Slow Computer

My computer has been running slow for a while now, but I haven't been able to figure out why…

Here's the log from HijackThis
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan Enterprise\scriptcl.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [Apoint] "C:\Program Files\Apoint2K\Apoint.exe"
O4 - HKLM\..\Run: [TPNF] "C:\Program Files\TOSHIBA\TouchPad\TPTray.exe"
O4 - HKLM\..\Run: [CeEKEY] "C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe"
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [DDWMon] "C:\Program Files\TOSHIBA\TOSHIBA Direct Disc Writer\\ddwmon.exe"
O4 - HKLM\..\Run: [PadTouch] "C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe"
O4 - HKLM\..\Run: [SmoothView] "C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe"
O4 - HKLM\..\Run: [HWSetup] "C:\Program Files\TOSHIBA\TOSHIBA Applet\HWSetup.exe" hwSetUP
O4 - HKLM\..\Run: [Tvs] "C:\Program Files\Toshiba\Tvs\TvsTray.exe"
O4 - HKLM\..\Run: [SVPWUTIL] "C:\Program Files\Toshiba\Windows Utilities\SVPWUTIL.exe" SVPwUTIL
O4 - HKLM\..\Run: [CFSServ.exe] CFSServ.exe -NoClient
O4 - HKLM\..\Run: [LXCFCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCFtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechCameraAssistant] "C:\Program Files\Logitech\Video\CameraAssistant.exe"
O4 - HKLM\..\Run: [LogitechVideo[inspector]] "C:\Program Files\Logitech\Video\InstallHelper.exe" /inspect
O4 - HKLM\..\Run: [LogitechCameraService(E)] "C:\WINDOWS\system32\ElkCtrl.exe" /automation
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [TOSCDSPD] "C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [FRAGBIRD] C:\DOCUME~1\default\APPLIC~1\army01\dateflaproad.exe
O4 - HKCU\..\Run: [EA Core] "C:\Program Files\Electronic Arts\EADM\Core.exe" -silent
O4 - HKCU\..\Run: [WeatherEye] C:\Documents and Settings\default\Local Settings\Application Data\TheWeatherNetwork\WeatherEye\WeatherEye.exe
O4 - Global Startup: McAfee Security Scan Plus.lnk = ?
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS…er.cab56986.cab
O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: lxcf_device - - C:\WINDOWS\system32\lxcfcoms.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe
O23 - Service: McAfee Security Scan Component Host Service (McComponentHostService) - McAfee, Inc. - C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe
O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\mcshield.exe
O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exe
O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\WINDOWS\system32\TODDSrv.exe

Here's the startuplist
StartupList report, 13/01/2011, 11:36:55 PM
StartupList version: 1.52.2
Started from : C:\Program Files\Trend Micro\HijackThis\HijackThis.EXE
Detected: Windows XP SP3 (WinNT 5.01.2600)
Detected: Internet Explorer v7.00 (7.00.6000.17093)
* Using default options
* Including empty and uninteresting sections
* Showing rarely important sections
==================================================

Running processes:

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
C:\WINDOWS\system32\acs.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\Program Files\McAfee\VirusScan Enterprise\mcshield.exe
C:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\TODDSrv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\Program Files\TOSHIBA\TOSHIBA Direct Disc Writer\ddwmon.exe
C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
C:\Program Files\Toshiba\Tvs\TvsTray.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSServ.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\CameraAssistant.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\WINDOWS\system32\ElkCtrl.exe
C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE
C:\Program Files\McAfee\Common Framework\UdaterUI.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\McAfee\Common Framework\McTray.exe
C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\system32\lxcfcoms.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe

————————————————–

Listing of startup folders:

Shell folders Startup:
[C:\Documents and Settings\default\Start Menu\Programs\Startup]
*No files*

Shell folders AltStartup:
*Folder not found*

User shell folders Startup:
*Folder not found*

User shell folders AltStartup:
*Folder not found*

Shell folders Common Startup:
[C:\Documents and Settings\All Users\Start Menu\Programs\Startup]
McAfee Security Scan Plus.lnk = ?

Shell folders Common AltStartup:
*Folder not found*

User shell folders Common Startup:
*Folder not found*

User shell folders Alternate Common Startup:
*Folder not found*

————————————————–

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,

[HKLM\Software\Microsoft\Windows\CurrentVersion\Winlogon]
*Registry key not found*

[HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
*Registry value not found*

[HKCU\Software\Microsoft\Windows\CurrentVersion\Winlogon]
*Registry key not found*

————————————————–

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

ATIPTA = "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
RTHDCPL = RTHDCPL.EXE
Alcmtr = ALCMTR.EXE
Apoint = "C:\Program Files\Apoint2K\Apoint.exe"
TPNF = "C:\Program Files\TOSHIBA\TouchPad\TPTray.exe"
CeEKEY = "C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe"
NDSTray.exe = NDSTray.exe
DDWMon = "C:\Program Files\TOSHIBA\TOSHIBA Direct Disc Writer\\ddwmon.exe"
PadTouch = "C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe"
SmoothView = "C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe"
HWSetup = "C:\Program Files\TOSHIBA\TOSHIBA Applet\HWSetup.exe" hwSetUP
Tvs = "C:\Program Files\Toshiba\Tvs\TvsTray.exe"
SVPWUTIL = "C:\Program Files\Toshiba\Windows Utilities\SVPWUTIL.exe" SVPwUTIL
CFSServ.exe = CFSServ.exe -NoClient
LXCFCATS = rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCFtime.dll,_RunDLLEntry@16
LVCOMSX = C:\WINDOWS\system32\LVCOMSX.EXE
LogitechCameraAssistant = "C:\Program Files\Logitech\Video\CameraAssistant.exe"
LogitechVideo[inspector] = "C:\Program Files\Logitech\Video\InstallHelper.exe" /inspect
LogitechCameraService(E) = "C:\WINDOWS\system32\ElkCtrl.exe" /automation
ShStatEXE = "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
McAfeeUpdaterUI = "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey
Adobe Reader Speed Launcher = "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
Adobe ARM = "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
QuickTime Task = "C:\Program Files\QuickTime\QTTask.exe" -atboottime
iTunesHelper = "C:\Program Files\iTunes\iTunesHelper.exe"
SunJavaUpdateSched = "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

————————————————–

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce

*No values found*

————————————————–

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

*No values found*

————————————————–

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

*No values found*

————————————————–

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

*Registry key not found*

————————————————–

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

TOSCDSPD = "C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe"
ctfmon.exe = C:\WINDOWS\system32\ctfmon.exe
msnmsgr = "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
FRAGBIRD = C:\DOCUME~1\default\APPLIC~1\army01\dateflaproad.exe
EA Core = "C:\Program Files\Electronic Arts\EADM\Core.exe" -silent
WeatherEye = C:\Documents and Settings\default\Local Settings\Application Data\TheWeatherNetwork\WeatherEye\WeatherEye.exe

————————————————–

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce

*No values found*

————————————————–

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

*No values found*

————————————————–

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices

*No values found*

————————————————–

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

*Registry key not found*

————————————————–

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run

*Registry key not found*

————————————————–

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run

*Registry key not found*

————————————————–

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

[OptionalComponents]
=

————————————————–

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
*No subkeys found*

————————————————–

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
*No subkeys found*

————————————————–

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
*No subkeys found*

————————————————–

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
*Registry key not found*

————————————————–

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
*No subkeys found*

————————————————–

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
*No subkeys found*

————————————————–

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
*No subkeys found*

————————————————–

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
*No subkeys found*

————————————————–

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
*Registry key not found*

————————————————–

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run
*Registry key not found*

————————————————–

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run
*Registry key not found*

————————————————–

File association entry for .EXE:
HKEY_CLASSES_ROOT\exefile\shell\open\command

(Default) = "%1" %*

————————————————–

File association entry for .COM:
HKEY_CLASSES_ROOT\comfile\shell\open\command

(Default) = "%1" %*

————————————————–

File association entry for .BAT:
HKEY_CLASSES_ROOT\batfile\shell\open\command

(Default) = "%1" %*

————————————————–

File association entry for .PIF:
HKEY_CLASSES_ROOT\piffile\shell\open\command

(Default) = "%1" %*

————————————————–

File association entry for .SCR:
HKEY_CLASSES_ROOT\scrfile\shell\open\command

(Default) = "%1" /S

————————————————–

File association entry for .HTA:
HKEY_CLASSES_ROOT\htafile\shell\open\command

(Default) = C:\WINDOWS\system32\mshta.exe "%1" %*

————————————————–

File association entry for .TXT:
HKEY_CLASSES_ROOT\txtfile\shell\open\command

(Default) = %SystemRoot%\system32\NOTEPAD.EXE %1

————————————————–

Enumerating Active Setup stub paths:
HKLM\Software\Microsoft\Active Setup\Installed Components
(* = disabled by HKCU twin)

[<{12d0ed0d-0ee0-4f90-8827-78cefb8f4988}] *
StubPath = C:\WINDOWS\system32\ieudinit.exe

[>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
StubPath = C:\WINDOWS\inf\unregmp2.exe /ShowWMP

[>{26923b43-4d38-484f-9b9e-de460746276c}] *
StubPath = %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE

[>{60B49E34-C7CC-11D0-8953-00A0C90347FF}] *
StubPath = RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP

[>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] *
StubPath = %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

[{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] *
StubPath = %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

[{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] *
StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install

[{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT

[{5945c046-1e7d-11d1-bc44-00c04fd912be}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser

[{6BF52A52-394A-11d3-B153-00C04F79FAA6}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp11.inf,PerUserStub

[{7790769C-0471-11d2-AF11-00C04FA35D02}] *
StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install

[{89820200-ECBD-11cf-8B85-00AA005B4340}] *
StubPath = regsvr32.exe /s /n /i:U shell32.dll

[{89820200-ECBD-11cf-8B85-00AA005B4383}] *
StubPath = C:\WINDOWS\system32\ie4uinit.exe -BaseSettings

[{89B4C1CD-B018-4511-B0A1-5476DBF70820}] *
StubPath = c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install

————————————————–

Enumerating ICQ Agent Autostart apps:
HKCU\Software\Mirabilis\ICQ\Agent\Apps

*Registry key not found*

————————————————–

Load/Run keys from C:\WINDOWS\WIN.INI:

load=*INI section not found*
run=*INI section not found*

Load/Run keys from Registry:

HKLM\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
HKLM\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
HKLM\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
HKCU\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
HKCU\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
HKCU\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
HKCU\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
HKCU\..\Windows NT\CurrentVersion\Windows: load=
HKCU\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: load=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: AppInit_DLLs=

————————————————–

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*

Shell & screensaver key from Registry:

Shell=Explorer.exe
SCRNSAVE.EXE=C:\WINDOWS\system32\ssstars.scr
drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry key not found*
HKLM\..\Policies: Shell=*Registry value not found*

————————————————–

Checking for EXPLORER.EXE instances:

C:\WINDOWS\Explorer.exe: PRESENT!

C:\Explorer.exe: not present
C:\WINDOWS\Explorer\Explorer.exe: not present
C:\WINDOWS\System\Explorer.exe: not present
C:\WINDOWS\System32\Explorer.exe: not present
C:\WINDOWS\Command\Explorer.exe: not present
C:\WINDOWS\Fonts\Explorer.exe: not present

————————————————–

Checking for superhidden extensions:

.lnk: HIDDEN! (arrow overlay: yes)
.pif: HIDDEN! (arrow overlay: yes)
.exe: not hidden
.com: not hidden
.bat: not hidden
.hta: not hidden
.scr: not hidden
.shs: HIDDEN!
.shb: HIDDEN!
.vbs: not hidden
.vbe: not hidden
.wsh: not hidden
.scf: HIDDEN! (arrow overlay: NO!)
.url: HIDDEN! (arrow overlay: yes)
.js: not hidden
.jse: not hidden

————————————————–

Verifying REGEDIT.EXE integrity:

- Regedit.exe found in C:\WINDOWS
- .reg open command is normal (regedit.exe %1)
- Company name OK: 'Microsoft Corporation'
- Original filename OK: 'REGEDIT.EXE'
- File description: 'Registry Editor'

Registry check passed

————————————————–

Enumerating Browser Helper Objects:

AcroIEHelperStub - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll - {18DF081C-E8AD-4283-A596-FA578C2EBDC3}
(no name) - (no file) - {5C255C8A-E604-49b4-9D64-90988571CECB}
scriptproxy - C:\Program Files\McAfee\VirusScan Enterprise\scriptcl.dll - {7DB2D5A0-7241-4E79-B68D-6309F01C5231}
(no name) - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll - {9030D464-4C02-4ABF-8ECC-5164760863C6}
(no name) - C:\Program Files\Java\jre6\bin\jp2ssv.dll - {DBC80044-A445-435b-BC74-9C25C1C588A9}
JQSIEStartDetectorImpl - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll - {E7E6F031-17CE-4C07-BC86-EABFE594F69C}

————————————————–

Enumerating Task Scheduler jobs:

AC3F2B769184DE42.job

————————————————–

Enumerating Download Program Files:

[Shockwave ActiveX Control]
InProcServer32 = C:\WINDOWS\system32\Adobe\Director\SwDir.dll
CODEBASE = http://download.macromedia.com/pub/shockwa…director/sw.cab

[Checkers Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\msgrchkr.dll
CODEBASE = http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab

[Office Update Installation Engine]
InProcServer32 = C:\WINDOWS\opuc.dll
CODEBASE = http://office.microsoft.com/officeupdate/content/opuc3.cab

[Java Plug-in 1.6.0_22]
InProcServer32 = C:\Program Files\Java\jre6\bin\jp2iexp.dll
CODEBASE = http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab

[MessengerStatsClient Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\MessengerStatsPAClient.dll
CODEBASE = http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab

[Java Plug-in 1.6.0_22]
InProcServer32 = C:\Program Files\Java\jre6\bin\jp2iexp.dll
CODEBASE = http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab

[Java Plug-in 1.6.0_22]
InProcServer32 = C:\Program Files\Java\jre6\bin\npjpi160_22.dll
CODEBASE = http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab

[{E2883E8F-472F-4FB0-9522-AC9BF37916A7}]
CODEBASE = http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

[Minesweeper Flags Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\MineSweeper.dll
CODEBASE = http://messenger.zone.msn.com/binary/MineS…er.cab56986.cab

————————————————–

Enumerating Winsock LSP files:

NameSpace #1: C:\WINDOWS\System32\mswsock.dll
NameSpace #2: C:\WINDOWS\System32\winrnr.dll
NameSpace #3: C:\WINDOWS\System32\mswsock.dll
NameSpace #4: C:\Program Files\Bonjour\mdnsNSP.dll
Protocol #1: C:\WINDOWS\system32\mswsock.dll
Protocol #2: C:\WINDOWS\system32\mswsock.dll
Protocol #3: C:\WINDOWS\system32\mswsock.dll
Protocol #4: C:\WINDOWS\system32\rsvpsp.dll
Protocol #5: C:\WINDOWS\system32\rsvpsp.dll
Protocol #6: C:\WINDOWS\system32\mswsock.dll
Protocol #7: C:\WINDOWS\system32\mswsock.dll
Protocol #8: C:\WINDOWS\system32\mswsock.dll
Protocol #9: C:\WINDOWS\system32\mswsock.dll
Protocol #10: C:\WINDOWS\system32\mswsock.dll
Protocol #11: C:\WINDOWS\system32\mswsock.dll
Protocol #12: C:\WINDOWS\system32\mswsock.dll
Protocol #13: C:\WINDOWS\system32\mswsock.dll
Protocol #14: C:\WINDOWS\system32\mswsock.dll
Protocol #15: C:\WINDOWS\system32\mswsock.dll
Protocol #16: C:\WINDOWS\system32\mswsock.dll
Protocol #17: C:\WINDOWS\system32\mswsock.dll

————————————————–

Enumerating Windows NT/2000/XP services

Microsoft ACPI Driver: system32\DRIVERS\ACPI.sys (system)
Microsoft Embedded Controller Driver: system32\DRIVERS\ACPIEC.sys (system)
Atheros Configuration Service: C:\WINDOWS\system32\acs.exe (autostart)
Microsoft Kernel Acoustic Echo Canceller: system32\drivers\aec.sys (manual start)
AEGIS Protocol (IEEE 802.1x) v3.4.7.0: system32\DRIVERS\AegisP.sys (autostart)
AFD: \SystemRoot\System32\drivers\afd.sys (system)
TOSHIBA V92 Software Modem: system32\DRIVERS\AGRSM.sys (manual start)
Alerter: %SystemRoot%\system32\svchost.exe -k LocalService (disabled)
Application Layer Gateway Service: %SystemRoot%\System32\alg.exe (manual start)
Alps Pointing-device Filter Driver: system32\DRIVERS\Apfiltr.sys (manual start)
Apple Mobile Device: "C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe" (autostart)
Application Management: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
Atheros Wireless Network Adapter Service: system32\DRIVERS\ar5211.sys (manual start)
1394 ARP Client Protocol: system32\DRIVERS\arp1394.sys (manual start)
ASP.NET State Service: %SystemRoot%\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (manual start)
RAS Asynchronous Media Driver: system32\DRIVERS\asyncmac.sys (manual start)
Standard IDE/ESDI Hard Disk Controller: system32\DRIVERS\atapi.sys (system)
Ati HotKey Poller: %SystemRoot%\system32\Ati2evxx.exe (autostart)
ati2mtag: system32\DRIVERS\ati2mtag.sys (manual start)
ATM ARP Client Protocol: system32\DRIVERS\atmarpc.sys (manual start)
Windows Audio: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Audio Stub Driver: system32\DRIVERS\audstub.sys (manual start)
Background Intelligent Transfer Service: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Bonjour Service: "C:\Program Files\Bonjour\mDNSResponder.exe" (autostart)
Brother MFC Filter Driver: System32\Drivers\Brfilt.sys (manual start)
MAC Bridge: system32\DRIVERS\bridge.sys (manual start)
MAC Bridge Miniport: system32\DRIVERS\bridge.sys (manual start)
BrSplService: C:\WINDOWS\system32\brsvc01a.exe (autostart)
Computer Browser: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Brother Serial driver: System32\Drivers\BrSerWdm.sys (manual start)
Brother MFC USB Fax Only Modem: System32\Drivers\BrUsbMdm.sys (manual start)
Brother MFC USB Scanner driver: System32\Drivers\BrUsbScn.sys (manual start)
Closed Caption Decoder: system32\DRIVERS\CCDECODE.sys (manual start)
CD-ROM Driver: system32\DRIVERS\cdrom.sys (system)
ConfigFree Service: C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe (autostart)
Indexing Service: %SystemRoot%\system32\cisvc.exe (manual start)
ClipBook: %SystemRoot%\system32\clipsrv.exe (disabled)
.NET Runtime Optimization Service v2.0.50727_X86: C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (manual start)
Microsoft ACPI Control Method Battery Driver: system32\DRIVERS\CmBatt.sys (manual start)
Microsoft Composite Battery Driver: system32\DRIVERS\compbatt.sys (system)
COM+ System Application: C:\WINDOWS\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235} (manual start)
Cryptographic Services: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
DCOM Server Process Launcher: %SystemRoot%\system32\svchost -k DcomLaunch (autostart)
DHCP Client: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Disk Driver: system32\DRIVERS\disk.sys (system)
Logical Disk Manager Administrative Service: %SystemRoot%\System32\dmadmin.exe /com (manual start)
dmboot: System32\drivers\dmboot.sys (disabled)
dmio: System32\drivers\dmio.sys (disabled)
dmload: System32\drivers\dmload.sys (disabled)
Logical Disk Manager: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Microsoft Kernel DLS Syntheiszer: system32\drivers\DMusic.sys (manual start)
DNS Client: %SystemRoot%\system32\svchost.exe -k NetworkService (autostart)
Wired AutoConfig: %SystemRoot%\System32\svchost.exe -k dot3svc (manual start)
Microsoft Kernel DRM Audio Descrambler: system32\drivers\drmkaud.sys (manual start)
DVD-RAM_Service: C:\WINDOWS\system32\DVDRAMSV.exe (autostart)
Extensible Authentication Protocol Service: %SystemRoot%\System32\svchost.exe -k eapsvcs (manual start)
Error Reporting Service: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Event Log: %SystemRoot%\system32\services.exe (autostart)
COM+ Event System: C:\WINDOWS\system32\svchost.exe -k netsvcs (manual start)
Fast User Switching Compatibility: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
FltMgr: system32\drivers\fltmgr.sys (system)
Windows Presentation Foundation Font Cache 3.0.0.0: c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe (manual start)
Volume Manager Driver: system32\DRIVERS\ftdisk.sys (system)
GEAR ASPI Filter Driver: System32\Drivers\GEARAspiWDM.sys (manual start)
Generic Packet Classifier: system32\DRIVERS\msgpc.sys (manual start)
Microsoft UAA Bus Driver for High Definition Audio: system32\DRIVERS\HDAudBus.sys (manual start)
Help and Support: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
HID Input Service: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Microsoft HID Class Driver: system32\DRIVERS\hidusb.sys (manual start)
Health Key and Certificate Management Service: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
HTTP: System32\Drivers\HTTP.sys (manual start)
HTTP SSL: %SystemRoot%\System32\svchost.exe -k HTTPFilter (manual start)
i8042 Keyboard and PS/2 Mouse Port Driver: system32\DRIVERS\i8042prt.sys (system)
InstallDriver Table Manager: "C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe" (manual start)
Windows CardSpace: "c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe" (manual start)
CD-Burning Filter Driver: system32\DRIVERS\imapi.sys (system)
IMAPI CD-Burning COM Service: C:\WINDOWS\system32\imapi.exe (manual start)
Service for Realtek HD Audio (WDM): system32\drivers\RtkHDAud.sys (manual start)
Intel Processor Driver: system32\DRIVERS\intelppm.sys (system)
IPv6 Windows Firewall Driver: system32\drivers\ip6fw.sys (manual start)
IP Traffic Filter Driver: system32\DRIVERS\ipfltdrv.sys (manual start)
IP in IP Tunnel Driver: system32\DRIVERS\ipinip.sys (manual start)
IP Network Address Translator: system32\DRIVERS\ipnat.sys (manual start)
iPod Service: "C:\Program Files\iPod\bin\iPodService.exe" (manual start)
IPSEC driver: system32\DRIVERS\ipsec.sys (system)
IR Enumerator Service: system32\DRIVERS\irenum.sys (manual start)
PnP ISA/EISA Bus Driver: system32\DRIVERS\isapnp.sys (system)
IVI ASPI Shell: system32\drivers\iviaspi.sys (manual start)
Java Quick Starter: "C:\Program Files\Java\jre6\bin\jqs.exe" -service -config "C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf" (autostart)
Keyboard Class Driver: system32\DRIVERS\kbdclass.sys (system)
Microsoft Kernel Wave Audio Mixer: system32\drivers\kmixer.sys (manual start)
Server: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Workstation: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
TCP/IP NetBIOS Helper: %SystemRoot%\system32\svchost.exe -k LocalService (autostart)
Logitech Kernel Audio Processing Filter Driver: \??\C:\WINDOWS\system32\drivers\Lvckap.sys (manual start)
Logitech Machine Vision Engine Loader: \??\C:\WINDOWS\system32\drivers\lvmvdrv.sys (manual start)
Logitech LVPrcMon Driver: \??\C:\WINDOWS\system32\drivers\LVPrcMon.sys (manual start)
Logitech Process Monitor: c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe (autostart)
Logitech USB Monitor Filter: system32\drivers\lvusbsta.sys (manual start)
lxcf_device: C:\WINDOWS\system32\lxcfcoms.exe -service (manual start)
McAfee Framework Service: "C:\Program Files\McAfee\Common Framework\FrameworkService.exe" /ServiceStart (autostart)
McAfee Security Scan Component Host Service: "C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe" (manual start)
McAfee McShield: "C:\Program Files\McAfee\VirusScan Enterprise\mcshield.exe" (autostart)
McAfee Task Manager: "C:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exe" (autostart)
Machine Debug Manager: "C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE" (autostart)
meiudf: System32\Drivers\meiudf.sys (system)
Messenger: %SystemRoot%\system32\svchost.exe -k netsvcs (disabled)
mf: system32\DRIVERS\mf.sys (manual start)
McAfee Inc.: system32\drivers\mfeapfk.sys (manual start)
McAfee Inc.: system32\drivers\mfeavfk.sys (manual start)
McAfee Inc.: system32\drivers\mfebopk.sys (manual start)
McAfee Inc.: system32\drivers\mfehidk.sys (manual start)
VSCore mferkdk: \??\C:\Program Files\McAfee\VirusScan Enterprise\mferkdk.sys (system)
McAfee Inc.: system32\drivers\mfetdik.sys (system)
NetMeeting Remote Desktop Sharing: C:\WINDOWS\system32\mnmsrvc.exe (manual start)
Mouse Class Driver: system32\DRIVERS\mouclass.sys (system)
Mouse HID Driver: system32\DRIVERS\mouhid.sys (manual start)
WebDav Client Redirector: system32\DRIVERS\mrxdav.sys (manual start)
MRXSMB: system32\DRIVERS\mrxsmb.sys (system)
Distributed Transaction Coordinator: C:\WINDOWS\system32\msdtc.exe (manual start)
Windows Installer: C:\WINDOWS\system32\msiexec.exe /V (manual start)
Microsoft Streaming Service Proxy: system32\drivers\MSKSSRV.sys (manual start)
Microsoft Streaming Clock Proxy: system32\drivers\MSPCLOCK.sys (manual start)
Microsoft Streaming Quality Manager Proxy: system32\drivers\MSPQM.sys (manual start)
Microsoft System Management BIOS Driver: system32\DRIVERS\mssmbios.sys (manual start)
Microsoft Streaming Tee/Sink-to-Sink Converter: system32\drivers\MSTEE.sys (manual start)
NABTS/FEC VBI Codec: system32\DRIVERS\NABTSFEC.sys (manual start)
Network Access Protection Agent: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Microsoft TV/Video Connection: system32\DRIVERS\NdisIP.sys (manual start)
Remote Access NDIS TAPI Driver: system32\DRIVERS\ndistapi.sys (manual start)
NDIS Usermode I/O Protocol: system32\DRIVERS\ndisuio.sys (manual start)
Remote Access NDIS WAN Driver: system32\DRIVERS\ndiswan.sys (manual start)
NetBIOS Interface: system32\DRIVERS\netbios.sys (system)
NetBios over Tcpip: system32\DRIVERS\netbt.sys (system)
Network DDE: %SystemRoot%\system32\netdde.exe (disabled)
Network DDE DSDM: %SystemRoot%\system32\netdde.exe (disabled)
TOSHIBA Network Device Usermode I/O Protocol: system32\DRIVERS\netdevio.sys (autostart)
Net Logon: %SystemRoot%\system32\lsass.exe (manual start)
Network Connections: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Net.Tcp Port Sharing Service: "c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe" (disabled)
1394 Net Driver: system32\DRIVERS\nic1394.sys (manual start)
Network Location Awareness (NLA): %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
NT LM Security Support Provider: %SystemRoot%\system32\lsass.exe (manual start)
Removable Storage: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
IPX Traffic Filter Driver: system32\DRIVERS\nwlnkflt.sys (manual start)
IPX Traffic Forwarder Driver: system32\DRIVERS\nwlnkfwd.sys (manual start)
VIA OHCI Compliant IEEE 1394 Host Controller: system32\DRIVERS\ohci1394.sys (system)
Office Source Engine: "C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE" (manual start)
PCI Bus Driver: system32\DRIVERS\pci.sys (system)
PCIIde: system32\DRIVERS\pciide.sys (system)
Pcmcia: system32\DRIVERS\pcmcia.sys (system)
Padus ASPI Shell: system32\drivers\pfc.sys (manual start)
Logitech QuickCam Express(PID_0928): system32\DRIVERS\LV561AV.SYS (manual start)
Plug and Play: %SystemRoot%\system32\services.exe (autostart)
IPSEC Services: %SystemRoot%\system32\lsass.exe (autostart)
WAN Miniport (PPTP): system32\DRIVERS\raspptp.sys (manual start)
Protected Storage: %SystemRoot%\system32\lsass.exe (autostart)
QoS Packet Scheduler: system32\DRIVERS\psched.sys (manual start)
Direct Parallel Link Driver: system32\DRIVERS\ptilink.sys (manual start)
PxHelp20: System32\Drivers\PxHelp20.sys (system)
Remote Access Auto Connection Driver: system32\DRIVERS\rasacd.sys (system)
Remote Access Auto Connection Manager: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
WAN Miniport (L2TP): system32\DRIVERS\rasl2tp.sys (manual start)
Remote Access Connection Manager: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
Remote Access PPPOE Driver: system32\DRIVERS\raspppoe.sys (manual start)
Direct Parallel: system32\DRIVERS\raspti.sys (manual start)
Rdbss: system32\DRIVERS\rdbss.sys (system)
RDPCDD: System32\DRIVERS\RDPCDD.sys (system)
Remote Desktop Help Session Manager: C:\WINDOWS\system32\sessmgr.exe (manual start)
Digital CD Audio Playback Filter Driver: system32\DRIVERS\redbook.sys (system)
Routing and Remote Access: %SystemRoot%\system32\svchost.exe -k netsvcs (disabled)
Remote Procedure Call (RPC) Locator: %SystemRoot%\system32\locator.exe (manual start)
Remote Procedure Call (RPC): %SystemRoot%\system32\svchost -k rpcss (autostart)
QoS RSVP: %SystemRoot%\system32\rsvp.exe (manual start)
Realtek RTL8139/810x/8169/8110 all in one NDIS XP Driver: system32\DRIVERS\Rtlnicxp.sys (manual start)
Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver: system32\DRIVERS\RTL8139.SYS (manual start)
Security Accounts Manager: %SystemRoot%\system32\lsass.exe (autostart)
Smart Card: %SystemRoot%\System32\SCardSvr.exe (manual start)
Schedule: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Secdrv: system32\DRIVERS\secdrv.sys (autostart)
Secondary Logon: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
System Event Notification: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
High-Capacity Floppy Disk Drive: system32\DRIVERS\sfloppy.sys (manual start)
Windows Firewall/Internet Connection Sharing (ICS): %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Shell Hardware Detection: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
BDA Slip De-Framer: system32\DRIVERS\SLIP.sys (manual start)
Microsoft Kernel Audio Splitter: system32\drivers\splitter.sys (manual start)
Print Spooler: %SystemRoot%\system32\spoolsv.exe (autostart)
System Restore Filter Driver: system32\DRIVERS\sr.sys (system)
System Restore Service: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Srv: system32\DRIVERS\srv.sys (manual start)
SSDP Discovery Service: %SystemRoot%\system32\svchost.exe -k LocalService (manual start)
Windows Image Acquisition (WIA): %SystemRoot%\system32\svchost.exe -k imgsvc (autostart)
BDA IPSink: system32\DRIVERS\StreamIP.sys (manual start)
Software Bus Driver: system32\DRIVERS\swenum.sys (manual start)
Microsoft Kernel GS Wavetable Synthesizer: system32\drivers\swmidi.sys (manual start)
MS Software Shadow Copy Provider: C:\WINDOWS\system32\dllhost.exe /Processid:{DDDE52AE-610B-43ED-BDBD-F0D0C8FD0A38} (manual start)
Microsoft Kernel System Audio Device: system32\drivers\sysaudio.sys (manual start)
Performance Logs and Alerts: %SystemRoot%\system32\smlogsvc.exe (manual start)
Telephony: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
TBiosDrv: \??\C:\WINDOWS\system32\Drivers\Tbiosdrv.sys (manual start)
TCP/IP Protocol Driver: system32\DRIVERS\tcpip.sys (system)
TOSHIBA Writing Engine Filter Driver: system32\DRIVERS\tdcmdpst.sys (manual start)
TDSSserv.sys: \systemroot\system32\drivers\TDSSmhct.sys (system)
TOSHIBA UDF File System Driver: system32\DRIVERS\tdudf.sys (autostart)
Terminal Device Driver: system32\DRIVERS\termdd.sys (system)
Terminal Services: %SystemRoot%\System32\svchost -k DComLaunch (manual start)
Themes: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
TOSHIBA Optical Disc Drive Service: C:\WINDOWS\system32\TODDSrv.exe (autostart)
TPwSav: \??\C:\WINDOWS\system32\drivers\TPwSav.sys (system)
Distributed Link Tracking Client: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
TOSHIBA Virtual Sound with SRS technologies: system32\DRIVERS\Tvs.sys (manual start)
Microcode Update Driver: system32\DRIVERS\update.sys (manual start)
Universal Plug and Play Device Host: %SystemRoot%\system32\svchost.exe -k LocalService (manual start)
Uninterruptible Power Supply: %SystemRoot%\System32\ups.exe (manual start)
Apple Mobile USB Driver: System32\Drivers\usbaapl.sys (manual start)
Microsoft USB Generic Parent Driver: system32\DRIVERS\usbccgp.sys (manual start)
Microsoft USB 2.0 Enhanced Host Controller Miniport Driver: system32\DRIVERS\usbehci.sys (manual start)
USB2 Enabled Hub: system32\DRIVERS\usbhub.sys (manual start)
Microsoft USB Open Host Controller Miniport Driver: system32\DRIVERS\usbohci.sys (manual start)
Microsoft USB PRINTER Class: system32\DRIVERS\usbprint.sys (manual start)
USB Scanner Driver: system32\DRIVERS\usbscan.sys (manual start)
USB Mass Storage Driver: system32\DRIVERS\USBSTOR.SYS (manual start)
VGA Display Controller.: \SystemRoot\System32\drivers\vga.sys (system)
Volume Shadow Copy: %SystemRoot%\System32\vssvc.exe (manual start)
Windows Time: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Remote Access IP ARP Driver: system32\DRIVERS\wanarp.sys (manual start)
Microsoft WINMM WDM Audio Compatibility Driver: system32\drivers\wdmaud.sys (manual start)
WebClient: %SystemRoot%\system32\svchost.exe -k LocalService (autostart)
Windows Management Instrumentation: %systemroot%\system32\svchost.exe -k netsvcs (autostart)
Portable Media Serial Number Service: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
WMI Performance Adapter: C:\WINDOWS\system32\wbem\wmiapsrv.exe (manual start)
Windows Media Player Network Sharing Service: "C:\Program Files\Windows Media Player\WMPNetwk.exe" (manual start)
WpdUsb: System32\Drivers\wpdusb.sys (manual start)
Security Center: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
World Standard Teletext Codec: system32\DRIVERS\WSTCODEC.SYS (manual start)
Automatic Updates: %systemroot%\system32\svchost.exe -k netsvcs (autostart)
Windows Driver Foundation - User-mode Driver Framework Platform Driver: system32\DRIVERS\WudfPf.sys (manual start)
Windows Driver Foundation - User-mode Driver Framework Reflector: system32\DRIVERS\wudfrd.sys (manual start)
Windows Driver Foundation - User-mode Driver Framework: %SystemRoot%\system32\svchost.exe -k WudfServiceGroup (manual start)
Wireless Zero Configuration: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Network Provisioning Service: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)


————————————————–

Enumerating Windows NT logon/logoff scripts:
*No scripts set to run*

Windows NT checkdisk command:
BootExecute = autocheck autochk *

Windows NT 'Wininit.ini':
PendingFileRenameOperations: *Registry value not found*

————————————————–

Enumerating ShellServiceObjectDelayLoad items:

PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\system32\webcheck.dll
SysTray: C:\WINDOWS\system32\stobject.dll
WPDShServiceObj: C:\WINDOWS\system32\WPDShServiceObj.dll

————————————————–
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run

*Registry key not found*

————————————————–

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run

*No values found*

————————————————–

End of report, 40,719 bytes
Report generated in 1.094 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only

ark.txt
GMER 1.0.15.15530 - http://www.gmer.net
Rootkit scan 2011-01-14 16:58:56
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 FUJITSU_MHV2060BH_PL rev.00000029
Running: gmer.exe; Driver: C:\DOCUME~1\default\LOCALS~1\Temp\fwpyaaod.sys


—- System - GMER 1.0.15 —-

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateKey [0xF17D61AB]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwDeleteKey [0xF17D61BF]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwDeleteValueKey [0xF17D61EB]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwOpenKey [0xF17D6197]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwRenameKey [0xF17D61D5]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwSetValueKey [0xF17D6201]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwTerminateProcess [0xF17D6217]

—- Kernel code sections - GMER 1.0.15 —-

PAGE ntoskrnl.exe!ZwOpenKey 80568D48 5 Bytes JMP F17D619B \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwCreateKey 80570833 5 Bytes JMP F17D61AF \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwSetValueKey 80572A6E 7 Bytes JMP F17D6205 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwTerminateProcess 805824CC 5 Bytes JMP F17D621B \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwDeleteValueKey 80592D64 7 Bytes JMP F17D61EF \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwDeleteKey 80595316 7 Bytes JMP F17D61C3 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
PAGE ntoskrnl.exe!ZwRenameKey 8064EAEA 7 Bytes JMP F17D61D9 \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)

—- User code sections - GMER 1.0.15 —-

.text C:\Program Files\Internet Explorer\iexplore.exe[1400] USER32.dll!DialogBoxParamW 7E4247AB 5 Bytes JMP 3E1DF4D9 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[1400] USER32.dll!DialogBoxIndirectParamW 7E432072 5 Bytes JMP 3E3527F6 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[1400] USER32.dll!MessageBoxIndirectA 7E43A082 5 Bytes JMP 3E352777 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[1400] USER32.dll!DialogBoxParamA 7E43B144 5 Bytes JMP 3E3527BB C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[1400] USER32.dll!MessageBoxExW 7E450838 5 Bytes JMP 3E352703 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[1400] USER32.dll!MessageBoxExA 7E45085C 5 Bytes JMP 3E35273D C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[1400] USER32.dll!DialogBoxIndirectParamA 7E456D7D 5 Bytes JMP 3E352831 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[1400] USER32.dll!MessageBoxIndirectW 7E4664D5 5 Bytes JMP 3E20178A C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[1400] ole32.dll!OleLoadFromStream 7752981B 5 Bytes JMP 3E3529F3 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

—- Devices - GMER 1.0.15 —-

AttachedDevice \FileSystem\Ntfs \Ntfs mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)

—- Registry - GMER 1.0.15 —-

Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040211900063D11C8EF10054038389C\Usage@HandWritingFiles 1043227363
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls@Èî5\5âgC$æ\x2039\1\x2020âgC$æ\x2039\1m\x2026hC\x2dcø\x2039\1\x2dcø\x2039\1dæ\x2039\1<æ\x2039\1#\ImageUploader4.ocx 1
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls@ÉU\x2018|\x201eã\x2039\1\ImageUploader4.ocx 1
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls@PË\17\6m\5\x2018|\1\ImageUploader4.ocx 1
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls@X\xa2>\5m\5\x2018|\1\ImageUploader4.ocx 1

—- Disk sectors - GMER 1.0.15 —-

Disk \Device\Harddisk0\DR0 sector 01: copy of MBR
Disk \Device\Harddisk0\DR0 sector 02: copy of MBR
Disk \Device\Harddisk0\DR0 sector 03: copy of MBR
Disk \Device\Harddisk0\DR0 sector 04: copy of MBR
Disk \Device\Harddisk0\DR0 sector 05: copy of MBR
Disk \Device\Harddisk0\DR0 sector 06: copy of MBR
Disk \Device\Harddisk0\DR0 sector 07: copy of MBR
Disk \Device\Harddisk0\DR0 sector 08: copy of MBR
Disk \Device\Harddisk0\DR0 sector 09: copy of MBR
Disk \Device\Harddisk0\DR0 sector 10: copy of MBR
Disk \Device\Harddisk0\DR0 sector 11: copy of MBR
Disk \Device\Harddisk0\DR0 sector 12: copy of MBR
Disk \Device\Harddisk0\DR0 sector 13: copy of MBR
Disk \Device\Harddisk0\DR0 sector 14: copy of MBR
Disk \Device\Harddisk0\DR0 sector 15: copy of MBR
Disk \Device\Harddisk0\DR0 sector 16: copy of MBR
Disk \Device\Harddisk0\DR0 sector 17: copy of MBR
Disk \Device\Harddisk0\DR0 sector 18: copy of MBR
Disk \Device\Harddisk0\DR0 sector 19: copy of MBR
Disk \Device\Harddisk0\DR0 sector 20: copy of MBR
Disk \Device\Harddisk0\DR0 sector 21: copy of MBR
Disk \Device\Harddisk0\DR0 sector 22: copy of MBR
Disk \Device\Harddisk0\DR0 sector 23: copy of MBR
Disk \Device\Harddisk0\DR0 sector 24: copy of MBR
Disk \Device\Harddisk0\DR0 sector 25: copy of MBR
Disk \Device\Harddisk0\DR0 sector 26: copy of MBR
Disk \Device\Harddisk0\DR0 sector 27: copy of MBR
Disk \Device\Harddisk0\DR0 sector 28: copy of MBR
Disk \Device\Harddisk0\DR0 sector 29: copy of MBR
Disk \Device\Harddisk0\DR0 sector 30: copy of MBR
Disk \Device\Harddisk0\DR0 sector 31: copy of MBR
Disk \Device\Harddisk0\DR0 sector 32: copy of MBR
Disk \Device\Harddisk0\DR0 sector 33: copy of MBR
Disk \Device\Harddisk0\DR0 sector 34: copy of MBR
Disk \Device\Harddisk0\DR0 sector 35: copy of MBR
Disk \Device\Harddisk0\DR0 sector 36: copy of MBR
Disk \Device\Harddisk0\DR0 sector 37: copy of MBR
Disk \Device\Harddisk0\DR0 sector 38: copy of MBR
Disk \Device\Harddisk0\DR0 sector 39: copy of MBR
Disk \Device\Harddisk0\DR0 sector 40: copy of MBR
Disk \Device\Harddisk0\DR0 sector 41: copy of MBR
Disk \Device\Harddisk0\DR0 sector 42: copy of MBR
Disk \Device\Harddisk0\DR0 sector 43: copy of MBR
Disk \Device\Harddisk0\DR0 sector 44: copy of MBR
Disk \Device\Harddisk0\DR0 sector 45: copy of MBR
Disk \Device\Harddisk0\DR0 sector 46: copy of MBR
Disk \Device\Harddisk0\DR0 sector 47: copy of MBR
Disk \Device\Harddisk0\DR0 sector 48: copy of MBR
Disk \Device\Harddisk0\DR0 sector 49: copy of MBR
Disk \Device\Harddisk0\DR0 sector 50: copy of MBR
Disk \Device\Harddisk0\DR0 sector 51: copy of MBR
Disk \Device\Harddisk0\DR0 sector 52: copy of MBR
Disk \Device\Harddisk0\DR0 sector 53: copy of MBR
Disk \Device\Harddisk0\DR0 sector 54: copy of MBR
Disk \Device\Harddisk0\DR0 sector 55: copy of MBR
Disk \Device\Harddisk0\DR0 sector 56: copy of MBR
Disk \Device\Harddisk0\DR0 sector 57: copy of MBR
Disk \Device\Harddisk0\DR0 sector 58: copy of MBR
Disk \Device\Harddisk0\DR0 sector 59: copy of MBR
Disk \Device\Harddisk0\DR0 sector 60: copy of MBR
Disk \Device\Harddisk0\DR0 sector 61: copy of MBR
Disk \Device\Harddisk0\DR0 sector 62: rootkit-like behavior; copy of MBR
Disk \Device\Harddisk0\DR0 sector 63: rootkit-like behavior; copy of MBR
Disk \Device\Harddisk0\DR0 sectors 117209984 (+255): rootkit-like behavior;

—- EOF - GMER 1.0.15 —-


OTL.txt
OTL logfile created on: 14/01/2011 5:08:57 PM - Run 1
OTL by OldTimer - Version 3.2.20.2 Folder = C:\Documents and Settings\default\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 00001009 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy

478.00 Mb Total Physical Memory | 116.00 Mb Available Physical Memory | 24.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 63.00% Paging File free
Paging file location(s): C:\pagefile.sys 672 1344 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 55.89 Gb Total Space | 18.94 Gb Free Space | 33.88% Space Free | Partition Type: NTFS

Computer Name: YOUR-2B7C71599F | User Name: default | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/01/14 17:08:06 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Documents and Settings\default\Desktop\OTL.exe
PRC - [2010/08/13 11:58:56 | 000,144,672 | —- | M] (Apple Inc.) – C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
PRC - [2010/01/15 07:49:20 | 000,255,536 | —- | M] (McAfee, Inc.) – C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe
PRC - [2009/01/27 19:50:00 | 000,144,704 | —- | M] (McAfee, Inc.) – C:\Program Files\McAfee\VirusScan Enterprise\mcshield.exe
PRC - [2009/01/27 19:50:00 | 000,111,952 | —- | M] (McAfee, Inc.) – C:\Program Files\McAfee\VirusScan Enterprise\shstat.exe
PRC - [2009/01/27 19:50:00 | 000,054,608 | —- | M] (McAfee, Inc.) – C:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exe
PRC - [2008/04/13 19:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) – C:\WINDOWS\explorer.exe
PRC - [2006/11/17 12:40:56 | 000,136,768 | —- | M] (McAfee, Inc.) – C:\Program Files\McAfee\Common Framework\naPrdMgr.exe
PRC - [2006/11/17 12:39:58 | 000,136,768 | —- | M] (McAfee, Inc.) – C:\Program Files\McAfee\Common Framework\UdaterUI.exe
PRC - [2006/11/17 12:37:44 | 000,104,000 | —- | M] (McAfee, Inc.) – C:\Program Files\McAfee\Common Framework\FrameworkService.exe
PRC - [2006/11/17 02:06:00 | 000,086,016 | —- | M] (McAfee, Inc.) – C:\Program Files\McAfee\Common Framework\Mctray.exe
PRC - [2006/04/25 19:57:00 | 000,299,008 | —- | M] (TOSHIBA Corporation) – C:\Program Files\TOSHIBA\TOSHIBA Direct Disc Writer\DDWMon.exe
PRC - [2006/04/04 16:57:18 | 000,053,248 | —- | M] (COMPAL ELECTRONIC INC.) – C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
PRC - [2006/03/16 15:27:26 | 000,634,880 | —- | M] (COMPAL ELECTRONIC INC.) – C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
PRC - [2006/02/02 14:11:38 | 000,073,728 | —- | M] (TOSHIBA Corporation) – C:\Program Files\TOSHIBA\Tvs\TvsTray.exe
PRC - [2005/12/20 14:17:48 | 000,114,688 | —- | M] (TOSHIBA Corporation) – C:\WINDOWS\system32\TODDSrv.exe
PRC - [2005/12/09 14:37:42 | 000,081,920 | —- | M] (Logitech Inc.) – c:\Program Files\Common Files\Logitech\LVMVFM\LVPrcSrv.exe
PRC - [2005/12/09 14:32:18 | 000,225,280 | —- | M] (Logitech Inc.) – C:\WINDOWS\system32\LVCOMSX.EXE
PRC - [2005/12/07 09:26:30 | 000,489,472 | —- | M] (Logitech Inc.) – C:\Program Files\Logitech\Video\CameraAssistant.exe
PRC - [2005/12/06 00:06:10 | 001,077,322 | —- | M] (TOSHIBA) – C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
PRC - [2005/11/17 02:44:38 | 000,798,720 | —- | M] (TOSHIBA CORPORATION) – C:\Program Files\TOSHIBA\ConfigFree\CFSServ.exe
PRC - [2005/11/02 03:41:04 | 000,978,944 | —- | M] (TOSHIBA CORPORATION) – C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
PRC - [2005/09/26 10:22:28 | 000,036,864 | —- | M] () – C:\WINDOWS\system32\acs.exe
PRC - [2005/07/25 14:25:18 | 000,491,520 | —- | M] ( ) – C:\WINDOWS\system32\lxcfcoms.exe
PRC - [2005/04/26 18:13:20 | 000,122,880 | —- | M] (TOSHIBA Corporation) – C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
PRC - [2005/01/17 03:38:38 | 000,040,960 | —- | M] (TOSHIBA CORPORATION) – C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
PRC - [2004/12/30 02:32:20 | 000,065,536 | —- | M] (TOSHIBA) – C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe
PRC - [2004/11/01 16:22:22 | 000,262,144 | —- | M] (Logitech Inc.) – C:\WINDOWS\system32\ElkCtrl.exe
PRC - [2004/08/27 11:33:00 | 000,110,592 | —- | M] (Matsushita Electric Industrial Co., Ltd.) – C:\WINDOWS\system32\DVDRAMSV.exe
PRC - [2002/04/11 19:00:00 | 000,057,344 | —- | M] (brother Industries Ltd) – C:\WINDOWS\system32\brsvc01a.exe
PRC - [2001/12/12 19:01:00 | 000,045,056 | —- | M] (brother Industries Ltd) – C:\WINDOWS\system32\brss01a.exe


========== Modules (SafeList) ==========

MOD - [2011/01/14 17:08:06 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Documents and Settings\default\Desktop\OTL.exe
MOD - [2010/08/23 11:12:02 | 001,054,208 | —- | M] (Microsoft Corporation) – C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll
MOD - [2005/12/09 14:37:42 | 000,086,016 | —- | M] (Logitech Inc.) – C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcInj.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] – – (AppMgmt)
SRV - [2010/08/13 11:58:56 | 000,144,672 | —- | M] (Apple Inc.) [Auto | Running] – C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe – (Apple Mobile Device)
SRV - [2010/01/15 07:49:20 | 000,227,232 | —- | M] (McAfee, Inc.) [On_Demand | Stopped] – C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe – (McComponentHostService)
SRV - [2009/01/27 19:50:00 | 000,144,704 | —- | M] (McAfee, Inc.) [Auto | Paused] – C:\Program Files\McAfee\VirusScan Enterprise\mcshield.exe – (McShield)
SRV - [2009/01/27 19:50:00 | 000,054,608 | —- | M] (McAfee, Inc.) [Auto | Running] – C:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exe – (McTaskManager)
SRV - [2006/11/17 12:37:44 | 000,104,000 | —- | M] (McAfee, Inc.) [Auto | Running] – C:\Program Files\McAfee\Common Framework\FrameworkService.exe – (McAfeeFramework)
SRV - [2005/12/20 14:17:48 | 000,114,688 | —- | M] (TOSHIBA Corporation) [Auto | Running] – C:\WINDOWS\system32\TODDSrv.exe – (TODDSrv)
SRV - [2005/12/09 14:37:42 | 000,081,920 | —- | M] (Logitech Inc.) [Auto | Running] – c:\Program Files\Common Files\Logitech\LVMVFM\LVPrcSrv.exe – (LVPrcSrv)
SRV - [2005/09/26 10:22:28 | 000,036,864 | —- | M] () [Auto | Running] – C:\WINDOWS\system32\acs.exe – (ACS)
SRV - [2005/07/25 14:25:18 | 000,491,520 | —- | M] ( ) [On_Demand | Running] – C:\WINDOWS\System32\lxcfcoms.exe – (lxcf_device)
SRV - [2005/01/17 03:38:38 | 000,040,960 | —- | M] (TOSHIBA CORPORATION) [Auto | Running] – C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe – (CFSvcs)
SRV - [2004/08/27 11:33:00 | 000,110,592 | —- | M] (Matsushita Electric Industrial Co., Ltd.) [Auto | Running] – C:\WINDOWS\system32\DVDRAMSV.exe – (DVD-RAM_Service)
SRV - [2002/04/11 19:00:00 | 000,057,344 | —- | M] (brother Industries Ltd) [Auto | Running] – C:\WINDOWS\system32\brsvc01a.exe – (Brother XP spl Service)


========== Driver Services (SafeList) ==========

DRV - [2009/01/27 19:50:00 | 000,177,864 | —- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\mfehidk.sys – (mfehidk)
DRV - [2009/01/27 19:50:00 | 000,073,512 | —- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\mfeavfk.sys – (mfeavfk)
DRV - [2009/01/27 19:50:00 | 000,065,000 | —- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\mfeapfk.sys – (mfeapfk)
DRV - [2009/01/27 19:50:00 | 000,052,168 | —- | M] (McAfee, Inc.) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\mfetdik.sys – (mfetdik)
DRV - [2009/01/27 19:50:00 | 000,034,408 | —- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\mfebopk.sys – (mfebopk)
DRV - [2009/01/27 19:50:00 | 000,031,848 | —- | M] (McAfee, Inc.) [Kernel | System | Running] – C:\Program Files\McAfee\VirusScan Enterprise\mferkdk.sys – (mferkdk)
DRV - [2008/04/13 13:36:41 | 000,063,744 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\mf.sys – (mf)
DRV - [2008/04/13 11:36:05 | 000,144,384 | —- | M] (Windows ® Server 2003 DDK provider) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\hdaudbus.sys – (HDAudBus)
DRV - [2006/04/25 11:01:48 | 000,043,776 | —- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\Tvs.sys – (Tvs)
DRV - [2006/04/18 17:12:00 | 000,098,816 | —- | M] (TOSHIBA Corporation) [File_System | Auto | Running] – C:\WINDOWS\system32\drivers\tdudf.sys – (tdudf)
DRV - [2006/04/17 18:31:26 | 004,262,912 | —- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\RtkHDAud.Sys – (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2006/04/01 16:46:28 | 000,471,264 | —- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\ar5211.sys – (AR5211)
DRV - [2006/03/17 18:36:42 | 001,155,584 | —- | M] (Agere Systems) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\AGRSM.sys – (AgereSoftModem)
DRV - [2006/03/17 04:24:09 | 001,520,640 | —- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\ati2mtag.sys – (ati2mtag)
DRV - [2006/03/02 20:49:50 | 000,015,360 | —- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\tdcmdpst.sys – (tdcmdpst)
DRV - [2006/01/05 18:31:20 | 000,011,264 | —- | M] (TOSHIBA ) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\TPwSav.sys – (TPwSav)
DRV - [2005/12/09 14:37:42 | 002,400,256 | —- | M] () [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\LVMVdrv.sys – (lvmvdrv)
DRV - [2005/12/09 14:37:42 | 000,016,768 | —- | M] () [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\LVPrcMon.sys – (LVPrcMon)
DRV - [2005/12/09 14:35:54 | 002,174,464 | —- | M] () [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\Lvckap.sys – (Lvckap)
DRV - [2005/12/05 22:27:29 | 000,287,360 | R— | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\LV561AV.SYS – (PID_0928) Logitech QuickCam Express(PID_0928)
DRV - [2005/12/05 22:26:16 | 000,039,424 | R— | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\LVUSBSta.sys – (LVUSBSta)
DRV - [2005/06/01 14:33:00 | 000,102,384 | —- | M] (Matsushita Electric Industrial Co.,Ltd.) [File_System | System | Running] – C:\WINDOWS\system32\drivers\meiudf.sys – (meiudf)
DRV - [2004/11/15 03:22:08 | 000,101,874 | —- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\Apfiltr.sys – (ApfiltrService)
DRV - [2004/08/03 17:31:34 | 000,020,992 | —- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\RTL8139.sys – (rtl8139) Realtek RTL8139(A/B/C)
DRV - [2004/06/27 21:35:24 | 000,069,760 | —- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\Rtlnicxp.sys – (RTL8023xp)
DRV - [2003/09/19 03:47:00 | 000,010,368 | —- | M] (Padus, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\pfc.sys – (Pfc)
DRV - [2003/09/11 01:36:54 | 000,021,060 | —- | M] (InterVideo, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\iviaspi.sys – (Iviaspi)
DRV - [2003/01/29 01:35:00 | 000,012,032 | —- | M] (TOSHIBA Corporation.) [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\Netdevio.sys – (Netdevio)
DRV - [2002/01/24 16:43:40 | 000,006,528 | —- | M] () [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\Tbiosdrv.sys – (TBiosDrv)
DRV - [2001/08/17 12:12:22 | 000,010,368 | —- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\BrUsbScn.sys – (BrUsbScn)
DRV - [2001/08/17 12:12:20 | 000,060,416 | —- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\BrSerWdm.sys – (BrSerWDM)
DRV - [2001/08/17 12:12:20 | 000,011,008 | —- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\BrUsbMdm.sys – (BrUsbMdm)
DRV - [2001/08/17 12:12:12 | 000,002,944 | —- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\BrFilt.sys – (brfilt)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-1537700535-1587211706-558873121-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKU\S-1-5-21-1537700535-1587211706-558873121-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/
IE - HKU\S-1-5-21-1537700535-1587211706-558873121-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.sympatico.ca/"
FF - prefs.js..extensions.enabledItems: [removed]:3.6.7
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {7694c49c-9fbd-11dc-8314-0800200c9a66}:3.6.7

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/12/21 17:06:10 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/12/11 13:26:11 | 000,000,000 | —D | M]

[2008/08/28 14:05:44 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\default\Application Data\Mozilla\Extensions
[2011/01/13 23:33:26 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\default\Application Data\Mozilla\Firefox\Profiles\f4xp4pmk.default\extensions
[2010/05/27 14:26:35 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\default\Application Data\Mozilla\Firefox\Profiles\f4xp4pmk.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/12/12 15:05:40 | 000,000,000 | —D | M] (Aquatint Black) – C:\Documents and Settings\default\Application Data\Mozilla\Firefox\Profiles\f4xp4pmk.default\extensions\{7694c49c-9fbd-11dc-8314-0800200c9a66}
[2010/12/12 15:05:16 | 000,000,000 | —D | M] (Virtus Search Opt-in) – C:\Documents and Settings\default\Application Data\Mozilla\Firefox\Profiles\f4xp4pmk.default\extensions\[removed]
[2010/12/12 15:05:16 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\default\Application Data\Mozilla\Firefox\Profiles\f4xp4pmk.default\extensions\[removed]\chrome
[2010/12/12 15:05:16 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\default\Application Data\Mozilla\Firefox\Profiles\f4xp4pmk.default\extensions\[removed]\defaults
[2010/12/12 15:05:40 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\default\Application Data\Mozilla\Firefox\Profiles\f4xp4pmk.default\extensions\{7694c49c-9fbd-11dc-8314-0800200c9a66}\chrome\win\mozapps\extensions
[2011/01/13 23:33:26 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2010/11/11 02:19:42 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2010/11/11 02:19:12 | 000,000,000 | —D | M] (Java Quick Starter) – C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2010/11/11 02:19:11 | 000,472,808 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2008/12/07 22:33:47 | 000,151,552 | —- | M] (PopCap Games) – C:\Program Files\Mozilla Firefox\plugins\nppopcaploader.dll

O1 HOSTS File: ([2010/05/08 23:37:06 | 000,347,217 | R— | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 123topsearch.com
O1 - Hosts: 127.0.0.1 www.123topsearch.com
O1 - Hosts: 127.0.0.1 132.com
O1 - Hosts: 127.0.0.1 www.132.com
O1 - Hosts: 127.0.0.1 www.136136.net
O1 - Hosts: 127.0.0.1 136136.net
O1 - Hosts: 11906 more lines…
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan Enterprise\scriptcl.dll (McAfee, Inc.)
O3 - HKU\S-1-5-21-1537700535-1587211706-558873121-1006\..\Toolbar\WebBrowser: (no name) - {C4069E3A-68F1-403E-B40E-20066696354B} - No CLSID value found.
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [CeEKEY] C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe (COMPAL ELECTRONIC INC.)
O4 - HKLM..\Run: [CFSServ.exe] File not found
O4 - HKLM..\Run: [DDWMon] C:\Program Files\TOSHIBA\TOSHIBA Direct Disc Writer\ddwmon.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [HWSetup] C:\Program Files\TOSHIBA\TOSHIBA Applet\HWSetup.exe (TOSHIBA CO.,LTD.)
O4 - HKLM..\Run: [LogitechCameraAssistant] C:\Program Files\Logitech\Video\CameraAssistant.exe (Logitech Inc.)
O4 - HKLM..\Run: [LogitechCameraService(E)] C:\WINDOWS\System32\ElkCtrl.exe (Logitech Inc.)
O4 - HKLM..\Run: [LogitechVideo[inspector]] C:\Program Files\Logitech\Video\InstallHelper.exe (Logitech Inc.)
O4 - HKLM..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE (Logitech Inc.)
O4 - HKLM..\Run: [LXCFCATS] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCFtime.DLL ()
O4 - HKLM..\Run: [McAfeeUpdaterUI] C:\Program Files\McAfee\Common Framework\UdaterUI.exe (McAfee, Inc.)
O4 - HKLM..\Run: [NDSTray.exe] File not found
O4 - HKLM..\Run: [PadTouch] C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe (TOSHIBA)
O4 - HKLM..\Run: [ShStatEXE] C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE (McAfee, Inc.)
O4 - HKLM..\Run: [SmoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [SVPWUTIL] C:\Program Files\Toshiba\Windows Utilities\SVPWUTIL.exe (TOSHIBA)
O4 - HKLM..\Run: [TPNF] C:\Program Files\TOSHIBA\TouchPad\TPTray.exe (COMPAL ELECTRONIC INC.)
O4 - HKLM..\Run: [Tvs] C:\Program Files\Toshiba\Tvs\TvsTray.exe (TOSHIBA Corporation)
O4 - HKU\S-1-5-21-1537700535-1587211706-558873121-1006..\Run: [EA Core] C:\Program Files\Electronic Arts\EADM\Core.exe (Electronic Arts)
O4 - HKU\S-1-5-21-1537700535-1587211706-558873121-1006..\Run: [FRAGBIRD] File not found
O4 - HKU\S-1-5-21-1537700535-1587211706-558873121-1006..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe (TOSHIBA)
O4 - HKU\S-1-5-21-1537700535-1587211706-558873121-1006..\Run: [WeatherEye] C:\Documents and Settings\default\Local Settings\Application Data\TheWeatherNetwork\WeatherEye\WeatherEye.exe (Pelmorex Media Inc.)
O4 - HKU\S-1-5-21-1537700535-1587211706-558873121-1006..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\System32\Macromed\Flash\NPSWF32_FlashUtil.exe (Adobe Systems, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk = C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1537700535-1587211706-558873121-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O7 - HKU\S-1-5-21-1537700535-1587211706-558873121-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: _NoDriveTypeAutoRun = 145
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab (Checkers Class)
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} http://office.microsoft.com/officeupdate/content/opuc3.cab (Office Update Installation Engine)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab (MessengerStatsClient Class)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} http://messenger.zone.msn.com/binary/MineS…er.cab56986.cab (Minesweeper Flags Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 192.168.2.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O20 - Winlogon\Notify\WRNotifier: DllName - WRLogonNTF.dll - File not found
O24 - Desktop WallPaper: C:\Documents and Settings\default\My Documents\My Pictures\Backgrounds\glow.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\default\My Documents\My Pictures\Backgrounds\glow.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/05/03 13:51:28 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O33 - MountPoints2\{edc805f2-116d-11e0-8fd6-0016e35f30af}\Shell\Auto\command - "" = E:\launcher.exe
O33 - MountPoints2\{edc805f2-116d-11e0-8fd6-0016e35f30af}\Shell\AutoRun - "" = Auto&Play
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (38012732607299584)

========== Files/Folders - Created Within 30 Days ==========

[2011/01/14 17:08:00 | 000,602,112 | —- | C] (OldTimer Tools) – C:\Documents and Settings\default\Desktop\OTL.exe
[2011/01/12 08:18:03 | 000,000,000 | —D | C] – C:\WINDOWS\LastGood
[2006/09/05 21:32:35 | 001,134,592 | —- | C] ( ) – C:\WINDOWS\System32\lxcfusb1.dll
[2006/09/05 21:32:34 | 001,183,744 | —- | C] ( ) – C:\WINDOWS\System32\lxcfserv.dll
[2006/09/05 21:32:34 | 000,155,648 | —- | C] ( ) – C:\WINDOWS\System32\lxcfprox.dll
[2006/09/05 21:32:34 | 000,114,688 | —- | C] ( ) – C:\WINDOWS\System32\lxcfpplc.dll
[2006/09/05 21:32:33 | 000,413,696 | —- | C] ( ) – C:\WINDOWS\System32\lxcfcomm.dll
[2006/09/05 21:32:32 | 000,704,512 | —- | C] ( ) – C:\WINDOWS\System32\lxcfcomc.dll
[2006/09/05 21:32:32 | 000,483,328 | —- | C] ( ) – C:\WINDOWS\System32\lxcflmpm.dll
[6 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\Documents and Settings\default\My Documents\*.tmp files -> C:\Documents and Settings\default\My Documents\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/01/14 17:08:06 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Documents and Settings\default\Desktop\OTL.exe
[2011/01/14 17:00:13 | 000,000,270 | -H– | M] () – C:\WINDOWS\tasks\AC3F2B769184DE42.job
[2011/01/14 16:49:10 | 000,296,448 | —- | M] () – C:\Documents and Settings\default\Desktop\gmer.exe
[2011/01/13 23:22:58 | 000,008,903 | —- | M] () – C:\Documents and Settings\default\My Documents\hijack_this
[2011/01/12 08:38:08 | 000,002,206 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2011/01/12 08:16:19 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/01/12 08:16:16 | 501,329,920 | -HS- | M] () – C:\hiberfil.sys
[2011/01/10 19:30:01 | 000,002,497 | —- | M] () – C:\Documents and Settings\default\Desktop\Microsoft Word.lnk
[2011/01/08 13:31:03 | 000,002,137 | —- | M] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2010/12/24 13:36:51 | 000,470,668 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/12/24 13:36:51 | 000,084,808 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2010/12/24 13:33:54 | 116,129,792 | —- | M] () – C:\WINDOWS\MEMORY.DMP
[2010/12/21 01:14:17 | 000,023,432 | -H– | M] () – C:\WINDOWS\System32\mlfcache.dat
[2010/12/17 02:54:54 | 000,130,888 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2010/12/17 00:21:39 | 000,001,393 | —- | M] () – C:\WINDOWS\imsins.BAK
[6 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\Documents and Settings\default\My Documents\*.tmp files -> C:\Documents and Settings\default\My Documents\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/01/13 23:22:57 | 000,008,903 | —- | C] () – C:\Documents and Settings\default\My Documents\hijack_this
[2010/12/21 01:14:17 | 000,023,432 | -H– | C] () – C:\WINDOWS\System32\mlfcache.dat
[2009/11/13 11:39:37 | 000,000,036 | —- | C] () – C:\Documents and Settings\default\Local Settings\Application Data\housecall.guid.cache
[2009/01/20 19:40:37 | 000,001,025 | —- | C] () – C:\WINDOWS\System32\sysprs7.dll
[2009/01/20 19:40:37 | 000,000,205 | —- | C] () – C:\WINDOWS\System32\lsprst7.dll
[2008/12/03 00:27:40 | 000,000,000 | —- | C] () – C:\WINDOWS\ToDisc.INI
[2008/11/05 16:51:01 | 000,000,098 | —- | C] () – C:\WINDOWS\wininit.ini
[2008/03/02 11:39:15 | 000,000,097 | —- | C] () – C:\WINDOWS\System32\PICSDK.ini
[2008/01/09 12:49:25 | 000,000,000 | —- | C] () – C:\WINDOWS\pcf.INI
[2007/11/13 22:25:01 | 000,000,197 | —- | C] () – C:\WINDOWS\System32\MRT.INI
[2007/10/15 17:48:37 | 000,015,360 | —- | C] () – C:\Documents and Settings\default\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007/10/14 11:36:46 | 000,000,312 | —- | C] () – C:\Documents and Settings\All Users\Application Data\hpzinstall.log
[2007/09/11 13:44:36 | 000,000,280 | —- | C] () – C:\WINDOWS\System32\epoPGPsdk.dll.sig
[2007/01/05 09:38:08 | 000,001,359 | —- | C] () – C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2006/11/27 17:26:50 | 000,684,032 | —- | C] () – C:\WINDOWS\System32\libeay32.dll
[2006/11/27 17:26:49 | 000,155,648 | —- | C] () – C:\WINDOWS\System32\ssleay32.dll
[2006/10/09 20:02:03 | 000,000,425 | —- | C] () – C:\WINDOWS\BRWMARK.INI
[2006/10/09 20:02:03 | 000,000,030 | —- | C] () – C:\WINDOWS\System32\brss01a.ini
[2006/10/09 20:02:03 | 000,000,027 | —- | C] () – C:\WINDOWS\BRPP2KA.INI
[2006/10/09 20:01:21 | 000,000,713 | —- | C] () – C:\WINDOWS\BRMFBIDI.INI
[2006/09/09 12:24:52 | 000,013,126 | R— | C] () – C:\WINDOWS\System32\lvcoinst.ini
[2006/09/09 11:43:46 | 000,000,719 | R— | C] () – C:\WINDOWS\System32\InstExec.ini
[2006/09/09 11:38:30 | 000,000,051 | —- | C] () – C:\Documents and Settings\All Users\Application Data\Installer.log
[2006/09/05 21:32:35 | 000,040,960 | —- | C] () – C:\WINDOWS\System32\lxcfvs.dll
[2006/09/05 20:52:54 | 000,000,000 | —- | C] () – C:\WINDOWS\PCFriend.INI
[2006/09/05 18:16:49 | 000,000,000 | —- | C] () – C:\WINDOWS\iPlayer.INI
[2006/08/20 06:49:49 | 000,000,000 | —- | C] () – C:\WINDOWS\TPTray.INI
[2006/08/20 06:49:49 | 000,000,000 | —- | C] () – C:\WINDOWS\CeEKey.INI
[2006/08/20 05:55:44 | 000,128,113 | —- | C] () – C:\WINDOWS\System32\csellang.ini
[2006/08/20 05:55:44 | 000,045,056 | —- | C] () – C:\WINDOWS\System32\csellang.dll
[2006/08/20 05:55:44 | 000,010,165 | —- | C] () – C:\WINDOWS\System32\tosmreg.ini
[2006/08/20 05:55:44 | 000,007,671 | —- | C] () – C:\WINDOWS\System32\cseltbl.ini
[2006/08/20 05:55:19 | 000,006,528 | —- | C] () – C:\WINDOWS\System32\drivers\Tbiosdrv.sys
[2006/05/04 21:33:04 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2006/05/03 16:13:51 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2006/05/03 16:09:22 | 000,000,000 | —- | C] () – C:\WINDOWS\NDSTray.INI
[2006/05/03 16:07:00 | 000,036,736 | —- | C] () – C:\WINDOWS\System32\drivers\CSIIDecoder_kern_i386.sys
[2006/05/03 16:07:00 | 000,029,184 | —- | C] () – C:\WINDOWS\System32\drivers\TSXT_kern_i386.sys
[2006/05/03 16:04:16 | 000,204,800 | —- | C] () – C:\WINDOWS\System32\IVIresizeW7.dll
[2006/05/03 16:04:16 | 000,200,704 | —- | C] () – C:\WINDOWS\System32\IVIresizeA6.dll
[2006/05/03 16:04:16 | 000,192,512 | —- | C] () – C:\WINDOWS\System32\IVIresizeP6.dll
[2006/05/03 16:04:16 | 000,192,512 | —- | C] () – C:\WINDOWS\System32\IVIresizeM6.dll
[2006/05/03 16:04:16 | 000,188,416 | —- | C] () – C:\WINDOWS\System32\IVIresizePX.dll
[2006/05/03 16:04:16 | 000,020,480 | —- | C] () – C:\WINDOWS\System32\IVIresize.dll
[2006/05/03 15:58:30 | 000,032,768 | —- | C] () – C:\WINDOWS\System32\EBLib.DLL
[2006/05/03 15:55:22 | 000,135,168 | —- | C] () – C:\WINDOWS\System32\RtlCPAPI.dll
[2006/05/03 13:54:56 | 000,000,780 | —- | C] () – C:\WINDOWS\orun32.ini
[2006/05/03 13:32:48 | 000,002,392 | —- | C] () – C:\WINDOWS\System32\oeminfo.ini
[2006/05/03 13:32:41 | 000,755,200 | —- | C] () – C:\WINDOWS\System32\ir50_32.dll
[2006/05/03 13:32:41 | 000,338,432 | —- | C] () – C:\WINDOWS\System32\ir41_qcx.dll
[2006/05/03 13:32:41 | 000,200,192 | —- | C] () – C:\WINDOWS\System32\ir50_qc.dll
[2006/05/03 13:32:41 | 000,183,808 | —- | C] () – C:\WINDOWS\System32\ir50_qcx.dll
[2006/05/03 13:32:41 | 000,120,320 | —- | C] () – C:\WINDOWS\System32\ir41_qc.dll
[2006/05/03 06:44:12 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2006/01/05 20:49:34 | 000,036,864 | —- | C] () – C:\WINDOWS\System32\HWS_Ctrl.dll
[2006/01/05 19:36:22 | 000,024,576 | —- | C] () – C:\WINDOWS\System32\EKECioCtl.dll
[2005/12/09 16:36:30 | 000,028,672 | —- | C] () – C:\WINDOWS\System32\TPeculiarity.dll
[2005/12/09 14:37:42 | 002,400,256 | —- | C] () – C:\WINDOWS\System32\drivers\LVMVdrv.sys
[2005/12/09 14:37:42 | 000,016,768 | —- | C] () – C:\WINDOWS\System32\drivers\LVPrcMon.sys
[2005/12/09 14:35:54 | 002,174,464 | —- | C] () – C:\WINDOWS\System32\drivers\Lvckap.sys
[2005/11/23 15:55:42 | 000,024,576 | —- | C] () – C:\WINDOWS\System32\SPCtl.dll
[2003/01/07 14:05:08 | 000,002,695 | —- | C] () – C:\WINDOWS\System32\OUTLPERF.INI
[1999/01/27 12:39:06 | 000,065,024 | —- | C] () – C:\WINDOWS\System32\indounin.dll
[1998/10/10 23:07:38 | 000,088,576 | —- | C] () – C:\WINDOWS\System32\Iticheck.dll
[1997/06/13 06:56:08 | 000,056,832 | —- | C] () – C:\WINDOWS\System32\Iyvu9_32.dll

========== LOP Check ==========

[2006/05/03 16:06:00 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\toshiba
[2009/02/05 18:35:21 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Admin Inter 1 Mags
[2010/05/10 03:00:49 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Electronic Arts
[2006/09/15 16:21:48 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PopCap
[2010/05/08 22:48:27 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\RegCure
[2009/01/20 19:47:49 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SafeNet Sentinel
[2010/11/02 11:41:22 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2009/09/27 20:25:53 | 000,000,000 | —D | M] – C:\Documents and Settings\default\Application Data\army01
[2007/09/10 12:25:08 | 000,000,000 | —D | M] – C:\Documents and Settings\default\Application Data\CiscoCAA
[2009/09/14 14:25:55 | 000,000,000 | —D | M] – C:\Documents and Settings\default\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2008/11/23 23:29:36 | 000,000,000 | —D | M] – C:\Documents and Settings\default\Application Data\Image Zone Express
[2006/09/22 21:09:35 | 000,000,000 | —D | M] – C:\Documents and Settings\default\Application Data\InterVideo
[2007/11/04 13:36:37 | 000,000,000 | —D | M] – C:\Documents and Settings\default\Application Data\LimeWire
[2008/03/02 11:39:50 | 000,000,000 | —D | M] – C:\Documents and Settings\default\Application Data\Panasonic
[2006/09/10 14:53:22 | 000,000,000 | —D | M] – C:\Documents and Settings\default\Application Data\toshiba
[2010/12/28 01:31:02 | 000,000,000 | —D | M] – C:\Documents and Settings\default\Application Data\uTorrent
[2006/05/03 16:06:00 | 000,000,000 | —D | M] – C:\Documents and Settings\Default User\Application Data\toshiba
[2009/01/29 11:44:24 | 000,000,000 | —D | M] – C:\Documents and Settings\Guest\Application Data\CiscoCAA
[2006/05/03 16:06:00 | 000,000,000 | —D | M] – C:\Documents and Settings\Guest\Application Data\toshiba
[2011/01/14 17:00:13 | 000,000,270 | -H– | M] () – C:\WINDOWS\Tasks\AC3F2B769184DE42.job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.exe >


< MD5 for: EXPLORER.EXE >
[2008/04/13 19:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 – C:\WINDOWS\explorer.exe
[2008/04/13 19:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 – C:\WINDOWS\ServicePackFiles\i386\explorer.exe
[2007/06/13 06:26:03 | 001,033,216 | —- | M] (Microsoft Corporation) MD5=7712DF0CDDE3A5AC89843E61CD5B3658 – C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
[2007/06/13 05:23:07 | 001,033,216 | —- | M] (Microsoft Corporation) MD5=97BD6515465659FF8F3B7BE375B2EA87 – C:\WINDOWS\$NtServicePackUninstall$\explorer.exe
[2004/08/04 07:00:00 | 001,032,192 | —- | M] (Microsoft Corporation) MD5=A0732187050030AE399B241436565E64 – C:\WINDOWS\$NtUninstallKB938828$\explorer.exe

< MD5 for: SVCHOST.EXE >
[2008/04/13 19:12:36 | 000,014,336 | —- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 – C:\WINDOWS\ServicePackFiles\i386\svchost.exe
[2008/04/13 19:12:36 | 000,014,336 | —- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 – C:\WINDOWS\system32\svchost.exe
[2004/08/04 07:00:00 | 000,014,336 | —- | M] (Microsoft Corporation) MD5=8F078AE4ED187AAABC0A305146DE6716 – C:\WINDOWS\$NtServicePackUninstall$\svchost.exe

< MD5 for: USERINIT.EXE >
[2004/08/04 07:00:00 | 000,024,576 | —- | M] (Microsoft Corporation) MD5=39B1FFB03C2296323832ACBAE50D2AFF – C:\WINDOWS\$NtServicePackUninstall$\userinit.exe
[2008/04/13 19:12:38 | 000,026,112 | —- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 – C:\WINDOWS\ServicePackFiles\i386\userinit.exe
[2008/04/13 19:12:38 | 000,026,112 | —- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 – C:\WINDOWS\system32\userinit.exe

< MD5 for: WINLOGON.EXE >
[2004/08/04 07:00:00 | 000,502,272 | —- | M] (Microsoft Corporation) MD5=01C3346C241652F43AED8E2149881BFE – C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
[2008/04/13 19:12:39 | 000,507,904 | —- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E – C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
[2008/04/13 19:12:39 | 000,507,904 | —- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E – C:\WINDOWS\system32\winlogon.exe

< %systemroot%\*. /mp /s >

< c:\system volume information|_REGISTRY_MACHINE_SOFTWARE;true;true;true /FP >
[2010/10/09 09:16:57 | 034,762,752 | —- | M] () – c:\System Volume Information\_restore{065E2FD8-25CB-4416-BD5C-AC5CC2C7C7A9}\RP800\snapshot\_REGISTRY_MACHINE_SOFTWARE
[2010/10/11 17:43:05 | 034,775,040 | —- | M] () – c:\System Volume Information\_restore{065E2FD8-25CB-4416-BD5C-AC5CC2C7C7A9}\RP801\snapshot\_REGISTRY_MACHINE_SOFTWARE
[2010/10/13 09:09:51 | 034,775,040 | —- | M] () – c:\System Volume Information\_restore{065E2FD8-25CB-4416-BD5C-AC5CC2C7C7A9}\RP802\snapshot\_REGISTRY_MACHINE_SOFTWARE
[2010/10/14 06:32:39 | 034,775,040 | —- | M] () – c:\System Volume Information\_restore{065E2FD8-25CB-4416-BD5C-AC5CC2C7C7A9}\RP803\snapshot\_REGISTRY_MACHINE_SOFTWARE
[2010/10/21 21:07:31 | 034,775,040 | —- | M] () – c:\System Volume Information\_restore{065E2FD8-25CB-4416-BD5C-AC5CC2C7C7A9}\RP804\snapshot\_REGISTRY_MACHINE_SOFTWARE
[2010/10/24 10:30:20 | 034,775,040 | —- | M] () – c:\System Volume Information\_restore{065E2FD8-25CB-4416-BD5C-AC5CC2C7C7A9}\RP805\snapshot\_REGISTRY_MACHINE_SOFTWARE
[2010/10/26 06:20:10 | 034,775,040 | —- | M] () – c:\System Volume Information\_restore{065E2FD8-25CB-4416-BD5C-AC5CC2C7C7A9}\RP806\snapshot\_REGISTRY_MACHINE_SOFTWARE
[2010/10/29 12:43:55 | 034,775,040 | —- | M] () – c:\System Volume Information\_restore{065E2FD8-25CB-4416-BD5C-AC5CC2C7C7A9}\RP807\snapshot\_REGISTRY_MACHINE_SOFTWARE
[2010/10/31 12:29:24 | 034,775,040 | —- | M] () – c:\System Volume Information\_restore{065E2FD8-25CB-4416-BD5C-AC5CC2C7C7A9}\RP808\snapshot\_REGISTRY_MACHINE_SOFTWARE
[2010/11/02 06:30:37 | 034,775,040 | —- | M] () – c:\System Volume Information\_restore{065E2FD8-25CB-4416-BD5C-AC5CC2C7C7A9}\RP809\snapshot\_REGISTRY_MACHINE_SOFTWARE
[2010/11/02 11:37:54 | 035,184,640 | —- | M] () – c:\System Volume Information\_restore{065E2FD8-25CB-4416-BD5C-AC5CC2C7C7A9}\RP810\snapshot\_REGISTRY_MACHINE_SOFTWARE
[2010/11/04 15:04:47 | 035,319,808 | —- | M] () – c:\System Volume Information\_restore{065E2FD8-25CB-4416-BD5C-AC5CC2C7C7A9}\RP811\snapshot\_REGISTRY_MACHINE_SOFTWARE
[2010/11/05 22:57:53 | 035,319,808 | —- | M] () – c:\System Volume Information\_restore{065E2FD8-25CB-4416-BD5C-AC5CC2C7C7A9}\RP812\snapshot\_REGISTRY_MACHINE_SOFTWARE
[2010/11/09 07:50:49 | 035,319,808 | —- | M] () – c:\System Volume Information\_restore{065E2FD8-25CB-4416-BD5C-AC5CC2C7C7A9}\RP813\snapshot\_REGISTRY_MACHINE_SOFTWARE
[2010/11/10 15:35:28 | 035,319,808 | —- | M] () – c:\System Volume Information\_restore{065E2FD8-25CB-4416-BD5C-AC5CC2C7C7A9}\RP814\snapshot\_REGISTRY_MACHINE_SOFTWARE
[2010/11/11 02:18:49 | 035,319,808 | —- | M] () – c:\System Volume Information\_restore{065E2FD8-25CB-4416-BD5C-AC5CC2C7C7A9}\RP815\snapshot\_REGISTRY_MACHINE_SOFTWARE
[2010/11/11 03:01:28 | 035,340,288 | —- | M] () – c:\System Volume Information\_restore{065E2FD8-25CB-4416-BD5C-AC5CC2C7C7A9}\RP816\snapshot\_REGISTRY_MACHINE_SOFTWARE
[2010/11/12 13:54:28 | 035,344,384 | —- | M] () – c:\System Volume Information\_restore{065E2FD8-25CB-4416-BD5C-AC5CC2C7C7A9}\RP817\snapshot\_REGISTRY_MACHINE_SOFTWARE
[2010/11/17 11:05:05 | 035,348,480 | —- | M] () – c:\System Volume Information\_restore{065E2FD8-25CB-4416-BD5C-AC5CC2C7C7A9}\RP818\snapshot\_REGISTRY_MACHINE_SOFTWARE
[2010/11/19 13:26:20 | 035,348,480 | —- | M] () – c:\System Volume Information\_restore{065E2FD8-25CB-4416-BD5C-AC5CC2C7C7A9}\RP819\snapshot\_REGISTRY_MACHINE_SOFTWARE
[2010/11/20 14:15:38 | 035,348,480 | —- | M] () – c:\System Volume Information\_restore{065E2FD8-25CB-4416-BD5C-AC5CC2C7C7A9}\RP820\snapshot\_REGISTRY_MACHINE_SOFTWARE
[2010/11/21 17:23:34 | 035,348,480 | —- | M] () – c:\System Volume Information\_restore{065E2FD8-25CB-4416-BD5C-AC5CC2C7C7A9}\RP821\snapshot\_REGISTRY_MACHINE_SOFTWARE
[2010/11/23 11:39:57 | 035,348,480 | —- | M] () – c:\System Volume Information\_restore{065E2FD8-25CB-4416-BD5C-AC5CC2C7C7A9}\RP822\snapshot\_REGISTRY_MACHINE_SOFTWARE
[2010/11/25 16:19:00 | 035,348,480 | —- | M] () – c:\System Volume Information\_restore{065E2FD8-25CB-4416-BD5C-AC5CC2C7C7A9}\RP823\snapshot\_REGISTRY_MACHINE_SOFTWARE
[2010/11/27 10:32:55 | 035,348,480 | —- | M] () – c:\System Volume Information\_restore{065E2FD8-25CB-4416-BD5C-AC5CC2C7C7A9}\RP824\snapshot\_REGISTRY_MACHINE_SOFTWARE
[2010/11/28 18:34:30 | 035,348,480 | —- | M] () – c:\System Volume Information\_restore{065E2FD8-25CB-4416-BD5C-AC5CC2C7C7A9}\RP825\snapshot\_REGISTRY_MACHINE_SOFTWARE
[2010/12/02 02:44:18 | 035,348,480 | —- | M] () – c:\System Volume Information\_restore{065E2FD8-25CB-4416-BD5C-AC5CC2C7C7A9}\RP826\snapshot\_REGISTRY_MACHINE_SOFTWARE
[2010/12/04 00:12:24 | 035,348,480 | —- | M] () – c:\System Volume Information\_restore{065E2FD8-25CB-4416-BD5C-AC5CC2C7C7A9}\RP827\snapshot\_REGISTRY_MACHINE_SOFTWARE
[2010/12/05 16:43:32 | 035,348,480 | —- | M] () – c:\System Volume Information\_restore{065E2FD8-25CB-4416-BD5C-AC5CC2C7C7A9}\RP828\snapshot\_REGISTRY_MACHINE_SOFTWARE
[2010/12/07 16:25:35 | 035,348,480 | —- | M] () – c:\System Volume Information\_restore{065E2FD8-25CB-4416-BD5C-AC5CC2C7C7A9}\RP829\snapshot\_REGISTRY_MACHINE_SOFTWARE
[2010/12/09 14:51:48 | 035,348,480 | —- | M] () – c:\System Volume Information\_restore{065E2FD8-25CB-4416-BD5C-AC5CC2C7C7A9}\RP830\snapshot\_REGISTRY_MACHINE_SOFTWARE
[2010/12/14 08:08:42 | 035,348,480 | —- | M] () – c:\System Volume Information\_restore{065E2FD8-25CB-4416-BD5C-AC5CC2C7C7A9}\RP831\snapshot\_REGISTRY_MACHINE_SOFTWARE
[2010/12/16 07:24:22 | 035,381,248 | —- | M] () – c:\System Volume Information\_restore{065E2FD8-25CB-4416-BD5C-AC5CC2C7C7A9}\RP832\snapshot\_REGISTRY_MACHINE_SOFTWARE
[2010/12/17 15:10:22 | 035,487,744 | —- | M] () – c:\System Volume Information\_restore{065E2FD8-25CB-4416-BD5C-AC5CC2C7C7A9}\RP833\snapshot\_REGISTRY_MACHINE_SOFTWARE
[2010/12/18 17:03:25 | 035,487,744 | —- | M] () – c:\System Volume Information\_restore{065E2FD8-25CB-4416-BD5C-AC5CC2C7C7A9}\RP834\snapshot\_REGISTRY_MACHINE_SOFTWARE
[2010/12/23 04:20:39 | 035,627,008 | —- | M] () – c:\System Volume Information\_restore{065E2FD8-25CB-4416-BD5C-AC5CC2C7C7A9}\RP835\snapshot\_REGISTRY_MACHINE_SOFTWARE
[2010/12/24 04:39:58 | 035,627,008 | —- | M] () – c:\System Volume Information\_restore{065E2FD8-25CB-4416-BD5C-AC5CC2C7C7A9}\RP836\snapshot\_REGISTRY_MACHINE_SOFTWARE
[2010/12/27 00:22:16 | 035,627,008 | —- | M] () – c:\System Volume Information\_restore{065E2FD8-25CB-4416-BD5C-AC5CC2C7C7A9}\RP837\snapshot\_REGISTRY_MACHINE_SOFTWARE
[2010/12/30 00:12:28 | 035,627,008 | —- | M] () – c:\System Volume Information\_restore{065E2FD8-25CB-4416-BD5C-AC5CC2C7C7A9}\RP838\snapshot\_REGISTRY_MACHINE_SOFTWARE
[2010/12/31 13:32:59 | 035,627,008 | —- | M] () – c:\System Volume Information\_restore{065E2FD8-25CB-4416-BD5C-AC5CC2C7C7A9}\RP839\snapshot\_REGISTRY_MACHINE_SOFTWARE
[2011/01/02 14:25:21 | 035,627,008 | —- | M] () – c:\System Volume Information\_restore{065E2FD8-25CB-4416-BD5C-AC5CC2C7C7A9}\RP840\snapshot\_REGISTRY_MACHINE_SOFTWARE
[2011/01/05 14:09:29 | 035,627,008 | —- | M] () – c:\System Volume Information\_restore{065E2FD8-25CB-4416-BD5C-AC5CC2C7C7A9}\RP841\snapshot\_REGISTRY_MACHINE_SOFTWARE
[2011/01/08 14:49:42 | 035,627,008 | —- | M] () – c:\System Volume Information\_restore{065E2FD8-25CB-4416-BD5C-AC5CC2C7C7A9}\RP842\snapshot\_REGISTRY_MACHINE_SOFTWARE
[2011/01/10 22:45:14 | 035,627,008 | —- | M] () – c:\System Volume Information\_restore{065E2FD8-25CB-4416-BD5C-AC5CC2C7C7A9}\RP843\snapshot\_REGISTRY_MACHINE_SOFTWARE
[2011/01/12 08:32:43 | 035,627,008 | —- | M] () – c:\System Volume Information\_restore{065E2FD8-25CB-4416-BD5C-AC5CC2C7C7A9}\RP844\snapshot\_REGISTRY_MACHINE_SOFTWARE
[2011/01/13 12:08:23 | 035,627,008 | —- | M] () – c:\System Volume Information\_restore{065E2FD8-25CB-4416-BD5C-AC5CC2C7C7A9}\RP845\snapshot\_REGISTRY_MACHINE_SOFTWARE
[2011/01/14 17:11:33 | 035,639,296 | —- | M] () – c:\System Volume Information\_restore{065E2FD8-25CB-4416-BD5C-AC5CC2C7C7A9}\RP846\snapshot\_REGISTRY_MACHINE_SOFTWARE

< End of report >

Extras.txt
OTL Extras logfile created on: 14/01/2011 5:08:57 PM - Run 1
OTL by OldTimer - Version 3.2.20.2 Folder = C:\Documents and Settings\default\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 00001009 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy

478.00 Mb Total Physical Memory | 116.00 Mb Available Physical Memory | 24.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 63.00% Paging File free
Paging file location(s): C:\pagefile.sys 672 1344 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 55.89 Gb Total Space | 18.94 Gb Free Space | 33.88% Space Free | Partition Type: NTFS

Computer Name: YOUR-2B7C71599F | User Name: default | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]

[HKEY_USERS\S-1-5-21-1537700535-1587211706-558873121-1006\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusOverride" = 0
"FirewallOverride" = 0
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Risk\RISKII.EXE" = C:\Program Files\Risk\RISKII.EXE:*:Disabled:Risk II
"C:\Program Files\uTorrent\uTorrent.exe" = C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent – (BitTorrent, Inc.)
"C:\WINDOWS\system32\drivers\svchost.exe" = C:\WINDOWS\system32\drivers\svchost.exe:*:Disabled:svchost
"C:\Program Files\SPSSInc\SPSS16\spss.exe" = C:\Program Files\SPSSInc\SPSS16\spss.exe:*:Disabled:SPSS 16.0 for Windows (1033:exe)
"C:\Program Files\SPSSInc\SPSS16\spss.com" = C:\Program Files\SPSSInc\SPSS16\spss.com:*:Disabled:SPSS 16.0 for Windows (1033:com)
"C:\Program Files\SPSSInc\SPSS16\SPSSWinWrapIDE.exe" = C:\Program Files\SPSSInc\SPSS16\SPSSWinWrapIDE.exe:*:Disabled:SPSS Basic Script Editor (1033)
"C:\Program Files\QuickTime\QuickTimePlayer.exe" = C:\Program Files\QuickTime\QuickTimePlayer.exe:*:Disabled:QuickTime Player – (Apple Inc.)
"C:\Program Files\DC++\DCPlusPlus.exe" = C:\Program Files\DC++\DCPlusPlus.exe:*:Disabled:DC++
"C:\Program Files\Electronic Arts\EADM\Core.exe" = C:\Program Files\Electronic Arts\EADM\Core.exe:*:Disabled:EA Download Manager – (Electronic Arts)
"C:\Program Files\McAfee\Common Framework\FrameworkService.exe" = C:\Program Files\McAfee\Common Framework\FrameworkService.exe:*:Disabled:McAfee Framework Service – (McAfee, Inc.)
"C:\Program Files\PrinterOn Corporation\PrintWhere 3.5\pwcCEX.exe" = C:\Program Files\PrinterOn Corporation\PrintWhere 3.5\pwcCEX.exe:*:Disabled:pwcCEX.exe
"C:\Program Files\PrinterOn Corporation\PrintWhere 3.5\pwcDDE.exe" = C:\Program Files\PrinterOn Corporation\PrintWhere 3.5\pwcDDE.exe:*:Disabled:pwcDDE.exe
"C:\Program Files\PrinterOn Corporation\PrintWhere 3.5\pwcPost.exe" = C:\Program Files\PrinterOn Corporation\PrintWhere 3.5\pwcPost.exe:*:Disabled:pwcPost.exe
"C:\Program Files\PrinterOn Corporation\PrintWhere 3.5\pwcPrinterSelect.exe" = C:\Program Files\PrinterOn Corporation\PrintWhere 3.5\pwcPrinterSelect.exe:*:Disabled:pwcPrinterSelect.exe
"C:\Program Files\PrinterOn Corporation\PrintWhere 3.5\pwcRoute.exe" = C:\Program Files\PrinterOn Corporation\PrintWhere 3.5\pwcRoute.exe:*:Disabled:pwcRoute.exe
"C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" = C:\Program Files\Veoh Networks\Veoh\VeohClient.exe:*:Disabled:Veoh Client
"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes – (Apple Inc.)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{008D69EB-70FF-46AB-9C75-924620DF191A}" = TOSHIBA Speech System SR Engine(U.S.) Version1.0
"{02EED746-8C5A-43C8-BB3D-D29C8B363A4D}" = TOSHIBA Zooming Utility
"{05832D65-6EDB-4D32-BA78-BCD0E2B91C02}" = Atheros Wireless LAN MiniPCI/PCIe card Driver
"{0BEDBD4E-2D34-47B5-9973-57E62B29307C}" = ATI Control Panel
"{0BF5FBE7-3907-4A1F-9E48-8B66E52850D6}" = TrayApp
"{12688FD7-CB92-4A5B-BEE4-5C8E0574434F}" = Utility Common Driver
"{12B3A009-A080-4619-9A2A-C6DB151D8D67}" = TOSHIBA Assist
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{19FDB8E4-59AD-4330-9667-E8DCAF018DD3}" = Unload
"{1E04F83B-2AB9-4301-9EF7-E86307F79C72}" = Google Earth
"{1E1F1E70-14D8-4380-8652-BD1A895A7D65}" = Status
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{24BEBF2E-73F3-4599-840B-EDC612CCDD0D}" = Destinations
"{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java™ 6 Update 22
"{287ECFA4-719A-2143-A09B-D6A12DE54E40}" = Acrobat.com
"{2CE5A2E7-3437-4CE7-BCF4-85ED6EEFF9E4}" = iTunes
"{2FCE4FC5-6930-40E7-A4F1-F862207424EF}" = InterVideo WinDVD Creator 2
"{3248F0A8-6813-11D6-A77B-00B0D0150060}" = J2SE Runtime Environment 5.0 Update 6
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{35C03C04-3F1F-42C2-A989-A757EE691F65}" = McAfee VirusScan Enterprise
"{3A57482F-BEBC-47E4-ADA1-6302403C7E50}" = TOSHIBA Accessibility
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{3FBF6F99-8EC6-41B4-8527-0A32241B5496}" = TOSHIBA Speech System TTS Engine(U.S.) Version1.0
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{400830CA-F056-4BBE-80A3-9DF9CA4FB889}" = TOSHIBA Direct Disc Writer
"{4041C245-7099-4C96-9738-5EBC23827B3C}" = BufferChm
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4BE53DB2-C1F2-44D1-A9AB-1630BA7F2AF1}" = SolutionCenter
"{51B4E156-14A5-4904-9AE4-B1AA2A0E46BE}" = TOSHIBA Supervisor Password
"{5279374D-87FE-4879-9385-F17278EBB9D3}" = TOSHIBA Hardware Setup
"{529DDE6B-4F31-438B-B218-F36266ABD8C0}" = TOSHIBA Disc Creator
"{5D96E2B1-D9AC-46E0-9073-425C5F63E338}" = Touch and Launch
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder
"{71D658CF-4E0D-4DA8-AA67-8C0B6F1C01FE}" = Atheros Client Utility
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{729DF902-05F9-4C00-9E6D-411119824E5F}" = hpiCamDrvQFolder
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7900D3A6-A9E8-4954-ACCB-AB15867978BF}" = TOSHIBA Hotkey Utility
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{80977342-27E8-4FF7-8B6A-D8D89461DA7F}" = TouchPad On/Off Utility
"{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}" = Windows Live Essentials
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{8B12BA86-ADAC-4BA6-B441-FFC591087252}" = TOSHIBA Virtual Sound
"{91120409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Standard Edition 2003
"{91810AFC-A4F8-4EBA-A5AA-B198BBC81144}" = InterVideo WinDVD for TOSHIBA
"{91A10409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office OneNote 2003
"{9422C8EA-B0C6-4197-B8FC-DC797658CA00}" = Windows Live Sign-in Assistant
"{94FB906A-CF42-4128-A509-D353026A607E}" = REALTEK Gigabit and Fast Ethernet NIC Driver
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9A00D1BA-D03A-44E5-AF28-86A1F377DF61}" = The Sims Makin' Magic
"{9A9DBEBC-C800-4776-A970-D76D6AA405B1}" = PHOTOfunSTUDIO -viewer-
"{9D765FA6-F2BC-40AF-8145-50808F9BDF4E}" = DVD-RAM Driver
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = ALPS Touch Pad Driver
"{9FE35071-CAB2-4E79-93E7-BFC6A2DC5C5D}" = CD/DVD Drive Acoustic Silencer
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A38D57D1-5F29-4691-B3DD-FE4B3A7B3AFE}" = TOSHIBA Power Saver
"{A85FD55B-891B-4314-97A5-EA96C0BD80B5}" = Windows Live Messenger
"{A96E97134CA649888820BCDE5E300BBD}" = H.264 Decoder
"{AAC389499AEF40428987B3D30CFC76C9}" = MKV Splitter
"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
"{AC76BA86-7AD7-1033-7B44-A93000000001}" = Adobe Reader 9.3.3
"{AEF9DC35ADDF4825B049ACBFD1C6EB37}" = AAC Decoder
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Plus Web Player
"{BDD83DC9-BEE9-4654-A5DA-CC46C250088D}" = TOSHIBA ConfigFree
"{BE009302-8937-402f-A6CE-8DDC1C20A480}" = CameraUserGuides
"{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}" = The Sims™ 3
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C191BE7C-8542-4A61-973A-714EF76C5995}" = Logitech QuickCam Software
"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
"{C9849786-7F71-41af-BF85-E0C25DE3D263}" = CameraDrivers
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CCA1EEA3-555E-4D05-AC46-4B49C6C5D887}" = Apple Mobile Device Support
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D7CAE58E-26DE-49B7-A75D-EAEDF76726BE}" = HP Photosmart Essential
"{DAEAFD68-BB4A-4507-A241-C8804D2EA66D}" = Apple Application Support
"{DEBB2986-15B0-4D28-95FA-5C966A396589}" = HPProductAssistant
"{E13AF122-FEB8-4d7b-8C66-C11F805539B1}" = HP Photosmart Cameras 6.0
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{E7004147-2CCA-431C-AA05-2AB166B9785D}" = QuickTime
"{EC2715CE-C182-483C-84CC-81D7D914CF14}" = WebReg
"{ECFDD6BD-E0C0-41CC-A171-E6D6AF4C0E93}" = HP Software Update
"{EE033C1F-443E-41EC-A0E2-559B539A4E4D}" = TOSHIBA Speech System Applications
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call
"{FF1C31AE-0CDC-40CE-AB85-406F8B70D643}" = Bonjour
"AC3Filter" = AC3Filter (remove only)
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11
"All ATI Software" = ATI - Software Uninstall Utility
"ATI Display Driver" = ATI Display Driver
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"EADM" = EA Download Manager
"Fn-esse" = TOSHIBA Fn-esse
"HijackThis" = HijackThis 2.0.2
"HP Imaging Device Functions" = HP Imaging Device Functions 6.0
"HP Solution Center & Imaging Support Tools" = HP Solution Center and Imaging Support Tools 6.0
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"InstallShield_{02EED746-8C5A-43C8-BB3D-D29C8B363A4D}" = TOSHIBA Zooming Utility
"InstallShield_{3A57482F-BEBC-47E4-ADA1-6302403C7E50}" = TOSHIBA Accessibility
"InstallShield_{51B4E156-14A5-4904-9AE4-B1AA2A0E46BE}" = TOSHIBA Supervisor Password
"InstallShield_{5279374D-87FE-4879-9385-F17278EBB9D3}" = TOSHIBA Hardware Setup
"InstallShield_{7900D3A6-A9E8-4954-ACCB-AB15867978BF}" = TOSHIBA Hotkey Utility
"InstallShield_{80977342-27E8-4FF7-8B6A-D8D89461DA7F}" = TouchPad On/Off Utility
"InstallShield_{A38D57D1-5F29-4691-B3DD-FE4B3A7B3AFE}" = TOSHIBA Power Saver
"InterActual Player" = InterActual Player
"Lexmark 730 Series" = Lexmark 730 Series
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"McAfee Anti-Spyware Enterprise Module" = McAfee AntiSpyware Enterprise Module
"McAfee Security Scan" = McAfee Security Scan Plus
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.6.13)" = Mozilla Firefox (3.6.13)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"MSNINST" = MSN
"Network Play System (Patching)" = Network Play System (Patching)
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"PC Diagnostic Tool" = TOSHIBA PC Diagnostic Tool
"PCFriendly" = PCFriendly
"PopCap Browser Plugin" = PopCap Browser Plugin
"QcDrv" = Logitech® Camera Driver
"TOSHIBA Software Modem" = TOSHIBA Software Modem
"Toshiba Tbiosdrv Driver" = Toshiba Tbiosdrv Driver
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinLiveSuite_Wave3" = Windows Live Essentials
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-1537700535-1587211706-558873121-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"uTorrent" = µTorrent
"way vc info" = CiD Help
"WeatherEye" = WeatherEye

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 13/01/2011 12:13:53 AM | Computer Name = YOUR-2B7C71599F | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 13/01/2011 12:13:53 AM | Computer Name = YOUR-2B7C71599F | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 33828

Error - 13/01/2011 12:13:53 AM | Computer Name = YOUR-2B7C71599F | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 33828

Error - 13/01/2011 12:13:54 AM | Computer Name = YOUR-2B7C71599F | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 13/01/2011 12:13:54 AM | Computer Name = YOUR-2B7C71599F | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 35781

Error - 13/01/2011 12:13:54 AM | Computer Name = YOUR-2B7C71599F | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 35781

Error - 13/01/2011 12:13:56 AM | Computer Name = YOUR-2B7C71599F | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 13/01/2011 12:13:56 AM | Computer Name = YOUR-2B7C71599F | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 37781

Error - 13/01/2011 12:13:56 AM | Computer Name = YOUR-2B7C71599F | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 37781

Error - 14/01/2011 12:19:23 AM | Computer Name = YOUR-2B7C71599F | Source = Application Error | ID = 1000
Description = Faulting application plugin-container.exe, version 1.9.2.3989, faulting
module ntdll.dll, version 5.1.2600.5755, fault address 0x0000100b.

[ System Events ]
Error - 14/01/2011 6:04:45 PM | Computer Name = YOUR-2B7C71599F | Source = Disk | ID = 262151
Description = The device, \Device\Harddisk0\D, has a bad block.

Error - 14/01/2011 6:04:50 PM | Computer Name = YOUR-2B7C71599F | Source = Disk | ID = 262151
Description = The device, \Device\Harddisk0\D, has a bad block.

Error - 14/01/2011 6:04:54 PM | Computer Name = YOUR-2B7C71599F | Source = Disk | ID = 262151
Description = The device, \Device\Harddisk0\D, has a bad block.

Error - 14/01/2011 6:04:59 PM | Computer Name = YOUR-2B7C71599F | Source = Disk | ID = 262151
Description = The device, \Device\Harddisk0\D, has a bad block.

Error - 14/01/2011 6:05:04 PM | Computer Name = YOUR-2B7C71599F | Source = Disk | ID = 262151
Description = The device, \Device\Harddisk0\D, has a bad block.

Error - 14/01/2011 6:05:08 PM | Computer Name = YOUR-2B7C71599F | Source = Disk | ID = 262151
Description = The device, \Device\Harddisk0\D, has a bad block.

Error - 14/01/2011 6:05:13 PM | Computer Name = YOUR-2B7C71599F | Source = Disk | ID = 262151
Description = The device, \Device\Harddisk0\D, has a bad block.

Error - 14/01/2011 6:05:17 PM | Computer Name = YOUR-2B7C71599F | Source = Disk | ID = 262151
Description = The device, \Device\Harddisk0\D, has a bad block.

Error - 14/01/2011 6:22:28 PM | Computer Name = YOUR-2B7C71599F | Source = Disk | ID = 262151
Description = The device, \Device\Harddisk0\D, has a bad block.

Error - 14/01/2011 6:22:32 PM | Computer Name = YOUR-2B7C71599F | Source = Disk | ID = 262151
Description = The device, \Device\Harddisk0\D, has a bad block.


< End of report >

OTL Log
All processes killed
========== OTL ==========
Registry value HKEY_USERS\S-1-5-21-1537700535-1587211706-558873121-1006\Software\Microsoft\Windows\CurrentVersion\Run\\FRAGBIRD deleted successfully.
C:\WINDOWS\tasks\AC3F2B769184DE42.job moved successfully.
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\WINDOWS\system32\drivers\svchost.exe deleted successfully.
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Documents and Settings\default\Desktop\cmd.bat deleted successfully.
C:\Documents and Settings\default\Desktop\cmd.txt deleted successfully.
File\Folder C:\WINDOWS\system32\drivers\svchost.exe not found.
File\Folder C:\DOCUME~1\default\APPLIC~1\army01\dateflaproad.exe not found.
========== COMMANDS ==========
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: Administrator
->Temporary Internet Files folder emptied: 32768 bytes
->Flash cache emptied: 2836 bytes

User: Administrator.YOUR-2B7C71599F
->Temporary Internet Files folder emptied: 269522 bytes
->FireFox cache emptied: 53524 bytes
->Flash cache emptied: 2836 bytes

User: All Users

User: default
->Temp folder emptied: 329734090 bytes
->Temporary Internet Files folder emptied: 41370490 bytes
->Java cache emptied: 98442566 bytes
->FireFox cache emptied: 139129235 bytes
->Flash cache emptied: 1794002 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes
->Flash cache emptied: 41620 bytes

User: Guest
->Temp folder emptied: 2093839 bytes
->Temporary Internet Files folder emptied: 298814359 bytes
->Java cache emptied: 212475 bytes
->FireFox cache emptied: 2911293 bytes
->Flash cache emptied: 1382 bytes

User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 32969 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 39138 bytes
%systemroot%\System32 .tmp files removed: 4370961 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 12698449 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 113824184 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33984 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 998.00 mb


[EMPTYFLASH]

User: Administrator
->Flash cache emptied: 0 bytes

User: Administrator.YOUR-2B7C71599F
->Flash cache emptied: 0 bytes

User: All Users

User: default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Guest
->Flash cache emptied: 0 bytes

User: LocalService

User: NetworkService

Total Flash Files Cleaned = 0.00 mb

Restore point Set: OTL Restore Point (0)

OTL by OldTimer - Version 3.2.20.2 log created on 01152011_012935

Files\Folders moved on Reboot…
File\Folder C:\Documents and Settings\default\Local Settings\Temp\~DFB6CC.tmp not found!
File\Folder C:\Documents and Settings\default\Local Settings\Temp\~DFB6DC.tmp not found!
C:\Documents and Settings\default\Local Settings\Temporary Internet Files\Content.IE5\UH15E1IN\ads[3].htm moved successfully.
C:\Documents and Settings\default\Local Settings\Temporary Internet Files\Content.IE5\UH15E1IN\indexCAM4LLPH.htm moved successfully.
C:\Documents and Settings\default\Local Settings\Temporary Internet Files\Content.IE5\UH15E1IN\like[1].htm moved successfully.
C:\Documents and Settings\default\Local Settings\Temporary Internet Files\Content.IE5\3EBMVTBK\ads[3].htm moved successfully.
C:\Documents and Settings\default\Local Settings\Temporary Internet Files\Content.IE5\3EBMVTBK\ads[4].htm moved successfully.
C:\Documents and Settings\default\Local Settings\Temporary Internet Files\Content.IE5\3EBMVTBK\iframe[1].htm moved successfully.
C:\Documents and Settings\default\Local Settings\Temporary Internet Files\AntiPhishing\A0AB7674-8D67-4F4D-B5E1-96FAEADFB79D.dat moved successfully.

Registry entries deleted on Reboot…



MBRCheck
MBRCheck, version 1.2.3
© 2010, AD

Command-line:
Windows Version: Windows XP Home Edition
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x0000000c

Kernel Drivers (total 137):
0x804D7000 \WINDOWS\system32\ntoskrnl.exe
0x806EE000 \WINDOWS\system32\hal.dll
0xF7CF0000 \WINDOWS\system32\KDCOM.DLL
0xF7C00000 \WINDOWS\system32\BOOTVID.dll
0xF77A1000 ACPI.sys
0xF7CF2000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
0xF7790000 pci.sys
0xF77F0000 isapnp.sys
0xF7800000 ohci1394.sys
0xF7810000 \WINDOWS\system32\DRIVERS\1394BUS.SYS
0xF7C04000 compbatt.sys
0xF7C08000 \WINDOWS\system32\DRIVERS\BATTC.SYS
0xF7DB8000 pciide.sys
0xF7A70000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
0xF7772000 pcmcia.sys
0xF7820000 MountMgr.sys
0xF7753000 ftdisk.sys
0xF7C0C000 ACPIEC.sys
0xF7DB9000 \WINDOWS\system32\DRIVERS\OPRGHDLR.SYS
0xF7A78000 PartMgr.sys
0xF7830000 VolSnap.sys
0xF773B000 atapi.sys
0xF7840000 disk.sys
0xF7850000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
0xF771B000 fltmgr.sys
0xF7709000 sr.sys
0xF7860000 PxHelp20.sys
0xF76F2000 KSecDD.sys
0xF7665000 Ntfs.sys
0xF7638000 NDIS.sys
0xF761E000 Mup.sys
0xF7880000 \SystemRoot\system32\DRIVERS\nic1394.sys
0xF79F0000 \SystemRoot\system32\DRIVERS\intelppm.sys
0xF6C51000 \SystemRoot\system32\DRIVERS\ati2mtag.sys
0xF6C3D000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
0xF6BC9000 \SystemRoot\system32\DRIVERS\ar5211.sys
0xF7B68000 \SystemRoot\system32\DRIVERS\usbohci.sys
0xF6BA5000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0xF7B70000 \SystemRoot\system32\DRIVERS\usbehci.sys
0xF7CE4000 \SystemRoot\system32\DRIVERS\tdcmdpst.sys
0xF7A00000 \SystemRoot\system32\DRIVERS\imapi.sys
0xF7B80000 \SystemRoot\system32\drivers\iviaspi.sys
0xF7CE8000 \SystemRoot\system32\drivers\pfc.sys
0xF7A10000 \SystemRoot\system32\DRIVERS\cdrom.sys
0xF7A20000 \SystemRoot\system32\DRIVERS\redbook.sys
0xF6B82000 \SystemRoot\system32\DRIVERS\ks.sys
0xF7B88000 \SystemRoot\System32\Drivers\GEARAspiWDM.sys
0xF6B5A000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0xF75FA000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0xF7A30000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0xF7B90000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0xF6B41000 \SystemRoot\system32\DRIVERS\Apfiltr.sys
0xF7B98000 \SystemRoot\system32\DRIVERS\mouclass.sys
0xF6B2F000 \SystemRoot\system32\DRIVERS\Rtlnicxp.sys
0xF7E00000 \SystemRoot\system32\DRIVERS\audstub.sys
0xF0D59000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0xF1401000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0xEF92C000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0xF0D49000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0xF0D39000 \SystemRoot\system32\DRIVERS\raspptp.sys
0xF16DC000 \SystemRoot\system32\DRIVERS\TDI.SYS
0xEF91B000 \SystemRoot\system32\DRIVERS\psched.sys
0xF0D29000 \SystemRoot\system32\DRIVERS\msgpc.sys
0xF16B4000 \SystemRoot\system32\DRIVERS\ptilink.sys
0xF16D4000 \SystemRoot\system32\DRIVERS\raspti.sys
0xF0D19000 \SystemRoot\system32\DRIVERS\termdd.sys
0xF7D28000 \SystemRoot\system32\DRIVERS\swenum.sys
0xEF8BD000 \SystemRoot\system32\DRIVERS\update.sys
0xF13ED000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0xF0D09000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xF000F000 \SystemRoot\system32\DRIVERS\usbhub.sys
0xF7D3E000 \SystemRoot\system32\DRIVERS\USBD.SYS
0xED782000 \SystemRoot\system32\DRIVERS\AGRSM.sys
0xF7BB8000 \SystemRoot\System32\Drivers\Modem.SYS
0xED34C000 \SystemRoot\system32\drivers\RtkHDAud.sys
0xED328000 \SystemRoot\system32\drivers\portcls.sys
0xEFFEF000 \SystemRoot\system32\drivers\drmk.sys
0xEFFDF000 \SystemRoot\system32\DRIVERS\Tvs.sys
0xF7AF0000 \SystemRoot\system32\DRIVERS\tsxt_kern_i386.sys
0xF7B60000 \SystemRoot\system32\DRIVERS\wowhd_kern_i386.sys
0xEFFCF000 \SystemRoot\system32\DRIVERS\csiidecoder_kern_i386.sys
0xF7D44000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xF0332000 \SystemRoot\System32\Drivers\Null.SYS
0xF7D30000 \SystemRoot\System32\Drivers\Beep.SYS
0xF7B08000 \SystemRoot\System32\drivers\vga.sys
0xF7D46000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xF7D4E000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xED2EF000 \SystemRoot\System32\Drivers\meiudf.sys
0xED2DE000 \SystemRoot\System32\Drivers\Udfs.SYS
0xF7B30000 \SystemRoot\System32\Drivers\Msfs.SYS
0xF7BC0000 \SystemRoot\System32\Drivers\Npfs.SYS
0xF0652000 \SystemRoot\system32\DRIVERS\rasacd.sys
0xED2CB000 \SystemRoot\system32\DRIVERS\ipsec.sys
0xED272000 \SystemRoot\system32\DRIVERS\tcpip.sys
0xEFFAF000 \SystemRoot\system32\drivers\mfetdik.sys
0xED24C000 \SystemRoot\system32\DRIVERS\ipnat.sys
0xED224000 \SystemRoot\system32\DRIVERS\netbt.sys
0xED202000 \SystemRoot\System32\drivers\afd.sys
0xEFF9F000 \SystemRoot\system32\DRIVERS\netbios.sys
0xF0642000 \??\C:\WINDOWS\system32\drivers\TPwSav.sys
0xED1D7000 \SystemRoot\system32\DRIVERS\rdbss.sys
0xED167000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xF254D000 \??\C:\Program Files\McAfee\VirusScan Enterprise\mferkdk.sys
0xF170C000 \SystemRoot\System32\Drivers\Fips.SYS
0xF5CD9000 \SystemRoot\system32\DRIVERS\wanarp.sys
0xF5604000 \SystemRoot\system32\DRIVERS\arp1394.sys
0xED14F000 \SystemRoot\System32\Drivers\dump_atapi.sys
0xF7D56000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
0xBF800000 \SystemRoot\System32\win32k.sys
0xF7C94000 \SystemRoot\System32\drivers\Dxapi.sys
0xF2505000 \SystemRoot\System32\watchdog.sys
0xBF000000 \SystemRoot\System32\drivers\dxg.sys
0xF7E62000 \SystemRoot\System32\drivers\dxgthk.sys
0xBF012000 \SystemRoot\System32\ati2dvag.dll
0xBF055000 \SystemRoot\System32\ati2cqag.dll
0xBF094000 \SystemRoot\System32\atikvmag.dll
0xBF0CA000 \SystemRoot\System32\ati3duag.dll
0xBF355000 \SystemRoot\System32\ativvaxx.dll
0xBFFA0000 \SystemRoot\System32\ATMFD.DLL
0xEB08E000 \SystemRoot\system32\DRIVERS\tdudf.sys
0xF78E0000 \SystemRoot\System32\Drivers\Cdfs.SYS
0xF7B40000 \SystemRoot\system32\DRIVERS\AegisP.sys
0xEB0C3000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0xEB0BB000 \SystemRoot\system32\DRIVERS\netdevio.sys
0xEFEE6000 \SystemRoot\system32\DRIVERS\mrxdav.sys
0xEFD76000 \SystemRoot\system32\DRIVERS\srv.sys
0xF219C000 \SystemRoot\system32\DRIVERS\secdrv.sys
0xEFB1C000 \SystemRoot\system32\drivers\mfehidk.sys
0xF7BB0000 \SystemRoot\system32\drivers\mfebopk.sys
0xEFCF6000 \SystemRoot\system32\drivers\mfeapfk.sys
0xEFABB000 \SystemRoot\system32\drivers\mfeavfk.sys
0xF7B20000 \??\C:\WINDOWS\system32\drivers\LVPrcMon.sys
0xF018F000 \SystemRoot\system32\drivers\wdmaud.sys
0xF024C000 \SystemRoot\system32\drivers\sysaudio.sys
0xF0370000 \SystemRoot\System32\Drivers\HTTP.sys
0xF0079000 \SystemRoot\system32\drivers\kmixer.sys
0x7C900000 \WINDOWS\system32\ntdll.dll

Processes (total 62):
0 System Idle Process
4 System
504 C:\WINDOWS\system32\smss.exe
596 csrss.exe
656 C:\WINDOWS\system32\winlogon.exe
700 C:\WINDOWS\system32\services.exe
712 C:\WINDOWS\system32\lsass.exe
864 C:\WINDOWS\system32\ati2evxx.exe
876 C:\WINDOWS\system32\svchost.exe
956 svchost.exe
1008 C:\WINDOWS\system32\svchost.exe
1192 svchost.exe
1244 svchost.exe
1404 C:\WINDOWS\system32\brsvc01a.exe
1428 C:\WINDOWS\system32\brss01a.exe
1420 C:\WINDOWS\system32\spoolsv.exe
1476 C:\Program Files\Common Files\Logitech\LVMVFM\LVPrcSrv.exe
1492 C:\WINDOWS\system32\acs.exe
1532 svchost.exe
1624 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
1640 C:\Program Files\Bonjour\mDNSResponder.exe
1652 C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
1688 C:\WINDOWS\system32\DVDRAMSV.exe
1748 C:\Program Files\Java\jre6\bin\jqs.exe
1776 C:\Program Files\McAfee\Common Framework\FrameworkService.exe
1812 C:\Program Files\McAfee\VirusScan Enterprise\mcshield.exe
1848 C:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exe
200 naPrdMgr.exe
196 C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
716 C:\WINDOWS\system32\svchost.exe
1932 C:\WINDOWS\system32\TODDSrv.exe
2080 alg.exe
3520 C:\WINDOWS\system32\wscntfy.exe
3588 C:\WINDOWS\system32\ati2evxx.exe
3764 C:\WINDOWS\explorer.exe
2312 C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
2428 C:\WINDOWS\RTHDCPL.exe
2752 C:\Program Files\Apoint2K\Apoint.exe
476 C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
2920 C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
3032 C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
3064 C:\Program Files\TOSHIBA\TOSHIBA Direct Disc Writer\DDWMon.exe
3288 C:\Program Files\Apoint2K\ApntEx.exe
3432 C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
3640 C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
3816 C:\Program Files\TOSHIBA\Tvs\TvsTray.exe
4092 C:\Program Files\TOSHIBA\ConfigFree\CFSServ.exe
464 C:\WINDOWS\system32\LVCOMSX.EXE
1200 C:\Program Files\Logitech\Video\CameraAssistant.exe
1984 C:\WINDOWS\system32\ElkCtrl.exe
2088 C:\Program Files\McAfee\VirusScan Enterprise\shstat.exe
1088 C:\Program Files\McAfee\Common Framework\UdaterUI.exe
2584 C:\Program Files\McAfee\Common Framework\Mctray.exe
1952 C:\Program Files\iTunes\iTunesHelper.exe
2968 C:\Program Files\Common Files\Java\Java Update\jusched.exe
3548 C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe
3620 C:\WINDOWS\system32\ctfmon.exe
2504 C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe
2880 C:\Program Files\iPod\bin\iPodService.exe
2544 C:\WINDOWS\system32\taskmgr.exe
2692 C:\Program Files\Internet Explorer\iexplore.exe
1300 C:\Documents and Settings\default\Desktop\MBRCheck.exe

\\.\C: –> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)

PhysicalDrive0 Model Number: FUJITSUMHV2060BHPL, Rev: 00000029

Size Device Name MBR Status
——————————————–
55 GB \\.\PhysicalDrive0 Windows 98 MBR code detected
SHA1: 48F01D7E76A0F3C038D08611E3FDC0EE4EF9FD3E


Done!




MBAM Log
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4052

Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.11

15/01/2011 2:29:39 AM
mbam-log-2011-01-15 (02-29-39).txt

Scan type: Quick scan
Objects scanned: 131405
Time elapsed: 23 minute(s), 33 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{9034a523-d068-4be8-a284-9df278be776e} (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\TDSSserv.sys (Rootkit.TDSS) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

At the moment I can see nothing that would cause combofix to fail. All other programmes whilst we try to track this down run very fast

Dependant on this I may need to reset the MBR to windows XP

Please read carefully and follow these steps.

• Download TDSSKiller and save it to your Desktop.
• Extract its contents to your desktop.
• Once extracted, open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
  
  
  🖼Click to load external image (Posted Image)
  
  
• If an infected file is detected, the default action will be Cure, click on Continue.
  
  
  🖼Click to load external image (Posted Image)
  
  
• If a suspicious file is detected, the default action will be Skip, click on Continue.
  
  
  🖼Click to load external image (Posted Image)
  
  
• It may ask you to reboot the computer to complete the process. Click on Reboot Now.
  
  
  🖼Click to load external image (Posted Image)
  
  
• If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
• If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.