – C:\WINDOWS\kodakpcd.Leon & Rose.ini
[2006/08/15 20:10:50 | 000,000,049 | —- | C] () – C:\WINDOWS\VistaEmail.ini
[2006/03/22 09:27:20 | 001,425,680 | —- | C] () – C:\Program Files\PPVIEW32.EXE
[2005/12/19 22:11:36 | 000,000,062 | —- | C] () – C:\WINDOWS\ANS2000.INI
[2005/12/19 22:11:36 | 000,000,020 | -H– | C] () – C:\WINDOWS\akebook.ini
[2005/12/19 22:11:36 | 000,000,004 | -H– | C] () – C:\WINDOWS\a3kebook.ini
[2005/04/21 09:41:26 | 000,000,116 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2005/03/05 08:49:03 | 000,000,000 | R-S- | C] () – C:\WINDOWS\System32\q068laju1do8.dll
[2005/03/04 17:30:45 | 000,000,429 | —- | C] () – C:\WINDOWS\System32\nt62rptr32.sys
[2005/03/04 14:17:17 | 000,002,217 | —- | C] () – C:\WINDOWS\delprot.ini
[2005/03/04 14:14:02 | 000,003,876 | —- | C] () – C:\WINDOWS\nhccek.dll
[2005/02/27 15:52:27 | 000,072,192 | —- | C] () – C:\WINDOWS\System32\zlib.dll
[2005/02/27 15:44:07 | 000,000,045 | —- | C] () – C:\WINDOWS\GJHMNKGH.ini
[2005/01/09 12:38:25 | 000,000,000 | —- | C] () – C:\WINDOWS\RAWImage.INI
[2004/12/24 14:13:39 | 000,000,000 | —- | C] () – C:\WINDOWS\OpPrintServer.INI
[2004/10/26 11:37:39 | 000,823,359 | —- | C] () – C:\WINDOWS\System32\wdoz32t.dll
[2004/04/14 18:53:00 | 000,051,712 | —- | C] () – C:\WINDOWS\wc98pp.dll
[2004/04/08 11:52:09 | 000,000,021 | —- | C] () – C:\WINDOWS\Shapeworks.ini
[2003/11/27 12:51:00 | 000,012,034 | —- | C] () – C:\WINDOWS\hpdj5600.ini
[2003/11/21 14:58:06 | 000,005,120 | —- | C] () – C:\WINDOWS\System32\TMFaxUI.dll
[2003/11/21 14:57:52 | 000,013,824 | —- | C] () – C:\WINDOWS\System32\TMFaxMon.dll
[2003/10/26 12:09:36 | 000,000,073 | —- | C] () – C:\WINDOWS\cdplayer.ini
[2003/08/09 16:20:39 | 000,000,073 | —- | C] () – C:\WINDOWS\efaxview.ini
[2003/08/09 14:06:53 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2003/08/09 13:27:40 | 000,363,520 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2003/08/09 07:56:42 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2003/01/07 14:05:08 | 000,002,695 | —- | C] () – C:\WINDOWS\System32\OUTLPERF.INI
[2002/12/10 00:00:00 | 001,708,032 | —- | C] () – C:\WINDOWS\System32\MSO97V.DLL
[2002/12/10 00:00:00 | 000,036,864 | —- | C] () – C:\WINDOWS\System32\DOCOBJ.DLL
[2002/12/10 00:00:00 | 000,032,768 | —- | C] () – C:\WINDOWS\System32\MSORFS.DLL
[2002/12/10 00:00:00 | 000,032,768 | —- | C] () – C:\WINDOWS\System32\HLINKPRX.DLL
[2002/04/09 17:17:14 | 000,249,270 | —- | C] () – C:\WINDOWS\System32\_007350_.tmp.dll
[2001/08/23 12:00:00 | 000,022,040 | —- | C] () – C:\WINDOWS\System32\_007318_.tmp.dll

========== LOP Check ==========

[2008/10/24 11:45:42 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Applications
[2008/02/19 20:04:48 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\msw
[2008/11/22 11:36:59 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Musicnotes
[2008/10/22 10:18:19 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PCSettings
[2011/01/03 16:49:43 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\pdf995
[2010/11/24 10:35:50 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TaxCut
[2007/05/05 10:16:53 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2008/02/19 19:51:56 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Viewpoint
[2010/09/09 06:49:00 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\{ECC164E0-3133-4C70-A831-F08DB2940F70}
[2011/01/02 07:59:57 | 000,000,472 | —- | M] () – C:\WINDOWS\Tasks\Ad-Aware Update (Weekly).job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2011/01/01 03:19:15 | 000,006,636 | —- | M] () – C:\aaw7boot.log
[2005/09/01 18:50:38 | 000,000,007 | —- | M] () – C:\ad.dll
[2003/09/11 06:30:28 | 000,000,007 | —- | M] () – C:\ap.dll
[2003/09/11 06:30:38 | 000,000,007 | —- | M] () – C:\as.dll
[2003/08/09 12:10:11 | 000,000,000 | —- | M] () – C:\AUTOEXEC.BAT
[2003/09/11 06:30:49 | 000,000,007 | —- | M] () – C:\ax.dll
[2003/09/11 06:30:59 | 000,000,007 | —- | M] () – C:\az.dll
[2010/09/29 16:21:14 | 000,000,211 | -HS- | M] () – C:\boot.ini
[2003/08/09 12:10:11 | 000,000,000 | —- | M] () – C:\CONFIG.SYS
[2006/03/22 09:27:21 | 000,081,978 | —- | M] (Microsoft Corporation) – C:\HLINK.DLL
[2006/03/22 09:27:22 | 000,014,160 | —- | M] (Microsoft Corporation) – C:\HLINKPRX.DLL
[2003/11/27 12:54:56 | 000,000,000 | —- | M] () – C:\hpcmerr.log
[2010/08/07 15:31:25 | 002,000,000 | —- | M] () – C:\hpfr5600.log
[2003/08/09 12:10:11 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2005/03/04 14:07:40 | 000,000,048 | -HS- | M] () – C:\keys.ini
[2005/03/06 21:18:50 | 000,006,949 | —- | M] () – C:\log.txt
[2005/03/06 21:20:26 | 000,006,949 | —- | M] () – C:\logl2mfix.txt
[2003/08/09 12:10:11 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2006/03/22 09:27:21 | 000,014,336 | —- | M] (Microsoft) – C:\MSIMRT.DLL
[2006/03/22 09:27:22 | 000,010,544 | —- | M] (Microsoft) – C:\MSIMRT16.DLL
[2006/03/22 09:27:22 | 000,022,016 | —- | M] (Microsoft) – C:\MSIMRT32.DLL
[2006/03/22 09:27:21 | 000,120,320 | —- | M] (Microsoft) – C:\MSIMUSIC.DLL
[2006/03/22 09:27:22 | 001,691,408 | —- | M] () – C:\MSO97V.DLL
[2006/03/22 09:27:22 | 000,005,632 | —- | M] () – C:\MSPPT8VR.OLB
[2006/03/22 09:27:23 | 000,229,136 | —- | M] (Microsoft Corporation) – C:\MSV7ENU.DLL
[2004/10/30 18:25:41 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2008/10/24 13:56:37 | 000,250,048 | RHS- | M] () – C:\ntldr
[2011/01/01 03:19:38 | 601,882,624 | -HS- | M] () – C:\pagefile.sys
[2006/03/22 09:27:59 | 000,000,014 | —- | M] () – C:\PLAYLIST.LST
[2006/03/22 09:27:23 | 000,483,386 | —- | M] () – C:\PP4X322.DLL
[2006/03/22 09:27:22 | 000,098,361 | —- | M] () – C:\PP7X32.DLL
[2006/03/22 09:27:22 | 000,158,208 | —- | M] (Microsoft Corporation) – C:\PPINTLV.DLL
[2006/03/22 09:27:22 | 000,032,768 | —- | M] () – C:\RAPPT.DLL
[2008/12/31 18:09:06 | 000,012,636 | —- | M] () – C:\Rescued document.txt
[2005/12/19 22:05:42 | 000,000,642 | —- | M] () – C:\scl.dat
[2006/03/22 09:27:22 | 000,194,320 | —- | M] (Microsoft Corp.) – C:\T2EMBED.DLL
[2005/03/06 21:16:56 | 000,000,000 | —- | M] () – C:\test5.txt
[2006/03/22 09:27:22 | 000,456,464 | —- | M] (Microsoft Corporation) – C:\URLMON.DLL
[2006/03/22 09:27:21 | 000,480,528 | —- | M] (Microsoft Corporation) – C:\WININET.DLL

< %systemroot%\Fonts\*.com >

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2003/08/09 12:09:27 | 000,000,067 | -HS- | M] () – C:\WINDOWS\Fonts\desktop.ini
[6 C:\WINDOWS\Fonts\*.tmp files -> C:\WINDOWS\Fonts\*.tmp -> ]

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2003/06/18 16:31:48 | 000,018,944 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\mdippr.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >
[2004/05/18 16:26:04 | 000,000,208 | —- | M] () – C:\Documents and Settings\All Users\Favorites\Yahoo! Mail.url
[2004/05/18 16:13:06 | 000,000,207 | —- | M] () – C:\Documents and Settings\All Users\Favorites\Yahoo!.url

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2010/09/09 06:44:40 | 133,582,520 | —- | M] (Lavasoft ) – C:\Program Files\Ad-AwareInstall.exe
[2006/03/22 09:27:21 | 001,425,680 | —- | M] () – C:\Program Files\PPVIEW32.EXE

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2003/08/09 07:53:50 | 000,094,208 | —- | M] () – C:\WINDOWS\system32\config\default.sav
[2003/08/09 07:53:50 | 000,626,688 | —- | M] () – C:\WINDOWS\system32\config\software.sav
[2003/08/09 07:53:50 | 000,393,216 | —- | M] () – C:\WINDOWS\system32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lîk /x >
[2008/10/24 14:38:20 | 000,000,272 | -HS- | M] () – C:\Documents and Settings\All Users\Start Menu\desktop.ini
[2010/10/29 09:47:26 | 000,000,741 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\PokerStars.lnk
[2010/08/14 07:42:01 | 000,001,568 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Set Program Access and Defaults.lnk
[2008/10/24 13:08:13 | 000,001,507 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Windows Update.lnk

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Mikzosoft\Internet Explorer\Quick Launch\*.lnk /x >

< %USERPROFILE%\Deskuop\*.exe >

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-01-01 08:02:39

========== Alternate Data Streams ==========

@Alternate Data Stream - 88 bytes -> C:\ad.dll:SummaryInformation

< End of report >

OTL Extras

OTL Extras logfile created on: 1/3/2011 9:03:24 PM - Run 1
OTL by OldTimer - Version 3.2.20.1 Folder = F:\My Documents\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

383.00 Mb Total Physical Memory | 126.00 Mb Available Physical Memory | 33.00% Memory free
919.00 Mb Paging File | 409.00 Mb Available in Paging File | 44.00% Paging File free
Paging file location(s): C:\pagefile.sys 574 1200 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 149.05 Gb Total Space | 137.85 Gb Free Space | 92.49% Space Free | Partition Type: NTFS
Drive F: | 74.51 Gb Total Space | 65.37 Gb Free Space | 87.74% Space Free | Partition Type: FAT32

Computer Name: PROFESSIONAL | User Name: Leon & Rose | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = ChromeHTML] – Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusOverride" = 0
"FirewallOverride" = 0
"AntiVirusDisableNotify" = 1
"FirewallDisableNotify" = 1
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Yahoo!\Messenger\YPager.exe" = C:\Program Files\Yahoo!\Messenger\YPager.exe:*:Enabled:Yahoo! Messenger – File not found
"C:\Program Files\Yahoo!\Messenger\YServer.exe" = C:\Program Files\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server – File not found
"C:\WINDOWS\system32\mmc.exe" = C:\WINDOWS\system32\mmc.exe:*:Disabled:Microsoft Management Console – (Microsoft Corporation)
"C:\Program Files\AIM\aim.exe" = C:\Program Files\AIM\aim.exe:*:Enabled:AOL Instant Messenger – File not found
"C:\WINDOWS\system32\dpvsetup.exe" = C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test – (Microsoft Corporation)
"C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe" = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe:*:Enabled:EasyShare – File not found
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" = C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger – File not found

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{08C5815C-2C6E-44f8-8748-0E61BC9AFB68}" = Symantec KB-DocID:2003093015493306
"{0F2F77E4-4053-4108-B153-81F0B42EDCF4}" = WebIQ Technology Engine
"{10964A8F-21C1-45EA-BC2D-F84B505C3848}" = H&R; Block Deluxe + Efile + State 2010
"{1E697208-321A-4BD7-A8A3-41B406EB3DED}" = eBook Pro Viewer 5.5
"{26A24AE4-039D-4CA4-87B4-2F83216012FF}" = Java™ 6 Update 21
"{26BDE7D8-93F0-4A07-AD47-1707DB417941}" = Camera Support Core Library
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{68E7E8BD-2233-49BE-81D6-1A1FAF1B5196}" = RAW Image Task 1.1
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8CDC6712-AF80-459E-911F-F1E156CB0AB0}" = hp deskjet 5600
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{91CA0409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Small Business Edition 2003
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{AC76BA86-7AD7-1033-7B44-A94000000001}" = Adobe Reader 9.4.1
"{B34BE30D-A759-4EC2-B58F-19FE2DEBF651}" = Camera Window
"{BEF56F2D-56ED-4176-BF72-7B68D4A3B98D}" = Canon PhotoRecord
"{C1D76D7A-F3BB-47EA-A746-5B1E2FFC1DF2}" = Canon Utilities ZoomBrowser EX
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CF2C1A86-5A98-4862-A3AE-9992E3A6427D}" = RemoteCapture Task 1.0.3
"{D3EE034D-5B92-4A55-AA02-2E6D0A6A96EE}" = Windows Resource Kit Tools - SubInAcl.exe
"{DBA4DB9D-EE51-4944-A419-98AB1F1249C8}" = LiveUpdate Notice (Symantec Corporation)
"{DE286975-ACF1-45B8-9EF7-34E162B2C817}" = MovieEdit Task
"{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}" = Ad-Aware
"{E0828692-FD9D-459F-9312-C645C3CA6650}" = HP Photo and Imaging 2.0 - Deskjet Series
"{EF4C7EB0-D71B-43A3-9552-8053DE4B0401}" = PhotoStitch
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"ActiveTouchMeetingClient" = WebEx
"Ad-Aware" = Ad-Aware
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Shockwave Player" = Adobe Shockwave Player
"cbox" = Conference Client Uninstall
"CCleaner" = CCleaner
"EASEUS Partition Master Home Edition_is1" = EASEUS Partition Master 6.1.1 Home Edition
"EASEUS Todo Backup 1.1_is1" = EASEUS Todo Backup 1.1
"HijackThis" = HijackThis 1.99.1
"hp deskjet 5600 series_Driver" = hp deskjet 5600 series
"hp print screen utility" = hp print screen utility
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"InstallShield_{26BDE7D8-93F0-4A07-AD47-1707DB417941}" = Canon Camera Support Core Library
"InstallShield_{68E7E8BD-2233-49BE-81D6-1A1FAF1B5196}" = Canon RAW Image Task for ZoomBrowser EX
"InstallShield_{B34BE30D-A759-4EC2-B58F-19FE2DEBF651}" = Canon Camera Window for ZoomBrowser EX
"InstallShield_{CF2C1A86-5A98-4862-A3AE-9992E3A6427D}" = Canon RemoteCapture Task for ZoomBrowser EX
"InstallShield_{DE286975-ACF1-45B8-9EF7-34E162B2C817}" = Canon MovieEdit Task for ZoomBrowser EX
"InstallShield_{EF4C7EB0-D71B-43A3-9552-8053DE4B0401}" = Canon Utilities PhotoStitch 3.1
"LiveReg" = LiveReg (Symantec Corporation)
"LiveUpdate" = LiveUpdate 3.2 (Symantec Corporation)
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Mozilla Firefox (3.6.12)" = Mozilla Firefox (3.6.12)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"MSN Music Assistant" = MSN Music Assistant
"NAV" = Norton AntiVirus
"Nero - Burning Rom!UninstallKey" = Nero OEM
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"NMPUninstallKey" = Nero Media Player
"Pdf995" = Pdf995 (installed by TaxCut)
"PdfEdit995" = PdfEdit995 (installed by TaxCut)
"PokerStars" = PokerStars
"PPTView97" = Microsoft PowerPoint Viewer 97
"scrabble" = SCRABBLE (remove only)
"Shockwave" = Shockwave
"System Monitor for Windows 98/NT/XP/2000/2003_is1" = System Monitor for Windows 98/NT/XP/2000/2003
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome
"Move Networks Player - IE" = Move Networks Media Player for Internet Explorer

========== Last 10 Event Log Errors ==========

Error: Unable to start EventLog service!

< End of report >

RKU Log
RkU Version: 3.8.388.590, Type LE (SR2)
==============================================
OS Name: Windows XP
Version 5.1.2600 (Service Pack 3)
Number of processors #1
==============================================
>Drivers
==============================================
0x804D7000 C:\WINDOWS\system32\ntoskrnl.exe 2189952 bytes (Microsoft Corporation, NT Kernel & System)
0x804D7000 PnpManager 2189952 bytes
0x804D7000 RAW 2189952 bytes
0x804D7000 WMIxWDM 2189952 bytes
0xBF800000 Win32k 1855488 bytes
0xBF800000 C:\WINDOWS\System32\win32k.sys 1855488 bytes (Microsoft Corporation, Multi-User Win32 Driver)
0xF262B000 C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\Definitions\VirusDefs\20110103.001\NAVEX15.SYS 1355776 bytes (Symantec Corporation, AV Engine)
0xF3B62000 C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\Definitions\BASHDefs\20101123.003\BHDrvx86.sys 704512 bytes (Symantec Corporation, BASH Driver)
0xF7236000 C:\WINDOWS\System32\DRIVERS\winachcf.sys 700416 bytes (Conexant, Modem)
0xF74BF000 SYMEFA.SYS 671744 bytes
0xF741B000 Ntfs.sys 577536 bytes (Microsoft Corporation, NT File System Driver)
0xF32AE000 C:\WINDOWS\System32\Drivers\NAV\1205000.07D\SRTSP.SYS 544768 bytes (Symantec Corporation, Symantec AutoProtect)
0xF3C89000 C:\WINDOWS\System32\DRIVERS\mrxsmb.sys 458752 bytes (Microsoft Corporation, Windows NT SMB Minirdr)
0xF3C2B000 C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys 385024 bytes (Symantec Corporation, Symantec Eraser Control Driver)
0xF7080000 C:\WINDOWS\System32\DRIVERS\update.sys 385024 bytes (Microsoft Corporation, Update Driver)
0xBF012000 C:\WINDOWS\System32\ati2dvaa.dll 380928 bytes (ATI Technologies Inc., ATI RAGE 128 WindowsNT Display Driver)
0xF3F36000 C:\WINDOWS\System32\Drivers\NAV\1205000.07D\SYMTDI.SYS 364544 bytes (Symantec Corporation, Network Dispatch Driver)
0xF3F8F000 C:\WINDOWS\System32\DRIVERS\tcpip.sys 364544 bytes (Microsoft Corporation, TCP/IP Protocol Driver)
0xF3E6A000 C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\Definitions\IPSDefs\20101231.001\IDSxpx86.sys 360448 bytes (Symantec Corporation, IDS Core Driver)
0xF367B000 C:\WINDOWS\System32\DRIVERS\srv.sys 360448 bytes (Microsoft Corporation, Server driver)
0xF7575000 SYMDS.SYS 356352 bytes
0xF733C000 C:\WINDOWS\System32\DRIVERS\ati2mtaa.sys 327680 bytes (ATI Technologies Inc., ATI RAGE 128 Miniport Driver)
0xBFFA0000 C:\WINDOWS\System32\ATMFD.DLL 290816 bytes (Adobe Systems Incorporated, Windows NT OpenType/Type 1 Font Driver)
0xF2B83000 C:\WINDOWS\System32\Drivers\HTTP.sys 266240 bytes (Microsoft Corporation, HTTP Protocol Stack)
0xF3E0A000 C:\WINDOWS\system32\DRIVERS\tcpip6.sys 229376 bytes (Microsoft Corporation, IPv6 driver)
0xF70DE000 C:\WINDOWS\System32\DRIVERS\rdpdr.sys 196608 bytes (Microsoft Corporation, Microsoft RDP Device redirector)
0xF765A000 ACPI.sys 188416 bytes (Microsoft Corporation, ACPI Driver for NT)
0xF374B000 C:\WINDOWS\System32\DRIVERS\mrxdav.sys 184320 bytes (Microsoft Corporation, Windows NT WebDav Minirdr)
0xF73EE000 NDIS.sys 184320 bytes (Microsoft Corporation, NDIS 5.1 wrapper driver)
0xF25EC000 C:\WINDOWS\system32\drivers\kmixer.sys 176128 bytes (Microsoft Corporation, Kernel Mode Audio Mixer)
0xF3CF9000 C:\WINDOWS\System32\DRIVERS\rdbss.sys 176128 bytes (Microsoft Corporation, Redirected Drive Buffering SubSystem Driver)
0xF3E42000 C:\WINDOWS\System32\DRIVERS\netbt.sys 163840 bytes (Microsoft Corporation, MBT Transport driver)
0xF3778000 C:\WINDOWS\System32\DRIVERS\nwrdr.sys 163840 bytes (Microsoft Corporation, NetWare Redirector File System Driver)
0xF7604000 dmio.sys 155648 bytes (Microsoft Corp., Veritas Software, NT Disk Manager I/O Driver)
0xF3F10000 C:\WINDOWS\System32\DRIVERS\ipnat.sys 155648 bytes (Microsoft Corporation, IP Network Address Translator)
0xF3EEA000 C:\WINDOWS\system32\Drivers\SYMEVENT.SYS 155648 bytes (Symantec Corporation, Symantec Event Library)
0xF3B3E000 C:\WINDOWS\System32\Drivers\Fastfat.SYS 147456 bytes (Microsoft Corporation, Fast FAT File System Driver)
0xF3D24000 C:\WINDOWS\system32\drivers\NAV\1205000.07D\Ironx86.SYS 147456 bytes (Symantec Corporation, Iron Driver)
0xF7304000 C:\WINDOWS\system32\drivers\portcls.sys 147456 bytes (Microsoft Corporation, Port Class (Class Driver for Port/Miniport Devices))
0xF71FE000 C:\WINDOWS\System32\DRIVERS\USBPORT.SYS 147456 bytes (Microsoft Corporation, USB 1.1 & 2.0 Port Driver)
0xF72E1000 C:\WINDOWS\system32\drivers\ks.sys 143360 bytes (Microsoft Corporation, Kernel CSA Library)
0xF3D48000 C:\WINDOWS\System32\drivers\afd.sys 139264 bytes (Microsoft Corporation, Ancillary Function Driver for WinSock)
0xF75CC000 fltmgr.sys 131072 bytes (Microsoft Corporation, Microsoft Filesystem Filter Manager)
0xF762A000 ftdisk.sys 126976 bytes (Microsoft Corporation, FT Disk Driver)
0xF3C0E000 C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys 118784 bytes (Symantec Corporation, Symantec Eraser Utility Driver)
0xF7063000 C:\WINDOWS\system32\DRIVERS\EuDisk.sys 118784 bytes (CHENGDU YIWO Tech Development Co., Ltd, EuDisk Bus Enumerator)
0xF73D4000 Mup.sys 106496 bytes (Microsoft Corporation, Multiple UNC Provider driver)
0xF75EC000 atapi.sys 98304 bytes (Microsoft Corporation, IDE/ATAPI Port Driver)
0xF3B26000 C:\WINDOWS\System32\Drivers\dump_atapi.sys 98304 bytes
0xF74A8000 KSecDD.sys 94208 bytes (Microsoft Corporation, Kernel Security Support Provider Interface)
0xF71E7000 C:\WINDOWS\System32\DRIVERS\ndiswan.sys 94208 bytes (Microsoft Corporation, MS PPP Framing Driver (Strong Encryption))
0xF3980000 C:\WINDOWS\System32\DRIVERS\nwlnkipx.sys 90112 bytes (Microsoft Corporation, NWLINK2 IPX Protocol Driver)
0xF2E1A000 C:\WINDOWS\system32\drivers\wdmaud.sys 86016 bytes (Microsoft Corporation, MMSYSTEM Wave/Midi API mapper)
0xF2617000 C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\Definitions\VirusDefs\20110103.001\NAVENG.SYS 81920 bytes (Symantec Corporation, AV Engine)
0xF7222000 C:\WINDOWS\System32\DRIVERS\parport.sys 81920 bytes (Microsoft Corporation, Parallel Port Driver)
0xF7328000 C:\WINDOWS\System32\DRIVERS\VIDEOPRT.SYS 81920 bytes (Microsoft Corporation, Video Port Driver)
0x806EE000 ACPI_HAL 81152 bytes
0x806EE000 C:\WINDOWS\system32\hal.dll 81152 bytes (Microsoft Corporation, Hardware Abstraction Layer DLL)
0xF3FE8000 C:\WINDOWS\System32\DRIVERS\ipsec.sys 77824 bytes (Microsoft Corporation, IPSec Driver)
0xBF000000 C:\WINDOWS\System32\drivers\dxg.sys 73728 bytes (Microsoft Corporation, DirectX Graphics Driver)
0xF7563000 sr.sys 73728 bytes (Microsoft Corporation, System Restore Filesystem Filter Driver)
0xF7649000 pci.sys 69632 bytes (Microsoft Corporation, NT Plug and Play PCI Enumerator)
0xF71AE000 C:\WINDOWS\System32\DRIVERS\psched.sys 69632 bytes (Microsoft Corporation, MS QoS Packet Scheduler)
0xF78E9000 C:\WINDOWS\System32\Drivers\Cdfs.SYS 65536 bytes (Microsoft Corporation, CD-ROM File System Driver)
0xF7789000 C:\WINDOWS\System32\DRIVERS\cdrom.sys 65536 bytes (Microsoft Corporation, SCSI CD-ROM Driver)
0xF3AEE000 C:\WINDOWS\System32\DRIVERS\nwlnknb.sys 65536 bytes (Microsoft Corporation, NWLINK2 IPX Netbios Protocol Driver)
0xF7779000 C:\WINDOWS\System32\DRIVERS\serial.sys 65536 bytes (Microsoft Corporation, Serial Device Driver)
0xF7759000 C:\WINDOWS\system32\drivers\drmk.sys 61440 bytes (Microsoft Corporation, Microsoft Kernel DRM Descrambler Filter)
0xF76F9000 Lbd.sys 61440 bytes (Lavasoft AB, Boot Driver)
0xF7799000 C:\WINDOWS\System32\DRIVERS\redbook.sys 61440 bytes (Microsoft Corporation, Redbook Audio Filter Driver)
0xF2FDF000 C:\WINDOWS\system32\drivers\sysaudio.sys 61440 bytes (Microsoft Corporation, System Audio WDM Filter)
0xF7809000 C:\WINDOWS\System32\DRIVERS\usbhub.sys 61440 bytes (Microsoft Corporation, Default Hub Driver for USB)
0xF3938000 C:\WINDOWS\System32\DRIVERS\nwlnkspx.sys 57344 bytes (Microsoft Corporation, NWLINK2 SPX Protocol Driver)
0xF76E9000 C:\WINDOWS\System32\DRIVERS\CLASSPNP.SYS 53248 bytes (Microsoft Corporation, SCSI Class System Dll)
0xF7769000 C:\WINDOWS\System32\DRIVERS\i8042prt.sys 53248 bytes (Microsoft Corporation, i8042 Port Driver)
0xF77B9000 C:\WINDOWS\System32\DRIVERS\rasl2tp.sys 53248 bytes (Microsoft Corporation, RAS L2TP mini-port/call-manager driver)
0xF76C9000 VolSnap.sys 53248 bytes (Microsoft Corporation, Volume Shadow Copy Driver)
0xF77D9000 C:\WINDOWS\System32\DRIVERS\raspptp.sys 49152 bytes (Microsoft Corporation, Peer-to-Peer Tunneling Protocol)
0xF7709000 agp440.sys 45056 bytes (Microsoft Corporation, 440 NT AGP Filter)
0xF78B9000 C:\WINDOWS\System32\Drivers\Fips.SYS 45056 bytes (Microsoft Corporation, FIPS Crypto Driver)
0xF77A9000 C:\WINDOWS\System32\DRIVERS\imapi.sys 45056 bytes (Microsoft Corporation, IMAPI Kernel Driver)
0xF76B9000 MountMgr.sys 45056 bytes (Microsoft Corporation, Mount Manager)
0xF7739000 C:\WINDOWS\System32\DRIVERS\p3.sys 45056 bytes (Microsoft Corporation, Processor Device Driver)
0xF77C9000 C:\WINDOWS\System32\DRIVERS\raspppoe.sys 45056 bytes (Microsoft Corporation, RAS PPPoE mini-port/call-manager driver)
0xF78A9000 C:\WINDOWS\system32\drivers\NAV\1205000.07D\SRTSPX.SYS 45056 bytes (Symantec Corporation, Symantec AutoProtect)
0xF7749000 C:\WINDOWS\system32\drivers\es1371mp.sys 40960 bytes (Creative Technology Ltd., ENSONIQ AudioPCI 97 WDM Audio Miniport)
0xF76A9000 isapnp.sys 40960 bytes (Microsoft Corporation, PNP ISA Bus Driver)
0xF7819000 C:\WINDOWS\System32\Drivers\NDProxy.SYS 40960 bytes (Microsoft Corporation, NDIS Proxy)
0xF77F9000 C:\WINDOWS\System32\DRIVERS\termdd.sys 40960 bytes (Microsoft Corporation, Terminal Server Driver)
0xF76D9000 disk.sys 36864 bytes (Microsoft Corporation, PnP Disk Driver)
0xF7889000 C:\WINDOWS\system32\drivers\ip6fw.sys 36864 bytes (Microsoft Corporation, IPv6 Windows Firewall Driver)
0xF77E9000 C:\WINDOWS\System32\DRIVERS\msgpc.sys 36864 bytes (Microsoft Corporation, MS General Packet Classifier)
0xF7899000 C:\WINDOWS\System32\DRIVERS\netbios.sys 36864 bytes (Microsoft Corporation, NetBIOS interface driver)
0xF2D0C000 C:\WINDOWS\System32\Drivers\Normandy.SYS 36864 bytes (RKU Driver)
0xF7879000 C:\WINDOWS\System32\DRIVERS\wanarp.sys 36864 bytes (Microsoft Corporation, MS Remote Access and Routing ARP Driver)
0xF7999000 C:\WINDOWS\System32\Drivers\Modem.SYS 32768 bytes (Microsoft Corporation, Modem Device Driver)
0xF7A81000 C:\WINDOWS\System32\Drivers\Npfs.SYS 32768 bytes (Microsoft Corporation, NPFS Driver)
0xF79C1000 C:\WINDOWS\System32\DRIVERS\fdc.sys 28672 bytes (Microsoft Corporation, Floppy Disk Controller Driver)
0xF7929000 C:\WINDOWS\System32\DRIVERS\PCIIDEX.SYS 28672 bytes (Microsoft Corporation, PCI IDE Bus Driver Extension)
0xF7981000 C:\WINDOWS\System32\DRIVERS\usbprint.sys 28672 bytes (Microsoft Corporation, USB Printer driver)
0xF7AA1000 C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS 28672 bytes (Microsoft Corporation, USB Mass Storage Class Driver)
0xF7941000 eubakup.sys 24576 bytes (CHENGDU YIWO Tech Development Co., Ltd, Disk Backup Driver)
0xF79B1000 C:\WINDOWS\System32\DRIVERS\kbdclass.sys 24576 bytes (Microsoft Corporation, Keyboard Class Driver)
0xF79A9000 C:\WINDOWS\System32\DRIVERS\mouclass.sys 24576 bytes (Microsoft Corporation, Mouse Class Driver)
0xF7979000 C:\WINDOWS\System32\DRIVERS\RTL8139.SYS 24576 bytes (Realtek Semiconductor Corporation, Realtek RTL8139 NDIS 5.0 Driver)
0xF7AB1000 C:\WINDOWS\system32\drivers\symlcbrd.sys 24576 bytes (Symantec Corporation, Symantec Core Component)
0xF79D9000 C:\WINDOWS\System32\DRIVERS\usbuhci.sys 24576 bytes (Microsoft Corporation, UHCI USB Miniport Driver)
0xF7A61000 C:\WINDOWS\System32\drivers\vga.sys 24576 bytes (Microsoft Corporation, VGA/Super VGA Video Driver)
0xF7A49000 C:\WINDOWS\System32\DRIVERS\flpydisk.sys 20480 bytes (Microsoft Corporation, Floppy Driver)
0xF7A71000 C:\WINDOWS\System32\Drivers\Msfs.SYS 20480 bytes (Microsoft Corporation, Mailslot driver)
0xF7931000 PartMgr.sys 20480 bytes (Microsoft Corporation, Partition Manager)
0xF7A09000 C:\WINDOWS\System32\DRIVERS\ptilink.sys 20480 bytes (Parallel Technologies, Inc., Parallel Technologies DirectParallel IO Library)
0xF7939000 PxHelp20.sys 20480 bytes (Sonic Solutions, Px Engine Device Driver for Windows 2000/XP)
0xF7A19000 C:\WINDOWS\System32\DRIVERS\raspti.sys 20480 bytes (Microsoft Corporation, PTI DirectParallel® mini-port/call-manager driver)
0xF79F9000 C:\WINDOWS\System32\DRIVERS\TDI.SYS 20480 bytes (Microsoft Corporation, TDI Wrapper)
0xF7A01000 C:\WINDOWS\System32\watchdog.sys 20480 bytes (Microsoft Corporation, Watchdog Driver)
0xF2EEB000 C:\WINDOWS\System32\DRIVERS\asyncmac.sys 16384 bytes (Microsoft Corporation, MS Remote Access serial network driver)
0xF7ABD000 eufs.sys 16384 bytes (CHENGDU YIWO Tech Development Co., Ltd, File System Filter Driver)
0xF7B41000 C:\WINDOWS\system32\drivers\MODEMCSA.sys 16384 bytes (Microsoft Corporation, Unimodem CSA Filter)
0xF7BA1000 C:\WINDOWS\System32\DRIVERS\mssmbios.sys 16384 bytes (Microsoft Corporation, System Management BIOS Driver)
0xF3EE2000 C:\WINDOWS\System32\DRIVERS\ndisuio.sys 16384 bytes (Microsoft Corporation, NDIS User mode I/O Driver)
0xF7B69000 C:\WINDOWS\System32\DRIVERS\serenum.sys 16384 bytes (Microsoft Corporation, Serial Port Enumerator)
0xF7AB9000 C:\WINDOWS\system32\BOOTVID.dll 12288 bytes (Microsoft Corporation, VGA Boot Driver)
0xF738C000 C:\WINDOWS\System32\drivers\Dxapi.sys 12288 bytes (Microsoft Corporation, DirectX API Driver)
0xF3A2A000 C:\Program Files\Lavasoft\Ad-Aware\KernExplorer.sys 12288 bytes
0xF7B7D000 C:\WINDOWS\System32\DRIVERS\ndistapi.sys 12288 bytes (Microsoft Corporation, NDIS 3.0 connection wrapper driver)
0xF7B5D000 C:\WINDOWS\System32\DRIVERS\rasacd.sys 12288 bytes (Microsoft Corporation, RAS Automatic Connection Driver)
0xF7B4D000 C:\WINDOWS\system32\DRIVERS\tunmp.sys 12288 bytes (Microsoft Corporation, Microsoft Tunnel Interface Driver)
0xF71DF000 C:\WINDOWS\System32\drivers\ws2ifsl.sys 12288 bytes (Microsoft Corporation, Winsock2 IFS Layer)
0xF7BEB000 C:\WINDOWS\System32\Drivers\Beep.SYS 8192 bytes (Microsoft Corporation, BEEP Driver)
0xF7BAF000 dmload.sys 8192 bytes (Microsoft Corp., Veritas Software., NT Disk Manager Startup Driver)
0xF7C23000 C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS 8192 bytes
0xF7BE7000 C:\WINDOWS\System32\Drivers\Fs_Rec.SYS 8192 bytes (Microsoft Corporation, File System Recognizer Driver)
0xF7BAD000 intelide.sys 8192 bytes (Microsoft Corporation, Intel PCI IDE Driver)
0xF7BA9000 C:\WINDOWS\system32\KDCOM.DLL 8192 bytes (Microsoft Corporation, Kernel Debugger HW Extension DLL)
0xF7BEF000 C:\WINDOWS\System32\Drivers\mnmdd.SYS 8192 bytes (Microsoft Corporation, Frame buffer simulator)
0xF7C3F000 C:\WINDOWS\System32\Drivers\ParVdm.SYS 8192 bytes (Microsoft Corporation, VDM Parallel Driver)
0xF7BF3000 C:\WINDOWS\System32\DRIVERS\RDPCDD.sys 8192 bytes (Microsoft Corporation, RDP Miniport)
0xF7BBF000 C:\WINDOWS\System32\DRIVERS\swenum.sys 8192 bytes (Microsoft Corporation, Plug and Play Software Device Enumerator)
0xF7BC3000 C:\WINDOWS\System32\DRIVERS\USBD.SYS 8192 bytes (Microsoft Corporation, Universal Serial Bus Driver)
0xF7BAB000 C:\WINDOWS\System32\DRIVERS\WMILIB.SYS 8192 bytes (Microsoft Corporation, WMILIB WMI support library Dll)
0xF7DA6000 C:\WINDOWS\System32\DRIVERS\audstub.sys 4096 bytes (Microsoft Corporation, AudStub Driver)
0xF7D71000 C:\WINDOWS\System32\drivers\dxgthk.sys 4096 bytes (Microsoft Corporation, DirectX Graphics Driver Thunk)
0xF7DE1000 C:\WINDOWS\System32\Drivers\Null.SYS 4096 bytes (Microsoft Corporation, NULL Driver)
==============================================
>Stealth
==============================================
WARNING: Virus alike driver modification [hsfdpsp2.sys]
WARNING: Virus alike driver modification [atinrvxx.sys]
WARNING: Virus alike driver modification [wadv08nt.sys]
WARNING: Virus alike driver modification [ati1mdxx.sys]
WARNING: Virus alike driver modification [cpqdap01.sys]
WARNING: Virus alike driver modification [wadv07nt.sys]
WARNING: Virus alike driver modification [mdmxsdk.sys]
WARNING: Virus alike driver modification [wadv09nt.sys]
WARNING: Virus alike driver modification [wadv11nt.sys]
WARNING: Virus alike driver modification [nikedrv.sys]
WARNING: Virus alike driver modification [rio8drv.sys]
WARNING: Virus alike driver modification [riodrv.sys]
WARNING: Virus alike driver modification [ati1pdxx.sys]
WARNING: Virus alike driver modification [fsvga.sys]
WARNING: Virus alike driver modification [imagesrv.sys]
WARNING: Virus alike driver modification [mtlmnt5.sys]
WARNING: Virus alike driver modification [slnt7554.sys]
WARNING: Virus alike driver modification [mtlstrm.sys]
WARNING: Virus alike driver modification [slwdmsup.sys]
WARNING: Virus alike driver modification [recagent.sys]
WARNING: Virus alike driver modification [atinmdxx.sys]
WARNING: Virus alike driver modification [atinttxx.sys]
WARNING: Virus alike driver modification [atinpdxx.sys]
WARNING: Virus alike driver modification [smclib.sys]
WARNING: Virus alike driver modification [s3gnbm.sys]
WARNING: Virus alike driver modification [ntmtlfax.sys]
WARNING: Virus alike driver modification [nv4_mini.sys]
WARNING: Virus alike driver modification [ati1ttxx.sys]
WARNING: Virus alike driver modification [tsbvcap.sys]
WARNING: Virus alike driver modification [hsfbs2s2.sys]
WARNING: Virus alike driver modification [watv06nt.sys]
WARNING: Virus alike driver modification [watv10nt.sys]
WARNING: Virus alike driver modification [cinemst2.sys]
WARNING: Virus alike driver modification [ati1snxx.sys]
WARNING: Virus alike driver modification [atinsnxx.sys]
WARNING: Virus alike driver modification [ati1xbxx.sys]
WARNING: Virus alike driver modification [ati1raxx.sys]
WARNING: Virus alike driver modification [atmepvc.sys]
WARNING: Virus alike driver modification [atinxbxx.sys]
WARNING: Virus alike driver modification [rawwan.sys]
WARNING: Virus alike driver modification [ati1xsxx.sys]
WARNING: Virus alike driver modification [atmuni.sys]
WARNING: Virus alike driver modification [ati1tuxx.sys]
WARNING: Virus alike driver modification [wpdusb.sys]
WARNING: Virus alike driver modification [slntamr.sys]
WARNING: Virus alike driver modification [mtxparhm.sys]
WARNING: Virus alike driver modification [tosdvd.sys]
WARNING: Virus alike driver modification [atinraxx.sys]
WARNING: Virus alike driver modification [imagedrv.sys]
WARNING: Virus alike driver modification [ati1btxx.sys]
WARNING: Virus alike driver modification [atinbtxx.sys]
WARNING: Virus alike driver modification [vdmindvd.sys]
WARNING: Virus alike driver modification [rootmdm.sys]
WARNING: Virus alike driver modification [atinxsxx.sys]
WARNING: Virus alike driver modification [ati1rvxx.sys]
WARNING: Virus alike driver modification [hsfcxts2.sys]
WARNING: Virus alike driver modification [ati2mtag.sys]
WARNING: Virus alike driver modification [atintuxx.sys]
WARNING: Virus alike driver modification [mcd.sys]
WARNING: Virus alike driver modification [slnthal.sys]

Conspire

Post #5January 4, 2011, 6:36 AM UTC

Hello there,

***Read through this entire procedure and if you have any questions, please ask them before you begin. Copy this page to Notepad and save to your desktop for reference as you will not have any browsers open while you are carrying out portions of these instructions. Do take note that if you could not run any tools requested, carry on with the next instruction(if any) and let us know.

Thank you for the logs and we will skip Security Check for this.

Download Combofix from any of the links below but rename it to ConspireCF before saving it to your desktop.

Link 1
Link 2

==================================

Double click on the renamed ComboFix.exe & follow the prompts.

When finished, it will produce a report for you.
Please post the C:\ComboFix.txt so we can continue cleaning the system.

As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply for further review.

flower4496

Post #6January 4, 2011, 2:47 PM UTC

Thank you for your quick response.

Here is the combofix text

ComboFix 11-01-03.04 - Leon & Rose 01/04/2011 9:16.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.383.132 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\conspireCF.exe
AV: Lavasoft Ad-Watch Live! Anti-Virus *Disabled/Updated* {A1C4F2E0-7FDE-4917-AFAE-013EFC3EDE33}
AV: Norton AntiVirus *Disabled/Updated* {E10A9785-9598-4754-B552-92431C1C35F8}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Leon & Rose\g2mdlhlpx.exe
c:\documents and settings\Leon & Rose\jaudio16k.tar
c:\windows\a3kebook.ini
c:\windows\akebook.ini
c:\windows\ANS2000.INI
c:\windows\system32\_007307_.tmp.dll
c:\windows\system32\_007308_.tmp.dll
c:\windows\system32\_007309_.tmp.dll
c:\windows\system32\_007310_.tmp.dll
c:\windows\system32\_007317_.tmp.dll
c:\windows\system32\_007318_.tmp.dll
c:\windows\system32\_007319_.tmp.dll
c:\windows\system32\_007320_.tmp.dll
c:\windows\system32\_007322_.tmp.dll
c:\windows\system32\_007323_.tmp.dll
c:\windows\system32\_007326_.tmp.dll
c:\windows\system32\_007327_.tmp.dll
c:\windows\system32\_007329_.tmp.dll
c:\windows\system32\_007330_.tmp.dll
c:\windows\system32\_007331_.tmp.dll
c:\windows\system32\_007333_.tmp.dll
c:\windows\system32\_007336_.tmp.dll
c:\windows\system32\_007337_.tmp.dll
c:\windows\system32\_007338_.tmp.dll
c:\windows\system32\_007341_.tmp.dll
c:\windows\system32\_007342_.tmp.dll
c:\windows\system32\_007344_.tmp.dll
c:\windows\system32\_007347_.tmp.dll
c:\windows\system32\_007349_.tmp.dll
c:\windows\system32\_007350_.tmp.dll
c:\windows\system32\_007351_.tmp.dll
c:\windows\system32\_007352_.tmp.dll
c:\windows\system32\_007353_.tmp.dll
c:\windows\system32\_007356_.tmp.dll
c:\windows\system32\_007357_.tmp.dll
c:\windows\system32\_007358_.tmp.dll
c:\windows\system32\_007359_.tmp.dll
c:\windows\system32\_007360_.tmp.dll
c:\windows\system32\_007365_.tmp.dll
c:\windows\system32\_007367_.tmp.dll
c:\windows\system32\Cache
c:\windows\system32\SET156.tmp
c:\windows\system32\SET3A0.tmp
c:\windows\system32\Temp
c:\windows\system32\vmss
c:\windows\wc98pp.dll

.
((((((((((((((((((((((((( Files Created from 2010-12-04 to 2011-01-04 )))))))))))))))))))))))))))))))
.

2010-12-15 19:50 . 2010-11-02 15:17 40960 -c—-w- c:\windows\system32\dllcache\ndproxy.sys
2010-12-15 19:48 . 2010-10-11 14:59 45568 -c—-w- c:\windows\system32\dllcache\wab.exe
2010-12-09 20:14 . 2010-12-28 16:35 ——– d—–w- c:\windows\system32\drivers\NAV\1205000.07D

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-11-18 18:12 . 2003-08-09 17:06 81920 —-a-w- c:\windows\system32\isign32.dll
2010-11-06 00:34 . 2004-08-24 00:32 832512 —-a-w- c:\windows\system32\wininet.dll
2010-11-06 00:34 . 2004-10-29 12:53 78336 —-a-w- c:\windows\system32\ieencode.dll
2010-11-06 00:34 . 2002-08-29 07:41 1830912 ——w- c:\windows\system32\inetcpl.cpl
2010-11-06 00:34 . 2001-08-23 17:00 17408 —-a-w- c:\windows\system32\corpol.dll
2010-11-04 12:34 . 2010-09-09 11:54 98392 —-a-w- c:\windows\system32\drivers\SBREDrv.sys
2010-11-03 12:25 . 2004-10-29 12:53 389120 —-a-w- c:\windows\system32\html.iec
2010-11-02 15:17 . 2008-10-24 14:35 40960 —-a-w- c:\windows\system32\drivers\ndproxy.sys
2010-10-28 13:13 . 2001-08-23 17:00 290048 —-a-w- c:\windows\system32\atmfd.dll
2010-10-26 13:25 . 2008-10-24 14:36 1853312 —-a-w- c:\windows\system32\win32k.sys
2010-10-23 20:08 . 2008-10-22 15:34 60808 —-a-w- c:\windows\system32\S32EVNT1.DLL
2010-10-23 20:08 . 2008-10-22 15:34 126512 —-a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2010-09-09 11:44 . 2010-09-09 11:43 133582520 —-a-w- c:\program files\Ad-AwareInstall.exe
2006-03-22 14:27 . 2006-03-22 14:27 1425680 -c–a-w- c:\program files\PPVIEW32.EXE
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\documents and settings\Leon & Rose\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2010-11-18 136176]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 517768]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb09.exe" [2003-07-28 188416]
"DeviceDiscovery"="c:\program files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe" [2003-05-21 229437]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
SoftStuff Wallpaper Changer.lnk - c:\program files\SoftStuff\softstrt.exe [N/A]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-09-21 03:07 932288 —-a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager]
2003-04-11 20:25 212992 —-a-w- c:\program files\HP\hpcoretech\hpcmpmgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 15:50 155648 —-a-w- c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-05-14 15:44 248552 —-a-w- c:\program files\Common Files\Java\Java Update\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"LiveUpdate Notice Service"=2 (0x2)
"LiveUpdate Notice Ex"=2 (0x2)
"LiveUpdate"=3 (0x3)
"ERSvc"=2 (0x2)
"Automatic LiveUpdate Scheduler"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\WINDOWS\\system32\\mshta.exe"=
"c:\\Program Files\\Windows Media Player\\wmplayer.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R0 EUBAKUP;EUBAKUP;c:\windows\system32\drivers\eubakup.sys [9/3/2010 8:49 AM 26248]
R0 EUFS;EUFS;c:\windows\system32\drivers\eufs.sys [9/3/2010 8:50 AM 20616]
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [9/9/2010 6:54 AM 64288]
R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NAV\1205000.07D\symds.sys [12/9/2010 3:15 PM 340016]
R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NAV\1205000.07D\symefa.sys [12/9/2010 3:15 PM 652336]
R1 BHDrvx86;BHDrvx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\Definitions\BASHDefs\20101123.003\BHDrvx86.sys [12/2/2010 12:41 AM 691248]
R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NAV\1205000.07D\ironx86.sys [12/9/2010 3:15 PM 136312]
R2 Iprip;RIP Listener;c:\windows\System32\svchost.exe -k netsvcs [8/23/2001 12:00 PM 14336]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [8/12/2010 7:15 AM 1389400]
R2 NAV;Norton AntiVirus;c:\program files\Norton AntiVirus\Norton AntiVirus\Engine\18.5.0.125\ccsvchst.exe [12/9/2010 3:15 PM 130000]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [9/6/2010 11:52 AM 102448]
R3 EuDisk;EASEUS Disk Enumerator;c:\windows\system32\drivers\EuDisk.sys [9/3/2010 8:49 AM 122504]
R3 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\Definitions\IPSDefs\20101231.001\IDSXpx86.sys [12/31/2010 10:10 PM 341944]
S3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys [9/7/2010 7:22 AM 13192]
S3 EUDSKACS;EUDSKACS;c:\windows\system32\drivers\eudskacs.sys [9/3/2010 8:49 AM 14216]
S3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys [9/7/2010 7:22 AM 8456]
S3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files\Lavasoft\Ad-Aware\kernexplorer.sys [8/12/2010 7:15 AM 15264]
S3 PRISM_USB;Linksys Wireless-B USB Network Adapter Driver;c:\windows\system32\drivers\LSPMUSB.sys [9/9/2004 8:24 PM 666624]
S4 CWShredder Service;CWShredder Service;c:\antispyware\CWShredder\CWShredder.exe service –> c:\antispyware\CWShredder\CWShredder.exe service [?]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc
.
Contents of the 'Scheduled Tasks' folder

2011-01-04 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2010-08-12 23:52]

2011-01-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1960408961-1580818891-1060284298-1003Core.job
- c:\documents and settings\Leon & Rose\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-11-18 17:30]

2011-01-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1960408961-1580818891-1060284298-1003UA.job
- c:\documents and settings\Leon & Rose\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-11-18 17:30]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
uInternet Connection Wizard,ShellNext = iexplore
Trusted Zone: ameritrade.com
Trusted Zone: brokersxpress.com\www
Trusted Zone: herbalink.com\www
Trusted Zone: optionsxpress.com\www
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Leon & Rose\Application Data\Mozilla\Firefox\Profiles\oqvjm278.default\
FF - prefs.js: network.proxy.type - 0
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Quick Starter: [removed] - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - Ext: Norton IPS: {BBDA0591-3099-440a-AA10-41764D9DB4DB} - c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\IPSFFPlgn
.
- - - - ORPHANS REMOVED - - - -

MSConfigStartUp-QuickTime Task - c:\program files\QuickTime\qttask.exe
MSConfigStartUp-Upromise0 - c:\program files\Upromise_RemindU\Upromise0.exe
HKLM_ActiveSetup-9889b58b-cb6d-45c5-a2ed-7382a7c1f900 - c:\windows\system32\lhuuwx.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-01-04 09:33
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\NAV]
"ImagePath"="\"c:\program files\Norton AntiVirus\Norton AntiVirus\Engine\18.5.0.125\ccSvcHst.exe\" /s \"NAV\" /m \"c:\program files\Norton AntiVirus\Norton AntiVirus\Engine\18.5.0.125\diMaster.dll\" /prefetch:1"
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'explorer.exe'(3584)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
c:\windows\System32\tcpsvcs.exe
c:\program files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
c:\windows\System32\wbem\unsecapp.exe
c:\windows\system32\wscntfy.exe
c:\documents and settings\Leon & Rose\Local Settings\Application Data\Google\Update\1.2.183.39\GoogleCrashHandler.exe
c:\program files\Lavasoft\Ad-Aware\AAWTray.exe
.
**************************************************************************
.
Completion time: 2011-01-04 09:42:15 - machine was rebooted
ComboFix-quarantined-files.txt 2011-01-04 14:42

Pre-Run: 147,886,804,992 bytes free
Post-Run: 148,332,085,248 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

- - End Of File - - 6A298C379656563E5314F1D09A032F35

Conspire

Post #7January 4, 2011, 5:25 PM UTC

Hello,

Does the computer freezes and show about:blank page anymore?

ESET Online Scanner
I'd like us to scan your machine with ESET OnlineScan

Note: If you are using Windows Vista/7, open your browser by right-clicking on its icon and select 'Run as administrator' to perform this scan.

*Note
It is recommended to disable onboard antivirus program and antispyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your antivirus along with your antispyware programs.

Hold down Control and click on the following link to open ESET OnlineScan in a new window.
ESET OnlineScan
Click the [external image: Posted Image] button.
For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
- Click on [external image: Posted Image] to download the ESET Smart Installer. Save it to your desktop.
- Double click on the [external image: Posted Image] icon on your desktop.
Check [external image: Posted Image]
Click the [external image: Posted Image] button.
Accept any security warnings from your browser.
Check [external image: Posted Image]
Make sure that the option "Remove found threats" is Unchecked
Push the Start button.
ESET will then download updates for itself, install itself, and begin
scanning your computer. Please be patient as this can take some time.
When the scan completes, push [external image: Posted Image]
Push [external image: Posted Image], and save the file to your desktop using a unique name, such as
ESETScan. Include the contents of this report in your next reply.
Push the [external image: Posted Image] button.
Push [external image: Posted Image]

===================================================

Please get a new OTL scan log. Please set OTL up this way for the scan.

Double click on OTL.exe to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output
UNCheck the boxes beside LOP Check and Purity Check.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

===================================================

On your next reply please post :
ESET report
Fresh OTL log

Good Day!

flower4496

Post #8January 4, 2011, 8:25 PM UTC

Yes, the about blank and slow response is still an issue.

Here are the 2 reports, it appears I have 4 trojans, how can I remove them?

ESETcan report:

C:\WINDOWS\system32\drivers\etc\hosts.20050304-152001.backup Win32/Qhost.NAN trojan
C:\WINDOWS\system32\drivers\etc\hosts.20050304-152058.backup Win32/Qhost.NAN trojan
C:\WINDOWS\system32\drivers\etc\hosts.20050304-162833.backup Win32/Qhost.NAN trojan
C:\WINDOWS\system32\drivers\etc\hosts.bak Win32/Qhost.NAN trojan

OTL report:

OTL logfile created on: 1/4/2011 3:14:27 PM - Run 2
OTL by OldTimer - Version 3.2.20.1 Folder = F:\My Documents\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

383.00 Mb Total Physical Memory | 123.00 Mb Available Physical Memory | 32.00% Memory free
919.00 Mb Paging File | 518.00 Mb Available in Paging File | 56.00% Paging File free
Paging file location(s): C:\pagefile.sys 574 1200 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 149.05 Gb Total Space | 138.13 Gb Free Space | 92.67% Space Free | Partition Type: NTFS
Drive F: | 74.51 Gb Total Space | 65.38 Gb Free Space | 87.74% Space Free | Partition Type: FAT32

Computer Name: PROFESSIONAL | User Name: Leon & Rose | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - F:\My Documents\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft)
PRC - C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe (Lavasoft)
PRC - C:\Program Files\Norton AntiVirus\Norton AntiVirus\Engine\18.5.0.125\ccsvchst.exe (Symantec Corporation)
PRC - C:\Documents and Settings\Leon & Rose\Local Settings\Application Data\Google\Update\1.2.183.39\GoogleCrashHandler.exe (Google Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe ()
PRC - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe (Symantec Corporation)
PRC - C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe (HP)
PRC - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe (Hewlett-Packard)

========== Modules (SafeList) ==========

MOD - F:\My Documents\Downloads\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (LiveUpdate Notice Ex) – C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe File not found
SRV - (HidServ) – C:\WINDOWS\System32\hidserv.dll File not found
SRV - (CWShredder Service) – C:\AntiSpyware\CWShredder\CWShredder.exe File not found
SRV - (Lavasoft Ad-Aware Service) – C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft)
SRV - (NAV) – C:\Program Files\Norton AntiVirus\Norton AntiVirus\Engine\18.5.0.125\ccSvcHst.exe (Symantec Corporation)
SRV - (p2pgasvc) – C:\WINDOWS\system32\p2pgasvc.dll (Microsoft Corporation)
SRV - (Iprip) – C:\WINDOWS\system32\iprip.dll (Microsoft Corporation)
SRV - (Symantec Core LC) – C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe ()
SRV - (LiveUpdate) – C:\Program Files\Symantec\LiveUpdate\LuComServer_3_2.EXE (Symantec Corporation)
SRV - (Automatic LiveUpdate Scheduler) – C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (Symantec Corporation)
SRV - (LiveUpdate Notice Service) – C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe (Symantec Corporation)

========== Driver Services (SafeList) ==========

DRV - (TSP) – C:\WINDOWS\System32\drivers\klif.sys File not found
DRV - (SYMREDRV) – C:\WINDOWS\System32\Drivers\NAV\1002000.007\SYMREDRV.SYS File not found
DRV - (SYMNDIS) – C:\WINDOWS\System32\Drivers\NAV\1008000.029\SYMNDIS.SYS File not found
DRV - (SYMIDS) – C:\WINDOWS\System32\Drivers\NAV\1008000.029\SYMIDS.SYS File not found
DRV - (SYMFW) – C:\WINDOWS\System32\Drivers\NAV\1008000.029\SYMFW.SYS File not found
DRV - (SYMDNS) – C:\WINDOWS\System32\Drivers\NAV\1002000.007\SYMDNS.SYS File not found
DRV - (catchme) – C:\conspireCF\catchme.sys File not found
DRV - (NAVEX15) – C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\Definitions\VirusDefs\20110104.002\NAVEX15.SYS (Symantec Corporation)
DRV - (NAVENG) – C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\Definitions\VirusDefs\20110104.002\NAVENG.SYS (Symantec Corporation)
DRV - (SYMTDI) – C:\WINDOWS\System32\Drivers\NAV\1205000.07D\SYMTDI.SYS (Symantec Corporation)
DRV - (SRTSP) – C:\WINDOWS\System32\Drivers\NAV\1205000.07D\SRTSP.SYS (Symantec Corporation)
DRV - (SRTSPX) Symantec Real Time Storage Protection (PEL) – C:\WINDOWS\system32\drivers\NAV\1205000.07D\SRTSPX.SYS (Symantec Corporation)
DRV - (BHDrvx86) – C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\Definitions\BASHDefs\20101123.003\BHDrvx86.sys (Symantec Corporation)
DRV - (SymEFA) – C:\WINDOWS\system32\drivers\NAV\1205000.07D\SYMEFA.SYS (Symantec Corporation)
DRV - (SymIRON) – C:\WINDOWS\system32\drivers\NAV\1205000.07D\Ironx86.SYS (Symantec Corporation)
DRV - (IDSxpx86) – C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\Definitions\IPSDefs\20101231.001\IDSXpx86.sys (Symantec Corporation)
DRV - (Lavasoft Kernexplorer) – C:\Program Files\Lavasoft\Ad-Aware\kernexplorer.sys ()
DRV - (SymEvent) – C:\WINDOWS\system32\drivers\SYMEVENT.SYS (Symantec Corporation)
DRV - (SymDS) – C:\WINDOWS\system32\drivers\NAV\1205000.07D\SYMDS.SYS (Symantec Corporation)
DRV - (Lbd) – C:\WINDOWS\system32\DRIVERS\Lbd.sys (Lavasoft AB)
DRV - (epmntdrv) – C:\WINDOWS\system32\epmntdrv.sys ()
DRV - (EuGdiDrv) – C:\WINDOWS\system32\EuGdiDrv.sys ()
DRV - (EraserUtilRebootDrv) – C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation)
DRV - (eeCtrl) – C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys (Symantec Corporation)
DRV - (Tcpip6) – C:\WINDOWS\system32\drivers\tcpip6.sys (Microsoft Corporation)
DRV - (EUFS) – C:\WINDOWS\system32\drivers\eufs.sys (CHENGDU YIWO Tech Development Co., Ltd)
DRV - (EUDSKACS) – C:\WINDOWS\system32\drivers\eudskacs.sys (CHENGDU YIWO Tech Development Co., Ltd)
DRV - (EUBAKUP) – C:\WINDOWS\system32\drivers\eubakup.sys (CHENGDU YIWO Tech Development Co., Ltd)
DRV - (EuDisk) – C:\WINDOWS\system32\drivers\EuDisk.sys (CHENGDU YIWO Tech Development Co., Ltd)
DRV - (NwlnkIpx) – C:\WINDOWS\system32\drivers\nwlnkipx.sys (Microsoft Corporation)
DRV - (symlcbrd) – C:\WINDOWS\system32\drivers\symlcbrd.sys (Symantec Corporation)
DRV - (rtl8139) Realtek RTL8139(A/B/C) – C:\WINDOWS\system32\drivers\rtl8139.sys (Realtek Semiconductor Corporation)
DRV - (ati2mtaa) – C:\WINDOWS\system32\drivers\ati2mtaa.sys (ATI Technologies Inc.)
DRV - (PRISM_USB) – C:\WINDOWS\system32\drivers\LSPMUSB.sys (Cisco-Linksys, LLC.)
DRV - (es1371) Creative AudioPCI (ES1371,ES1373) (WDM) – C:\WINDOWS\system32\drivers\es1371mp.sys (Creative Technology Ltd.)
DRV - (NwlnkNb) – C:\WINDOWS\system32\drivers\nwlnknb.sys (Microsoft Corporation)
DRV - (NwlnkSpx) – C:\WINDOWS\system32\drivers\nwlnkspx.sys (Microsoft Corporation)
DRV - (HCF_MSFT) – C:\WINDOWS\system32\drivers\HCF_MSFT.sys (Conexant)
DRV - (Winachcf) – C:\WINDOWS\system32\drivers\winachcf.sys (Conexant)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Search Bar = http://search.msn.com/spbasic.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page_bak = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Data = C3 17 11 E0 B2 A4 AC 29 3E F1 D7 B3 41 B1 2A 69 EF FE DE 71 3C 18 BA 0A F9 AA 17 17 FE 78 [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {BBDA0591-3099-440a-AA10-41764D9DB4DB}:2.0
FF - prefs.js..network.proxy.type: 0

FF - HKLM\software\mozilla\Firefox\extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\IPSFFPlgn\ [2010/12/28 11:37:41 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/11/18 09:44:13 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/11/18 09:43:13 | 000,000,000 | —D | M]

[2010/11/18 09:44:36 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Leon & Rose\Application Data\Mozilla\Extensions
[2010/11/18 09:44:36 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Leon & Rose\Application Data\Mozilla\Firefox\Profiles\oqvjm278.default\extensions
[2010/11/18 09:43:13 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2010/12/28 11:37:41 | 000,000,000 | —D | M] (Norton IPS) – C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\IPSFFPLGN
[2009/03/21 09:39:01 | 000,000,000 | —D | M] (Java Quick Starter) – C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF

O1 HOSTS File: ([2011/01/04 09:33:43 | 000,000,027 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton AntiVirus\Norton AntiVirus\Engine\18.5.0.125\ips\ipsbho.dll (Symantec Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {63CC63C6-1AE1-491C-B96A-812A7950A1EC} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {C4069E3A-68F1-403E-B40E-20066696354B} - No CLSID value found.
O4 - HKLM..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe (Hewlett-Packard)
O4 - HKLM..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe (HP)
O4 - HKLM..\Run: [Symantec PIF AlertEng] C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe (Symantec Corporation)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\SoftStuff Wallpaper Changer.lnk = C:\Program Files\SoftStuff\softstrt.exe File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra Button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe (PokerStars)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation)
O15 - HKCU\..Trusted Domains: ameritrade.com ([]http in Trusted sites)
O15 - HKCU\..Trusted Domains: brokersxpress.com ([www] https in Trusted sites)
O15 - HKCU\..Trusted Domains: herbalink.com ([www] http in Trusted sites)
O15 - HKCU\..Trusted Domains: optionsxpress.com ([www] https in Trusted sites)
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} http://office.microsoft.com/templates/ieawsdc.cab (Microsoft Office Template and Media Control)
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} http://download.microsoft.com/download/e/4…/OGAControl.cab (Office Genuine Advantage Validation Tool)
O16 - DPF: {230C3D02-DA27-11D2-8612-00A0C93EEA3C} http://www.winkflash.com/photo/loaders/SAXFile.cab (SAXFile FileUpload ActiveX Control)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://fpdownload.macromedia.com/pub/shock…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {315B0BFB-2BD4-481B-80A3-A9B80727C61B} http://webiq005.webiqonline.com/WebIQ/Data…6-6D5536C585C9} (WebIQ Engine Application Object)
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} http://office.microsoft.com/officeupdate/content/opuc.cab (Office Update Installation Engine)
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} http://gfx1.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab (MSN Photo Upload Tool)
O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} http://fb.familylink.com/we_are_related/st…geUploader5.cab (Image Uploader Control)
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} http://upload.facebook.com/controls/Facebo…otoUploader.cab (Facebook Photo Uploader Control)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://v5.windowsupdate.microsoft.com/v5co…b?1098888781197 (WUWebControl Class)
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} https://webdl.symantec.com/activex/symdlmgr.cab (Symantec Download Manager)
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} http://www.winkflash.com/photo/loaders/ImageUploader4.cab (Image Uploader Control)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.0…oUploader55.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {8E28B3A9-FE83-45D1-B657-D5426B81A121} http://cs6b.instantservice.com/jars/customerxsigned41.cab (CustomerCtrl Class)
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} http://www.sibelius.com/download/software/…tiveXPlugin.cab (ScorchPlugin Class)
O16 - DPF: {C7DB51B4-BCF7-4923-8874-7F1A0DC92277} http://office.microsoft.com/officeupdate/content/opuc4.cab (Office Update Installation Engine)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} http://photos.groups.yahoo.com/ocx/us/yexplorer1_9us.cab (PhotosCtrl Class)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/pub/shock…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} https://optionsxpressevents.webex.com/clien…bex/ieatgpc.cab (GpcContainer Class)
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} http://by107fd.bay107.hotmail.msn.com/activex/HMAtchmt.ocx (Hotmail Attachments Control)
O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O16 - DPF: YExplorer1_8US.CAB http://photos.groups.yahoo.com/ocx/us/yexplorer1_8us.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed] [removed]
O18 - Protocol\Handler\cetihpz {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Program Files\HP\hpcoretech\comp\hpuiprot.dll (Hewlett-Packard Company)
O18 - Protocol\Handler\ic32pp {BBCA9F81-8F4F-11D2-90FF-0080C83D3571} - Reg Error: Key error. File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2003/08/09 12:10:11 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (lsdelete) - C:\WINDOWS\System32\lsdelete.exe ()
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/01/04 13:05:25 | 000,000,000 | —D | C] – C:\Program Files\ESET
[2011/01/04 11:18:41 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2011/01/04 09:13:20 | 000,000,000 | RHSD | C] – C:\cmdcons
[2011/01/04 09:11:00 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2011/01/04 09:11:00 | 000,161,792 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2011/01/04 09:11:00 | 000,136,704 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2011/01/04 09:11:00 | 000,031,232 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2011/01/04 09:10:34 | 000,000,000 | —D | C] – C:\WINDOWS\ERDNT
[2011/01/04 09:08:11 | 000,000,000 | —D | C] – C:\Qoobox
[2010/12/16 10:43:07 | 000,000,000 | —D | C] – F:\My Documents\Momsnowrem2010
[2010/12/15 14:50:06 | 000,040,960 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ndproxy.sys
[2010/12/15 14:48:44 | 000,045,568 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wab.exe
[2010/09/09 06:43:42 | 133,582,520 | —- | C] (Lavasoft ) – C:\Program Files\Ad-AwareInstall.exe
[2003/12/09 13:16:52 | 000,442,368 | —- | C] ( ) – C:\WINDOWS\System32\comintfs.dll
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[249 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/01/04 14:36:02 | 000,001,002 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1960408961-1580818891-1060284298-1003UA.job
[2011/01/04 12:36:01 | 000,000,950 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1960408961-1580818891-1060284298-1003Core.job
[2011/01/04 09:45:30 | 000,000,472 | —- | M] () – C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2011/01/04 09:33:43 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2011/01/04 09:33:03 | 000,013,646 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2011/01/04 09:32:19 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/01/04 09:13:27 | 000,000,327 | RHS- | M] () – C:\boot.ini
[2011/01/04 09:01:56 | 004,012,968 | R— | M] () – C:\Documents and Settings\Leon & Rose\Desktop\conspireCF.exe
[2011/01/03 10:51:32 | 000,000,073 | —- | M] () – C:\WINDOWS\efaxview.ini
[2010/12/31 07:06:27 | 000,817,948 | —- | M] () – C:\WINDOWS\System32\drivers\NAV\1205000.07D\Cat.DB
[2010/12/28 11:37:13 | 000,002,100 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Norton AntiVirus.LNK
[2010/12/26 10:27:27 | 000,000,116 | —- | M] () – C:\WINDOWS\NeroDigital.ini
[2010/12/26 10:27:23 | 000,121,344 | —- | M] () – C:\Documents and Settings\Leon & Rose\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/12/17 14:13:01 | 000,277,352 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2010/12/17 13:49:27 | 000,001,393 | —- | M] () – C:\WINDOWS\imsins.BAK
[2010/12/15 10:38:58 | 000,002,313 | —- | M] () – C:\Documents and Settings\Leon & Rose\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2010/12/15 10:38:57 | 000,002,335 | —- | M] () – C:\Documents and Settings\Leon & Rose\Desktop\Google Chrome.lnk
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[249 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/01/04 09:13:27 | 000,000,211 | —- | C] () – C:\Boot.bak
[2011/01/04 09:13:22 | 000,260,272 | RHS- | C] () – C:\cmldr
[2011/01/04 09:11:00 | 000,256,512 | —- | C] () – C:\WINDOWS\PEV.exe
[2011/01/04 09:11:00 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2011/01/04 09:11:00 | 000,089,088 | —- | C] () – C:\WINDOWS\MBR.exe
[2011/01/04 09:11:00 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2011/01/04 09:11:00 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2011/01/04 09:05:43 | 004,012,968 | R— | C] () – C:\Documents and Settings\Leon & Rose\Desktop\conspireCF.exe
[2010/10/20 16:33:04 | 000,001,940 | —- | C] () – C:\Documents and Settings\Leon & Rose\Local Settings\Application Data\{96C87F53-AC72-4604-A9CC-186A49F17F3C}.ini
[2010/09/07 07:22:32 | 000,014,848 | —- | C] () – C:\WINDOWS\System32\EuEpmGdi.dll
[2010/09/07 07:22:31 | 000,013,192 | —- | C] () – C:\WINDOWS\System32\epmntdrv.sys
[2010/09/07 07:22:31 | 000,008,456 | —- | C] () – C:\WINDOWS\System32\EuGdiDrv.sys
[2010/03/24 18:30:38 | 000,088,502 | —- | C] () – C:\Documents and Settings\Leon & Rose\Local Settings\Application Data\FASTWiz.log
[2008/10/22 10:27:16 | 000,003,920 | —- | C] () – C:\Documents and Settings\All Users\Application Data\LUUnInstall.LiveUpdate
[2008/06/24 08:33:01 | 000,001,755 | —- | C] () – C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2008/02/04 17:23:10 | 000,693,792 | —- | C] () – C:\WINDOWS\System32\OGACheckControl.DLL
[2007/05/11 07:38:37 | 000,000,000 | —- | C] () – C:\WINDOWS\webica.ini
[2007/02/24 11:23:25 | 000,000,028 | —- | C] () – C:\WINDOWS\pdf995.ini
[2007/02/18 17:41:59 | 000,000,142 | —- | C] () – C:\WINDOWS\wpd99.drv
[2007/02/18 17:41:23 | 000,051,716 | —- | C] () – C:\WINDOWS\System32\pdf995mon.dll
[2006/08/21 08:03:54 | 000,000,023 | —- | C] () – C:\WINDOWS\kodakpcd.Leon & Rose.ini
[2006/08/15 20:10:50 | 000,000,049 | —- | C] () – C:\WINDOWS\VistaEmail.ini
[2006/03/22 09:27:20 | 001,425,680 | —- | C] () – C:\Program Files\PPVIEW32.EXE
[2005/04/21 09:41:26 | 000,000,116 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2005/03/05 08:49:03 | 000,000,000 | R-S- | C] () – C:\WINDOWS\System32\q068laju1do8.dll
[2005/03/04 17:30:45 | 000,000,429 | —- | C] () – C:\WINDOWS\System32\nt62rptr32.sys
[2005/03/04 14:17:17 | 000,002,217 | —- | C] () – C:\WINDOWS\delprot.ini
[2005/03/04 14:14:02 | 000,003,876 | —- | C] () – C:\WINDOWS\nhccek.dll
[2005/03/02 17:52:52 | 000,000,069 | —- | C] () – C:\Documents and Settings\Leon & Rose\Application Data\tvmuknwrd.dll
[2005/03/02 17:52:52 | 000,000,037 | —- | C] () – C:\Documents and Settings\Leon & Rose\Application Data\tvmcwrd.dll
[2005/02/27 15:52:27 | 000,072,192 | —- | C] () – C:\WINDOWS\System32\zlib.dll
[2005/02/27 15:44:07 | 000,000,045 | —- | C] () – C:\WINDOWS\GJHMNKGH.ini
[2005/02/10 11:56:32 | 000,000,134 | —- | C] () – C:\Documents and Settings\Leon & Rose\Local Settings\Application Data\fusioncache.dat
[2005/01/09 12:38:25 | 000,000,000 | —- | C] () – C:\WINDOWS\RAWImage.INI
[2004/12/24 14:13:39 | 000,000,000 | —- | C] () – C:\WINDOWS\OpPrintServer.INI
[2004/10/26 11:37:39 | 000,823,359 | —- | C] () – C:\WINDOWS\System32\wdoz32t.dll
[2004/06/02 06:54:08 | 000,264,890 | —- | C] () – C:\Documents and Settings\Leon & Rose\Application Data\tvmknwrd.dll
[2004/04/08 11:52:09 | 000,000,021 | —- | C] () – C:\WINDOWS\Shapeworks.ini
[2004/01/27 13:49:09 | 000,121,344 | —- | C] () – C:\Documents and Settings\Leon & Rose\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2003/11/27 12:51:00 | 000,012,034 | —- | C] () – C:\WINDOWS\hpdj5600.ini
[2003/11/21 14:58:06 | 000,005,120 | —- | C] () – C:\WINDOWS\System32\TMFaxUI.dll
[2003/11/21 14:57:52 | 000,013,824 | —- | C] () – C:\WINDOWS\System32\TMFaxMon.dll
[2003/10/26 12:09:36 | 000,000,073 | —- | C] () – C:\WINDOWS\cdplayer.ini
[2003/08/09 16:20:39 | 000,000,073 | —- | C] () – C:\WINDOWS\efaxview.ini
[2003/08/09 14:06:53 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2003/08/09 13:27:40 | 000,363,520 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2003/08/09 07:56:42 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2003/01/07 14:05:08 | 000,002,695 | —- | C] () – C:\WINDOWS\System32\OUTLPERF.INI
[2002/12/10 00:00:00 | 001,708,032 | —- | C] () – C:\WINDOWS\System32\MSO97V.DLL
[2002/12/10 00:00:00 | 000,036,864 | —- | C] () – C:\WINDOWS\System32\DOCOBJ.DLL
[2002/12/10 00:00:00 | 000,032,768 | —- | C] () – C:\WINDOWS\System32\MSORFS.DLL
[2002/12/10 00:00:00 | 000,032,768 | —- | C] () – C:\WINDOWS\System32\HLINKPRX.DLL

========== Alternate Data Streams ==========

@Alternate Data Stream - 88 bytes -> C:\ad.dll:SummaryInformation

< End of report >

Conspire

Post #9January 5, 2011, 12:58 PM UTC

Hi,

Sorry for the delayed response.

Go to My Computer-> Tools-> Folder Options-> View tab:

Under the Hidden files and folders heading:
Select - Show hidden files and folders.
Uncheck- Hide protected operating system files (recommended) option.
Also, make sure there is no checkmark beside Hide file extensions for known file types.
Click OK. (Remember to Hide files and folders once done)

Please go to one of the below sites to scan the following files:
Virus Total
jotti.org
VirScan

click on Browse, and upload the following file for analysis:
C:\WINDOWS\System32\wdoz32t.dll
C:\WINDOWS\System32\nt62rptr32.sys

Then click Submit. Allow the file to be scanned, and then please copy and paste the results here for me to see.
If it says already scanned – click "reanalyze now"
Please post the results in your next reply.

===================================================

Run OTL.exe

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

:OTL
[2005/03/05 08:49:03 | 000,000,000 | R-S- | C] () – C:\WINDOWS\System32\q068laju1do8.dll
[2005/03/04 14:17:17 | 000,002,217 | —- | C] () – C:\WINDOWS\delprot.ini
[2005/03/04 14:14:02 | 000,003,876 | —- | C] () – C:\WINDOWS\nhccek.dll
[2005/03/02 17:52:52 | 000,000,069 | —- | C] () – C:\Documents and Settings\Leon & Rose\Application Data\tvmuknwrd.dll
[2005/03/02 17:52:52 | 000,000,037 | —- | C] () – C:\Documents and Settings\Leon & Rose\Application Data\tvmcwrd.dll
[2005/02/27 15:44:07 | 000,000,045 | —- | C] () – C:\WINDOWS\GJHMNKGH.ini
[2004/06/02 06:54:08 | 000,264,890 | —- | C] () – C:\Documents and Settings\Leon & Rose\Application Data\tvmknwrd.dll

:Files
C:\WINDOWS\system32\drivers\etc\hosts.20050304-152001.backup
C:\WINDOWS\system32\drivers\etc\hosts.20050304-152058.backup
C:\WINDOWS\system32\drivers\etc\hosts.20050304-162833.backup
C:\WINDOWS\system32\drivers\etc\hosts.bak

:Commands
[emptyflash]
[emptytemp]
[resethosts]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Then post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )

===================================================

On your next reply please post :
File scanner report
OTL fix log
Fresh OTL log

Let me know if you have any problems in performing with the steps above or any questions you may have.

Good Day!

flower4496

Post #10January 5, 2011, 2:40 PM UTC

Thank you.

I ran virustotal, and OTL- I inserted the code and pressed runfix, after reboot I ran OTL again without any code in the custom scan area.

here are the all the results:

C:\WINDOWS\System32\wdoz32t.dll
Antivirus Version Last Update Result
AhnLab-V3 2011.01.05.00 2011.01.04 -
AntiVir 7.11.1.29 2011.01.05 -
Antiy-AVL 2.0.3.7 2011.01.05 -
AVG 9.0.0.851 2011.01.05 -
BitDefender 7.2 2011.01.05 -
ClamAV 0.96.4.0 2011.01.05 -
Comodo 7300 2011.01.05 -
DrWeb 5.0.2.03300 2011.01.05 -
eSafe 7.0.17.0 2011.01.02 -
F-Secure 9.0.16160.0 2011.01.05 -
Fortinet 4.2.254.0 2011.01.05 -
GData 21 2011.01.05 -
Ikarus T3.1.1.90.0 2011.01.05 -
K7AntiVirus 9.75.3435 2011.01.04 -
Kaspersky 7.0.0.125 2011.01.05 -
McAfee 5.400.0.1158 2011.01.05 -
McAfee-GW-Edition 2010.1C 2011.01.05 -
Microsoft 1.6402 2011.01.05 -
NOD32 5761 2011.01.05 -
Norman 6.06.12 2011.01.05 -
nProtect 2011-01-05.01 2011.01.05 -
Panda 10.0.2.7 2011.01.04 -
PCTools 7.0.3.5 2011.01.04 -
Rising 22.81.02.03 2011.01.05 -
Sophos 4.60.0 2011.01.05 -
SUPERAntiSpyware 4.40.0.1006 2011.01.05 -
Symantec 20101.3.0.103 2011.01.05 -
TrendMicro 9.120.0.1004 2011.01.05 -
TrendMicro-HouseCall 9.120.0.1004 2011.01.05 -
VBA32 3.12.14.2 2011.01.04 -
ViRobot 2011.1.5.4238 2011.01.05 -
VirusBuster 13.6.127.0 2011.01.04 -
Additional information
Show all
MD5 : 1f53e3448c4696454228529692a184f7
SHA1 : c13b8bd6f1739a2dfbfdace6fa668b39912ac5c0
SHA256: 91e23e3839c9999705e4e9bd7d32388ebe6c653105d1877815fbe35c4417038d

VT Community

File name: nt62rptr32.sys
Submission date: 2011-01-05 13:42:26 (UTC)
Current status: queued (#9) queued (#9) analysing finished

Result: 3/ 43 (7.0%)
VT Community

not reviewed
Safety score: -

Compact Print results
Antivirus Version Last Update Result
AhnLab-V3 2011.01.05.00 2011.01.04 -
AntiVir 7.11.1.29 2011.01.05 -
Antiy-AVL 2.0.3.7 2011.01.05 -
Avast 4.8.1351.0 2011.01.05 -
Avast5 5.0.677.0 2011.01.05 -
AVG 9.0.0.851 2011.01.05 -
BitDefender 7.2 2011.01.05 -
CAT-QuickHeal 11.00 2011.01.05 -
ClamAV 0.96.4.0 2011.01.05 -
Command 5.2.11.5 2011.01.05 -
Comodo 7300 2011.01.05 -
DrWeb 5.0.2.03300 2011.01.05 -
Emsisoft 5.1.0.1 2011.01.05 Spyware!IK
eSafe 7.0.17.0 2011.01.02 -
eTrust-Vet 36.1.8082 2011.01.05 -
F-Prot 4.6.2.117 2011.01.05 -
F-Secure 9.0.16160.0 2011.01.05 -
Fortinet 4.2.254.0 2011.01.05 -
GData 21 2011.01.05 -
Ikarus T3.1.1.90.0 2011.01.05 Spyware
Jiangmin 13.0.900 2011.01.05 -
K7AntiVirus 9.75.3435 2011.01.04 -
Kaspersky 7.0.0.125 2011.01.05 -
McAfee 5.400.0.1158 2011.01.05 -
McAfee-GW-Edition 2010.1C 2011.01.05 -
Microsoft 1.6402 2011.01.05 Spyware:Win32/Agent
NOD32 5761 2011.01.05 -
Norman 6.06.12 2011.01.05 -
nProtect 2011-01-05.01 2011.01.05 -
Panda 10.0.2.7 2011.01.05 -
PCTools 7.0.3.5 2011.01.04 -
Prevx 3.0 2011.01.05 -
Rising 22.81.02.03 2011.01.05 -
Sophos 4.60.0 2011.01.05 -
SUPERAntiSpyware 4.40.0.1006 2011.01.05 -
Symantec 20101.3.0.103 2011.01.05 -
TheHacker 6.7.0.1.110 2011.01.03 -
TrendMicro 9.120.0.1004 2011.01.05 -
TrendMicro-HouseCall 9.120.0.1004 2011.01.05 -
VBA32 3.12.14.2 2011.01.04 -
VIPRE 7961 2011.01.05 -
ViRobot 2011.1.5.4238 2011.01.05 -
VirusBuster 13.6.127.0 2011.01.04 -
Additional informationShow all
MD5 : fe4898c730de89eb646e7aa512f00d56
SHA1 : cd4db3930e80b7040fd0602ea999437c88efc2bf
SHA256: 9b5e0560ef4d1a9a376c38bbdd0de53880a7e8c7db9f78733554aaa84dcfd651
ssdeep: 12:dFzsijmq+RIz/JiysIf6/g23O/YFK7uH2qqAn:dCijbmIk4x23O5uHJ/
File size : 429 bytes
First seen: 2011-01-05 13:42:26
Last seen : 2011-01-05 13:42:26
TrID:
Unknown!
sigcheck:
publisher….: n/a
copyright….: n/a
product……: n/a
description..: n/a
original name: n/a
internal name: n/a
file version.: n/a
comments…..: n/a
signers……: -
signing date.: -
verified…..: Unsigned

VT Community

OTL fix log:

All processes killed
========== OTL ==========
C:\WINDOWS\system32\q068laju1do8.dll moved successfully.
C:\WINDOWS\delprot.ini moved successfully.
C:\WINDOWS\nhccek.dll moved successfully.
C:\Documents and Settings\Leon & Rose\Application Data\tvmuknwrd.dll moved successfully.
C:\Documents and Settings\Leon & Rose\Application Data\tvmcwrd.dll moved successfully.
C:\WINDOWS\GJHMNKGH.ini moved successfully.
C:\Documents and Settings\Leon & Rose\Application Data\tvmknwrd.dll moved successfully.
========== FILES ==========
C:\WINDOWS\system32\drivers\etc\hosts.20050304-152001.backup moved successfully.
C:\WINDOWS\system32\drivers\etc\hosts.20050304-152058.backup moved successfully.
C:\WINDOWS\system32\drivers\etc\hosts.20050304-162833.backup moved successfully.
C:\WINDOWS\system32\drivers\etc\hosts.bak moved successfully.
========== COMMANDS ==========

[EMPTYFLASH]

User: All Users

User: BB443B11-7D12-450c-9F85-2D32804655F9

User: Default User

User: Leon & Rose
->Flash cache emptied: 57645 bytes

User: LocalService

User: NetworkService

Total Flash Files Cleaned = 0.00 mb

[EMPTYTEMP]

User: All Users

User: BB443B11-7D12-450c-9F85-2D32804655F9

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: Leon & Rose
->Temp folder emptied: 97985 bytes
->Temporary Internet Files folder emptied: 2577587 bytes
->Java cache emptied: 6563764 bytes
->FireFox cache emptied: 47721391 bytes
->Google Chrome cache emptied: 6692027 bytes
->Flash cache emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 65603 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 1086474 bytes
%systemroot%\System32 .tmp files removed: 57646361 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 16823 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 220061 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 117.00 mb

C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

OTL by OldTimer - Version 3.2.20.1 log created on 01052011_091357

Files\Folders moved on Reboot…
File\Folder C:\Documents and Settings\Leon & Rose\Local Settings\Temp\~DF8CA8.tmp not found!
File\Folder C:\Documents and Settings\Leon & Rose\Local Settings\Temp\~DF989E.tmp not found!
File\Folder C:\WINDOWS\temp\Perflib_Perfdata_76c.dat not found!

Registry entries deleted on Reboot…

OTL final scan:

OTL logfile created on: 1/5/2011 9:18:29 AM - Run 3
OTL by OldTimer - Version 3.2.20.1 Folder = F:\My Documents\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

383.00 Mb Total Physical Memory | 90.00 Mb Available Physical Memory | 24.00% Memory free
919.00 Mb Paging File | 597.00 Mb Available in Paging File | 65.00% Paging File free
Paging file location(s): C:\pagefile.sys 574 1200 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 149.05 Gb Total Space | 138.33 Gb Free Space | 92.81% Space Free | Partition Type: NTFS
Drive F: | 74.51 Gb Total Space | 65.37 Gb Free Space | 87.74% Space Free | Partition Type: FAT32

Computer Name: PROFESSIONAL | User Name: Leon & Rose | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - F:\My Documents\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft)
PRC - C:\Program Files\Norton AntiVirus\Norton AntiVirus\Engine\18.5.0.125\ccsvchst.exe (Symantec Corporation)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe ()
PRC - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe (Symantec Corporation)
PRC - C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe (HP)
PRC - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe (Hewlett-Packard)

========== Modules (SafeList) ==========

MOD - F:\My Documents\Downloads\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (LiveUpdate Notice Ex) – C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe File not found
SRV - (HidServ) – C:\WINDOWS\System32\hidserv.dll File not found
SRV - (CWShredder Service) – C:\AntiSpyware\CWShredder\CWShredder.exe File not found
SRV - (Lavasoft Ad-Aware Service) – C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft)
SRV - (NAV) – C:\Program Files\Norton AntiVirus\Norton AntiVirus\Engine\18.5.0.125\ccSvcHst.exe (Symantec Corporation)
SRV - (p2pgasvc) – C:\WINDOWS\system32\p2pgasvc.dll (Microsoft Corporation)
SRV - (Iprip) – C:\WINDOWS\system32\iprip.dll (Microsoft Corporation)
SRV - (Symantec Core LC) – C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe ()
SRV - (LiveUpdate) – C:\Program Files\Symantec\LiveUpdate\LuComServer_3_2.EXE (Symantec Corporation)
SRV - (Automatic LiveUpdate Scheduler) – C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (Symantec Corporation)
SRV - (LiveUpdate Notice Service) – C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe (Symantec Corporation)

========== Driver Services (SafeList) ==========

DRV - (TSP) – C:\WINDOWS\System32\drivers\klif.sys File not found
DRV - (SYMREDRV) – C:\WINDOWS\System32\Drivers\NAV\1002000.007\SYMREDRV.SYS File not found
DRV - (SYMNDIS) – C:\WINDOWS\System32\Drivers\NAV\1008000.029\SYMNDIS.SYS File not found
DRV - (SYMIDS) – C:\WINDOWS\System32\Drivers\NAV\1008000.029\SYMIDS.SYS File not found
DRV - (SYMFW) – C:\WINDOWS\System32\Drivers\NAV\1008000.029\SYMFW.SYS File not found
DRV - (SYMDNS) – C:\WINDOWS\System32\Drivers\NAV\1002000.007\SYMDNS.SYS File not found
DRV - (catchme) – C:\conspireCF\catchme.sys File not found
DRV - (NAVEX15) – C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\Definitions\VirusDefs\20110104.035\NAVEX15.SYS (Symantec Corporation)
DRV - (NAVENG) – C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\Definitions\VirusDefs\20110104.035\NAVENG.SYS (Symantec Corporation)
DRV - (SYMTDI) – C:\WINDOWS\System32\Drivers\NAV\1205000.07D\SYMTDI.SYS (Symantec Corporation)
DRV - (SRTSP) – C:\WINDOWS\System32\Drivers\NAV\1205000.07D\SRTSP.SYS (Symantec Corporation)
DRV - (SRTSPX) Symantec Real Time Storage Protection (PEL) – C:\WINDOWS\system32\drivers\NAV\1205000.07D\SRTSPX.SYS (Symantec Corporation)
DRV - (BHDrvx86) – C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\Definitions\BASHDefs\20101123.003\BHDrvx86.sys (Symantec Corporation)
DRV - (SymEFA) – C:\WINDOWS\system32\drivers\NAV\1205000.07D\SYMEFA.SYS (Symantec Corporation)
DRV - (SymIRON) – C:\WINDOWS\system32\drivers\NAV\1205000.07D\Ironx86.SYS (Symantec Corporation)
DRV - (IDSxpx86) – C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\Definitions\IPSDefs\20101231.001\IDSXpx86.sys (Symantec Corporation)
DRV - (Lavasoft Kernexplorer) – C:\Program Files\Lavasoft\Ad-Aware\kernexplorer.sys ()
DRV - (SymEvent) – C:\WINDOWS\system32\drivers\SYMEVENT.SYS (Symantec Corporation)
DRV - (SymDS) – C:\WINDOWS\system32\drivers\NAV\1205000.07D\SYMDS.SYS (Symantec Corporation)
DRV - (Lbd) – C:\WINDOWS\system32\DRIVERS\Lbd.sys (Lavasoft AB)
DRV - (epmntdrv) – C:\WINDOWS\system32\epmntdrv.sys ()
DRV - (EuGdiDrv) – C:\WINDOWS\system32\EuGdiDrv.sys ()
DRV - (EraserUtilRebootDrv) – C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation)
DRV - (eeCtrl) – C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys (Symantec Corporation)
DRV - (Tcpip6) – C:\WINDOWS\system32\drivers\tcpip6.sys (Microsoft Corporation)
DRV - (EUFS) – C:\WINDOWS\system32\drivers\eufs.sys (CHENGDU YIWO Tech Development Co., Ltd)
DRV - (EUDSKACS) – C:\WINDOWS\system32\drivers\eudskacs.sys (CHENGDU YIWO Tech Development Co., Ltd)
DRV - (EUBAKUP) – C:\WINDOWS\system32\drivers\eubakup.sys (CHENGDU YIWO Tech Development Co., Ltd)
DRV - (EuDisk) – C:\WINDOWS\system32\drivers\EuDisk.sys (CHENGDU YIWO Tech Development Co., Ltd)
DRV - (NwlnkIpx) – C:\WINDOWS\system32\drivers\nwlnkipx.sys (Microsoft Corporation)
DRV - (symlcbrd) – C:\WINDOWS\system32\drivers\symlcbrd.sys (Symantec Corporation)
DRV - (rtl8139) Realtek RTL8139(A/B/C) – C:\WINDOWS\system32\drivers\rtl8139.sys (Realtek Semiconductor Corporation)
DRV - (ati2mtaa) – C:\WINDOWS\system32\drivers\ati2mtaa.sys (ATI Technologies Inc.)
DRV - (PRISM_USB) – C:\WINDOWS\system32\drivers\LSPMUSB.sys (Cisco-Linksys, LLC.)
DRV - (es1371) Creative AudioPCI (ES1371,ES1373) (WDM) – C:\WINDOWS\system32\drivers\es1371mp.sys (Creative Technology Ltd.)
DRV - (NwlnkNb) – C:\WINDOWS\system32\drivers\nwlnknb.sys (Microsoft Corporation)
DRV - (NwlnkSpx) – C:\WINDOWS\system32\drivers\nwlnkspx.sys (Microsoft Corporation)
DRV - (HCF_MSFT) – C:\WINDOWS\system32\drivers\HCF_MSFT.sys (Conexant)
DRV - (Winachcf) – C:\WINDOWS\system32\drivers\winachcf.sys (Conexant)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Search Bar = http://search.msn.com/spbasic.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page_bak = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Data = C3 17 11 E0 B2 A4 AC 29 3E F1 D7 B3 41 B1 2A 69 EF FE DE 71 3C 18 BA 0A F9 AA 17 17 FE 78 [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {BBDA0591-3099-440a-AA10-41764D9DB4DB}:2.0
FF - prefs.js..network.proxy.type: 0

FF - HKLM\software\mozilla\Firefox\extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\IPSFFPlgn\ [2010/12/28 11:37:41 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/11/18 09:44:13 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/11/18 09:43:13 | 000,000,000 | —D | M]

[2010/11/18 09:44:36 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Leon & Rose\Application Data\Mozilla\Extensions
[2010/11/18 09:44:36 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Leon & Rose\Application Data\Mozilla\Firefox\Profiles\oqvjm278.default\extensions
[2010/11/18 09:43:13 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2010/12/28 11:37:41 | 000,000,000 | —D | M] (Norton IPS) – C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\IPSFFPLGN
[2009/03/21 09:39:01 | 000,000,000 | —D | M] (Java Quick Starter) – C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF

O1 HOSTS File: ([2011/01/05 09:14:31 | 000,000,098 | —- | M]) - C:\WINDOWS\system32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton AntiVirus\Norton AntiVirus\Engine\18.5.0.125\ips\ipsbho.dll (Symantec Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {63CC63C6-1AE1-491C-B96A-812A7950A1EC} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {C4069E3A-68F1-403E-B40E-20066696354B} - No CLSID value found.
O4 - HKLM..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe (Hewlett-Packard)
O4 - HKLM..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe (HP)
O4 - HKLM..\Run: [Symantec PIF AlertEng] C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe (Symantec Corporation)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\SoftStuff Wallpaper Changer.lnk = C:\Program Files\SoftStuff\softstrt.exe File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra Button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe (PokerStars)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation)
O15 - HKCU\..Trusted Domains: ameritrade.com ([]http in Trusted sites)
O15 - HKCU\..Trusted Domains: brokersxpress.com ([www] https in Trusted sites)
O15 - HKCU\..Trusted Domains: herbalink.com ([www] http in Trusted sites)
O15 - HKCU\..Trusted Domains: optionsxpress.com ([www] https in Trusted sites)
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} http://office.microsoft.com/templates/ieawsdc.cab (Microsoft Office Template and Media Control)
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} http://download.microsoft.com/download/e/4…/OGAControl.cab (Office Genuine Advantage Validation Tool)
O16 - DPF: {230C3D02-DA27-11D2-8612-00A0C93EEA3C} http://www.winkflash.com/photo/loaders/SAXFile.cab (SAXFile FileUpload ActiveX Control)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://fpdownload.macromedia.com/pub/shock…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {315B0BFB-2BD4-481B-80A3-A9B80727C61B} http://webiq005.webiqonline.com/WebIQ/Data…6-6D5536C585C9} (WebIQ Engine Application Object)
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} http://office.microsoft.com/officeupdate/content/opuc.cab (Office Update Installation Engine)
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} http://gfx1.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab (MSN Photo Upload Tool)
O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} http://fb.familylink.com/we_are_related/st…geUploader5.cab (Image Uploader Control)
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} http://upload.facebook.com/controls/Facebo…otoUploader.cab (Facebook Photo Uploader Control)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://v5.windowsupdate.microsoft.com/v5co…b?1098888781197 (WUWebControl Class)
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} https://webdl.symantec.com/activex/symdlmgr.cab (Symantec Download Manager)
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} http://www.winkflash.com/photo/loaders/ImageUploader4.cab (Image Uploader Control)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.0…oUploader55.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {8E28B3A9-FE83-45D1-B657-D5426B81A121} http://cs6b.instantservice.com/jars/customerxsigned41.cab (CustomerCtrl Class)
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} http://www.sibelius.com/download/software/…tiveXPlugin.cab (ScorchPlugin Class)
O16 - DPF: {C7DB51B4-BCF7-4923-8874-7F1A0DC92277} http://office.microsoft.com/officeupdate/content/opuc4.cab (Office Update Installation Engine)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} http://photos.groups.yahoo.com/ocx/us/yexplorer1_9us.cab (PhotosCtrl Class)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/pub/shock…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} https://optionsxpressevents.webex.com/clien…bex/ieatgpc.cab (GpcContainer Class)
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} http://by107fd.bay107.hotmail.msn.com/activex/HMAtchmt.ocx (Hotmail Attachments Control)
O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O16 - DPF: YExplorer1_8US.CAB http://photos.groups.yahoo.com/ocx/us/yexplorer1_8us.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed] [removed]
O18 - Protocol\Handler\cetihpz {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Program Files\HP\hpcoretech\comp\hpuiprot.dll (Hewlett-Packard Company)
O18 - Protocol\Handler\ic32pp {BBCA9F81-8F4F-11D2-90FF-0080C83D3571} - Reg Error: Key error. File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2003/08/09 12:10:11 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (lsdelete) - C:\WINDOWS\System32\lsdelete.exe ()
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/01/04 13:05:25 | 000,000,000 | —D | C] – C:\Program Files\ESET
[2011/01/04 11:18:41 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2011/01/04 09:13:20 | 000,000,000 | RHSD | C] – C:\cmdcons
[2011/01/04 09:11:00 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2011/01/04 09:11:00 | 000,161,792 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2011/01/04 09:11:00 | 000,136,704 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2011/01/04 09:11:00 | 000,031,232 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2011/01/04 09:10:34 | 000,000,000 | —D | C] – C:\WINDOWS\ERDNT
[2011/01/04 09:08:11 | 000,000,000 | —D | C] – C:\Qoobox
[2010/12/16 10:43:07 | 000,000,000 | —D | C] – F:\My Documents\Momsnowrem2010
[2010/12/15 14:50:06 | 000,040,960 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ndproxy.sys
[2010/12/15 14:48:44 | 000,045,568 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wab.exe
[2010/09/09 06:43:42 | 133,582,520 | —- | C] (Lavasoft ) – C:\Program Files\Ad-AwareInstall.exe
[2003/12/09 13:16:52 | 000,442,368 | —- | C] ( ) – C:\WINDOWS\System32\comintfs.dll

========== Files - Modified Within 30 Days ==========

[2011/01/05 09:19:48 | 000,000,472 | —- | M] () – C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2011/01/05 09:17:18 | 000,013,646 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2011/01/05 09:16:31 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/01/05 09:14:31 | 000,000,098 | —- | M] () – C:\WINDOWS\System32\drivers\etc\Hosts
[2011/01/05 08:36:01 | 000,001,002 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1960408961-1580818891-1060284298-1003UA.job
[2011/01/05 00:35:48 | 000,818,134 | —- | M] () – C:\WINDOWS\System32\drivers\NAV\1205000.07D\Cat.DB
[2011/01/04 12:36:01 | 000,000,950 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1960408961-1580818891-1060284298-1003Core.job
[2011/01/04 09:13:27 | 000,000,327 | RHS- | M] () – C:\boot.ini
[2011/01/04 09:01:56 | 004,012,968 | R— | M] () – C:\Documents and Settings\Leon & Rose\Desktop\conspireCF.exe
[2011/01/03 10:51:32 | 000,000,073 | —- | M] () – C:\WINDOWS\efaxview.ini
[2010/12/28 11:37:13 | 000,002,100 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Norton AntiVirus.LNK
[2010/12/26 10:27:27 | 000,000,116 | —- | M] () – C:\WINDOWS\NeroDigital.ini
[2010/12/26 10:27:23 | 000,121,344 | —- | M] () – C:\Documents and Settings\Leon & Rose\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/12/17 14:13:01 | 000,277,352 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2010/12/17 13:49:27 | 000,001,393 | —- | M] () – C:\WINDOWS\imsins.BAK
[2010/12/15 10:38:58 | 000,002,313 | —- | M] () – C:\Documents and Settings\Leon & Rose\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2010/12/15 10:38:57 | 000,002,335 | —- | M] () – C:\Documents and Settings\Leon & Rose\Desktop\Google Chrome.lnk

========== Files Created - No Company Name ==========

[2011/01/04 09:13:27 | 000,000,211 | —- | C] () – C:\Boot.bak
[2011/01/04 09:13:22 | 000,260,272 | RHS- | C] () – C:\cmldr
[2011/01/04 09:11:00 | 000,256,512 | —- | C] () – C:\WINDOWS\PEV.exe
[2011/01/04 09:11:00 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2011/01/04 09:11:00 | 000,089,088 | —- | C] () – C:\WINDOWS\MBR.exe
[2011/01/04 09:11:00 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2011/01/04 09:11:00 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2011/01/04 09:05:43 | 004,012,968 | R— | C] () – C:\Documents and Settings\Leon & Rose\Desktop\conspireCF.exe
[2010/10/20 16:33:04 | 000,001,940 | —- | C] () – C:\Documents and Settings\Leon & Rose\Local Settings\Application Data\{96C87F53-AC72-4604-A9CC-186A49F17F3C}.ini
[2010/09/07 07:22:32 | 000,014,848 | —- | C] () – C:\WINDOWS\System32\EuEpmGdi.dll
[2010/09/07 07:22:31 | 000,013,192 | —- | C] () – C:\WINDOWS\System32\epmntdrv.sys
[2010/09/07 07:22:31 | 000,008,456 | —- | C] () – C:\WINDOWS\System32\EuGdiDrv.sys
[2010/03/24 18:30:38 | 000,088,502 | —- | C] () – C:\Documents and Settings\Leon & Rose\Local Settings\Application Data\FASTWiz.log
[2008/10/22 10:27:16 | 000,003,920 | —- | C] () – C:\Documents and Settings\All Users\Application Data\LUUnInstall.LiveUpdate
[2008/06/24 08:33:01 | 000,001,755 | —- | C] () – C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2008/02/04 17:23:10 | 000,693,792 | —- | C] () – C:\WINDOWS\System32\OGACheckControl.DLL
[2007/05/11 07:38:37 | 000,000,000 | —- | C] () – C:\WINDOWS\webica.ini
[2007/02/24 11:23:25 | 000,000,028 | —- | C] () – C:\WINDOWS\pdf995.ini
[2007/02/18 17:41:59 | 000,000,142 | —- | C] () – C:\WINDOWS\wpd99.drv
[2007/02/18 17:41:23 | 000,051,716 | —- | C] () – C:\WINDOWS\System32\pdf995mon.dll
[2006/08/21 08:03:54 | 000,000,023 | —- | C] () – C:\WINDOWS\kodakpcd.Leon & Rose.ini
[2006/08/15 20:10:50 | 000,000,049 | —- | C] () – C:\WINDOWS\VistaEmail.ini
[2006/03/22 09:27:20 | 001,425,680 | —- | C] () – C:\Program Files\PPVIEW32.EXE
[2005/04/21 09:41:26 | 000,000,116 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2005/03/04 17:30:45 | 000,000,429 | —- | C] () – C:\WINDOWS\System32\nt62rptr32.sys
[2005/02/27 15:52:27 | 000,072,192 | —- | C] () – C:\WINDOWS\System32\zlib.dll
[2005/02/10 11:56:32 | 000,000,134 | —- | C] () – C:\Documents and Settings\Leon & Rose\Local Settings\Application Data\fusioncache.dat
[2005/01/09 12:38:25 | 000,000,000 | —- | C] () – C:\WINDOWS\RAWImage.INI
[2004/12/24 14:13:39 | 000,000,000 | —- | C] () – C:\WINDOWS\OpPrintServer.INI
[2004/10/26 11:37:39 | 000,823,359 | —- | C] () – C:\WINDOWS\System32\wdoz32t.dll
[2004/04/08 11:52:09 | 000,000,021 | —- | C] () – C:\WINDOWS\Shapeworks.ini
[2004/01/27 13:49:09 | 000,121,344 | —- | C] () – C:\Documents and Settings\Leon & Rose\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2003/11/27 12:51:00 | 000,012,034 | —- | C] () – C:\WINDOWS\hpdj5600.ini
[2003/11/21 14:58:06 | 000,005,120 | —- | C] () – C:\WINDOWS\System32\TMFaxUI.dll
[2003/11/21 14:57:52 | 000,013,824 | —- | C] () – C:\WINDOWS\System32\TMFaxMon.dll
[2003/10/26 12:09:36 | 000,000,073 | —- | C] () – C:\WINDOWS\cdplayer.ini
[2003/08/09 16:20:39 | 000,000,073 | —- | C] () – C:\WINDOWS\efaxview.ini
[2003/08/09 14:06:53 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2003/08/09 13:27:40 | 000,363,520 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2003/08/09 07:56:42 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2003/01/07 14:05:08 | 000,002,695 | —- | C] () – C:\WINDOWS\System32\OUTLPERF.INI
[2002/12/10 00:00:00 | 001,708,032 | —- | C] () – C:\WINDOWS\System32\MSO97V.DLL
[2002/12/10 00:00:00 | 000,036,864 | —- | C] () – C:\WINDOWS\System32\DOCOBJ.DLL
[2002/12/10 00:00:00 | 000,032,768 | —- | C] () – C:\WINDOWS\System32\MSORFS.DLL
[2002/12/10 00:00:00 | 000,032,768 | —- | C] () – C:\WINDOWS\System32\HLINKPRX.DLL

========== Alternate Data Streams ==========

@Alternate Data Stream - 88 bytes -> C:\ad.dll:SummaryInformation

< End of report >

Conspire

Post #11January 5, 2011, 2:58 PM UTC

Hi,

Thank you.

Run OTL.exe

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

:OTL
DRV - (TSP) – C:\WINDOWS\System32\drivers\klif.sys File not found

:Files
C:\WINDOWS\System32\wdoz32t.dll
C:\WINDOWS\System32\nt62rptr32.sys

:Commands
[emptyflash]
[emptytemp]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Then post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )

===================================================

On your next reply please post :
OTL fix log
Fresh OTL log
Please advise the behaviour of the computer

Let me know if you have any problems in performing with the steps above or any questions you may have.

Good Day!

flower4496

Post #12January 5, 2011, 6:04 PM UTC

Thank you,
Here is the otl fix log

All processes killed
========== OTL ==========
Service TSP stopped successfully!
Service TSP deleted successfully!
File C:\WINDOWS\System32\drivers\klif.sys File not found not found.
========== FILES ==========
C:\WINDOWS\System32\wdoz32t.dll moved successfully.
C:\WINDOWS\System32\nt62rptr32.sys moved successfully.
========== COMMANDS ==========

[EMPTYFLASH]

User: All Users

User: BB443B11-7D12-450c-9F85-2D32804655F9

User: Default User

User: Leon & Rose
->Flash cache emptied: 456 bytes

User: LocalService

User: NetworkService

Total Flash Files Cleaned = 0.00 mb

[EMPTYTEMP]

User: All Users

User: BB443B11-7D12-450c-9F85-2D32804655F9

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Leon & Rose
->Temp folder emptied: 953 bytes
->Temporary Internet Files folder emptied: 4648239 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Google Chrome cache emptied: 10911250 bytes
->Flash cache emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 16889 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 15.00 mb

OTL by OldTimer - Version 3.2.20.1 log created on 01052011_124256

Files\Folders moved on Reboot…
File\Folder C:\WINDOWS\temp\Perflib_Perfdata_768.dat not found!

Registry entries deleted on Reboot…

Here is the otl log after reboot:

OTL logfile created on: 1/5/2011 12:52:42 PM - Run 4
OTL by OldTimer - Version 3.2.20.1 Folder = F:\My Documents\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

383.00 Mb Total Physical Memory | 84.00 Mb Available Physical Memory | 22.00% Memory free
919.00 Mb Paging File | 510.00 Mb Available in Paging File | 55.00% Paging File free
Paging file location(s): C:\pagefile.sys 574 1200 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 149.05 Gb Total Space | 138.33 Gb Free Space | 92.81% Space Free | Partition Type: NTFS
Drive F: | 74.51 Gb Total Space | 65.37 Gb Free Space | 87.73% Space Free | Partition Type: FAT32

Computer Name: PROFESSIONAL | User Name: Leon & Rose | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - F:\My Documents\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft)
PRC - C:\Documents and Settings\Leon & Rose\Local Settings\Application Data\Google\Chrome\Application\chrome.exe (Google Inc.)
PRC - C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe (Lavasoft)
PRC - C:\Program Files\Norton AntiVirus\Norton AntiVirus\Engine\18.5.0.125\ccsvchst.exe (Symantec Corporation)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe ()
PRC - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe (Symantec Corporation)
PRC - C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe (HP)
PRC - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe (Hewlett-Packard)

========== Modules (SafeList) ==========

MOD - F:\My Documents\Downloads\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (LiveUpdate Notice Ex) – C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe File not found
SRV - (HidServ) – C:\WINDOWS\System32\hidserv.dll File not found
SRV - (CWShredder Service) – C:\AntiSpyware\CWShredder\CWShredder.exe File not found
SRV - (Lavasoft Ad-Aware Service) – C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft)
SRV - (NAV) – C:\Program Files\Norton AntiVirus\Norton AntiVirus\Engine\18.5.0.125\ccSvcHst.exe (Symantec Corporation)
SRV - (p2pgasvc) – C:\WINDOWS\system32\p2pgasvc.dll (Microsoft Corporation)
SRV - (Iprip) – C:\WINDOWS\system32\iprip.dll (Microsoft Corporation)
SRV - (Symantec Core LC) – C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe ()
SRV - (LiveUpdate) – C:\Program Files\Symantec\LiveUpdate\LuComServer_3_2.EXE (Symantec Corporation)
SRV - (Automatic LiveUpdate Scheduler) – C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (Symantec Corporation)
SRV - (LiveUpdate Notice Service) – C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe (Symantec Corporation)

========== Driver Services (SafeList) ==========

DRV - (SYMREDRV) – C:\WINDOWS\System32\Drivers\NAV\1002000.007\SYMREDRV.SYS File not found
DRV - (SYMNDIS) – C:\WINDOWS\System32\Drivers\NAV\1008000.029\SYMNDIS.SYS File not found
DRV - (SYMIDS) – C:\WINDOWS\System32\Drivers\NAV\1008000.029\SYMIDS.SYS File not found
DRV - (SYMFW) – C:\WINDOWS\System32\Drivers\NAV\1008000.029\SYMFW.SYS File not found
DRV - (SYMDNS) – C:\WINDOWS\System32\Drivers\NAV\1002000.007\SYMDNS.SYS File not found
DRV - (catchme) – C:\conspireCF\catchme.sys File not found
DRV - (NAVEX15) – C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\Definitions\VirusDefs\20110105.003\NAVEX15.SYS (Symantec Corporation)
DRV - (NAVENG) – C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\Definitions\VirusDefs\20110105.003\NAVENG.SYS (Symantec Corporation)
DRV - (SYMTDI) – C:\WINDOWS\System32\Drivers\NAV\1205000.07D\SYMTDI.SYS (Symantec Corporation)
DRV - (SRTSP) – C:\WINDOWS\System32\Drivers\NAV\1205000.07D\SRTSP.SYS (Symantec Corporation)
DRV - (SRTSPX) Symantec Real Time Storage Protection (PEL) – C:\WINDOWS\system32\drivers\NAV\1205000.07D\SRTSPX.SYS (Symantec Corporation)
DRV - (BHDrvx86) – C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\Definitions\BASHDefs\20101123.003\BHDrvx86.sys (Symantec Corporation)
DRV - (SymEFA) – C:\WINDOWS\system32\drivers\NAV\1205000.07D\SYMEFA.SYS (Symantec Corporation)
DRV - (SymIRON) – C:\WINDOWS\system32\drivers\NAV\1205000.07D\Ironx86.SYS (Symantec Corporation)
DRV - (IDSxpx86) – C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\Definitions\IPSDefs\20101231.001\IDSXpx86.sys (Symantec Corporation)
DRV - (Lavasoft Kernexplorer) – C:\Program Files\Lavasoft\Ad-Aware\kernexplorer.sys ()
DRV - (SymEvent) – C:\WINDOWS\system32\drivers\SYMEVENT.SYS (Symantec Corporation)
DRV - (SymDS) – C:\WINDOWS\system32\drivers\NAV\1205000.07D\SYMDS.SYS (Symantec Corporation)
DRV - (Lbd) – C:\WINDOWS\system32\DRIVERS\Lbd.sys (Lavasoft AB)
DRV - (epmntdrv) – C:\WINDOWS\system32\epmntdrv.sys ()
DRV - (EuGdiDrv) – C:\WINDOWS\system32\EuGdiDrv.sys ()
DRV - (EraserUtilRebootDrv) – C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation)
DRV - (eeCtrl) – C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys (Symantec Corporation)
DRV - (Tcpip6) – C:\WINDOWS\system32\drivers\tcpip6.sys (Microsoft Corporation)
DRV - (EUFS) – C:\WINDOWS\system32\drivers\eufs.sys (CHENGDU YIWO Tech Development Co., Ltd)
DRV - (EUDSKACS) – C:\WINDOWS\system32\drivers\eudskacs.sys (CHENGDU YIWO Tech Development Co., Ltd)
DRV - (EUBAKUP) – C:\WINDOWS\system32\drivers\eubakup.sys (CHENGDU YIWO Tech Development Co., Ltd)
DRV - (EuDisk) – C:\WINDOWS\system32\drivers\EuDisk.sys (CHENGDU YIWO Tech Development Co., Ltd)
DRV - (NwlnkIpx) – C:\WINDOWS\system32\drivers\nwlnkipx.sys (Microsoft Corporation)
DRV - (symlcbrd) – C:\WINDOWS\system32\drivers\symlcbrd.sys (Symantec Corporation)
DRV - (rtl8139) Realtek RTL8139(A/B/C) – C:\WINDOWS\system32\drivers\rtl8139.sys (Realtek Semiconductor Corporation)
DRV - (ati2mtaa) – C:\WINDOWS\system32\drivers\ati2mtaa.sys (ATI Technologies Inc.)
DRV - (PRISM_USB) – C:\WINDOWS\system32\drivers\LSPMUSB.sys (Cisco-Linksys, LLC.)
DRV - (es1371) Creative AudioPCI (ES1371,ES1373) (WDM) – C:\WINDOWS\system32\drivers\es1371mp.sys (Creative Technology Ltd.)
DRV - (NwlnkNb) – C:\WINDOWS\system32\drivers\nwlnknb.sys (Microsoft Corporation)
DRV - (NwlnkSpx) – C:\WINDOWS\system32\drivers\nwlnkspx.sys (Microsoft Corporation)
DRV - (HCF_MSFT) – C:\WINDOWS\system32\drivers\HCF_MSFT.sys (Conexant)
DRV - (Winachcf) – C:\WINDOWS\system32\drivers\winachcf.sys (Conexant)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Search Bar = http://search.msn.com/spbasic.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page_bak = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Data = C3 17 11 E0 B2 A4 AC 29 3E F1 D7 B3 41 B1 2A 69 EF FE DE 71 3C 18 BA 0A F9 AA 17 17 FE 78 [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {BBDA0591-3099-440a-AA10-41764D9DB4DB}:2.0
FF - prefs.js..network.proxy.type: 0

FF - HKLM\software\mozilla\Firefox\extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\IPSFFPlgn\ [2010/12/28 11:37:41 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/11/18 09:44:13 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/11/18 09:43:13 | 000,000,000 | —D | M]

[2010/11/18 09:44:36 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Leon & Rose\Application Data\Mozilla\Extensions
[2010/11/18 09:44:36 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Leon & Rose\Application Data\Mozilla\Firefox\Profiles\oqvjm278.default\extensions
[2010/11/18 09:43:13 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2010/12/28 11:37:41 | 000,000,000 | —D | M] (Norton IPS) – C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\IPSFFPLGN
[2009/03/21 09:39:01 | 000,000,000 | —D | M] (Java Quick Starter) – C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF

O1 HOSTS File: ([2011/01/05 09:14:31 | 000,000,098 | —- | M]) - C:\WINDOWS\system32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton AntiVirus\Norton AntiVirus\Engine\18.5.0.125\ips\ipsbho.dll (Symantec Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {63CC63C6-1AE1-491C-B96A-812A7950A1EC} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {C4069E3A-68F1-403E-B40E-20066696354B} - No CLSID value found.
O4 - HKLM..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe (Hewlett-Packard)
O4 - HKLM..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe (HP)
O4 - HKLM..\Run: [Symantec PIF AlertEng] C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe (Symantec Corporation)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\SoftStuff Wallpaper Changer.lnk = C:\Program Files\SoftStuff\softstrt.exe File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra Button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe (PokerStars)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation)
O15 - HKCU\..Trusted Domains: ameritrade.com ([]http in Trusted sites)
O15 - HKCU\..Trusted Domains: brokersxpress.com ([www] https in Trusted sites)
O15 - HKCU\..Trusted Domains: herbalink.com ([www] http in Trusted sites)
O15 - HKCU\..Trusted Domains: optionsxpress.com ([www] https in Trusted sites)
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} http://office.microsoft.com/templates/ieawsdc.cab (Microsoft Office Template and Media Control)
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} http://download.microsoft.com/download/e/4…/OGAControl.cab (Office Genuine Advantage Validation Tool)
O16 - DPF: {230C3D02-DA27-11D2-8612-00A0C93EEA3C} http://www.winkflash.com/photo/loaders/SAXFile.cab (SAXFile FileUpload ActiveX Control)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://fpdownload.macromedia.com/pub/shock…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {315B0BFB-2BD4-481B-80A3-A9B80727C61B} http://webiq005.webiqonline.com/WebIQ/Data…6-6D5536C585C9} (WebIQ Engine Application Object)
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} http://office.microsoft.com/officeupdate/content/opuc.cab (Office Update Installation Engine)
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} http://gfx1.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab (MSN Photo Upload Tool)
O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} http://fb.familylink.com/we_are_related/st…geUploader5.cab (Image Uploader Control)
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} http://upload.facebook.com/controls/Facebo…otoUploader.cab (Facebook Photo Uploader Control)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://v5.windowsupdate.microsoft.com/v5co…b?1098888781197 (WUWebControl Class)
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} https://webdl.symantec.com/activex/symdlmgr.cab (Symantec Download Manager)
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} http://www.winkflash.com/photo/loaders/ImageUploader4.cab (Image Uploader Control)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.0…oUploader55.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {8E28B3A9-FE83-45D1-B657-D5426B81A121} http://cs6b.instantservice.com/jars/customerxsigned41.cab (CustomerCtrl Class)
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} http://www.sibelius.com/download/software/…tiveXPlugin.cab (ScorchPlugin Class)
O16 - DPF: {C7DB51B4-BCF7-4923-8874-7F1A0DC92277} http://office.microsoft.com/officeupdate/content/opuc4.cab (Office Update Installation Engine)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} http://photos.groups.yahoo.com/ocx/us/yexplorer1_9us.cab (PhotosCtrl Class)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/pub/shock…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} https://optionsxpressevents.webex.com/clien…bex/ieatgpc.cab (GpcContainer Class)
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} http://by107fd.bay107.hotmail.msn.com/activex/HMAtchmt.ocx (Hotmail Attachments Control)
O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O16 - DPF: YExplorer1_8US.CAB http://photos.groups.yahoo.com/ocx/us/yexplorer1_8us.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed] [removed]
O18 - Protocol\Handler\cetihpz {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Program Files\HP\hpcoretech\comp\hpuiprot.dll (Hewlett-Packard Company)
O18 - Protocol\Handler\ic32pp {BBCA9F81-8F4F-11D2-90FF-0080C83D3571} - Reg Error: Key error. File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2003/08/09 12:10:11 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (lsdelete) - C:\WINDOWS\System32\lsdelete.exe ()
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/01/04 13:05:25 | 000,000,000 | —D | C] – C:\Program Files\ESET
[2011/01/04 11:18:41 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2011/01/04 09:13:20 | 000,000,000 | RHSD | C] – C:\cmdcons
[2011/01/04 09:11:00 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2011/01/04 09:11:00 | 000,161,792 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2011/01/04 09:11:00 | 000,136,704 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2011/01/04 09:11:00 | 000,031,232 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2011/01/04 09:10:34 | 000,000,000 | —D | C] – C:\WINDOWS\ERDNT
[2011/01/04 09:08:11 | 000,000,000 | —D | C] – C:\Qoobox
[2010/12/16 10:43:07 | 000,000,000 | —D | C] – F:\My Documents\Momsnowrem2010
[2010/12/15 14:50:06 | 000,040,960 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ndproxy.sys
[2010/12/15 14:48:44 | 000,045,568 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wab.exe
[2010/09/09 06:43:42 | 133,582,520 | —- | C] (Lavasoft ) – C:\Program Files\Ad-AwareInstall.exe
[2003/12/09 13:16:52 | 000,442,368 | —- | C] ( ) – C:\WINDOWS\System32\comintfs.dll

========== Files - Modified Within 30 Days ==========

[2011/01/05 12:49:04 | 000,000,472 | —- | M] () – C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2011/01/05 12:45:58 | 000,013,646 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2011/01/05 12:45:31 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/01/05 12:36:05 | 000,001,002 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1960408961-1580818891-1060284298-1003UA.job
[2011/01/05 12:36:05 | 000,000,950 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1960408961-1580818891-1060284298-1003Core.job
[2011/01/05 09:14:31 | 000,000,098 | —- | M] () – C:\WINDOWS\System32\drivers\etc\Hosts
[2011/01/05 00:35:48 | 000,818,134 | —- | M] () – C:\WINDOWS\System32\drivers\NAV\1205000.07D\Cat.DB
[2011/01/04 09:13:27 | 000,000,327 | RHS- | M] () – C:\boot.ini
[2011/01/03 10:51:32 | 000,000,073 | —- | M] () – C:\WINDOWS\efaxview.ini
[2010/12/28 11:37:13 | 000,002,100 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Norton AntiVirus.LNK
[2010/12/26 10:27:27 | 000,000,116 | —- | M] () – C:\WINDOWS\NeroDigital.ini
[2010/12/26 10:27:23 | 000,121,344 | —- | M] () – C:\Documents and Settings\Leon & Rose\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/12/17 14:13:01 | 000,277,352 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2010/12/17 13:49:27 | 000,001,393 | —- | M] () – C:\WINDOWS\imsins.BAK
[2010/12/15 10:38:58 | 000,002,313 | —- | M] () – C:\Documents and Settings\Leon & Rose\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2010/12/15 10:38:57 | 000,002,335 | —- | M] () – C:\Documents and Settings\Leon & Rose\Desktop\Google Chrome.lnk

========== Files Created - No Company Name ==========

[2011/01/04 09:13:27 | 000,000,211 | —- | C] () – C:\Boot.bak
[2011/01/04 09:13:22 | 000,260,272 | RHS- | C] () – C:\cmldr
[2011/01/04 09:11:00 | 000,256,512 | —- | C] () – C:\WINDOWS\PEV.exe
[2011/01/04 09:11:00 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2011/01/04 09:11:00 | 000,089,088 | —- | C] () – C:\WINDOWS\MBR.exe
[2011/01/04 09:11:00 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2011/01/04 09:11:00 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2010/10/20 16:33:04 | 000,001,940 | —- | C] () – C:\Documents and Settings\Leon & Rose\Local Settings\Application Data\{96C87F53-AC72-4604-A9CC-186A49F17F3C}.ini
[2010/09/07 07:22:32 | 000,014,848 | —- | C] () – C:\WINDOWS\System32\EuEpmGdi.dll
[2010/09/07 07:22:31 | 000,013,192 | —- | C] () – C:\WINDOWS\System32\epmntdrv.sys
[2010/09/07 07:22:31 | 000,008,456 | —- | C] () – C:\WINDOWS\System32\EuGdiDrv.sys
[2010/03/24 18:30:38 | 000,088,502 | —- | C] () – C:\Documents and Settings\Leon & Rose\Local Settings\Application Data\FASTWiz.log
[2008/10/22 10:27:16 | 000,003,920 | —- | C] () – C:\Documents and Settings\All Users\Application Data\LUUnInstall.LiveUpdate
[2008/06/24 08:33:01 | 000,001,755 | —- | C] () – C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2008/02/04 17:23:10 | 000,693,792 | —- | C] () – C:\WINDOWS\System32\OGACheckControl.DLL
[2007/05/11 07:38:37 | 000,000,000 | —- | C] () – C:\WINDOWS\webica.ini
[2007/02/24 11:23:25 | 000,000,028 | —- | C] () – C:\WINDOWS\pdf995.ini
[2007/02/18 17:41:59 | 000,000,142 | —- | C] () – C:\WINDOWS\wpd99.drv
[2007/02/18 17:41:23 | 000,051,716 | —- | C] () – C:\WINDOWS\System32\pdf995mon.dll
[2006/08/21 08:03:54 | 000,000,023 | —- | C] () – C:\WINDOWS\kodakpcd.Leon & Rose.ini
[2006/08/15 20:10:50 | 000,000,049 | —- | C] () – C:\WINDOWS\VistaEmail.ini
[2006/03/22 09:27:20 | 001,425,680 | —- | C] () – C:\Program Files\PPVIEW32.EXE
[2005/04/21 09:41:26 | 000,000,116 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2005/02/27 15:52:27 | 000,072,192 | —- | C] () – C:\WINDOWS\System32\zlib.dll
[2005/02/10 11:56:32 | 000,000,134 | —- | C] () – C:\Documents and Settings\Leon & Rose\Local Settings\Application Data\fusioncache.dat
[2005/01/09 12:38:25 | 000,000,000 | —- | C] () – C:\WINDOWS\RAWImage.INI
[2004/12/24 14:13:39 | 000,000,000 | —- | C] () – C:\WINDOWS\OpPrintServer.INI
[2004/04/08 11:52:09 | 000,000,021 | —- | C] () – C:\WINDOWS\Shapeworks.ini
[2004/01/27 13:49:09 | 000,121,344 | —- | C] () – C:\Documents and Settings\Leon & Rose\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2003/11/27 12:51:00 | 000,012,034 | —- | C] () – C:\WINDOWS\hpdj5600.ini
[2003/11/21 14:58:06 | 000,005,120 | —- | C] () – C:\WINDOWS\System32\TMFaxUI.dll
[2003/11/21 14:57:52 | 000,013,824 | —- | C] () – C:\WINDOWS\System32\TMFaxMon.dll
[2003/10/26 12:09:36 | 000,000,073 | —- | C] () – C:\WINDOWS\cdplayer.ini
[2003/08/09 16:20:39 | 000,000,073 | —- | C] () – C:\WINDOWS\efaxview.ini
[2003/08/09 14:06:53 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2003/08/09 13:27:40 | 000,363,520 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2003/08/09 07:56:42 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2003/01/07 14:05:08 | 000,002,695 | —- | C] () – C:\WINDOWS\System32\OUTLPERF.INI
[2002/12/10 00:00:00 | 001,708,032 | —- | C] () – C:\WINDOWS\System32\MSO97V.DLL
[2002/12/10 00:00:00 | 000,036,864 | —- | C] () – C:\WINDOWS\System32\DOCOBJ.DLL
[2002/12/10 00:00:00 | 000,032,768 | —- | C] () – C:\WINDOWS\System32\MSORFS.DLL
[2002/12/10 00:00:00 | 000,032,768 | —- | C] () – C:\WINDOWS\System32\HLINKPRX.DLL

========== Alternate Data Streams ==========

@Alternate Data Stream - 88 bytes -> C:\ad.dll:SummaryInformation

< End of report >

I will let you know in a few minutes how the computer is acting.
Thanks

flower4496

Post #13January 5, 2011, 8:17 PM UTC

The computer seems to be running ok right now

Conspire

Post #14January 6, 2011, 10:35 AM UTC

So no more about:blank already? No freezes whatsoever?

flower4496

Post #15January 6, 2011, 2:06 PM UTC

It seems to be gone now and no freezes. Thank you

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

slow internet response and about blank

✨ Ask AI

Ask AI