Tdiserv activity 2/zeroaccess rootkit

OTL logfile created on: 12/6/2011 5:38:45 PM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Documents and Settings\Pritikin Guest\Desktop
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

503.37 Mb Total Physical Memory | 250.96 Mb Available Physical Memory | 49.86% Memory free
1.20 Gb Paging File | 0.85 Gb Available in Paging File | 70.68% Paging File free
Paging file location(s): C:\pagefile.sys 756 1512 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 37.17 Gb Total Space | 24.46 Gb Free Space | 65.80% Space Free | Partition Type: NTFS
Drive E: | 14.90 Gb Total Space | 14.84 Gb Free Space | 99.56% Space Free | Partition Type: FAT32

Computer Name: PRIT-LT | User Name: Pritikin Guest | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Pritikin Guest\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Common Files\Java\Java Update\jucheck.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\Norton 360\Engine\5.1.0.29\ccsvchst.exe (Symantec Corporation)
PRC - C:\Program Files\Nikon\Nikon Message Center 2\NkMC2.exe (Nikon Corporation)
PRC - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe (Symantec Corporation)
PRC - C:\Program Files\Dell\QuickSet\quickset.exe ()
PRC - C:\Program Files\Apoint\Apoint.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\Apoint\ApntEx.exe (Alps Electric Co., Ltd.)


========== Modules (No Company Name) ==========

MOD - \\?\globalroot\systemroot\system32\mswsock.dll ()
MOD - \\.\globalroot\systemroot\system32\mswsock.dll ()
MOD - C:\WINDOWS\system32\preflib.dll ()
MOD - C:\WINDOWS\system32\bcm1xsup.dll ()
MOD - C:\Program Files\Dell\QuickSet\quickset.exe ()
MOD - C:\Program Files\Dell\QuickSet\dadkeyb.dll ()
MOD - C:\Program Files\Dell\QuickSet\preflibcl.dll ()


========== Win32 Services (SafeList) ==========

SRV - (NICCONFIGSVC) – File not found
SRV - (Lavasoft Ad-Aware Service) – File not found
SRV - (HidServ) – File not found
SRV - (gusvc) – File not found
SRV - (McComponentHostService) – C:\Program Files\McAfee Security Scan\3.0.229\McCHSvc.exe (McAfee, Inc.)
SRV - (N360) – C:\Program Files\Norton 360\Engine\5.1.0.29\ccSvcHst.exe (Symantec Corporation)
SRV - (ACDaemon) – C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
SRV - (LiveUpdate Notice Service) – C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifSvc.exe (Symantec Corporation)


========== Driver Services (SafeList) ==========

DRV - (SymEvent) – C:\WINDOWS\system32\drivers\SYMEVENT.SYS (Symantec Corporation)
DRV - (NAVEX15) – C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\VirusDefs\20111205.032\NAVEX15.SYS (Symantec Corporation)
DRV - (eeCtrl) – C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys (Symantec Corporation)
DRV - (EraserUtilRebootDrv) – C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation)
DRV - (NAVENG) – C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\VirusDefs\20111205.032\NAVENG.SYS (Symantec Corporation)
DRV - (IDSxpx86) – C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\IPSDefs\20111203.001\IDSXpx86.sys (Symantec Corporation)
DRV - (BHDrvx86) – C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\BASHDefs\20111123.001\BHDrvx86.sys (Symantec Corporation)
DRV - (Lbd) – C:\WINDOWS\system32\DRIVERS\Lbd.sys (Lavasoft AB)
DRV - (Avgtdix) – C:\WINDOWS\system32\drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (SRTSP) – C:\WINDOWS\System32\Drivers\N360\0501000.01D\SRTSP.SYS (Symantec Corporation)
DRV - (SRTSPX) Symantec Real Time Storage Protection (PEL) – C:\WINDOWS\system32\drivers\N360\0501000.01D\SRTSPX.SYS (Symantec Corporation)
DRV - (SYMTDI) – C:\WINDOWS\System32\Drivers\N360\0501000.01D\SYMTDI.SYS (Symantec Corporation)
DRV - (SymEFA) – C:\WINDOWS\system32\drivers\N360\0501000.01D\SYMEFA.SYS (Symantec Corporation)
DRV - (SymDS) – C:\WINDOWS\system32\drivers\N360\0501000.01D\SYMDS.SYS (Symantec Corporation)
DRV - (SymIRON) – C:\WINDOWS\system32\drivers\N360\0501000.01D\Ironx86.SYS (Symantec Corporation)
DRV - (BCM43XX) – C:\WINDOWS\system32\drivers\BCMWL5.SYS (Broadcom Corporation)
DRV - (APPDRV) – C:\WINDOWS\SYSTEM32\DRIVERS\APPDRV.SYS (Dell Inc)
DRV - (STAC97) – C:\WINDOWS\system32\drivers\STAC97.sys (SigmaTel, Inc.)
DRV - (bcm4sbxp) – C:\WINDOWS\system32\drivers\bcm4sbxp.sys (Broadcom Corporation)
DRV - (ApfiltrService) – C:\WINDOWS\system32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)
DRV - (HSFHWICH) – C:\WINDOWS\system32\drivers\HSFHWICH.sys (Conexant Systems, Inc.)
DRV - (winachsf) – C:\WINDOWS\system32\drivers\HSF_CNXT.sys (Conexant Systems, Inc.)
DRV - (HSF_DP) – C:\WINDOWS\system32\drivers\HSF_DP.sys (Conexant Systems, Inc.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Page_URL = http://www.google.com/ig/dell?hl=en
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Start Page = http://www.google.com/ig/dell?hl=en

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig/dell?hl=en
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerm…tf8&oe;=utf8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://webhelper.centurylink.com/index.php…age.com/&r;=
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultthis.engineName: "Elf 1.12 Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2857572&SearchSource;=3&q;={searchTerms}"
FF - prefs.js..browser.search.selectedEngine: "AddThis"
FF - prefs.js..browser.startup.homepage: "http://www.google.com/"
FF - prefs.js..extensions.enabledItems: {3e0e7d2a-070f-4a47-b019-91fe5385ba79}:3.1.0
FF - prefs.js..keyword.URL: "http://isearch.avg.com/search?cid=%7B3fcce00c-e729-4335-bd37-356657f74e42%7D∣=0790a8f4d6e747d1b4ecd15de3dcbc94-61c940c3b78c29b0b68f9b862ada7fb13f624490&ds;=AVG&v;=8.0.0.34.1⟨=en≺=pr&d;=2011-09-16%2023%3A27%3A18&sap;=ku&q;="

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@macromedia.com/FlashPlayer9: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@macromedia.com/FlashPlayer9: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\IPSFFPlgn\ [2011/12/02 08:58:18 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\coFFPlgn_2011_7_3_6 [2011/12/06 17:33:07 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 7.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/10/04 06:18:10 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 7.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/09/18 23:25:42 | 000,000,000 | —D | M]

[2008/08/28 02:32:19 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Pritikin Guest\Application Data\Mozilla\Extensions
[2011/09/16 22:28:03 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Pritikin Guest\Application Data\Mozilla\Firefox\Profiles\262bb5lm.default\extensions
[2011/08/30 08:00:43 | 000,000,000 | —D | M] (AddThis) – C:\Documents and Settings\Pritikin Guest\Application Data\Mozilla\Firefox\Profiles\262bb5lm.default\extensions\{3e0e7d2a-070f-4a47-b019-91fe5385ba79}
[2011/09/16 22:28:03 | 000,000,000 | —D | M] (AVG Security Toolbar) – C:\Documents and Settings\Pritikin Guest\Application Data\Mozilla\Firefox\Profiles\262bb5lm.default\extensions\avg@toolbar
[2010/12/02 08:07:28 | 000,000,919 | —- | M] () – C:\Documents and Settings\Pritikin Guest\Application Data\Mozilla\Firefox\Profiles\262bb5lm.default\searchplugins\conduit.xml
[2011/12/02 11:16:35 | 000,002,463 | —- | M] () – C:\Documents and Settings\Pritikin Guest\Application Data\Mozilla\Firefox\Profiles\262bb5lm.default\searchplugins\safesearch.xml
[2011/11/29 15:07:15 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2011/08/04 20:52:48 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
[2011/09/16 22:38:15 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA}
[2011/12/06 17:33:07 | 000,000,000 | —D | M] (Norton Toolbar) – C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\COFFPLGN_2011_7_3_6
[2011/12/02 08:58:18 | 000,000,000 | —D | M] (Symantec IPS) – C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\IPSFFPLGN
[2011/08/04 20:52:27 | 000,000,000 | —D | M] (Java Quick Starter) – C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2011/10/04 06:18:05 | 000,134,104 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011/07/19 04:05:25 | 000,476,904 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2011/10/04 06:17:42 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml

Hosts file not found
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG2012\avgssie.dll File not found
O2 - BHO: (Reg Error: Value error.) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton 360\Engine\5.1.0.29\coieplg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton 360\Engine\5.1.0.29\ips\ipsbho.dll (Symantec Corporation)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360\Engine\5.1.0.29\coieplg.dll (Symantec Corporation)
O4 - HKLM..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [ArcSoft Connection Service] C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)
O4 - HKLM..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe ()
O4 - HKLM..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k File not found
O4 - HKLM..\Run: [Nikon Message Center 2] C:\Program Files\Nikon\Nikon Message Center 2\NkMC2.exe (Nikon Corporation)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk = File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - mswsock.dll File not found
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_27)
O16 - DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} http://java.sun.com/products/plugin/autodl…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_27)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_27)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1 [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1B66B197-F0F6-49E4-A069-803FA11B37AB}: DhcpNameServer = 192.168.0.1 [removed]
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/08/11 18:15:00 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKCU\…exe [@ = exefile] – Reg Error: Value error. File not found

NetSvcs: 6to4 - File not found
NetSvcs: HidServ - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2011/12/06 17:36:19 | 001,916,416 | —- | C] (AVAST Software) – C:\Documents and Settings\Pritikin Guest\Desktop\aswMBR.exe
[2011/12/06 17:36:16 | 000,584,192 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Pritikin Guest\Desktop\OTL.exe
[2011/11/30 16:30:05 | 001,932,256 | —- | C] (Symantec Corporation) – C:\Documents and Settings\Pritikin Guest\My Documents\FixTDSS.exe
[2011/11/30 15:04:46 | 000,000,000 | —D | C] – C:\WINDOWS\Minidump
[2011/11/29 20:06:43 | 000,331,384 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0501000.01D\symtdiv.sys
[2011/11/29 20:06:42 | 000,369,784 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0501000.01D\symtdi.sys
[2011/11/29 20:06:38 | 000,296,568 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0501000.01D\symnets.sys
[2011/11/29 20:06:35 | 000,744,568 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0501000.01D\symefa.sys
[2011/11/29 20:06:31 | 000,340,088 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0501000.01D\symds.sys
[2011/11/29 20:06:29 | 000,050,168 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0501000.01D\srtspx.sys
[2011/11/29 20:06:27 | 000,516,216 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0501000.01D\srtsp.sys
[2011/11/29 20:06:26 | 000,136,312 | R— | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\N360\0501000.01D\ironx86.sys
[2011/11/29 20:03:47 | 000,000,000 | —D | C] – C:\WINDOWS\System32\drivers\N360\0501000.01D
[2011/11/29 19:52:48 | 000,000,000 | —D | C] – C:\WINDOWS\System32\N360_BACKUP
[2011/11/29 19:19:14 | 000,126,584 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\SYMEVENT.SYS
[2011/11/29 19:19:14 | 000,060,872 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\S32EVNT1.DLL
[2011/11/29 19:19:13 | 000,000,000 | —D | C] – C:\Program Files\Symantec
[2011/11/29 19:17:10 | 000,106,928 | —- | C] (GEAR Software Inc.) – C:\WINDOWS\System32\GEARAspi.dll
[2011/11/29 19:15:24 | 000,000,000 | —D | C] – C:\WINDOWS\System32\drivers\N360
[2011/11/29 19:15:19 | 000,000,000 | —D | C] – C:\Program Files\Windows Sidebar
[2011/11/29 19:15:19 | 000,000,000 | —D | C] – C:\Program Files\Norton 360
[2011/11/29 19:15:19 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Norton 360
[2011/11/29 19:14:44 | 000,000,000 | —D | C] – C:\Program Files\NortonInstaller
[2011/11/29 18:39:17 | 000,200,976 | —- | C] (Trend Micro Inc.) – C:\WINDOWS\System32\drivers\tmcomm.sys
[2011/11/29 18:29:00 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\McAfee Security Scan Plus
[2011/11/29 17:27:29 | 000,000,000 | -H-D | C] – C:\WINDOWS\System32\GroupPolicy
[2011/11/29 17:19:29 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2011/11/29 17:19:27 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Adobe
[2011/11/29 16:54:57 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Sun
[2011/11/29 15:34:46 | 000,000,000 | -HSD | C] – C:\WINDOWS\CSC
[2011/11/09 06:05:26 | 000,000,000 | —D | C] – C:\WINDOWS\System32\cache
[7 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/12/06 17:33:46 | 000,002,206 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2011/12/06 17:32:28 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/12/06 17:32:19 | 527,892,480 | -HS- | M] () – C:\hiberfil.sys
[2011/12/06 13:08:56 | 000,001,324 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2011/12/06 10:53:20 | 000,004,856 | —- | M] () – C:\{E06CFF78-B2E8-404D-A8F4-6319F5B7C20A}
[2011/12/03 00:05:00 | 001,916,416 | —- | M] (AVAST Software) – C:\Documents and Settings\Pritikin Guest\Desktop\aswMBR.exe
[2011/12/01 22:52:48 | 000,584,192 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Pritikin Guest\Desktop\OTL.exe
[2011/11/30 16:45:34 | 001,932,256 | —- | M] (Symantec Corporation) – C:\Documents and Settings\Pritikin Guest\My Documents\FixTDSS.exe
[2011/11/30 16:27:58 | 000,382,260 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2011/11/30 16:27:58 | 000,053,838 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2011/11/30 16:12:01 | 000,000,211 | RHS- | M] () – C:\boot.ini
[2011/11/30 08:34:24 | 000,001,900 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Norton 360.LNK
[2011/11/30 08:33:47 | 001,097,616 | —- | M] () – C:\WINDOWS\System32\drivers\N360\0501000.01D\Cat.DB
[2011/11/29 20:09:27 | 000,016,354 | -HS- | M] () – C:\Documents and Settings\All Users\Application Data\471683k1k612j866r557p5vjp0e0
[2011/11/29 20:09:26 | 000,016,354 | -HS- | M] () – C:\Documents and Settings\Pritikin Guest\Local Settings\Application Data\471683k1k612j866r557p5vjp0e0
[2011/11/29 20:08:41 | 000,126,584 | —- | M] (Symantec Corporation) – C:\WINDOWS\System32\drivers\SYMEVENT.SYS
[2011/11/29 20:08:41 | 000,060,872 | —- | M] (Symantec Corporation) – C:\WINDOWS\System32\S32EVNT1.DLL
[2011/11/29 20:08:41 | 000,007,468 | —- | M] () – C:\WINDOWS\System32\drivers\SYMEVENT.CAT
[2011/11/29 20:08:41 | 000,000,806 | —- | M] () – C:\WINDOWS\System32\drivers\SYMEVENT.INF
[2011/11/29 18:29:00 | 000,001,807 | —- | M] () – C:\Documents and Settings\All Users\Desktop\McAfee Security Scan Plus.lnk
[2011/11/29 17:13:44 | 000,414,368 | —- | M] (Adobe Systems Incorporated) – C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2011/11/29 16:35:19 | 000,000,486 | —- | M] () – C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2011/11/29 04:05:45 | 000,024,576 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\userinit.exe
[2011/11/29 04:05:29 | 000,000,064 | —- | M] () – C:\WINDOWS\System32\rp_stats.dat
[2011/11/29 04:05:29 | 000,000,044 | —- | M] () – C:\WINDOWS\System32\rp_rules.dat
[7 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/12/06 10:53:20 | 000,004,856 | —- | C] () – C:\{E06CFF78-B2E8-404D-A8F4-6319F5B7C20A}
[2011/12/01 13:38:40 | 527,892,480 | -HS- | C] () – C:\hiberfil.sys
[2011/11/30 08:33:06 | 001,097,616 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0501000.01D\Cat.DB
[2011/11/29 20:06:40 | 000,007,877 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0501000.01D\symnetv.cat
[2011/11/29 20:06:40 | 000,001,474 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0501000.01D\symnetv.inf
[2011/11/29 20:06:37 | 000,007,458 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0501000.01D\symnet.cat
[2011/11/29 20:06:37 | 000,001,446 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0501000.01D\symnet.inf
[2011/11/29 20:06:33 | 000,003,373 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0501000.01D\symefa.inf
[2011/11/29 20:06:32 | 000,007,456 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0501000.01D\symefa.cat
[2011/11/29 20:06:30 | 000,002,792 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0501000.01D\symds.inf
[2011/11/29 20:06:28 | 000,007,454 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0501000.01D\srtspx.cat
[2011/11/29 20:06:28 | 000,001,389 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0501000.01D\srtspx.inf
[2011/11/29 20:06:27 | 000,001,383 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0501000.01D\srtsp.inf
[2011/11/29 20:06:26 | 000,007,528 | R— | C] () – C:\WINDOWS\System32\drivers\N360\0501000.01D\iron.cat
[2011/11/29 20:06:26 | 000,007,450 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0501000.01D\srtsp.cat
[2011/11/29 20:06:26 | 000,000,742 | R— | C] () – C:\WINDOWS\System32\drivers\N360\0501000.01D\iron.inf
[2011/11/29 20:03:53 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0501000.01D\symds.cat
[2011/11/29 20:03:47 | 000,000,172 | —- | C] () – C:\WINDOWS\System32\drivers\N360\0501000.01D\isolate.ini
[2011/11/29 19:19:14 | 000,007,468 | —- | C] () – C:\WINDOWS\System32\drivers\SYMEVENT.CAT
[2011/11/29 19:19:14 | 000,000,806 | —- | C] () – C:\WINDOWS\System32\drivers\SYMEVENT.INF
[2011/11/29 19:18:19 | 000,001,900 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Norton 360.LNK
[2011/11/29 18:27:33 | 000,001,611 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
[2011/11/29 17:32:02 | 000,001,324 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2011/11/29 03:18:34 | 000,016,354 | -HS- | C] () – C:\Documents and Settings\Pritikin Guest\Local Settings\Application Data\471683k1k612j866r557p5vjp0e0
[2011/11/29 03:18:34 | 000,016,354 | -HS- | C] () – C:\Documents and Settings\All Users\Application Data\471683k1k612j866r557p5vjp0e0
[2011/09/23 08:33:22 | 000,000,064 | —- | C] () – C:\WINDOWS\System32\rp_stats.dat
[2011/09/23 08:33:22 | 000,000,044 | —- | C] () – C:\WINDOWS\System32\rp_rules.dat
[2011/07/31 03:09:16 | 000,000,000 | —- | C] () – C:\WINDOWS\ViewNX2.INI
[2011/07/31 02:44:36 | 000,000,268 | RH– | C] () – C:\Documents and Settings\All Users\Application Data\Treble Reduction
[2011/07/31 02:44:36 | 000,000,268 | RH– | C] () – C:\Documents and Settings\All Users\Application Data\Transportation
[2011/07/31 02:44:36 | 000,000,268 | RH– | C] () – C:\Documents and Settings\All Users\Application Data\Trance Pad
[2011/07/31 02:44:36 | 000,000,268 | RH– | C] () – C:\Documents and Settings\Pritikin Guest\Application Data\Themes
[2011/07/31 02:44:36 | 000,000,268 | RH– | C] () – C:\Documents and Settings\Pritikin Guest\Application Data\Textures
[2011/07/31 02:44:36 | 000,000,268 | RH– | C] () – C:\Documents and Settings\Pritikin Guest\Application Data\Templates
[2011/07/31 02:44:36 | 000,000,020 | -H– | C] () – C:\Documents and Settings\All Users\Application Data\PKP_DLev.DAT
[2011/07/31 02:44:36 | 000,000,020 | -H– | C] () – C:\Documents and Settings\All Users\Application Data\PKP_DLet.DAT
[2011/07/31 02:44:36 | 000,000,020 | -H– | C] () – C:\Documents and Settings\All Users\Application Data\PKP_DLes.DAT
[2011/07/31 02:44:36 | 000,000,012 | RH– | C] () – C:\Documents and Settings\All Users\Application Data\Work - Home
[2011/07/31 02:44:36 | 000,000,012 | RH– | C] () – C:\Documents and Settings\All Users\Application Data\Woodwind
[2011/07/31 02:44:36 | 000,000,012 | RH– | C] () – C:\Documents and Settings\All Users\Application Data\WebServer
[2007/12/24 12:10:17 | 000,086,016 | —- | C] () – C:\WINDOWS\System32\preflib.dll
[2007/12/24 12:10:11 | 000,757,760 | —- | C] () – C:\WINDOWS\System32\bcm1xsup.dll
[2006/12/17 04:44:12 | 000,001,168 | —- | C] () – C:\WINDOWS\mozver.dat
[2006/11/21 12:25:10 | 000,000,000 | —- | C] () – C:\WINDOWS\nsreg.dat
[2006/02/03 11:06:53 | 000,000,737 | —- | C] () – C:\WINDOWS\ODBC.INI
[2005/12/27 20:49:43 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2005/12/27 20:46:33 | 000,192,512 | —- | C] () – C:\WINDOWS\System32\AegisI5.exe
[2005/12/27 20:46:33 | 000,020,480 | —- | C] () – C:\WINDOWS\System32\WLTRYSVC.EXE
[2005/12/27 20:46:26 | 000,000,004 | -H– | C] () – C:\Documents and Settings\All Users\Application Data\QSLLPSVCShare
[2005/12/27 20:28:56 | 000,192,512 | —- | C] () – C:\WINDOWS\System32\stac97co.dll
[2005/12/27 20:28:40 | 000,049,152 | —- | C] () – C:\WINDOWS\setpwrcg.exe
[2005/12/27 20:28:22 | 000,000,390 | —- | C] () – C:\WINDOWS\System32\OEMINFO.INI
[2004/08/11 18:24:19 | 000,000,791 | —- | C] () – C:\WINDOWS\orun32.ini
[2004/08/11 18:19:30 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2004/08/11 18:12:14 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2004/08/11 18:11:31 | 000,001,793 | —- | C] () – C:\WINDOWS\System32\fxsperf.ini
[2004/08/11 18:07:24 | 000,004,346 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2004/08/11 18:06:43 | 000,117,360 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2004/08/11 18:00:30 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2004/08/11 18:00:28 | 000,382,260 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[2004/08/11 18:00:28 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[2004/08/11 18:00:28 | 000,053,838 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[2004/08/11 18:00:28 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[2004/08/11 18:00:27 | 000,004,627 | —- | C] () – C:\WINDOWS\System32\oembios.dat
[2004/08/11 18:00:26 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\oembios.bin
[2004/08/11 18:00:24 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat
[2004/08/11 18:00:19 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[2004/08/11 18:00:19 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\mib.bin
[2004/08/11 18:00:12 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[2004/08/11 18:00:04 | 000,001,788 | —- | C] () – C:\WINDOWS\System32\Dcache.bin
[2003/01/07 15:05:08 | 000,002,695 | —- | C] () – C:\WINDOWS\System32\OUTLPERF.INI
[1997/07/11 00:00:00 | 000,061,440 | —- | C] () – C:\WINDOWS\System32\WRKGADM.EXE
[1997/07/11 00:00:00 | 000,045,056 | —- | C] () – C:\WINDOWS\System32\XLREC.DLL
[1997/07/11 00:00:00 | 000,040,960 | —- | C] () – C:\WINDOWS\System32\RECNCL.DLL
[1997/07/11 00:00:00 | 000,036,864 | —- | C] () – C:\WINDOWS\System32\ODBCSTF.DLL
[1997/07/11 00:00:00 | 000,036,864 | —- | C] () – C:\WINDOWS\System32\DOCOBJ.DLL
[1997/07/11 00:00:00 | 000,032,768 | —- | C] () – C:\WINDOWS\System32\HLINKPRX.DLL

========== LOP Check ==========

[2011/09/16 22:26:23 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\Common Files
[2011/07/31 02:44:36 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\EnterNHelp
[2011/11/29 17:40:46 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\MFAData
[2011/07/31 12:19:47 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Nikon
[2011/07/31 02:44:36 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Ultima_T15
[2011/09/16 22:27:20 | 000,000,000 | —D | M] – C:\Documents and Settings\Pritikin Guest\Application Data\AVG Secure Search
[2011/10/08 19:03:22 | 000,000,000 | —D | M] – C:\Documents and Settings\Pritikin Guest\Application Data\eBookPro6
[2011/07/31 03:01:00 | 000,000,000 | —D | M] – C:\Documents and Settings\Pritikin Guest\Application Data\Nikon
[2011/11/29 16:35:19 | 000,000,486 | —- | M] () – C:\WINDOWS\Tasks\Ad-Aware Update (Weekly).job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2004/08/11 18:15:00 | 000,000,000 | —- | M] () – C:\AUTOEXEC.BAT
[2011/11/30 16:12:01 | 000,000,211 | RHS- | M] () – C:\boot.ini
[2004/08/11 18:15:00 | 000,000,000 | —- | M] () – C:\CONFIG.SYS
[2005/12/27 20:29:00 | 000,003,882 | RH– | M] () – C:\dell.sdr
[2011/11/26 20:16:57 | 000,000,182 | —- | M] () – C:\drwtsn32.log
[2007/04/19 18:24:14 | 000,005,174 | -H– | M] () – C:\ffastun.ffa
[2007/04/19 18:24:14 | 000,270,336 | -H– | M] () – C:\ffastun.ffl
[2007/04/19 18:24:14 | 000,389,120 | -H– | M] () – C:\ffastun.ffo
[2007/04/19 18:24:14 | 000,634,880 | -H– | M] () – C:\ffastun0.ffx
[2011/12/06 17:32:19 | 527,892,480 | -HS- | M] () – C:\hiberfil.sys
[2006/02/04 20:28:46 | 000,004,128 | —- | M] () – C:\INFCACHE.1
[2004/08/11 18:15:00 | 000,000,000 | -H– | M] () – C:\IO.SYS
[2004/08/11 18:15:00 | 000,000,000 | -H– | M] () – C:\MSDOS.SYS
[2004/08/04 06:00:00 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2004/08/04 06:00:00 | 000,250,032 | RHS- | M] () – C:\ntldr
[2011/12/06 17:32:17 | 792,723,456 | -HS- | M] () – C:\pagefile.sys
[2011/12/06 10:53:20 | 000,004,856 | —- | M] () – C:\{E06CFF78-B2E8-404D-A8F4-6319F5B7C20A}

< %systemroot%\Fonts\*.com >

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2004/08/11 18:14:22 | 000,000,067 | -HS- | M] () – C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2003/06/18 17:31:48 | 000,018,944 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\mdippr.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >
[1997/07/11 00:00:00 | 000,000,002 | —- | M] () – C:\Documents and Settings\Pritikin Guest\Application Data\Microsoft\ArtGalry.cag

< %PROGRAMFILES%\*.* >

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2004/08/11 18:06:14 | 000,094,208 | —- | M] () – C:\WINDOWS\System32\config\default.sav
[2004/08/11 18:06:14 | 000,659,456 | —- | M] () – C:\WINDOWS\System32\config\software.sav
[2004/08/11 18:06:14 | 000,876,544 | —- | M] () – C:\WINDOWS\System32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lîk /x >
[2004/08/11 18:15:06 | 000,000,294 | -HS- | M] () – C:\Documents and Settings\All Users\Start Menu\desktop.ini
[2011/09/18 19:30:16 | 000,002,433 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\New Office Document.lnk
[2011/07/31 02:23:02 | 000,002,443 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Open Office Document.lnk
[2004/08/11 18:15:06 | 000,001,511 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Set Program Access and Defaults.lnk
[2004/08/11 18:15:06 | 000,000,398 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Windows Catalog.lnk
[2004/08/11 18:15:06 | 000,001,411 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Windows Update.lnk

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Mikzosoft\Internet Explorer\Quick Launch\*.lnk /x >

< %USERPROFILE%\Deskuop\*.exe >

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results Install|LastSuccessTime /rs >

< %USERPROFILE%\..|smtmp;true;true;true /FP >

< %temp%\smtmp\*.* /s > >


< MD5 for: EXPLORER.EX_ >
[2004/08/04 06:00:00 | 000,359,533 | —- | M] () MD5=4F061B12F3D5457315A0314954E7EF46 – C:\i386\EXPLORER.EX_

< MD5 for: EXPLORER.EXE >
[2008/04/13 19:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 – C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\explorer.exe
[2007/06/13 06:26:03 | 001,033,216 | —- | M] (Microsoft Corporation) MD5=7712DF0CDDE3A5AC89843E61CD5B3658 – C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
[2007/06/13 05:23:07 | 001,033,216 | —- | M] (Microsoft Corporation) MD5=97BD6515465659FF8F3B7BE375B2EA87 – C:\WINDOWS\explorer.exe
[2007/06/13 05:23:07 | 001,033,216 | —- | M] (Microsoft Corporation) MD5=97BD6515465659FF8F3B7BE375B2EA87 – C:\WINDOWS\system32\dllcache\explorer.exe
[2004/08/04 06:00:00 | 001,032,192 | —- | M] (Microsoft Corporation) MD5=A0732187050030AE399B241436565E64 – C:\WINDOWS\$NtUninstallKB938828$\explorer.exe

< MD5 for: EXPLORER.SC_ >
[2004/08/04 06:00:00 | 000,000,181 | —- | M] () MD5=BC5B38879C56DFBC05C8B5C43AC4D739 – C:\i386\EXPLORER.SC_

< MD5 for: EXPLORER.SCF >
[2004/08/04 06:00:00 | 000,000,080 | —- | M] () MD5=A3975A7D2C98B30A2AE010754FFB9392 – C:\WINDOWS\explorer.scf

< MD5 for: IEXPLORE.CHM >
[2009/02/21 00:21:24 | 000,529,818 | —- | M] () MD5=1435F4731719DF5F57D17DC38196245D – C:\WINDOWS\Help\iexplore.chm
[2004/08/04 06:00:00 | 000,204,810 | —- | M] () MD5=60858526AAD1CC55F5F0055B8E3B66FE – C:\i386\iexplore.chm
[2004/08/04 06:00:00 | 000,204,810 | —- | M] () MD5=60858526AAD1CC55F5F0055B8E3B66FE – C:\WINDOWS\ie7\iexplore.chm
[2006/09/01 07:43:50 | 000,503,758 | —- | M] () MD5=652E46500C149D1DC948BF9CEA8C4933 – C:\WINDOWS\ie8\iexplore.chm

< MD5 for: IEXPLORE.EX_ >
[2004/08/04 06:00:00 | 000,037,895 | —- | M] () MD5=F83009589844F0C30801CC2221F06AB9 – C:\i386\IEXPLORE.EX_

< MD5 for: IEXPLORE.EXE >
[2008/04/22 03:02:46 | 000,625,664 | —- | M] (Microsoft Corporation) MD5=197B7E4030CFBD8D2979D375E1787AA2 – C:\WINDOWS\$hf_mig$\KB950759-IE7\SP2QFE\iexplore.exe
[2008/08/23 00:56:15 | 000,635,848 | —- | M] (Microsoft Corporation) MD5=1F03216084447F990AE797317D0A6E70 – C:\WINDOWS\ie7updates\KB974455-IE7\iexplore.exe
[2008/04/22 02:40:18 | 000,625,664 | —- | M] (Microsoft Corporation) MD5=232B22817B90AE0AFF2D189E3E3735AC – C:\WINDOWS\ie7updates\KB953838-IE7\iexplore.exe
[2007/12/06 06:01:25 | 000,625,664 | —- | M] (Microsoft Corporation) MD5=2703D940A62B731AA220529DD7331A78 – C:\WINDOWS\ie7updates\KB947864-IE7\iexplore.exe
[2007/06/27 03:27:30 | 000,625,152 | —- | M] (Microsoft Corporation) MD5=275CEE268B9E5D82474C43D5D249D111 – C:\WINDOWS\ie7updates\KB939653-IE7\iexplore.exe
[2008/02/29 03:55:46 | 000,625,664 | —- | M] (Microsoft Corporation) MD5=2D0E5592AB5A46C27DAF7CCAFF4F5B59 – C:\WINDOWS\ie7updates\KB950759-IE7\iexplore.exe
[2009/08/27 00:18:42 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=332EC7562F3AA7364F2D4231C56DA986 – C:\WINDOWS\$hf_mig$\KB974455-IE7\SP3QFE\iexplore.exe
[2007/08/17 05:21:21 | 000,625,152 | —- | M] (Microsoft Corporation) MD5=3AC2BC667DA0AF2C968E96E1630F5AB5 – C:\WINDOWS\ie7updates\KB942615-IE7\iexplore.exe
[2009/10/28 01:54:16 | 000,634,632 | —- | M] (Microsoft Corporation) MD5=4F9B04D546C23A295F3F0AE015BE51DB – C:\WINDOWS\ie7updates\KB982381-IE7\iexplore.exe
[2006/10/17 12:04:40 | 000,622,080 | —- | M] (Microsoft Corporation) MD5=5334D4461AA92A7B008755FE6D13C5F2 – C:\WINDOWS\ie7updates\KB928090-IE7\iexplore.exe
[2007/08/17 05:12:49 | 000,625,152 | —- | M] (Microsoft Corporation) MD5=5577D0E3AC2F9F035ACD81B44AF5F511 – C:\WINDOWS\$hf_mig$\KB939653-IE7\SP2QFE\iexplore.exe
[2008/04/13 19:12:22 | 000,093,184 | —- | M] (Microsoft Corporation) MD5=55794B97A7FAABD2910873C85274F409 – C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\iexplore.exe
[2007/10/10 03:16:56 | 000,625,664 | —- | M] (Microsoft Corporation) MD5=632BDE0179847234433CA50945442ACB – C:\WINDOWS\$hf_mig$\KB942615-IE7\SP2QFE\iexplore.exe
[2008/06/23 04:20:52 | 000,625,664 | —- | M] (Microsoft Corporation) MD5=64E376A47763DAEABCDA14BD5B6EA286 – C:\WINDOWS\ie7updates\KB956390-IE7\iexplore.exe
[2008/02/22 04:40:22 | 000,625,664 | —- | M] (Microsoft Corporation) MD5=6E0888626E0CAC79F57149814E22DB4D – C:\WINDOWS\$hf_mig$\KB947864-IE7\SP2QFE\iexplore.exe
[2009/10/28 01:54:21 | 000,634,632 | —- | M] (Microsoft Corporation) MD5=80675329E0FD54F016C4F8A83C616349 – C:\WINDOWS\$hf_mig$\KB976325-IE7\SP3QFE\iexplore.exe
[2007/12/06 03:34:45 | 000,625,664 | —- | M] (Microsoft Corporation) MD5=809D17D8FA0FDAEE07778CD821CAFFDE – C:\WINDOWS\$hf_mig$\KB944533-IE7\SP2QFE\iexplore.exe
[2007/01/08 18:08:42 | 000,623,616 | —- | M] (Microsoft Corporation) MD5=93A6A4F5293AE19E3B37021AABCF0902 – C:\WINDOWS\ie7updates\KB937143-IE7\iexplore.exe
[2010/04/16 06:08:29 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=B24A4E23A2FEDB6976EB04D334AD82B2 – C:\WINDOWS\$hf_mig$\KB982381-IE7\SP3QFE\iexplore.exe
[2009/03/08 13:09:26 | 000,638,816 | —- | M] (Microsoft Corporation) MD5=B60DDDD2D63CE41CB8C487FCFBB6419E – C:\Program Files\Internet Explorer\iexplore.exe
[2009/03/08 13:09:26 | 000,638,816 | —- | M] (Microsoft Corporation) MD5=B60DDDD2D63CE41CB8C487FCFBB6419E – C:\WINDOWS\system32\dllcache\iexplore.exe
[2007/06/27 04:16:52 | 000,625,152 | —- | M] (Microsoft Corporation) MD5=BD8502DFD53FC24FB8D6929DC46B8C2C – C:\WINDOWS\$hf_mig$\KB937143-IE7\SP2QFE\iexplore.exe
[2010/04/16 06:43:25 | 000,634,656 | —- | M] (Microsoft Corporation) MD5=C4BA5E36FB57F547117305BF1E0FE454 – C:\WINDOWS\ie8\iexplore.exe
[2008/06/23 03:23:52 | 000,625,664 | —- | M] (Microsoft Corporation) MD5=C52A9EF571E91535EB78DB4B8B95EA07 – C:\WINDOWS\$hf_mig$\KB953838-IE7\SP2QFE\iexplore.exe
[2004/08/04 06:00:00 | 000,093,184 | —- | M] (Microsoft Corporation) MD5=E7484514C0464642BE7B4DC2689354C8 – C:\WINDOWS\ie7\iexplore.exe
[2008/08/23 00:56:16 | 000,635,848 | —- | M] (Microsoft Corporation) MD5=E8305C30D35E85D6657ED3E9934CB302 – C:\WINDOWS\$hf_mig$\KB956390-IE7\SP2QFE\iexplore.exe
[2007/10/10 05:59:52 | 000,625,152 | —- | M] (Microsoft Corporation) MD5=E854D02E4231F704D9BE782A424E6D8B – C:\WINDOWS\ie7updates\KB944533-IE7\iexplore.exe
[2009/08/27 00:18:44 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=F232BA9F39BC0F722672C7E79E68EBEA – C:\WINDOWS\ie7updates\KB976325-IE7\iexplore.exe

< MD5 for: IEXPLORE.EXE.MUI >
[2009/03/08 13:21:44 | 000,012,288 | —- | M] (Microsoft Corporation) MD5=943030B55FDB56FB8B8FCC086071E119 – C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui
[2009/03/08 13:21:44 | 000,012,288 | —- | M] (Microsoft Corporation) MD5=943030B55FDB56FB8B8FCC086071E119 – C:\Program Files\Internet Explorer\iexplore.exe.mui
[2006/10/17 12:04:26 | 000,573,440 | —- | M] (Microsoft Corporation) MD5=E83C9C1F9DD9D47BB44871BFC7E69DDD – C:\WINDOWS\ie8\iexplore.exe.mui

< MD5 for: IEXPLORE.EXE-2D97EBE6.PF >
[2011/12/06 17:36:50 | 000,136,334 | —- | M] () MD5=EFD5F3682F7BE878AD13EA648892832D – C:\WINDOWS\Prefetch\IEXPLORE.EXE-2D97EBE6.pf

< MD5 for: IEXPLORE.HLP >
[2004/08/04 06:00:00 | 000,180,335 | —- | M] () MD5=3F19AF1B745140DAFAC6F78F561A3C62 – C:\i386\iexplore.hlp
[2004/08/04 06:00:00 | 000,180,335 | —- | M] () MD5=3F19AF1B745140DAFAC6F78F561A3C62 – C:\WINDOWS\Help\iexplore.hlp

< MD5 for: WINLOGON.EXE >
[2004/08/04 06:00:00 | 000,502,272 | —- | M] (Microsoft Corporation) MD5=01C3346C241652F43AED8E2149881BFE – C:\i386\winlogon.exe
[2004/08/04 06:00:00 | 000,502,272 | —- | M] (Microsoft Corporation) MD5=01C3346C241652F43AED8E2149881BFE – C:\WINDOWS\system32\winlogon.exe
[2008/04/13 19:12:39 | 000,507,904 | —- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E – C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\winlogon.exe

< >

========== Hard Links - Junction Points - Mount Points - Symbolic Links ==========
[C:\WINDOWS\$NtUninstallKB4961$] -> Error: Cannot create file handle -> Unknown point type

< End of report >

I can add these files from my place.
I kept getting a conection error at my clients place.

OTL Extras logfile created on: 12/6/2011 5:38:45 PM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Documents and Settings\Pritikin Guest\Desktop
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

503.37 Mb Total Physical Memory | 250.96 Mb Available Physical Memory | 49.86% Memory free
1.20 Gb Paging File | 0.85 Gb Available in Paging File | 70.68% Paging File free
Paging file location(s): C:\pagefile.sys 756 1512 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 37.17 Gb Total Space | 24.46 Gb Free Space | 65.80% Space Free | Partition Type: NTFS
Drive E: | 14.90 Gb Total Space | 14.84 Gb Free Space | 99.56% Space Free | Partition Type: FAT32

Computer Name: PRIT-LT | User Name: Pritikin Guest | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.exe [@ = exefile] – Reg Error: Value error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] – "%1" %*
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 1
"FirewallDisableNotify" = 1
"UpdatesDisableNotify" = 1
"AntiVirusOverride" = 1
"FirewallOverride" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\AVG\AVG2012\avgnsx.exe" = C:\Program Files\AVG\AVG2012\avgnsx.exe:*:Disabled:Online Shield


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F528948-0E80-4C96-B455-DE4167CB1DF7}" = Internal Network Card Power Management
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{26A24AE4-039D-4CA4-87B4-2F83216026FF}" = Java™ 6 Update 27
"{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}" = QuickTime
"{3248F0A8-6813-11D6-A77B-00B0D0150060}" = J2SE Runtime Environment 5.0 Update 6
"{3248F0A8-6813-11D6-A77B-00B0D0150100}" = J2SE Runtime Environment 5.0 Update 10
"{3248F0A8-6813-11D6-A77B-00B0D0150110}" = J2SE Runtime Environment 5.0 Update 11
"{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java™ 6 Update 3
"{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java™ 6 Update 5
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{385DD1DD-65AA-408D-8E70-74601C2DB7E6}" = Ad-Aware
"{3F92ABBB-6BBF-11D5-B229-002078017FBF}" = NetWaiting
"{46C045BF-2B3F-4BC4-8E4C-00E0CF8BD9DB}" = Adobe AIR
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{553255F3-78FD-40F1-A6F8-6882140265FE}" = Apple Application Support
"{64A77F14-0E08-4A97-A859-E93CFF428756}" = Broadcom Management Programs 2
"{7148F0A8-6813-11D6-A77B-00B0D0142030}" = Java 2 Runtime Environment, SE v1.4.2_03
"{7F142D56-3326-11D5-B229-002078017FBF}" = Modem Helper
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{87441A59-5E64-4096-A170-14EFE67200C3}" = Picture Control Utility
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel® Graphics Media Accelerator Driver for Mobile
"{90E00409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Outlook 2003
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = ALPS Touch Pad Driver
"{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.1)
"{B014EE44-9197-4513-9613-71E6EB1B514E}" = Nikon Message Center 2
"{C5074CC4-0E26-4716-A307-960272A90040}" = QuickSet
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{D1E7142C-6BC3-49EB-A71A-E5D7ADAC7599}" = Nikon File Uploader 2
"{DBA4DB9D-EE51-4944-A419-98AB1F1249C8}" = LiveUpdate Notice (Symantec Corporation)
"{DDD62492-32A7-412B-8AF1-2CF032AD42E3}" = ViewNX 2
"{E646DCF0-5A68-11D5-B229-002078017FBF}" = Digital Line Detect
"{F18046C5-1C4E-4BE1-A3D6-A6F970E2E8E8}" = ArcSoft Panorama Maker 5
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Broadcom 802.11b Network Adapter" = Dell Wireless WLAN Card
"CNXT_MODEM_PCI_VEN_8086&DEV_24x6&SUBSYS_542214F1" = Conexant D110 MDC V.9x Modem
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"InstallShield_{64A77F14-0E08-4A97-A859-E93CFF428756}" = Broadcom Management Programs 2
"McAfee Security Scan" = McAfee Security Scan Plus
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Mozilla Firefox 7.0.1 (x86 en-US)" = Mozilla Firefox 7.0.1 (x86 en-US)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"N360" = Norton 360
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"Office8.0" = Microsoft Office 97, Professional Edition
"Spybot - Search & Destroy_is1" = Spybot - Search & Destroy 1.4
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 12/2/2011 11:39:11 AM | Computer Name = PRIT-LT | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: The specified server cannot perform the requested operation.

Error - 12/2/2011 11:39:11 AM | Computer Name = PRIT-LT | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: The specified server cannot perform the requested operation.

Error - 12/2/2011 11:39:11 AM | Computer Name = PRIT-LT | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: The specified server cannot perform the requested operation.

Error - 12/2/2011 11:39:11 AM | Computer Name = PRIT-LT | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: The specified server cannot perform the requested operation.

Error - 12/2/2011 11:54:22 AM | Computer Name = PRIT-LT | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This operation returned because the timeout period expired.

Error - 12/2/2011 11:54:22 AM | Computer Name = PRIT-LT | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: The specified server cannot perform the requested operation.

Error - 12/2/2011 11:54:40 AM | Computer Name = PRIT-LT | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This network connection does not exist.

Error - 12/2/2011 11:54:40 AM | Computer Name = PRIT-LT | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This network connection does not exist.

Error - 12/6/2011 10:06:48 AM | Computer Name = PRIT-LT | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This operation returned because the timeout period expired.

Error - 12/6/2011 10:06:48 AM | Computer Name = PRIT-LT | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: The specified server cannot perform the requested operation.

[ Application Events ]
Error - 12/2/2011 11:39:11 AM | Computer Name = PRIT-LT | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: The specified server cannot perform the requested operation.

Error - 12/2/2011 11:39:11 AM | Computer Name = PRIT-LT | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: The specified server cannot perform the requested operation.

Error - 12/2/2011 11:39:11 AM | Computer Name = PRIT-LT | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: The specified server cannot perform the requested operation.

Error - 12/2/2011 11:39:11 AM | Computer Name = PRIT-LT | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: The specified server cannot perform the requested operation.

Error - 12/2/2011 11:54:22 AM | Computer Name = PRIT-LT | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This operation returned because the timeout period expired.

Error - 12/2/2011 11:54:22 AM | Computer Name = PRIT-LT | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: The specified server cannot perform the requested operation.

Error - 12/2/2011 11:54:40 AM | Computer Name = PRIT-LT | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This network connection does not exist.

Error - 12/2/2011 11:54:40 AM | Computer Name = PRIT-LT | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This network connection does not exist.

Error - 12/6/2011 10:06:48 AM | Computer Name = PRIT-LT | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This operation returned because the timeout period expired.

Error - 12/6/2011 10:06:48 AM | Computer Name = PRIT-LT | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: The specified server cannot perform the requested operation.

[ System Events ]
Error - 12/6/2011 6:33:44 PM | Computer Name = PRIT-LT | Source = Service Control Manager | ID = 7023
Description = The Network Location Awareness (NLA) service terminated with the following
error: %%127

Error - 12/6/2011 6:33:44 PM | Computer Name = PRIT-LT | Source = Service Control Manager | ID = 7023
Description = The Network Location Awareness (NLA) service terminated with the following
error: %%127

Error - 12/6/2011 6:33:44 PM | Computer Name = PRIT-LT | Source = Service Control Manager | ID = 7023
Description = The Network Location Awareness (NLA) service terminated with the following
error: %%127

Error - 12/6/2011 6:34:39 PM | Computer Name = PRIT-LT | Source = Service Control Manager | ID = 7023
Description = The Network Location Awareness (NLA) service terminated with the following
error: %%127

Error - 12/6/2011 6:35:48 PM | Computer Name = PRIT-LT | Source = Service Control Manager | ID = 7023
Description = The Network Location Awareness (NLA) service terminated with the following
error: %%127

Error - 12/6/2011 6:37:42 PM | Computer Name = PRIT-LT | Source = Service Control Manager | ID = 7023
Description = The Network Location Awareness (NLA) service terminated with the following
error: %%127

Error - 12/6/2011 6:37:58 PM | Computer Name = PRIT-LT | Source = Service Control Manager | ID = 7023
Description = The Network Location Awareness (NLA) service terminated with the following
error: %%127

Error - 12/6/2011 6:42:45 PM | Computer Name = PRIT-LT | Source = Service Control Manager | ID = 7023
Description = The Network Location Awareness (NLA) service terminated with the following
error: %%127

Error - 12/6/2011 6:44:33 PM | Computer Name = PRIT-LT | Source = Service Control Manager | ID = 7023
Description = The Network Location Awareness (NLA) service terminated with the following
error: %%127

Error - 12/6/2011 7:05:56 PM | Computer Name = PRIT-LT | Source = Service Control Manager | ID = 7023
Description = The Network Location Awareness (NLA) service terminated with the following
error: %%127


< End of report >

Hello stevenmcs

First,

Please read through these instructions to familarize yourself with what to expect when this tool runs

Please download ComboFix from one of the following locations:

• LINK 1
• LINK 2

**IMPORTANT! Save ComboFix to your Desktop. Read the following thoroughly

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link :How to Disable your Security Programs
  
• Double click on 'ComboFix.exe' & follow the prompts.
  
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message box:

[external image: Posted Image]

Click on 'Yes', to continue scanning for malware.

When finished, it will produce a log for you.
Please include the contents of C:\ComboFix.txt in your next reply.

Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3. ComboFix may reset a number of Internet Explorer's settings, including making Internet Explorer the default browser.
4. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please let me know.
5. ComboFix disconnects your machine from the internet. The connection is automatically restored before ComboFix completes its run. If ComboFix runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

In your next reply please post the log created by ComboFix.

Next,

Please read carefully and follow these steps.

• Download TDSSKiller and save it to your Desktop.
• Extract its contents to your desktop.
• Once extracted, open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.

🖼Click to load external image (Posted Image)

• If an infected file is detected, the default action will be Cure, click on Continue.

🖼Click to load external image (Posted Image)

• If a suspicious file is detected, the default action will be Skip, click on Continue.

🖼Click to load external image (Posted Image)

• It may ask you to reboot the computer to complete the process. Click on Reboot Now.

🖼Click to load external image (Posted Image)

• If no reboot is required, click on Report. A log file should appear. Please copy and paste the contents of that file here.
• If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt".
• Please copy and paste the contents of that file here.

In your next post please include:

• ComboFix.txt
• The TDSSKiller log

6:43 PM 12/8/2011ComboFix 11-12-08.01 - Pritikin Guest 12/08/2011 18:04:09.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.503.256 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: AVG Anti-Virus 2012 *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
AV: Lavasoft Ad-Watch Live! Anti-Virus *Enabled/Updated* {A1C4F2E0-7FDE-4917-AFAE-013EFC3EDE33}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\$NtUninstallKB4961$\797927299
c:\windows\$NtUninstallKB4961$\829104650\@
c:\windows\$NtUninstallKB4961$\829104650\bckfg.tmp
c:\windows\$NtUninstallKB4961$\829104650\cfg.ini
c:\windows\$NtUninstallKB4961$\829104650\Desktop.ini
c:\windows\$NtUninstallKB4961$\829104650\keywords
c:\windows\$NtUninstallKB4961$\829104650\kwrd.dll
c:\windows\$NtUninstallKB4961$\829104650\L\iahonoel
c:\windows\$NtUninstallKB4961$\829104650\lsflt7.ver
c:\windows\$NtUninstallKB4961$\829104650\U\00000001.@
c:\windows\$NtUninstallKB4961$\829104650\U\00000002.@
c:\windows\$NtUninstallKB4961$\829104650\U\00000004.@
c:\windows\$NtUninstallKB4961$\829104650\U\80000000.@
c:\windows\$NtUninstallKB4961$\829104650\U\80000004.@
c:\windows\$NtUninstallKB4961$\829104650\U\80000032.@
c:\windows\CSC\d6
c:\windows\system32\Cache
c:\windows\system32\Cache\19c609b651c93d0f.fb
c:\windows\system32\Cache\272512937d9e61a4.fb
c:\windows\system32\Cache\287204568329e189.fb
c:\windows\system32\Cache\28bc8f716fd76a47.fb
c:\windows\system32\Cache\2c53092c95605355.fb
c:\windows\system32\Cache\3917078cb68ec657.fb
c:\windows\system32\Cache\590ba23ce359fd0c.fb
c:\windows\system32\Cache\610289e025a3ee9a.fb
c:\windows\system32\Cache\651c5d3cdbfb8bd1.fb
c:\windows\system32\Cache\6c59ac5e7e7a3ad0.fb
c:\windows\system32\Cache\ad10a52aff5e038d.fb
c:\windows\system32\Cache\d201ef9910cd39de.fb
c:\windows\system32\Cache\d2e94710a5708128.fb
c:\windows\system32\Cache\d79b9dfe81484ec4.fb
c:\windows\$NtUninstallKB4961$ . . . . Failed to delete
.
.
((((((((((((((((((((((((( Files Created from 2011-11-08 to 2011-12-08 )))))))))))))))))))))))))))))))
.
.
2011-11-30 00:52 . 2011-11-30 00:52 ——– d—–w- c:\windows\system32\N360_BACKUP
2011-11-30 00:19 . 2011-07-06 17:44 27888 —-a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2011-11-30 00:19 . 2011-11-30 01:08 60872 —-a-w- c:\windows\system32\S32EVNT1.DLL
2011-11-30 00:19 . 2011-11-30 01:08 126584 —-a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2011-11-30 00:19 . 2011-11-30 01:09 ——– d—–w- c:\program files\Symantec
2011-11-30 00:17 . 2010-08-21 04:59 106928 —-a-w- c:\windows\system32\GEARAspi.dll
2011-11-30 00:15 . 2011-11-30 13:34 ——– d—–w- c:\windows\system32\drivers\N360
2011-11-30 00:15 . 2011-11-30 00:15 ——– d—–w- c:\program files\Norton 360
2011-11-30 00:15 . 2011-11-30 00:15 ——– d—–w- c:\program files\Windows Sidebar
2011-11-30 00:14 . 2011-11-30 00:14 ——– d—–w- c:\program files\NortonInstaller
2011-11-29 23:39 . 2011-06-21 04:09 200976 —-a-w- c:\windows\system32\drivers\tmcomm.sys
2011-11-29 22:27 . 2011-11-29 22:27 ——– d–h–w- c:\windows\system32\GroupPolicy
2011-11-29 22:12 . 2011-11-29 22:12 ——– d-sh–w- c:\documents and settings\Administrator\PrivacIE
2011-11-29 21:14 . 2011-11-29 21:14 ——– d—–w- c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2011-11-29 21:14 . 2011-11-29 21:14 ——– d-sh–w- c:\documents and settings\Administrator\IETldCache
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-29 22:13 . 2011-09-17 02:41 414368 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-11-29 09:05 . 2004-08-11 23:00 24576 —-a-w- c:\windows\system32\userinit.exe
2011-09-17 03:26 . 2011-09-17 03:27 101720 —-a-w- c:\windows\system32\drivers\SBREDrv.sys
2011-10-04 11:18 . 2011-10-04 11:18 134104 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dell Wireless Manager UI]
c:\windows\system32\WLTRAY [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2011-06-06 16:55 937920 —-a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Apoint]
2004-09-13 09:33 155648 —-a-w- c:\program files\Apoint\Apoint.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ArcSoft Connection Service]
2010-10-27 23:17 207424 —-a-w- c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Broadcom Wireless Manager UI]
2007-03-16 23:10 1392640 —-a-w- c:\windows\system32\WLTRAY.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2004-08-04 11:00 15360 —-a-w- c:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dell QuickSet]
2005-09-01 23:24 684032 —-a-w- c:\program files\Dell\QuickSet\quickset.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd]
2005-09-20 21:32 77824 —-a-w- c:\windows\system32\hkcmd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers]
2005-09-20 21:36 114688 —-a-w- c:\windows\system32\igfxpers.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxtray]
2005-09-20 21:35 94208 —-a-w- c:\windows\system32\igfxtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nikon Message Center 2]
2010-05-25 23:16 619008 —-a-w- c:\program files\Nikon\Nikon Message Center 2\NkMC2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-03-18 01:53 421888 —-a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2011-06-09 17:06 254696 —-a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"N360"=2 (0x2)
"LiveUpdate Notice Service"=2 (0x2)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
.
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [9/16/2011 10:00 PM 64512]
R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\N360\0501000.01D\symds.sys [11/29/2011 8:06 PM 340088]
R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\N360\0501000.01D\symefa.sys [11/29/2011 8:06 PM 744568]
R1 BHDrvx86;BHDrvx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\BASHDefs\20111123.001\BHDrvx86.sys [11/23/2011 11:08 PM 819320]
R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\N360\0501000.01D\ironx86.sys [11/29/2011 8:06 PM 136312]
R2 N360;Norton 360;c:\program files\Norton 360\Engine\5.1.0.29\ccsvchst.exe [11/29/2011 8:04 PM 130008]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [11/29/2011 8:12 PM 106104]
R3 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\IPSDefs\20111203.001\IDSXpx86.sys [12/6/2011 9:32 AM 356280]
S3 Lavasoft Kernexplorer;Lavasoft helper driver;\??\c:\program files\Lavasoft\Ad-Aware\KernExplorer.sys –> c:\program files\Lavasoft\Ad-Aware\KernExplorer.sys [?]
.
Contents of the 'Scheduled Tasks' folder
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://webhelper.centurylink.com/index.php?origURL=http%3A//www.usaabrokerage.com/&r=
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
FF - ProfilePath - c:\documents and settings\Pritikin Guest\Application Data\Mozilla\Firefox\Profiles\262bb5lm.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2857572&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - AddThis
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - prefs.js: keyword.URL - hxxp://isearch.avg.com/search?cid=%7B3fcce00c-e729-4335-bd37-356657f74e42%7D&mid=0790a8f4d6e747d1b4ecd15de3dcbc94-61c940c3b78c29b0b68f9b862ada7fb13f624490&ds=AVG&v=8.0.0.34.1&lang=en&pr=pr&d=2011-09-16%2023%3A27%3A18&sap=ku&q=
.
- - - - ORPHANS REMOVED - - - -
.
SafeBoot-Lavasoft Ad-Aware Service
MSConfigStartUp-1450444774 - c:\documents and settings\Pritikin Guest\Local Settings\Application Data\kxi.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-12-08 18:22
Windows 5.1.2600 Service Pack 2 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\N360]
"ImagePath"="\"c:\program files\Norton 360\Engine\5.1.0.29\ccSvcHst.exe\" /s \"N360\" /m \"c:\program files\Norton 360\Engine\5.1.0.29\diMaster.dll\" /prefetch:1"
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(888)
c:\windows\System32\BCMLogon.dll
.
- - - - - - - > 'explorer.exe'(1776)
c:\windows\system32\WININET.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\IEFRAME.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\windows\System32\WLTRYSVC.EXE
c:\windows\System32\bcmwltry.exe
c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
.
**************************************************************************
.
Completion time: 2011-12-08 18:26:39 - machine was rebooted
ComboFix-quarantined-files.txt 2011-12-08 23:26
.
Pre-Run: 26,365,747,200 bytes free
Post-Run: 26,764,095,488 bytes free
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - 99A82392D14246575A84BE907EF49FC0





18:30:30.0171 2732 TDSS rootkit removing tool [removed] Dec 7 2011 13:21:06
18:30:30.0609 2732 ============================================================
18:30:30.0609 2732 Current date / time: 2011/12/08 18:30:30.0609
18:30:30.0609 2732 SystemInfo:
18:30:30.0609 2732
18:30:30.0609 2732 OS Version: 5.1.2600 ServicePack: 2.0
18:30:30.0609 2732 Product type: Workstation
18:30:30.0609 2732 ComputerName: PRIT-LT
18:30:30.0609 2732 UserName: Pritikin Guest
18:30:30.0609 2732 Windows directory: C:\WINDOWS
18:30:30.0609 2732 System windows directory: C:\WINDOWS
18:30:30.0609 2732 Processor architecture: Intel x86
18:30:30.0609 2732 Number of processors: 1
18:30:30.0609 2732 Page size: 0x1000
18:30:30.0609 2732 Boot type: Normal boot
18:30:30.0609 2732 ============================================================
18:30:33.0937 2732 Initialize success
18:30:44.0000 3548 ============================================================
18:30:44.0000 3548 Scan started
18:30:44.0000 3548 Mode: Manual;
18:30:44.0000 3548 ============================================================
18:30:45.0218 3548 Abiosdsk - ok
18:30:45.0390 3548 abp480n5 (6abb91494fe6c59089b9336452ab2ea3) C:\WINDOWS\system32\DRIVERS\ABP480N5.SYS
18:30:45.0390 3548 abp480n5 - ok
18:30:45.0578 3548 ACPI (a10c7534f7223f4a73a948967d00e69b) C:\WINDOWS\system32\DRIVERS\ACPI.sys
18:30:45.0578 3548 ACPI - ok
18:30:45.0765 3548 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys
18:30:45.0765 3548 ACPIEC - ok
18:30:45.0890 3548 adpu160m (9a11864873da202c996558b2106b0bbc) C:\WINDOWS\system32\DRIVERS\adpu160m.sys
18:30:45.0890 3548 adpu160m - ok
18:30:46.0109 3548 aec (1ee7b434ba961ef845de136224c30fec) C:\WINDOWS\system32\drivers\aec.sys
18:30:46.0109 3548 aec - ok
18:30:46.0296 3548 AFD (192b1dc85a4f86418835d915a00053b0) C:\WINDOWS\System32\drivers\afd.sys
18:30:46.0328 3548 AFD ( Rootkit.Win32.ZAccess.k ) - infected
18:30:46.0328 3548 AFD - detected Rootkit.Win32.ZAccess.k (0)
18:30:46.0515 3548 agp440 (2c428fa0c3e3a01ed93c9b2a27d8d4bb) C:\WINDOWS\system32\DRIVERS\agp440.sys
18:30:46.0515 3548 agp440 - ok
18:30:46.0593 3548 agpCPQ (67288b07d6aba6c1267b626e67bc56fd) C:\WINDOWS\system32\DRIVERS\agpCPQ.sys
18:30:46.0593 3548 agpCPQ - ok
18:30:46.0718 3548 Aha154x (c23ea9b5f46c7f7910db3eab648ff013) C:\WINDOWS\system32\DRIVERS\aha154x.sys
18:30:46.0718 3548 Aha154x - ok
18:30:46.0859 3548 aic78u2 (19dd0fb48b0c18892f70e2e7d61a1529) C:\WINDOWS\system32\DRIVERS\aic78u2.sys
18:30:46.0859 3548 aic78u2 - ok
18:30:47.0015 3548 aic78xx (b7fe594a7468aa0132deb03fb8e34326) C:\WINDOWS\system32\DRIVERS\aic78xx.sys
18:30:47.0015 3548 aic78xx - ok
18:30:47.0109 3548 AliIde (1140ab9938809700b46bb88e46d72a96) C:\WINDOWS\system32\DRIVERS\aliide.sys
18:30:47.0109 3548 AliIde - ok
18:30:47.0234 3548 alim1541 (f312b7cef21eff52fa23056b9d815fad) C:\WINDOWS\system32\DRIVERS\alim1541.sys
18:30:47.0234 3548 alim1541 - ok
18:30:47.0390 3548 amdagp (675c16a3c1f8482f85ee4a97fc0dde3d) C:\WINDOWS\system32\DRIVERS\amdagp.sys
18:30:47.0390 3548 amdagp - ok
18:30:47.0500 3548 amsint (79f5add8d24bd6893f2903a3e2f3fad6) C:\WINDOWS\system32\DRIVERS\amsint.sys
18:30:47.0500 3548 amsint - ok
18:30:47.0640 3548 ApfiltrService (aeb775a2bae0f392ba6adc0bb706233a) C:\WINDOWS\system32\DRIVERS\Apfiltr.sys
18:30:47.0671 3548 ApfiltrService - ok
18:30:47.0843 3548 APPDRV (ec94e05b76d033b74394e7b2175103cf) C:\WINDOWS\SYSTEM32\DRIVERS\APPDRV.SYS
18:30:47.0843 3548 APPDRV - ok
18:30:48.0078 3548 Arp1394 (f0d692b0bffb46e30eb3cea168bbc49f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
18:30:48.0078 3548 Arp1394 - ok
18:30:48.0218 3548 asc (62d318e9a0c8fc9b780008e724283707) C:\WINDOWS\system32\DRIVERS\asc.sys
18:30:48.0218 3548 asc - ok
18:30:48.0250 3548 asc3350p (69eb0cc7714b32896ccbfd5edcbea447) C:\WINDOWS\system32\DRIVERS\asc3350p.sys
18:30:48.0250 3548 asc3350p - ok
18:30:48.0390 3548 asc3550 (5d8de112aa0254b907861e9e9c31d597) C:\WINDOWS\system32\DRIVERS\asc3550.sys
18:30:48.0390 3548 asc3550 - ok
18:30:48.0515 3548 AsyncMac (02000abf34af4c218c35d257024807d6) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
18:30:48.0515 3548 AsyncMac - ok
18:30:48.0687 3548 atapi (cdfe4411a69c224bd1d11b2da92dac51) C:\WINDOWS\system32\DRIVERS\atapi.sys
18:30:48.0687 3548 atapi - ok
18:30:48.0796 3548 Atdisk - ok
18:30:48.0921 3548 Atmarpc (ec88da854ab7d7752ec8be11a741bb7f) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
18:30:48.0921 3548 Atmarpc - ok
18:30:49.0125 3548 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
18:30:49.0125 3548 audstub - ok
18:30:49.0375 3548 BCM43XX (b89bcf0a25aeb3b47030ac83287f894a) C:\WINDOWS\system32\DRIVERS\bcmwl5.sys
18:30:49.0578 3548 BCM43XX - ok
18:30:49.0671 3548 bcm4sbxp (78123f44be9e4768852a3a017e02d637) C:\WINDOWS\system32\DRIVERS\bcm4sbxp.sys
18:30:49.0671 3548 bcm4sbxp - ok
18:30:49.0875 3548 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
18:30:49.0875 3548 Beep - ok
18:30:50.0500 3548 BHDrvx86 (9d14d76e4e7b9b2ead17149011db2b11) C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\BASHDefs\20111123.001\BHDrvx86.sys
18:30:50.0734 3548 BHDrvx86 - ok
18:30:50.0953 3548 bvrp_pci - ok
18:30:50.0968 3548 catchme - ok
18:30:51.0078 3548 cbidf (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\DRIVERS\cbidf2k.sys
18:30:51.0078 3548 cbidf - ok
18:30:51.0171 3548 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
18:30:51.0171 3548 cbidf2k - ok
18:30:51.0328 3548 cd20xrnt (f3ec03299634490e97bbce94cd2954c7) C:\WINDOWS\system32\DRIVERS\cd20xrnt.sys
18:30:51.0328 3548 cd20xrnt - ok
18:30:51.0515 3548 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
18:30:51.0515 3548 Cdaudio - ok
18:30:51.0687 3548 Cdfs (cd7d5152df32b47f4e36f710b35aae02) C:\WINDOWS\system32\drivers\Cdfs.sys
18:30:51.0703 3548 Cdfs - ok
18:30:51.0828 3548 Cdrom (af9c19b3100fe010496b1a27181fbf72) C:\WINDOWS\system32\DRIVERS\cdrom.sys
18:30:51.0828 3548 Cdrom - ok
18:30:51.0890 3548 Changer - ok
18:30:52.0046 3548 CmBatt (4266be808f85826aedf3c64c1e240203) C:\WINDOWS\system32\DRIVERS\CmBatt.sys
18:30:52.0046 3548 CmBatt - ok
18:30:52.0203 3548 CmdIde (e5dcb56c533014ecbc556a8357c929d5) C:\WINDOWS\system32\DRIVERS\cmdide.sys
18:30:52.0203 3548 CmdIde - ok
18:30:52.0296 3548 Compbatt (df1b1a24bf52d0ebc01ed4ece8979f50) C:\WINDOWS\system32\DRIVERS\compbatt.sys
18:30:52.0312 3548 Compbatt - ok
18:30:52.0406 3548 Cpqarray (3ee529119eed34cd212a215e8c40d4b6) C:\WINDOWS\system32\DRIVERS\cpqarray.sys
18:30:52.0406 3548 Cpqarray - ok
18:30:52.0546 3548 dac2w2k (e550e7418984b65a78299d248f0a7f36) C:\WINDOWS\system32\DRIVERS\dac2w2k.sys
18:30:52.0578 3548 dac2w2k - ok
18:30:52.0687 3548 dac960nt (683789caa3864eb46125ae86ff677d34) C:\WINDOWS\system32\DRIVERS\dac960nt.sys
18:30:52.0687 3548 dac960nt - ok
18:30:52.0828 3548 Disk (00ca44e4534865f8a3b64f7c0984bff0) C:\WINDOWS\system32\DRIVERS\disk.sys
18:30:52.0859 3548 Disk - ok
18:30:53.0156 3548 dmboot (c0fbb516e06e243f0cf31f597e7ebf7d) C:\WINDOWS\system32\drivers\dmboot.sys
18:30:53.0265 3548 dmboot - ok
18:30:53.0609 3548 dmio (f5e7b358a732d09f4bcf2824b88b9e28) C:\WINDOWS\system32\drivers\dmio.sys
18:30:53.0640 3548 dmio - ok
18:30:53.0765 3548 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
18:30:53.0765 3548 dmload - ok
18:30:53.0859 3548 DMusic (a6f881284ac1150e37d9ae47ff601267) C:\WINDOWS\system32\drivers\DMusic.sys
18:30:53.0859 3548 DMusic - ok
18:30:53.0953 3548 dpti2o (40f3b93b4e5b0126f2f5c0a7a5e22660) C:\WINDOWS\system32\DRIVERS\dpti2o.sys
18:30:53.0953 3548 dpti2o - ok
18:30:54.0109 3548 drmkaud (1ed4dbbae9f5d558dbba4cc450e3eb2e) C:\WINDOWS\system32\drivers\drmkaud.sys
18:30:54.0125 3548 drmkaud - ok
18:30:54.0250 3548 E100B (3fca03cbca11269f973b70fa483c88ef) C:\WINDOWS\system32\DRIVERS\e100b325.sys
18:30:54.0281 3548 E100B - ok
18:30:54.0578 3548 eeCtrl (75e8b69f28c813675b16db357f20720f) C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys
18:30:54.0640 3548 eeCtrl - ok
18:30:54.0765 3548 EraserUtilRebootDrv (720b18d76de9e603b626dfcd6f1fca7c) C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys
18:30:54.0765 3548 EraserUtilRebootDrv - ok
18:30:54.0843 3548 Fastfat (3117f595e9615e04f05a54fc15a03b20) C:\WINDOWS\system32\drivers\Fastfat.sys
18:30:54.0921 3548 Fastfat - ok
18:30:55.0031 3548 Fdc (ced2e8396a8838e59d8fd529c680e02c) C:\WINDOWS\system32\DRIVERS\fdc.sys
18:30:55.0031 3548 Fdc - ok
18:30:55.0187 3548 Fips (e153ab8a11de5452bcf5ac7652dbf3ed) C:\WINDOWS\system32\drivers\Fips.sys
18:30:55.0187 3548 Fips - ok
18:30:55.0359 3548 Flpydisk (0dd1de43115b93f4d85e889d7a86f548) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
18:30:55.0359 3548 Flpydisk - ok
18:30:55.0593 3548 FltMgr (3d234fb6d6ee875eb009864a299bea29) C:\WINDOWS\system32\DRIVERS\fltMgr.sys
18:30:55.0609 3548 FltMgr - ok
18:30:55.0875 3548 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
18:30:55.0875 3548 Fs_Rec - ok
18:30:55.0984 3548 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
18:30:55.0984 3548 Ftdisk - ok
18:30:56.0140 3548 GEARAspiWDM (5ae3a887ece5bbb72cfab273c2fd1cfa) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
18:30:56.0140 3548 GEARAspiWDM - ok
18:30:56.0312 3548 Gpc (c0f1d4a21de5a415df8170616703debf) C:\WINDOWS\system32\DRIVERS\msgpc.sys
18:30:56.0312 3548 Gpc - ok
18:30:56.0546 3548 HidUsb (1de6783b918f540149aa69943bdfeba8) C:\WINDOWS\system32\DRIVERS\hidusb.sys
18:30:56.0546 3548 HidUsb - ok
18:30:56.0671 3548 hpn (b028377dea0546a5fcfba928a8aefae0) C:\WINDOWS\system32\DRIVERS\hpn.sys
18:30:56.0671 3548 hpn - ok
18:30:56.0812 3548 HSFHWICH (140ba850417896b6b3322048de280368) C:\WINDOWS\system32\DRIVERS\HSFHWICH.sys
18:30:56.0906 3548 HSFHWICH - ok
18:30:57.0125 3548 HSF_DP (b2dfc168d6f7512faea085253c5a37ad) C:\WINDOWS\system32\DRIVERS\HSF_DP.sys
18:30:57.0343 3548 HSF_DP - ok
18:30:57.0671 3548 HTTP (9f8b0f4276f618964fd118be4289b7cd) C:\WINDOWS\system32\Drivers\HTTP.sys
18:30:57.0687 3548 HTTP - ok
18:30:57.0843 3548 i2omgmt (8f09f91b5c91363b77bcd15599570f2c) C:\WINDOWS\system32\drivers\i2omgmt.sys
18:30:57.0843 3548 i2omgmt - ok
18:30:57.0968 3548 i2omp (ed6bf9e441fdea13292a6d30a64a24c3) C:\WINDOWS\system32\DRIVERS\i2omp.sys
18:30:57.0968 3548 i2omp - ok
18:30:58.0078 3548 i8042prt (5502b58eef7486ee6f93f3f164dcb808) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
18:30:58.0078 3548 i8042prt - ok
18:30:58.0359 3548 ialm (9a883c3c4d91292c0d09de7c728e781c) C:\WINDOWS\system32\DRIVERS\ialmnt5.sys
18:30:58.0515 3548 ialm - ok
18:30:58.0968 3548 IDSxpx86 (e72d3894d42355e9cd5fd77e1e4fea11) C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\IPSDefs\20111203.001\IDSxpx86.sys
18:30:59.0015 3548 IDSxpx86 - ok
18:30:59.0328 3548 Imapi (f8aa320c6a0409c0380e5d8a99d76ec6) C:\WINDOWS\system32\DRIVERS\imapi.sys
18:30:59.0328 3548 Imapi - ok
18:30:59.0468 3548 ini910u (4a40e045faee58631fd8d91afc620719) C:\WINDOWS\system32\DRIVERS\ini910u.sys
18:30:59.0468 3548 ini910u - ok
18:30:59.0640 3548 IntelIde (2d722b2b54ab55b2fa475eb58d7b2aad) C:\WINDOWS\system32\DRIVERS\intelide.sys
18:30:59.0640 3548 IntelIde - ok
18:30:59.0734 3548 intelppm (279fb78702454dff2bb445f238c048d2) C:\WINDOWS\system32\DRIVERS\intelppm.sys
18:30:59.0734 3548 intelppm - ok
18:30:59.0859 3548 Ip6Fw (4448006b6bc60e6c027932cfc38d6855) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
18:30:59.0859 3548 Ip6Fw - ok
18:30:59.0953 3548 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
18:30:59.0953 3548 IpFilterDriver - ok
18:31:00.0046 3548 IpInIp (e1ec7f5da720b640cd8fb8424f1b14bb) C:\WINDOWS\system32\DRIVERS\ipinip.sys
18:31:00.0046 3548 IpInIp - ok
18:31:00.0265 3548 IpNat (e2168cbc7098ffe963c6f23f472a3593) C:\WINDOWS\system32\DRIVERS\ipnat.sys
18:31:00.0265 3548 IpNat - ok
18:31:00.0453 3548 IPSec (64537aa5c003a6afeee1df819062d0d1) C:\WINDOWS\system32\DRIVERS\ipsec.sys
18:31:00.0453 3548 IPSec - ok
18:31:00.0625 3548 IRENUM (50708daa1b1cbb7d6ac1cf8f56a24410) C:\WINDOWS\system32\DRIVERS\irenum.sys
18:31:00.0625 3548 IRENUM - ok
18:31:00.0718 3548 isapnp (e504f706ccb699c2596e9a3da1596e87) C:\WINDOWS\system32\DRIVERS\isapnp.sys
18:31:00.0718 3548 isapnp - ok
18:31:00.0843 3548 Kbdclass (ebdee8a2ee5393890a1acee971c4c246) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
18:31:00.0843 3548 Kbdclass - ok
18:31:01.0015 3548 kmixer (ba5deda4d934e6288c2f66caf58d2562) C:\WINDOWS\system32\drivers\kmixer.sys
18:31:01.0062 3548 kmixer - ok
18:31:01.0218 3548 KSecDD (674d3e5a593475915dc6643317192403) C:\WINDOWS\system32\drivers\KSecDD.sys
18:31:01.0218 3548 KSecDD - ok
18:31:01.0281 3548 Lavasoft Kernexplorer - ok
18:31:01.0515 3548 Lbd (336abe8721cbc3110f1c6426da633417) C:\WINDOWS\system32\DRIVERS\Lbd.sys
18:31:01.0515 3548 Lbd - ok
18:31:01.0640 3548 lbrtfdc - ok
18:31:01.0812 3548 mdmxsdk (3c318b9cd391371bed62126581ee9961) C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys
18:31:01.0812 3548 mdmxsdk - ok
18:31:01.0921 3548 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
18:31:01.0921 3548 mnmdd - ok
18:31:02.0109 3548 Modem (6fc6f9d7acc36dca9b914565a3aeda05) C:\WINDOWS\system32\drivers\Modem.sys
18:31:02.0109 3548 Modem - ok
18:31:02.0265 3548 Mouclass (34e1f0031153e491910e12551400192c) C:\WINDOWS\system32\DRIVERS\mouclass.sys
18:31:02.0265 3548 Mouclass - ok
18:31:02.0421 3548 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys
18:31:02.0421 3548 mouhid - ok
18:31:02.0578 3548 MountMgr (65653f3b4477f3c63e68a9659f85ee2e) C:\WINDOWS\system32\drivers\MountMgr.sys
18:31:02.0578 3548 MountMgr - ok
18:31:02.0734 3548 mraid35x (3f4bb95e5a44f3be34824e8e7caf0737) C:\WINDOWS\system32\DRIVERS\mraid35x.sys
18:31:02.0734 3548 mraid35x - ok
18:31:02.0859 3548 MRxDAV (29414447eb5bde2f8397dc965dbb3156) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
18:31:02.0875 3548 MRxDAV - ok
18:31:03.0125 3548 MRxSmb (fb6c89bb3ce282b08bdb1e3c179e1c39) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
18:31:03.0218 3548 MRxSmb - ok
18:31:03.0265 3548 Msfs (561b3a4333ca2dbdba28b5b956822519) C:\WINDOWS\system32\drivers\Msfs.sys
18:31:03.0265 3548 Msfs - ok
18:31:03.0421 3548 MSKSSRV (ae431a8dd3c1d0d0610cdbac16057ad0) C:\WINDOWS\system32\drivers\MSKSSRV.sys
18:31:03.0421 3548 MSKSSRV - ok
18:31:03.0546 3548 MSPCLOCK (13e75fef9dfeb08eeded9d0246e1f448) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
18:31:03.0546 3548 MSPCLOCK - ok
18:31:03.0640 3548 MSPQM (1988a33ff19242576c3d0ef9ce785da7) C:\WINDOWS\system32\drivers\MSPQM.sys
18:31:03.0640 3548 MSPQM - ok
18:31:03.0812 3548 mssmbios (469541f8bfd2b32659d5d463a6714bce) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
18:31:03.0812 3548 mssmbios - ok
18:31:03.0953 3548 Mup (82035e0f41c2dd05ae41d27fe6cf7de1) C:\WINDOWS\system32\drivers\Mup.sys
18:31:03.0984 3548 Mup - ok
18:31:04.0468 3548 NAVENG (862f55824ac81295837b0ab63f91071f) C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\VirusDefs\20111206.002\NAVENG.SYS
18:31:04.0484 3548 NAVENG - ok
18:31:04.0843 3548 NAVEX15 (529d571b551cb9da44237389b936f1ae) C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\VirusDefs\20111206.002\NAVEX15.SYS
18:31:05.0062 3548 NAVEX15 - ok
18:31:05.0390 3548 NDIS (558635d3af1c7546d26067d5d9b6959e) C:\WINDOWS\system32\drivers\NDIS.sys
18:31:05.0390 3548 NDIS - ok
18:31:05.0484 3548 NdisTapi (08d43bbdacdf23f34d79e44ed35c1b4c) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
18:31:05.0484 3548 NdisTapi - ok
18:31:05.0625 3548 Ndisuio (34d6cd56409da9a7ed573e1c90a308bf) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
18:31:05.0625 3548 Ndisuio - ok
18:31:05.0734 3548 NdisWan (0b90e255a9490166ab368cd55a529893) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
18:31:05.0734 3548 NdisWan - ok
18:31:05.0906 3548 NDProxy (59fc3fb44d2669bc144fd87826bb571f) C:\WINDOWS\system32\drivers\NDProxy.sys
18:31:05.0906 3548 NDProxy - ok
18:31:06.0046 3548 NetBIOS (3a2aca8fc1d7786902ca434998d7ceb4) C:\WINDOWS\system32\DRIVERS\netbios.sys
18:31:06.0046 3548 NetBIOS - ok
18:31:06.0203 3548 NetBT (0c80e410cd2f47134407ee7dd19cc86b) C:\WINDOWS\system32\DRIVERS\netbt.sys
18:31:06.0203 3548 NetBT - ok
18:31:06.0375 3548 NIC1394 (5c5c53db4fef16cf87b9911c7e8c6fbc) C:\WINDOWS\system32\DRIVERS\nic1394.sys
18:31:06.0375 3548 NIC1394 - ok
18:31:06.0453 3548 Npfs (4f601bcb8f64ea3ac0994f98fed03f8e) C:\WINDOWS\system32\drivers\Npfs.sys
18:31:06.0453 3548 Npfs - ok
18:31:06.0734 3548 Ntfs (19a811ef5f1ed5c926a028ce107ff1af) C:\WINDOWS\system32\drivers\Ntfs.sys
18:31:06.0734 3548 Ntfs - ok
18:31:06.0875 3548 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
18:31:06.0875 3548 Null - ok
18:31:07.0218 3548 nv (2b298519edbfcf451d43e0f1e8f1006d) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
18:31:07.0453 3548 nv - ok
18:31:07.0750 3548 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
18:31:07.0750 3548 NwlnkFlt - ok
18:31:07.0828 3548 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
18:31:07.0843 3548 NwlnkFwd - ok
18:31:07.0968 3548 ohci1394 (0951db8e5823ea366b0e408d71e1ba2a) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
18:31:07.0984 3548 ohci1394 - ok
18:31:08.0187 3548 Parport (29744eb4ce659dfe3b4122deb45bc478) C:\WINDOWS\system32\DRIVERS\parport.sys
18:31:08.0187 3548 Parport - ok
18:31:08.0312 3548 PartMgr (3334430c29dc338092f79c38ef7b4cd0) C:\WINDOWS\system32\drivers\PartMgr.sys
18:31:08.0312 3548 PartMgr - ok
18:31:08.0453 3548 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
18:31:08.0453 3548 ParVdm - ok
18:31:08.0578 3548 PCI (8086d9979234b603ad5bc2f5d890b234) C:\WINDOWS\system32\DRIVERS\pci.sys
18:31:08.0578 3548 PCI - ok
18:31:08.0640 3548 PCIDump - ok
18:31:08.0734 3548 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys
18:31:08.0734 3548 PCIIde - ok
18:31:08.0843 3548 Pcmcia (82a087207decec8456fbe8537947d579) C:\WINDOWS\system32\DRIVERS\pcmcia.sys
18:31:08.0843 3548 Pcmcia - ok
18:31:08.0875 3548 PDCOMP - ok
18:31:08.0937 3548 PDFRAME - ok
18:31:08.0984 3548 PDRELI - ok
18:31:09.0078 3548 PDRFRAME - ok
18:31:09.0140 3548 perc2 (6c14b9c19ba84f73d3a86dba11133101) C:\WINDOWS\system32\DRIVERS\perc2.sys
18:31:09.0156 3548 perc2 - ok
18:31:09.0281 3548 perc2hib (f50f7c27f131afe7beba13e14a3b9416) C:\WINDOWS\system32\DRIVERS\perc2hib.sys
18:31:09.0312 3548 perc2hib - ok
18:31:09.0453 3548 PptpMiniport (1c5cc65aac0783c344f16353e60b72ac) C:\WINDOWS\system32\DRIVERS\raspptp.sys
18:31:09.0453 3548 PptpMiniport - ok
18:31:09.0593 3548 PSched (48671f327553dcf1d27f6197f622a668) C:\WINDOWS\system32\DRIVERS\psched.sys
18:31:09.0609 3548 PSched - ok
18:31:09.0687 3548 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
18:31:09.0734 3548 Ptilink - ok
18:31:09.0843 3548 ql1080 (0a63fb54039eb5662433caba3b26dba7) C:\WINDOWS\system32\DRIVERS\ql1080.sys
18:31:09.0843 3548 ql1080 - ok
18:31:09.0968 3548 Ql10wnt (6503449e1d43a0ff0201ad5cb1b8c706) C:\WINDOWS\system32\DRIVERS\ql10wnt.sys
18:31:09.0968 3548 Ql10wnt - ok
18:31:10.0062 3548 ql12160 (156ed0ef20c15114ca097a34a30d8a01) C:\WINDOWS\system32\DRIVERS\ql12160.sys
18:31:10.0109 3548 ql12160 - ok
18:31:10.0281 3548 ql1240 (70f016bebde6d29e864c1230a07cc5e6) C:\WINDOWS\system32\DRIVERS\ql1240.sys
18:31:10.0281 3548 ql1240 - ok
18:31:10.0421 3548 ql1280 (907f0aeea6bc451011611e732bd31fcf) C:\WINDOWS\system32\DRIVERS\ql1280.sys
18:31:10.0421 3548 ql1280 - ok
18:31:10.0562 3548 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
18:31:10.0625 3548 RasAcd - ok
18:31:10.0734 3548 Rasl2tp (98faeb4a4dcf812ba1c6fca4aa3e115c) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
18:31:10.0734 3548 Rasl2tp - ok
18:31:10.0875 3548 RasPppoe (7306eeed8895454cbed4669be9f79faa) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
18:31:10.0875 3548 RasPppoe - ok
18:31:10.0953 3548 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
18:31:10.0968 3548 Raspti - ok
18:31:11.0156 3548 Rdbss (03b965b1ca47f6ef60eb5e51cb50e0af) C:\WINDOWS\system32\DRIVERS\rdbss.sys
18:31:11.0156 3548 Rdbss - ok
18:31:11.0296 3548 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
18:31:11.0296 3548 RDPCDD - ok
18:31:11.0453 3548 rdpdr (a2cae2c60bc37e0751ef9dda7ceaf4ad) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
18:31:11.0500 3548 rdpdr - ok
18:31:11.0734 3548 RDPWD (b54cd38a9ebfbf2b3561426e3fe26f62) C:\WINDOWS\system32\drivers\RDPWD.sys
18:31:11.0765 3548 RDPWD - ok
18:31:11.0906 3548 redbook (b31b4588e4086d8d84adbf9845c2402b) C:\WINDOWS\system32\DRIVERS\redbook.sys
18:31:11.0906 3548 redbook - ok
18:31:12.0078 3548 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
18:31:12.0093 3548 Secdrv - ok
18:31:12.0250 3548 serenum (a2d868aeeff612e70e213c451a70cafb) C:\WINDOWS\system32\DRIVERS\serenum.sys
18:31:12.0250 3548 serenum - ok
18:31:12.0375 3548 Serial (cd9404d115a00d249f70a371b46d5a26) C:\WINDOWS\system32\DRIVERS\serial.sys
18:31:12.0375 3548 Serial - ok
18:31:12.0546 3548 Sfloppy (0d13b6df6e9e101013a7afb0ce629fe0) C:\WINDOWS\system32\drivers\Sfloppy.sys
18:31:12.0546 3548 Sfloppy - ok
18:31:12.0656 3548 Simbad - ok
18:31:12.0781 3548 sisagp (732d859b286da692119f286b21a2a114) C:\WINDOWS\system32\DRIVERS\sisagp.sys
18:31:12.0781 3548 sisagp - ok
18:31:12.0890 3548 Sparrow (83c0f71f86d3bdaf915685f3d568b20e) C:\WINDOWS\system32\DRIVERS\sparrow.sys
18:31:12.0890 3548 Sparrow - ok
18:31:13.0078 3548 splitter (0ce218578fff5f4f7e4201539c45c78f) C:\WINDOWS\system32\drivers\splitter.sys
18:31:13.0078 3548 splitter - ok
18:31:13.0187 3548 sr (e41b6d037d6cd08461470af04500dc24) C:\WINDOWS\system32\DRIVERS\sr.sys
18:31:13.0187 3548 sr - ok
18:31:13.0453 3548 SRTSP (83726cf02eced69138948083e06b6eac) C:\WINDOWS\System32\Drivers\N360\0501000.01D\SRTSP.SYS
18:31:13.0546 3548 SRTSP - ok
18:31:13.0828 3548 SRTSPX (4e7eab2e5615d39cf1f1df9c71e5e225) C:\WINDOWS\system32\drivers\N360\0501000.01D\SRTSPX.SYS
18:31:13.0828 3548 SRTSPX - ok
18:31:14.0046 3548 Srv (7a4f147cc6b133f905f6e65e2f8669fb) C:\WINDOWS\system32\DRIVERS\srv.sys
18:31:14.0125 3548 Srv - ok
18:31:14.0281 3548 STAC97 (305cc42945a713347f978d78566113f3) C:\WINDOWS\system32\drivers\STAC97.sys
18:31:14.0375 3548 STAC97 - ok
18:31:14.0484 3548 swenum (03c1bae4766e2450219d20b993d6e046) C:\WINDOWS\system32\DRIVERS\swenum.sys
18:31:14.0546 3548 swenum - ok
18:31:14.0640 3548 swmidi (94abc808fc4b6d7d2bbf42b85e25bb4d) C:\WINDOWS\system32\drivers\swmidi.sys
18:31:14.0640 3548 swmidi - ok
18:31:14.0796 3548 symc810 (1ff3217614018630d0a6758630fc698c) C:\WINDOWS\system32\DRIVERS\symc810.sys
18:31:14.0796 3548 symc810 - ok
18:31:14.0921 3548 symc8xx (070e001d95cf725186ef8b20335f933c) C:\WINDOWS\system32\DRIVERS\symc8xx.sys
18:31:14.0921 3548 symc8xx - ok
18:31:15.0156 3548 SymDS (9bbeb8c6258e72d62e7560e6667aad39) C:\WINDOWS\system32\drivers\N360\0501000.01D\SYMDS.SYS
18:31:15.0218 3548 SymDS - ok
18:31:15.0546 3548 SymEFA (d5c02629c02a820a7e71bca3d44294a3) C:\WINDOWS\system32\drivers\N360\0501000.01D\SYMEFA.SYS
18:31:15.0671 3548 SymEFA - ok
18:31:15.0953 3548 SymEvent (ab33c3b196197ca467cbdda717860dba) C:\WINDOWS\system32\Drivers\SYMEVENT.SYS
18:31:15.0953 3548 SymEvent - ok
18:31:16.0171 3548 SymIRON (a73399804d5d4a8b20ba60fcf70c9f1f) C:\WINDOWS\system32\drivers\N360\0501000.01D\Ironx86.SYS
18:31:16.0250 3548 SymIRON - ok
18:31:16.0437 3548 SYMTDI (dec35ccaf7a222df918306cd2fdfbd39) C:\WINDOWS\System32\Drivers\N360\0501000.01D\SYMTDI.SYS
18:31:16.0500 3548 SYMTDI - ok
18:31:16.0718 3548 sym_hi (80ac1c4abbe2df3b738bf15517a51f2c) C:\WINDOWS\system32\DRIVERS\sym_hi.sys
18:31:16.0718 3548 sym_hi - ok
18:31:16.0875 3548 sym_u3 (bf4fab949a382a8e105f46ebb4937058) C:\WINDOWS\system32\DRIVERS\sym_u3.sys
18:31:16.0875 3548 sym_u3 - ok
18:31:16.0984 3548 sysaudio (650ad082d46bac0e64c9c0e0928492fd) C:\WINDOWS\system32\drivers\sysaudio.sys
18:31:17.0000 3548 sysaudio - ok
18:31:17.0218 3548 Tcpip (2a5554fc5b1e04e131230e3ce035c3f9) C:\WINDOWS\system32\DRIVERS\tcpip.sys
18:31:17.0218 3548 Tcpip - ok
18:31:17.0390 3548 TDPIPE (38d437cf2d98965f239b0abcd66dcb0f) C:\WINDOWS\system32\drivers\TDPIPE.sys
18:31:17.0390 3548 TDPIPE - ok
18:31:17.0546 3548 TDTCP (ed0580af02502d00ad8c4c066b156be9) C:\WINDOWS\system32\drivers\TDTCP.sys
18:31:17.0546 3548 TDTCP - ok
18:31:17.0671 3548 TermDD (a540a99c281d933f3d69d55e48727f47) C:\WINDOWS\system32\DRIVERS\termdd.sys
18:31:17.0671 3548 TermDD - ok
18:31:17.0828 3548 TosIde (f2790f6af01321b172aa62f8e1e187d9) C:\WINDOWS\system32\DRIVERS\toside.sys
18:31:17.0828 3548 TosIde - ok
18:31:18.0062 3548 Udfs (12f70256f140cd7d52c58c7048fde657) C:\WINDOWS\system32\drivers\Udfs.sys
18:31:18.0078 3548 Udfs - ok
18:31:18.0218 3548 ultra (1b698a51cd528d8da4ffaed66dfc51b9) C:\WINDOWS\system32\DRIVERS\ultra.sys
18:31:18.0218 3548 ultra - ok
18:31:18.0437 3548 Update (ced744117e91bdc0beb810f7d8608183) C:\WINDOWS\system32\DRIVERS\update.sys
18:31:18.0500 3548 Update - ok
18:31:18.0687 3548 usbehci (15e993ba2f6946b2bfbbfcd30398621e) C:\WINDOWS\system32\DRIVERS\usbehci.sys
18:31:18.0687 3548 usbehci - ok
18:31:18.0828 3548 usbhub (c72f40947f92cea56a8fb532edf025f1) C:\WINDOWS\system32\DRIVERS\usbhub.sys
18:31:18.0828 3548 usbhub - ok
18:31:19.0000 3548 usbscan (a6bc71402f4f7dd5b77fd7f4a8ddba85) C:\WINDOWS\system32\DRIVERS\usbscan.sys
18:31:19.0000 3548 usbscan - ok
18:31:19.0187 3548 USBSTOR (6cd7b22193718f1d17a47a1cd6d37e75) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
18:31:19.0187 3548 USBSTOR - ok
18:31:19.0296 3548 usbuhci (f8fd1400092e23c8f2f31406ef06167b) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
18:31:19.0296 3548 usbuhci - ok
18:31:19.0437 3548 VgaSave (8a60edd72b4ea5aea8202daf0e427925) C:\WINDOWS\System32\drivers\vga.sys
18:31:19.0437 3548 VgaSave - ok
18:31:19.0546 3548 viaagp (d92e7c8a30cfd14d8e15b5f7f032151b) C:\WINDOWS\system32\DRIVERS\viaagp.sys
18:31:19.0546 3548 viaagp - ok
18:31:19.0734 3548 ViaIde (59cb1338ad3654417bea49636457f65d) C:\WINDOWS\system32\DRIVERS\viaide.sys
18:31:19.0734 3548 ViaIde - ok
18:31:19.0859 3548 VolSnap (ee4660083deba849ff6c485d944b379b) C:\WINDOWS\system32\drivers\VolSnap.sys
18:31:19.0859 3548 VolSnap - ok
18:31:20.0093 3548 Wanarp (984ef0b9788abf89974cfed4bfbaacbc) C:\WINDOWS\system32\DRIVERS\wanarp.sys
18:31:20.0093 3548 Wanarp - ok
18:31:20.0203 3548 WDICA - ok
18:31:20.0421 3548 wdmaud (efd235ca22b57c81118c1aeb4798f1c1) C:\WINDOWS\system32\drivers\wdmaud.sys
18:31:20.0421 3548 wdmaud - ok
18:31:20.0671 3548 winachsf (2dc7c0b6175a0a8ed84a4f70199c93b5) C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys
18:31:20.0828 3548 winachsf - ok
18:31:21.0062 3548 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
18:31:21.0062 3548 WudfPf - ok
18:31:21.0156 3548 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
18:31:21.0171 3548 WudfRd - ok
18:31:21.0218 3548 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk0\DR0
18:31:24.0328 3548 \Device\Harddisk0\DR0 - ok
18:31:24.0359 3548 Boot (0x1200) (645a8966a6859110332c154223c1ce1e) \Device\Harddisk0\DR0\Partition0
18:31:24.0359 3548 \Device\Harddisk0\DR0\Partition0 - ok
18:31:24.0359 3548 ============================================================
18:31:24.0359 3548 Scan finished
18:31:24.0359 3548 ============================================================
18:31:24.0375 1404 Detected object count: 1
18:31:24.0375 1404 Actual detected object count: 1
18:31:34.0640 1404 VerifyFileNameVersionInfo: GetFileVersionInfoSizeW(C:\WINDOWS\system32\drivers\afd.sys) error 1813
18:31:37.0421 1404 Backup copy found, using it..
18:31:39.0109 1404 C:\WINDOWS\System32\drivers\afd.sys - will be cured on reboot
18:31:51.0265 1404 AFD ( Rootkit.Win32.ZAccess.k ) - User select action: Cure
18:32:05.0328 2712 Deinitialize success

Well it seems to have worked. It runs much faster and Norton hasn't alerted me at least before I went home. There were some problems starting Combofix it kept having trouble reading extracion files but I clicked retry and it installed. (the computer was very slow it took about 10 minutes to get apps for control panel to show up.) The TDSSKiller program kept telling me AVG and Lavasoft was active. The first application that Norton removed was "XP Security 2012 Trial" (Obviously fake nothing real finds that many treats that fast) Before that I tried to run Lavasoft and AVG but they seemed to be lanching the problem program. So I deleted all of the AVG files I could find before installing Norton Since TDSSKiller kept telling me they were active and AVG wasn't show in add remove programs. I uninstalled Lavasoft and rebooted. I got the same message I used regedit to remove all referances with AVG that werent something else like AVGeneral and Avg. still it said it was active so I used MSConfig and disabled all startup programs and a couple of system referances. It still said they were active but I must have clicked the wrong thing and it continued on and ran without problems and now it seems fine. I re-enabled all I had stoped with MSConfig Thanks