Google redirect / tdss e!rootkit

Hi,

I have a Windows XP system that runs slow and redirects Google URLs. McAfee finds TDSS e!rootkit but cannot successfully remove it. I've pasted the OTL log and Extras.txt below. I also tried running DDS, but it runs for about 3 minutes then hangs.

Thanks so very much for your help!
Katya


OTL logfile created on: 7/3/2011 10:30:01 AM - Run 1
OTL by OldTimer - Version 3.2.25.0 Folder = C:\Documents and Settings\shera\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1014.42 Mb Total Physical Memory | 270.18 Mb Available Physical Memory | 26.63% Memory free
2.07 Gb Paging File | 1.36 Gb Available in Paging File | 65.91% Paging File free
Paging file location(s): C:\pagefile.sys 1200 1512 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 33.24 Gb Total Space | 7.12 Gb Free Space | 21.42% Space Free | Partition Type: NTFS

Computer Name: EARWIG | User Name: shera | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\shera\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Applications\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\McAfee\VirusScan Enterprise\mcshield.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\VirusScan Enterprise\shstat.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\Common Framework\Mctray.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\Common Framework\naPrdMgr.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\Common Framework\UdaterUI.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\Common Framework\FrameworkService.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\VirusScan Enterprise\scan32.exe (McAfee, Inc.)
PRC - C:\Program Files\ThinkPad\ConnectUtilities\QCTRAY.EXE (IBM Corp.)
PRC - C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE (IBM Corp.)
PRC - C:\WINDOWS\system32\QCONSVC.EXE (IBM Corp.)
PRC - C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe ()
PRC - c:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe (Symantec Corporation)
PRC - C:\Program Files\IBM\Messages By IBM\ibmmessages.exe (IBM)
PRC - C:\WINDOWS\system32\acs.exe ()
PRC - C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe ()
PRC - C:\Applications\National Instruments\NI-DAQ\HWConfig\nidevldstat.exe (National Instruments Corporation)
PRC - C:\WINDOWS\system32\nipalsm.exe (National Instruments Corporation)
PRC - C:\Applications\bmem\bmem.exe (Brennan Underwood)
PRC - C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe ()
PRC - C:\IBMTOOLS\utils\ibmprc.exe (IBM Corp.)
PRC - C:\WINDOWS\system32\TpKmpSvc.exe ()
PRC - C:\WINDOWS\system32\niSvcLoc.exe (National Instruments)
PRC - C:\Program Files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe (IBM Corporation)


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\shera\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (PsaSrv) – File not found
SRV - (McShield) – C:\Program Files\McAfee\VirusScan Enterprise\mcshield.exe (McAfee, Inc.)
SRV - (McTaskManager) – C:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exe (McAfee, Inc.)
SRV - (McAfeeFramework) – C:\Program Files\McAfee\Common Framework\FrameworkService.exe (McAfee, Inc.)
SRV - (QCONSVC) – C:\WINDOWS\system32\QCONSVC.EXE (IBM Corp.)
SRV - (SymWSC) – c:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe (Symantec Corporation)
SRV - (ACS) – C:\WINDOWS\system32\acs.exe ()
SRV - (nipxirmu) – C:\WINDOWS\system32\nipalsm.exe (National Instruments Corporation)
SRV - (nidevldu) – C:\WINDOWS\system32\nipalsm.exe (National Instruments Corporation)
SRV - (IBM Rapid Restore Ultra Service) – C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe ()
SRV - (NILM License manager) – C:\Applications\National Instruments\Shared\License Manager\Bin\lmgrd.exe (Macrovision Corporation)
SRV - (TpKmpSVC) – C:\WINDOWS\system32\TpKmpSvc.exe ()
SRV - (niSvcLoc) – C:\WINDOWS\System32\niSvcLoc.exe (National Instruments)


========== Driver Services (SafeList) ==========

DRV - (mfehidk) – C:\WINDOWS\system32\drivers\mfehidk.sys (McAfee, Inc.)
DRV - (mfeavfk) – C:\WINDOWS\system32\drivers\mfeavfk.sys (McAfee, Inc.)
DRV - (mfeapfk) – C:\WINDOWS\system32\drivers\mfeapfk.sys (McAfee, Inc.)
DRV - (mfetdik) – C:\WINDOWS\system32\drivers\mfetdik.sys (McAfee, Inc.)
DRV - (mfebopk) – C:\WINDOWS\system32\drivers\mfebopk.sys (McAfee, Inc.)
DRV - (mferkdk) – C:\Program Files\McAfee\VirusScan Enterprise\mferkdk.sys (McAfee, Inc.)
DRV - (psadd) – C:\WINDOWS\system32\drivers\psadd.sys (Windows ® 2000 DDK provider)
DRV - (MDC8021X) AEGIS Protocol (IEEE 802.1x) – C:\WINDOWS\system32\drivers\mdc8021x.sys (Meetinghouse Data Communications)
DRV - (ibmfilter) – C:\WINDOWS\system32\drivers\ibmfilter.sys (IBM)
DRV - (QCNDISIF) – C:\WINDOWS\system32\drivers\qcndisif.sys (IBM Corporation.)
DRV - (ANC) – C:\WINDOWS\system32\drivers\ANC.sys (IBM Corp.)
DRV - (IBMTPCHK) – C:\WINDOWS\system32\drivers\IBMBLDID.SYS ()
DRV - (TPPWR) – C:\WINDOWS\system32\drivers\TPPWR.SYS (IBM Corp.)
DRV - (Smapint) – C:\WINDOWS\system32\drivers\SMAPINT.SYS (Microsoft Corporation)
DRV - (TDSMAPI) – C:\WINDOWS\system32\drivers\TDSMAPI.SYS ()
DRV - (AR5211) – C:\WINDOWS\system32\drivers\ar5211.sys (Atheros Communications, Inc.)
DRV - (HSFHWICH) – C:\WINDOWS\system32\drivers\HSFHWICH.sys (Conexant Systems, Inc.)
DRV - (winachsf) – C:\WINDOWS\system32\drivers\HSF_CNXT.sys (Conexant Systems, Inc.)
DRV - (HSF_DP) – C:\WINDOWS\system32\drivers\HSF_DP.sys (Conexant Systems, Inc.)
DRV - (nissrk) – C:\WINDOWS\system32\drivers\nissrk.dll (National Instruments Corporation)
DRV - (niwfrk) – C:\WINDOWS\system32\drivers\niwfrk.dll (National Instruments Corporation)
DRV - (niesrk) – C:\WINDOWS\system32\drivers\niesrk.dll (National Instruments Corporation)
DRV - (nixsrk) – C:\WINDOWS\system32\drivers\nixsrk.dll (National Instruments Corporation)
DRV - (nidmmk) – C:\WINDOWS\system32\drivers\nidmmk.dll (National Instruments Corporation)
DRV - (Nidaq32k) – C:\WINDOWS\System32\drivers\nidaq32k.sys (National Instruments Corporation)
DRV - (nistck) – C:\WINDOWS\system32\drivers\niSTCk.dll (National Instruments Corporation)
DRV - (nimdsk) – C:\WINDOWS\system32\drivers\nimdsk.dll (National Instruments Corporation)
DRV - (nibffrk) – C:\WINDOWS\system32\drivers\nibffrk.dll (National Instruments Corporation)
DRV - (niarbk) – C:\WINDOWS\system32\drivers\niarbk.dll (National Instruments Corporation)
DRV - (TSMAPIP) – C:\WINDOWS\system32\drivers\TSMAPIP.SYS ()
DRV - (NiViPxiK) – C:\WINDOWS\System32\drivers\NiViPxiK.sys (National Instruments)
DRV - (niswdk) – C:\WINDOWS\system32\drivers\niswdk.dll (National Instruments Corporation)
DRV - (nisdigk) – C:\WINDOWS\system32\drivers\nisdigk.dll (National Instruments Corporation)
DRV - (nilvaik) – C:\WINDOWS\system32\drivers\nilvaik.dll (National Instruments Corporation)
DRV - (nidsark) – C:\WINDOWS\system32\drivers\nidsark.dll (National Instruments Corporation)
DRV - (nispdk) – C:\WINDOWS\system32\drivers\nispdk.dll ()
DRV - (niscdk) – C:\WINDOWS\system32\drivers\niscdk.dll (National Instruments Corporation)
DRV - (nistcrk) – C:\WINDOWS\system32\drivers\nistcrk.dll (National Instruments Corporation)
DRV - (nitiork) – C:\WINDOWS\system32\drivers\nitiork.dll (National Instruments Corporation)
DRV - (nimsdrk) – C:\WINDOWS\system32\drivers\nimsdrk.dll (National Instruments Corporation)
DRV - (nicdrk) – C:\WINDOWS\system32\drivers\nicdrk.dll (National Instruments Corporation)
DRV - (nidmxfk) – C:\WINDOWS\system32\drivers\nidmxfk.dll (National Instruments Corporation)
DRV - (nimstsk) – C:\WINDOWS\system32\drivers\nimstsk.dll (National Instruments Corporation)
DRV - (nimru2k) – C:\WINDOWS\system32\drivers\nimru2k.dll (National Instruments Corporation)
DRV - (nipxirmk) – C:\WINDOWS\system32\drivers\nipxirmk.dll (National Instruments Corporation)
DRV - (NIPALK) – C:\WINDOWS\System32\drivers\nipalk.sys (National Instruments Corporation)
DRV - (gpib420) – C:\WINDOWS\system32\drivers\gpib420.sys (National Instruments Corporation)
DRV - (GpibPrtK) – C:\WINDOWS\system32\drivers\GpibPrtK.sys (National Instruments Corporation)
DRV - (lvalarmk) – C:\WINDOWS\system32\drivers\lvalarmk.dll (National Instruments)
DRV - (niorbk) – C:\WINDOWS\system32\drivers\niorbk.dll (National Instruments Corporation)
DRV - (nimsrlk) – C:\WINDOWS\system32\drivers\nimsrlk.dll (National Instruments Corporation)
DRV - (nimslk) – C:\WINDOWS\system32\drivers\nimslk.dll (National Instruments Corporation)
DRV - (nistc2k) – C:\WINDOWS\system32\drivers\nistc2k.dll (National Instruments Corporation)
DRV - (nimxpk) – C:\WINDOWS\system32\drivers\nimxpk.dll (National Instruments Corporation)
DRV - (nidimk) – C:\WINDOWS\system32\drivers\nidimk.dll (National Instruments Corporation)
DRV - (nimxdfk) – C:\WINDOWS\system32\drivers\nimxdfk.dll (National Instruments Corporation)
DRV - (nimdbgk) – C:\WINDOWS\system32\drivers\nimdbgk.dll (National Instruments Corporation)
DRV - (cvintdrv) – C:\WINDOWS\System32\drivers\cvintdrv.sys ()
DRV - (WINIO) – C:\WINDOWS\system32\winio.sys ()


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.google.com/"
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {0506C90D-8D85-4E30-9F54-801E15B05A57}:1.9.1

FF - HKLM\software\mozilla\Firefox\extensions\\{2E68C12D-D3A2-41D1-AC22-8DFF85C16349}: C:\Documents and Settings\shera\Local Settings\Application Data\{2E68C12D-D3A2-41D1-AC22-8DFF85C16349}
FF - HKLM\software\mozilla\Firefox\extensions\\{0506C90D-8D85-4E30-9F54-801E15B05A57}: C:\Documents and Settings\pooper\Local Settings\Application Data\{0506C90D-8D85-4E30-9F54-801E15B05A57}\ [2011/06/26 20:23:35 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 5.0\extensions\\Components: C:\Applications\Mozilla Firefox\components [2011/06/28 23:14:50 | 000,000,000 | -H-D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 5.0\extensions\\Plugins: C:\Applications\Mozilla Firefox\plugins [2011/06/28 23:14:29 | 000,000,000 | -H-D | M]

[2011/06/26 22:30:14 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\shera\Application Data\Mozilla\Extensions
[2011/06/28 23:04:38 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\shera\Application Data\Mozilla\Firefox\Profiles\lv4ekymk.default\extensions
File not found (No name found) –
[2007/10/29 22:29:44 | 000,000,000 | -H-D | M] (Java Console) – C:\APPLICATIONS\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}
[2008/11/16 11:19:36 | 000,000,000 | -H-D | M] (Java Console) – C:\APPLICATIONS\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}
[2011/06/26 20:23:35 | 000,000,000 | —D | M] (XULRunner) – C:\DOCUMENTS AND SETTINGS\POOPER\LOCAL SETTINGS\APPLICATION DATA\{0506C90D-8D85-4E30-9F54-801E15B05A57}
[2010/12/13 21:23:30 | 000,000,000 | —D | M] (Java Quick Starter) – C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF

O1 HOSTS File: ([2004/08/04 09:00:00 | 000,000,734 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (DriveLetterAccess) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll (Sonic Solutions)
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan Enterprise\scriptcl.dll (McAfee, Inc.)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [BluetoothAuthenticationAgent] C:\WINDOWS\System32\bthprops.cpl (Microsoft Corporation)
O4 - HKLM..\Run: [BMMGAG] C:\Program Files\ThinkPad\Utilities\PWRMONIT.DLL (IBM Corp.)
O4 - HKLM..\Run: [BMMLREF] C:\Program Files\ThinkPad\Utilities\BMMLREF.EXE ()
O4 - HKLM..\Run: [BMMMONWND] C:\Program Files\ThinkPad\Utilities\BATINFEX.DLL ()
O4 - HKLM..\Run: [ibmmessages] C:\Program Files\IBM\Messages By IBM\\ibmmessages.exe ()
O4 - HKLM..\Run: [IBMPRC] C:\IBMTOOLS\utils\ibmprc.exe (IBM Corp.)
O4 - HKLM..\Run: [KeePass 2 PreLoad] C:\Applications\KeePass Password Safe 2\KeePass.exe (Dominik Reichl)
O4 - HKLM..\Run: [McAfeeUpdaterUI] C:\Program Files\McAfee\Common Framework\UdaterUI.exe (McAfee, Inc.)
O4 - HKLM..\Run: [NIDAQmxDriverStatus] C:\Applications\National Instruments\NI-DAQ\HWConfig\nidevldstat.exe (National Instruments Corporation)
O4 - HKLM..\Run: [QCTray] C:\Program Files\ThinkPad\ConnectUtilities\QCTRAY.EXE (IBM Corp.)
O4 - HKLM..\Run: [QCWLICON] C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE (IBM Corp.)
O4 - HKLM..\Run: [ShStatEXE] C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE (McAfee, Inc.)
O4 - HKLM..\Run: [SSC_UserPrompt] c:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe (Symantec Corporation)
O4 - HKLM..\Run: [TP4EX] C:\WINDOWS\System32\TP4EX.exe (IBM Corporation)
O4 - HKLM..\Run: [TPHOTKEY] C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe ()
O4 - HKLM..\Run: [TPKMAPHELPER] C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe (IBM Corp.)
O4 - HKLM..\Run: [UC_SMB] File not found
O4 - HKLM..\Run: [UC_Start] C:\Program Files\IBM\Updater\\ucstartup.exe ()
O4 - HKLM..\Run: [UpdateManager] C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe (Sonic Solutions)
O4 - HKCU..\Run: [ibmmessages] C:\Program Files\IBM\Messages By IBM\ibmmessages.exe (IBM)
O4 - Startup: C:\Documents and Settings\shera\Start Menu\Programs\Startup\bmem.lnk = C:\Applications\bmem\bmem.exe (Brennan Underwood)
O4 - Startup: C:\Documents and Settings\shera\Start Menu\Programs\Startup\Dropbox.lnk = C:\Documents and Settings\shera\Application Data\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/…b?1291466364281 (WUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_06)
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_02)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_05)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} http://www.adobe.com/products/acrobat/nos/gp.cab (get_atlcom Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
O20 - Winlogon\Notify\QConGina: DllName - QConGina.dll - C:\WINDOWS\System32\QConGina.dll (IBM Corp.)
O24 - Desktop WallPaper: C:\Documents and Settings\shera\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\shera\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/12/15 09:16:49 | 000,000,000 | -H– | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: vidc.tscc - C:\WINDOWS\System32\tsccvid.dll (TechSmith Corporation)
Drivers32: vidc.yv12 - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)

CREATERESTOREPOINT
Error creating restore point.

========== Files/Folders - Created Within 30 Days ==========

[2011/07/03 10:28:02 | 000,580,096 | —- | C] (OldTimer Tools) – C:\Documents and Settings\shera\Desktop\OTL.exe
[2011/07/01 18:48:21 | 000,000,000 | —D | C] – C:\WINDOWS\System32\MpEngineStore
[2011/07/01 18:45:13 | 000,000,000 | —D | C] – C:\1ff265ccf20027fc46f76727ad08f951
[2011/06/30 23:29:23 | 000,000,000 | —D | C] – C:\28ca9de61a140a4e92
[2011/06/30 23:20:01 | 000,105,472 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mup.sys
[2011/06/30 23:14:45 | 000,040,960 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ndproxy.sys
[2011/06/30 23:13:19 | 000,045,568 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wab.exe
[2011/06/28 23:45:11 | 000,000,000 | —D | C] – C:\QUARANTINE
[2011/06/28 23:32:52 | 000,000,000 | —D | C] – C:\Documents and Settings\shera\Local Settings\Application Data\Adobe
[2011/06/28 23:11:38 | 000,000,000 | —D | C] – C:\Documents and Settings\shera\My Documents\Downloads
[2011/06/28 22:32:34 | 001,495,552 | —- | C] (PGP Corporation) – C:\WINDOWS\System32\epoPGPsdk.dll
[2011/06/28 22:32:34 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\McAfee
[2011/06/28 22:32:34 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Cisco Systems
[2011/06/28 22:32:04 | 000,034,152 | —- | C] (McAfee, Inc.) – C:\WINDOWS\System32\drivers\mfebopk.sys
[2011/06/28 22:32:03 | 000,072,264 | —- | C] (McAfee, Inc.) – C:\WINDOWS\System32\drivers\mfeavfk.sys
[2011/06/28 22:32:03 | 000,064,360 | —- | C] (McAfee, Inc.) – C:\WINDOWS\System32\drivers\mfeapfk.sys
[2011/06/28 22:32:02 | 000,052,136 | —- | C] (McAfee, Inc.) – C:\WINDOWS\System32\drivers\mfetdik.sys
[2011/06/28 22:32:01 | 000,170,408 | —- | C] (McAfee, Inc.) – C:\WINDOWS\System32\drivers\mfehidk.sys
[2011/06/28 22:31:56 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\McAfee
[2011/06/28 22:31:14 | 000,000,000 | —D | C] – C:\Program Files\McAfee
[2011/06/28 22:31:14 | 000,000,000 | —D | C] – C:\Program Files\Common Files\McAfee
[2011/06/28 22:24:15 | 000,000,000 | —D | C] – C:\Documents and Settings\shera\Application Data\KeePass
[2011/06/28 22:24:03 | 000,000,000 | —D | C] – C:\Documents and Settings\shera\Application Data\Dropbox
[2011/06/28 22:23:58 | 000,000,000 | —D | C] – C:\Documents and Settings\shera\Application Data\ACD Systems
[2011/06/28 22:23:54 | 000,000,000 | —D | C] – C:\Documents and Settings\shera\Application Data\PCTeX
[2011/06/28 22:23:53 | 000,000,000 | —D | C] – C:\Documents and Settings\shera\Application Data\MathWorks
[2011/06/28 22:23:53 | 000,000,000 | —D | C] – C:\Documents and Settings\shera\Application Data\Mathematica
[2011/06/28 22:08:32 | 000,000,000 | —D | C] – C:\Documents and Settings\shera\Desktop\wlf
[2011/06/28 22:08:30 | 000,000,000 | —D | C] – C:\Documents and Settings\shera\Desktop\pdfs-etc
[2011/06/28 06:47:04 | 000,000,000 | —D | C] – C:\Documents and Settings\shera\Application Data\Malwarebytes
[2011/06/28 06:40:01 | 000,000,000 | —D | C] – C:\Documents and Settings\shera\Application Data\Adobe
[2011/06/27 05:45:11 | 000,000,000 | —D | C] – C:\Documents and Settings\shera\Application Data\Macromedia
[2011/06/27 05:44:08 | 000,000,000 | —D | C] – C:\Documents and Settings\shera\Application Data\Sun
[2011/06/26 22:29:40 | 000,000,000 | -HSD | C] – C:\Documents and Settings\shera\PrivacIE
[2011/06/26 22:29:02 | 000,000,000 | —D | C] – C:\Documents and Settings\shera\Local Settings\Application Data\Mozilla
[2011/06/26 22:28:59 | 000,000,000 | —D | C] – C:\Documents and Settings\shera\Application Data\Mozilla
[2011/06/26 22:27:07 | 000,000,000 | -HSD | C] – C:\Documents and Settings\shera\IETldCache
[2011/06/26 22:26:49 | 000,000,000 | —D | C] – C:\Documents and Settings\shera\Application Data\Identities
[2011/06/26 22:26:48 | 000,000,000 | –SD | C] – C:\Documents and Settings\shera\Application Data\Microsoft
[2011/06/26 22:26:48 | 000,000,000 | —D | C] – C:\Documents and Settings\shera\Application Data\Sonic
[2011/06/26 22:26:47 | 000,000,000 | RH-D | C] – C:\Documents and Settings\shera\SendTo
[2011/06/26 22:26:47 | 000,000,000 | RH-D | C] – C:\Documents and Settings\shera\Recent
[2011/06/26 22:26:47 | 000,000,000 | RH-D | C] – C:\Documents and Settings\shera\Application Data
[2011/06/26 22:26:47 | 000,000,000 | R–D | C] – C:\Documents and Settings\shera\Start Menu\Programs\Startup
[2011/06/26 22:26:47 | 000,000,000 | R–D | C] – C:\Documents and Settings\shera\Start Menu
[2011/06/26 22:26:47 | 000,000,000 | R–D | C] – C:\Documents and Settings\shera\My Documents\My Pictures
[2011/06/26 22:26:47 | 000,000,000 | R–D | C] – C:\Documents and Settings\shera\My Documents\My Music
[2011/06/26 22:26:47 | 000,000,000 | R–D | C] – C:\Documents and Settings\shera\My Documents
[2011/06/26 22:26:47 | 000,000,000 | R–D | C] – C:\Documents and Settings\shera\Favorites
[2011/06/26 22:26:47 | 000,000,000 | R–D | C] – C:\Documents and Settings\shera\Start Menu\Programs\Accessories
[2011/06/26 22:26:47 | 000,000,000 | -HSD | C] – C:\Documents and Settings\shera\Cookies
[2011/06/26 22:26:47 | 000,000,000 | -H-D | C] – C:\Documents and Settings\shera\PrintHood
[2011/06/26 22:26:47 | 000,000,000 | -H-D | C] – C:\Documents and Settings\shera\NetHood
[2011/06/26 22:26:47 | 000,000,000 | -H-D | C] – C:\Documents and Settings\shera\Local Settings
[2011/06/26 22:26:47 | 000,000,000 | —D | C] – C:\Documents and Settings\shera\Application Data\Symantec
[2011/06/26 22:26:47 | 000,000,000 | —D | C] – C:\Documents and Settings\shera\Local Settings\Application Data\Microsoft
[2011/06/26 22:26:47 | 000,000,000 | —D | C] – C:\Documents and Settings\shera\Desktop
[2011/06/26 22:26:47 | 000,000,000 | —D | C] – C:\Documents and Settings\shera\Local Settings\Application Data\BVRP Software
[2011/06/26 22:26:46 | 000,000,000 | -H-D | C] – C:\Documents and Settings\shera\Templates
[2011/06/26 17:42:46 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\bA00000FnCkF00000
[6 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/07/03 10:28:21 | 000,580,096 | —- | M] (OldTimer Tools) – C:\Documents and Settings\shera\Desktop\OTL.exe
[2011/07/02 21:07:27 | 000,054,156 | -H– | M] () – C:\WINDOWS\QTFont.qfn
[2011/07/02 21:06:15 | 000,002,278 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2011/07/02 21:03:21 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/07/02 21:03:18 | 1063,768,064 | -HS- | M] () – C:\hiberfil.sys
[2011/07/02 10:58:53 | 000,004,608 | —- | M] () – C:\Documents and Settings\shera\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/07/02 10:53:15 | 000,000,756 | —- | M] () – C:\Documents and Settings\shera\Desktop\Shortcut to ACDSee5.exe.lnk
[2011/07/01 18:44:56 | 000,001,355 | —- | M] () – C:\WINDOWS\imsins.BAK
[2011/07/01 07:04:58 | 000,451,836 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2011/07/01 07:04:57 | 000,073,684 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2011/07/01 00:02:15 | 000,247,752 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2011/06/30 05:29:38 | 000,001,002 | —- | M] () – C:\Documents and Settings\shera\Start Menu\Programs\Startup\Dropbox.lnk
[2011/06/28 23:37:56 | 000,000,696 | —- | M] () – C:\Documents and Settings\shera\Desktop\Shortcut to mbam.exe.lnk
[2011/06/28 23:15:12 | 000,000,709 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2011/06/26 22:28:22 | 000,000,823 | —- | M] () – C:\Documents and Settings\shera\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2011/06/26 17:50:57 | 000,000,120 | —- | M] () – C:\WINDOWS\Jxabologoce.dat
[2011/06/26 17:50:57 | 000,000,000 | —- | M] () – C:\WINDOWS\Khewidimeqagu.bin
[6 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/07/02 10:58:52 | 000,004,608 | —- | C] () – C:\Documents and Settings\shera\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/07/02 10:53:12 | 000,000,756 | —- | C] () – C:\Documents and Settings\shera\Desktop\Shortcut to ACDSee5.exe.lnk
[2011/06/30 05:29:34 | 000,001,002 | —- | C] () – C:\Documents and Settings\shera\Start Menu\Programs\Startup\Dropbox.lnk
[2011/06/28 23:37:56 | 000,000,696 | —- | C] () – C:\Documents and Settings\shera\Desktop\Shortcut to mbam.exe.lnk
[2011/06/28 23:15:12 | 000,000,715 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Mozilla Firefox.lnk
[2011/06/28 23:15:12 | 000,000,709 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2011/06/28 22:39:27 | 000,000,623 | —- | C] () – C:\Documents and Settings\shera\Start Menu\Programs\Startup\bmem.lnk
[2011/06/28 22:32:34 | 000,000,280 | —- | C] () – C:\WINDOWS\System32\epoPGPsdk.dll.sig
[2011/06/28 22:11:46 | 000,036,099 | —- | C] () – C:\Documents and Settings\shera\Desktop\SFValeRight.fig
[2011/06/28 22:11:46 | 000,001,711 | —- | C] () – C:\Documents and Settings\shera\Desktop\World Wind 1.3.lnk
[2011/06/28 22:11:46 | 000,000,790 | —- | C] () – C:\Documents and Settings\shera\Desktop\Windows Media Player.lnk
[2011/06/28 22:11:46 | 000,000,630 | —- | C] () – C:\Documents and Settings\shera\Desktop\Triplist.sxc.lnk
[2011/06/28 22:11:31 | 000,000,729 | —- | C] () – C:\Documents and Settings\shera\Desktop\rock-talk.lnk
[2011/06/28 22:11:30 | 000,153,568 | —- | C] () – C:\Documents and Settings\shera\Desktop\Polley_CV_HMSformat.pdf
[2011/06/28 22:11:30 | 000,000,735 | —- | C] () – C:\Documents and Settings\shera\Desktop\PCTeXv6.lnk
[2011/06/28 22:11:30 | 000,000,728 | —- | C] () – C:\Documents and Settings\shera\Desktop\PowerPoint.lnk
[2011/06/28 22:11:30 | 000,000,708 | —- | C] () – C:\Documents and Settings\shera\Desktop\Photoshop.lnk
[2011/06/28 22:11:22 | 000,000,830 | —- | C] () – C:\Documents and Settings\shera\Desktop\Mathematica.lnk
[2011/06/28 22:11:22 | 000,000,770 | —- | C] () – C:\Documents and Settings\shera\Desktop\LabVIEW.lnk
[2011/06/28 22:11:22 | 000,000,685 | —- | C] () – C:\Documents and Settings\shera\Desktop\KeePass Password Safe.lnk
[2011/06/28 22:11:22 | 000,000,614 | —- | C] () – C:\Documents and Settings\shera\Desktop\JMP7.lnk
[2011/06/28 22:11:21 | 000,001,531 | —- | C] () – C:\Documents and Settings\shera\Desktop\FreeMind.lnk
[2011/06/28 22:11:21 | 000,001,016 | —- | C] () – C:\Documents and Settings\shera\Desktop\Dropbox.lnk
[2011/06/28 22:11:21 | 000,000,743 | —- | C] () – C:\Documents and Settings\shera\Desktop\Illustrator.lnk
[2011/06/28 22:11:21 | 000,000,741 | —- | C] () – C:\Documents and Settings\shera\Desktop\emacs.lnk
[2011/06/28 22:11:21 | 000,000,617 | —- | C] () – C:\Documents and Settings\shera\Desktop\Gorilla.lnk
[2011/06/28 22:11:16 | 007,312,596 | —- | C] () – C:\Documents and Settings\shera\Desktop\digit-exe-windows-4_1.zip
[2011/06/28 22:11:16 | 000,000,561 | —- | C] () – C:\Documents and Settings\shera\Desktop\CDex.lnk
[2011/06/28 22:10:47 | 039,955,064 | —- | C] () – C:\Documents and Settings\shera\Desktop\Breval sonata.aif
[2011/06/26 22:28:22 | 000,000,811 | —- | C] () – C:\Documents and Settings\shera\Start Menu\Programs\Internet Explorer.lnk
[2011/06/26 22:28:02 | 000,000,796 | —- | C] () – C:\Documents and Settings\shera\Start Menu\Programs\Windows Media Player.lnk
[2011/06/26 22:26:52 | 000,000,823 | —- | C] () – C:\Documents and Settings\shera\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2011/06/26 22:26:52 | 000,000,079 | —- | C] () – C:\Documents and Settings\shera\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf
[2011/06/26 22:26:49 | 000,001,503 | —- | C] () – C:\Documents and Settings\shera\Start Menu\Programs\Remote Assistance.lnk
[2011/06/26 22:26:49 | 000,000,746 | —- | C] () – C:\Documents and Settings\shera\Start Menu\Programs\Outlook Express.lnk
[2011/06/26 17:50:57 | 000,000,120 | —- | C] () – C:\WINDOWS\Jxabologoce.dat
[2011/06/26 17:50:57 | 000,000,000 | —- | C] () – C:\WINDOWS\Khewidimeqagu.bin
[2009/04/05 14:27:12 | 000,001,363 | —- | C] () – C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2005/03/13 13:18:00 | 000,000,048 | —- | C] () – C:\WINDOWS\PerWin.ini
[2004/12/15 18:18:14 | 000,000,000 | —- | C] () – C:\WINDOWS\nsreg.dat
[2004/12/15 18:08:08 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2004/12/15 15:32:25 | 000,099,965 | —- | C] () – C:\WINDOWS\UninstallFirefox.exe
[2004/12/15 15:31:18 | 000,007,469 | —- | C] () – C:\WINDOWS\mozver.dat
[2004/12/15 13:18:21 | 000,041,324 | —- | C] () – C:\WINDOWS\System32\winio.sys
[2004/12/15 13:18:07 | 000,000,156 | —- | C] () – C:\WINDOWS\matlab.ini
[2004/12/15 09:19:58 | 000,069,632 | —- | C] () – C:\WINDOWS\uinst001.exe
[2004/12/07 21:01:52 | 000,002,481 | —- | C] () – C:\WINDOWS\System32\OEMINFO.INI
[2004/12/07 20:40:33 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2004/12/07 20:39:07 | 000,184,320 | —- | C] () – C:\WINDOWS\TPBATHLP.EXE
[2004/12/07 20:37:52 | 000,028,672 | —- | C] () – C:\WINDOWS\System32\JAWTAccessBridge.dll
[2004/12/07 20:37:00 | 000,086,016 | —- | C] () – C:\WINDOWS\System32\PcdrKernelModeServices.dll
[2004/12/07 20:37:00 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\ProgressTrace.dll
[2004/12/07 20:36:11 | 000,002,432 | —- | C] () – C:\WINDOWS\System32\drivers\IBMBLDID.SYS
[2004/12/07 20:31:18 | 000,032,256 | —- | C] () – C:\WINDOWS\System32\drivers\psasrv.exe
[2004/12/07 20:23:57 | 000,204,800 | —- | C] () – C:\WINDOWS\System32\IVIresizeW7.dll
[2004/12/07 20:23:57 | 000,200,704 | —- | C] () – C:\WINDOWS\System32\IVIresizeA6.dll
[2004/12/07 20:23:57 | 000,192,512 | —- | C] () – C:\WINDOWS\System32\IVIresizeP6.dll
[2004/12/07 20:23:57 | 000,192,512 | —- | C] () – C:\WINDOWS\System32\IVIresizeM6.dll
[2004/12/07 20:23:57 | 000,188,416 | —- | C] () – C:\WINDOWS\System32\IVIresizePX.dll
[2004/12/07 20:23:57 | 000,020,480 | —- | C] () – C:\WINDOWS\System32\IVIresize.dll
[2004/12/07 20:22:20 | 000,000,136 | —- | C] () – C:\WINDOWS\WinInit.ini
[2004/12/07 20:21:51 | 000,053,248 | —- | C] () – C:\WINDOWS\System32\pxhpinst.exe
[2004/12/07 20:15:13 | 000,110,592 | —- | C] () – C:\WINDOWS\_tpiu000.exe
[2004/12/07 20:15:06 | 000,061,440 | —- | C] () – C:\WINDOWS\System32\FPCALL.dll
[2004/12/07 20:14:19 | 000,009,341 | —- | C] () – C:\WINDOWS\System32\drivers\TDSMAPI.SYS
[2004/12/07 20:13:45 | 000,032,768 | —- | C] () – C:\WINDOWS\System32\TpKmpSvc.exe
[2004/12/07 20:13:34 | 000,147,456 | —- | C] () – C:\WINDOWS\System32\ssleay32.dll
[2004/12/07 20:13:34 | 000,036,864 | —- | C] () – C:\WINDOWS\System32\acs.exe
[2004/12/07 20:13:33 | 000,651,264 | —- | C] () – C:\WINDOWS\System32\libeay32.dll
[2004/12/07 20:13:00 | 000,110,592 | —- | C] () – C:\WINDOWS\System32\AegisI5.exe
[2004/08/09 15:03:43 | 000,000,791 | —- | C] () – C:\WINDOWS\orun32.ini
[2004/08/09 15:01:40 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2004/08/09 14:51:56 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2004/08/09 14:46:20 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2004/08/09 14:45:31 | 000,247,752 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2004/07/27 01:09:40 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini
[2004/07/15 20:25:26 | 000,005,632 | —- | C] () – C:\WINDOWS\System32\nipxiini.dll
[2004/07/15 19:54:56 | 000,008,704 | —- | C] () – C:\WINDOWS\System32\niidaqlv.dll
[2004/07/15 18:45:08 | 000,005,081 | —- | C] () – C:\WINDOWS\System32\ni7030.dat
[2004/07/15 18:35:54 | 000,028,672 | —- | C] () – C:\WINDOWS\System32\NIAutoConfig.exe
[2004/07/15 18:35:52 | 000,028,672 | —- | C] () – C:\WINDOWS\System32\NIAutoCfgRda.exe
[2004/07/09 13:40:48 | 000,059,497 | —- | C] () – C:\WINDOWS\System32\nispdu.dll
[2004/07/08 22:35:32 | 000,010,349 | —- | C] () – C:\WINDOWS\System32\niscdrau.dll
[2004/07/08 22:28:00 | 000,068,202 | —- | C] () – C:\WINDOWS\System32\drivers\nispdk.dll
[2004/07/07 14:56:20 | 000,003,584 | —- | C] () – C:\WINDOWS\System32\nipalpg.dll
[2004/05/03 02:13:50 | 000,045,056 | —- | C] () – C:\WINDOWS\System32\gpib-vdd.dll
[2004/05/03 02:09:52 | 000,036,864 | —- | C] () – C:\WINDOWS\System32\RemoveRebootKey.exe
[2004/03/19 16:57:22 | 000,000,244 | —- | C] () – C:\WINDOWS\System32\nirpc.ini
[2004/03/19 16:12:10 | 000,045,056 | —- | C] () – C:\WINDOWS\System32\pwdmon.dll
[2004/03/19 16:12:10 | 000,019,692 | —- | C] () – C:\WINDOWS\ibmprc.ini
[2004/02/17 17:52:10 | 000,008,448 | —- | C] () – C:\WINDOWS\System32\drivers\nienetpm.sys
[2004/02/17 17:51:44 | 000,006,173 | —- | C] () – C:\WINDOWS\System32\gpib.ini
[2004/01/09 10:10:32 | 000,143,360 | —- | C] () – C:\WINDOWS\System32\AIBMRUNL.dll
[2003/07/29 11:00:00 | 000,007,140 | —- | C] () – C:\WINDOWS\System32\drivers\cvintdrv.sys
[2002/12/11 10:57:00 | 000,012,653 | —- | C] () – C:\WINDOWS\System32\GPIB.DLL
[2002/03/21 13:51:52 | 000,503,808 | R— | C] () – C:\WINDOWS\System32\lt_xtrans.dll
[2002/03/21 13:51:52 | 000,286,720 | R— | C] () – C:\WINDOWS\System32\MrSIDD.dll
[2002/03/21 13:51:52 | 000,163,840 | R— | C] () – C:\WINDOWS\System32\lt_common.dll
[2002/03/21 13:51:52 | 000,126,976 | R— | C] () – C:\WINDOWS\System32\lt_trans.dll
[2002/03/21 13:51:52 | 000,069,632 | R— | C] () – C:\WINDOWS\System32\lt_meta.dll
[2002/03/21 13:51:52 | 000,053,248 | R— | C] () – C:\WINDOWS\System32\lt_encrypt.dll
[2002/03/21 13:51:52 | 000,020,480 | R— | C] () – C:\WINDOWS\System32\lt_messagetext.dll
[2002/03/20 22:01:06 | 000,006,688 | R— | C] () – C:\WINDOWS\System32\Digita.sys
[2002/03/20 22:00:20 | 000,049,152 | R— | C] () – C:\WINDOWS\System32\TransportUSB.dll
[2002/03/20 22:00:20 | 000,049,152 | R— | C] () – C:\WINDOWS\System32\TransportSerial.dll
[2002/03/20 22:00:20 | 000,049,152 | R— | C] () – C:\WINDOWS\System32\TransportIrDA.dll
[2002/03/20 22:00:20 | 000,049,152 | R— | C] () – C:\WINDOWS\System32\TransportIrCOMM.dll
[2002/01/09 22:38:20 | 000,106,496 | —- | C] () – C:\WINDOWS\desktopset.exe
[2001/10/28 17:42:30 | 000,116,224 | —- | C] () – C:\WINDOWS\System32\pdfcmnnt.dll
[2001/08/23 11:26:08 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\OEMBIOS.BIN
[2001/08/23 11:24:30 | 000,004,524 | —- | C] () – C:\WINDOWS\System32\OEMBIOS.DAT
[1999/11/15 13:58:52 | 000,028,672 | —- | C] () – C:\WINDOWS\NIRegApp.exe
[1999/11/04 12:00:38 | 000,001,840 | —- | C] () – C:\WINDOWS\System32\niidaqs.dll
[1999/01/22 14:46:56 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\MSRTEDIT.DLL
[1998/10/02 13:02:46 | 000,060,416 | —- | C] () – C:\WINDOWS\System32\Opcenum.exe
[1980/01/01 04:00:00 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[1980/01/01 04:00:00 | 000,451,836 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[1980/01/01 04:00:00 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[1980/01/01 04:00:00 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[1980/01/01 04:00:00 | 000,131,072 | —- | C] () – C:\WINDOWS\System32\e1000msg.dll
[1980/01/01 04:00:00 | 000,122,880 | —- | C] () – C:\WINDOWS\System32\tp4uires.dll
[1980/01/01 04:00:00 | 000,073,684 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[1980/01/01 04:00:00 | 000,057,344 | —- | C] () – C:\WINDOWS\System32\tp4unins.exe
[1980/01/01 04:00:00 | 000,057,344 | —- | C] () – C:\WINDOWS\System32\ibmpmsvc.exe
[1980/01/01 04:00:00 | 000,049,152 | —- | C] () – C:\WINDOWS\System32\tpinspm.dll
[1980/01/01 04:00:00 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\mib.bin
[1980/01/01 04:00:00 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[1980/01/01 04:00:00 | 000,005,600 | —- | C] () – C:\WINDOWS\System32\tp4table.dat
[1980/01/01 04:00:00 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[1980/01/01 04:00:00 | 000,001,804 | —- | C] () – C:\WINDOWS\System32\dcache.bin
[1980/01/01 04:00:00 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat

========== LOP Check ==========

[2004/12/14 18:26:15 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\ACD Systems
[2011/06/26 17:42:46 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\bA00000FnCkF00000
[2004/12/07 20:23:02 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\ibm
[2011/06/28 22:24:03 | 000,000,000 | —D | M] – C:\Documents and Settings\shera\Application Data\ACD Systems
[2011/07/03 10:26:56 | 000,000,000 | —D | M] – C:\Documents and Settings\shera\Application Data\Dropbox
[2011/07/01 23:08:31 | 000,000,000 | —D | M] – C:\Documents and Settings\shera\Application Data\KeePass
[2011/06/28 22:23:56 | 000,000,000 | —D | M] – C:\Documents and Settings\shera\Application Data\PCTeX
[2005/01/29 16:39:32 | 000,000,554 | —- | M] () – C:\WINDOWS\Tasks\BMMTask.job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2004/12/15 09:16:49 | 000,000,000 | -H– | M] () – C:\AUTOEXEC.BAT
[2004/12/15 09:15:46 | 000,000,194 | RHS- | M] () – C:\BOOT.INI
[2004/12/07 20:17:08 | 000,000,000 | -H– | M] () – C:\BOOTLOG.PRV
[2004/12/07 20:41:40 | 000,000,000 | -H– | M] () – C:\BOOTLOG.TXT
[2004/08/09 14:35:38 | 000,000,512 | -HS- | M] () – C:\BOOTSECT.DOS
[2004/12/07 20:38:46 | 000,000,355 | —- | M] () – C:\ccrrec.ver
[2004/12/15 09:16:49 | 000,000,000 | -H– | M] () – C:\CONFIG.SYS
[2004/12/07 20:21:38 | 000,000,754 | —- | M] () – C:\drivez.log
[2011/07/02 21:03:18 | 1063,768,064 | -HS- | M] () – C:\hiberfil.sys
[2004/12/15 09:16:49 | 000,000,000 | -H– | M] () – C:\IO.SYS
[2004/12/07 20:19:48 | 000,000,164 | —- | M] () – C:\LOGFILE.txt
[2004/08/04 09:00:00 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2009/01/18 12:57:40 | 000,250,048 | RHS- | M] () – C:\ntldr
[2011/07/02 21:03:15 | 1258,291,200 | -HS- | M] () – C:\pagefile.sys
[2004/12/07 21:01:52 | 000,001,370 | —- | M] () – C:\SYSLEVEL.IBM
[2004/12/07 21:00:20 | 000,000,043 | —- | M] () – C:\TCPACHIP.LOG
[2004/12/15 15:00:10 | 000,000,043 | —- | M] () – C:\ver.txt

< %systemroot%\Fonts\*.com >

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2004/08/09 14:54:48 | 000,000,067 | -HS- | M] () – C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >
[2003/07/15 20:35:04 | 000,002,193 | —- | M] () – C:\WINDOWS\system32\TpShPrm.jpg
[6 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\*.jpg >
[2002/10/10 17:07:40 | 000,055,408 | —- | M] () – C:\WINDOWS\1024 x 768 IBM Americas Map.jpg
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2004/08/09 14:45:10 | 000,094,208 | —- | M] () – C:\WINDOWS\System32\config\default.sav
[2004/08/09 14:45:10 | 000,659,456 | —- | M] () – C:\WINDOWS\System32\config\software.sav
[2004/08/09 14:45:10 | 000,876,544 | —- | M] () – C:\WINDOWS\System32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2011/06/26 22:28:18 | 000,000,119 | -HS- | M] () – C:\Documents and Settings\shera\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
[2004/08/09 15:03:14 | 000,000,079 | —- | M] () – C:\Documents and Settings\shera\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

< %USERPROFILE%\Desktop\*.exe >
[2011/07/03 10:28:21 | 000,580,096 | —- | M] (OldTimer Tools) – C:\Documents and Settings\shera\Desktop\OTL.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-07-01 23:27:18

< End of report >

++++++++++++++++++++++++++++++ extras.txt ++++++++++++++++++++++++++++
OTL Extras logfile created on: 7/3/2011 10:30:01 AM - Run 1
OTL by OldTimer - Version 3.2.25.0 Folder = C:\Documents and Settings\shera\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1014.42 Mb Total Physical Memory | 270.18 Mb Available Physical Memory | 26.63% Memory free
2.07 Gb Paging File | 1.36 Gb Available in Paging File | 65.91% Paging File free
Paging file location(s): C:\pagefile.sys 1200 1512 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 33.24 Gb Total Space | 7.12 Gb Free Space | 21.42% Space Free | Partition Type: NTFS

Computer Name: EARWIG | User Name: shera | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.url [@ = InternetShortcut] – rundll32.exe shdocvw.dll,OpenURL %l

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Applications\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] – "%1" %*
htmlfile – "C:\Applications\Microsoft Office\Office\msohtmed.exe" %1 (Microsoft Corporation)
InternetShortcut [open] – rundll32.exe shdocvw.dll,OpenURL %l
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [ACDBrowse] – "C:\Applications\ACD Systems\ACDSee\5.0\ACDSee5.exe" "%1" (ACD Systems, Ltd.)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusOverride" = 0
"FirewallOverride" = 0
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\IBM\Updater\jre\bin\java.exe" = C:\Program Files\IBM\Updater\jre\bin\java.exe:*:Enabled:IBM Update Connector – (IBM)
"C:\Program Files\IBM\Updater\jre\bin\javaw.exe" = C:\Program Files\IBM\Updater\jre\bin\javaw.exe:*:Enabled:IBM Update Connector – (IBM)
"C:\Program Files\IBM\Updater\ucsmb.exe" = C:\Program Files\IBM\Updater\ucsmb.exe:*:Enabled:IBM Update Connector – (IBM Corporation, Inc.)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\IBM\Updater\jre\bin\java.exe" = C:\Program Files\IBM\Updater\jre\bin\java.exe:*:Enabled:IBM Update Connector – (IBM)
"C:\Program Files\IBM\Updater\jre\bin\javaw.exe" = C:\Program Files\IBM\Updater\jre\bin\javaw.exe:*:Enabled:IBM Update Connector – (IBM)
"C:\Program Files\IBM\Updater\ucsmb.exe" = C:\Program Files\IBM\Updater\ucsmb.exe:*:Enabled:IBM Update Connector – (IBM Corporation, Inc.)
"C:\Applications\National Instruments\LabVIEW 7.1\LabVIEW.exe" = C:\Applications\National Instruments\LabVIEW 7.1\LabVIEW.exe:*:Enabled:LabVIEW 7.1 Development System – ()
"C:\Applications\Mozilla Firefox\firefox.exe" = C:\Applications\Mozilla Firefox\firefox.exe:*:Enabled:Firefox – (Mozilla Corporation)
"C:\Program Files\uTorrent\uTorrent.exe" = C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent
"C:\Documents and Settings\shera\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\octoshape\octoshape.exe" = C:\Documents and Settings\shera\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\octoshape\octoshape.exe:*:Enabled:Octoshape add-in for Adobe Flash Player
"C:\Documents and Settings\shera\Application Data\Dropbox\bin\Dropbox.exe" = C:\Documents and Settings\shera\Application Data\Dropbox\bin\Dropbox.exe:*:Enabled:Dropbox – (Dropbox, Inc.)
"C:\Applications\Mozilla Firefox 1.0.4\firefox.exe" = C:\Applications\Mozilla Firefox 1.0.4\firefox.exe:*:Enabled:Firefox
"C:\Program Files\McAfee\Common Framework\FrameworkService.exe" = C:\Program Files\McAfee\Common Framework\FrameworkService.exe:*:Enabled:McAfee Framework Service – (McAfee, Inc.)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00010409-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 SR-1 Professional
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{03178905-E40F-4FF3-AD16-D9310A89D8A6}" = NI Distribution Information - PDS English
"{03717BDF-FDD0-4737-9FF4-4A85378ADB37}" = NI STC 1.2.0
"{09DA4F91-2A09-4232-AB8C-6BC740096DE3}" = Sonic Update Manager
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{0C13CF88-5BC0-4DEF-B75D-434B934FFEFA}" = NI Timing 1.2.0
"{0F19C4E5-7985-479E-9E90-CA8EDB93B8A1}" = NI DAQ Assistant 1.3.0
"{0F56CF81-C5FB-4727-B1F5-AB1F14ADA131}" = NI PXI Provider 1.4 for MAX
"{0FFBCE8F-AAF9-4556-B06B-77835A5C38AF}" = NI-DAQmx DSA Support 1.3.0
"{1007F41F-7D69-468E-8017-3849A5A973C2}" = IBM ThinkVantage Technologies Welcome Message
"{105CFC7C-6992-11D5-BD9D-000102C10FD8}" = Lizardtech DjVu Control
"{11783F13-C3A9-44A8-929B-21A476F65272}" = IBM Rescue and Recovery with Rapid Restore
"{11A8F66F-7B73-422C-88B6-7187BEF92AE7}" = NI LabVIEW 7.1 Core Essentials
"{1206EF92-2E83-4859-ACCB-2048C3CB7DA6}" = IBM DLA
"{12089734-6365-4E86-A926-310AAED42527}" = JMP 7
"{13331087-2FC7-4DB5-934C-4FF832930902}" = NI Math Interface Toolkit 1.0
"{1526D87C-A955-4FAB-BF18-697BA457E352}" = Norton WMI Update
"{18D3491C-835C-46EC-80B5-8A2C7FD7602B}" = NI-VISA Server 3.2f1
"{1A55480E-26E3-40A8-B51A-4397B4FAFB6D}" = NI-VXI Support for LabVIEW 1.2.1f0
"{1D4C2F2A-236A-42F4-97A0-EC944E78EBDC}" = NI LabVIEW Run-Time Engine 7.0
"{1D7D3205-FB9E-49FE-BD3A-65E82E383C93}" = NI-DAQmx 7.3
"{1EA42080-A2DC-412B-A41E-7F5BFF4C2D62}" = Traditional NI-DAQ Documentation 1.0.3
"{1F7CCFA3-D926-4882-B2A5-A0217ED25597}" = PC-Doctor for Windows
"{1FFF06B2-F1DB-4040-BB8C-1612869A8242}" = NI Measurement & Automation Explorer 3.1.1
"{2111B23F-7FDA-4A41-8309-E5A1663CA296}" = IBM ThinkPad Keyboard Customizer Utility
"{22B71A00-4DED-11D4-A5E5-0004AC564F43}" = IBM Access Connections
"{251F8A77-7ACB-47BB-98CE-9F671B69D90F}" = NI Example Finder 2.0
"{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java™ 6 Update 22
"{2878CD7B-FD12-4ADE-9B90-11DF678EF18C}" = NI Instrument IO Assistant for LabVIEW 7.1
"{2CA24006-E10F-412E-AF5B-BF0CECA5B39A}" = NI SCXI 1.2.0
"{2F824C4A-EADA-4874-AEE5-3203EF689D35}" = NI-DAQmx Switch Core 1.3.0
"{32154C21-82CF-4D90-97CF-FD2AC696579B}" = NI-DAQ Provider for MAX
"{3248F0A8-6813-11D6-A77B-00B0D0150060}" = J2SE Runtime Environment 5.0 Update 6
"{3248F0A8-6813-11D6-A77B-00B0D0160020}" = Java™ 6 Update 2
"{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java™ 6 Update 5
"{339E14FF-8FDC-4809-AAF2-87BA22905C7F}" = DirectX for Managed Code Update (December 2004)
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{35C03C04-3F1F-42C2-A989-A757EE691F65}" = McAfee VirusScan Enterprise
"{36495C59-089C-49D1-BD15-9E5BD86DC9A1}" = ItsDeductible Express
"{3C031817-A0A7-46CD-BF39-0D2565B256B7}" = NI-DAQmx MAX Support 1.2.0
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3CA1BED8-F427-4369-9A5C-A2EBA60D9C69}" = NI-RPC 3.1.1f0 for PharLap
"{3EBD3749-304E-4A4C-9575-C00E5F015217}" = Apple Mobile Device Support
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{41266CAD-3D37-433E-8FD9-8635A7FF776E}" = NI-DAQ C API 7.2
"{43E144BB-7C40-40BD-8E4D-8715CCAB5C4F}" = NI Assistant Framework
"{46893F4E-733A-426D-80BE-929A5A269646}" = NI LVBrokerAux71
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4CEE515B-8F33-4926-B6D4-0A88577434E3}" = NI DDSP
"{4DF43A0E-0EFD-4E06-8C5F-DA05DB177D27}" = NI Assistant Framework LabVIEW Code Generator 61
"{50A07A8D-EA01-41CA-BC22-DB92A328AC5B}" = NI Common Digital 1.2.0
"{52A0629C-FBD8-4829-B804-2340178CBA09}" = NI LabVIEW Run-Time Engine 7.1
"{5491F066-6FD8-4893-A033-A92EC54E6851}" = NI-DAQ 7.0 Document Set 1.0.1
"{54CED721-471C-4F40-914C-4630DE07CE8D}" = NI LVBroker
"{5C0E53EA-3113-45FA-A917-140996D30197}" = NI-DAQmx Expert Framework 1.2.0
"{607C8C4E-5FEC-4656-9DA1-3D6D6B7DE0ED}" = NI LabVIEW Advanced Analysis 7.1
"{612E0FD9-0A25-41A1-A054-6EFC627B2DD0}" = NI-RPC 3.1.1f0
"{63569CE9-FA00-469C-AF5C-E5D4D93ACF91}" = Windows Genuine Advantage v1.3.0254.0
"{68086CF6-FEEA-4EAA-9912-B15BBD51995D}" = NI Measurement Studio Recipe Processor
"{68B3B910-727B-47A9-B764-F697C7D65002}" = NI LabWindows/CVI 7.0 Code Generator
"{69726177-CA53-474A-AA73-D9BF43C15191}" = NI-DAQmx support for LabVIEW
"{6C72E14A-C1F3-45E5-8810-83CE3C19ED63}" = IBM 32-bit Runtime Environment for Java 2, v1.4.1
"{6CE96A14-61E2-48CC-837E-22710A953ADE}" = IBM Themes
"{703011D4-4003-4E36-B051-4EFDA0144320}" = NI-MRU 2.2.1f0
"{72806716-7088-41B2-8FA6-717A2A164DAB}" = IBM Active Protection System
"{7579CE41-6F5E-4C24-B235-5DEB1CBD1833}" = NI Assistant Framework LabVIEW Code Generator 70
"{768C5E6C-A505-42C9-A8D4-86E05BC60C35}" = NI MIO Device Drivers 1.3.0
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{7DBAAE54-8EBA-4559-A9EE-C83E77639278}" = NI-DAQ 7.3, Traditional
"{7EB0D766-982D-4187-88A7-6E0780BAA69F}" = NI LabVIEW Professional Tools 7.1
"{83C03FBE-4492-4133-BBAB-421CD88ADA32}" = OpenOffice.org 2.3
"{84D0BDE5-5871-4EC8-8D31-63354170BF55}" = NI LabVIEW Picture Control and CIN Tools 7.1
"{871F133C-B87C-4AA3-8F32-E42E897CA86E}" = NI-MXDF 1.2.0f0
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel® Extreme Graphics 2 Driver
"{8D815BF3-2399-459C-B121-49373FEFB9E8}" = IBM Update Connector
"{91810AFC-A4F8-4EBA-A5AA-B198BBC81144}" = InterVideo WinDVD
"{9209FFD4-8D01-438A-9B07-4B5C14EC0666}" = NI-VISA Runtime 3.2f1
"{928BF1DA-CBF0-4BF7-A351-8E0F9EC77337}" = NI Spy 2.1.0f0
"{94435A21-A597-41AC-85BA-680E8348EB50}" = NI LabVIEW Application Builder 7.1
"{951BAE8C-D04C-4742-9FB4-659FEC299916}" = NI Remote Provider for MAX
"{9541FED0-327F-4DF0-8B96-EF57EF622F19}" = IBM RecordNow!
"{95A890AA-B3B1-44B6-9C18-A8F7AB3EE7FC}" = QuickTime
"{9C235712-49D6-4F91-A7AD-70A9776244EA}" = NI-488.2 2.20
"{9CED486E-968D-4821-B379-594B04F4B476}" = NI Uninstaller
"{9E970E8C-CF09-4FB6-96E5-3C8B075FDFE8}" = NI-VISA 3.2f1
"{9FAC9E5C-0D20-4DBF-AFE5-2E09C52A95A2}" = IBM Wireless LAN Adapters Software (11a/b, 11b/g, 11a/b/g)
"{A3E1134C-5AB6-4FD6-B11B-407B7D97FBD0}" = NI LVBrokerAux1071
"{A3E88590-7883-47B2-97CA-D96250F5814C}" = NI-MDBG 1.1.0f0
"{A7A7E4F3-52D4-4E54-8FF6-BAD3D3EDBD9A}" = NI-ORB 1.1.0f1
"{A87D7BC1-24E3-4B03-8909-A9CC592E5B32}" = NI-PAL 1.8.2f0
"{AAB72BEE-A87B-4735-9CEF-AFB93EC401BE}" = Mathematica 5
"{AC76BA86-7AD7-1033-7B44-A81300000003}" = Adobe Reader 8.1.7
"{AECDDE86-31E1-4E61-ACFA-5B50BC232DBE}" = NI-DAQ INF Files 7.3.0
"{AF5E8D43-49AD-4BE7-A941-2BB0A8CACA62}" = ACDSee 5.0 Standard
"{B09B6544-B3F5-4C7E-AD31-57DDB4B409B1}" = MIT SecureCRT 4.0.3
"{B2672F02-82AD-457C-9E81-A2C20D073748}" = NI Remote PXI Provider for MAX
"{B74F042E-E1B9-4A5B-8D46-387BB172F0A4}" = Apple Software Update
"{B8A204BC-7177-470E-BBDD-47256D05B325}" = iTunes
"{B9C78D5B-665C-4DCB-BE82-3F71DD263968}" = NI Instrument IO Assistant
"{BB36E39E-ED11-43A3-A7FA-B4E550FFA35E}" = NI LVBrokerAux70
"{C47256EE-D8F4-43F0-AD4F-BCD28E879DF1}" = NI-DIM 1.1.0f0
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{D3BA79B7-823E-437A-A7E0-BDB2CB62C7BE}" = NI LabVIEW 7.1
"{DCF8B0DF-99FA-407C-A213-07083237A017}" = NI-DAQmx Documentation 1.1.1
"{E07E0FC0-8F3D-45CB-98A4-A571EECB5FC6}" = NI PXI Resource Manager 1.3.0
"{E862BC9A-A1C6-4863-BB20-B5F39051A18A}" = NI Calibration Provider for MAX
"{E8C8DB97-8C1D-425B-A706-69AAE1A0AAE3}" = NI-VISA Provider 3.2 for MAX
"{E901B3E8-8499-42CA-8B70-3E28B28BB4FA}" = NI Software Provider for MAX
"{EA664480-3844-11D5-8C25-444553540000}" = IBM TrackPoint Accessibility Features
"{EC60B018-251A-47E7-A838-CECB70AE46EF}" = NI LabVIEW Service Locator 1.0
"{EC6AF20D-4376-4070-BEE4-D3A0DFF7E140}" = Access IBM
"{EDE1DBA0-A030-46FD-8AA3-68D4B42A7F83}" = NI Measurements eXtensions for PAL 1.2.0
"{EEA99573-AFFE-49B4-973F-702BF2E9C99B}" = NI-488.2 Provider for MAX
"{F03B416A-80AC-421A-9C13-6C34A2E9F446}" = NI Assistant Framework LabVIEW Code Generator 71
"{F386C340-DF4B-4BBA-9503-420FB7EDB395}" = Wallpapers
"{F413B3A4-EE5D-457C-BAE5-6E58D9589ED5}" = Access IBM Message Center
"{F7BCD5CA-0E96-4F60-9613-E23E87131833}" = NI DPPH
"{FCC9BA43-E00A-4269-B0CA-6708ED300914}" = NI LabVIEW Full 7.1
"{FE4AC94A-F3EB-4383-A6A8-03B87B8536F5}" = MIT SecureFX 2.1.3
"1656e28ae7cb12a3498502c5526295f6" = SAS Private JRE (J2SE™ Java Runtime Environment 1.4.2_09)
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Illustrator 9.0.1" = Adobe Illustrator 9.0.1
"Adobe Photoshop 6.0" = Adobe Photoshop 6.0
"Adobe SVG Viewer" = Adobe SVG Viewer
"AFPL Ghostscript 8.14" = AFPL Ghostscript 8.14
"AFPL Ghostscript Fonts" = AFPL Ghostscript Fonts
"Aspell English Dictionary_is1" = Aspell English Dictionary-0.50-2
"B991B020-2968-11D8-AF23-444553540000_is1" = FreeMind
"bmem" = bmem
"CNXT_MODEM_PCI_VEN_8086&DEV;_24C6&SUBSYS;_05591014" = IBM Integrated 56K Modem
"EasyEject Utility" = IBM ThinkPad EasyEject Utility
"getPlus®_ocx" = getPlus®_ocx
"GNU Aspell_is1" = GNU Aspell 0.50-3
"GSview 4.6" = GSview 4.6
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"InstallShield_{6C72E14A-C1F3-45E5-8810-83CE3C19ED63}" = IBM 32-bit Runtime Environment for Java 2, v1.4.1
"InstallShield_{AAB72BEE-A87B-4735-9CEF-AFB93EC401BE}" = Mathematica 5
"KeePassPasswordSafe2_is1" = KeePass Password Safe 2.13
"LiveUpdate" = LiveUpdate 1.90 (Symantec Corporation)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware version 1.51.0.1200
"MatlabR14" = MATLAB Family of Products Release 14
"Mendeley Desktop" = Mendeley Desktop 0.9.4.1
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Mozilla Firefox 5.0 (x86 en-US)" = Mozilla Firefox 5.0 (x86 en-US)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NASA World Wind 1.3" = NASA World Wind 1.3
"NI Uninstaller" = National Instruments Software
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"PCTeXv6_is1" = PCTeX version 6
"Power Features" = IBM ThinkPad Battery MaxiMiser and Power Management Features
"Power Management Driver" = IBM ThinkPad Power Management Driver
"Presentation Director" = IBM ThinkPad Presentation Director
"PROSet" = Intel® PRO Network Adapters and Drivers
"ThinkPad Configuration" = IBM ThinkPad Configuration
"ThinkPad FullScreen Magnifier" = ThinkPad FullScreen Magnifier
"ThinkPadSoftwareInstaller" = ThinkPad Software Installer
"TrackPoint" = IBM TrackPoint Support
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinZip" = WinZip
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 6/28/2011 10:53:54 PM | Computer Name = EARWIG | Source = McLogEvent | ID = 1008
Description = The McShield service terminated unexpectedly. Please review event 5019
or 5051 for details. The McShield service will be restarted in 10 seconds;

Error - 7/1/2011 7:08:03 AM | Computer Name = EARWIG | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 8.0.6001.18702, faulting
module mshtml.dll, version 8.0.6001.18975, fault address 0x0008b02d.

Error - 7/1/2011 7:08:19 AM | Computer Name = EARWIG | Source = Application Error | ID = 1001
Description = Fault bucket 2060153407.

Error - 7/2/2011 8:38:59 AM | Computer Name = EARWIG | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 8.0.6001.18702, faulting
module mshtml.dll, version 8.0.6001.19088, fault address 0x001bad17.

Error - 7/2/2011 11:04:00 AM | Computer Name = EARWIG | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 8.0.6001.18702, faulting
module mshtml.dll, version 8.0.6001.19088, fault address 0x0038f58b.

Error - 7/2/2011 11:27:16 AM | Computer Name = EARWIG | Source = McLogEvent | ID = 259
Description = The scan found detections. Scan engine version 5400.1158 DAT version
6394.

Error - 7/2/2011 3:29:15 PM | Computer Name = EARWIG | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 8.0.6001.18702, faulting
module ntdll.dll, version 5.1.2600.5755, fault address 0x00028c0b.

Error - 7/2/2011 3:30:40 PM | Computer Name = EARWIG | Source = MsiInstaller | ID = 11706
Description = Product: Microsoft Office 2000 SR-1 Professional – Error 1706. No
valid source could be found for product Microsoft Office 2000 SR-1 Professional.
The Windows installer cannot continue.

Error - 7/2/2011 6:39:44 PM | Computer Name = EARWIG | Source = McLogEvent | ID = 259
Description = The scan found detections. Scan engine version 5400.1158 DAT version
6394.

Error - 7/2/2011 9:27:23 PM | Computer Name = EARWIG | Source = McLogEvent | ID = 259
Description = The scan found detections. Scan engine version 5400.1158 DAT version
6394.

[ System Events ]
Error - 7/1/2011 7:22:20 PM | Computer Name = EARWIG | Source = NtServicePack | ID = 921877
Description = Windows XP KB2393802 installation failed. An internal error occurred.


Error - 7/1/2011 7:22:28 PM | Computer Name = EARWIG | Source = Windows Update Agent | ID = 20
Description = Installation Failure: Windows failed to install the following update
with error 0x8007054f: Security Update for Windows XP (KB2393802).

Error - 7/1/2011 8:26:08 PM | Computer Name = EARWIG | Source = DCOM | ID = 10010
Description = The server {0002DF01-0000-0000-C000-000000000046} did not register
with DCOM within the required timeout.

Error - 7/1/2011 8:26:42 PM | Computer Name = EARWIG | Source = Service Control Manager | ID = 7022
Description = The McAfee McShield service hung on starting.

Error - 7/1/2011 8:28:45 PM | Computer Name = EARWIG | Source = DCOM | ID = 10010
Description = The server {0002DF01-0000-0000-C000-000000000046} did not register
with DCOM within the required timeout.

Error - 7/1/2011 8:30:32 PM | Computer Name = EARWIG | Source = DCOM | ID = 10010
Description = The server {0002DF01-0000-0000-C000-000000000046} did not register
with DCOM within the required timeout.

Error - 7/2/2011 6:13:19 AM | Computer Name = EARWIG | Source = Service Control Manager | ID = 7011
Description = Timeout (30000 milliseconds) waiting for a transaction response from
the WZCSVC service.

Error - 7/2/2011 3:37:21 PM | Computer Name = EARWIG | Source = DCOM | ID = 10010
Description = The server {0002DF01-0000-0000-C000-000000000046} did not register
with DCOM within the required timeout.

Error - 7/2/2011 3:39:27 PM | Computer Name = EARWIG | Source = DCOM | ID = 10010
Description = The server {0002DF01-0000-0000-C000-000000000046} did not register
with DCOM within the required timeout.

Error - 7/2/2011 9:05:22 PM | Computer Name = EARWIG | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the ACU Configuration Service
service to connect.


< End of report >

Hello,
Welcome to WhatTheTech. My name is mowman, and I will be helping you fix your problems.

If you do not make a reply in 3 days, we will have to close your topic.

You may want to keep the link to this topic in your favorites. Alternatively, you can click the Options button at the top bar of this topic and Track this topic. The topics you are tracking can be found by clicking on My Topics at the top of any page.

Please take note of some guidelines for this fix:

•Refrain from making any changes to your computer including installing/uninstall programs, deleting files, modifying the registry, and running scanners or tools. Doing so could cause changes to the directions I have to give you and prolong the time required. Further more, you should not be taking any advice relating to this computer from any other source throughout the course of this fix.
•If you do not understand any step(s) provided, please do not hesitate to ask before continuing. I would much rather clarify instructions or explain them differently than have something important broken.
•Even if things appear to be better, it might not mean we are finished. Please continue to follow my instructions and reply back until I give you the "all clean". We do not want to clean you part-way, only to have the system re-infect itself.
•Please reply using the button in the lower right hand corner of your screen. Do not start a new topic. The logs that you post should be pasted directly into the reply.
Only attach them if requested or if they do not fit into the post







Please download TDSSKiller.zip

• Extract it to your desktop
• Double click TDSSKiller.exe
• Press Start Scan
  
  • Only if Malicious objects are found then ensure Cure is selected
    If suspicious objects are found select skip
  • Then click Continue > Reboot now
• Copy and paste the log in your next reply
  
  • A copy of the log will be saved automatically to the root of the drive (typically C:\)

Download ComboFix from one of these locations:

Link 1
Link 2


* IMPORTANT !!! Save ComboFix.exe to your Desktop

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
• See this Link for programs that need to be disabled and instruction on how to disable them.
• Remember to re-enable them when we're done.
  
  
• Double click on ComboFix.exe & follow the prompts.
  
  
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

*If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.