What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Computer is jacked up big time.

15 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Here's the problem so far. The computer started running really slow, so I went for a reboot and then after the reboot. Nothing would open, the explorer bar was non responsive. The only way it runs is in Safe Mode. Someone suggest that the Master Boot Record could be screwed up. But I'll let you guys take a hack at it. Thanks in advance.
Post #2
Hello Blindsided623 and welcome to the WTT forum.

My name is Astabi and I would be glad to help you with your computer problem. Please read the following guidelines which will help to make cleaning your machine easier:
  • Please do not install/uninstall any programs unless asked to.
  • Please do not run any scans other than those requested
  • Please follow all instructions in the order posted
  • Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  • If you don't understand something, please don't hesitate to ask for clarification before proceeding
  • The fixes are specific to your problem and should only be used for this issue on this machine.
  • Please reply within 3 days. If you do not reply within this period I will post a reminder but topics with no reply in 4 days will be closed!
Please note that I am still in training and my replies need to be checked by an expert in order for you to receive the best possible advice. This may result in a small delay between my posts but I shall try to keep this to a minimum.


Thanks,
Astabi
Post #3
Hello,

I would like you to do the following:

Enable Boot Logging:

To Enable Boot Logging
  • Go to Start> Shut off your Computer> Restart
  • As the computer starts to boot-up, Tap the F8 KEY repeatedly,
  • this will bring up a menu.
  • Use the Up and Down Arrow Keys to scroll up to Enable Boot Logging
  • Then press the Enter Key on your Keyboard
  • Windows XP will be displayed on the next screen, hit the Enter Key
The computer will try to start in normal mode, if it cannot it will generate a log at c:\Windows\Ntbtlog.txt

Next,

Restart your computer, choose Safe Mode w/networking if you are able.
Go to c:\Windows\Ntbtlog.txt and attach log to next reply.

I would also like to know:
Are you able to go into safe mode with networking,
or are you accessing these forums with another computer?

Thanks,
Astabi
Post #4
It started up correctly this time which is weird considering I tried to restart the computer at least 5 times to no avail before. I was running the computer in Safe Mode with networking on and I was accessing the forums from this computer that was having the problems. I attached the log for you check over. Thanks again!

Attachments:

Post #5
Hello,

Is the computer now booted into Normal mode? If so I would like you to do the following:
If it is still only booting in SafeMode let me know, I will suggest a different instruction set.

If the Computer booted fine, in normal mode do this:
Run CHECKDISK
Start - Run - (type)chkdsk /f /r - Enter <– notice the required space before "/f" and "/r"
You will receive a warning that CHECKDISK cannot be run due to inability to lock files or files in use.
You will be invited to allow CHECKDISK to run next time you reboot your machine.
Allow this to be scheduled by typing "Y" and pressing Enter.
Reboot your machine.

CHECKDISK will open during the boot-up cycle, before opening Windows
It will run a series of 5 scans.
CHECKDISK does not create a log, but if you follow along with the Scan, it alerts when it finds a "bad-cluster" and
announces that it is moving the file contents to a safe known-good location on the Hard Drive disk surface.
CHECKDISK scans take between 30 - 40 minutes depending upon the size of your Hard Drive.
Note: CHECKDISK should be run multiple times if it does detect any "bad-sectors".
Please Run CHECKDISK a second and even third time until no errors/bad-sectors are identified.

Let us know if that takes care of the problem.

Thanks,
Astabi
Post #6
I ran the checkdisk twice, and the second time through it didn't find any errors. Everything is running fine as far as I can tell. Anything else you need done?
Post #7
Hello,

I would like to get a check of your system now that it's booting normally.

Please do the following:
  • Download OTL to your desktop.
  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • When the window appears, underneath Output at the top change it to Minimal Output.
  • Check the boxes beside LOP Check and Purity Check.
  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt.
    Note:These logs can be located in the OTL. folder on you C:\ drive if they fail to open automatically.
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them both in.

Then,

[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.
  • Extract the contents of the zipped file to desktop.
  • Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

    [external image: Posted Image]
    Click the image to enlarge it
  • In the right panel, you will see several boxes that have been checked. Uncheck the following …
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and attach it in your reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

So, in your next reply please provide:
OTL.Txt
Extras.Txt
Gmer.txt

Thanks,
Astabi
Post #8
OTL logfile created on: 4/5/2011 9:15:09 PM - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Paul\My Documents\Downloads
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

255.00 Mb Total Physical Memory | 104.00 Mb Available Physical Memory | 41.00% Memory free
617.00 Mb Paging File | 267.00 Mb Available in Paging File | 43.00% Paging File free
Paging file location(s): C:\pagefile.sys 384 768 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 37.25 Gb Total Space | 21.30 Gb Free Space | 57.18% Space Free | Partition Type: NTFS

Computer Name: PAUL | User Name: Paul | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Paul\My Documents\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\UPHClean\uphclean.exe (Windows ® Codename Longhorn DDK provider)
PRC - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Linksys\Wireless-G Notebook Adapter\NICServ.exe ()
PRC - C:\WINDOWS\system32\pctspk.exe (PCtel, Inc.)


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Paul\My Documents\Downloads\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (AppMgmt) – File not found
SRV - (UPHClean) – C:\Program Files\UPHClean\uphclean.exe (Windows ® Codename Longhorn DDK provider)
SRV - (getPlusHelper) getPlus® – C:\Program Files\NOS\bin\getPlus_Helper.dll (NOS Microsystems Ltd.)
SRV - (antivirservice) – C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (antivirschedulerservice) – C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (NICSer_WPC54G) – C:\Program Files\Linksys\Wireless-G Notebook Adapter\NICServ.exe ()
SRV - (Pctspk) – C:\WINDOWS\system32\pctspk.exe (PCtel, Inc.)


========== Driver Services (SafeList) ==========

DRV - (Tcpip6) – C:\WINDOWS\system32\drivers\tcpip6.sys (Microsoft Corporation)
DRV - (RTL8192su) – C:\WINDOWS\system32\drivers\RTL8192su.sys (Realtek Semiconductor Corporation )
DRV - (avgntflt) – C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH)
DRV - (saskutil) – C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (sasenum) – C:\Program Files\SUPERAntiSpyware\SASENUM.SYS ( SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASDIFSV) – C:\Program Files\SUPERAntiSpyware\sasdifsv.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (ssmdrv) – C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (avipbb) – C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgio) – C:\Program Files\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (moufiltr) – C:\WINDOWS\system32\drivers\moufiltr.sys (Chic Tech.)
DRV - (BCM43XX) – C:\WINDOWS\system32\drivers\BCMWL5.SYS (Broadcom Corporation)
DRV - (BCM42RLY) – C:\WINDOWS\system32\bcm42rly.sys (Broadcom Corporation)
DRV - (odysseyIM4) – C:\WINDOWS\system32\drivers\odysseyIM4.sys (Funk Software, Inc.)
DRV - (ati2mtag) – C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (TDWXP) – C:\WINDOWS\system32\drivers\wpndis51.sys (WavePlus Technology Co., Ltd.)
DRV - (CBTNDIS5) – C:\WINDOWS\system32\CBTNDIS5.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (cs429x) – C:\WINDOWS\system32\drivers\cwawdm.sys (Cirrus Logic, Inc.)
DRV - (Vpctcom) – C:\WINDOWS\system32\DRIVERS\vpctcom.sys (PCtel, Inc.)
DRV - (Vvoice) – C:\WINDOWS\system32\DRIVERS\vvoice.sys (PCtel, Inc.)
DRV - (Vmodem) – C:\WINDOWS\system32\DRIVERS\vmodem.sys (PCTEL, INC.)
DRV - (Ptserli) – C:\WINDOWS\system32\drivers\ptserli.sys (PCTEL, INC.)
DRV - (EL90XBC) – C:\WINDOWS\system32\drivers\el90xbc5.sys (3Com Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Yahoo! Search
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://search.yahoo.com/search?p={searchTe…-8&fr;=b1ie7
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://google.atcomet.com/b/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 91.201.177.245:3128

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "AIM Search"
FF - prefs.js..browser.search.defaulturl: "http://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType;=tb50fftrie7&query;="
FF - prefs.js..browser.search.selectedEngine: "AIM Search"
FF - prefs.js..browser.search.update: false
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://google.atcomet.com/b/"
FF - prefs.js..extensions.enabledItems: [removed]:1.0.0.07076007
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.8.20100408.6
FF - prefs.js..network.proxy.type: 4


FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/02/09 23:05:21 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/03/12 01:59:19 | 000,000,000 | —D | M]

[2009/02/26 14:51:39 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Paul\Application Data\Mozilla\Extensions
[2009/02/26 14:51:39 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Paul\Application Data\Mozilla\Extensions\[removed]
[2011/01/13 03:09:11 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Paul\Application Data\Mozilla\Firefox\Profiles\5gj188sf.default\extensions
[2010/06/02 17:56:34 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Paul\Application Data\Mozilla\Firefox\Profiles\5gj188sf.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/01/13 03:09:02 | 000,000,000 | —D | M] (Greasemonkey) – C:\Documents and Settings\Paul\Application Data\Mozilla\Firefox\Profiles\5gj188sf.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2008/02/05 17:08:58 | 000,000,000 | —D | M] (Move Media Player) – C:\Documents and Settings\Paul\Application Data\Mozilla\Firefox\Profiles\5gj188sf.default\extensions\[removed]
[2008/11/20 19:58:04 | 000,001,739 | —- | M] () – C:\Documents and Settings\Paul\Application Data\Mozilla\Firefox\Profiles\5gj188sf.default\searchplugins\aim-search.xml
[2011/03/12 01:59:24 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2011/03/12 01:59:27 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
[2011/02/02 22:40:24 | 000,472,808 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll

O1 HOSTS File: ([2009/11/04 21:32:23 | 000,000,027 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {C4069E3A-68F1-403E-B40E-20066696354B} - No CLSID value found.
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Main present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKCU\..Trusted Domains: chase.com ([]https in Trusted sites)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} http://download.bitdefender.com/resources/…can8/oscan8.cab (Reg Error: Key error.)
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} http://upload.facebook.com/controls/Facebo…otoUploader.cab (Facebook Photo Uploader Control)
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} http://download.divx.com/player/DivXBrowserPlugin.cab (DivXBrowserPlugin Object)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…t/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {BF985246-09BF-11D2-BE62-006097DF57F6} http://simcity.ea.com/play/classic/SimCityX.cab (SimCityX Control)
O16 - DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/flas…ent/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (get_atlcom Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.106.128.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O24 - Desktop WallPaper: C:\Documents and Settings\Paul\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Paul\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/04/01 23:13:44 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Paul\Recent
[2011/03/18 01:53:02 | 000,000,000 | —D | C] – C:\Program Files\UPHClean
[2011/03/17 00:53:42 | 000,000,000 | —D | C] – C:\Program Files\Treads
[2011/03/17 00:53:42 | 000,000,000 | —D | C] – C:\Documents and Settings\Paul\Start Menu\Programs\Treads
[2011/03/17 00:50:59 | 000,527,192 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\XAudio2_7.dll
[2011/03/17 00:50:59 | 000,074,072 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\XAPOFX1_5.dll
[2011/03/17 00:50:58 | 000,239,960 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xactengine3_7.dll
[2011/03/17 00:50:57 | 002,106,216 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\D3DCompiler_43.dll
[2011/03/17 00:50:56 | 001,868,128 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dcsx_43.dll
[2011/03/17 00:50:55 | 000,248,672 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx11_43.dll
[2011/03/17 00:50:54 | 000,470,880 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx10_43.dll
[2011/03/17 00:50:53 | 001,998,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\D3DX9_43.dll
[2011/03/17 00:50:52 | 000,528,216 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\XAudio2_6.dll
[2011/03/17 00:50:52 | 000,074,072 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\XAPOFX1_4.dll
[2011/03/17 00:50:51 | 000,238,936 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xactengine3_6.dll
[2011/03/17 00:50:50 | 000,022,360 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\X3DAudio1_7.dll
[2011/03/17 00:50:49 | 000,515,416 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\XAudio2_5.dll
[2011/03/17 00:50:48 | 000,238,936 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xactengine3_5.dll
[2011/03/17 00:50:47 | 001,974,616 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\D3DCompiler_42.dll
[2011/03/17 00:50:46 | 005,501,792 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dcsx_42.dll
[2011/03/17 00:50:43 | 000,235,344 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx11_42.dll
[2011/03/17 00:50:42 | 000,453,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx10_42.dll
[2011/03/17 00:50:41 | 001,892,184 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\D3DX9_42.dll
[2011/03/17 00:50:40 | 001,846,632 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\D3DCompiler_41.dll
[2011/03/17 00:50:40 | 000,453,456 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx10_41.dll
[2011/03/17 00:50:39 | 004,178,264 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\D3DX9_41.dll
[2011/03/17 00:50:37 | 000,517,448 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\XAudio2_4.dll
[2011/03/17 00:50:37 | 000,235,352 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xactengine3_4.dll
[2011/03/17 00:50:37 | 000,069,464 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\XAPOFX1_3.dll
[2011/03/17 00:50:36 | 000,022,360 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\X3DAudio1_6.dll
[2011/03/17 00:50:35 | 002,036,576 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\D3DCompiler_40.dll
[2011/03/17 00:50:35 | 000,452,440 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx10_40.dll
[2011/03/17 00:50:34 | 004,379,984 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\D3DX9_40.dll
[2011/03/17 00:50:32 | 000,514,384 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\XAudio2_3.dll
[2011/03/17 00:50:32 | 000,070,992 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\XAPOFX1_2.dll
[2011/03/17 00:50:31 | 000,235,856 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xactengine3_3.dll
[2011/03/17 00:50:31 | 000,023,376 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\X3DAudio1_5.dll
[2011/03/17 00:50:29 | 000,509,448 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\XAudio2_2.dll
[2011/03/17 00:50:29 | 000,068,616 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\XAPOFX1_1.dll
[2011/03/17 00:50:28 | 000,238,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xactengine3_2.dll
[2011/03/17 00:50:27 | 001,493,528 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\D3DCompiler_39.dll
[2011/03/17 00:50:27 | 000,467,984 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx10_39.dll
[2011/03/17 00:50:26 | 003,851,784 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\D3DX9_39.dll
[2011/03/17 00:50:25 | 000,507,400 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\XAudio2_1.dll
[2011/03/17 00:50:25 | 000,065,032 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\XAPOFX1_0.dll
[2011/03/17 00:50:24 | 000,238,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xactengine3_1.dll
[2011/03/17 00:50:23 | 000,025,608 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\X3DAudio1_4.dll
[2011/03/17 00:50:22 | 001,491,992 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\D3DCompiler_38.dll
[2011/03/17 00:50:22 | 000,467,984 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx10_38.dll
[2011/03/17 00:50:21 | 003,850,760 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\D3DX9_38.dll
[2011/03/17 00:50:20 | 000,479,752 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\XAudio2_0.dll
[2011/03/17 00:50:19 | 000,238,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xactengine3_0.dll
[2011/03/17 00:50:18 | 000,025,608 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\X3DAudio1_3.dll
[2011/03/17 00:50:17 | 001,420,824 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\D3DCompiler_37.dll
[2011/03/17 00:50:17 | 000,462,864 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx10_37.dll
[2011/03/17 00:50:16 | 003,786,760 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\D3DX9_37.dll
[2011/03/17 00:50:14 | 000,267,272 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xactengine2_10.dll
[2011/03/17 00:50:12 | 001,374,232 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\D3DCompiler_36.dll
[2011/03/17 00:50:12 | 000,444,776 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx10_36.dll
[2011/03/17 00:50:10 | 003,734,536 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx9_36.dll
[2011/03/17 00:50:08 | 000,267,112 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xactengine2_9.dll
[2011/03/17 00:50:07 | 001,358,192 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\D3DCompiler_35.dll
[2011/03/17 00:50:07 | 000,444,776 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx10_35.dll
[2011/03/17 00:50:06 | 003,727,720 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx9_35.dll
[2011/03/17 00:50:04 | 000,266,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xactengine2_8.dll
[2011/03/17 00:50:04 | 000,017,928 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\X3DAudio1_2.dll
[2011/03/17 00:50:03 | 001,124,720 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\D3DCompiler_34.dll
[2011/03/17 00:50:03 | 000,443,752 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx10_34.dll
[2011/03/17 00:50:02 | 003,497,832 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx9_34.dll
[2011/03/17 00:50:01 | 000,081,768 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xinput1_3.dll
[2011/03/17 00:50:00 | 000,261,480 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xactengine2_7.dll
[2011/03/17 00:49:59 | 001,123,696 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\D3DCompiler_33.dll
[2011/03/17 00:49:59 | 000,443,752 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx10_33.dll
[2011/03/17 00:49:50 | 003,495,784 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx9_33.dll
[2011/03/17 00:49:49 | 000,255,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xactengine2_6.dll
[2011/03/17 00:49:48 | 000,251,672 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xactengine2_5.dll
[2011/03/17 00:49:47 | 003,426,072 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx9_32.dll
[2011/03/17 00:49:46 | 000,237,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xactengine2_4.dll
[2011/03/17 00:49:46 | 000,015,128 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\x3daudio1_1.dll
[2011/03/17 00:49:45 | 002,414,360 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx9_31.dll
[2011/03/17 00:49:44 | 000,236,824 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xactengine2_3.dll
[2011/03/17 00:49:43 | 000,230,168 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xactengine2_2.dll
[2011/03/17 00:49:43 | 000,062,744 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xinput1_2.dll
[2011/03/17 00:49:42 | 000,062,672 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xinput1_1.dll
[2011/03/17 00:49:41 | 000,229,584 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xactengine2_1.dll
[2011/03/17 00:49:32 | 002,388,176 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx9_30.dll
[2011/03/17 00:49:31 | 000,230,096 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xactengine2_0.dll
[2011/03/17 00:49:31 | 000,014,032 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\x3daudio1_0.dll
[2011/03/17 00:49:30 | 002,332,368 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx9_29.dll
[2011/03/17 00:49:29 | 002,323,664 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx9_28.dll
[2011/03/17 00:49:28 | 000,061,136 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xinput9_1_0.dll
[2011/03/17 00:49:27 | 002,319,568 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx9_27.dll
[2011/03/17 00:49:26 | 002,297,552 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx9_26.dll
[2011/03/17 00:49:25 | 002,337,488 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx9_25.dll
[2011/03/17 00:49:21 | 002,222,800 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\d3dx9_24.dll
[2011/03/17 00:46:20 | 000,000,000 | —D | C] – C:\WINDOWS\Logs
[2011/03/16 17:29:46 | 000,000,000 | —D | C] – C:\Program Files\60 Tons
[2011/03/16 17:29:46 | 000,000,000 | —D | C] – C:\Documents and Settings\Paul\Start Menu\Programs\60 Tons
[2011/03/16 03:48:56 | 000,000,000 | —D | C] – C:\Documents and Settings\Paul\My Documents\Tanarus
[2011/03/16 03:30:20 | 000,000,000 | —D | C] – C:\Documents and Settings\Paul\Local Settings\Application Data\Bop Chat
[2011/03/16 03:29:09 | 000,000,000 | —D | C] – C:\Documents and Settings\Paul\Start Menu\Programs\Bop Chat
[2011/03/16 03:29:08 | 000,000,000 | —D | C] – C:\Program Files\Bop Chat
[2011/03/16 03:28:13 | 000,444,952 | —- | C] (Creative Labs) – C:\WINDOWS\System32\wrap_oal.dll
[2011/03/16 03:28:13 | 000,109,080 | —- | C] (Portions © Creative Labs Inc. and NVIDIA Corp.) – C:\WINDOWS\System32\OpenAL32.dll
[2011/03/16 03:28:13 | 000,000,000 | —D | C] – C:\Program Files\OpenAL
[2011/03/12 02:00:58 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Sun
[2011/03/12 01:59:18 | 000,472,808 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\deployJava1.dll
[2011/03/12 01:59:18 | 000,157,472 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaws.exe
[2011/03/12 01:59:17 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaw.exe
[2011/03/12 01:59:17 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\java.exe
[2011/03/12 01:57:19 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\McAfee
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/04/05 20:46:00 | 000,000,882 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/04/05 20:25:00 | 000,000,974 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-583907252-839522115-1343024091-1006UA.job
[2011/04/05 01:07:25 | 000,013,646 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2011/04/05 01:06:54 | 000,000,878 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/04/05 01:05:13 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/04/05 01:05:06 | 267,845,632 | -HS- | M] () – C:\hiberfil.sys
[2011/04/04 21:25:00 | 000,000,922 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-583907252-839522115-1343024091-1006Core.job
[2011/04/02 18:21:37 | 000,000,664 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2011/04/01 17:43:13 | 000,000,330 | RHS- | M] () – C:\boot.ini
[2011/03/31 20:03:07 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2011/03/19 22:05:39 | 000,433,800 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2011/03/19 22:05:39 | 000,068,232 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2011/03/18 02:03:09 | 000,262,144 | —- | M] () – C:\WINDOWS\System32\default_user_class.dat
[2011/03/17 00:53:15 | 000,444,952 | —- | M] (Creative Labs) – C:\WINDOWS\System32\wrap_oal.dll
[2011/03/17 00:53:15 | 000,109,080 | —- | M] (Portions © Creative Labs Inc. and NVIDIA Corp.) – C:\WINDOWS\System32\OpenAL32.dll
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/04/03 23:05:35 | 267,845,632 | -HS- | C] () – C:\hiberfil.sys
[2011/04/02 01:04:12 | 000,000,664 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2011/03/18 02:03:09 | 000,262,144 | —- | C] () – C:\WINDOWS\System32\default_user_class.dat
[2010/11/20 18:11:38 | 000,000,052 | —- | C] () – C:\WINDOWS\creation.INI
[2009/11/04 21:03:46 | 000,077,312 | —- | C] () – C:\WINDOWS\MBR.exe
[2009/08/05 14:36:11 | 000,000,554 | —- | C] () – C:\WINDOWS\eReg.dat
[2009/07/28 20:06:43 | 000,261,632 | —- | C] () – C:\WINDOWS\PEV.exe
[2009/07/28 20:06:43 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2009/07/28 20:06:43 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2009/07/28 20:06:43 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2009/01/05 15:44:10 | 000,053,248 | —- | C] () – C:\WINDOWS\bdoscandel.exe
[2009/01/05 15:44:10 | 000,000,453 | —- | C] () – C:\WINDOWS\bdoscandellang.ini
[2008/03/12 08:02:21 | 000,000,127 | —- | C] () – C:\WINDOWS\System32\MRT.INI
[2007/12/02 22:25:06 | 000,004,096 | —- | C] () – C:\WINDOWS\d3dx.dat
[2007/11/30 16:28:51 | 002,463,976 | —- | C] () – C:\WINDOWS\System32\NPSWF32.dll
[2007/11/15 18:37:25 | 000,001,631 | —- | C] () – C:\WINDOWS\mozver.dat
[2007/11/15 18:33:16 | 000,000,000 | —- | C] () – C:\WINDOWS\nsreg.dat
[2007/11/06 18:25:38 | 000,021,504 | —- | C] () – C:\Documents and Settings\Paul\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007/05/26 02:16:19 | 000,000,416 | —- | C] () – C:\WINDOWS\wininit.ini
[2007/04/08 12:13:34 | 000,043,520 | —- | C] () – C:\WINDOWS\System32\CmdLineExt03.dll
[2007/01/20 16:49:16 | 000,000,064 | —- | C] () – C:\WINDOWS\init.ini
[2006/12/18 15:42:14 | 000,000,000 | —- | C] () – C:\WINDOWS\iplayer.INI
[2006/12/14 02:17:43 | 000,000,085 | -HS- | C] () – C:\Documents and Settings\All Users\Application Data\.zreglib
[2006/12/07 03:33:22 | 000,094,208 | —- | C] () – C:\WINDOWS\System32\GTW32N50.dll
[2006/03/26 21:17:57 | 000,000,614 | —- | C] () – C:\WINDOWS\PowerReg.dat
[2006/03/25 10:41:56 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2006/01/02 03:24:17 | 000,001,536 | —- | C] () – C:\WINDOWS\System32\TrueSoft.dat
[2006/01/02 03:24:10 | 000,000,456 | —- | C] () – C:\WINDOWS\System32\pthsp.dat
[2006/01/01 21:00:08 | 000,000,082 | —- | C] () – C:\WINDOWS\usrwiz.ini
[2006/01/01 16:36:28 | 000,021,840 | —- | C] () – C:\WINDOWS\System32\SIntfNT.dll
[2006/01/01 16:36:28 | 000,017,212 | —- | C] () – C:\WINDOWS\System32\SIntf32.dll
[2006/01/01 16:36:28 | 000,012,067 | —- | C] () – C:\WINDOWS\System32\SIntf16.dll
[2006/01/01 00:07:09 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2005/12/31 23:58:25 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2005/12/31 17:45:56 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2005/12/31 17:44:17 | 000,160,344 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2004/08/04 07:00:00 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\oembios.bin
[2004/08/04 07:00:00 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[2004/08/04 07:00:00 | 000,433,800 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[2004/08/04 07:00:00 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[2004/08/04 07:00:00 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[2004/08/04 07:00:00 | 000,068,232 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[2004/08/04 07:00:00 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\mib.bin
[2004/08/04 07:00:00 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[2004/08/04 07:00:00 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2004/08/04 07:00:00 | 000,004,461 | —- | C] () – C:\WINDOWS\System32\oembios.dat
[2004/08/04 07:00:00 | 000,001,804 | —- | C] () – C:\WINDOWS\System32\dcache.bin
[2004/08/04 07:00:00 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat

========== LOP Check ==========

[2009/01/13 14:26:05 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Azureus
[2007/08/22 16:33:52 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\CanonBJ
[2006/12/14 02:18:02 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Elaborate Bytes
[2010/03/11 19:16:38 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Viewpoint
[2010/03/14 18:18:31 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\WinZip
[2011/02/09 23:11:21 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2009/12/30 00:13:44 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2010/08/21 12:05:35 | 000,000,000 | —D | M] – C:\Documents and Settings\Paul\Application Data\Atari
[2011/02/08 23:01:55 | 000,000,000 | —D | M] – C:\Documents and Settings\Paul\Application Data\Azureus
[2010/08/28 17:33:16 | 000,000,000 | —D | M] – C:\Documents and Settings\Paul\Application Data\BitComet
[2008/01/14 23:04:11 | 000,000,000 | —D | M] – C:\Documents and Settings\Paul\Application Data\Dev-Cpp
[2009/10/31 14:07:35 | 000,000,000 | —D | M] – C:\Documents and Settings\Paul\Application Data\FrostWire
[2009/06/10 17:05:53 | 000,000,000 | —D | M] – C:\Documents and Settings\Paul\Application Data\LimeWire
[2009/11/05 00:20:50 | 000,000,000 | —D | M] – C:\Documents and Settings\Paul\Application Data\quickhit.football.QHFootball.4D5206CA741FBF5FD6AAD1A97F5076E917382B34.1

========== Purity Check ==========



< End of report >


OTL Extras logfile created on: 4/5/2011 9:15:09 PM - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Paul\My Documents\Downloads
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

255.00 Mb Total Physical Memory | 104.00 Mb Available Physical Memory | 41.00% Memory free
617.00 Mb Paging File | 267.00 Mb Available in Paging File | 43.00% Paging File free
Paging file location(s): C:\pagefile.sys 384 768 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 37.25 Gb Total Space | 21.30 Gb Free Space | 57.18% Space Free | Partition Type: NTFS

Computer Name: PAUL | User Name: Paul | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = ChromeHTML] – Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] – "%1" %*
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Winamp.Bookmark] – "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)
Directory [Winamp.Enqueue] – "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft)
Directory [Winamp.Play] – "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\domainprofile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\standardprofile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008
"65533:TCP" = 65533:TCP:*:Enabled:Services
"52344:TCP" = 52344:TCP:*:Enabled:Services
"2479:TCP" = 2479:TCP:*:Enabled:Services
"3246:TCP" = 3246:TCP:*:Enabled:Services
"3389:TCP" = 3389:TCP:*:Enabled:Remote Desktop
"7768:TCP" = 7768:TCP:*:Enabled:Services
"6158:TCP" = 6158:TCP:*:Enabled:Services
"3829:TCP" = 3829:TCP:*:Enabled:Services
"80:TCP" = 80:TCP:*:Enabled:Services
"3949:TCP" = 3949:TCP:*:Enabled:Services
"6398:TCP" = 6398:TCP:*:Enabled:Services
"9434:TCP" = 9434:TCP:*:Enabled:Services
"9435:TCP" = 9435:TCP:*:Enabled:Services
"5141:TCP" = 5141:TCP:*:Enabled:Services
"8782:TCP" = 8782:TCP:*:Enabled:Services
"6753:TCP" = 6753:TCP:*:Enabled:Services
"6754:TCP" = 6754:TCP:*:Enabled:Services
"9060:TCP" = 9060:TCP:*:Enabled:Services
"9061:TCP" = 9061:TCP:*:Enabled:Services
"8389:TCP" = 8389:TCP:*:Enabled:Services
"8390:TCP" = 8390:TCP:*:Enabled:Services
"7354:TCP" = 7354:TCP:*:Enabled:Services
"7355:TCP" = 7355:TCP:*:Enabled:Services
"2734:TCP" = 2734:TCP:*:Enabled:Services
"3968:TCP" = 3968:TCP:*:Enabled:Services
"1874:TCP" = 1874:TCP:*:Enabled:Services
"1687:TCP" = 1687:TCP:*:Enabled:Services
"4386:TCP" = 4386:TCP:*:Enabled:Services
"6847:TCP" = 6847:TCP:*:Enabled:Services
"7217:TCP" = 7217:TCP:*:Enabled:Services
"2253:TCP" = 2253:TCP:*:Enabled:Services
"2784:TCP" = 2784:TCP:*:Enabled:Services
"8829:TCP" = 8829:TCP:*:Enabled:Services
"3817:TCP" = 3817:TCP:*:Enabled:Services
"9550:TCP" = 9550:TCP:*:Enabled:Services
"1812:TCP" = 1812:TCP:*:Enabled:Services
"2124:TCP" = 2124:TCP:*:Enabled:Services
"2844:TCP" = 2844:TCP:*:Enabled:Services
"3575:TCP" = 3575:TCP:*:Enabled:Services
"5067:TCP" = 5067:TCP:*:Enabled:Services
"8634:TCP" = 8634:TCP:*:Enabled:Services
"1522:TCP" = 1522:TCP:*:Enabled:Services
"5124:TCP" = 5124:TCP:*:Enabled:Services
"4670:TCP" = 4670:TCP:*:Enabled:Services
"5775:TCP" = 5775:TCP:*:Enabled:Services
"4139:TCP" = 4139:TCP:*:Enabled:Services
"1772:TCP" = 1772:TCP:*:Enabled:Services
"9951:TCP" = 9951:TCP:*:Enabled:Services
"9715:TCP" = 9715:TCP:*:Enabled:Services
"7678:TCP" = 7678:TCP:*:Enabled:Services
"4019:TCP" = 4019:TCP:*:Enabled:Services
"9928:TCP" = 9928:TCP:*:Enabled:Services
"9994:TCP" = 9994:TCP:*:Enabled:Services
"2170:TCP" = 2170:TCP:*:Enabled:Services
"4133:TCP" = 4133:TCP:*:Enabled:Services
"5211:TCP" = 5211:TCP:*:Enabled:Services

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22002
"18722:TCP" = 18722:TCP:*:Enabled:BitComet 18722 TCP
"18722:UDP" = 18722:UDP:*:Enabled:BitComet 18722 UDP
"65533:TCP" = 65533:TCP:*:Enabled:Services
"52344:TCP" = 52344:TCP:*:Enabled:Services
"2479:TCP" = 2479:TCP:*:Enabled:Services
"3246:TCP" = 3246:TCP:*:Enabled:Services
"3389:TCP" = 3389:TCP:*:Enabled:Remote Desktop
"7768:TCP" = 7768:TCP:*:Enabled:Services
"6158:TCP" = 6158:TCP:*:Enabled:Services
"3829:TCP" = 3829:TCP:*:Enabled:Services
"3949:TCP" = 3949:TCP:*:Enabled:Services
"6398:TCP" = 6398:TCP:*:Enabled:Services
"9434:TCP" = 9434:TCP:*:Enabled:Services
"9435:TCP" = 9435:TCP:*:Enabled:Services
"5141:TCP" = 5141:TCP:*:Enabled:Services
"8782:TCP" = 8782:TCP:*:Enabled:Services
"6753:TCP" = 6753:TCP:*:Enabled:Services
"6754:TCP" = 6754:TCP:*:Enabled:Services
"9060:TCP" = 9060:TCP:*:Enabled:Services
"9061:TCP" = 9061:TCP:*:Enabled:Services
"3074:TCP" = 3074:TCP:*:Enabled:Xbox Live
"3074:UDP" = 3074:UDP:*:Enabled:Live 2
"8389:TCP" = 8389:TCP:*:Enabled:Services
"8390:TCP" = 8390:TCP:*:Enabled:Services
"7354:TCP" = 7354:TCP:*:Enabled:Services
"7355:TCP" = 7355:TCP:*:Enabled:Services
"2734:TCP" = 2734:TCP:*:Enabled:Services
"3968:TCP" = 3968:TCP:*:Enabled:Services
"1874:TCP" = 1874:TCP:*:Enabled:Services
"1687:TCP" = 1687:TCP:*:Enabled:Services
"4386:TCP" = 4386:TCP:*:Enabled:Services
"6847:TCP" = 6847:TCP:*:Enabled:Services
"7217:TCP" = 7217:TCP:*:Enabled:Services
"2253:TCP" = 2253:TCP:*:Enabled:Services
"2784:TCP" = 2784:TCP:*:Enabled:Services
"8829:TCP" = 8829:TCP:*:Enabled:Services
"3817:TCP" = 3817:TCP:*:Enabled:Services
"9550:TCP" = 9550:TCP:*:Enabled:Services
"1812:TCP" = 1812:TCP:*:Enabled:Services
"2124:TCP" = 2124:TCP:*:Enabled:Services
"2844:TCP" = 2844:TCP:*:Enabled:Services
"3575:TCP" = 3575:TCP:*:Enabled:Services
"5067:TCP" = 5067:TCP:*:Enabled:Services
"8634:TCP" = 8634:TCP:*:Enabled:Services
"1522:TCP" = 1522:TCP:*:Enabled:Services
"5124:TCP" = 5124:TCP:*:Enabled:Services
"4670:TCP" = 4670:TCP:*:Enabled:Services
"5775:TCP" = 5775:TCP:*:Enabled:Services
"4139:TCP" = 4139:TCP:*:Enabled:Services
"1772:TCP" = 1772:TCP:*:Enabled:Services
"9951:TCP" = 9951:TCP:*:Enabled:Services
"9715:TCP" = 9715:TCP:*:Enabled:Services
"7678:TCP" = 7678:TCP:*:Enabled:Services
"4019:TCP" = 4019:TCP:*:Enabled:Services
"9928:TCP" = 9928:TCP:*:Enabled:Services
"9994:TCP" = 9994:TCP:*:Enabled:Services
"2170:TCP" = 2170:TCP:*:Enabled:Services
"4133:TCP" = 4133:TCP:*:Enabled:Services
"5211:TCP" = 5211:TCP:*:Enabled:Services

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\MSN Messenger\msncall.exe" = C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)
"C:\Program Files\MSN Messenger\msnmsgr.exe" = C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1
"C:\Program Files\MSN Messenger\livecall.exe" = C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Sony\Station\LaunchPad\LaunchPad.exe" = C:\Program Files\Sony\Station\LaunchPad\LaunchPad.exe:*:Enabled:LaunchPad
"C:\Program Files\SopCast\SopCast.exe" = C:\Program Files\SopCast\SopCast.exe:*:Enabled:SopCast Main Application – (www.sopcast.com)
"C:\Documents and Settings\Paul\Application Data\SopCast\adv\SopAdver.exe" = C:\Documents and Settings\Paul\Application Data\SopCast\adv\SopAdver.exe:*:Enabled:SopCast Adver – (www.sopcast.com)
"C:\Program Files\Mozilla Firefox\firefox.exe" = C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox – (Mozilla Corporation)
"C:\Program Files\SopCast\adv\SopAdver.exe" = C:\Program Files\SopCast\adv\SopAdver.exe:*:Enabled:SopCast Adver – (www.sopcast.com)
"C:\Program Files\TVUPlayer\TVUPlayer.exe" = C:\Program Files\TVUPlayer\TVUPlayer.exe:*:Enabled:TVUPlayer Component – (TVU networks)
"C:\Program Files\Avira\AntiVir Desktop\avcenter.exe" = C:\Program Files\Avira\AntiVir Desktop\avcenter.exe:*:Enabled:avcenter – (Avira GmbH)
"C:\Program Files\Avira\AntiVir Desktop\update.exe" = C:\Program Files\Avira\AntiVir Desktop\update.exe:*:Enabled:update – (Avira GmbH)
"C:\WINDOWS\system32\dwwin.exe" = C:\WINDOWS\system32\dwwin.exe:*:Enabled:dwwin – (Microsoft Corporation)
"C:\Program Files\BitComet\BitComet.exe" = C:\Program Files\BitComet\BitComet.exe:*:Enabled:BitComet.exe
"C:\Chain\creation.exe" = C:\Chain\creation.exe:*:Enabled:2AM Creation game engine
"C:\WINDOWS\system32\dpvsetup.exe" = C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test – (Microsoft Corporation)
"C:\Program Files\Bop Chat\Bop Chat.exe" = C:\Program Files\Bop Chat\Bop Chat.exe:*:Enabled:Bop Chat – (Slick)
"C:\Program Files\Bop Chat\Bop Chat Patcher.exe" = C:\Program Files\Bop Chat\Bop Chat Patcher.exe:*:Enabled:Patch – ()
"C:\Program Files\Treads\Treads Launchpad.exe" = C:\Program Files\Treads\Treads Launchpad.exe:*:Enabled:Treads game patcher – (Bop Games)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_iP1800_series" = Canon iP1800 series
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{196BB40D-1578-3D01-B289-BEFC77A11A1E}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
"{26A24AE4-039D-4CA4-87B4-2F83216014FF}" = Java™ 6 Update 24
"{2A2EDF5F-F3C6-4919-AE34-C08A71AD034A}" = Wireless-G Notebook Adapter
"{2A981294-F14C-4F0F-9627-D793270922F8}" = Bonjour
"{3248F0A8-6813-11D6-A77B-00B0D0150100}" = J2SE Runtime Environment 5.0 Update 10
"{3248F0A8-6813-11D6-A77B-00B0D0150110}" = J2SE Runtime Environment 5.0 Update 11
"{3248F0A8-6813-11D6-A77B-00B0D0160010}" = Java™ SE Runtime Environment 6 Update 1
"{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java™ 6 Update 5
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{5BF5F9C5-E95B-4AFA-94BE-F2A9CA73B61D}" = Apple Mobile Device Support
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{7D15B945-2725-4443-AB3F-D900556612FE}" = User Profile Hive Cleanup Service
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90850409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Word Viewer 2003
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A96E97134CA649888820BCDE5E300BBD}" = H.264 Decoder
"{AAC389499AEF40428987B3D30CFC76C9}" = MKV Splitter
"{AAD47011-8518-4608-9656-951DA35B587B}" = iTunes
"{AC76BA86-7AD7-1033-7B44-A94000000001}" = Adobe Reader 9.4.0
"{AEF9DC35ADDF4825B049ACBFD1C6EB37}" = AAC Decoder
"{AFD89880-C544-4777-B645-FBF6D3391B11}" = Belkin F7D1101 Basic Wireless USB Adapter
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{BD3DCAB0-3FE5-44FB-90DA-EFB0A2CD1387}" = Works Synchronization
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C4124E95-5061-4776-8D5D-E3D931C778E1}" = Microsoft VC9 runtime libraries
"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{E2883E8F-472F-4fb0-9522-AC9BF37916A7}" = Adobe Download Manager
"{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support
"{FAF7F1D7-C0E7-47EA-8AAA-84E4F9EA3C94}" = Works Suite OS Pack
"60 Tons " = 60 Tons Version '0.56'
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player
"avira antivir desktop" = Avira AntiVir Personal - Free Antivirus
"Canon iP1800 series User Registration" = Canon iP1800 series User Registration
"CanonMyPrinter" = Canon My Printer
"CCleaner" = CCleaner
"Dev-C++" = Dev-C++ 5 beta 9 release (4.9.9.2)
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie8" = Windows Internet Explorer 8
"InstallShield_{AFD89880-C544-4777-B645-FBF6D3391B11}" = Belkin F7D1101 Basic Wireless USB Adapter
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.6.13)" = Mozilla Firefox (3.6.13)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"OpenAL" = OpenAL
"Registry Mechanic_is1" = Registry Mechanic 5.2
"SoftwareUpdUtility" = Download Updater (AOL LLC)
"SopCast" = SopCast 2.0.4
"Treads game patcher" = Treads game patcher 1.0
"TVUPlayer" = TVUPlayer [removed]
"Winamp" = Winamp (remove only)
"WinCue" = WinCue (Remove only)
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinRAR archiver" = WinRAR archiver
"Wireless Keyboard" = Wireless Keyboard
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 3/11/2011 1:29:37 AM | Computer Name = PAUL | Source = Bonjour Service | ID = 100
Description = WSARecvMsg failed (10022)

Error - 3/17/2011 10:51:36 PM | Computer Name = PAUL | Source = Application Error | ID = 1000
Description = Faulting application ituneshelper.exe, version 10.1.2.17, faulting
module unknown, version 0.0.0.0, fault address 0x018b120c.

Error - 3/18/2011 1:34:58 AM | Computer Name = PAUL | Source = Application Hang | ID = 1002
Description = Hanging application chrome.exe, version 0.0.0.0, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 3/20/2011 9:57:08 PM | Computer Name = PAUL | Source = Application Hang | ID = 1002
Description = Hanging application chrome.exe, version 0.0.0.0, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 3/20/2011 10:04:56 PM | Computer Name = PAUL | Source = Application Hang | ID = 1002
Description = Hanging application chrome.exe, version 0.0.0.0, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 4/1/2011 11:17:27 PM | Computer Name = PAUL | Source = Application Hang | ID = 1002
Description = Hanging application chrome.exe, version 0.0.0.0, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 4/1/2011 11:57:13 PM | Computer Name = PAUL | Source = Application Hang | ID = 1002
Description = Hanging application chrome.exe, version 0.0.0.0, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 4/2/2011 12:03:15 AM | Computer Name = PAUL | Source = Application Hang | ID = 1002
Description = Hanging application rstrui.exe, version 5.1.2600.5512, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 4/2/2011 12:05:02 AM | Computer Name = PAUL | Source = Application Hang | ID = 1002
Description = Hanging application chrome.exe, version 0.0.0.0, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 4/2/2011 12:05:57 AM | Computer Name = PAUL | Source = Application Hang | ID = 1002
Description = Hanging application chrome.exe, version 0.0.0.0, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

[ System Events ]
Error - 4/4/2011 12:04:26 AM | Computer Name = PAUL | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service EventSystem
with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 4/5/2011 11:02:02 AM | Computer Name = PAUL | Source = Tcpip | ID = 4199
Description = The system detected an address conflict for IP address 192.168.1.110
with the system having network hardware address 00:17:FA:1C:D2:40. Network operations
on this system may be disrupted as a result.

Error - 4/5/2011 11:02:51 AM | Computer Name = PAUL | Source = Tcpip | ID = 4199
Description = The system detected an address conflict for IP address 192.168.1.110
with the system having network hardware address 00:17:FA:1C:D2:40. Network operations
on this system may be disrupted as a result.

Error - 4/5/2011 11:03:20 AM | Computer Name = PAUL | Source = Tcpip | ID = 4199
Description = The system detected an address conflict for IP address 192.168.1.110
with the system having network hardware address 00:17:FA:1C:D2:40. Network operations
on this system may be disrupted as a result.

Error - 4/5/2011 4:24:24 PM | Computer Name = PAUL | Source = Tcpip | ID = 4199
Description = The system detected an address conflict for IP address 192.168.1.110
with the system having network hardware address 00:17:FA:1C:D2:40. Network operations
on this system may be disrupted as a result.

Error - 4/5/2011 4:34:27 PM | Computer Name = PAUL | Source = Tcpip | ID = 4199
Description = The system detected an address conflict for IP address 192.168.1.110
with the system having network hardware address 00:17:FA:1C:D2:40. Network operations
on this system may be disrupted as a result.

Error - 4/5/2011 4:44:42 PM | Computer Name = PAUL | Source = Tcpip | ID = 4199
Description = The system detected an address conflict for IP address 192.168.1.110
with the system having network hardware address 00:17:FA:1C:D2:40. Network operations
on this system may be disrupted as a result.

Error - 4/5/2011 7:30:26 PM | Computer Name = PAUL | Source = Tcpip | ID = 4199
Description = The system detected an address conflict for IP address 192.168.1.110
with the system having network hardware address 00:17:FA:1C:D2:40. Network operations
on this system may be disrupted as a result.

Error - 4/5/2011 10:15:54 PM | Computer Name = PAUL | Source = Tcpip | ID = 4199
Description = The system detected an address conflict for IP address 192.168.1.110
with the system having network hardware address 00:17:FA:1C:D2:40. Network operations
on this system may be disrupted as a result.

Error - 4/5/2011 10:16:30 PM | Computer Name = PAUL | Source = Tcpip | ID = 4199
Description = The system detected an address conflict for IP address 192.168.1.110
with the system having network hardware address 00:17:FA:1C:D2:40. Network operations
on this system may be disrupted as a result.


< End of report >

Attachments:

Post #9
Hello,

Is this computer part of a home network using custom name server?

You have a number of FileSharing and Peer to Peer applications installed.
Avoid gaming sites, underground web pages, pirated software sites, and peer-to-peer (P2P) file sharing programs. They are a security risk which can make your computer susceptible to a smörgåsbord of malware infections, remote attacks, exposure of personal information, and identity theft. Many malicious worms and Trojans spread across P2P file sharing networks, gaming and underground sites. Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and Flash ads that install viruses, Trojans and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users. The best way to reduce the risk of infection is to avoid these types of web sites and not use any P2P applications. Read P2P Software User Advisories and Risks of File-Sharing Technology.


First, we need to backup your system registry:
* Making a backup using ERUNT (preferred method)

ERUNT is a handy little backup utility, which just about all helpers use. The advantages being that it requires very little User input to get a successful backup, and the backups it creates are also accessible from Windows Recovery Console, which can be very helpful in cases where the User's computer becomes unbootable.


Next, I would like you to do the following:

Download aswMBR.exe ( 511KB ) to your desktop.

Double click the aswMBR.exe to run it
[external image: Posted Image]
Click the "Scan" button to start scan
[external image: Posted Image]
On completion of the scan click save log, save it to your desktop and post in your next reply

Thanks,
Astabi
Post #10
aswMBR version 0.9.4 Copyright© 2011 AVAST Software Run date: 2011-04-07 22:26:33 —————————– 22:26:33.732 OS Version: Windows 5.1.2600 Service Pack 3 22:26:33.732 Number of processors: 1 586 0xB01 22:26:33.732 ComputerName: PAUL UserName: Paul 22:26:36.266 Initialize success 22:27:36.583 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 22:27:36.593 Disk 0 Vendor: CSD_CAT040H ________ Size: 38154MB BusType: 3 22:27:38.636 Disk 0 MBR read successfully 22:27:38.636 Disk 0 MBR scan 22:27:38.636 Disk 0 MBR hidden 22:27:40.639 Disk 0 scanning sectors +78124095 22:27:40.689 Disk 0 malicious Win32:MBRoot code @ sector 78124098 ! 22:27:40.689 Disk 0 PE file @ sector 78124120 ! 22:27:40.689 Disk 0 MBR [Win32:MBRoot] **ROOTKIT** 22:27:40.689 Disk 0 trace - called modules: 22:27:40.689 ntoskrnl.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x822d6aed]<< 22:27:40.689 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x82753030] 22:27:40.699 3 CLASSPNP.SYS[f9af2fd7] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x82732218] 22:27:40.699 Scan finished successfully
Post #11
Hello Blindsided623,

FIX

Re-Run aswMBR

Click Scan

On completion of the scan

Click the FIXMBR Button.
[external image: Posted Image]
Save the log as before and post in your next reply.

Thanks,
Astabi
Post #12
After I run the scan the Fix MBR button is grayed out and can't be clicked. The only button that is usable is the "Fix" button. It will let me run the FixMBR button if the scan hasn't run. Thanks!
Post #13
Hello,

I would like you to Start aswMBR.exe and click the Fix MBR button.

Next,

Please reboot your machine,

Then Re-Run as you did earlier.

Double click the aswMBR.exe to run it
Click the "Scan" button to start scan
On completion of the scan click save log, save it to your desktop and post in your next reply.

Thanks,
Astabi
Post #14
aswMBR version 0.9.4 Copyright© 2011 AVAST Software Run date: 2011-04-10 19:45:04 —————————– 19:45:04.744 OS Version: Windows 5.1.2600 Service Pack 3 19:45:04.744 Number of processors: 1 586 0xB01 19:45:04.744 ComputerName: PAUL UserName: Paul 19:45:06.867 Initialize success 19:45:09.170 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 19:45:09.170 Disk 0 Vendor: CSD_CAT040H ________ Size: 38154MB BusType: 3 19:45:11.223 Disk 0 MBR read successfully 19:45:11.223 Disk 0 MBR scan 19:45:13.316 Disk 0 scanning sectors +78124095 19:45:13.346 Disk 0 malicious Win32:MBRoot code @ sector 78124098 ! 19:45:13.346 Disk 0 PE file @ sector 78124120 ! 19:45:13.346 Disk 0 scanning C:\WINDOWS\system32\drivers 19:45:34.247 Service scanning 19:45:36.289 Disk 0 trace - called modules: 19:45:36.330 ntoskrnl.exe CLASSPNP.SYS disk.sys atapi.sys hal.dll intelide.sys PCIIDEX.SYS 19:45:36.330 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x82794030] 19:45:36.330 3 CLASSPNP.SYS[f9af2fd7] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x82728218] 19:45:36.330 Scan finished successfully
Post #15
Download ComboFix from one of these locations:


Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop
  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
  • Double click on ComboFix.exe & follow the prompts.
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.
[external image: Posted Image]




Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
[external image: Posted Image]



Click on Yes, to continue scanning for malware.

When finished, it will produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Thanks,
Astabi

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI