wilma1313
that helps.
I'm at the i386 one
Spyware / Malware / Virus Removal
fake critical error warning windows xp :-9
67 min read
oldman960
Hi wilma1313,
Ok good. Let's see if we can copy the file.
type copy volsnap.sys C:\windows\system32\drivers
note the space after copy and the space after .sys
Hit enter. You should recieve a message 1 file(s) copied.
Let me know how you make out.
Ok good. Let's see if we can copy the file.
type copy volsnap.sys C:\windows\system32\drivers
note the space after copy and the space after .sys
Hit enter. You should recieve a message 1 file(s) copied.
Let me know how you make out.
wilma1313
1 file copied, it says
oldman960
Hi wilma1313,
Good job.
type exit and hit enter. Your computer should now boot to windows. It may take a brief pause as it closes the Recovery Console.
Post back when you are back in windows and let me know if the computer is better or the same.
Good job.
type exit and hit enter. Your computer should now boot to windows. It may take a brief pause as it closes the Recovery Console.
Post back when you are back in windows and let me know if the computer is better or the same.
wilma1313
windows is loading very slowly and I am going to bed. Very happy to see windows back
thanks 
he will do some stuff on the computer tomorrow and I'll post back how its going.
he will do some stuff on the computer tomorrow and I'll post back how its going.
oldman960
Hi wilma1313,
Ok. We may have some more to do. Post back as soon as you can.
wilma1313
No redirects, seems normal for the most part.
thanks 
what else to do ?
what else to do ?
oldman960
Hi wilma1313,
Good to hear.
Please click start > Control Panel > Add/Remove Programs and uninstall
J2SE Runtime Environment 5.0 Update 2
Do not uninstall Java TM 6 Update 24 if found!
Next
If you haven't all ready downloaded and installed Malwarebytes Anti-Malware you can get a copy from Malwarebytes Anti-Malware
Download it and save to your desktop
Double Click mbam-setup.exe to install the application.
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.
Next
Please post back with
Thanks
Good to hear.
Please click start > Control Panel > Add/Remove Programs and uninstall
J2SE Runtime Environment 5.0 Update 2
Do not uninstall Java TM 6 Update 24 if found!
Next
If you haven't all ready downloaded and installed Malwarebytes Anti-Malware you can get a copy from Malwarebytes Anti-Malware
Download it and save to your desktop
Double Click mbam-setup.exe to install the application.
- Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
- If an update is found, it will download and install the latest version.
- Once the program has loaded, select "Perform Quick Scan", then click Scan.
- The scan may take some time to finish,so please be patient.
- When the scan is complete, click OK, then Show Results to view the results.
- Make sure that everything is checked, and click Remove Selected.
- When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
- The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
- Copy&Paste the entire report in your next reply.
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.
Next
- Double click on OTL.exe to run it. Make sure all other windows are closed and to let it run uninterrupted.
- When the window appears, underneath Output at the top change it to Minimal Output
- UNCheck the boxes beside LOP Check and Purity Check.
- In the window under Custom Scans/Fixes copy and paste the following
/md5start
volsnap.*
/md5stop
- Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
Please post back with
- MBAM log
- OTL.txt
Thanks
wilma1313
seems to be running ok. No more redirects. Slow, but I think it has been since before the infection, its old. Windows got hung up and would not load beyond the walpaper once this morn, but other wise is ok. MBAM was clean. here are the scans. Thanks!
Malwarebytes' Anti-Malware 1.51.0.1200
www.malwarebytes.org
Database version: 6955
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702
6/26/2011 3:52:35 PM
mbam-log-2011-06-26 (15-52-32).txt
Scan type: Quick scan
Objects scanned: 184740
Time elapsed: 1 hour(s), 1 minute(s), 17 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)
OTL logfile created on: 6/26/2011 4:34:50 PM - Run 4
OTL by OldTimer - Version 3.2.24.0 Folder = C:\Documents and Settings\Owner.Miguel\Desktop\infectio
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
1.87 Gb Total Physical Memory | 1.25 Gb Available Physical Memory | 66.66% Memory free
3.72 Gb Paging File | 3.10 Gb Available in Paging File | 83.35% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 142.20 Gb Total Space | 97.65 Gb Free Space | 68.67% Space Free | Partition Type: NTFS
Drive D: | 6.83 Gb Total Space | 4.83 Gb Free Space | 70.71% Space Free | Partition Type: FAT32
Computer Name: MIGUEL | User Name: Owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - C:\Documents and Settings\Owner.Miguel\Desktop\infectio\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe (McAfee, Inc.)
PRC - C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe (McAfee, Inc.)
PRC - C:\WINDOWS\system32\mfevtps.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee Online Backup\MOBK370stat.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee Online Backup\MOBK370backup.exe (McAfee, Inc.)
PRC - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe ()
PRC - C:\Garmin\gStart.exe (GARMIN Corp.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS (New Boundary Technologies, Inc.)
PRC - C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe (Motorola Inc.)
PRC - C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe (ATI Technologies Inc.)
PRC - C:\WINDOWS\stsystra.exe (SigmaTel, Inc.)
PRC - C:\Program Files\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.)
========== Modules (SafeList) ==========
MOD - C:\Documents and Settings\Owner.Miguel\Desktop\infectio\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)
MOD - C:\Program Files\McAfee\SiteAdvisor\sahook.dll ()
MOD - C:\WINDOWS\system32\SynTPFcs.dll (Synaptics, Inc.)
========== Win32 Services (SafeList) ==========
SRV - (mfefire) – C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe (McAfee, Inc.)
SRV - (McShield) – C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe ()
SRV - (mfevtp) – C:\WINDOWS\system32\mfevtps.exe (McAfee, Inc.)
SRV - (MOBK370backup) – C:\Program Files\McAfee Online Backup\MOBK370backup.exe (McAfee, Inc.)
SRV - (McODS) – C:\Program Files\McAfee\VirusScan\mcods.exe (McAfee, Inc.)
SRV - (MSK80Service) – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McProxy) – C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McNASvc) – C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McNaiAnn) – C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (mcmscsvc) – C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McMPFSvc) – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McAfee SiteAdvisor Service) – C:\Program Files\McAfee\SiteAdvisor\McSACore.exe ()
SRV - (PrismXL) – C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS (New Boundary Technologies, Inc.)
========== Driver Services (SafeList) ==========
DRV - (VolSnap) – C:\WINDOWS\System32\drivers\volsnap.new ()
DRV - (mfehidk) – C:\WINDOWS\system32\drivers\mfehidk.sys (McAfee, Inc.)
DRV - (mfefirek) – C:\WINDOWS\system32\drivers\mfefirek.sys (McAfee, Inc.)
DRV - (mfeavfk) – C:\WINDOWS\system32\drivers\mfeavfk.sys (McAfee, Inc.)
DRV - (mfeapfk) – C:\WINDOWS\system32\drivers\mfeapfk.sys (McAfee, Inc.)
DRV - (mfendiskmp) – C:\WINDOWS\system32\drivers\mfendisk.sys (McAfee, Inc.)
DRV - (mfendisk) – C:\WINDOWS\system32\drivers\mfendisk.sys (McAfee, Inc.)
DRV - (mferkdet) – C:\WINDOWS\system32\drivers\mferkdet.sys (McAfee, Inc.)
DRV - (mfetdi2k) – C:\WINDOWS\system32\drivers\mfetdi2k.sys (McAfee, Inc.)
DRV - (cfwids) – C:\WINDOWS\system32\drivers\cfwids.sys (McAfee, Inc.)
DRV - (mfebopk) – C:\WINDOWS\system32\drivers\mfebopk.sys (McAfee, Inc.)
DRV - (MOBK370Filter) – C:\WINDOWS\system32\drivers\MOBK370.sys (Mozy, Inc.)
DRV - (NwlnkIpx) – C:\WINDOWS\system32\drivers\nwlnkipx.sys (Microsoft Corporation)
DRV - (ASCTRM) – C:\WINDOWS\System32\drivers\asctrm.sys (Windows ® 2000 DDK provider)
DRV - (AmdK8) – C:\WINDOWS\system32\drivers\AmdK8.sys (Advanced Micro Devices)
DRV - (STHDA) – C:\WINDOWS\system32\drivers\sthda.sys (SigmaTel, Inc.)
DRV - (smserial) – C:\WINDOWS\system32\drivers\smserial.sys (Motorola Inc.)
DRV - (yukonwxp) – C:\WINDOWS\system32\drivers\yk51x86.sys (Marvell)
DRV - (ati2mtag) – C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (BCM43XX) – C:\WINDOWS\system32\drivers\BCMWL5.SYS (Broadcom Corporation)
DRV - (tifm21) – C:\WINDOWS\system32\drivers\tifm21.sys (Texas Instruments)
DRV - (Cdralw2k) – C:\WINDOWS\System32\drivers\cdralw2k.sys (Roxio)
DRV - (Cdr4_xp) – C:\WINDOWS\System32\drivers\cdr4_xp.sys (Roxio)
DRV - (NwlnkNb) – C:\WINDOWS\system32\drivers\nwlnknb.sys (Microsoft Corporation)
DRV - (NwlnkSpx) – C:\WINDOWS\system32\drivers\nwlnkspx.sys (Microsoft Corporation)
DRV - (wanatw) WAN Miniport (ATW) – C:\WINDOWS\system32\drivers\wanatw4.sys (America Online, Inc.)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = ibahn:80
FF - HKLM\software\mozilla\Firefox\Extensions\\{B7082FAA-CB62-4872-9106-E42DD88EDE45}: C:\Program Files\McAfee\SiteAdvisor [2010/03/02 22:12:15 | 000,000,000 | —D | M]
[2009/12/26 15:21:27 | 000,000,000 | -H-D | M] (No name found) – C:\Documents and Settings\Owner.Miguel\Application Data\Mozilla\Extensions
[2009/12/26 15:21:27 | 000,000,000 | -H-D | M] (No name found) – C:\Documents and Settings\Owner.Miguel\Application Data\Mozilla\Extensions\[removed]
O1 HOSTS File: ([2011/06/16 20:00:42 | 000,000,027 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - File not found
O2 - BHO: (McAfee Phishing Filter) - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\Program Files\McAfee\MSK\mskapbho.dll ()
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20110517161831.dll (McAfee, Inc.)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\Program Files\Google\GoogleToolbar2.dll (Google Inc.)
O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll ()
O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\WINDOWS\system32\bae.dll (Gateway Inc.)
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll ()
O3 - HKLM\..\Toolbar: (&Google) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar2.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar2.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [ATICCC] C:\Program Files\ATI Technologies\ATI.ACE\cli.exe (ATI Technologies Inc.)
O4 - HKLM..\Run: [mcui_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
O4 - HKLM..\Run: [Recguard] C:\WINDOWS\SMINST\Recguard.exe ()
O4 - HKLM..\Run: [Reminder] C:\WINDOWS\creator\Remind_XP.exe (SoftThinks)
O4 - HKLM..\Run: [SigmatelSysTrayApp] C:\WINDOWS\stsystra.exe (SigmaTel, Inc.)
O4 - HKLM..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe (Motorola Inc.)
O4 - HKLM..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.)
O4 - HKCU..\Run: [gStart] C:\Garmin\gStart.exe (GARMIN Corp.)
O4 - HKCU..\Run: [Power2GoExpress] File not found
O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Online Backup Status.lnk = C:\Program Files\McAfee Online Backup\MOBK370stat.exe (McAfee, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE (Microsoft Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme ()
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} http://download.mcafee.com/molbin/shared/m…01/mcinsctl.cab (McAfee.com Operating System Class)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwa…ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll ()
O18 - Protocol\Handler\skype4com - No CLSID value found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop WallPaper: C:\Documents and Settings\Owner.Miguel\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Owner.Miguel\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/06/17 04:41:16 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
========== Files/Folders - Created Within 30 Days ==========
[2011/06/26 14:49:28 | 000,022,712 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2011/06/26 14:29:16 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\McAfee
[2011/06/18 18:38:08 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner.Miguel\Application Data\Malwarebytes
[2011/06/18 18:38:04 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/06/18 18:38:03 | 000,039,984 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011/06/18 18:38:03 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2011/06/18 18:37:56 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2011/06/18 18:31:55 | 009,435,312 | —- | C] (Malwarebytes Corporation ) – C:\Documents and Settings\Owner.Miguel\Desktop\mbam-setup-1.51.0.1200.exe
[2011/06/16 20:30:58 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2011/06/16 20:11:28 | 000,000,000 | —D | C] – C:\WINDOWS\temp
[2011/06/16 19:32:45 | 000,000,000 | RHSD | C] – C:\cmdcons
[2011/06/16 19:28:17 | 000,518,144 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2011/06/16 19:28:17 | 000,406,528 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2011/06/16 19:28:17 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2011/06/16 19:28:17 | 000,060,416 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2011/06/16 19:28:06 | 000,000,000 | —D | C] – C:\WINDOWS\ERDNT
[2011/06/16 19:28:00 | 000,000,000 | —D | C] – C:\Qoobox
[2011/06/16 19:14:24 | 004,608,744 | —- | C] (Microsoft Corporation) – C:\Documents and Settings\Owner.Miguel\Desktop\WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[2011/06/16 17:28:37 | 000,105,472 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mup.sys
[2011/06/13 20:12:57 | 000,000,000 | —D | C] – C:\_OTL
[2011/06/11 20:31:38 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner.Miguel\Desktop\infectio
[2011/06/11 17:29:23 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Owner.Miguel\Recent
[2011/06/11 08:28:35 | 000,000,000 | -H-D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\iTunes
[2011/06/11 08:26:59 | 000,000,000 | —D | C] – C:\Program Files\iPod
[2011/06/04 16:28:25 | 000,000,000 | -H-D | C] – C:\Documents and Settings\Owner.Miguel\Local Settings\Application Data\Garmin
[2011/06/04 16:22:28 | 000,000,000 | -H-D | C] – C:\Documents and Settings\Owner.Miguel\Application Data\GARMIN
[2011/06/04 16:19:34 | 000,000,000 | —D | C] – C:\Program Files\Garmin
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\Documents and Settings\Owner.Miguel\Local Settings\Application Data\*.tmp files -> C:\Documents and Settings\Owner.Miguel\Local Settings\Application Data\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2011/06/26 16:42:01 | 000,000,884 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/06/26 15:59:22 | 000,040,652 | —- | M] () – C:\WINDOWS\MOBK370.blk
[2011/06/26 15:59:20 | 000,003,150 | —- | M] () – C:\WINDOWS\MOBK370.flt
[2011/06/26 15:42:07 | 000,000,880 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/06/26 15:00:41 | 000,052,352 | —- | M] () – C:\WINDOWS\System32\drivers\volsnap.new
[2011/06/26 14:49:56 | 000,000,802 | —- | M] () – C:\Documents and Settings\Owner.Miguel\Application Data\Microsoft\Internet Explorer\Quick Launch\Malwarebytes' Anti-Malware.lnk
[2011/06/26 14:49:56 | 000,000,784 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/06/26 14:22:31 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/06/26 14:22:08 | 2011,279,360 | -HS- | M] () – C:\hiberfil.sys
[2011/06/26 12:24:59 | 000,001,158 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2011/06/18 23:01:03 | 000,445,044 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2011/06/18 23:01:02 | 000,072,754 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2011/06/18 22:24:01 | 000,000,248 | —- | M] () – C:\Documents and Settings\Owner.Miguel\Desktop\PaperBack Swap.com.url
[2011/06/18 22:22:38 | 000,000,214 | —- | M] () – C:\Documents and Settings\Owner.Miguel\Desktop\BookMooch Member Home (2).url
[2011/06/18 18:40:59 | 000,000,000 | —- | M] () – C:\Documents and Settings\Owner.Miguel\defogger_reenable
[2011/06/18 18:31:56 | 009,435,312 | —- | M] (Malwarebytes Corporation ) – C:\Documents and Settings\Owner.Miguel\Desktop\mbam-setup-1.51.0.1200.exe
[2011/06/16 20:00:42 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2011/06/16 19:48:00 | 000,000,552 | —- | M] () – C:\WINDOWS\System32\d3d8caps.dat
[2011/06/16 19:33:01 | 000,000,337 | RHS- | M] () – C:\boot.ini
[2011/06/16 19:14:31 | 004,608,744 | —- | M] (Microsoft Corporation) – C:\Documents and Settings\Owner.Miguel\Desktop\WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[2011/06/16 18:24:59 | 000,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2011/06/15 18:22:40 | 000,000,664 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2011/06/14 21:14:22 | 000,000,000 | —- | M] () – C:\Documents and Settings\Owner.Miguel\Local Settings\Application Data\{2B5BC5F7-91CB-405E-843E-60C7B745449B}
[2011/06/11 08:28:35 | 000,001,542 | -H– | M] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2011/05/30 17:19:48 | 005,964,800 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mshtml.dll
[2011/05/29 09:11:30 | 000,039,984 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011/05/29 09:11:20 | 000,022,712 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\Documents and Settings\Owner.Miguel\Local Settings\Application Data\*.tmp files -> C:\Documents and Settings\Owner.Miguel\Local Settings\Application Data\*.tmp -> ]
========== Files Created - No Company Name ==========
[2011/06/26 14:49:56 | 000,000,802 | —- | C] () – C:\Documents and Settings\Owner.Miguel\Application Data\Microsoft\Internet Explorer\Quick Launch\Malwarebytes' Anti-Malware.lnk
[2011/06/26 14:49:56 | 000,000,784 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/06/19 14:57:39 | 2011,279,360 | -HS- | C] () – C:\hiberfil.sys
[2011/06/18 18:40:59 | 000,000,000 | —- | C] () – C:\Documents and Settings\Owner.Miguel\defogger_reenable
[2011/06/16 19:48:00 | 000,000,552 | —- | C] () – C:\WINDOWS\System32\d3d8caps.dat
[2011/06/16 19:33:01 | 000,000,221 | —- | C] () – C:\Boot.bak
[2011/06/16 19:32:55 | 000,260,272 | RHS- | C] () – C:\cmldr
[2011/06/16 19:28:17 | 000,256,512 | —- | C] () – C:\WINDOWS\PEV.exe
[2011/06/16 19:28:17 | 000,208,896 | —- | C] () – C:\WINDOWS\MBR.exe
[2011/06/16 19:28:17 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2011/06/16 19:28:17 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2011/06/16 19:28:17 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2011/06/16 17:47:33 | 000,000,788 | —- | C] () – C:\Documents and Settings\Owner.Miguel\Desktop\Windows Media Player.lnk
[2011/06/14 21:14:22 | 000,000,000 | —- | C] () – C:\Documents and Settings\Owner.Miguel\Local Settings\Application Data\{2B5BC5F7-91CB-405E-843E-60C7B745449B}
[2011/06/13 20:13:13 | 000,001,542 | -H– | C] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2011/06/13 20:13:13 | 000,000,800 | -H– | C] () – C:\Documents and Settings\Owner.Miguel\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk
[2011/06/13 20:13:13 | 000,000,079 | -H– | C] () – C:\Documents and Settings\Owner.Miguel\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf
[2011/06/13 20:13:12 | 000,002,104 | -H– | C] () – C:\Documents and Settings\Owner.Miguel\Application Data\Microsoft\Internet Explorer\Quick Launch\Play Games.lnk
[2011/06/13 20:13:12 | 000,001,854 | -H– | C] () – C:\Documents and Settings\Owner.Miguel\Application Data\Microsoft\Internet Explorer\Quick Launch\Apple Safari.lnk
[2011/06/13 20:13:12 | 000,001,757 | -H– | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
[2011/06/13 20:13:12 | 000,001,725 | -H– | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
[2011/06/13 20:13:12 | 000,001,478 | -H– | C] () – C:\Documents and Settings\Owner.Miguel\Application Data\Microsoft\Internet Explorer\Quick Launch\Media Center.lnk
[2011/06/13 20:13:12 | 000,000,815 | -H– | C] () – C:\Documents and Settings\Owner.Miguel\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2011/06/13 20:13:12 | 000,000,746 | -H– | C] () – C:\Documents and Settings\Owner.Miguel\Application Data\Microsoft\Internet Explorer\Quick Launch\Gateway Games.lnk
[2011/06/13 20:12:59 | 000,001,986 | -H– | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\MSN.lnk
[2011/06/13 20:12:59 | 000,001,854 | -H– | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Safari.lnk
[2011/06/13 20:12:59 | 000,001,077 | -H– | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Windows Live ID.lnk
[2011/06/13 20:12:59 | 000,000,786 | -H– | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Windows Movie Maker.lnk
[2011/06/13 20:12:59 | 000,000,621 | -H– | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Wireless SecureEasySetup.lnk
[2011/06/13 20:12:59 | 000,000,609 | -H– | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Windows Messenger.lnk
[2011/06/13 20:12:58 | 000,002,479 | -H– | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Word.lnk
[2011/06/13 20:12:58 | 000,002,046 | -H– | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Outlook.lnk
[2011/06/13 20:12:58 | 000,002,030 | -H– | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Excel.lnk
[2011/06/13 20:12:58 | 000,002,002 | -H– | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft PowerPoint.lnk
[2011/06/13 20:12:58 | 000,001,998 | -H– | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft FrontPage.lnk
[2011/06/13 20:12:58 | 000,001,990 | -H– | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Access.lnk
[2011/06/13 20:12:58 | 000,001,830 | -H– | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Apple Software Update.lnk
[2011/06/13 20:12:58 | 000,001,810 | -H– | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Adobe Reader 7.0.lnk
[2011/06/13 20:12:58 | 000,001,775 | -H– | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Office PowerPoint Viewer 2003.lnk
[2011/06/13 20:12:58 | 000,001,701 | -H– | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Works Task Launcher.lnk
[2011/06/13 20:12:58 | 000,001,466 | -H– | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Media Center.lnk
[2011/06/13 20:12:58 | 000,001,004 | -H– | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Money 2006.lnk
[2011/06/11 18:30:12 | 000,000,795 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Online Backup Status.lnk
[2011/06/11 18:24:27 | 000,000,248 | —- | C] () – C:\Documents and Settings\Owner.Miguel\Desktop\PaperBack Swap.com.url
[2011/06/11 18:19:40 | 000,000,214 | —- | C] () – C:\Documents and Settings\Owner.Miguel\Desktop\BookMooch Member Home (2).url
[2010/04/10 21:26:16 | 000,000,664 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/04/04 22:05:39 | 000,028,792 | -H– | C] () – C:\WINDOWS\System32\mlfcache.dat
[2008/06/07 13:09:54 | 000,000,056 | -H– | C] () – C:\WINDOWS\System32\ezsidmv.dat
[2007/05/26 16:27:56 | 000,002,206 | —- | C] () – C:\WINDOWS\unins000.dat
[2007/05/16 08:47:50 | 000,001,774 | -H– | C] () – C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2007/03/28 13:19:15 | 000,000,002 | —- | C] () – C:\WINDOWS\msoffice.ini
[2007/03/17 18:22:59 | 000,010,752 | -H– | C] () – C:\Documents and Settings\Owner.Miguel\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2006/11/08 21:08:45 | 000,032,768 | —- | C] () – C:\WINDOWS\System32\instlsp.exe
[2006/11/08 15:47:14 | 000,000,135 | -H– | C] () – C:\Documents and Settings\Owner.Miguel\Local Settings\Application Data\fusioncache.dat
[2006/10/04 02:01:07 | 000,023,552 | —- | C] () – C:\WINDOWS\System32\jesterss.dll
[2006/10/04 01:46:48 | 000,000,335 | —- | C] () – C:\WINDOWS\nsreg.dat
[2006/10/04 01:46:05 | 000,000,004 | —- | C] () – C:\WINDOWS\Pix11.dat
[2006/10/04 01:41:06 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2006/10/04 01:15:28 | 000,125,796 | —- | C] () – C:\WINDOWS\System32\atiicdxx.dat
[2006/10/04 01:14:37 | 000,018,944 | —- | C] () – C:\WINDOWS\System32\WLTRYSVC.EXE
[2006/10/04 01:14:36 | 000,086,016 | —- | C] () – C:\WINDOWS\System32\preflib.dll
[2006/10/04 01:14:20 | 000,757,760 | —- | C] () – C:\WINDOWS\System32\bcm1xsup.dll
[2006/06/21 04:48:15 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2006/06/21 04:12:42 | 000,352,256 | —- | C] () – C:\WINDOWS\System32\HotlineClient.exe
[2006/06/17 04:44:22 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2006/06/17 04:37:18 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2006/06/17 04:24:58 | 000,001,280 | —- | C] () – C:\WINDOWS\System32\oeminfo.ini
[2006/06/17 04:24:57 | 000,000,519 | —- | C] () – C:\WINDOWS\System32\emver.ini
[2006/06/17 04:23:25 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2006/06/17 04:23:22 | 000,445,044 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[2006/06/17 04:23:22 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[2006/06/17 04:23:22 | 000,072,754 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[2006/06/17 04:23:22 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[2006/06/17 04:23:20 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\oembios.bin
[2006/06/17 04:23:20 | 000,005,151 | —- | C] () – C:\WINDOWS\System32\oembios.dat
[2006/06/17 04:23:20 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat
[2006/06/17 04:23:19 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[2006/06/17 04:23:19 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\mib.bin
[2006/06/17 04:23:16 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[2006/06/17 04:23:08 | 000,001,804 | —- | C] () – C:\WINDOWS\System32\dcache.bin
[2006/06/16 21:31:45 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2006/06/16 21:30:47 | 000,159,544 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2005/08/05 23:01:54 | 000,235,008 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2004/06/15 02:00:00 | 000,077,321 | —- | C] () – C:\WINDOWS\unins000.exe
[1999/01/22 13:46:56 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\MSRTEDIT.DLL
========== Custom Scans ==========
< MD5 for: VOLSNAP.IN_ >
[2004/08/10 14:00:00 | 000,000,698 | —- | M] () MD5=03FF8C24B69C1FC99663DF3908FBEBA4 – C:\WINDOWS\I386\VOLSNAP.IN_
< MD5 for: VOLSNAP.INF >
[2004/08/10 14:00:00 | 000,001,095 | —- | M] () MD5=1C43F4D998567C9D2463E18669F33A3C – C:\WINDOWS\inf\volsnap.inf
< MD5 for: VOLSNAP.NEW >
[2011/06/26 15:00:41 | 000,052,352 | —- | M] () MD5=D158343035242A414346C75365B92854 – C:\WINDOWS\system32\drivers\volsnap.new
< MD5 for: VOLSNAP.PNF >
[2006/10/04 01:29:12 | 000,004,964 | —- | M] () MD5=BBD419C37F5A4538BC14BEAB41DAE841 – C:\WINDOWS\inf\volsnap.PNF
< MD5 for: VOLSNAP.SY_ >
[2004/08/10 14:00:00 | 000,025,390 | —- | M] () MD5=E021CFE0CAD70AC0F44999A892CBB9C5 – C:\WINDOWS\I386\VOLSNAP.SY_
< MD5 for: VOLSNAP.SYS >
[2008/04/13 13:41:01 | 000,052,352 | —- | M] (Microsoft Corporation) MD5=4C8FCB5CC53AAB716D810740FE59D025 – C:\WINDOWS\ServicePackFiles\i386\volsnap.sys
[2008/04/13 13:41:01 | 000,052,352 | —- | M] (Microsoft Corporation) MD5=4C8FCB5CC53AAB716D810740FE59D025 – C:\WINDOWS\system32\drivers\volsnap.sys
[2004/08/10 14:00:00 | 000,052,352 | —- | M] (Microsoft Corporation) MD5=EE4660083DEBA849FF6C485D944B379B – C:\WINDOWS\$NtServicePackUninstall$\volsnap.sys
< >
< End of report >
Malwarebytes' Anti-Malware 1.51.0.1200
www.malwarebytes.org
Database version: 6955
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702
6/26/2011 3:52:35 PM
mbam-log-2011-06-26 (15-52-32).txt
Scan type: Quick scan
Objects scanned: 184740
Time elapsed: 1 hour(s), 1 minute(s), 17 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)
OTL logfile created on: 6/26/2011 4:34:50 PM - Run 4
OTL by OldTimer - Version 3.2.24.0 Folder = C:\Documents and Settings\Owner.Miguel\Desktop\infectio
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
1.87 Gb Total Physical Memory | 1.25 Gb Available Physical Memory | 66.66% Memory free
3.72 Gb Paging File | 3.10 Gb Available in Paging File | 83.35% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 142.20 Gb Total Space | 97.65 Gb Free Space | 68.67% Space Free | Partition Type: NTFS
Drive D: | 6.83 Gb Total Space | 4.83 Gb Free Space | 70.71% Space Free | Partition Type: FAT32
Computer Name: MIGUEL | User Name: Owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - C:\Documents and Settings\Owner.Miguel\Desktop\infectio\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe (McAfee, Inc.)
PRC - C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe (McAfee, Inc.)
PRC - C:\WINDOWS\system32\mfevtps.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee Online Backup\MOBK370stat.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee Online Backup\MOBK370backup.exe (McAfee, Inc.)
PRC - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe ()
PRC - C:\Garmin\gStart.exe (GARMIN Corp.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS (New Boundary Technologies, Inc.)
PRC - C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe (Motorola Inc.)
PRC - C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe (ATI Technologies Inc.)
PRC - C:\WINDOWS\stsystra.exe (SigmaTel, Inc.)
PRC - C:\Program Files\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.)
========== Modules (SafeList) ==========
MOD - C:\Documents and Settings\Owner.Miguel\Desktop\infectio\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)
MOD - C:\Program Files\McAfee\SiteAdvisor\sahook.dll ()
MOD - C:\WINDOWS\system32\SynTPFcs.dll (Synaptics, Inc.)
========== Win32 Services (SafeList) ==========
SRV - (mfefire) – C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe (McAfee, Inc.)
SRV - (McShield) – C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe ()
SRV - (mfevtp) – C:\WINDOWS\system32\mfevtps.exe (McAfee, Inc.)
SRV - (MOBK370backup) – C:\Program Files\McAfee Online Backup\MOBK370backup.exe (McAfee, Inc.)
SRV - (McODS) – C:\Program Files\McAfee\VirusScan\mcods.exe (McAfee, Inc.)
SRV - (MSK80Service) – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McProxy) – C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McNASvc) – C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McNaiAnn) – C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (mcmscsvc) – C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McMPFSvc) – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McAfee SiteAdvisor Service) – C:\Program Files\McAfee\SiteAdvisor\McSACore.exe ()
SRV - (PrismXL) – C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS (New Boundary Technologies, Inc.)
========== Driver Services (SafeList) ==========
DRV - (VolSnap) – C:\WINDOWS\System32\drivers\volsnap.new ()
DRV - (mfehidk) – C:\WINDOWS\system32\drivers\mfehidk.sys (McAfee, Inc.)
DRV - (mfefirek) – C:\WINDOWS\system32\drivers\mfefirek.sys (McAfee, Inc.)
DRV - (mfeavfk) – C:\WINDOWS\system32\drivers\mfeavfk.sys (McAfee, Inc.)
DRV - (mfeapfk) – C:\WINDOWS\system32\drivers\mfeapfk.sys (McAfee, Inc.)
DRV - (mfendiskmp) – C:\WINDOWS\system32\drivers\mfendisk.sys (McAfee, Inc.)
DRV - (mfendisk) – C:\WINDOWS\system32\drivers\mfendisk.sys (McAfee, Inc.)
DRV - (mferkdet) – C:\WINDOWS\system32\drivers\mferkdet.sys (McAfee, Inc.)
DRV - (mfetdi2k) – C:\WINDOWS\system32\drivers\mfetdi2k.sys (McAfee, Inc.)
DRV - (cfwids) – C:\WINDOWS\system32\drivers\cfwids.sys (McAfee, Inc.)
DRV - (mfebopk) – C:\WINDOWS\system32\drivers\mfebopk.sys (McAfee, Inc.)
DRV - (MOBK370Filter) – C:\WINDOWS\system32\drivers\MOBK370.sys (Mozy, Inc.)
DRV - (NwlnkIpx) – C:\WINDOWS\system32\drivers\nwlnkipx.sys (Microsoft Corporation)
DRV - (ASCTRM) – C:\WINDOWS\System32\drivers\asctrm.sys (Windows ® 2000 DDK provider)
DRV - (AmdK8) – C:\WINDOWS\system32\drivers\AmdK8.sys (Advanced Micro Devices)
DRV - (STHDA) – C:\WINDOWS\system32\drivers\sthda.sys (SigmaTel, Inc.)
DRV - (smserial) – C:\WINDOWS\system32\drivers\smserial.sys (Motorola Inc.)
DRV - (yukonwxp) – C:\WINDOWS\system32\drivers\yk51x86.sys (Marvell)
DRV - (ati2mtag) – C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (BCM43XX) – C:\WINDOWS\system32\drivers\BCMWL5.SYS (Broadcom Corporation)
DRV - (tifm21) – C:\WINDOWS\system32\drivers\tifm21.sys (Texas Instruments)
DRV - (Cdralw2k) – C:\WINDOWS\System32\drivers\cdralw2k.sys (Roxio)
DRV - (Cdr4_xp) – C:\WINDOWS\System32\drivers\cdr4_xp.sys (Roxio)
DRV - (NwlnkNb) – C:\WINDOWS\system32\drivers\nwlnknb.sys (Microsoft Corporation)
DRV - (NwlnkSpx) – C:\WINDOWS\system32\drivers\nwlnkspx.sys (Microsoft Corporation)
DRV - (wanatw) WAN Miniport (ATW) – C:\WINDOWS\system32\drivers\wanatw4.sys (America Online, Inc.)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = ibahn:80
FF - HKLM\software\mozilla\Firefox\Extensions\\{B7082FAA-CB62-4872-9106-E42DD88EDE45}: C:\Program Files\McAfee\SiteAdvisor [2010/03/02 22:12:15 | 000,000,000 | —D | M]
[2009/12/26 15:21:27 | 000,000,000 | -H-D | M] (No name found) – C:\Documents and Settings\Owner.Miguel\Application Data\Mozilla\Extensions
[2009/12/26 15:21:27 | 000,000,000 | -H-D | M] (No name found) – C:\Documents and Settings\Owner.Miguel\Application Data\Mozilla\Extensions\[removed]
O1 HOSTS File: ([2011/06/16 20:00:42 | 000,000,027 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - File not found
O2 - BHO: (McAfee Phishing Filter) - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\Program Files\McAfee\MSK\mskapbho.dll ()
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20110517161831.dll (McAfee, Inc.)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\Program Files\Google\GoogleToolbar2.dll (Google Inc.)
O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll ()
O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\WINDOWS\system32\bae.dll (Gateway Inc.)
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll ()
O3 - HKLM\..\Toolbar: (&Google) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar2.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar2.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [ATICCC] C:\Program Files\ATI Technologies\ATI.ACE\cli.exe (ATI Technologies Inc.)
O4 - HKLM..\Run: [mcui_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
O4 - HKLM..\Run: [Recguard] C:\WINDOWS\SMINST\Recguard.exe ()
O4 - HKLM..\Run: [Reminder] C:\WINDOWS\creator\Remind_XP.exe (SoftThinks)
O4 - HKLM..\Run: [SigmatelSysTrayApp] C:\WINDOWS\stsystra.exe (SigmaTel, Inc.)
O4 - HKLM..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe (Motorola Inc.)
O4 - HKLM..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.)
O4 - HKCU..\Run: [gStart] C:\Garmin\gStart.exe (GARMIN Corp.)
O4 - HKCU..\Run: [Power2GoExpress] File not found
O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Online Backup Status.lnk = C:\Program Files\McAfee Online Backup\MOBK370stat.exe (McAfee, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE (Microsoft Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme ()
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} http://download.mcafee.com/molbin/shared/m…01/mcinsctl.cab (McAfee.com Operating System Class)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwa…ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll ()
O18 - Protocol\Handler\skype4com - No CLSID value found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop WallPaper: C:\Documents and Settings\Owner.Miguel\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Owner.Miguel\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/06/17 04:41:16 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
========== Files/Folders - Created Within 30 Days ==========
[2011/06/26 14:49:28 | 000,022,712 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2011/06/26 14:29:16 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\McAfee
[2011/06/18 18:38:08 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner.Miguel\Application Data\Malwarebytes
[2011/06/18 18:38:04 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/06/18 18:38:03 | 000,039,984 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011/06/18 18:38:03 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2011/06/18 18:37:56 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2011/06/18 18:31:55 | 009,435,312 | —- | C] (Malwarebytes Corporation ) – C:\Documents and Settings\Owner.Miguel\Desktop\mbam-setup-1.51.0.1200.exe
[2011/06/16 20:30:58 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2011/06/16 20:11:28 | 000,000,000 | —D | C] – C:\WINDOWS\temp
[2011/06/16 19:32:45 | 000,000,000 | RHSD | C] – C:\cmdcons
[2011/06/16 19:28:17 | 000,518,144 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2011/06/16 19:28:17 | 000,406,528 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2011/06/16 19:28:17 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2011/06/16 19:28:17 | 000,060,416 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2011/06/16 19:28:06 | 000,000,000 | —D | C] – C:\WINDOWS\ERDNT
[2011/06/16 19:28:00 | 000,000,000 | —D | C] – C:\Qoobox
[2011/06/16 19:14:24 | 004,608,744 | —- | C] (Microsoft Corporation) – C:\Documents and Settings\Owner.Miguel\Desktop\WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[2011/06/16 17:28:37 | 000,105,472 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mup.sys
[2011/06/13 20:12:57 | 000,000,000 | —D | C] – C:\_OTL
[2011/06/11 20:31:38 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner.Miguel\Desktop\infectio
[2011/06/11 17:29:23 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Owner.Miguel\Recent
[2011/06/11 08:28:35 | 000,000,000 | -H-D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\iTunes
[2011/06/11 08:26:59 | 000,000,000 | —D | C] – C:\Program Files\iPod
[2011/06/04 16:28:25 | 000,000,000 | -H-D | C] – C:\Documents and Settings\Owner.Miguel\Local Settings\Application Data\Garmin
[2011/06/04 16:22:28 | 000,000,000 | -H-D | C] – C:\Documents and Settings\Owner.Miguel\Application Data\GARMIN
[2011/06/04 16:19:34 | 000,000,000 | —D | C] – C:\Program Files\Garmin
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\Documents and Settings\Owner.Miguel\Local Settings\Application Data\*.tmp files -> C:\Documents and Settings\Owner.Miguel\Local Settings\Application Data\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2011/06/26 16:42:01 | 000,000,884 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/06/26 15:59:22 | 000,040,652 | —- | M] () – C:\WINDOWS\MOBK370.blk
[2011/06/26 15:59:20 | 000,003,150 | —- | M] () – C:\WINDOWS\MOBK370.flt
[2011/06/26 15:42:07 | 000,000,880 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/06/26 15:00:41 | 000,052,352 | —- | M] () – C:\WINDOWS\System32\drivers\volsnap.new
[2011/06/26 14:49:56 | 000,000,802 | —- | M] () – C:\Documents and Settings\Owner.Miguel\Application Data\Microsoft\Internet Explorer\Quick Launch\Malwarebytes' Anti-Malware.lnk
[2011/06/26 14:49:56 | 000,000,784 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/06/26 14:22:31 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/06/26 14:22:08 | 2011,279,360 | -HS- | M] () – C:\hiberfil.sys
[2011/06/26 12:24:59 | 000,001,158 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2011/06/18 23:01:03 | 000,445,044 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2011/06/18 23:01:02 | 000,072,754 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2011/06/18 22:24:01 | 000,000,248 | —- | M] () – C:\Documents and Settings\Owner.Miguel\Desktop\PaperBack Swap.com.url
[2011/06/18 22:22:38 | 000,000,214 | —- | M] () – C:\Documents and Settings\Owner.Miguel\Desktop\BookMooch Member Home (2).url
[2011/06/18 18:40:59 | 000,000,000 | —- | M] () – C:\Documents and Settings\Owner.Miguel\defogger_reenable
[2011/06/18 18:31:56 | 009,435,312 | —- | M] (Malwarebytes Corporation ) – C:\Documents and Settings\Owner.Miguel\Desktop\mbam-setup-1.51.0.1200.exe
[2011/06/16 20:00:42 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2011/06/16 19:48:00 | 000,000,552 | —- | M] () – C:\WINDOWS\System32\d3d8caps.dat
[2011/06/16 19:33:01 | 000,000,337 | RHS- | M] () – C:\boot.ini
[2011/06/16 19:14:31 | 004,608,744 | —- | M] (Microsoft Corporation) – C:\Documents and Settings\Owner.Miguel\Desktop\WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[2011/06/16 18:24:59 | 000,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2011/06/15 18:22:40 | 000,000,664 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2011/06/14 21:14:22 | 000,000,000 | —- | M] () – C:\Documents and Settings\Owner.Miguel\Local Settings\Application Data\{2B5BC5F7-91CB-405E-843E-60C7B745449B}
[2011/06/11 08:28:35 | 000,001,542 | -H– | M] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2011/05/30 17:19:48 | 005,964,800 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mshtml.dll
[2011/05/29 09:11:30 | 000,039,984 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011/05/29 09:11:20 | 000,022,712 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\Documents and Settings\Owner.Miguel\Local Settings\Application Data\*.tmp files -> C:\Documents and Settings\Owner.Miguel\Local Settings\Application Data\*.tmp -> ]
========== Files Created - No Company Name ==========
[2011/06/26 14:49:56 | 000,000,802 | —- | C] () – C:\Documents and Settings\Owner.Miguel\Application Data\Microsoft\Internet Explorer\Quick Launch\Malwarebytes' Anti-Malware.lnk
[2011/06/26 14:49:56 | 000,000,784 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/06/19 14:57:39 | 2011,279,360 | -HS- | C] () – C:\hiberfil.sys
[2011/06/18 18:40:59 | 000,000,000 | —- | C] () – C:\Documents and Settings\Owner.Miguel\defogger_reenable
[2011/06/16 19:48:00 | 000,000,552 | —- | C] () – C:\WINDOWS\System32\d3d8caps.dat
[2011/06/16 19:33:01 | 000,000,221 | —- | C] () – C:\Boot.bak
[2011/06/16 19:32:55 | 000,260,272 | RHS- | C] () – C:\cmldr
[2011/06/16 19:28:17 | 000,256,512 | —- | C] () – C:\WINDOWS\PEV.exe
[2011/06/16 19:28:17 | 000,208,896 | —- | C] () – C:\WINDOWS\MBR.exe
[2011/06/16 19:28:17 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2011/06/16 19:28:17 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2011/06/16 19:28:17 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2011/06/16 17:47:33 | 000,000,788 | —- | C] () – C:\Documents and Settings\Owner.Miguel\Desktop\Windows Media Player.lnk
[2011/06/14 21:14:22 | 000,000,000 | —- | C] () – C:\Documents and Settings\Owner.Miguel\Local Settings\Application Data\{2B5BC5F7-91CB-405E-843E-60C7B745449B}
[2011/06/13 20:13:13 | 000,001,542 | -H– | C] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2011/06/13 20:13:13 | 000,000,800 | -H– | C] () – C:\Documents and Settings\Owner.Miguel\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk
[2011/06/13 20:13:13 | 000,000,079 | -H– | C] () – C:\Documents and Settings\Owner.Miguel\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf
[2011/06/13 20:13:12 | 000,002,104 | -H– | C] () – C:\Documents and Settings\Owner.Miguel\Application Data\Microsoft\Internet Explorer\Quick Launch\Play Games.lnk
[2011/06/13 20:13:12 | 000,001,854 | -H– | C] () – C:\Documents and Settings\Owner.Miguel\Application Data\Microsoft\Internet Explorer\Quick Launch\Apple Safari.lnk
[2011/06/13 20:13:12 | 000,001,757 | -H– | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
[2011/06/13 20:13:12 | 000,001,725 | -H– | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
[2011/06/13 20:13:12 | 000,001,478 | -H– | C] () – C:\Documents and Settings\Owner.Miguel\Application Data\Microsoft\Internet Explorer\Quick Launch\Media Center.lnk
[2011/06/13 20:13:12 | 000,000,815 | -H– | C] () – C:\Documents and Settings\Owner.Miguel\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2011/06/13 20:13:12 | 000,000,746 | -H– | C] () – C:\Documents and Settings\Owner.Miguel\Application Data\Microsoft\Internet Explorer\Quick Launch\Gateway Games.lnk
[2011/06/13 20:12:59 | 000,001,986 | -H– | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\MSN.lnk
[2011/06/13 20:12:59 | 000,001,854 | -H– | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Safari.lnk
[2011/06/13 20:12:59 | 000,001,077 | -H– | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Windows Live ID.lnk
[2011/06/13 20:12:59 | 000,000,786 | -H– | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Windows Movie Maker.lnk
[2011/06/13 20:12:59 | 000,000,621 | -H– | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Wireless SecureEasySetup.lnk
[2011/06/13 20:12:59 | 000,000,609 | -H– | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Windows Messenger.lnk
[2011/06/13 20:12:58 | 000,002,479 | -H– | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Word.lnk
[2011/06/13 20:12:58 | 000,002,046 | -H– | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Outlook.lnk
[2011/06/13 20:12:58 | 000,002,030 | -H– | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Excel.lnk
[2011/06/13 20:12:58 | 000,002,002 | -H– | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft PowerPoint.lnk
[2011/06/13 20:12:58 | 000,001,998 | -H– | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft FrontPage.lnk
[2011/06/13 20:12:58 | 000,001,990 | -H– | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Access.lnk
[2011/06/13 20:12:58 | 000,001,830 | -H– | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Apple Software Update.lnk
[2011/06/13 20:12:58 | 000,001,810 | -H– | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Adobe Reader 7.0.lnk
[2011/06/13 20:12:58 | 000,001,775 | -H– | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Office PowerPoint Viewer 2003.lnk
[2011/06/13 20:12:58 | 000,001,701 | -H– | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Works Task Launcher.lnk
[2011/06/13 20:12:58 | 000,001,466 | -H– | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Media Center.lnk
[2011/06/13 20:12:58 | 000,001,004 | -H– | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Money 2006.lnk
[2011/06/11 18:30:12 | 000,000,795 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Online Backup Status.lnk
[2011/06/11 18:24:27 | 000,000,248 | —- | C] () – C:\Documents and Settings\Owner.Miguel\Desktop\PaperBack Swap.com.url
[2011/06/11 18:19:40 | 000,000,214 | —- | C] () – C:\Documents and Settings\Owner.Miguel\Desktop\BookMooch Member Home (2).url
[2010/04/10 21:26:16 | 000,000,664 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/04/04 22:05:39 | 000,028,792 | -H– | C] () – C:\WINDOWS\System32\mlfcache.dat
[2008/06/07 13:09:54 | 000,000,056 | -H– | C] () – C:\WINDOWS\System32\ezsidmv.dat
[2007/05/26 16:27:56 | 000,002,206 | —- | C] () – C:\WINDOWS\unins000.dat
[2007/05/16 08:47:50 | 000,001,774 | -H– | C] () – C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2007/03/28 13:19:15 | 000,000,002 | —- | C] () – C:\WINDOWS\msoffice.ini
[2007/03/17 18:22:59 | 000,010,752 | -H– | C] () – C:\Documents and Settings\Owner.Miguel\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2006/11/08 21:08:45 | 000,032,768 | —- | C] () – C:\WINDOWS\System32\instlsp.exe
[2006/11/08 15:47:14 | 000,000,135 | -H– | C] () – C:\Documents and Settings\Owner.Miguel\Local Settings\Application Data\fusioncache.dat
[2006/10/04 02:01:07 | 000,023,552 | —- | C] () – C:\WINDOWS\System32\jesterss.dll
[2006/10/04 01:46:48 | 000,000,335 | —- | C] () – C:\WINDOWS\nsreg.dat
[2006/10/04 01:46:05 | 000,000,004 | —- | C] () – C:\WINDOWS\Pix11.dat
[2006/10/04 01:41:06 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2006/10/04 01:15:28 | 000,125,796 | —- | C] () – C:\WINDOWS\System32\atiicdxx.dat
[2006/10/04 01:14:37 | 000,018,944 | —- | C] () – C:\WINDOWS\System32\WLTRYSVC.EXE
[2006/10/04 01:14:36 | 000,086,016 | —- | C] () – C:\WINDOWS\System32\preflib.dll
[2006/10/04 01:14:20 | 000,757,760 | —- | C] () – C:\WINDOWS\System32\bcm1xsup.dll
[2006/06/21 04:48:15 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2006/06/21 04:12:42 | 000,352,256 | —- | C] () – C:\WINDOWS\System32\HotlineClient.exe
[2006/06/17 04:44:22 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2006/06/17 04:37:18 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2006/06/17 04:24:58 | 000,001,280 | —- | C] () – C:\WINDOWS\System32\oeminfo.ini
[2006/06/17 04:24:57 | 000,000,519 | —- | C] () – C:\WINDOWS\System32\emver.ini
[2006/06/17 04:23:25 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2006/06/17 04:23:22 | 000,445,044 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[2006/06/17 04:23:22 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[2006/06/17 04:23:22 | 000,072,754 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[2006/06/17 04:23:22 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[2006/06/17 04:23:20 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\oembios.bin
[2006/06/17 04:23:20 | 000,005,151 | —- | C] () – C:\WINDOWS\System32\oembios.dat
[2006/06/17 04:23:20 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat
[2006/06/17 04:23:19 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[2006/06/17 04:23:19 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\mib.bin
[2006/06/17 04:23:16 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[2006/06/17 04:23:08 | 000,001,804 | —- | C] () – C:\WINDOWS\System32\dcache.bin
[2006/06/16 21:31:45 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2006/06/16 21:30:47 | 000,159,544 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2005/08/05 23:01:54 | 000,235,008 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2004/06/15 02:00:00 | 000,077,321 | —- | C] () – C:\WINDOWS\unins000.exe
[1999/01/22 13:46:56 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\MSRTEDIT.DLL
========== Custom Scans ==========
< MD5 for: VOLSNAP.IN_ >
[2004/08/10 14:00:00 | 000,000,698 | —- | M] () MD5=03FF8C24B69C1FC99663DF3908FBEBA4 – C:\WINDOWS\I386\VOLSNAP.IN_
< MD5 for: VOLSNAP.INF >
[2004/08/10 14:00:00 | 000,001,095 | —- | M] () MD5=1C43F4D998567C9D2463E18669F33A3C – C:\WINDOWS\inf\volsnap.inf
< MD5 for: VOLSNAP.NEW >
[2011/06/26 15:00:41 | 000,052,352 | —- | M] () MD5=D158343035242A414346C75365B92854 – C:\WINDOWS\system32\drivers\volsnap.new
< MD5 for: VOLSNAP.PNF >
[2006/10/04 01:29:12 | 000,004,964 | —- | M] () MD5=BBD419C37F5A4538BC14BEAB41DAE841 – C:\WINDOWS\inf\volsnap.PNF
< MD5 for: VOLSNAP.SY_ >
[2004/08/10 14:00:00 | 000,025,390 | —- | M] () MD5=E021CFE0CAD70AC0F44999A892CBB9C5 – C:\WINDOWS\I386\VOLSNAP.SY_
< MD5 for: VOLSNAP.SYS >
[2008/04/13 13:41:01 | 000,052,352 | —- | M] (Microsoft Corporation) MD5=4C8FCB5CC53AAB716D810740FE59D025 – C:\WINDOWS\ServicePackFiles\i386\volsnap.sys
[2008/04/13 13:41:01 | 000,052,352 | —- | M] (Microsoft Corporation) MD5=4C8FCB5CC53AAB716D810740FE59D025 – C:\WINDOWS\system32\drivers\volsnap.sys
[2004/08/10 14:00:00 | 000,052,352 | —- | M] (Microsoft Corporation) MD5=EE4660083DEBA849FF6C485D944B379B – C:\WINDOWS\$NtServicePackUninstall$\volsnap.sys
< >
< End of report >
oldman960
Hi wilma1313,
Something odd here.
Next
Please open OTL.
Something odd here.
Next
Please open OTL.
- Make sure all other windows are closed and to let it run uninterrupted.
- When the window appears, click the None button near the top (it may looked greyed out)
- In the window under Custom Scans/Fixes copy and paste the following
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\volsnap
- Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
wilma1313
Hi,
Windows will not load all the way now. Usually it stops before anything but the wallpaper is up, once in awhile it loads a little farther, we tried a couple times. It did that once today before I ran the scans too. so at this point I am stuck. Shutting down for the night, but will be ready to work at it again tomorrow night.
Such a bummer, it seemed like it might be back to normal.
thanks and g'nite
wilma1313
Hi,
After several tries he was able to get windows to fully load last night, so I hopefully should be able to follow the instructions tonight.
IF WIndows won't load though, any alternate advice?
thanks,
oldman960
Hi wilma1313,
Try safe mode next time. There will be a lot less trying to load at startup. We can always transfer things via CD.
For now just leave the computer on. Once you post the OTL log we should be able to see what is going on.
wilma1313
Here it is, hope I did it right,took like 2 sec.
OTL logfile created on: 6/27/2011 7:34:16 PM - Run 5
OTL by OldTimer - Version 3.2.24.0 Folder = C:\Documents and Settings\Owner.Miguel\Desktop\infectio
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
1.87 Gb Total Physical Memory | 1.44 Gb Available Physical Memory | 76.88% Memory free
3.72 Gb Paging File | 3.16 Gb Available in Paging File | 84.88% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 142.20 Gb Total Space | 98.24 Gb Free Space | 69.09% Space Free | Partition Type: NTFS
Drive D: | 6.83 Gb Total Space | 4.83 Gb Free Space | 70.71% Space Free | Partition Type: FAT32
Computer Name: MIGUEL | User Name: Owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: Off | File Age = 30 Days
========== Custom Scans ==========
< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\volsnap >
"ErrorControl" = 1
"Group" = System Bus Extender
"Start" = 0
"Type" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\volsnap\Enum]
< >
< End of report >
OTL logfile created on: 6/27/2011 7:34:16 PM - Run 5
OTL by OldTimer - Version 3.2.24.0 Folder = C:\Documents and Settings\Owner.Miguel\Desktop\infectio
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
1.87 Gb Total Physical Memory | 1.44 Gb Available Physical Memory | 76.88% Memory free
3.72 Gb Paging File | 3.16 Gb Available in Paging File | 84.88% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 142.20 Gb Total Space | 98.24 Gb Free Space | 69.09% Space Free | Partition Type: NTFS
Drive D: | 6.83 Gb Total Space | 4.83 Gb Free Space | 70.71% Space Free | Partition Type: FAT32
Computer Name: MIGUEL | User Name: Owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: Off | File Age = 30 Days
========== Custom Scans ==========
< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\volsnap >
"ErrorControl" = 1
"Group" = System Bus Extender
"Start" = 0
"Type" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\volsnap\Enum]
< >
< End of report >
oldman960
Hi wilma1313,
Please read carefully and follow these steps.
Thanks
Please read carefully and follow these steps.
- Download TDSSKiller and save it to your Desktop.
- Extract its contents to your desktop.
- Once extracted, open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
Click to load external image (Posted Image)
- If an infected file is detected, the default action will be Cure, click on Continue.
Click to load external image (Posted Image)
- If a suspicious file is detected, the default action will be Skip, click on Continue.
Click to load external image (Posted Image)
- It may ask you to reboot the computer to complete the process. Click on Reboot Now.
Click to load external image (Posted Image)
- If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
- If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.
Thanks
Ask AI
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI