What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Blue Screen computer crash

3 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hello,

My laptop keeps crashing….blue screen when I start up my computer and it tells me the hard drive is corrupted etc. I will post a note in the hardware forum also..but need help cleaning up my computer please. It is running really slow and before buying a new laptop I wanted to see if I could salvage this one.

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 6:18:56 PM, on 10/31/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\Program Files\AVG\AVG10\avgchsvx.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AVG\AVG10\avgfws.exe
C:\Program Files\AVG\AVG10\avgwdsvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\AVG\AVG PC Tuneup 2011\BoostSpeed.exe
C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\AVG\AVG10\avgam.exe
C:\Program Files\AVG\AVG10\avgnsx.exe
C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files\AVG\AVG10\avgtray.exe
C:\Program Files\Citrix\ICA Client\concentr.exe
C:\Program Files\Dell Support\DSAgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Citrix\ICA Client\wfcrun32.exe
C:\Program Files\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\AVG\AVG10\avgcsrvx.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Common Files\Java\Java Update\jucheck.exe
C:\PROGRA~1\AVG\AVG10\avgrsx.exe
C:\Program Files\AVG\AVG10\avgcsrvx.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\TamiH\Desktop\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: (no name) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG10\avgssie.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [zzzHPSETUP] D:\Setup.exe \RESET
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG10\avgtray.exe
O4 - HKLM\..\Run: [ConnectionCenter] "C:\Program Files\Citrix\ICA Client\concentr.exe" /startup
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1C11B948-582A-433F-A98D-A8C4D5CC64F2} (20-20 3D Viewer) - http://lazboy3d.icovia.com/PLANNER/Core/Pl…yerAX_Win32.cab
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - http://download.eset.com/special/eos/OnlineScanner.cab
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG10\avgpp.dll
O18 - Filter: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O18 - Filter hijack: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: AVG Firewall (avgfws) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG10\avgfws.exe
O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG10\avgwdsvc.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: WLTRYSVC - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

–
End of file - 7837 bytes
Post #2
Hello thoran

My name is Satchfan and I would be glad to help you with your computer problem.

Please read the following guidelines which will help to make cleaning your machine easier:
  • please follow all instructions in the order posted
  • please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear
  • all logs/reports, etc. must be posted in Notepad. Please ensure that word wrap is unchecked. In Notepad click Format, uncheck Word wrap if it is checked
  • if you don't understand something, please don't hesitate to ask for clarification before proceeding
  • the fixes are specific to your problem and should only be used for this issue on this machine.
  • please reply within 3 days. If you do not reply within this period I will post a reminder but topics with no reply in 4 days will be closed!
IMPORTANT:

Please DO NOT install/uninstall any programs unless asked to.
Please DO NOT run any scans other than those requested

I am looking at your log now and will reply with instructions shortly

Satchfan
Post #3
Hello again thoran

Download and run MBRCheck

Please download MBRCheck.exe to your desktop.
  • Be sure to disable your security programs
  • Double click on the file to run it (Vista and Windows 7 users will have to confirm the UAC prompt)
  • A window will open on your desktop
  • if an unknown bootcode is found you will have further options available to you, at this time press N then press Enter twice.
  • If nothing unusual is found just press Enter
  • A .txt file named MBRCheck_mm.dd.yy_hh.mm.ss should appear on your desktop.
  • Please post the contents of that file.
===================================================

Download and run OTL
  • Download OTL to your desktop.
  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • When the window appears, underneath Output at the top change it to Minimal Output.
  • Check the boxes beside LOP Check and Purity Check.
  • Under Custom Scan paste this in


    netsvcs
    drivers32
    %SYSTEMDRIVE%\*.*
    %systemroot%\Fonts\*.com
    %systemroot%\Fonts\*.dll
    %systemroot%\Fonts\*.ini
    %systemroot%\Fonts\*.ini2
    %systemroot%\Fonts\*.exe
    %systemroot%\system32\spool\prtprocs\w32x86\*.*
    %systemroot%\REPAIR\*.bak1
    %systemroot%\REPAIR\*.ini
    %systemroot%\system32\*.jpg
    %systemroot%\*.jpg
    %systemroot%\*.png
    %systemroot%\*.scr
    %systemroot%\*._sy
    %APPDATA%\Adobe\Update\*.*
    %ALLUSERSPROFILE%\Favorites\*.*
    %APPDATA%\Microsoft\*.*
    %PROGRAMFILES%\*.*
    %APPDATA%\Update\*.*
    %systemroot%\*. /mp /s
    CREATERESTOREPOINT
    %systemroot%\System32\config\*.sav
    %PROGRAMFILES%\bak. /s
    %systemroot%\system32\bak. /s
    %ALLUSERSPROFILE%\Start Menu\*.lnk /x
    %systemroot%\system32\config\systemprofile\*.dat /x
    %systemroot%\*.config
    %systemroot%\system32\*.db
    %PROGRAMFILES%\Internet Explorer\*.dat
    %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
    %USERPROFILE%\Desktop\*.exe
    %PROGRAMFILES%\Common Files\*.*
    %systemroot%\*.src
    %systemroot%\install\*.*
    %systemroot%\system32\DLL\*.*
    %systemroot%\system32\HelpFiles\*.*
    %systemroot%\system32\rundll\*.*
    %systemroot%\winn32\*.*
    %systemroot%\Java\*.*
    %systemroot%\system32\test\*.*
    %systemroot%\system32\Rundll32\*.*
    %systemroot%\AppPatch\Custom\*.*
    HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs

  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
  • You may need two posts to fit them both in.
Logs to include in the next post:

MBRCheck log
OTL.txt
Extras.txt

Satchfan
Post #4
I not able to log on to my laptop most of the time. When I tried turning on the laptop this morning, it started to boot up then I got the blue screen and error message that "problem detected and windows shut down to prevent damage. Problem seems to be caused by following file: Partmgr.sys Page_fault_in_nonpaged_area." I usually get the error message that says "unmountable boot volume" I'm unable to log on to the laptop to run the scans you suggested. Now what? Thanks.
Post #5
Hi thoran

Don’t worry about the MBRCheck as I noticed you ran it in a previous thread.

Boot to Safe mode with Networking and see if you can then download and run OTL

To Enter Safemode
  • go to Start> Shut off your Computer> Restart
  • as the computer starts to boot-up, tap the F8 KEY - this will bring up a menu
  • use the Up and Down Arrow Keys to scroll up to Safemode with Networking
  • then press Enter on your keyboard
Satchfan
Post #6
I was able to log on my laptop without having to use safe mode. I ran the scans but didn't get an Extras log. Here are the other logs.

MBRCheck, version 1.2.3
© 2010, AD

Command-line:
Windows Version: Windows XP Home Edition
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x0000000c

Kernel Drivers (total 125):
0x804D7000 \WINDOWS\system32\ntoskrnl.exe
0x806EE000 \WINDOWS\system32\hal.dll
0xF7B63000 \WINDOWS\system32\KDCOM.DLL
0xF7A73000 \WINDOWS\system32\BOOTVID.dll
0xF7614000 ACPI.sys
0xF7B65000 \WINDOWS\System32\DRIVERS\WMILIB.SYS
0xF7603000 pci.sys
0xF7663000 isapnp.sys
0xF7A77000 compbatt.sys
0xF7A7B000 \WINDOWS\System32\DRIVERS\BATTC.SYS
0xF7C2B000 pciide.sys
0xF78E3000 \WINDOWS\System32\DRIVERS\PCIIDEX.SYS
0xF7B67000 intelide.sys
0xF75E5000 pcmcia.sys
0xF7673000 MountMgr.sys
0xF75C6000 ftdisk.sys
0xF78EB000 PartMgr.sys
0xF7683000 VolSnap.sys
0xF75AE000 atapi.sys
0xF7693000 disk.sys
0xF76A3000 \WINDOWS\System32\DRIVERS\CLASSPNP.SYS
0xF758E000 fltmgr.sys
0xF757C000 sr.sys
0xF7565000 KSecDD.sys
0xF74D8000 Ntfs.sys
0xF74AB000 NDIS.sys
0xF7491000 Mup.sys
0xF78F3000 avgrkx86.sys
0xF7A7F000 AVGIDSEH.Sys
0xF7853000 \SystemRoot\System32\DRIVERS\intelppm.sys
0xF7B3F000 \SystemRoot\System32\DRIVERS\CmBatt.sys
0xF7421000 \SystemRoot\System32\DRIVERS\ialmnt5.sys
0xF740D000 \SystemRoot\System32\DRIVERS\VIDEOPRT.SYS
0xF79A3000 \SystemRoot\System32\DRIVERS\usbuhci.sys
0xF73E9000 \SystemRoot\System32\DRIVERS\USBPORT.SYS
0xF79AB000 \SystemRoot\System32\DRIVERS\usbehci.sys
0xF7863000 \SystemRoot\System32\DRIVERS\bcm4sbxp.sys
0xF739C000 \SystemRoot\System32\DRIVERS\bcmwl5.sys
0xF7873000 \SystemRoot\System32\DRIVERS\i8042prt.sys
0xF735A000 \SystemRoot\System32\DRIVERS\SynTP.sys
0xF7B99000 \SystemRoot\System32\DRIVERS\USBD.SYS
0xF79B3000 \SystemRoot\System32\DRIVERS\mouclass.sys
0xF79BB000 \SystemRoot\System32\DRIVERS\kbdclass.sys
0xF7883000 \SystemRoot\System32\Drivers\AFS2K.SYS
0xF79C3000 \SystemRoot\System32\Drivers\MxlW2k.SYS
0xF7893000 \SystemRoot\System32\DRIVERS\cdrom.sys
0xF78A3000 \SystemRoot\System32\DRIVERS\redbook.sys
0xF7337000 \SystemRoot\System32\DRIVERS\ks.sys
0xF72FA000 \SystemRoot\system32\drivers\stac97.sys
0xF72D6000 \SystemRoot\system32\drivers\portcls.sys
0xF78B3000 \SystemRoot\system32\drivers\drmk.sys
0xF71C9000 \SystemRoot\System32\DRIVERS\BCMSM.sys
0xF79CB000 \SystemRoot\System32\Drivers\Modem.SYS
0xF79D3000 \SystemRoot\system32\DRIVERS\avgfwdx.sys
0xF7C52000 \SystemRoot\System32\DRIVERS\audstub.sys
0xF78C3000 \SystemRoot\System32\DRIVERS\rasl2tp.sys
0xF7B53000 \SystemRoot\System32\DRIVERS\ndistapi.sys
0xF71B2000 \SystemRoot\System32\DRIVERS\ndiswan.sys
0xF78D3000 \SystemRoot\System32\DRIVERS\raspppoe.sys
0xF76C3000 \SystemRoot\System32\DRIVERS\raspptp.sys
0xF79DB000 \SystemRoot\System32\DRIVERS\TDI.SYS
0xF71A1000 \SystemRoot\System32\DRIVERS\psched.sys
0xF76D3000 \SystemRoot\System32\DRIVERS\msgpc.sys
0xF79E3000 \SystemRoot\System32\DRIVERS\ptilink.sys
0xF79EB000 \SystemRoot\System32\DRIVERS\raspti.sys
0xF76E3000 \SystemRoot\System32\DRIVERS\termdd.sys
0xF7B9B000 \SystemRoot\System32\DRIVERS\swenum.sys
0xF711B000 \SystemRoot\System32\DRIVERS\update.sys
0xF79F3000 \SystemRoot\System32\DRIVERS\omci.sys
0xF7458000 \SystemRoot\System32\DRIVERS\mssmbios.sys
0xF7703000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xEF042000 \SystemRoot\system32\drivers\ialmkchw.sys
0xEF024000 \SystemRoot\system32\drivers\ialmsbw.sys
0xF7723000 \SystemRoot\System32\DRIVERS\usbhub.sys
0xF7B03000 \SystemRoot\System32\Drivers\i2omgmt.SYS
0xF7743000 \SystemRoot\system32\DRIVERS\avgmfx86.sys
0xF7BA3000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xF7D68000 \SystemRoot\System32\Drivers\Null.SYS
0xF7BA5000 \SystemRoot\System32\Drivers\Beep.SYS
0xF7A0B000 \SystemRoot\System32\drivers\vga.sys
0xF7BA7000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xF7BA9000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xF7A13000 \SystemRoot\System32\Drivers\Msfs.SYS
0xF7A1B000 \SystemRoot\System32\Drivers\Npfs.SYS
0xF7B07000 \SystemRoot\System32\DRIVERS\rasacd.sys
0xEEF29000 \SystemRoot\System32\DRIVERS\ipsec.sys
0xEEED0000 \SystemRoot\System32\DRIVERS\tcpip.sys
0xEEE89000 \SystemRoot\system32\DRIVERS\avgtdix.sys
0xEEE63000 \SystemRoot\System32\DRIVERS\ipnat.sys
0xF7783000 \SystemRoot\System32\DRIVERS\wanarp.sys
0xEEE3B000 \SystemRoot\System32\DRIVERS\netbt.sys
0xEEE19000 \SystemRoot\System32\drivers\afd.sys
0xF77B3000 \SystemRoot\System32\DRIVERS\netbios.sys
0xEEDEE000 \SystemRoot\System32\DRIVERS\rdbss.sys
0xEED7E000 \SystemRoot\System32\DRIVERS\mrxsmb.sys
0xF7803000 \SystemRoot\System32\Drivers\Fips.SYS
0xEED6A000 \SystemRoot\system32\DRIVERS\ctxusbm.sys
0xEED2E000 \SystemRoot\system32\DRIVERS\avgldx86.sys
0xEEFE4000 \SystemRoot\System32\Drivers\Cdfs.SYS
0xEEC9E000 \SystemRoot\System32\Drivers\dump_atapi.sys
0xF7BCB000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
0xBF800000 \SystemRoot\System32\win32k.sys
0xF7B3B000 \SystemRoot\System32\drivers\Dxapi.sys
0xF792B000 \SystemRoot\System32\watchdog.sys
0xBF000000 \SystemRoot\System32\drivers\dxg.sys
0xF7C4D000 \SystemRoot\System32\drivers\dxgthk.sys
0xBF020000 \SystemRoot\System32\ialmdnt5.dll
0xBF012000 \SystemRoot\System32\ialmrnt5.dll
0xBF042000 \SystemRoot\System32\ialmdev5.DLL
0xBF073000 \SystemRoot\System32\ialmdd5.DLL
0xBFFA0000 \SystemRoot\System32\ATMFD.DLL
0xEEB7A000 \SystemRoot\System32\DRIVERS\mdc8021x.sys
0xEEB76000 \SystemRoot\System32\DRIVERS\ndisuio.sys
0xEE901000 \SystemRoot\System32\DRIVERS\mrxdav.sys
0xF7C1F000 \SystemRoot\System32\Drivers\ASCTRM.SYS
0xF797B000 \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys
0xEE76A000 \SystemRoot\System32\DRIVERS\srv.sys
0xF7A2B000 \SystemRoot\system32\DRIVERS\AVGIDSFilter.Sys
0xEE60A000 \SystemRoot\system32\DRIVERS\AVGIDSDriver.Sys
0xEE349000 \SystemRoot\System32\Drivers\HTTP.sys
0xEDFF2000 \SystemRoot\system32\drivers\wdmaud.sys
0xEE50A000 \SystemRoot\system32\drivers\sysaudio.sys
0xEDF63000 \SystemRoot\system32\drivers\kmixer.sys
0xEE2D9000 \SystemRoot\system32\DRIVERS\asyncmac.sys
0x7C900000 \WINDOWS\SYSTEM32\ntdll.dll

Processes (total 43):
0 System Idle Process
4 System
1040 C:\WINDOWS\SYSTEM32\smss.exe
1308 csrss.exe
1332 C:\WINDOWS\SYSTEM32\winlogon.exe
1380 C:\WINDOWS\SYSTEM32\services.exe
1392 C:\WINDOWS\SYSTEM32\lsass.exe
1556 C:\WINDOWS\SYSTEM32\svchost.exe
1656 svchost.exe
1696 C:\WINDOWS\SYSTEM32\svchost.exe
1912 svchost.exe
1964 svchost.exe
528 C:\WINDOWS\SYSTEM32\spoolsv.exe
604 svchost.exe
668 C:\Program Files\AVG\AVG10\avgwdsvc.exe
704 C:\Program Files\Java\jre6\bin\jqs.exe
1800 C:\WINDOWS\SYSTEM32\svchost.exe
184 C:\WINDOWS\SYSTEM32\WLTRYSVC.EXE
232 C:\WINDOWS\SYSTEM32\BCMWLTRY.EXE
1796 C:\Program Files\Canon\CAL\CALMAIN.exe
2360 alg.exe
764 C:\Program Files\AVG\AVG PC Tuneup 2011\BoostSpeed.exe
3096 C:\WINDOWS\explorer.exe
804 C:\WINDOWS\SYSTEM32\wuauclt.exe
1504 C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe
2700 C:\Program Files\Real\RealPlayer\realplay.exe
3544 C:\Program Files\HP\HP Software Update\hpwuSchd.exe
2996 C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
3012 C:\Program Files\Common Files\Java\Java Update\jusched.exe
3048 C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
2740 C:\Program Files\AVG\AVG10\avgtray.exe
3144 C:\Program Files\Citrix\ICA Client\concentr.exe
3172 C:\Program Files\Dell Support\DSAgnt.exe
1272 C:\WINDOWS\SYSTEM32\ctfmon.exe
2424 C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
3348 C:\Program Files\Citrix\ICA Client\wfcrun32.exe
2520 C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSMonitor.exe
1192 C:\Program Files\Internet Explorer\iexplore.exe
4040 C:\Program Files\Internet Explorer\iexplore.exe
1480 C:\Program Files\Common Files\Java\Java Update\jucheck.exe
3992 C:\Program Files\AVG\AVG10\avgui.exe
3576 C:\WINDOWS\SYSTEM32\wscntfy.exe
2352 C:\Documents and Settings\TamiH\Desktop\MBRCheck.exe

\\.\C: –> \\.\PhysicalDrive0 at offset 0x00000000`02f10c00 (NTFS)

PhysicalDrive0 Model Number: TOSHIBAMK3021GAS, Rev: GA129D

Size Device Name MBR Status
——————————————–
27 GB \\.\PhysicalDrive0 Dell MBR code detected
SHA1: 84B95CE8A54B7C5C3AAF149934FC46FB70FF8365


Done!

OTL logfile created on: 11/8/2011 6:13:28 PM - Run 2
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Documents and Settings\TamiH\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1022.33 Mb Total Physical Memory | 512.30 Mb Available Physical Memory | 50.11% Memory free
1.28 Gb Paging File | 0.91 Gb Available in Paging File | 70.93% Paging File free
Paging file location(s): C:\pagefile.sys 384 768 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 24.89 Gb Total Space | 7.68 Gb Free Space | 30.86% Space Free | Partition Type: NTFS

Computer Name: TAMI | User Name: TamiH | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\TamiH\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSMonitor.exe ()
PRC - C:\Program Files\AVG\AVG10\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG PC Tuneup 2011\BoostSpeed.exe (AVG)
PRC - C:\Program Files\Common Files\Java\Java Update\jucheck.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\Citrix\ICA Client\wfcrun32.exe (Citrix Systems, Inc.)
PRC - C:\Program Files\Citrix\ICA Client\concentr.exe (Citrix Systems, Inc.)
PRC - C:\Program Files\Canon\CAL\CALMAIN.exe (Canon Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Real\RealPlayer\realplay.exe (RealNetworks, Inc.)
PRC - C:\Program Files\Dell Support\DSAgnt.exe (Gteko Ltd.)
PRC - C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe (Musicmatch, Inc.)
PRC - C:\Program Files\HP\HP Software Update\hpwuSchd.exe (Hewlett-Packard)


========== Modules (No Company Name) ==========

MOD - C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSMonitor.exe ()
MOD - C:\Program Files\AVG\AVG PC Tuneup 2011\madExcept_.bpl ()
MOD - C:\Program Files\AVG\AVG PC Tuneup 2011\madBasic_.bpl ()
MOD - C:\Program Files\AVG\AVG PC Tuneup 2011\madDisAsm_.bpl ()
MOD - C:\Program Files\MUSICMATCH\Musicmatch Jukebox\TrackUtils.dll ()
MOD - C:\Program Files\MUSICMATCH\Musicmatch Jukebox\CoreDll.dll ()


========== Win32 Services (SafeList) ==========

SRV - (HidServ) – File not found
SRV - (AppMgmt) – File not found
SRV - (AVGIDSAgent) – C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe (AVG Technologies CZ, s.r.o.)
SRV - (avgfws) – C:\Program Files\AVG\AVG10\avgfws.exe (AVG Technologies CZ, s.r.o.)
SRV - (avgwd) – C:\Program Files\AVG\AVG10\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (CCALib8) – C:\Program Files\Canon\CAL\CALMAIN.exe (Canon Inc.)
SRV - (Pml Driver HPZ12) – C:\WINDOWS\SYSTEM32\HPZipm12.exe (HP)


========== Driver Services (SafeList) ==========

DRV - (AVGIDSDriver) – C:\WINDOWS\SYSTEM32\DRIVERS\AVGIDSDriver.sys (AVG Technologies CZ, s.r.o. )
DRV - (Avgtdix) – C:\WINDOWS\SYSTEM32\DRIVERS\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgrkx86) – C:\WINDOWS\system32\DRIVERS\avgrkx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgmfx86) – C:\WINDOWS\SYSTEM32\DRIVERS\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AVGIDSEH) – C:\WINDOWS\system32\DRIVERS\AVGIDSEH.Sys (AVG Technologies CZ, s.r.o. )
DRV - (AVGIDSShim) – C:\WINDOWS\SYSTEM32\DRIVERS\AVGIDSShim.sys (AVG Technologies CZ, s.r.o. )
DRV - (AVGIDSFilter) – C:\WINDOWS\SYSTEM32\DRIVERS\AVGIDSFilter.sys (AVG Technologies CZ, s.r.o. )
DRV - (Avgldx86) – C:\WINDOWS\SYSTEM32\DRIVERS\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgfwfd) – C:\WINDOWS\SYSTEM32\DRIVERS\avgfwdx.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgfwdx) – C:\WINDOWS\SYSTEM32\DRIVERS\avgfwdx.sys (AVG Technologies CZ, s.r.o.)
DRV - (ctxusbm) – C:\WINDOWS\SYSTEM32\DRIVERS\ctxusbm.sys (Citrix Systems, Inc.)
DRV - (AFS2K) – C:\WINDOWS\System32\drivers\AFS2K.SYS (Oak Technology Inc.)
DRV - (iAimFP4) – C:\WINDOWS\SYSTEM32\DRIVERS\wvchntxx.sys (Intel® Corporation)
DRV - (iAimFP3) – C:\WINDOWS\SYSTEM32\DRIVERS\wsiintxx.sys (Intel® Corporation)
DRV - (iAimTV4) – C:\WINDOWS\SYSTEM32\DRIVERS\wch7xxnt.sys (Intel® Corporation)
DRV - (iAimTV3) – C:\WINDOWS\SYSTEM32\DRIVERS\watv04nt.sys (Intel® Corporation)
DRV - (iAimTV1) – C:\WINDOWS\SYSTEM32\DRIVERS\watv02nt.sys (Intel® Corporation)
DRV - (iAimTV0) – C:\WINDOWS\SYSTEM32\DRIVERS\watv01nt.sys (Intel® Corporation)
DRV - (i81x) – C:\WINDOWS\SYSTEM32\DRIVERS\i81xnt5.sys (Intel® Corporation)
DRV - (iAimFP0) – C:\WINDOWS\SYSTEM32\DRIVERS\wadv01nt.sys (Intel® Corporation)
DRV - (iAimFP1) – C:\WINDOWS\SYSTEM32\DRIVERS\wadv02nt.sys (Intel® Corporation)
DRV - (iAimFP2) – C:\WINDOWS\SYSTEM32\DRIVERS\wadv05nt.sys (Intel® Corporation)
DRV - (MxlW2k) – C:\WINDOWS\System32\drivers\MxlW2k.sys (MusicMatch, Inc.)
DRV - (ASCTRM) – C:\WINDOWS\System32\drivers\asctrm.sys (Windows ® 2000 DDK provider)
DRV - (MDC8021X) AEGIS Protocol (IEEE 802.1x) – C:\WINDOWS\SYSTEM32\DRIVERS\mdc8021x.sys (Meetinghouse Data Communications)
DRV - (BCM43XX) – C:\WINDOWS\SYSTEM32\DRIVERS\BCMWL5.SYS (Broadcom Corporation)
DRV - (omci) – C:\WINDOWS\SYSTEM32\DRIVERS\omci.sys (Dell Inc)
DRV - (bcm4sbxp) – C:\WINDOWS\SYSTEM32\DRIVERS\bcm4sbxp.sys (Broadcom Corporation)
DRV - (STAC97) Audio Driver (WDM) – C:\WINDOWS\SYSTEM32\DRIVERS\stac97.sys (SigmaTel, Inc.)
DRV - (BCMModem) – C:\WINDOWS\SYSTEM32\DRIVERS\BCMSM.sys (Broadcom Corporation)
DRV - (EL90XBC) – C:\WINDOWS\SYSTEM32\DRIVERS\EL90XBC5.SYS (3Com Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/
IE - HKCU\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - No CLSID value found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\Software\MozillaPlugins\@canon.com/MycameraPlugin: C:\Program Files\Canon\MyCamera Download Plugin\NPCIG.dll (CANON INC.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60310.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@viewpoint.com/VMP: C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll ()

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG10\Firefox4\ [2011/09/17 15:28:46 | 000,000,000 | —D | M]


O1 HOSTS File: ([2010/09/01 10:28:14 | 000,000,027 | —- | M]) - C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG10\avgssie.dll (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [ConnectionCenter] C:\Program Files\Citrix\ICA Client\concentr.exe (Citrix Systems, Inc.)
O4 - HKLM..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd.exe (Hewlett-Packard)
O4 - HKLM..\Run: [MMTray] C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe (Musicmatch, Inc.)
O4 - HKLM..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [zzzHPSETUP] D:\Setup.exe \RESET File not found
O4 - HKCU..\Run: [DellSupport] C:\Program Files\Dell Support\DSAgnt.exe (Gteko Ltd.)
O4 - HKCU..\Run: [MoneyAgent] C:\Program Files\Microsoft Money\System\mnyexpr.exe (Microsoft Corp.)
O4 - HKCU..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\System32\Macromed\Flash\FlashUtil10m_ActiveX.exe (Adobe Systems, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Low Rights present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra Button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html File not found
O15 - HKCU\..Trusted Domains: aol.com ([objects] * is out of zone range - 5)
O16 - DPF: {1C11B948-582A-433F-A98D-A8C4D5CC64F2} http://lazboy3d.icovia.com/PLANNER/Core/Pl…yerAX_Win32.cab (20-20 3D Viewer)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} http://www.crucial.com/controls/cpcScanner.cab (Crucial cpcScan)
O16 - DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/pub/shock…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FC31B805-CB36-4FA0-8C69-FC95B778BE27}: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\cetihpz {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Program Files\HP\hpcoretech\comp\hpuiprot.dll (Hewlett-Packard Company)
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG10\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Filter\application/x-ica {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\ica {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\SYSTEM32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - (igfxsrvc.dll) - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\TamiH\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\TamiH\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2002/09/03 07:59:58 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgchsvx.exe /sync)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgrsx.exe /sync /restart)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - File not found
NetSvcs: HidServ - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: MSACM.CEGSM - C:\WINDOWS\System32\MOBILEV.ACM ()
Drivers32: msacm.iac2 - C:\WINDOWS\System32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\TSSOFT32.ACM (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\IR32_32.DLL ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\IR32_32.DLL ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: vidc.LEAD - C:\WINDOWS\System32\LCodcCMP.dll (LEAD Technologies, Inc.)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2011/11/08 18:10:31 | 000,584,192 | —- | C] (OldTimer Tools) – C:\Documents and Settings\TamiH\Desktop\OTL.exe
[2011/11/04 18:20:01 | 000,000,000 | -H-D | C] – C:\$AVG
[2011/10/31 17:18:03 | 000,388,608 | —- | C] (Trend Micro Inc.) – C:\Documents and Settings\TamiH\Desktop\HiJackThis.exe
[2011/10/31 16:31:47 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\iolo
[2011/10/23 20:59:24 | 000,000,000 | —D | C] – C:\Documents and Settings\TamiH\My Documents\Maui 2011_10_15

========== Files - Modified Within 30 Days ==========

[2011/11/08 18:10:39 | 000,584,192 | —- | M] (OldTimer Tools) – C:\Documents and Settings\TamiH\Desktop\OTL.exe
[2011/11/08 18:06:32 | 000,080,384 | —- | M] () – C:\Documents and Settings\TamiH\Desktop\MBRCheck.exe
[2011/11/08 18:02:51 | 000,000,000 | —- | M] () – C:\Documents and Settings\TamiH\Local Settings\Application Data\prvlcl.dat
[2011/11/08 17:38:11 | 000,000,388 | —- | M] () – C:\WINDOWS\tasks\AVG PC Tuneup 2011 Integrator Start On Windows Logon.job
[2011/11/08 17:34:29 | 000,617,187 | —- | M] () – C:\WINDOWS\System32\drivers\AVG\iavifw.avm
[2011/11/08 17:34:27 | 137,421,893 | —- | M] () – C:\WINDOWS\System32\drivers\AVG\incavi.avm
[2011/11/08 17:27:18 | 000,441,174 | —- | M] () – C:\WINDOWS\System32\PERFH009.DAT
[2011/11/08 17:27:18 | 000,072,042 | —- | M] () – C:\WINDOWS\System32\PERFC009.DAT
[2011/11/08 17:24:03 | 000,001,170 | —- | M] () – C:\WINDOWS\System32\WPA.DBL
[2011/11/08 17:24:00 | 000,002,048 | –S- | M] () – C:\WINDOWS\BOOTSTAT.DAT
[2011/11/08 17:23:57 | 1072,062,464 | -HS- | M] () – C:\hiberfil.sys
[2011/10/31 17:18:05 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Documents and Settings\TamiH\Desktop\HiJackThis.exe
[2011/10/25 23:43:46 | 000,173,383 | —- | M] () – C:\WINDOWS\System32\drivers\AVG\iavichjg.avm
[2011/10/23 21:33:35 | 000,096,713 | —- | M] () – C:\Documents and Settings\TamiH\Desktop\Maui tropical plantation map.jpg

========== Files Created - No Company Name ==========

[2011/11/08 18:06:27 | 000,080,384 | —- | C] () – C:\Documents and Settings\TamiH\Desktop\MBRCheck.exe
[2011/10/23 21:40:51 | 000,096,713 | —- | C] () – C:\Documents and Settings\TamiH\Desktop\Maui tropical plantation map.jpg
[2011/09/13 17:15:54 | 002,359,350 | —- | C] () – C:\Documents and Settings\TamiH\Application Data\ZBWallpaper_2.bmp
[2011/09/13 17:14:08 | 002,359,350 | —- | C] () – C:\Documents and Settings\TamiH\Application Data\ZBWallpaper_1.bmp
[2011/09/13 17:13:04 | 001,327,158 | —- | C] () – C:\Documents and Settings\TamiH\Application Data\ZBWallpaper.bmp
[2011/05/29 12:28:36 | 000,003,584 | —- | C] () – C:\Documents and Settings\TamiH\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/04/26 10:24:46 | 000,390,032 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2011/01/09 22:17:56 | 000,000,000 | —- | C] () – C:\Documents and Settings\TamiH\Local Settings\Application Data\prvlcl.dat
[2008/09/18 11:45:11 | 000,000,002 | —- | C] () – C:\WINDOWS\msoffice.ini
[2007/10/20 18:29:04 | 000,034,468 | —- | C] () – C:\WINDOWS\hpomdl03.dat
[2007/10/20 18:29:04 | 000,028,922 | —- | C] () – C:\WINDOWS\hpoins03.dat
[2005/11/21 22:21:02 | 000,004,212 | -H– | C] () – C:\WINDOWS\System32\zllictbl.dat
[2005/09/26 17:57:11 | 000,000,000 | —- | C] () – C:\WINDOWS\Textart.INI
[2005/09/14 10:25:29 | 000,061,678 | —- | C] () – C:\Documents and Settings\TamiH\Application Data\PFP120JPR.{PB
[2005/09/14 10:25:29 | 000,012,358 | —- | C] () – C:\Documents and Settings\TamiH\Application Data\PFP120JCM.{PB
[2005/09/12 09:07:04 | 000,047,787 | —- | C] () – C:\WINDOWS\hpiins01.dat
[2005/04/30 19:58:46 | 000,000,128 | —- | C] () – C:\Documents and Settings\TamiH\Local Settings\Application Data\fusioncache.dat
[2004/10/07 17:25:26 | 000,565,248 | R— | C] () – C:\WINDOWS\System32\hpotscl.dll
[2004/08/26 10:49:48 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2004/08/03 08:03:13 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2004/08/03 07:56:49 | 000,149,504 | —- | C] () – C:\WINDOWS\UNWISE.EXE
[2004/08/03 07:42:23 | 000,000,335 | —- | C] () – C:\WINDOWS\nsreg.dat
[2004/08/03 07:42:08 | 000,110,592 | —- | C] () – C:\WINDOWS\System32\AegisI5.exe
[2004/08/03 07:42:08 | 000,045,056 | —- | C] () – C:\WINDOWS\System32\WLTRYSVC.EXE
[2004/08/03 07:37:03 | 000,077,824 | —- | C] () – C:\WINDOWS\System32\SynTPCoI.dll
[2004/08/03 07:34:36 | 000,000,780 | —- | C] () – C:\WINDOWS\orun32.ini
[2004/08/03 07:15:48 | 000,002,048 | –S- | C] () – C:\WINDOWS\BOOTSTAT.DAT
[2004/08/03 07:13:42 | 000,363,520 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2004/08/03 07:13:34 | 000,441,174 | —- | C] () – C:\WINDOWS\System32\PERFH009.DAT
[2004/08/03 07:13:34 | 000,072,042 | —- | C] () – C:\WINDOWS\System32\PERFC009.DAT
[2004/08/03 07:13:19 | 000,001,793 | —- | C] () – C:\WINDOWS\System32\fxsperf.ini
[2004/08/03 06:53:58 | 000,000,547 | —- | C] () – C:\WINDOWS\System32\OEMINFO.INI
[2004/08/02 14:20:40 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2004/05/26 14:09:26 | 000,024,576 | —- | C] () – C:\WINDOWS\System32\DSRIRREM.EXE
[2004/05/04 16:11:06 | 000,000,283 | —- | C] () – C:\WINDOWS\System32\DLBCPLC.INI
[2003/01/07 15:05:08 | 000,002,695 | —- | C] () – C:\WINDOWS\System32\OUTLPERF.INI
[2002/09/03 08:05:08 | 000,259,048 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2002/09/03 07:59:14 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2002/09/03 07:56:30 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2002/09/03 07:31:46 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\OEMBIOS.BIN
[2002/09/03 07:31:44 | 000,004,594 | —- | C] () – C:\WINDOWS\System32\OEMBIOS.DAT
[2002/08/29 04:00:00 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\MLANG.DAT
[2002/08/29 04:00:00 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\PERFI009.DAT
[2002/08/29 04:00:00 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\DSSEC.DAT
[2002/08/29 04:00:00 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\MIB.BIN
[2002/08/29 04:00:00 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\PERFD009.DAT
[2002/08/29 04:00:00 | 000,001,804 | —- | C] () – C:\WINDOWS\System32\dcache.bin
[2002/08/29 04:00:00 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\NOISE.DAT
[2001/09/13 12:06:26 | 000,036,864 | —- | C] () – C:\WINDOWS\SETPWRCG.EXE

========== LOP Check ==========

[2011/01/08 16:49:14 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AVG10
[2011/01/12 12:25:06 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Citrix
[2011/01/08 16:48:28 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\Common Files
[2011/10/31 17:03:52 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\iolo
[2011/05/30 09:31:51 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\MFAData
[2011/11/08 18:18:55 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2004/08/03 07:44:25 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Viewpoint
[2011/02/27 22:22:25 | 000,000,000 | —D | M] – C:\Documents and Settings\TamiH\Application Data\AVG
[2011/01/08 16:54:39 | 000,000,000 | —D | M] – C:\Documents and Settings\TamiH\Application Data\AVG10
[2011/01/18 11:12:21 | 000,000,000 | —D | M] – C:\Documents and Settings\TamiH\Application Data\ICAClient
[2005/10/05 17:41:22 | 000,000,000 | —D | M] – C:\Documents and Settings\TamiH\Application Data\Snapfish
[2009/08/26 21:05:24 | 000,000,000 | —D | M] – C:\Documents and Settings\TamiH\Application Data\Viewpoint
[2011/11/08 17:38:11 | 000,000,388 | —- | M] () – C:\WINDOWS\Tasks\AVG PC Tuneup 2011 Integrator Start On Windows Logon.job
[2004/08/19 19:43:26 | 000,000,258 | —- | M] () – C:\WINDOWS\Tasks\ISP signup reminder 1.job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2005/12/10 17:59:13 | 000,010,920 | —- | M] () – C:\aolconnfix.exe
[2005/12/10 17:59:13 | 000,001,039 | —- | M] () – C:\aolconnfix.txt
[2002/09/03 07:59:58 | 000,000,000 | —- | M] () – C:\AUTOEXEC.BAT
[2009/03/15 16:51:42 | 000,000,211 | —- | M] () – C:\Boot.bak
[2010/05/15 11:16:38 | 000,000,281 | RHS- | M] () – C:\BOOT.INI
[2002/09/03 07:38:46 | 000,000,512 | -HS- | M] () – C:\BOOTSECT.DOS
[2004/08/03 22:00:00 | 000,260,272 | —- | M] () – C:\cmldr
[2010/09/01 10:34:45 | 000,007,751 | —- | M] () – C:\ComboFix.txt
[2002/09/03 07:59:58 | 000,000,000 | —- | M] () – C:\CONFIG.SYS
[2004/08/03 07:02:10 | 000,005,375 | RH– | M] () – C:\DELL.SDR
[2011/11/08 17:23:57 | 1072,062,464 | -HS- | M] () – C:\hiberfil.sys
[2007/10/20 18:48:25 | 000,000,377 | —- | M] () – C:\hpcmerr.log
[2002/09/03 07:59:58 | 000,000,000 | -H– | M] () – C:\IO.SYS
[2002/09/03 07:59:58 | 000,000,000 | -H– | M] () – C:\MSDOS.SYS
[2009/03/15 16:26:27 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2010/09/02 12:12:57 | 000,250,048 | RHS- | M] () – C:\NTLDR
[2011/11/08 17:23:55 | 402,653,184 | -HS- | M] () – C:\pagefile.sys
[2004/08/03 07:44:54 | 000,000,087 | —- | M] () – C:\SystemInfo.ini

< %systemroot%\Fonts\*.com >

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2002/09/03 07:59:02 | 000,000,067 | -HS- | M] () – C:\WINDOWS\Fonts\DESKTOP.INI

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2006/10/14 15:43:18 | 000,027,648 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2003/06/18 17:31:48 | 000,018,944 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\mdippr.dll
[2006/10/14 15:44:44 | 000,671,744 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\PrintFilterPipelineSvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2002/09/03 07:47:18 | 000,094,208 | —- | M] () – C:\WINDOWS\System32\config\DEFAULT.SAV
[2002/09/03 07:47:18 | 000,602,112 | —- | M] () – C:\WINDOWS\System32\config\SOFTWARE.SAV
[2002/09/03 07:47:18 | 000,380,928 | —- | M] () – C:\WINDOWS\System32\config\SYSTEM.SAV

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2010/09/02 12:41:06 | 000,000,272 | -HS- | M] () – C:\Documents and Settings\All Users\Start Menu\DESKTOP.INI

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2010/09/02 13:40:50 | 000,000,177 | -HS- | M] () – C:\Documents and Settings\TamiH\Application Data\Microsoft\Internet Explorer\Quick Launch\DESKTOP.INI
[2004/08/19 19:45:11 | 000,000,079 | —- | M] () – C:\Documents and Settings\TamiH\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

< %USERPROFILE%\Desktop\*.exe >
[2011/03/13 13:51:50 | 004,738,888 | —- | M] (AVG Technologies) – C:\Documents and Settings\TamiH\Desktop\AVG Internet Security 2011.exe
[2011/10/31 17:18:05 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Documents and Settings\TamiH\Desktop\HiJackThis.exe
[2011/11/08 18:06:32 | 000,080,384 | —- | M] () – C:\Documents and Settings\TamiH\Desktop\MBRCheck.exe
[2011/11/08 18:10:39 | 000,584,192 | —- | M] (OldTimer Tools) – C:\Documents and Settings\TamiH\Desktop\OTL.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-09-02 23:46:24

========== Alternate Data Streams ==========

@Alternate Data Stream - 152 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:0B4227B4

< End of report >
Post #7
Thoran I see you were also being helped by Blottedosk who advised you that this was not a malware problem and to start a topic in our Windows forum. Because of this I am closing this topic. Good luck resolving your problem. Satchfan
Post #8
Your post has been Moved, Closed or Edited for one of the following reasons: 1.) You posted multiple topics and only one is required 2.) You are spamming links to other places without approval 3.) Abusive language or other problems in your text 4.) Your topic is too old (20 days or more) and no replies from you after a volunteer tried to help you This is a family oriented forum to help those that need help. ==============================

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI