Personal Antivirus Malware

I'm working on a Dell Vostro 220 running Windows XP Professional. Yesterday I was infected with some type of malware/spyware related to an Antivirus Software. There are now pop-ups saying my computer is infected as well as a fake scan that appears to be "scanning my computer for viruses". There is a green shield that is now in my task bar that has notifications that say my computer is now infected and I need to install their software to remove it.

I have Avast Antiviurs on this computer, and when I restart my computer, it does allow me to block this malware When I tell it to ignore it, that's when I start getting all of the pop-ups. I ran this scan with Avast Antivirus blocking it. the malware and the "green shield" is not in my task bar when i ran the OTC scan. I hope this doesn't affect the results. If it does, just let me know and I'll run the scan again with the "green shield" in my task bar. Thanks.

Extras.Txt

OTL Extras logfile created on: 5/12/2011 11:36:33 AM - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\ERIK GONZALES\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 61.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 76.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 148.97 Gb Total Space | 119.93 Gb Free Space | 80.50% Space Free | Partition Type: NTFS

Computer Name: ERIK | User Name: ERIK GONZALES | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.url [@ = InternetShortcut] – rundll32.exe ieframe.dll,OpenURL %l

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] – "%1" %*
InternetShortcut [open] – rundll32.exe ieframe.dll,OpenURL %l
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00203668-8170-44A0-BE44-B632FA4D780F}" = Adobe AIR
"{178832DE-9DE0-4C87-9F82-9315A9B03985}" = Windows Live Writer
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{20C53FA2-4307-4671-A93F-9463B29DFCF1}" = Symantec Technical Support Web Controls
"{20F6DD05-F69A-45B4-B337-A2DCC5688060}" = AMS 360 Client Rev 3
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83216016FF}" = Java™ 6 Update 22
"{2A981294-F14C-4F0F-9627-D793270922F8}" = Bonjour
"{308B6AEA-DE50-4666-996D-0FA461719D6B}" = Apple Mobile Device Support
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant
"{46E1B1F2-A279-4356-9B17-029F9CC72EAE}" = Brother MFL-Pro Suite
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4CBA3D4C-8F51-4D60-B27E-F6B641C571E7}" = Microsoft Search Enhancement Pack
"{50120000-1105-0000-0000-0000000FF1CE}" = Microsoft Office 2007 Primary Interop Assemblies
"{58F4D4FD-1814-4068-B316-C28FC776C6DD}" = GoToMyPC
"{6412CECE-8172-4BE5-935B-6CECACD2CA87}" = Windows Live Mail
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD DX
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{7236672F-6430-439E-9B27-27EDEAF1D676}" = Diagnostic Utility
"{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com
"{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}" = Windows Live Essentials
"{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}" = Windows Live Sync
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)
"{90120000-0010-0409-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (English) 12
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_BASICR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_BASICR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_BASICR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_BASICR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_BASICR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_BASICR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_BASICR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_BASICR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager
"{91120000-0013-0000-0000-0000000FF1CE}" = Microsoft Office Basic 2007
"{91120000-0013-0000-0000-0000000FF1CE}_BASICR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-0013-0000-0000-0000000FF1CE}_BASICR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{995F1E2E-F542-4310-8E1D-9926F5A279B3}" = Windows Live Toolbar
"{9D59AC32-B0FA-4CD7-A2EC-4B57C06CD9D9}" = Dell Backup and Recovery Manager
"{9EDA3DD1-130D-4EE1-A3D2-5A3D795CC8C9}" = MFCLOC
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A85FD55B-891B-4314-97A5-EA96C0BD80B5}" = Windows Live Messenger
"{AC54E544-3E42-443C-A91D-A00A6974C592}" = NVIDIA PhysX v8.10.13
"{AC76BA86-1033-F400-BA7E-000000000004}" = Adobe Acrobat 9 Standard - English, Français, Deutsch
"{AC76BA86-1033-F400-BA7E-000000000004}_944" = Adobe Acrobat 9.4.4 - CPSID_83708
"{AC76BA86-1033-F400-BA7E-000000000004}{AC76BA86-1033-F400-BA7E-000000000004}" = Adobe Acrobat 9 Standard - English, Français, Deutsch
"{AC76BA86-7AD7-1033-7B44-A94000000001}" = Adobe Reader 9.4.4
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{BAF78226-3200-4DB4-BE33-4D922A799840}" = Windows Presentation Foundation
"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D594F5FC-AB96-464F-A23F-511632606115}" = AMS TransactNOW Client
"{D6C75F0B-3BC1-4FC9-B8C5-3F7E8ED059CA}" = Windows Live Photo Gallery
"{E2DFE069-083E-4631-9B6C-43C48E991DE5}" = Junk Mail filter update
"{E7004147-2CCA-431C-AA05-2AB166B9785D}" = QuickTime
"{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call
"{FAE36873-1941-4076-A9A5-48812B5EA0B7}" = iTunes
"ActiveTouchMeetingClient" = WebEx
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"avast" = avast! Internet Security
"BASICR" = Microsoft Office Basic 2007
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"HDMI" = Intel® Graphics Media Accelerator Driver
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"NVIDIA Drivers" = NVIDIA Drivers
"Tweak UI 2.10" = Tweak UI
"WinLiveSuite_Wave3" = Windows Live Essentials
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"GoToMeeting" = GoToMeeting 4.0.0.320

========== Last 10 Event Log Errors ==========

[ AMS 360 Events ]
Error - 5/2/2011 12:54:53 PM | Computer Name = ERIK | Source = AMS 360 | ID = 1018
Description = Source: ServerObjects Agency: 1000484-1, Login Id: erik UserName:ERIK
GONZALES PID:1820 Application: Client Application Directory: C:\Documents and Settings\ERIK
GONZALES\Local Settings\Application Data\AMS Services, Inc\AMS 360\ Fire Cannot access
a disposed object. Object name: 'frmCustomer'. at System.Windows.Forms.Control.MarshaledInvoke(Control
caller, Delegate method, Object[] args, Boolean synchronous) at System.Windows.Forms.Control.Invoke(Delegate
method, Object[] args) at AMSBothell.Components.Controls.FormBase.OnNotificationReceivedInternal(String
strEventType, ListDictionary oLD, Object oData) at AMSBothell.Components.WorkstationCoordinator.ClientObject.DataChanged(String
strEventType, ListDictionary e, Object oData) at AMSBothell.Components.WorkstationCoordinator.Notification.Server.Fire(String
strEventType, ListDictionary e, Object oData)

Error - 5/3/2011 11:16:04 AM | Computer Name = ERIK | Source = AMS 360 | ID = 1018
Description = Source: ServerObjects Agency: 1000484-1, Login Id: erik UserName:ERIK
GONZALES PID:1820 Application: Client Application Directory: C:\Documents and Settings\ERIK
GONZALES\Local Settings\Application Data\AMS Services, Inc\AMS 360\ Fire Cannot access
a disposed object. Object name: 'frmCustomer'. at System.Windows.Forms.Control.MarshaledInvoke(Control
caller, Delegate method, Object[] args, Boolean synchronous) at System.Windows.Forms.Control.Invoke(Delegate
method, Object[] args) at AMSBothell.Components.Controls.FormBase.OnNotificationReceivedInternal(String
strEventType, ListDictionary oLD, Object oData) at AMSBothell.Components.WorkstationCoordinator.ClientObject.DataChanged(String
strEventType, ListDictionary e, Object oData) at AMSBothell.Components.WorkstationCoordinator.Notification.Server.Fire(String
strEventType, ListDictionary e, Object oData)

Error - 5/4/2011 3:43:41 PM | Computer Name = ERIK | Source = AMS 360 | ID = 1023
Description =

Error - 5/10/2011 11:15:51 AM | Computer Name = ERIK | Source = AMS 360 | ID = 1023
Description =

Error - 5/10/2011 11:15:51 AM | Computer Name = ERIK | Source = AMS 360 | ID = 2
Description = Source: WorkstationCoordinator Agency: 1000484-1, Login Id: erik UserName:ERIK
GONZALES PID:3628 Application: Client Application Directory: C:\Documents and Settings\ERIK
GONZALES\Local Settings\Application Data\AMS Services, Inc\AMS 360\ Unable to clear
locks Expired Credentials at AMSBothell.WebServices.AMSSoapHttpClientProtocol.Invoke(String
methodName, Object[] parameters) at AMSBothell.WebServices.CheckInOutSvc.CheckInOutSvc.CheckInByWorkstation(String
strWorkstationId) at AMSBothell.Components.WorkstationCoordinator.WorkstationCoordinator.WorkstationC
oordinator_Closed(Object
sender, EventArgs e)

Error - 5/10/2011 4:40:26 PM | Computer Name = ERIK | Source = AMS 360 | ID = 1018
Description = Source: ServerObjects Agency: 1000484-1, Login Id: erik UserName:ERIK
GONZALES PID:3052 Application: Client Application Directory: C:\Documents and Settings\ERIK
GONZALES\Local Settings\Application Data\AMS Services, Inc\AMS 360\ Fire Cannot access
a disposed object. Object name: 'frmSubmissionGroup'. at System.Windows.Forms.Control.MarshaledInvoke(Control
caller, Delegate method, Object[] args, Boolean synchronous) at System.Windows.Forms.Control.Invoke(Delegate
method, Object[] args) at AMSBothell.Components.Controls.FormBase.OnNotificationReceivedInternal(String
strEventType, ListDictionary oLD, Object oData) at AMSBothell.Components.WorkstationCoordinator.ClientObject.DataChanged(String
strEventType, ListDictionary e, Object oData) at AMSBothell.Components.WorkstationCoordinator.Notification.Server.Fire(String
strEventType, ListDictionary e, Object oData)

Error - 5/11/2011 4:15:57 PM | Computer Name = ERIK | Source = AMS 360 | ID = 1
Description = Windows Login:ERIK GONZALES InstallCheck.WCInstalled exception copying/updating
files, config, or manifest: [Unable to connect to the remote server]

Error - 5/11/2011 5:24:49 PM | Computer Name = ERIK | Source = AMS 360 | ID = 1018
Description = Source: ServerObjects Agency: 1000484-1, Login Id: erik UserName:ERIK
GONZALES PID:2040 Application: Client Application Directory: C:\Documents and Settings\ERIK
GONZALES\Local Settings\Application Data\AMS Services, Inc\AMS 360\ Fire No connection
could be made because the target machine actively refused it 127.0.0.1:1140 Server
stack trace: at System.Net.Sockets.Socket.DoConnect(EndPoint endPointSnapshot,
SocketAddress socketAddress) at System.Net.Sockets.Socket.Connect(EndPoint remoteEP)

at System.Runtime.Remoting.Channels.RemoteConnection.CreateNewSocket(EndPoint
ipEndPoint) at System.Runtime.Remoting.Channels.RemoteConnection.CreateNewSocket()

at System.Runtime.Remoting.Channels.RemoteConnection.GetSocket() at System.Runtime.Remoting.Channels.SocketCache.GetSocket(String
machinePortAndSid, Boolean openNew) at System.Runtime.Remoting.Channels.Tcp.TcpClientTransportSink.SendRequestWithRetry
(IMessage
msg, ITransportHeaders requestHeaders, Stream requestStream) at System.Runtime.Remoting.Channels.Tcp.TcpClientTransportSink.ProcessMessage(IMess
age
msg, ITransportHeaders requestHeaders, Stream requestStream, ITransportHeaders&
responseHeaders, Stream& responseStream) at System.Runtime.Remoting.Channels.BinaryClientFormatterSink.SyncProcessMessage(IM
essage
msg) Exception rethrown at [0]: at System.Runtime.Remoting.Proxies.RealProxy.HandleReturnMessage(IMessage
reqMsg, IMessage retMsg) at System.Runtime.Remoting.Proxies.RealProxy.PrivateInvoke(MessageData&
msgData, Int32 type) at AMSBothell.Components.WorkstationCoordinator.ClientObject.DataChanged(String
strEventType, ListDictionary e, Object oData) at AMSBothell.Components.WorkstationCoordinator.Notification.Server.Fire(String
strEventType, ListDictionary e, Object oData)

Error - 5/11/2011 5:24:51 PM | Computer Name = ERIK | Source = AMS 360 | ID = 1019
Description = Source: ServerObjects Agency: 1000484-1, Login Id: erik UserName:ERIK
GONZALES PID:2040 Application: Client Application Directory: C:\Documents and Settings\ERIK
GONZALES\Local Settings\Application Data\AMS Services, Inc\AMS 360\ Fire-Ping Failed
No
connection could be made because the target machine actively refused it 127.0.0.1:1140

Server
stack trace: at System.Net.Sockets.Socket.DoConnect(EndPoint endPointSnapshot,
SocketAddress socketAddress) at System.Net.Sockets.Socket.Connect(EndPoint remoteEP)

at System.Runtime.Remoting.Channels.RemoteConnection.CreateNewSocket(EndPoint
ipEndPoint) at System.Runtime.Remoting.Channels.RemoteConnection.CreateNewSocket()

at System.Runtime.Remoting.Channels.RemoteConnection.GetSocket() at System.Runtime.Remoting.Channels.SocketCache.GetSocket(String
machinePortAndSid, Boolean openNew) at System.Runtime.Remoting.Channels.Tcp.TcpClientTransportSink.SendRequestWithRetry
(IMessage
msg, ITransportHeaders requestHeaders, Stream requestStream) at System.Runtime.Remoting.Channels.Tcp.TcpClientTransportSink.ProcessMessage(IMess
age
msg, ITransportHeaders requestHeaders, Stream requestStream, ITransportHeaders&
responseHeaders, Stream& responseStream) at System.Runtime.Remoting.Channels.BinaryClientFormatterSink.SyncProcessMessage(IM
essage
msg) Exception rethrown at [0]: at System.Runtime.Remoting.Proxies.RealProxy.HandleReturnMessage(IMessage
reqMsg, IMessage retMsg) at System.Runtime.Remoting.Proxies.RealProxy.PrivateInvoke(MessageData&
msgData, Int32 type) at AMSBothell.Components.WorkstationCoordinator.ClientObject.Ping()

at AMSBothell.Components.WorkstationCoordinator.Notification.Server.Fire(String
strEventType, ListDictionary e, Object oData)

Error - 5/12/2011 10:44:53 AM | Computer Name = ERIK | Source = AMS 360 | ID = 2
Description = Source: WorkstationCoordinator Agency: 1000484-1, Login Id: erik UserName:ERIK
GONZALES PID:2204 Application: Client Application Directory: C:\Documents and Settings\ERIK
GONZALES\Local Settings\Application Data\AMS Services, Inc\AMS 360\ Unable to clear
locks Expired Credentials at AMSBothell.WebServices.AMSSoapHttpClientProtocol.Invoke(String
methodName, Object[] parameters) at AMSBothell.WebServices.CheckInOutSvc.CheckInOutSvc.CheckInByWorkstation(String
strWorkstationId) at AMSBothell.Components.WorkstationCoordinator.WorkstationCoordinator.WorkstationC
oordinator_Closed(Object
sender, EventArgs e)

[ Application Events ]
Error - 5/12/2011 8:06:58 AM | Computer Name = ERIK | Source = Userenv | ID = 1041
Description = Windows cannot query DllName registry entry for {7B849a69-220F-451E-B3FE-2CB811AF94AE}
and it will not be loaded. This is most likely caused by a faulty registration.

Error - 5/12/2011 8:06:58 AM | Computer Name = ERIK | Source = Userenv | ID = 1041
Description = Windows cannot query DllName registry entry for {CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}
and it will not be loaded. This is most likely caused by a faulty registration.

Error - 5/12/2011 9:23:58 AM | Computer Name = ERIK | Source = Userenv | ID = 1041
Description = Windows cannot query DllName registry entry for {7B849a69-220F-451E-B3FE-2CB811AF94AE}
and it will not be loaded. This is most likely caused by a faulty registration.

Error - 5/12/2011 9:23:58 AM | Computer Name = ERIK | Source = Userenv | ID = 1041
Description = Windows cannot query DllName registry entry for {CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}
and it will not be loaded. This is most likely caused by a faulty registration.

Error - 5/12/2011 9:56:58 AM | Computer Name = ERIK | Source = Userenv | ID = 1041
Description = Windows cannot query DllName registry entry for {7B849a69-220F-451E-B3FE-2CB811AF94AE}
and it will not be loaded. This is most likely caused by a faulty registration.

Error - 5/12/2011 9:56:58 AM | Computer Name = ERIK | Source = Userenv | ID = 1041
Description = Windows cannot query DllName registry entry for {CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}
and it will not be loaded. This is most likely caused by a faulty registration.

Error - 5/12/2011 11:06:58 AM | Computer Name = ERIK | Source = Userenv | ID = 1041
Description = Windows cannot query DllName registry entry for {7B849a69-220F-451E-B3FE-2CB811AF94AE}
and it will not be loaded. This is most likely caused by a faulty registration.

Error - 5/12/2011 11:06:58 AM | Computer Name = ERIK | Source = Userenv | ID = 1041
Description = Windows cannot query DllName registry entry for {CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}
and it will not be loaded. This is most likely caused by a faulty registration.

Error - 5/12/2011 11:46:58 AM | Computer Name = ERIK | Source = Userenv | ID = 1041
Description = Windows cannot query DllName registry entry for {7B849a69-220F-451E-B3FE-2CB811AF94AE}
and it will not be loaded. This is most likely caused by a faulty registration.

Error - 5/12/2011 11:46:58 AM | Computer Name = ERIK | Source = Userenv | ID = 1041
Description = Windows cannot query DllName registry entry for {CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}
and it will not be loaded. This is most likely caused by a faulty registration.

[ OSession Events ]
Error - 6/15/2010 6:12:06 PM | Computer Name = ERIK | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6514.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 11032
seconds with 1680 seconds of active time. This session ended with a crash.

Error - 6/21/2010 1:23:03 PM | Computer Name = ERIK | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6514.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 9573
seconds with 1980 seconds of active time. This session ended with a crash.

Error - 8/31/2010 4:05:38 PM | Computer Name = ERIK | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6535.5005, Microsoft Office Version: 12.0.6425.1000. This session lasted 19544
seconds with 2160 seconds of active time. This session ended with a crash.

Error - 8/31/2010 4:40:08 PM | Computer Name = ERIK | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6535.5005, Microsoft Office Version: 12.0.6425.1000. This session lasted 2052
seconds with 1140 seconds of active time. This session ended with a crash.

Error - 11/15/2010 3:49:01 PM | Computer Name = ERIK | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6539.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 15113
seconds with 3960 seconds of active time. This session ended with a crash.

Error - 12/2/2010 11:41:09 AM | Computer Name = ERIK | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6539.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 783
seconds with 360 seconds of active time. This session ended with a crash.

Error - 12/9/2010 6:11:15 PM | Computer Name = ERIK | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6539.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 19867
seconds with 4380 seconds of active time. This session ended with a crash.

Error - 12/14/2010 6:01:05 PM | Computer Name = ERIK | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6539.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 22960
seconds with 6360 seconds of active time. This session ended with a crash.

Error - 1/19/2011 1:26:17 PM | Computer Name = ERIK | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6550.5003, Microsoft Office Version: 12.0.6425.1000. This session lasted 8722
seconds with 3540 seconds of active time. This session ended with a crash.

Error - 1/25/2011 3:09:34 PM | Computer Name = ERIK | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6550.5003, Microsoft Office Version: 12.0.6425.1000. This session lasted 8274
seconds with 360 seconds of active time. This session ended with a crash.

[ System Events ]
Error - 4/26/2011 10:34:22 AM | Computer Name = ERIK | Source = Service Control Manager | ID = 7000
Description = The Windows Search service failed to start due to the following error:
%%1053

Error - 5/5/2011 12:41:40 PM | Computer Name = ERIK | Source = iaStor | ID = 262153
Description = The device, \Device\Ide\iaStor0, did not respond within the timeout
period.

Error - 5/10/2011 1:31:15 PM | Computer Name = ERIK | Source = iaStor | ID = 262153
Description = The device, \Device\Ide\iaStor0, did not respond within the timeout
period.

Error - 5/11/2011 3:35:04 PM | Computer Name = ERIK | Source = DCOM | ID = 10010
Description = The server {B1DBD568-80B2-43FA-AE07-76FB23AA4650} did not register
with DCOM within the required timeout.

Error - 5/11/2011 3:39:10 PM | Computer Name = ERIK | Source = DCOM | ID = 10010
Description = The server {98D9A6F1-4696-4B5E-A2E8-36B3F9C1E12C} did not register
with DCOM within the required timeout.

Error - 5/11/2011 3:44:53 PM | Computer Name = ERIK | Source = DCOM | ID = 10010
Description = The server {B1DBD568-80B2-43FA-AE07-76FB23AA4650} did not register
with DCOM within the required timeout.

Error - 5/11/2011 3:44:56 PM | Computer Name = ERIK | Source = DCOM | ID = 10010
Description = The server {078AEF33-C48A-49F7-AFF3-A0EE810BFE7C} did not register
with DCOM within the required timeout.

Error - 5/11/2011 3:52:23 PM | Computer Name = ERIK | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the GoToMyPC service to connect.

Error - 5/11/2011 3:52:23 PM | Computer Name = ERIK | Source = Service Control Manager | ID = 7000
Description = The GoToMyPC service failed to start due to the following error: %%1053

Error - 5/11/2011 4:00:36 PM | Computer Name = ERIK | Source = System Error | ID = 1003
Description = Error code 1000000a, parameter1 98cf08dc, parameter2 0000001c, parameter3
00000001, parameter4 80502cd8.


< End of report >





OTL.Txt

OTL logfile created on: 5/12/2011 11:36:33 AM - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\ERIK GONZALES\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 61.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 76.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 148.97 Gb Total Space | 119.93 Gb Free Space | 80.50% Space Free | Partition Type: NTFS

Computer Name: ERIK | User Name: ERIK GONZALES | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\ERIK GONZALES\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Alwil Software\Avast5\AvastUI.exe (AVAST Software)
PRC - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
PRC - C:\Program Files\Alwil Software\Avast5\afwServ.exe (AVAST Software)
PRC - C:\Program Files\Adobe\Acrobat 9.0\Acrobat\acrotray.exe (Adobe Systems Inc.)
PRC - C:\Program Files\Citrix\GoToMyPC\g2tray.exe (Citrix Online, a division of Citrix Systems, Inc.)
PRC - C:\Program Files\Citrix\GoToMyPC\g2svc.exe (Citrix Online, a division of Citrix Systems, Inc.)
PRC - C:\Program Files\Citrix\GoToMyPC\g2pre.exe (Citrix Online, a division of Citrix Systems, Inc.)
PRC - C:\Program Files\Citrix\GoToMyPC\g2comm.exe (Citrix Online, a division of Citrix Systems, Inc.)
PRC - C:\Program Files\AMS Services\TransactNOW\OALaunch.exe (Vertafore Inc. d/b/a AMS Services)
PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
PRC - C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe (CyberLink Corp.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Brother\Brmfcmon\BrMfcMon.exe (Brother Industries, Ltd.)


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\ERIK GONZALES\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Program Files\Alwil Software\Avast5\snxhk.dll (AVAST Software)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (avast! Antivirus) – C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
SRV - (avast! Firewall) – C:\Program Files\Alwil Software\Avast5\afwServ.exe (AVAST Software)
SRV - (GoToMyPC) – C:\Program Files\Citrix\GoToMyPC\g2svc.exe (Citrix Online, a division of Citrix Systems, Inc.)
SRV - (FLEXnet Licensing Service) – C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.)
SRV - (IAANTMON) Intel® – C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
SRV - (Symantec RemoteAssist) – C:\Program Files\Common Files\Symantec Shared\Support Controls\ssrc.exe (Symantec, Inc.)


========== Driver Services (SafeList) ==========

DRV - (aswFW) – C:\WINDOWS\System32\drivers\aswFW.sys (AVAST Software)
DRV - (aswSnx) – C:\WINDOWS\System32\drivers\aswSnx.sys (AVAST Software)
DRV - (aswSP) – C:\WINDOWS\System32\drivers\aswSP.sys (AVAST Software)
DRV - (aswNdis2) – C:\WINDOWS\System32\drivers\aswNdis2.sys (AVAST Software)
DRV - (aswTdi) – C:\WINDOWS\System32\drivers\aswTdi.sys (AVAST Software)
DRV - (aswMon2) – C:\WINDOWS\System32\drivers\aswmon2.sys (AVAST Software)
DRV - (aswRdr) – C:\WINDOWS\System32\drivers\aswRdr.sys (AVAST Software)
DRV - (Aavmker4) – C:\WINDOWS\System32\drivers\aavmker4.sys (AVAST Software)
DRV - (aswFsBlk) – C:\WINDOWS\System32\drivers\aswFsBlk.sys (AVAST Software)
DRV - (aswNdis) – C:\WINDOWS\system32\DRIVERS\aswNdis.sys (ALWIL Software)
DRV - (RTLE8023xp) – C:\WINDOWS\system32\drivers\Rtenicxp.sys (Realtek Semiconductor Corporation )
DRV - (RTLVLAN) – C:\WINDOWS\system32\drivers\RTLVLAN.SYS (Realtek Semiconductor Corporation )
DRV - (RTLTEAMING) – C:\WINDOWS\system32\drivers\RTLTEAMING.SYS (Realtek Semiconductor Corporation)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) – C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (RtNdPt5x) – C:\WINDOWS\system32\drivers\RtNdPt5x.sys (Realtek Semiconductor Corporation )


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Page_URL = http://g.msn.com/USSMB/1
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.msn.com/sphome.aspx
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Start Page = http://g.msn.com/USSMB/1

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/USSMB/1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.live.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://my.yahoo.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:47392



O1 HOSTS File: ([2008/04/14 07:00:00 | 000,000,734 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Acrobat Assistant 8.0] C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe (Adobe Systems Inc.)
O4 - HKLM..\Run: [Adobe Acrobat Speed Launcher] C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\ALCMTR.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe (Brother Industries, Ltd.)
O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [PDVDDXSrv] C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe (CyberLink Corp.)
O4 - HKCU..\Run: [qhvxcfnd] C:\Documents and Settings\ERIK GONZALES\Local Settings\Temp\aryeqjmsi\goiwqjmxsik.exe ()
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\TransactNOW Monitor.lnk = C:\Program Files\AMS Services\TransactNOW\OALaunch.exe (Vertafore Inc. d/b/a AMS Services)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Append Link Target to Existing PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Append to Existing PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert Link Target to Adobe PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert to Adobe PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKCU\..Trusted Domains: ams360.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: ams-benefits.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: amsservices.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: ams-services.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: ams-support.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: prevailnetwork.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: vertafore.com ([]* in Trusted sites)
O16 - DPF: {1663ed61-23eb-11d2-b92f-008048fdd814} http://hoaic.live.ptsapp.com/systemInfo/ScriptX/smsx.cab (MeadCo ScriptX)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} https://vertaforesupport.webex.com/client/w…ort/ieatgpc.cab (GpcContainer Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.1.102
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\GoToMyPC: DllName - C:\Program Files\Citrix\GoToMyPC\G2WinLogon.dll - C:\Program Files\Citrix\GoToMyPC\G2WinLogon.dll (Citrix Online, a division of Citrix Systems, Inc.)
O24 - Desktop WallPaper: C:\WINDOWS\Dell.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Dell.bmp
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/04/25 16:29:32 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax ()
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll ()

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (57997455953756160)

========== Files/Folders - Created Within 30 Days ==========

[2011/05/12 11:30:50 | 000,580,608 | —- | C] (OldTimer Tools) – C:\Documents and Settings\ERIK GONZALES\Desktop\OTL.exe
[2011/05/11 16:03:47 | 000,000,000 | -HSD | C] – C:\Config.Msi
[2011/04/16 03:06:35 | 000,000,000 | —D | C] – C:\WINDOWS\ServicePackFiles
[2011/04/12 12:58:18 | 000,000,000 | R–D | C] – C:\Documents and Settings\ERIK GONZALES\Start Menu\Programs\Administrative Tools
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/05/12 11:31:00 | 000,580,608 | —- | M] (OldTimer Tools) – C:\Documents and Settings\ERIK GONZALES\Desktop\OTL.exe
[2011/05/11 16:27:28 | 000,001,158 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2011/05/11 16:26:58 | 000,206,492 | —- | M] () – C:\WINDOWS\System32\nvapps.xml
[2011/05/11 16:26:47 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/05/11 16:26:45 | 2146,418,688 | -HS- | M] () – C:\hiberfil.sys
[2011/05/10 10:20:58 | 000,001,731 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk
[2011/05/10 08:19:01 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2011/05/05 15:23:46 | 000,000,485 | —- | M] () – C:\Documents and Settings\ERIK GONZALES\Desktop\PUBLICDOCS.lnk
[2011/04/18 13:37:02 | 000,297,905 | —- | M] () – C:\Documents and Settings\ERIK GONZALES\Desktop\Freeman - Excess Liability.pdf
[2011/04/16 03:22:42 | 000,140,440 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2011/04/16 03:06:02 | 000,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2011/04/16 03:04:51 | 000,467,390 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2011/04/16 03:04:51 | 000,080,338 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/04/18 13:37:02 | 000,297,905 | —- | C] () – C:\Documents and Settings\ERIK GONZALES\Desktop\Freeman - Excess Liability.pdf
[2011/03/31 15:24:24 | 000,012,034 | —- | C] () – C:\Documents and Settings\ERIK GONZALES\Application Data\Comma Separated Values (Windows).CAL
[2010/03/29 11:59:47 | 000,025,788 | -H– | C] () – C:\WINDOWS\System32\mlfcache.dat
[2010/02/05 10:35:13 | 000,038,259 | —- | C] () – C:\Documents and Settings\ERIK GONZALES\Application Data\Microsoft Excel 97-2003.ADR
[2010/02/05 10:35:10 | 000,000,028 | —- | C] () – C:\WINDOWS\ODBC.INI
[2010/02/02 18:18:55 | 000,000,426 | —- | C] () – C:\WINDOWS\BRWMARK.INI
[2010/02/02 18:17:58 | 000,000,212 | —- | C] () – C:\WINDOWS\Brpfx04a.ini
[2010/02/02 18:17:58 | 000,000,093 | —- | C] () – C:\WINDOWS\brpcfx.ini
[2010/02/02 18:17:58 | 000,000,065 | —- | C] () – C:\WINDOWS\System32\bd7340.dat
[2010/02/02 18:17:39 | 000,000,114 | —- | C] () – C:\WINDOWS\System32\BRLMW03A.INI
[2010/02/02 18:17:19 | 000,000,086 | —- | C] () – C:\WINDOWS\Brfaxrx.ini
[2010/02/02 18:17:19 | 000,000,000 | —- | C] () – C:\WINDOWS\brdfxspd.dat
[2010/02/02 18:17:18 | 000,106,496 | —- | C] () – C:\WINDOWS\System32\BrMuSNMP.dll
[2010/01/28 15:09:41 | 000,000,008 | —- | C] () – C:\WINDOWS\System32\nvModes.dat
[2010/01/28 13:54:30 | 000,000,664 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/01/12 03:17:21 | 000,073,728 | —- | C] () – C:\WINDOWS\System32\RtNicProp32.dll
[2010/01/12 03:17:19 | 002,026,604 | —- | C] () – C:\WINDOWS\System32\igkrng500.bin
[2010/01/12 03:17:19 | 000,442,964 | —- | C] () – C:\WINDOWS\System32\igcompkrng500.bin
[2010/01/12 03:17:19 | 000,147,456 | —- | C] () – C:\WINDOWS\System32\igfxCoIn_v4977.dll
[2010/01/12 03:17:11 | 000,077,824 | —- | C] () – C:\WINDOWS\setpwr32.exe
[2010/01/12 03:14:40 | 000,001,152 | —- | C] () – C:\WINDOWS\System32\OEMINFO.INI
[2010/01/12 01:41:02 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2009/08/03 16:07:42 | 000,403,816 | —- | C] () – C:\WINDOWS\System32\OGACheckControl.dll
[2009/08/03 16:07:42 | 000,230,768 | —- | C] () – C:\WINDOWS\System32\OGAEXEC.exe
[2008/12/25 11:08:00 | 001,724,416 | —- | C] () – C:\WINDOWS\System32\nvwdmcpl.dll
[2008/12/25 11:08:00 | 001,657,376 | —- | C] () – C:\WINDOWS\System32\nwiz.exe
[2008/12/25 11:08:00 | 001,507,328 | —- | C] () – C:\WINDOWS\System32\nview.dll
[2008/12/25 11:08:00 | 001,346,080 | —- | C] () – C:\WINDOWS\System32\nvdspsch.exe
[2008/12/25 11:08:00 | 001,101,824 | —- | C] () – C:\WINDOWS\System32\nvwimg.dll
[2008/12/25 11:08:00 | 000,466,944 | —- | C] () – C:\WINDOWS\System32\nvshell.dll
[2008/12/25 11:08:00 | 000,449,056 | —- | C] () – C:\WINDOWS\System32\nvappbar.exe
[2008/12/25 11:08:00 | 000,432,672 | —- | C] () – C:\WINDOWS\System32\keystone.exe
[2008/10/07 10:13:30 | 000,197,912 | —- | C] () – C:\WINDOWS\System32\physxcudart_20.dll
[2008/10/07 10:13:22 | 000,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelTraditionalChinese.dll
[2008/10/07 10:13:20 | 000,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelSwedish.dll
[2008/10/07 10:13:20 | 000,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelSpanish.dll
[2008/10/07 10:13:20 | 000,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelSimplifiedChinese.dll
[2008/10/07 10:13:20 | 000,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelPortugese.dll
[2008/10/07 10:13:20 | 000,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelKorean.dll
[2008/10/07 10:13:20 | 000,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelJapanese.dll
[2008/10/07 10:13:20 | 000,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelGerman.dll
[2008/10/07 10:13:20 | 000,058,648 | —- | C] () – C:\WINDOWS\System32\AgCPanelFrench.dll
[2008/05/26 22:59:42 | 000,018,904 | —- | C] () – C:\WINDOWS\System32\structuredqueryschematrivial.bin
[2008/05/26 22:59:40 | 000,106,605 | —- | C] () – C:\WINDOWS\System32\structuredqueryschema.bin
[2008/04/25 16:31:41 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2008/04/25 16:27:18 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2008/04/25 16:26:32 | 000,001,793 | —- | C] () – C:\WINDOWS\System32\fxsperf.ini
[2008/04/25 11:16:35 | 000,755,200 | —- | C] () – C:\WINDOWS\System32\ir50_32.dll
[2008/04/25 11:16:35 | 000,338,432 | —- | C] () – C:\WINDOWS\System32\ir41_qcx.dll
[2008/04/25 11:16:35 | 000,200,192 | —- | C] () – C:\WINDOWS\System32\ir50_qc.dll
[2008/04/25 11:16:35 | 000,183,808 | —- | C] () – C:\WINDOWS\System32\ir50_qcx.dll
[2008/04/25 11:16:35 | 000,120,320 | —- | C] () – C:\WINDOWS\System32\ir41_qc.dll
[2008/04/25 11:16:24 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2008/04/25 11:16:22 | 000,467,390 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[2008/04/25 11:16:22 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[2008/04/25 11:16:22 | 000,080,338 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[2008/04/25 11:16:22 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[2008/04/25 11:16:22 | 000,004,627 | —- | C] () – C:\WINDOWS\System32\oembios.dat
[2008/04/25 11:16:21 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\oembios.bin
[2008/04/25 11:16:20 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat
[2008/04/25 11:16:18 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[2008/04/25 11:16:18 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\mib.bin
[2008/04/25 11:16:13 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[2008/04/25 11:16:11 | 000,001,804 | —- | C] () – C:\WINDOWS\System32\Dcache.bin
[2008/04/25 04:22:39 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2008/04/25 04:21:52 | 000,140,440 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2007/09/27 11:51:02 | 000,020,698 | —- | C] () – C:\WINDOWS\System32\idxcntrs.ini
[2007/09/27 11:48:48 | 000,030,628 | —- | C] () – C:\WINDOWS\System32\gsrvctr.ini
[2007/09/27 11:48:28 | 000,031,698 | —- | C] () – C:\WINDOWS\System32\gthrctr.ini

========== LOP Check ==========

[2010/11/11 14:23:44 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Alwil Software
[2010/02/02 17:49:06 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\CitrixLogs
[2010/10/12 09:54:19 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PCSettings
[2010/06/22 11:16:53 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2010/02/05 14:31:50 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2010/04/13 17:34:29 | 000,000,000 | —D | M] – C:\Documents and Settings\ERIK GONZALES\Application Data\AMS Services
[2010/02/04 16:03:31 | 000,000,000 | —D | M] – C:\Documents and Settings\ERIK GONZALES\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2011/05/11 16:27:28 | 000,000,000 | —D | M] – C:\Documents and Settings\ERIK GONZALES\Application Data\OA
[2010/04/13 09:48:44 | 000,000,000 | —D | M] – C:\Documents and Settings\ERIK GONZALES\Application Data\Tific
[2010/01/12 01:28:08 | 000,000,000 | —D | M] – C:\Documents and Settings\ERIK GONZALES\Application Data\Windows Desktop Search
[2010/02/02 17:21:22 | 000,000,000 | —D | M] – C:\Documents and Settings\ERIK GONZALES\Application Data\Windows Search

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2008/04/25 16:29:32 | 000,000,000 | —- | M] () – C:\AUTOEXEC.BAT
[2010/01/28 13:51:55 | 000,000,211 | RHS- | M] () – C:\boot.ini
[2008/01/19 01:45:46 | 000,333,203 | RHS- | M] () – C:\bootmgr
[2008/04/25 16:29:32 | 000,000,000 | —- | M] () – C:\CONFIG.SYS
[2010/01/12 03:19:08 | 000,028,367 | RH– | M] () – C:\dell.sdr
[2011/05/11 16:26:45 | 2146,418,688 | -HS- | M] () – C:\hiberfil.sys
[2008/04/25 16:29:32 | 000,000,000 | -H– | M] () – C:\IO.SYS
[2008/04/25 16:29:32 | 000,000,000 | -H– | M] () – C:\MSDOS.SYS
[2008/04/14 07:00:00 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2008/04/14 07:00:00 | 000,250,048 | RHS- | M] () – C:\ntldr
[2011/05/11 16:26:44 | 2145,386,496 | -HS- | M] () – C:\pagefile.sys

< %systemroot%\Fonts\*.com >
[2006/04/18 22:39:28 | 000,026,040 | —- | M] () – C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 21:53:56 | 000,026,489 | —- | M] () – C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 22:39:28 | 000,029,779 | —- | M] () – C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 21:58:52 | 000,030,808 | —- | M] () – C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2008/04/25 16:29:00 | 000,000,067 | -HS- | M] () – C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/07/06 07:06:10 | 000,089,088 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2010/07/26 13:42:54 | 000,052,080 | —- | M] (Citrix Online, a division of Citrix Systems, Inc.) – C:\WINDOWS\system32\spool\prtprocs\w32x86\GoToPrintProcessor.dll
[2008/07/06 05:50:03 | 000,597,504 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2011/02/23 09:04:21 | 000,040,648 | —- | M] (AVAST Software) – C:\WINDOWS\avastSS.scr
[2009/07/10 13:15:46 | 000,306,544 | —- | M] (Microsoft Corporation) – C:\WINDOWS\WLXPGSS.SCR

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2008/04/25 04:21:09 | 000,094,208 | —- | M] () – C:\WINDOWS\system32\config\default.sav
[2008/04/25 04:21:09 | 001,089,536 | —- | M] () – C:\WINDOWS\system32\config\software.sav
[2008/04/25 04:21:09 | 000,905,216 | —- | M] () – C:\WINDOWS\system32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2008/04/25 16:29:41 | 000,000,294 | -HS- | M] () – C:\Documents and Settings\All Users\Start Menu\desktop.ini

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2010/01/28 13:54:07 | 000,000,119 | -HS- | M] () – C:\Documents and Settings\ERIK GONZALES\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
[2008/04/25 16:33:01 | 000,000,079 | —- | M] () – C:\Documents and Settings\ERIK GONZALES\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

< %USERPROFILE%\Desktop\*.exe >
[2010/07/28 11:14:17 | 023,183,776 | —- | M] (AMS Services, Inc. ) – C:\Documents and Settings\ERIK GONZALES\Desktop\AMS360ClientInstaller.exe
[2010/07/30 16:22:45 | 103,981,016 | —- | M] (Symantec Corporation) – C:\Documents and Settings\ERIK GONZALES\Desktop\NIS-UPGRADE-ESD-17-6-0-32-EN.exe
[2011/05/12 11:31:00 | 000,580,608 | —- | M] (OldTimer Tools) – C:\Documents and Settings\ERIK GONZALES\Desktop\OTL.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-05-11 21:04:00

< >

< End of report >

ComboFix 11-05-15.04 - ERIK GONZALES 05/16/2011 9:51.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1402 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: avast! Internet Security *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: avast! Internet Security *Disabled* {7591DB91-41F0-48A3-B128-1A293FD8233D}
* Created a new restore point
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\ERIK GONZALES\g2mdlhlpx.exe
c:\windows\system32\gotomon.log
.
.
((((((((((((((((((((((((( Files Created from 2011-04-16 to 2011-05-16 )))))))))))))))))))))))))))))))
.
.
2011-05-13 19:36 . 2011-05-13 19:36 ——– d—–w- c:\documents and settings\ERIK GONZALES\Application Data\Malwarebytes
2011-05-13 19:36 . 2011-05-13 19:36 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2011-05-13 19:36 . 2010-12-20 23:09 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-05-13 19:36 . 2011-05-13 19:36 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2011-05-13 19:36 . 2010-12-20 23:08 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-03-07 05:33 . 2008-04-25 21:27 692736 —-a-w- c:\windows\system32\inetcomm.dll
2011-03-04 06:45 . 2008-04-25 16:16 434176 —-a-w- c:\windows\system32\vbscript.dll
2011-03-03 13:27 . 2008-04-25 16:16 1866880 —-a-w- c:\windows\system32\win32k.sys
2011-02-23 14:04 . 2010-11-11 19:23 40648 —-a-w- c:\windows\avastSS.scr
2011-02-23 14:04 . 2010-11-11 19:23 190016 —-a-w- c:\windows\system32\aswBoot.exe
2011-02-23 13:57 . 2010-11-11 19:24 101976 —-a-w- c:\windows\system32\drivers\aswFW.sys
2011-02-23 13:56 . 2010-11-11 19:24 371544 —-a-w- c:\windows\system32\drivers\aswSnx.sys
2011-02-23 13:56 . 2010-11-11 19:24 301528 —-a-w- c:\windows\system32\drivers\aswSP.sys
2011-02-23 13:56 . 2010-11-11 19:24 192728 —-a-w- c:\windows\system32\drivers\aswNdis2.sys
2011-02-23 13:55 . 2010-11-11 19:24 49240 —-a-w- c:\windows\system32\drivers\aswTdi.sys
2011-02-23 13:55 . 2010-11-11 19:24 102232 —-a-w- c:\windows\system32\drivers\aswmon2.sys
2011-02-23 13:55 . 2010-11-11 19:24 96344 —-a-w- c:\windows\system32\drivers\aswmon.sys
2011-02-23 13:55 . 2010-11-11 19:24 25432 —-a-w- c:\windows\system32\drivers\aswRdr.sys
2011-02-23 13:54 . 2010-11-11 19:24 30680 —-a-w- c:\windows\system32\drivers\aavmker4.sys
2011-02-23 13:54 . 2010-11-11 19:24 19544 —-a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-02-17 19:00 . 2008-04-25 16:16 832512 —-a-w- c:\windows\system32\wininet.dll
2011-02-17 19:00 . 2010-03-10 18:07 78336 —-a-w- c:\windows\system32\ieencode.dll
2011-02-17 19:00 . 2008-04-25 16:16 1830912 —-a-w- c:\windows\system32\inetcpl.cpl
2011-02-17 19:00 . 2008-04-25 16:16 17408 —-a-w- c:\windows\system32\corpol.dll
2011-02-17 13:18 . 2008-04-25 16:16 455936 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-02-17 13:18 . 2008-04-25 16:16 357888 —-a-w- c:\windows\system32\drivers\srv.sys
2011-02-17 12:32 . 2009-11-03 22:26 5120 —-a-w- c:\windows\system32\xpsp4res.dll
2011-02-17 11:44 . 2008-04-25 16:16 389120 —-a-w- c:\windows\system32\html.iec
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-02-23 14:04 122512 —-a-w- c:\program files\Alwil Software\Avast5\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2008-08-18 16806912]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-08-18 150040]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-08-18 178712]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-08-18 150040]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-02-11 186904]
"Adobe Acrobat Speed Launcher"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" [2011-01-31 38840]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" [2010-09-23 640440]
"PDVDDXSrv"="c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2009-02-05 128232]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-12-25 13680640]
"nwiz"="nwiz.exe" [2008-12-25 1657376]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-12-25 86016]
"BrMfcWnd"="c:\program files\Brother\Brmfcmon\BrMfcWnd.exe" [2009-02-10 745472]
"ControlCenter3"="c:\program files\Brother\ControlCenter3\brctrcen.exe" [2007-10-30 77824]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
"avast5"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2011-02-23 3451496]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-09-08 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-11-18 421160]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-01-31 35760]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
TransactNOW Monitor.lnk - c:\program files\AMS Services\TransactNOW\OALaunch.exe [2010-3-24 156672]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToMyPC]
2010-07-26 18:42 15216 —-a-w- c:\program files\Citrix\GoToMyPC\G2WinLogon.dll
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
.
R0 aswNdis;avast! Firewall NDIS Filter Service;c:\windows\system32\drivers\aswNdis.sys [11/11/2010 2:23 PM 12112]
R0 aswNdis2;avast! Firewall Core Firewall Service;c:\windows\system32\drivers\aswNdis2.sys [11/11/2010 2:24 PM 192728]
R1 aswFW;avast! TDI Firewall driver;c:\windows\system32\drivers\aswFW.sys [11/11/2010 2:24 PM 101976]
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [11/11/2010 2:24 PM 371544]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [11/11/2010 2:24 PM 301528]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [11/11/2010 2:24 PM 19544]
R2 RtNdPt5x;Realtek NDIS Protocol Driver;c:\windows\system32\drivers\RtNdPt5x.sys [1/12/2010 1:28 AM 22016]
S2 avast! Firewall;avast! Firewall;c:\program files\Alwil Software\Avast5\afwServ.exe [11/11/2010 2:23 PM 121000]
S3 RTLTEAMING;Realtek Intermediate Driver for Ethernet Extended Features;c:\windows\system32\drivers\RTLTEAMING.SYS [1/12/2010 1:28 AM 28800]
S3 RTLVLAN;Realtek VLAN Intermediate Driver;c:\windows\system32\drivers\RTLVLAN.SYS [1/12/2010 1:28 AM 17536]
.
Contents of the 'Scheduled Tasks' folder
.
2011-05-10 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 18:34]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://my.yahoo.com/
uInternet Settings,ProxyServer = http=127.0.0.1:47392
IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
Trusted Zone: ams-benefits.com
Trusted Zone: ams-services.com
Trusted Zone: ams-support.com
Trusted Zone: ams360.com
Trusted Zone: amsservices.com
Trusted Zone: prevailnetwork.com
Trusted Zone: vertafore.com
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-05-16 09:57
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
.
C:\## aswSnx private storage
.
scan completed successfully
hidden files: 1
.
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\S-1-5-21-2153744994-2716342797-388061744-1005\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10p_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10p_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(1116)
c:\program files\Citrix\GoToMyPC\G2WinLogon.dll
.
Completion time: 2011-05-16 09:59:35
ComboFix-quarantined-files.txt 2011-05-16 14:59
.
Pre-Run: 128,614,522,880 bytes free
Post-Run: 128,728,473,600 bytes free
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - 662FD94CF9A5AFA09D01836415443576