What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

I do not know

4 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
It would seem that one or more viruses or malware are in my computer. My avg scan is not showing this. I ran malwarebytes and it handled two infections. However, currently my virus protection - AVG 2012 is turned off and I am unable to turn it on. Also, there are pop-ups appearing, I am having some problems with Open Office, and the computer will not complete the shut down process. (Will go through the process; however, I have to manually push the off button to turn it off. Can you help me? Thank you!
Post #2
Hello,
Welcome to WhatTheTech. My name is mowman, and I will be helping you fix your problems.

If you do not make a reply in 3 days, we will have to close your topic.

You may want to keep the link to this topic in your favorites. Alternatively, you can click the Options button at the top bar of this topic and Track this topic. The topics you are tracking can be found by clicking on My Topics at the top of any page.

Please take note of some guidelines for this fix:

•Refrain from making any changes to your computer including installing/uninstall programs, deleting files, modifying the registry, and running scanners or tools. Doing so could cause changes to the directions I have to give you and prolong the time required. Further more, you should not be taking any advice relating to this computer from any other source throughout the course of this fix.
•If you do not understand any step(s) provided, please do not hesitate to ask before continuing. I would much rather clarify instructions or explain them differently than have something important broken.
•Even if things appear to be better, it might not mean we are finished. Please continue to follow my instructions and reply back until I give you the "all clean". We do not want to clean you part-way, only to have the system re-infect itself.
•Please reply using the button in the lower right hand corner of your screen. Do not start a new topic. The logs that you post should be pasted directly into the reply.
Only attach them if requested or if they do not fit into the post





Please download TDSSKiller.zip
  • Extract it to your desktop
  • Double click TDSSKiller.exe
  • Press Start Scan
    • Only if Malicious objects are found then ensure Cure is selected
      If suspicious objects are found select skip
    • Then click Continue > Reboot now
  • Copy and paste the log in your next reply
    • A copy of the log will be saved automatically to the root of the drive (typically C:\)












  • Download OTL to your desktop.
  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • When the window appears, underneath Output at the top change it to Minimal Output.
  • Check the boxes beside LOP Check and Purity Check.
  • Under Custom Scan paste this in

    netsvcs
    %SYSTEMDRIVE%\*.exe
    /md5start
    explorer.exe
    winlogon.exe
    Userinit.exe
    svchost.exe
    /md5stop
    C:\Windows\assembly\tmp\U\*.* /s
    CREATERESTOREPOINT

  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
  • You may need two posts to fit them both in.
Post #3
Mowman:

I have been having difficulty logging in to this forum for the past two days. Have finally solved this.

I sent all logs to you yesterday via the WhattheTech Contact form, requesting that someone get in touch with you, as I did not know of any other way to do so. At the time I also requested help with logging in.

I will now post the results of my scans. Re: rootkit —–


Results from first segment:
(Report that came up after scan said that it found 1 infected file; 2 cured.

Thank you.

21:12:56.0625 1116 TDSS rootkit removing tool [removed] Nov 16 2011 12:18:50
21:12:56.0984 1116 ============================================================
21:12:56.0984 1116 Current date / time: 2011/11/16 21:12:56.0984
21:12:56.0984 1116 SystemInfo:
21:12:56.0984 1116
21:12:56.0984 1116 OS Version: 5.1.2600 ServicePack: 3.0
21:12:56.0984 1116 Product type: Workstation
21:12:56.0984 1116 ComputerName: OWNER-0C0798AD2
21:12:56.0984 1116 UserName: Owner
21:12:57.0000 1116 Windows directory: C:\WINDOWS
21:12:57.0000 1116 System windows directory: C:\WINDOWS
21:12:57.0000 1116 Processor architecture: Intel x86
21:12:57.0000 1116 Number of processors: 1
21:12:57.0000 1116 Page size: 0x1000
21:12:57.0000 1116 Boot type: Normal boot
21:12:57.0000 1116 ============================================================
21:12:57.0750 1116 Initialize success


Thank you.


Above info in reply to Mowman who wrote::

NeebKarori,

mowman has just posted a reply to a topic that you have subscribed to titled "I do not know".

The topic can be found here:
http://forums.whatthetech.com/index.php?sh…view=getnewpost

There may be more replies to this topic, but only 1 email is sent per board visit for each subscribed topic. This is
to limit the amount of mail that is sent to your inbox.

Unsubscribing:
————–

You can unsubscribe at any time by logging into your control panel and clicking on the "View Topics" link.

Regards,

The What the Tech team.
http://forums.whatthetech.com/index.php
Post #4
All results are from yesterday 11/16 (and where sent via contact form as I could not log in.

********

Just ran TDSS again. No threats found. all clear. I will proceed to your next instruction.


P.S. The data below were listed as "Report."

**********

Results from OTS report:

1) OTL.Txt:

OTL logfile created on: 11/16/2011 10:36:05 PM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Documents and Settings\Owner\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

959.36 Mb Total Physical Memory | 505.57 Mb Available Physical Memory | 52.70% Memory free
2.26 Gb Paging File | 1.76 Gb Available in Paging File | 78.00% Paging File free
Paging file location(s): C:\pagefile.sys 1440 2880 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.52 Gb Total Space | 54.70 Gb Free Space | 73.41% Space Free | Partition Type: NTFS
Drive D: | 455.04 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: OWNER-0C0798AD2 | User Name: Owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Owner\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\AVG\AVG2012\avgemcx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2012\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2012\avgnsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2012\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2012\avgrsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\8.0.1\ToolbarUpdater.exe ()
PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files\AVG\AVG2012\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG Secure Search\vprot.exe ()
PRC - C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2012\avgscanx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Program Files\Real\RealPlayer\Update\realsched.exe (RealNetworks, Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\SSC Service Utility\ssc_serv.exe (SSC Localization Group)
PRC - C:\Program Files\TRENDnet\TEW-424UB\WlanCU.exe ()
PRC - C:\WINDOWS\soundman.exe (Realtek Semiconductor Corp.)


========== Modules (No Company Name) ==========

MOD - C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\8.0.1\ToolbarUpdater.exe ()
MOD - C:\Program Files\AVG Secure Search\vprot.exe ()
MOD - C:\WINDOWS\system32\nvshell.dll ()
MOD - C:\Program Files\Adobe\Reader 9.0\Reader\ViewerPS.dll ()
MOD - C:\Program Files\TRENDnet\TEW-424UB\WlanCU.exe ()
MOD - C:\Program Files\TRENDnet\TEW-424UB\WlanDll.dll ()
MOD - C:\Program Files\TRENDnet\TEW-424UB\acAuth.dll ()


========== Win32 Services (SafeList) ==========

SRV - (WinDefend) – File not found
SRV - (avgwd) – C:\Program Files\AVG\AVG2012\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (vToolbarUpdater) – C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\8.0.1\ToolbarUpdater.exe ()
SRV - (MBAMService) – C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (AVGIDSAgent) – C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe (AVG Technologies CZ, s.r.o.)



CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

File not found – C:\WINDOWS\System32\
[2011/11/16 21:25:50 | 000,584,192 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Owner\Desktop\OTL.exe
[2011/11/16 12:21:12 | 001,564,976 | —- | C] (Kaspersky Lab ZAO) – C:\Documents and Settings\Owner\Desktop\TDSSKiller.exe
[2011/11/12 17:12:38 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Application Data\Real
[2011/11/12 03:54:07 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Application Data\Macromedia
[2011/11/11 02:20:02 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Application Data\Sun
[2011/11/11 00:56:06 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Application Data\Adobe
[2011/11/11 00:50:58 | 000,000,000 | -HSD | C] – C:\WINDOWS\assembly
[2011/11/11 00:46:34 | 000,000,000 | -HSD | C] – C:\Documents and Settings\Owner\Local Settings\Application Data\2c3bd761
[2011/11/09 14:51:35 | 000,000,000 | —D | C] – C:\WINDOWS\System32\cache
[2011/11/05 01:49:11 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Java
[2011/11/05 01:48:55 | 000,157,472 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaws.exe
[2011/11/05 01:48:55 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\javaw.exe
[2011/11/05 01:48:55 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\WINDOWS\System32\java.exe
[2011/10/30 22:28:00 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\My Documents\……………..MarinaMatsushima…._files
[2011/10/30 22:27:40 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\My Documents\…………..Marina Matsushima…._files
[2011/10/30 22:24:11 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\My Documents\………………..Marinamm…._files
[2011/10/28 20:01:46 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\My Documents\………………………………………………….defiipod…._file
s
[2011/10/24 22:29:54 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\My Documents\My Scans
[2011/10/20 22:57:31 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\My Documents\Jung astro chart_files
[2011/10/20 22:55:45 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\My Documents\…….favorite quotes by C.G. Jung_files
[2011/10/20 22:49:02 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\My Documents\Carl Jung Thirteen Quotations on the Shadow_files
[2011/10/19 02:36:21 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\My Documents\SEE-The Bio of Kund- Shadow, Sabotage and Sacrifice_files
[2011/10/19 02:17:20 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\My Documents\Welcome to The Shadow Lands _ Shadow_files
[2011/10/18 19:33:31 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\My Documents\JTP - journal-content_files
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

File not found – C:\WINDOWS\System32\
[2011/11/16 22:38:06 | 000,000,978 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-436374069-1844823847-725345543-1003UA.job
[2011/11/16 21:38:03 | 000,000,926 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-436374069-1844823847-725345543-1003Core.job
[2011/11/16 21:25:48 | 000,584,192 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Owner\Desktop\OTL.exe
[2011/11/16 21:08:15 | 000,013,646 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2011/11/16 21:07:39 | 000,043,531 | —- | M] () – C:\WINDOWS\System32\nvapps.xml
[2011/11/16 21:07:33 | 000,000,278 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-436374069-1844823847-725345543-1003.job
[2011/11/16 21:07:30 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/11/16 17:14:47 | 000,000,702 | —- | M] () – C:\Documents and Settings\All Users\Desktop\AVG 2012.lnk
[2011/11/16 17:08:21 | 109,888,454 | —- | M] () – C:\WINDOWS\System32\drivers\AVG\incavi.avm
[2011/11/16 12:21:12 | 001,564,976 | —- | M] (Kaspersky Lab ZAO) – C:\Documents and Settings\Owner\Desktop\TDSSKiller.exe
[2011/11/16 05:51:29 | 000,000,069 | —- | M] () – C:\WINDOWS\NeroDigital.ini
[2011/11/16 05:14:33 | 000,235,298 | —- | M] () – C:\Documents and Settings\Owner\My Documents\Amma Letter - Psychology.odt
[2011/11/16 04:00:01 | 000,035,161 | —- | M] () – C:\Documents and Settings\Owner\My Documents\Amma Letter - Engler - Is therapy necesssary on the Path.odt
[2011/11/15 18:48:17 | 000,190,213 | —- | M] () – C:\Documents and Settings\Owner\My Documents\Amma Lette -Spir & Psy Bypassing - -.odt
[2011/11/15 17:30:02 | 000,095,978 | —- | M] () – C:\Documents and Settings\Owner\My Documents\Amma Letter - Analysis.odt
[2011/11/15 17:22:03 | 000,022,827 | —- | M] () – C:\Documents and Settings\Owner\My Documents\Amma Letter – Intro.odt
[2011/11/15 17:09:43 | 000,111,863 | —- | M] () – C:\Documents and Settings\Owner\My Documents\Amma Letter - Problem Statement.odt
[2011/11/15 00:11:10 | 000,045,699 | —- | M] () – C:\Documents and Settings\Owner\My Documents\Amma Letter – Proposed Solutions.odt
[2011/11/14 22:26:04 | 000,043,798 | —- | M] () – C:\Documents and Settings\Owner\My Documents\Amma Letter – Specific Devotees.odt
[2011/11/14 21:19:59 | 000,065,404 | —- | M] () – C:\Documents and Settings\Owner\My Documents\Amma letter - Spirituality.odt
[2011/11/14 19:53:59 | 000,014,875 | —- | M] () – C:\Documents and Settings\Owner\My Documents\Amma Letter - Conclusion.odt
[2011/11/14 04:26:51 | 000,100,460 | —- | M] () – C:\Documents and Settings\Owner\My Documents\Assagioli on Education.pdf
[2011/11/14 00:27:13 | 000,014,809 | —- | M] () – C:\Documents and Settings\Owner\My Documents\Amma Letter - The Path of the Mother - Savitri.odt
[2011/11/13 21:03:42 | 000,100,870 | —- | M] () – C:\Documents and Settings\Owner\My Documents\Amma - The Emperor's New Clothes - Kornfield.odt
[2011/11/13 17:52:29 | 000,040,999 | —- | M] () – C:\Documents and Settings\Owner\My Documents\untitled_1_2.odt
[2011/11/13 17:02:13 | 000,039,901 | —- | M] () – C:\Documents and Settings\Owner\My Documents\Amma Letter - Community.odt
[2011/11/13 16:39:03 | 000,011,935 | —- | M] () – C:\Documents and Settings\Owner\My Documents\Amma Letter – Conclusion.odt
[2011/11/13 03:57:38 | 001,906,951 | —- | M] () – C:\Documents and Settings\Owner\My Documents\My - WHAT CAN BE DONE.odt
[2011/11/13 02:27:47 | 000,143,222 | —- | M] () – C:\Documents and Settings\Owner\My Documents\My - Blame vs. Accountability - Good for Intro - possib.odt
[2011/11/12 21:32:55 | 000,000,286 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-436374069-1844823847-725345543-1003.job
[2011/11/12 17:20:57 | 000,073,484 | —- | M] () – C:\Documents and Settings\Owner\My Documents\For - Gallery Openings.odt
[2011/11/11 14:41:37 | 000,002,262 | —- | M] () – C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2011/11/11 14:41:35 | 000,002,284 | —- | M] () – C:\Documents and Settings\Owner\Desktop\Google Chrome.lnk
[2011/11/11 02:20:02 | 000,000,664 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2011/11/11 00:46:14 | 000,000,784 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Privacy Protection.lnk
[2011/11/10 03:21:26 | 000,028,002 | —- | M] () – C:\Documents and Settings\Owner\My Documents\Behavior-mod, Mind-mod.odt
[2011/11/10 03:17:45 | 000,029,094 | —- | M] () – C:\Documents and Settings\Owner\My Documents\Psycho-tronics.odt
[2011/11/09 03:06:13 | 000,025,094 | —- | M] () – C:\Documents and Settings\Owner\My Documents\Hap!! - 2.odt
[2011/11/09 03:06:06 | 000,216,240 | —- | M] () – C:\Documents and Settings\Owner\My Documents\Hap!! - 1.odt
[2011/11/08 21:46:18 | 000,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2011/11/08 18:13:51 | 000,162,672 | —- | M] () – C:\WINDOWS\System32\drivers\AVG\iavichjg.avm
[2011/11/07 01:24:13 | 000,041,973 | —- | M] () – C:\Documents and Settings\Owner\My Documents\…………………………………………………….Lanae….odt
[2011/11/06 16:46:10 | 018,410,785 | —- | M] () – C:\Documents and Settings\Owner\My Documents\Gallery Openings.odt
[2011/11/06 16:43:50 | 000,049,144 | —- | M] () – C:\Documents and Settings\Owner\My Documents\Amazon Customer Reviews - Me ans Lee - How I Came to Know, Love and Lose Lee Harvey Oswald.odt
[2011/11/06 13:41:14 | 000,311,604 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2011/11/06 13:41:14 | 000,039,992 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2011/11/04 22:20:41 | 001,596,631 | —- | M] () – C:\Documents and Settings\Owner\My Documents\Chellis.odt
[2011/11/04 15:43:52 | 000,158,429 | —- | M] () – C:\Documents and Settings\Owner\My Documents\RMV-3 form 314597400_9992.pdf
[2011/11/03 18:31:43 | 000,019,790 | —- | M] () – C:\Documents and Settings\Owner\My Documents\Bank of America.odt
[2011/11/03 18:13:52 | 000,011,425 | —- | M] () – C:\Documents and Settings\Owner\My Documents\BankofAmerica.odt
[2011/10/30 22:28:01 | 000,081,194 | —- | M] () – C:\Documents and Settings\Owner\My Documents\……………..MarinaMatsushima…..htm
[2011/10/30 22:27:40 | 000,081,194 | —- | M] () – C:\Documents and Settings\Owner\My Documents\…………..Marina Matsushima…..htm
[2011/10/30 22:24:12 | 000,080,869 | —- | M] () – C:\Documents and Settings\Owner\My Documents\………………..Marinamm…..htm
[2011/10/30 20:40:21 | 009,653,242 | —- | M] () – C:\Documents and Settings\Owner\My Documents\Debbie – 2011 Ongoing Sessions.odt
[2011/10/28 20:01:46 | 000,004,201 | —- | M] () – C:\Documents and Settings\Owner\My Documents\………………………………………………….defiipod…..htm
[2011/10/28 16:36:39 | 005,464,426 | —- | M] () – C:\Documents and Settings\Owner\My Documents\Debbie - Final Bill 3-1-11.odt
[2011/10/27 22:27:40 | 000,019,645 | —- | M] () – C:\Documents and Settings\Owner\My Documents\ARGUELLES.odt
[2011/10/27 20:27:51 | 002,139,369 | —- | M] () – C:\Documents and Settings\Owner\My Documents\Debbie - begins payments 6-12.odt
[2011/10/25 00:14:15 | 000,445,663 | —- | M] () – C:\Documents and Settings\Owner\My Documents\Debbie D - Disability Review Letter.odt
[2011/10/24 00:00:48 | 007,607,730 | —- | M] () – C:\Documents and Settings\Owner\My Documents\Debbie – 2011 dates and bill.odt
[2011/10/22 18:20:02 | 012,632,868 | —- | M] () – C:\Documents and Settings\Owner\My Documents\DEBBIE-BCBS said they paid-rec'd 500 - 2011.odt
[2011/10/22 01:39:21 | 000,414,368 | —- | M] (Adobe Systems Incorporated) – C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2011/10/20 22:57:31 | 000,003,452 | —- | M] () – C:\Documents and Settings\Owner\My Documents\Jung astro chart.htm
[2011/10/20 22:55:46 | 000,044,623 | —- | M] () – C:\Documents and Settings\Owner\My Documents\…….favorite quotes by C.G. Jung.htm
[2011/10/20 22:49:03 | 000,055,120 | —- | M] () – C:\Documents and Settings\Owner\My Documents\Carl Jung Thirteen Quotations on the Shadow.htm
[2011/10/19 02:36:21 | 000,075,807 | —- | M] () – C:\Documents and Settings\Owner\My Documents\SEE-The Bio of Kund- Shadow, Sabotage and Sacrifice.htm
[2011/10/19 02:17:21 | 000,025,828 | —- | M] () – C:\Documents and Settings\Owner\My Documents\Welcome to The Shadow Lands _ Shadow.htm
[2011/10/18 20:17:08 | 000,355,108 | —- | M] () – C:\Documents and Settings\Owner\My Documents\Befriending Emotion - pps. 3-10.odt
[2011/10/18 20:16:05 | 000,553,366 | —- | M] () – C:\Documents and Settings\Owner\My Documents\Befriending Emotion - pps. 1-2.odt
[2011/10/18 19:35:10 | 000,453,696 | —- | M] () – C:\Documents and Settings\Owner\My Documents\befriending_emotion.pdf
[2011/10/18 19:33:34 | 000,386,906 | —- | M] () – C:\Documents and Settings\Owner\My Documents\JTP - journal-content.aspx
[2011/10/18 00:00:21 | 000,086,837 | —- | M] () – C:\Documents and Settings\Owner\My Documents\Amma - Robert Augustus Masters - Essays.odt
[2011/10/17 23:06:36 | 000,044,705 | —- | M] () – C:\Documents and Settings\Owner\My Documents\Amma Letter – Spiritual Bypassing – relevant quotes Masters + others.odt
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/11/14 04:26:51 | 000,100,460 | —- | C] () – C:\Documents and Settings\Owner\My Documents\Assagioli on Education.pdf
[2011/11/13 18:04:25 | 000,040,999 | —- | C] () – C:\Documents and Settings\Owner\My Documents\untitled_1_2.odt
[2011/11/11 02:20:02 | 000,000,664 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2011/11/11 00:46:12 | 000,000,784 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Privacy Protection.lnk
[2011/11/10 07:04:55 | 000,073,484 | —- | C] () – C:\Documents and Settings\Owner\My Documents\For - Gallery Openings.odt
[2011/11/10 03:21:25 | 000,028,002 | —- | C] () – C:\Documents and Settings\Owner\My Documents\Behavior-mod, Mind-mod.odt
[2011/11/09 20:03:43 | 000,029,094 | —- | C] () – C:\Documents and Settings\Owner\My Documents\Psycho-tronics.odt
[2011/11/08 21:12:01 | 000,025,094 | —- | C] () – C:\Documents and Settings\Owner\My Documents\Hap!! - 2.odt
[2011/11/08 21:11:40 | 000,216,240 | —- | C] () – C:\Documents and Settings\Owner\My Documents\Hap!! - 1.odt
[2011/11/07 01:24:11 | 000,041,973 | —- | C] () – C:\Documents and Settings\Owner\My Documents\…………………………………………………….Lanae….odt
[2011/11/06 14:40:24 | 000,049,144 | —- | C] () – C:\Documents and Settings\Owner\My Documents\Amazon Customer Reviews - Me ans Lee - How I Came to Know, Love and Lose Lee Harvey Oswald.odt
[2011/11/04 16:19:14 | 001,596,631 | —- | C] () – C:\Documents and Settings\Owner\My Documents\Chellis.odt
[2011/11/04 15:43:51 | 000,158,429 | —- | C] () – C:\Documents and Settings\Owner\My Documents\RMV-3 form 314597400_9992.pdf
[2011/10/30 22:28:00 | 000,081,194 | —- | C] () – C:\Documents and Settings\Owner\My Documents\……………..MarinaMatsushima…..htm
[2011/10/30 22:27:39 | 000,081,194 | —- | C] () – C:\Documents and Settings\Owner\My Documents\…………..Marina Matsushima…..htm
[2011/10/30 22:24:11 | 000,080,869 | —- | C] () – C:\Documents and Settings\Owner\My Documents\………………..Marinamm…..htm
[2011/10/28 20:01:46 | 000,004,201 | —- | C] () – C:\Documents and Settings\Owner\My Documents\………………………………………………….defiipod…..htm
[2011/10/25 17:22:04 | 000,011,425 | —- | C] () – C:\Documents and Settings\Owner\My Documents\BankofAmerica.odt
[2011/10/24 22:59:02 | 018,410,785 | —- | C] () – C:\Documents and Settings\Owner\My Documents\Gallery Openings.odt
[2011/10/23 05:32:11 | 000,035,161 | —- | C] () – C:\Documents and Settings\Owner\My Documents\Amma Letter - Engler - Is therapy necesssary on the Path.odt
[2011/10/22 20:32:29 | 000,014,809 | —- | C] () – C:\Documents and Settings\Owner\My Documents\Amma Letter - The Path of the Mother - Savitri.odt
[2011/10/20 22:57:31 | 000,003,452 | —- | C] () – C:\Documents and Settings\Owner\My Documents\Jung astro chart.htm
[2011/10/20 22:55:45 | 000,044,623 | —- | C] () – C:\Documents and Settings\Owner\My Documents\…….favorite quotes by C.G. Jung.htm
[2011/10/20 22:49:02 | 000,055,120 | —- | C] () – C:\Documents and Settings\Owner\My Documents\Carl Jung Thirteen Quotations on the Shadow.htm
[2011/10/20 21:31:38 | 000,014,875 | —- | C] () – C:\Documents and Settings\Owner\My Documents\Amma Letter - Conclusion.odt
[2011/10/19 02:36:21 | 000,075,807 | —- | C] () – C:\Documents and Settings\Owner\My Documents\SEE-The Bio of Kund- Shadow, Sabotage and Sacrifice.htm
[2011/10/19 02:17:20 | 000,025,828 | —- | C] () – C:\Documents and Settings\Owner\My Documents\Welcome to The Shadow Lands _ Shadow.htm
[2011/10/18 20:17:05 | 000,355,108 | —- | C] () – C:\Documents and Settings\Owner\My Documents\Befriending Emotion - pps. 3-10.odt
[2011/10/18 20:15:55 | 000,553,366 | —- | C] () – C:\Documents and Settings\Owner\My Documents\Befriending Emotion - pps. 1-2.odt
[2011/10/18 19:35:08 | 000,453,696 | —- | C] () – C:\Documents and Settings\Owner\My Documents\befriending_emotion.pdf
[2011/10/18 19:33:27 | 000,386,906 | —- | C] () – C:\Documents and Settings\Owner\My Documents\JTP - journal-content.aspx
[2011/10/18 02:19:56 | 000,011,935 | —- | C] () – C:\Documents and Settings\Owner\My Documents\Amma Letter – Conclusion.odt
[2011/10/18 00:00:21 | 000,086,837 | —- | C] () – C:\Documents and Settings\Owner\My Documents\Amma - Robert Augustus Masters - Essays.odt
[2011/09/04 22:04:38 | 000,205,170 | —- | C] () – C:\WINDOWS\hpwins26.dat
[2011/09/04 22:04:37 | 000,000,370 | —- | C] () – C:\WINDOWS\hpwmdl26.dat
[2011/07/04 15:19:46 | 000,031,131 | —- | C] () – C:\Documents and Settings\Owner\Application Data\D5AA.C89
[2010/06/30 19:02:22 | 000,000,028 | —- | C] () – C:\WINDOWS\pdf995.ini
[2010/06/30 19:00:50 | 000,000,060 | —- | C] () – C:\WINDOWS\wpd99.drv
[2010/06/30 19:00:49 | 000,051,716 | —- | C] () – C:\WINDOWS\System32\pdf995mon.dll
[2010/06/01 22:05:44 | 000,000,036 | —- | C] () – C:\Documents and Settings\Owner\Local Settings\Application Data\housecall.guid.cache
[2010/06/01 21:59:17 | 000,000,000 | —- | C] () – C:\WINDOWS\nsreg.dat
[2010/05/22 20:29:08 | 000,163,677 | —- | C] () – C:\WINDOWS\hphins33.dat
[2010/05/22 20:29:07 | 000,000,586 | —- | C] () – C:\WINDOWS\hphmdl33.dat
[2010/05/02 20:22:00 | 000,005,248 | —- | C] () – C:\WINDOWS\System32\giveio.sys
[2010/05/02 20:15:10 | 000,073,220 | —- | C] () – C:\WINDOWS\System32\EPPICPrinterDB.dat
[2010/05/02 20:15:10 | 000,021,021 | —- | C] () – C:\WINDOWS\System32\EPPICPattern3.dat
[2010/05/02 20:15:10 | 000,015,670 | —- | C] () – C:\WINDOWS\System32\EPPICPattern5.dat
[2010/05/02 20:15:10 | 000,013,280 | —- | C] () – C:\WINDOWS\System32\EPPICPattern2.dat
[2010/05/02 20:15:10 | 000,010,673 | —- | C] () – C:\WINDOWS\System32\EPPICPattern4.dat
[2010/05/02 20:15:10 | 000,004,943 | —- | C] () – C:\WINDOWS\System32\EPPICPattern6.dat
[2010/05/02 20:15:10 | 000,001,140 | —- | C] () – C:\WINDOWS\System32\EPPICPresetData_PT.dat
[2010/05/02 20:15:10 | 000,001,140 | —- | C] () – C:\WINDOWS\System32\EPPICPresetData_BP.dat
[2010/05/02 20:15:10 | 000,001,137 | —- | C] () – C:\WINDOWS\System32\EPPICPresetData_ES.dat
[2010/05/02 20:15:10 | 000,001,130 | —- | C] () – C:\WINDOWS\System32\EPPICPresetData_FR.dat
[2010/05/02 20:15:10 | 000,001,130 | —- | C] () – C:\WINDOWS\System32\EPPICPresetData_CF.dat
[2010/05/02 20:15:10 | 000,001,104 | —- | C] () – C:\WINDOWS\System32\EPPICPresetData_EN.dat
[2010/05/02 20:15:10 | 000,000,097 | —- | C] () – C:\WINDOWS\System32\PICSDK.ini
[2010/05/02 20:15:09 | 000,031,053 | —- | C] () – C:\WINDOWS\System32\EPPICPattern131.dat
[2010/05/02 20:15:09 | 000,029,114 | —- | C] () – C:\WINDOWS\System32\EPPICPattern1.dat
[2010/05/02 20:15:09 | 000,027,417 | —- | C] () – C:\WINDOWS\System32\EPPICPattern121.dat
[2009/10/13 22:12:55 | 000,010,752 | —- | C] () – C:\Documents and Settings\Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/09/28 22:31:45 | 000,000,169 | —- | C] () – C:\WINDOWS\RtlRack.ini
[2009/09/28 22:31:04 | 000,000,069 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2009/09/21 16:02:55 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2009/09/21 15:57:11 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2009/09/21 14:06:38 | 000,049,152 | R— | C] () – C:\WINDOWS\System32\ChCfg.exe
[2009/09/21 14:06:16 | 000,147,456 | R— | C] () – C:\WINDOWS\System32\RtlCPAPI.dll
[2009/09/21 14:06:12 | 000,000,164 | R— | C] () – C:\WINDOWS\avrack.ini
[2009/09/21 08:43:40 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2009/09/21 08:41:07 | 000,113,376 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2006/01/24 20:15:00 | 001,662,976 | —- | C] () – C:\WINDOWS\System32\nvwdmcpl.dll
[2006/01/24 20:15:00 | 001,519,616 | —- | C] () – C:\WINDOWS\System32\nwiz.exe
[2006/01/24 20:15:00 | 001,466,368 | —- | C] () – C:\WINDOWS\System32\nview.dll
[2006/01/24 20:15:00 | 001,339,392 | —- | C] () – C:\WINDOWS\System32\nvdspsch.exe
[2006/01/24 20:15:00 | 001,019,904 | —- | C] () – C:\WINDOWS\System32\nvwimg.dll
[2006/01/24 20:15:00 | 000,573,440 | —- | C] () – C:\WINDOWS\System32\nvhwvid.dll
[2006/01/24 20:15:00 | 000,466,944 | —- | C] () – C:\WINDOWS\System32\nvshell.dll
[2006/01/24 20:15:00 | 000,442,368 | —- | C] () – C:\WINDOWS\System32\nvappbar.exe
[2006/01/24 20:15:00 | 000,425,984 | —- | C] () – C:\WINDOWS\System32\keystone.exe
[2006/01/24 20:15:00 | 000,286,720 | —- | C] () – C:\WINDOWS\System32\nvnt4cpl.dll
[2006/01/24 20:15:00 | 000,106,496 | —- | C] () – C:\WINDOWS\System32\nvapi.dll
[2004/08/04 07:00:00 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[2004/08/04 07:00:00 | 000,311,604 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[2004/08/04 07:00:00 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[2004/08/04 07:00:00 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[2004/08/04 07:00:00 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\mib.bin
[2004/08/04 07:00:00 | 000,039,992 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[2004/08/04 07:00:00 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[2004/08/04 07:00:00 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2004/08/04 07:00:00 | 000,001,804 | —- | C] () – C:\WINDOWS\System32\dcache.bin
[2004/08/04 07:00:00 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat
[2003/07/21 07:00:00 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\oembios.bin
[2003/07/21 07:00:00 | 000,004,461 | —- | C] () – C:\WINDOWS\System32\oembios.dat

========== LOP Check ==========

[2011/11/16 21:08:15 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AVG2012
[2011/10/16 16:39:31 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\avg9
[2011/03/14 13:52:10 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\Common Files
[2010/05/02 20:14:59 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\EPSON
[2011/11/16 17:21:54 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\MFAData
[2011/06/29 20:23:20 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\pdf995
[2011/10/16 16:22:53 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2011/10/16 17:17:18 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\AVG Secure Search
[2011/10/16 17:19:47 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\AVG2012
[2010/09/21 16:53:25 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2009/10/13 23:34:19 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\OpenOffice.org
[2010/06/30 19:02:22 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\pdf995
[2011/08/29 20:18:24 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\QuickScan

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.exe >


< MD5 for: EXPLORER.EXE >
[2008/04/13 19:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 – C:\WINDOWS\explorer.exe
[2008/04/13 19:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 – C:\WINDOWS\ServicePackFiles\i386\explorer.exe
[2004/08/04 07:00:00 | 001,032,192 | —- | M] (Microsoft Corporation) MD5=A0732187050030AE399B241436565E64 – C:\WINDOWS\$NtServicePackUninstall$\explorer.exe

< MD5 for: SVCHOST.EXE >
[2008/04/13 19:12:36 | 000,014,336 | —- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 – C:\WINDOWS\ServicePackFiles\i386\svchost.exe
[2008/04/13 19:12:36 | 000,014,336 | —- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 – C:\WINDOWS\system32\svchost.exe
[2004/08/04 07:00:00 | 000,014,336 | —- | M] (Microsoft Corporation) MD5=8F078AE4ED187AAABC0A305146DE6716 – C:\WINDOWS\$NtServicePackUninstall$\svchost.exe

< MD5 for: USERINIT.EXE >
[2004/08/04 07:00:00 | 000,024,576 | —- | M] (Microsoft Corporation) MD5=39B1FFB03C2296323832ACBAE50D2AFF – C:\WINDOWS\$NtServicePackUninstall$\userinit.exe
[2008/04/13 19:12:38 | 000,026,112 | —- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 – C:\WINDOWS\ServicePackFiles\i386\userinit.exe
[2008/04/13 19:12:38 | 000,026,112 | —- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 – C:\WINDOWS\system32\userinit.exe

< MD5 for: WINLOGON.EXE >
[2004/08/04 07:00:00 | 000,502,272 | —- | M] (Microsoft Corporation) MD5=01C3346C241652F43AED8E2149881BFE – C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
[2008/04/13 19:12:39 | 000,507,904 | —- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E – C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
[2008/04/13 19:12:39 | 000,507,904 | —- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E – C:\WINDOWS\system32\winlogon.exe

< C:\Windows\assembly\tmp\U\*.* /s >

========== Alternate Data Streams ==========

@Alternate Data Stream - 121 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2
@Alternate Data Stream - 109 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A8ADE5D8

< End of report >



**********************

Extras.txt - Notepad:

OTL Extras logfile created on: 11/16/2011 10:36:05 PM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Documents and Settings\Owner\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

959.36 Mb Total Physical Memory | 505.57 Mb Available Physical Memory | 52.70% Memory free
2.26 Gb Paging File | 1.76 Gb Available in Paging File | 78.00% Paging File free
Paging file location(s): C:\pagefile.sys 1440 2880 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.52 Gb Total Space | 54.70 Gb Free Space | 73.41% Space Free | Partition Type: NTFS
Drive D: | 455.04 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: OWNER-0C0798AD2 | User Name: Owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] – "%1" %*
htmlfile – Reg Error: Key error.
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22002

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe" = C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe – (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe" = C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe – (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hposid01.exe" = C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe – (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpfcCopy.exe" = C:\Program Files\HP\Digital Imaging\bin\hpfcCopy.exe:*:Enabled:hpfccopy.exe – ()
"C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe" = C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe – (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe" = C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe – (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe" = C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe:*:Enabled:hpiscnapp.exe – (Hewlett-Packard)
"C:\Program Files\Common Files\HP\Digital Imaging\Bin\hpqPhotoCrm.exe" = C:\Program Files\Common Files\HP\Digital Imaging\Bin\hpqPhotoCrm.exe:*:Enabled:hpqphotocrm.exe – (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpofxs08.exe" = C:\Program Files\HP\Digital Imaging\bin\hpofxs08.exe:*:Enabled:hpofxs08.exe – (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpqfxt08.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqfxt08.exe:*:Enabled:hpqfxt08.exe – (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpqgplgtupl.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqgplgtupl.exe:*:Enabled:hpqgplgtupl.exe – (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpqusgm.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqusgm.exe:*:Enabled:hpqusgm.exe – (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpqusgh.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqusgh.exe:*:Enabled:hpqusgh.exe – (Hewlett-Packard Co.)
"C:\Program Files\HP\HP Software Update\HPWUCli.exe" = C:\Program Files\HP\HP Software Update\HPWUCli.exe:*:Enabled:hpwucli.exe – (Hewlett-Packard)
"C:\Program Files\HP\Digital Imaging\smart web printing\SmartWebPrintExe.exe" = C:\Program Files\HP\Digital Imaging\smart web printing\SmartWebPrintExe.exe:*:Enabled:smartwebprintexe.exe – (Hewlett-Packard Co.)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\AVG\AVG8\avgemc.exe" = C:\Program Files\AVG\AVG8\avgemc.exe:*:Enabled:avgemc.exe
"C:\Program Files\AVG\AVG8\avgupd.exe" = C:\Program Files\AVG\AVG8\avgupd.exe:*:Enabled:avgupd.exe
"C:\Program Files\AVG\AVG8\avgnsx.exe" = C:\Program Files\AVG\AVG8\avgnsx.exe:*:Enabled:avgnsx.exe
"C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe" = C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe – (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe" = C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe – (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hposid01.exe" = C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe – (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpfcCopy.exe" = C:\Program Files\HP\Digital Imaging\bin\hpfcCopy.exe:*:Enabled:hpfccopy.exe – ()
"C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe" = C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe – (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe" = C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe – (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe" = C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe:*:Enabled:hpiscnapp.exe – (Hewlett-Packard)
"C:\Program Files\Common Files\HP\Digital Imaging\Bin\hpqPhotoCrm.exe" = C:\Program Files\Common Files\HP\Digital Imaging\Bin\hpqPhotoCrm.exe:*:Enabled:hpqphotocrm.exe – (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpofxs08.exe" = C:\Program Files\HP\Digital Imaging\bin\hpofxs08.exe:*:Enabled:hpofxs08.exe – (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpqfxt08.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqfxt08.exe:*:Enabled:hpqfxt08.exe – (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpqgplgtupl.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqgplgtupl.exe:*:Enabled:hpqgplgtupl.exe – (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpqusgm.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqusgm.exe:*:Enabled:hpqusgm.exe – (Hewlett-Packard Co.)
"C:\Program Files\HP\Digital Imaging\bin\hpqusgh.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqusgh.exe:*:Enabled:hpqusgh.exe – (Hewlett-Packard Co.)
"C:\Program Files\HP\HP Software Update\HPWUCli.exe" = C:\Program Files\HP\HP Software Update\HPWUCli.exe:*:Enabled:hpwucli.exe – (Hewlett-Packard)
"C:\Program Files\HP\Digital Imaging\smart web printing\SmartWebPrintExe.exe" = C:\Program Files\HP\Digital Imaging\smart web printing\SmartWebPrintExe.exe:*:Enabled:smartwebprintexe.exe – (Hewlett-Packard Co.)
"C:\Program Files\AVG\AVG2012\avgmfapx.exe" = C:\Program Files\AVG\AVG2012\avgmfapx.exe:*:Enabled:AVG Installer – (AVG Technologies CZ, s.r.o.)
"C:\WINDOWS\explorer.exe" = C:\WINDOWS\explorer.exe:*:Disabled:Windows Explorer – (Microsoft Corporation)
"C:\Program Files\Mozilla Firefox\firefox.exe" = C:\Program Files\Mozilla Firefox\firefox.exe:*:Disabled:Firefox – (Mozilla Corporation)
"C:\Documents and Settings\Owner\Application Data\Real\Update\UpgradeHelper\RealPlayer\9.00\rnupgagent.exe" = C:\Documents and Settings\Owner\Application Data\Real\Update\UpgradeHelper\RealPlayer\9.00\rnupgagent.exe:*:Disabled:RealNetworks Installer – (RealNetworks, Inc.)
"C:\Program Files\Real\RealPlayer\realplay.exe" = C:\Program Files\Real\RealPlayer\realplay.exe:*:Enabled:RealPlayer – (RealNetworks, Inc.)
"C:\Program Files\OpenOffice.org 3\program\soffice.bin" = C:\Program Files\OpenOffice.org 3\program\soffice.bin:*:Enabled:OpenOffice.org 3.1 – (OpenOffice.org)
"C:\Program Files\Mozilla Firefox\crashreporter.exe" = C:\Program Files\Mozilla Firefox\crashreporter.exe:*:Disabled:crashreporter – (Mozilla Foundation)
"C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" = C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe:*:Enabled:Malwarebytes' Anti-Malware – (Malwarebytes Corporation)
"C:\Program Files\AVG\AVG2012\avgnsx.exe" = C:\Program Files\AVG\AVG2012\avgnsx.exe:*:Enabled:Online Shield – (AVG Technologies CZ, s.r.o.)
"C:\Program Files\AVG\AVG2012\avgdiagex.exe" = C:\Program Files\AVG\AVG2012\avgdiagex.exe:*:Enabled:AVG Diagnostics 2012 – (AVG Technologies CZ, s.r.o.)
"C:\Program Files\AVG\AVG2012\avgemcx.exe" = C:\Program Files\AVG\AVG2012\avgemcx.exe:*:Enabled:Personal E-mail Scanner – (AVG Technologies CZ, s.r.o.)
"C:\Documents and Settings\Owner\Desktop\TDSSKiller.exe" = C:\Documents and Settings\Owner\Desktop\TDSSKiller.exe:*:Disabled:TDSS rootkit removing tool – (Kaspersky Lab ZAO)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{07FB17D8-7DB6-4F06-80C4-8BE1719CB6A1}" = hpWLPGInstaller
"{0F367CA3-3B2F-43F9-A44A-25A8EE69E45D}" = Scan
"{16DABD39-A174-4C6B-A2C4-A492E64933C8}" = AVG 2012
"{175F0111-2968-4935-8F70-33108C6A4DE3}" = MarketResearch
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite
"{21A2F5EE-1DC5-488A-BE7E-E526F8C61488}" = DeviceDiscovery
"{26A24AE4-039D-4CA4-87B4-2F83216016FF}" = Java™ 6 Update 29
"{28379381-B56A-43e1-B505-3098D82B1C30}" = 4500G510gm_Software_Min
"{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}" = RealUpgrade 1.1
"{2CD0168D-FBBC-4667-8810-105CB6EC6348}" = HP Deskjet D1600 Printer Driver Software 13.0 Rel .6
"{2EEA7AA4-C203-4b90-A34F-19FB7EF1C81C}" = BufferChm
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{43CDF946-F5D9-4292-B006-BA0D92013021}" = WebReg
"{440B915A-0C85-45DB-92AE-75AE14704A64}" = Fax
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A70EF07-7F88-4434-BB61-D1DE8AE93DD4}" = SolutionCenter
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{5727583F-3530-45FD-B09E-7E1CB6C135AD}" = DJ_SF_06_D1600_SW_Min
"{63FF21C9-A810-464F-B60A-3111747B1A6D}" = GPBaseService2
"{66B6D13A-9CC1-417D-B6F2-58AA539D1033}" = Nero 7 Essentials
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{68A10D12-0D0F-4212-BDE6-D87FAD32A8FA}" = SmartWebPrinting
"{6B2FFB21-AC88-45C3-9A7D-4BB3E744EC91}" = HPSSupply
"{6BBA26E9-AB03-4FE7-831A-3535584CA002}" = Toolbox
"{6D8D64BE-F500-55B6-705D-DFD08AFE0624}" = Acrobat.com
"{7059BDA7-E1DB-442C-B7A1-6144596720A4}" = HP Update
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}" = RealNetworks - Microsoft Visual C++ 2008 Runtime
"{92127AF5-FDD8-4ADF-BC40-C356C9EE0B7D}" = 32 Bit HP CIO Components Installer
"{92A51949-EE4C-466D-AAF0-99E74A49A63F}" = DocMgr
"{98BD9EA5-2DF2-445C-8C8D-057F55B3C633}" = AVG 2012
"{9B362566-EC1B-4700-BB9C-EC661BDE2175}" = DocProc
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A06275F4-324B-4E85-95E6-87B2CD729401}" = Windows Defender
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{AC76BA86-7AD7-1033-7B44-A91000000001}" = Adobe Reader 9.1
"{AE8705FB-E13C-40A9-8A2D-68D6733FBFC2}" = Status
"{B2455727-ED8F-4643-8A6E-F4AB8DE3633D}" = Network
"{B7A0CE06-068E-11D6-97FD-0050BACBF861}" = PowerProducer
"{BD7204BA-DD64-499E-9B55-6A282CDF4FA4}" = Destinations
"{BE0D4271-69C9-4f28-AD9B-BB33D126A30E}" = 4500G510gm
"{C151CE54-E7EA-4804-854B-F515368B0798}" = Athlon 64 Processor Driver
"{C43326F5-F135-4551-8270-7F7ABA0462E1}" = HPProductAssistant
"{C43421C0-0DCB-4F26-8A3B-BF16155F9879}" = TRENDnet TEW-424UB Wireless USB 2.0 Adapter Driver and Utility
"{C75CDBA2-3C86-481e-BD10-BDDA758F9DFF}" = hpPrintProjects
"{D16A31F9-276D-4968-A753-FFEAC56995D0}" = Epson Print CD
"{DC0A5F99-FD66-433F-9D3A-05DCBA64BE42}" = TrayApp
"{DF0B357C-5874-47D0-81E7-79AA890B0CE0}" = 4500_G510gm_Help
"{E5083D57-D93F-404C-A91F-1C50D67C2BEB}" = HP Officejet 4500 G510g-m
"{E6B87DC4-2B3D-4483-ADFF-E483BF718991}" = OpenOffice.org 3.1
"{EAE8CF06-28CA-4213-839C-A32817A47E00}" = D1600
"{FB08F381-6533-4108-B7DD-039E11FBC27E}" = Realtek AC'97 Audio
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"AVG" = AVG 2012
"AVG Secure Search" = AVG Security Toolbar
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"EPSON Printer and Utilities" = EPSON Printer Software
"HP Document Manager" = HP Document Manager 2.0
"HP Imaging Device Functions" = HP Imaging Device Functions 13.0
"HP Print Projects" = HP Print Projects 1.0
"HP Smart Web Printing" = HP Smart Web Printing 4.5
"HP Solution Center & Imaging Support Tools" = HP Solution Center 13.0
"HPExtendedCapabilities" = HP Customer Participation Program 13.0
"HPOCR" = OCR Software by I.R.I.S. 13.0
"ie8" = Windows Internet Explorer 8
"InstallShield_{C43421C0-0DCB-4F26-8A3B-BF16155F9879}" = TRENDnet TEW-424UB Wireless USB 2.0 Adapter Driver and Utility
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware version 1.51.1.1800
"Mozilla Firefox 7.0.1 (x86 en-US)" = Mozilla Firefox 7.0.1 (x86 en-US)
"NVIDIA Drivers" = NVIDIA Drivers
"Pdf995" = Pdf995
"RealPlayer 12.0" = RealPlayer
"Shop for HP Supplies" = Shop for HP Supplies
"SSC Service Utility_is1" = SSC Service Utility v4.30
"Windows Media Format Runtime" = Windows Media Format Runtime
"Windows XP Service Pack" = Windows XP Service Pack 3
"Yahoo! Companion" = Yahoo! Toolbar

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 11/13/2011 6:56:32 PM | Computer Name = OWNER-0C0798AD2 | Source = Application Hang | ID = 1002
Description = Hanging application soffice.bin, version 3.1.9420.500, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 11/13/2011 9:54:19 PM | Computer Name = OWNER-0C0798AD2 | Source = Application Hang | ID = 1002
Description = Hanging application soffice.bin, version 3.1.9420.500, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 11/15/2011 1:04:26 AM | Computer Name = OWNER-0C0798AD2 | Source = Application Hang | ID = 1002
Description = Hanging application soffice.bin, version 3.1.9420.500, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 11/15/2011 1:04:28 AM | Computer Name = OWNER-0C0798AD2 | Source = Application Hang | ID = 1002
Description = Hanging application soffice.bin, version 3.1.9420.500, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 11/15/2011 1:04:28 AM | Computer Name = OWNER-0C0798AD2 | Source = Application Hang | ID = 1002
Description = Hanging application soffice.bin, version 3.1.9420.500, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 11/15/2011 1:20:47 AM | Computer Name = OWNER-0C0798AD2 | Source = Application Hang | ID = 1002
Description = Hanging application soffice.bin, version 3.1.9420.500, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 11/16/2011 5:56:40 AM | Computer Name = OWNER-0C0798AD2 | Source = Application Hang | ID = 1002
Description = Hanging application soffice.bin, version 3.1.9420.500, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 11/16/2011 11:24:38 PM | Computer Name = OWNER-0C0798AD2 | Source = Application Hang | ID = 1002
Description = Hanging application soffice.bin, version 3.1.9420.500, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 11/16/2011 11:24:40 PM | Computer Name = OWNER-0C0798AD2 | Source = Application Hang | ID = 1002
Description = Hanging application soffice.bin, version 3.1.9420.500, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 11/16/2011 11:26:31 PM | Computer Name = OWNER-0C0798AD2 | Source = Application Hang | ID = 1002
Description = Hanging application explorer.exe, version 6.0.2900.5512, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

[ System Events ]
Error - 11/16/2011 9:58:39 PM | Computer Name = OWNER-0C0798AD2 | Source = Service Control Manager | ID = 7023
Description = The Network Location Awareness (NLA) service terminated with the following
error: %%127

Error - 11/16/2011 9:58:42 PM | Computer Name = OWNER-0C0798AD2 | Source = Service Control Manager | ID = 7023
Description = The Network Location Awareness (NLA) service terminated with the following
error: %%127

Error - 11/16/2011 9:58:56 PM | Computer Name = OWNER-0C0798AD2 | Source = Service Control Manager | ID = 7023
Description = The Network Location Awareness (NLA) service terminated with the following
error: %%127

Error - 11/16/2011 9:59:20 PM | Computer Name = OWNER-0C0798AD2 | Source = Service Control Manager | ID = 7031
Description = The Print Spooler service terminated unexpectedly. It has done this
2 time(s). The following corrective action will be taken in 60000 milliseconds:
Restart the service.

Error - 11/16/2011 10:01:08 PM | Computer Name = OWNER-0C0798AD2 | Source = Service Control Manager | ID = 7034
Description = The Print Spooler service terminated unexpectedly. It has done this
3 time(s).

Error - 11/16/2011 10:07:46 PM | Computer Name = OWNER-0C0798AD2 | Source = Service Control Manager | ID = 7000
Description = The Windows Defender service failed to start due to the following
error: %%2

Error - 11/16/2011 10:07:55 PM | Computer Name = OWNER-0C0798AD2 | Source = sr | ID = 1
Description = The System Restore filter encountered the unexpected error '0xC0000001'
while processing the file '' on the volume 'HarddiskVolume1'. It has stopped monitoring
the volume.

Error - 11/16/2011 10:08:08 PM | Computer Name = OWNER-0C0798AD2 | Source = Service Control Manager | ID = 7031
Description = The Print Spooler service terminated unexpectedly. It has done this
1 time(s). The following corrective action will be taken in 60000 milliseconds:
Restart the service.

Error - 11/16/2011 10:09:29 PM | Computer Name = OWNER-0C0798AD2 | Source = Service Control Manager | ID = 7031
Description = The Print Spooler service terminated unexpectedly. It has done this
2 time(s). The following corrective action will be taken in 60000 milliseconds:
Restart the service.

Error - 11/16/2011 10:10:41 PM | Computer Name = OWNER-0C0798AD2 | Source = Service Control Manager | ID = 7034
Description = The Print Spooler service terminated unexpectedly. It has done this
3 time(s).


< End of report >



****************************

I'll await your reply.

With appreciation,
Post #5
Download ComboFix from one of these locations:

Link 1
Link 2


* IMPORTANT !!! Save ComboFix.exe to your Desktop


  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
  • See this Link for programs that need to be disabled and instruction on how to disable them.
  • Remember to re-enable them when we're done.

  • Double click on ComboFix.exe & follow the prompts.

  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.


[external image: Posted Image]



Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]


Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

*If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.
Post #6
Mowman, Busy last few days. My intuition is telling me that it would be a good idea to run OTL again, as it was last run on: 11/16 (I sent you these results). I now should be able to move ahead - right through your protocol - with no further interruptions, once OTL is completed. I did run TDSS killer a few moments ago. All clear. No infections. As I recall, there was a yellow/black OTL icon on my desktop at the time I ran this program. However, it is currently not appearing. I do have an another OTL icon on the desktop - beginning: ** OTL logfile created on: 11/16/2011 10:36:05 PM - Run 1 OTL by OldTimer - Version 3.2.31.0 Folder = C:\Documents and Settings\Owner\Desktop Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy ** That is a notepad file only, however. To summarize: I wish to run OTL again, but do not know how to do so. Please advise. Thank you. P.S. I have not yet downloaded saved ComboFix.exe to my Desktop
Post #7
Mowman, Just wanted to add a symptom that I did not mention in my initial "contact email" to WTT. When I go to view installed printers - my printer does not show up. Thanks.
Post #9
I'll be happy to do so. My question is - since my anti-virus software has been down and I have needed to be online (prior to, and since running OTL on the 16th) - why do you believe that the system has not been reinfected? I'm not confidant about this, and will await your reply before moving ahead.
Post #11

My question is - since my anti-virus software has been down and I have needed to be online (prior to, and since running OTL on the 16th) - why do you believe that the system has not been reinfected?

It may or may not have,but a Combofix log gives me the same information as OTL but in a different way,and also removes infections.That is why we cannot proceed further without running it.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI