What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

cmd and regedit -will not run

8 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
several problems including
start run cmd and regedit do not run screen blinks and comes back to desktop.
als ms essentials will not install get error code 0x80070643
and google gives avcodec-53.dll is not a valid windows image
d.d.s appears to lock first run widow blinks and closes 2nd run just sits there with ##

any help would be appreciated
TIA
Jim

copy of hijackthis log file

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:09:12 AM, on 1/30/2012
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\RealVNC\VNC4\WinVNC4.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\tmiadmin\Desktop\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.earthlink.net/AL/Search
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkID=151778&fi=50542
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O2 - BHO: EarthLink PopUp Blocker V2 - {512ACF1B-64D9-4928-B382-A80556F28DB4} - C:\Program Files\EarthLink\Toolbar\ElnkPub.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Earthlink Protection BHO - {9579D574-D4D8-4335-9560-FE8641A013BD} - C:\Program Files\EarthLink\Toolbar\ProtctIE.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.7227.1100\swg.dll
O2 - BHO: Uninstall Legacy Earthlink Toolbar - {E713904C-DF05-4C79-BBAD-02DB923253BE} - C:\Program Files\EarthLink\Toolbar\uninsttb.dll
O3 - Toolbar: EarthLink Toolbar - {C7768536-96F8-4001-B1A2-90EE21279187} - C:\Program Files\EarthLink\Toolbar\Toolbar.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {032C5CBC-2272-438F-AC73-38EA92AF19BD} (WebViewer Control) - http://192.168.1.3/WebViewer.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1149864138515
O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} (AcDcToday Control) - file://C:\Program Files\Acadm 2000i\AcDcToday.ocx
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secur…loadManager.ocx
O16 - DPF: {C6637286-300D-11D4-AE0A-0010830243BD} (InstaFred Control) - file://C:\Program Files\Acadm 2000i\InstFred.ocx
O16 - DPF: {E9348280-2D74-4933-BE25-73D946926795} (DeviceEnum Class) - http://h20270.www2.hp.com/ediags/gmn/insta…cdetection3.cab
O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file://C:\Program Files\Acadm 2000i\AcPreview.ocx
O17 - HKLM\System\CCS\Services\Tcpip\..\{9D9D590B-2089-4E24-BBB5-A7BE9F8880CE}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer =
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer =
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer =
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4.exe

–
End of file - 6080 bytes
Post #2
Welcome to What the Tech JIMF54,

Let's get a more detailed look at things, then decide on repairs. If you would, don't install any other security software or programs now, until we get everything resolved.


To make sure you have an accurate view of files there, make sure you can View Hidden Files. Also uncheck "Hide Extensions for Known File Types"



To keep them from interfering with the repairs, be sure to temporarily disable all antivirus/anti-spyware softwares while these steps are being completed. This can usually be done through right clicking the software's Taskbar icons, or accessing each software through Start - Programs. Here are some antivirus disable tips if needed.

——-

Go here and download Dial-a-fix-v0.60.0.24.zip (scroll down to the "green" box"), then unzip that to the desktop. In the Dial-a-fix folder locate and click on Dial-a-fix.exe to open the tool display.

Once the display opens another Restrictive Policies display should open. Click the Remove button, then close Dial-a-Fix. That may provide access to things like Regedit.

Note - Dial-a-Fix was never updated for the later versions of Internet Explorer (iexplore.exe). If it indicates it cannot identify that, just OK the warning. It will still run correctly.

————-

Download NCRFix.reg from here to your desktop, then right click that file, and allow it to Merge with the registry. Also may provide better access to things right now.

————

Click here and download OldTimer's OTL to your desktop, then click that to open the scan display. At the top click "Scan All Users", then click "Run Scan". Make no other changes at this time.

When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are also saved in the same location as OTL.exe. Post the contents of those back here please.

———–

Click here and download the installer for Gmer to your desktop, then click that file to run Gmer.


Once the opening scan finishes, click on Scan (again, before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while this scan completes. Also do not use your computer during the scan).

When completed, click on the Copy button and rightclick on your Desktop, choose "New" > Text document. Once the file is created, open it and rightclick again and choose Paste. Copy the information and post it here please.

Note - If Gmer shows it has located infection once it's opening scan completes, do not click the Scan button. We don't want hidden malware settings to cause any problems. Instead, just click on the Copy button and rightclick on your Desktop, choose "New" > Text document. Once the file is created, open it and rightclick again and choose Paste. Copy the information and post it here please.

———–

Download aswMBR ( 511KB ) to your desktop.
  • Double click the aswMBR.exe icon to run it
  • If you can have an open Internet connection, and allow it to download the latest Avast engine detections.
  • {i}If avast! antivirus is already installed, just do the next step.{/i}
  • Click the Scan button to start the scan
  • On completion of the scan, click the save log button, save it to your desktop and post it in your next reply.

A lot, but comprehensive, and will make sure we get a good view of everything.
Post #3
Thanks for your response. I downloaded and ran trend micro house call..it found 1 trojan and repaired, all appears to be fine now cmd works regedit works able to install ms essentials so far no more problems..if I encounter more issues I will repost ..Again Thanks for the response. Jim :D
Post #4
Glad to be able to offer the help Jim. Malware tends to bring more with it, so I would recommend going ahead with the posted steps. But if not, be well.
Post #5
Jintan Might as weel check it

otl log


OTL logfile created on: 2/2/2012 8:53:55 AM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Documents and Settings\tmiadmin\Desktop\avcheck
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

502.07 Mb Total Physical Memory | 185.45 Mb Available Physical Memory | 36.94% Memory free
1.20 Gb Paging File | 0.84 Gb Available in Paging File | 70.02% Paging File free
Paging file location(s): C:\pagefile.sys 756 1512 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 70.94 Gb Total Space | 54.80 Gb Free Space | 77.25% Space Free | Partition Type: NTFS

Computer Name: SHOP | User Name: tmiadmin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/02/02 07:00:38 | 000,584,192 | —- | M] (OldTimer Tools) – C:\Documents and Settings\tmiadmin\Desktop\avcheck\OTL.exe
PRC - [2011/06/15 15:16:48 | 000,997,920 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Security Client\msseces.exe
PRC - [2011/04/27 15:39:26 | 000,228,520 | —- | M] (Microsoft Corporation) – c:\Program Files\Microsoft Security Client\Antimalware\MpCmdRun.exe
PRC - [2011/04/27 15:39:26 | 000,011,736 | —- | M] (Microsoft Corporation) – c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
PRC - [2008/10/15 17:13:58 | 000,439,632 | —- | M] (RealVNC Ltd.) – C:\Program Files\RealVNC\VNC4\winvnc4.exe
PRC - [2008/04/13 19:12:28 | 000,060,416 | —- | M] (Microsoft Corporation) – C:\Program Files\Outlook Express\msimn.exe
PRC - [2008/04/13 19:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) – C:\WINDOWS\explorer.exe


========== Modules (No Company Name) ==========

MOD - [2008/12/25 12:36:32 | 000,139,264 | —- | M] () – C:\Program Files\Brother\BrUtilities\BrLogAPI.dll
MOD - [2002/11/26 13:43:18 | 000,106,496 | —- | M] () – C:\WINDOWS\SYSTEM32\BrMuSNMP.dll


========== Win32 Services (SafeList) ==========

SRV - [2011/04/27 15:39:26 | 000,011,736 | —- | M] (Microsoft Corporation) [Auto | Running] – c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe – (MsMpSvc)
SRV - [2008/10/15 17:13:58 | 000,439,632 | —- | M] (RealVNC Ltd.) [Auto | Running] – C:\Program Files\RealVNC\VNC4\WinVNC4.exe – (WinVNC4)
SRV - [2007/03/07 14:47:46 | 000,076,848 | —- | M] () [Disabled | Stopped] – C:\Program Files\DellSupport\brkrsvc.exe – (DSBrokerService)
SRV - [2005/10/22 20:47:00 | 000,069,632 | —- | M] (HP) [Disabled | Stopped] – C:\WINDOWS\SYSTEM32\HPZipm12.exe – (Pml Driver HPZ12)
SRV - [2000/06/29 03:45:10 | 000,052,224 | —- | M] (Kenonic Controls Ltd.) [Disabled | Stopped] – C:\WINDOWS\System32\Crypserv.exe – (Crypkey License)


========== Driver Services (SafeList) ==========

DRV - [2010/02/11 07:02:15 | 000,226,880 | —- | M] (Microsoft Corporation) [Kernel | System | Running] – C:\WINDOWS\SYSTEM32\DRIVERS\tcpip6.sys – (Tcpip6)
DRV - [2008/04/13 13:56:06 | 000,088,320 | —- | M] (Microsoft Corporation) [Kernel | Auto | Running] – C:\WINDOWS\SYSTEM32\DRIVERS\nwlnkipx.sys – (NwlnkIpx)
DRV - [2007/06/15 12:25:46 | 000,049,904 | R— | M] (Avanquest Software) [Kernel | On_Demand | Stopped] – C:\WINDOWS\SYSTEM32\DRIVERS\BVRPMPR5.SYS – (BVRPMPR5)
DRV - [2007/02/25 11:10:48 | 000,005,376 | –S- | M] (Gteko Ltd.) [Kernel | Auto | Running] – C:\WINDOWS\SYSTEM32\DRIVERS\dsunidrv.sys – (dsunidrv)
DRV - [2006/10/05 15:07:28 | 000,004,736 | —- | M] (Gteko Ltd.) [Kernel | On_Demand | Stopped] – C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys – (DSproct)
DRV - [2005/09/20 11:22:37 | 000,009,344 | R— | M] (Hewlett Packard) [Kernel | On_Demand | Stopped] – C:\WINDOWS\SYSTEM32\DRIVERS\hpfxbulk.sys – (HPFXBULK)
DRV - [2004/11/19 04:23:10 | 000,008,552 | —- | M] (Windows ® 2000 DDK provider) [Kernel | Auto | Running] – C:\WINDOWS\System32\drivers\asctrm.sys – (ASCTRM)
DRV - [2004/10/07 20:16:04 | 000,035,840 | —- | M] (Oak Technology Inc.) [Kernel | System | Running] – C:\WINDOWS\System32\drivers\AFS2K.SYS – (AFS2K)
DRV - [2004/08/04 06:00:00 | 000,063,232 | —- | M] (Microsoft Corporation) [Kernel | Auto | Running] – C:\WINDOWS\SYSTEM32\DRIVERS\NWLNKNB.SYS – (NwlnkNb)
DRV - [2004/08/04 06:00:00 | 000,055,936 | —- | M] (Microsoft Corporation) [Kernel | Auto | Running] – C:\WINDOWS\SYSTEM32\DRIVERS\NWLNKSPX.SYS – (NwlnkSpx)
DRV - [2004/08/03 22:31:20 | 000,036,224 | —- | M] (ADMtek Incorporated.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\SYSTEM32\DRIVERS\an983.sys – (AN983)
DRV - [2003/11/17 16:59:20 | 000,212,224 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\SYSTEM32\DRIVERS\HSFHWBS2.sys – (HSFHWBS2)
DRV - [2003/11/17 16:58:02 | 000,680,704 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\SYSTEM32\DRIVERS\HSF_CNXT.sys – (winachsf)
DRV - [2003/11/17 16:56:26 | 001,042,432 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\SYSTEM32\DRIVERS\HSF_DP.sys – (HSF_DP)
DRV - [2002/12/17 05:41:10 | 000,076,288 | —- | M] (Rainbow Technologies, Inc.) [Kernel | Auto | Running] – C:\WINDOWS\System32\Drivers\SENTINEL.SYS – (Sentinel)
DRV - [2002/11/08 14:45:06 | 000,017,217 | —- | M] (Dell Computer Corporation) [Kernel | System | Running] – C:\WINDOWS\SYSTEM32\DRIVERS\omci.sys – (omci)
DRV - [2001/10/24 19:16:10 | 000,036,224 | R— | M] (LinkSys Group Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\SYSTEM32\DRIVERS\lne100v5.sys – (LNE100) Linksys LNE100TX(v5)
DRV - [2000/02/03 14:53:12 | 000,024,608 | —- | M] () [Kernel | System | Running] – C:\WINDOWS\system32\ckldrv.sys – (NetworkX)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.earthlink.net/AL/Search


IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,First Home Page = http://www.dell4me.com/myway
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,First Home Page = http://www.dell4me.com/myway
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-2336832311-1325935186-3394737582-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
IE - HKU\S-1-5-21-2336832311-1325935186-3394737582-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
IE - HKU\S-1-5-21-2336832311-1325935186-3394737582-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========


FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pack.google.com/Google Updater;version=13: C:\Program Files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll (Google)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@viewpoint.com/VMP: C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll ()
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Documents and Settings\tmiadmin\Local Settings\Application Data\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Documents and Settings\tmiadmin\Local Settings\Application Data\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.0.10\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009/05/12 11:56:26 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.0.10\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/01/30 15:28:44 | 000,000,000 | —D | M]

[2012/01/30 07:52:04 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\tmiadmin\Application Data\Mozilla\Extensions
[2012/01/30 08:15:21 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\tmiadmin\Application Data\Mozilla\Firefox\Profiles\j6trukck.default\extensions
[2012/01/30 08:15:21 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\tmiadmin\Application Data\Mozilla\Firefox\Profiles\j6trukck.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2009/01/26 12:44:27 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2007/07/26 11:05:16 | 000,001,329 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\crawlersrch.xml

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{googl
e:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chro
me&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client
=chrome&hl={language}&q={searchTerms}
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Documents and Settings\tmiadmin\Local Settings\Application Data\Google\Chrome\Application\16.0.912.77\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Documents and Settings\tmiadmin\Local Settings\Application Data\Google\Chrome\Application\16.0.912.77\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Documents and Settings\tmiadmin\Local Settings\Application Data\Google\Chrome\Application\16.0.912.77\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Acrobat 7.0\Reader\Browser\nppdf32.dll
CHR - plugin: QuickTime Plug-in 6.3 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 6.3 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 6.3 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 6.3 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 6.3 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 6.3 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npdrmv2.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npwmsdrm.dll
CHR - plugin: Windows Media Player Plug-in Dynamic Link Library (Enabled) = C:\Program Files\Windows Media Player\npdsplay.dll
CHR - plugin: Google Update (Enabled) = C:\Documents and Settings\tmiadmin\Local Settings\Application Data\Google\Update\1.3.21.79\npGoogleUpdate3.dll
CHR - plugin: Google Updater (Enabled) = C:\Program Files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
CHR - plugin: MetaStream 3 Plugin (Enabled) = C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: YouTube = C:\Documents and Settings\tmiadmin\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.3_0\
CHR - Extension: Google Search = C:\Documents and Settings\tmiadmin\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.16_0\
CHR - Extension: Gmail = C:\Documents and Settings\tmiadmin\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

O1 HOSTS File: ([2009/05/14 10:08:18 | 000,306,096 | R— | M]) - C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 10539 more lines…
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll File not found
O2 - BHO: (ElnkPubBHO Class) - {512ACF1B-64D9-4928-B382-A80556F28DB4} - C:\Program Files\EarthLink\Toolbar\ElnkPub.dll (EarthLink, Inc.)
O2 - BHO: (DriveLetterAccess) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\SYSTEM32\dla\tfswshx.dll (Sonic Solutions)
O2 - BHO: (ElnkProtectionBHO Class) - {9579D574-D4D8-4335-9560-FE8641A013BD} - C:\Program Files\EarthLink\Toolbar\ProtctIE.dll (EarthLink, Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.7227.1100\swg.dll (Google Inc.)
O2 - BHO: (ElnkLegacyUninstBHO Class) - {E713904C-DF05-4C79-BBAD-02DB923253BE} - C:\Program Files\EarthLink\Toolbar\uninsttb.dll (EarthLink, Inc.)
O3 - HKLM\..\Toolbar: (EarthLink Toolbar) - {C7768536-96F8-4001-B1A2-90EE21279187} - C:\Program Files\EarthLink\Toolbar\Toolbar.dll (EarthLink, Inc.)
O3 - HKU\S-1-5-21-2336832311-1325935186-3394737582-1006\..\Toolbar\WebBrowser: (no name) - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - No CLSID value found.
O4 - HKLM..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe (Brother Industries, Ltd.)
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-2336832311-1325935186-3394737582-1006..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_1_0 -reboot 1 File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-2336832311-1325935186-3394737582-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - Reg Error: Key error. File not found
O9 - Extra Button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\SYSTEM32\nwprovau.dll (Microsoft Corporation)
O12 - Plugin for: .spop - C:\Program Files\Internet Explorer\PLUGINS\NPDocBox.dll (InterTrust Technologies Corporation, Inc.)
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} http://office.microsoft.com/templates/ieawsdc.cab (Microsoft Office Template and Media Control)
O16 - DPF: {032C5CBC-2272-438F-AC73-38EA92AF19BD} http://192.168.1.3/WebViewer.cab (WebViewer Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdat…b?1149864138515 (MUWebControl Class)
O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} file://C:\Program Files\Acadm 2000i\AcDcToday.ocx (AcDcToday Control)
O16 - DPF: {7B19E477-0FF8-11d4-9914-005004D3B3DB} http://java.sun.com/products/plugin/1.2/ji…122_008-win.cab (JavaPlugin.Object)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/products/plugin/1.2/ji…122_008-win.cab (JavaBeansBridge.Object)
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} https://h17000.www1.hp.com/ewfrf-JAVA/Secur…loadManager.ocx (Get_ActiveX Control)
O16 - DPF: {C6637286-300D-11D4-AE0A-0010830243BD} file://C:\Program Files\Acadm 2000i\InstFred.ocx (InstaFred Control)
O16 - DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} http://java.sun.com/products/plugin/autodl…indows-i586.cab (Java Plug-in 1.4.2_03)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwa…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E9348280-2D74-4933-BE25-73D946926795} http://h20270.www2.hp.com/ediags/gmn/insta…cdetection3.cab (DeviceEnum Class)
O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} file://C:\Program Files\Acadm 2000i\AcPreview.ocx (AcPreview Control)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer =
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9D9D590B-2089-4E24-BBB5-A7BE9F8880CE}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E6DF896F-66C1-49B0-BDF7-7E03FBF249DD}: NameServer = 4.2.2.2,24.25.5.61
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: System - (cspuf.exe) - File not found
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\SYSTEM32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\DELL.BMP
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005/05/25 11:11:13 | 000,000,047 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2012/02/02 08:50:15 | 000,000,000 | —D | C] – C:\Documents and Settings\tmiadmin\Desktop\avcheck
[2012/01/31 09:55:58 | 000,000,000 | —D | C] – C:\Documents and Settings\tmiadmin\Local Settings\Application Data\Identities
[2012/01/31 09:25:58 | 000,000,000 | —D | C] – C:\Documents and Settings\tmiadmin\Application Data\Brother
[2012/01/31 08:30:04 | 000,000,000 | —D | C] – C:\Documents and Settings\tmiadmin\My Documents\My Labels
[2012/01/31 08:28:16 | 000,000,000 | —D | C] – C:\Documents and Settings\tmiadmin\Local Settings\Application Data\Temp
[2012/01/31 08:02:51 | 000,000,000 | —D | C] – C:\SHOP DATA
[2012/01/30 15:29:36 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Adobe AIR
[2012/01/30 15:26:03 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Adobe
[2012/01/30 15:01:55 | 000,000,000 | —D | C] – C:\Documents and Settings\tmiadmin\My Documents\Downloads
[2012/01/30 14:56:19 | 000,000,000 | —D | C] – C:\Documents and Settings\tmiadmin\Application Data\AdobeUM
[2012/01/30 14:54:55 | 000,000,000 | —D | C] – C:\Documents and Settings\tmiadmin\Local Settings\Application Data\Adobe
[2012/01/30 14:42:42 | 000,237,072 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\MpSigStub.exe
[2012/01/30 14:40:33 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Security Client
[2012/01/30 14:28:42 | 000,000,000 | —D | C] – C:\Documents and Settings\tmiadmin\Application Data\PC-FAX TX
[2012/01/30 14:23:40 | 000,000,000 | —D | C] – C:\Documents and Settings\tmiadmin\Start Menu\Programs\Google Chrome
[2012/01/30 13:53:44 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Brother
[2012/01/30 13:53:13 | 000,006,784 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\serscan.sys
[2012/01/30 13:53:01 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Documents\BrFaxRx
[2012/01/30 13:52:08 | 000,055,808 | —- | C] (Brother Industries,Ltd.) – C:\WINDOWS\System32\brinsstr.dll
[2012/01/30 13:52:07 | 000,176,128 | —- | C] (Brother Industries, Ltd.) – C:\WINDOWS\System32\BROSNMP.DLL
[2012/01/30 13:52:07 | 000,073,728 | —- | C] (Brother Industries Ltd.) – C:\WINDOWS\System32\BrDctF2.dll
[2012/01/30 13:52:07 | 000,005,120 | —- | C] (Brother Industries Ltd.) – C:\WINDOWS\System32\BrDctF2L.dll
[2012/01/30 13:52:07 | 000,003,072 | —- | C] (Brother Industries Ltd.) – C:\WINDOWS\System32\BrDctF2S.dll
[2012/01/30 13:51:56 | 000,070,656 | —- | C] (Brother Industries,Ltd.) – C:\WINDOWS\System32\BrWiaNCp.dll
[2012/01/30 13:51:56 | 000,070,144 | —- | C] (Brother Industries, Ltd.) – C:\WINDOWS\System32\BrNetSti.dll
[2012/01/30 13:51:56 | 000,044,032 | —- | C] (Brother Industries,Ltd) – C:\WINDOWS\System32\Brnsplg.dll
[2012/01/30 13:51:54 | 001,530,880 | —- | C] (Brother Industries, Ltd.) – C:\WINDOWS\System32\BrWia08b.dll
[2012/01/30 13:51:54 | 000,111,928 | —- | C] (Brother Industries Ltd) – C:\WINDOWS\System32\BRRBTOOL.EXE
[2012/01/30 13:51:54 | 000,077,824 | —- | C] (Brother Industries, Ltd.) – C:\WINDOWS\System32\BRLMW03A.DLL
[2012/01/30 13:51:54 | 000,024,223 | —- | C] (Brother Industries, Ltd) – C:\WINDOWS\System32\BRLM03A.DLL
[2012/01/30 13:51:53 | 000,000,000 | —D | C] – C:\Brother
[2012/01/30 13:51:51 | 000,126,976 | —- | C] (Brother Industries, Ltd.) – C:\WINDOWS\System32\BrfxD05a.dll
[2012/01/30 13:51:50 | 000,167,936 | —- | C] (brother) – C:\WINDOWS\System32\NSSearch.dll
[2012/01/30 13:51:50 | 000,131,072 | —- | C] (Brother Industries,Ltd.) – C:\WINDOWS\brunin03.dll
[2012/01/30 13:51:50 | 000,118,784 | —- | C] (Brother Industries,LTD.) – C:\WINDOWS\System32\BrMfNt.dll
[2012/01/30 13:51:50 | 000,073,728 | —- | C] (Brother Industories Ltd. P&S Company) – C:\WINDOWS\System32\BRCrypt.dll
[2012/01/30 13:51:13 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Brother
[2012/01/30 13:51:09 | 000,000,000 | —D | C] – C:\Documents and Settings\tmiadmin\Application Data\InstallShield
[2012/01/30 13:43:45 | 000,014,048 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\spmsg2.dll
[2012/01/30 11:46:06 | 000,000,000 | —D | C] – C:\SHOP SHARE
[2012/01/30 10:09:21 | 000,000,000 | R–D | C] – C:\Documents and Settings\tmiadmin\Start Menu\Programs\Administrative Tools
[2012/01/30 09:15:53 | 000,000,000 | —D | C] – C:\Documents and Settings\tmiadmin\Local Settings\Application Data\Google
[2012/01/30 08:34:52 | 000,000,000 | —D | C] – C:\Program Files\RealVNC
[2012/01/30 08:34:52 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\RealVNC
[2012/01/30 08:22:29 | 000,000,000 | —D | C] – C:\Documents and Settings\tmiadmin\Application Data\Macromedia
[2012/01/30 08:22:29 | 000,000,000 | —D | C] – C:\Documents and Settings\tmiadmin\Application Data\Adobe
[2012/01/30 08:06:49 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Space Plasma 3D Screensaver
[2012/01/30 08:06:48 | 001,517,056 | —- | C] (Digital Minds Software) – C:\WINDOWS\System32\Space_Plasma_3D_Screensaver.scr
[2012/01/30 08:06:48 | 000,000,000 | —D | C] – C:\Program Files\Space Plasma 3D Screensaver
[2012/01/30 08:06:48 | 000,000,000 | —D | C] – C:\Documents and Settings\tmiadmin\Local Settings\Application Data\Digital Minds Software
[2012/01/30 08:01:45 | 000,000,000 | —D | C] – C:\Documents and Settings\tmiadmin\Application Data\Windows Search
[2012/01/30 07:51:58 | 000,000,000 | —D | C] – C:\Documents and Settings\tmiadmin\Local Settings\Application Data\Mozilla
[2012/01/30 07:51:58 | 000,000,000 | —D | C] – C:\Documents and Settings\tmiadmin\Application Data\Mozilla
[2012/01/30 07:51:09 | 000,000,000 | —D | C] – C:\Documents and Settings\tmiadmin\Application Data\EarthLink
[2012/01/30 07:49:29 | 000,000,000 | —D | C] – C:\Documents and Settings\tmiadmin\Local Settings\Application Data\Musicmatch
[2012/01/30 07:48:43 | 000,000,000 | -HSD | C] – C:\Documents and Settings\tmiadmin\IETldCache
[2012/01/30 07:48:11 | 000,000,000 | —D | C] – C:\Documents and Settings\tmiadmin\Application Data\Jasc Software Inc
[2012/01/30 07:48:11 | 000,000,000 | —D | C] – C:\Documents and Settings\tmiadmin\Application Data\Identities
[2012/01/30 07:48:10 | 000,000,000 | –SD | C] – C:\Documents and Settings\tmiadmin\Application Data\Microsoft
[2012/01/30 07:48:10 | 000,000,000 | RH-D | C] – C:\Documents and Settings\tmiadmin\SendTo
[2012/01/30 07:48:10 | 000,000,000 | RH-D | C] – C:\Documents and Settings\tmiadmin\Recent
[2012/01/30 07:48:10 | 000,000,000 | RH-D | C] – C:\Documents and Settings\tmiadmin\Application Data
[2012/01/30 07:48:10 | 000,000,000 | R–D | C] – C:\Documents and Settings\tmiadmin\Start Menu\Programs\Startup
[2012/01/30 07:48:10 | 000,000,000 | R–D | C] – C:\Documents and Settings\tmiadmin\Start Menu
[2012/01/30 07:48:10 | 000,000,000 | R–D | C] – C:\Documents and Settings\tmiadmin\My Documents\My Videos
[2012/01/30 07:48:10 | 000,000,000 | R–D | C] – C:\Documents and Settings\tmiadmin\My Documents\My Pictures
[2012/01/30 07:48:10 | 000,000,000 | R–D | C] – C:\Documents and Settings\tmiadmin\My Documents\My Music
[2012/01/30 07:48:10 | 000,000,000 | R–D | C] – C:\Documents and Settings\tmiadmin\My Documents
[2012/01/30 07:48:10 | 000,000,000 | R–D | C] – C:\Documents and Settings\tmiadmin\Favorites
[2012/01/30 07:48:10 | 000,000,000 | R–D | C] – C:\Documents and Settings\tmiadmin\Start Menu\Programs\Accessories
[2012/01/30 07:48:10 | 000,000,000 | -HSD | C] – C:\Documents and Settings\tmiadmin\Cookies
[2012/01/30 07:48:10 | 000,000,000 | -H-D | C] – C:\Documents and Settings\tmiadmin\Templates
[2012/01/30 07:48:10 | 000,000,000 | -H-D | C] – C:\Documents and Settings\tmiadmin\PrintHood
[2012/01/30 07:48:10 | 000,000,000 | -H-D | C] – C:\Documents and Settings\tmiadmin\NetHood
[2012/01/30 07:48:10 | 000,000,000 | -H-D | C] – C:\Documents and Settings\tmiadmin\Local Settings
[2012/01/30 07:48:10 | 000,000,000 | —D | C] – C:\Documents and Settings\tmiadmin\Application Data\Sun
[2012/01/30 07:48:10 | 000,000,000 | —D | C] – C:\Documents and Settings\tmiadmin\Application Data\Sonic
[2012/01/30 07:48:10 | 000,000,000 | —D | C] – C:\Documents and Settings\tmiadmin\My Documents\My PSP8 Files
[2012/01/30 07:48:10 | 000,000,000 | —D | C] – C:\Documents and Settings\tmiadmin\Local Settings\Application Data\Microsoft
[2012/01/30 07:48:10 | 000,000,000 | —D | C] – C:\Documents and Settings\tmiadmin\Desktop
[2012/01/30 07:48:10 | 000,000,000 | —D | C] – C:\Documents and Settings\tmiadmin\Start Menu\Programs\Dell Accessories
[2012/01/30 07:48:10 | 000,000,000 | —D | C] – C:\Documents and Settings\tmiadmin\Local Settings\Application Data\BVRP Software
[2012/01/30 07:48:10 | 000,000,000 | —D | C] – C:\Documents and Settings\tmiadmin\Local Settings\Application Data\ApplicationHistory
[2012/01/30 07:48:10 | 000,000,000 | —D | C] – C:\Documents and Settings\tmiadmin\Local Settings\Application Data\{7148F0A6-6813-11D6-A77B-00B0D0142030}
[2012/01/30 07:28:56 | 000,000,000 | R–D | C] – C:\My Documents
[2012/01/27 14:21:02 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Silverlight
[2012/01/27 14:06:22 | 000,000,000 | —D | C] – C:\WINDOWS\ie8updates
[2012/01/27 14:05:35 | 000,743,424 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iedvtool.dll
[2012/01/27 14:03:06 | 000,000,000 | -H-D | C] – C:\WINDOWS\ie8
[2012/01/27 12:10:13 | 000,000,000 | —D | C] – C:\WINDOWS\SxsCaPendDel
[2012/01/27 06:49:25 | 000,954,368 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mfc40.dll
[2012/01/27 06:49:24 | 000,953,856 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mfc40u.dll
[2012/01/27 06:48:05 | 000,119,808 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\t2embed.dll
[2012/01/27 06:48:05 | 000,081,920 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fontsub.dll
[2012/01/27 06:47:16 | 000,617,472 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\comctl32.dll
[2012/01/27 06:47:02 | 000,040,960 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ndproxy.sys
[2012/01/27 06:46:46 | 000,744,448 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\helpsvc.exe
[2012/01/27 06:44:32 | 000,471,552 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\aclayers.dll
[2012/01/27 06:41:46 | 000,139,656 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\rdpwd.sys
[2012/01/27 06:39:44 | 000,105,472 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mup.sys
[2012/01/27 06:38:10 | 003,558,912 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\moviemk.exe
[2012/01/27 06:36:27 | 000,010,496 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ndistapi.sys
[2012/01/27 06:33:46 | 000,045,568 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\wab.exe
[2012/01/27 06:32:32 | 000,590,848 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\rpcrt4.dll
[2008/07/07 13:39:42 | 000,062,910 | —- | C] ($PROGRAMNAME) – C:\Program Files\Uninstall.exe
[5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/02/02 08:54:00 | 000,000,438 | -H– | M] () – C:\WINDOWS\tasks\User_Feed_Synchronization-{6A30A62C-87F7-4B99-9A80-0FAEE897B8FD}.job
[2012/02/02 08:49:37 | 000,461,960 | —- | M] () – C:\WINDOWS\System32\PERFH009.DAT
[2012/02/02 08:49:37 | 000,078,070 | —- | M] () – C:\WINDOWS\System32\PERFC009.DAT
[2012/02/02 08:32:02 | 000,000,990 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2336832311-1325935186-3394737582-1006UA.job
[2012/02/02 08:07:01 | 000,000,886 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2012/02/01 17:32:00 | 000,000,938 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2336832311-1325935186-3394737582-1006Core.job
[2012/02/01 15:07:00 | 000,000,882 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2012/02/01 13:17:10 | 000,000,868 | —- | M] () – C:\WINDOWS\tasks\Google Software Updater.job
[2012/01/31 09:40:51 | 000,002,139 | —- | M] () – C:\Documents and Settings\tmiadmin\Desktop\CAS PART LABELS.lbx
[2012/01/31 08:24:32 | 000,000,427 | —- | M] () – C:\Documents and Settings\tmiadmin\Desktop\Shortcut to SHOP DATA.lnk
[2012/01/31 08:01:09 | 000,002,206 | —- | M] () – C:\WINDOWS\System32\WPA.DBL
[2012/01/31 08:00:32 | 000,002,048 | –S- | M] () – C:\WINDOWS\BOOTSTAT.DAT
[2012/01/31 07:44:05 | 000,237,072 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\MpSigStub.exe
[2012/01/30 15:28:45 | 000,001,734 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Adobe Reader X.lnk
[2012/01/30 14:41:06 | 000,001,945 | —- | M] () – C:\WINDOWS\epplauncher.mif
[2012/01/30 14:28:47 | 000,000,752 | —- | M] () – C:\WINDOWS\Brpfx04a.ini
[2012/01/30 14:23:45 | 000,002,309 | —- | M] () – C:\Documents and Settings\tmiadmin\Desktop\Google Chrome.lnk
[2012/01/30 14:23:45 | 000,002,287 | —- | M] () – C:\Documents and Settings\tmiadmin\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2012/01/30 14:16:13 | 000,221,917 | —- | M] () – C:\Documents and Settings\tmiadmin\Local Settings\Application Data\census.cache
[2012/01/30 14:16:08 | 000,207,812 | —- | M] () – C:\Documents and Settings\tmiadmin\Local Settings\Application Data\ars.cache
[2012/01/30 13:53:34 | 000,000,410 | —- | M] () – C:\WINDOWS\BRWMARK.INI
[2012/01/30 13:53:01 | 000,000,093 | —- | M] () – C:\WINDOWS\brpcfx.ini
[2012/01/30 13:53:01 | 000,000,086 | —- | M] () – C:\WINDOWS\Brfaxrx.ini
[2012/01/30 13:53:01 | 000,000,050 | —- | M] () – C:\WINDOWS\System32\bd8480dn.dat
[2012/01/30 13:43:55 | 000,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2012/01/30 13:43:49 | 000,001,404 | —- | M] () – C:\Documents and Settings\tmiadmin\Application Data\Microsoft\Internet Explorer\Quick Launch\XPS Viewer EP.lnk
[2012/01/30 13:43:48 | 000,001,386 | —- | M] () – C:\Documents and Settings\All Users\Desktop\XPS Viewer EP.lnk
[2012/01/30 13:00:12 | 000,000,036 | —- | M] () – C:\Documents and Settings\tmiadmin\Local Settings\Application Data\housecall.guid.cache
[2012/01/30 12:09:00 | 000,000,472 | —- | M] () – C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2012/01/30 09:08:00 | 000,000,002 | —- | M] () – C:\WINDOWS\msoffice.ini
[2012/01/30 08:34:52 | 000,000,713 | —- | M] () – C:\Documents and Settings\tmiadmin\Application Data\Microsoft\Internet Explorer\Quick Launch\VNC Viewer 4.lnk
[2012/01/30 08:34:52 | 000,000,695 | —- | M] () – C:\Documents and Settings\tmiadmin\Desktop\VNC Viewer 4.lnk
[2012/01/30 08:25:06 | 000,000,211 | RHS- | M] () – C:\BOOT.INI
[2012/01/30 08:06:49 | 000,001,631 | —- | M] () – C:\Documents and Settings\tmiadmin\Desktop\Space Plasma 3D Screensaver.lnk
[2012/01/30 07:53:05 | 000,000,376 | —- | M] () – C:\WINDOWS\ODBC.INI
[2012/01/30 07:49:04 | 000,000,815 | —- | M] () – C:\Documents and Settings\tmiadmin\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2012/01/30 07:48:56 | 000,000,782 | —- | M] () – C:\Documents and Settings\tmiadmin\Desktop\Windows Media Player.lnk
[2012/01/30 07:25:00 | 000,425,408 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/01/31 09:26:35 | 000,002,139 | —- | C] () – C:\Documents and Settings\tmiadmin\Desktop\CAS PART LABELS.lbx
[2012/01/31 08:24:32 | 000,000,427 | —- | C] () – C:\Documents and Settings\tmiadmin\Desktop\Shortcut to SHOP DATA.lnk
[2012/01/30 15:28:45 | 000,001,734 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Adobe Reader X.lnk
[2012/01/30 15:28:44 | 000,001,804 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Adobe Reader X.lnk
[2012/01/30 14:40:39 | 000,001,680 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Security Essentials.lnk
[2012/01/30 14:23:45 | 000,002,309 | —- | C] () – C:\Documents and Settings\tmiadmin\Desktop\Google Chrome.lnk
[2012/01/30 14:23:45 | 000,002,287 | —- | C] () – C:\Documents and Settings\tmiadmin\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2012/01/30 14:22:58 | 000,000,990 | —- | C] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2336832311-1325935186-3394737582-1006UA.job
[2012/01/30 14:22:58 | 000,000,938 | —- | C] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2336832311-1325935186-3394737582-1006Core.job
[2012/01/30 13:53:34 | 000,000,410 | —- | C] () – C:\WINDOWS\BRWMARK.INI
[2012/01/30 13:53:01 | 000,000,752 | —- | C] () – C:\WINDOWS\Brpfx04a.ini
[2012/01/30 13:53:01 | 000,000,093 | —- | C] () – C:\WINDOWS\brpcfx.ini
[2012/01/30 13:53:01 | 000,000,050 | —- | C] () – C:\WINDOWS\System32\bd8480dn.dat
[2012/01/30 13:51:54 | 000,045,056 | —- | C] () – C:\WINDOWS\System32\BRTCPCON.DLL
[2012/01/30 13:51:54 | 000,000,114 | —- | C] () – C:\WINDOWS\System32\BRLMW03A.INI
[2012/01/30 13:51:53 | 000,000,050 | —- | C] () – C:\WINDOWS\System32\BRADM08A.DAT
[2012/01/30 13:51:52 | 000,006,224 | —- | C] () – C:\WINDOWS\CVRPAGE.BMP
[2012/01/30 13:51:51 | 000,000,086 | —- | C] () – C:\WINDOWS\Brfaxrx.ini
[2012/01/30 13:51:51 | 000,000,000 | —- | C] () – C:\WINDOWS\brdfxspd.dat
[2012/01/30 13:51:50 | 000,106,496 | —- | C] () – C:\WINDOWS\System32\BrMuSNMP.dll
[2012/01/30 13:43:49 | 000,001,404 | —- | C] () – C:\Documents and Settings\tmiadmin\Application Data\Microsoft\Internet Explorer\Quick Launch\XPS Viewer EP.lnk
[2012/01/30 13:43:48 | 000,001,392 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\XPS Viewer EP.lnk
[2012/01/30 13:43:48 | 000,001,386 | —- | C] () – C:\Documents and Settings\All Users\Desktop\XPS Viewer EP.lnk
[2012/01/30 13:08:59 | 000,221,917 | —- | C] () – C:\Documents and Settings\tmiadmin\Local Settings\Application Data\census.cache
[2012/01/30 13:08:38 | 000,207,812 | —- | C] () – C:\Documents and Settings\tmiadmin\Local Settings\Application Data\ars.cache
[2012/01/30 13:00:12 | 000,000,036 | —- | C] () – C:\Documents and Settings\tmiadmin\Local Settings\Application Data\housecall.guid.cache
[2012/01/30 09:08:00 | 000,000,002 | —- | C] () – C:\WINDOWS\msoffice.ini
[2012/01/30 08:34:52 | 000,000,713 | —- | C] () – C:\Documents and Settings\tmiadmin\Application Data\Microsoft\Internet Explorer\Quick Launch\VNC Viewer 4.lnk
[2012/01/30 08:34:52 | 000,000,695 | —- | C] () – C:\Documents and Settings\tmiadmin\Desktop\VNC Viewer 4.lnk
[2012/01/30 08:11:57 | 000,001,945 | —- | C] () – C:\WINDOWS\epplauncher.mif
[2012/01/30 08:06:49 | 000,001,631 | —- | C] () – C:\Documents and Settings\tmiadmin\Desktop\Space Plasma 3D Screensaver.lnk
[2012/01/30 07:49:04 | 000,000,803 | —- | C] () – C:\Documents and Settings\tmiadmin\Start Menu\Programs\Internet Explorer.lnk
[2012/01/30 07:48:56 | 000,000,788 | —- | C] () – C:\Documents and Settings\tmiadmin\Start Menu\Programs\Windows Media Player.lnk
[2012/01/30 07:48:56 | 000,000,782 | —- | C] () – C:\Documents and Settings\tmiadmin\Desktop\Windows Media Player.lnk
[2012/01/30 07:48:19 | 000,001,769 | —- | C] () – C:\Documents and Settings\tmiadmin\Application Data\Microsoft\Internet Explorer\Quick Launch\Musicmatch Jukebox.lnk
[2012/01/30 07:48:19 | 000,000,815 | —- | C] () – C:\Documents and Settings\tmiadmin\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2012/01/30 07:48:19 | 000,000,742 | —- | C] () – C:\Documents and Settings\tmiadmin\Application Data\Microsoft\Internet Explorer\Quick Launch\QuickTime Player.lnk
[2012/01/30 07:48:19 | 000,000,079 | —- | C] () – C:\Documents and Settings\tmiadmin\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf
[2012/01/30 07:48:18 | 000,000,000 | -H– | C] () – C:\Documents and Settings\tmiadmin\hpothb07.tif
[2012/01/30 07:48:18 | 000,000,000 | -H– | C] () – C:\Documents and Settings\tmiadmin\hpothb07.dat
[2012/01/30 07:48:11 | 000,001,503 | —- | C] () – C:\Documents and Settings\tmiadmin\Start Menu\Programs\Remote Assistance.lnk
[2012/01/30 07:48:11 | 000,000,738 | —- | C] () – C:\Documents and Settings\tmiadmin\Start Menu\Programs\Outlook Express.lnk
[2012/01/30 07:35:56 | 000,000,438 | -H– | C] () – C:\WINDOWS\tasks\User_Feed_Synchronization-{6A30A62C-87F7-4B99-9A80-0FAEE897B8FD}.job
[2012/01/27 12:05:11 | 000,001,374 | —- | C] () – C:\WINDOWS\imsins.BAK
[2012/01/26 16:52:19 | 000,000,886 | —- | C] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2012/01/26 16:52:10 | 000,000,882 | —- | C] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2009/05/14 09:00:28 | 000,000,552 | —- | C] () – C:\WINDOWS\System32\d3d8caps.dat
[2009/03/16 14:24:39 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2009/01/08 14:40:16 | 000,765,952 | —- | C] () – C:\WINDOWS\System32\xvidcore.dll
[2009/01/08 14:40:16 | 000,180,224 | —- | C] () – C:\WINDOWS\System32\xvidvfw.dll
[2008/07/07 13:39:42 | 000,000,000 | —- | C] () – C:\Program Files\uninstall.dat
[2008/05/31 10:38:54 | 000,036,864 | —- | C] () – C:\WINDOWS\uinst001.exe
[2008/05/31 10:25:13 | 000,086,016 | R— | C] () – C:\WINDOWS\System32\QL57F.DLL
[2008/05/31 10:25:13 | 000,000,971 | R— | C] () – C:\WINDOWS\System32\QL57L.INI
[2008/05/26 20:59:42 | 000,018,904 | —- | C] () – C:\WINDOWS\System32\structuredqueryschematrivial.bin
[2008/05/26 20:59:40 | 000,106,605 | —- | C] () – C:\WINDOWS\System32\structuredqueryschema.bin
[2007/09/27 09:51:02 | 000,020,698 | —- | C] () – C:\WINDOWS\System32\idxcntrs.ini
[2007/09/27 09:48:48 | 000,030,628 | —- | C] () – C:\WINDOWS\System32\gsrvctr.ini
[2007/09/27 09:48:28 | 000,031,698 | —- | C] () – C:\WINDOWS\System32\gthrctr.ini
[2007/01/22 10:54:02 | 000,000,367 | —- | C] () – C:\WINDOWS\System32\CNCMFP12.INI
[2007/01/17 18:47:24 | 000,000,134 | —- | C] () – C:\WINDOWS\Readiris.ini
[2007/01/17 18:47:19 | 000,023,040 | —- | C] () – C:\WINDOWS\System32\irisco32.dll
[2007/01/17 18:37:28 | 000,208,896 | —- | C] () – C:\WINDOWS\System32\HPPAPR01.DLL
[2007/01/17 18:37:28 | 000,000,508 | —- | C] () – C:\WINDOWS\System32\HPPAPR01.DAT
[2007/01/17 18:33:45 | 000,053,631 | —- | C] () – C:\WINDOWS\hppins02.dat
[2007/01/17 18:33:44 | 000,002,037 | —- | C] () – C:\WINDOWS\hppmdl02.dat
[2007/01/17 18:29:20 | 000,053,661 | —- | C] () – C:\WINDOWS\hppins02.dat.temp
[2007/01/17 18:29:20 | 000,002,037 | —- | C] () – C:\WINDOWS\hppmdl02.dat.temp
[2007/01/16 13:48:17 | 000,000,225 | —- | C] () – C:\WINDOWS\hpntwksetup.ini
[2007/01/16 13:29:26 | 000,000,560 | —- | C] () – C:\WINDOWS\hpbvspst.ini
[2007/01/16 13:29:02 | 000,001,432 | —- | C] () – C:\WINDOWS\hpbvnstp.ini
[2006/06/09 09:36:09 | 000,099,965 | —- | C] () – C:\WINDOWS\UninstallFirefox.exe
[2006/06/09 09:35:58 | 000,003,287 | —- | C] () – C:\WINDOWS\mozver.dat
[2006/01/24 14:44:32 | 000,593,920 | —- | C] () – C:\WINDOWS\System32\slmp4core.dll
[2005/07/05 12:24:57 | 000,000,059 | —- | C] () – C:\WINDOWS\hpoRW.dat
[2005/05/25 13:06:00 | 000,032,768 | —- | C] () – C:\WINDOWS\System32\instlsp.exe
[2005/05/18 14:44:10 | 000,042,266 | —- | C] () – C:\WINDOWS\avwin.ini
[2005/05/18 14:44:10 | 000,000,030 | —- | C] () – C:\WINDOWS\avx.ini
[2005/01/24 09:27:31 | 000,008,754 | —- | C] () – C:\WINDOWS\cadcam.INI
[2005/01/24 09:19:43 | 000,056,832 | —- | C] () – C:\WINDOWS\System32\ActPanel.dll
[2005/01/24 09:18:37 | 000,000,000 | —- | C] () – C:\WINDOWS\win1.ini
[2005/01/24 09:18:33 | 000,000,034 | —- | C] () – C:\WINDOWS\Crypkey.ini
[2005/01/24 09:18:30 | 000,027,648 | R— | C] () – C:\WINDOWS\Setup_ck.exe
[2005/01/24 09:18:30 | 000,024,608 | —- | C] () – C:\WINDOWS\System32\Ckldrv.sys
[2005/01/24 09:18:30 | 000,018,432 | —- | C] () – C:\WINDOWS\Setup_ck.dll
[2005/01/24 09:18:30 | 000,011,776 | —- | C] () – C:\WINDOWS\Ckrfresh.exe
[2004/11/19 04:31:36 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2004/11/19 04:29:54 | 000,000,429 | —- | C] () – C:\WINDOWS\wininit.ini
[2004/11/19 04:25:42 | 000,149,504 | —- | C] () – C:\WINDOWS\UNWISE.EXE
[2004/11/19 04:22:18 | 000,000,335 | —- | C] () – C:\WINDOWS\nsreg.dat
[2004/11/19 04:19:38 | 000,024,576 | —- | C] () – C:\WINDOWS\System32\javaw.exe
[2004/11/19 04:19:38 | 000,024,064 | —- | C] () – C:\WINDOWS\System32\java.exe
[2004/11/19 04:12:32 | 000,002,048 | –S- | C] () – C:\WINDOWS\BOOTSTAT.DAT
[2004/11/19 04:11:44 | 000,461,960 | —- | C] () – C:\WINDOWS\System32\PERFH009.DAT
[2004/11/19 04:11:44 | 000,078,070 | —- | C] () – C:\WINDOWS\System32\PERFC009.DAT
[2004/11/19 03:58:34 | 000,000,520 | —- | C] () – C:\WINDOWS\System32\OEMINFO.INI
[2004/09/15 23:03:14 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini
[2004/08/11 18:25:56 | 000,000,791 | —- | C] () – C:\WINDOWS\ORUN32.INI
[2004/08/11 18:20:10 | 000,425,408 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2004/08/11 18:14:38 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2004/08/11 18:12:16 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2004/08/11 11:31:24 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\OEMBIOS.BIN
[2004/08/11 11:31:24 | 000,004,627 | —- | C] () – C:\WINDOWS\System32\OEMBIOS.DAT
[2004/08/04 06:00:00 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\MLANG.DAT
[2004/08/04 06:00:00 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\PERFI009.DAT
[2004/08/04 06:00:00 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\DSSEC.DAT
[2004/08/04 06:00:00 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\MIB.BIN
[2004/08/04 06:00:00 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\PERFD009.DAT
[2004/08/04 06:00:00 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\SECUPD.DAT
[2004/08/04 06:00:00 | 000,001,804 | —- | C] () – C:\WINDOWS\System32\dcache.bin
[2004/08/04 06:00:00 | 000,001,793 | —- | C] () – C:\WINDOWS\System32\FXSPERF.INI
[2004/08/04 06:00:00 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\NOISE.DAT
[2004/07/19 17:01:02 | 000,045,056 | —- | C] () – C:\WINDOWS\SETPWRCG.EXE
[2004/05/26 16:09:26 | 000,024,576 | —- | C] () – C:\WINDOWS\System32\DSRIRREM.EXE
[2001/03/29 02:37:14 | 000,000,033 | —- | C] () – C:\WINDOWS\hppcap.ini
[2000/06/12 03:37:18 | 000,045,056 | —- | C] () – C:\WINDOWS\System32\mtstack.exe
[2000/05/08 04:20:00 | 000,045,056 | —- | C] () – C:\WINDOWS\trayhook.dll
[2000/05/08 04:20:00 | 000,020,480 | —- | C] () – C:\WINDOWS\sointgr.exe
[1999/01/22 21:46:58 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\MSRTEDIT.DLL
[1998/10/11 00:07:38 | 000,088,576 | —- | C] () – C:\WINDOWS\System32\Iticheck.dll

< End of report >
Post #6
otl extras


OTL Extras logfile created on: 2/2/2012 8:53:55 AM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Documents and Settings\tmiadmin\Desktop\avcheck
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

502.07 Mb Total Physical Memory | 185.45 Mb Available Physical Memory | 36.94% Memory free
1.20 Gb Paging File | 0.84 Gb Available in Paging File | 70.02% Paging File free
Paging file location(s): C:\pagefile.sys 756 1512 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 70.94 Gb Total Space | 54.80 Gb Free Space | 77.25% Space Free | Partition Type: NTFS

Computer Name: SHOP | User Name: tmiadmin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] – "%1" %*
htmlfile – Reg Error: Key error.
http [open] – "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
https [open] – "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"5900:TCP" = 5900:TCP:*:Enabled:vnc
"3389:TCP" = 3389:TCP:*:Enabled:@xpsp2res.dll,-22009
"54925:UDP" = 54925:UDP:*:Enabled:Brother Network Scanner

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"D:\setup\HPZNET01.EXE" = D:\setup\HPZNET01.EXE:*:Enabled:hpznet01.exe
"D:\setup\hppapd.exe" = D:\setup\hppapd.exe:*:Enabled:hppapd.exe
"D:\setup\HPPNICIFS01.EXE" = D:\setup\HPPNICIFS01.EXE:*:Enabled:hppnicifs01.exe
"D:\setup\HPNTWKEXE.EXE" = D:\setup\HPNTWKEXE.EXE:*:Enabled:hpntwkexe.exe
"D:\bin\IA\Core\MDM_Util.exe" = D:\bin\IA\Core\MDM_Util.exe:*:Enabled:MDM_Util
"C:\Program Files\Avira\AntiVir Desktop\update.exe" = C:\Program Files\Avira\AntiVir Desktop\update.exe:*:Enabled:update.exe
"C:\Program Files\AVG\AVG8\avgtray.exe" = C:\Program Files\AVG\AVG8\avgtray.exe:*:Enabled:AVG Free Tray Icon
"C:\Program Files\AVG\AVG8\avgui.exe" = C:\Program Files\AVG\AVG8\avgui.exe:*:Enabled:AVG Free User Interface
"C:\Unfold3D\FABRIWIN\ORTHO.EXE" = C:\Unfold3D\FABRIWIN\ORTHO.EXE:*:Enabled:3D Orthographic – (MetalSoft, Inc.)
"C:\Program Files\RealVNC\VNC4\winvnc4.exe" = C:\Program Files\RealVNC\VNC4\winvnc4.exe:*:Enabled:winvnc4.exe – (RealVNC Ltd.)
"C:\Program Files\Brother\Brmfl08i\FAXRX.exe" = C:\Program Files\Brother\Brmfl08i\FAXRX.exe:*:Enabled:FAXRX.EXE – (Brother Industries Ltd.)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00000409-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 Premium
"{004B8D14-7E3A-490A-ABB3-753535E169E3}" = Brother MFL-Pro Suite
"{01ADCC5D-45B4-45E4-AC5C-C06E044B16DF}" = hppIOFiles
"{01B93B3A-283F-411B-A648-69CABCACC986}" = Canon MF Drivers
"{05BFB060-4F22-4710-B0A2-2801A1B606C5}" = Microsoft Antimalware
"{09DA4F91-2A09-4232-AB8C-6BC740096DE3}" = Sonic Update Manager
"{0EB5D9B7-8E6C-4A9E-B74F-16B7EE89A67B}" = Microsoft Plus! Photo Story 2 LE
"{0EF45FEA-E3C1-4660-854A-810C1BA169E2}" = hppLJ3390
"{1206EF92-2E83-4859-ACCB-2048C3CB7DA6}" = Sonic DLA
"{132CA5D9-C745-4B0B-A3B2-8C7A6EC3EE7E}" = Canon MF Toolbox [removed].mf04
"{17334AAF-C9E7-483B-9F45-E3FCAF07FFA7}" = Intel® PROSet for Wired Connections
"{173D5E9E-8ABC-4EB2-B371-18AF8812A91D}" = hppFaxUtility
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}" = Google Earth
"{21657574-BD54-48A2-9450-EB03B2C7FC29}" = Sonic MyDVD
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{2637C347-9DAD-11D6-9EA2-00055D0CA761}" = Dell Media Experience
"{33BB4982-DC52-4886-A03B-F4C5C80BEE89}" = Windows Media Player 10
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{352310C3-E46B-42D3-8F32-54721FDD72D9}" = NetZeroInstallers
"{35BDEFF1-A610-4956-A00D-15453C116395}" = Internet Explorer Default Page
"{3F92ABBB-6BBF-11D5-B229-002078017FBF}" = NetWaiting
"{4B9F45E8-E3CE-40B4-9463-80A9B3481DEF}" = Banctec Service Agreement
"{4D82392D-AF90-4159-9A14-887BBC835191}" = hpp3390usg
"{4EC00390-2A9D-4140-8BE5-A984AB6543F3}" = FabriWIN
"{5081528F-5DD5-49BA-8213-9A6A13502497}" = Sentinel System Driver 5.41.1 (32-bit)
"{54B6DC7D-8C5B-4DFB-BC15-C010A3326B2B}" = Microsoft Security Client
"{5783F2D7-0005-0409-0000-0060B0CE6BBA}" = AutoCAD Mechanical 2000i
"{5905F42D-3F5F-4916-ADA6-94A3646AEE76}" = Dell Driver Reset Tool
"{606E5C0D-6039-42A7-988E-9D51DE773AFF}" = hppFonts
"{64FC0C98-B035-4530-B15D-3D30610B6DF1}" = HP Software Update
"{663D8AAF-CB71-4056-8C60-1D85BC576C6E}" = hppTooCool
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD 5.3
"{6A69D94E-C569-4154-9643-72E94D1DDFDA}" = XPS Essentials Pack
"{6E45BA47-383C-4C1E-8ED0-0D4845C293D7}" = Microsoft Plus! Digital Media Edition Installer
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7148F0A8-6813-11D6-A77B-00B0D0142030}" = Java 2 Runtime Environment, SE v1.4.2_03
"{76E41F43-59D2-4F30-BA42-9A762EE1E8DE}" = Avanquest update
"{7A3F0566-5E05-4919-9C98-456F6B5CF831}" = Get High Speed Internet!
"{7C4BCD17-BDBA-4078-9D8C-8CA8B7EABE77}" =
"{7E1DD3AD-71DE-4E6A-B5A9-BFC373D0BA55}" = MyInvoices & Estimates Deluxe
"{7EFA5E6F-74F7-4AFB-8AEA-AA790BD3A76D}" = DellSupport
"{7F142D56-3326-11D5-B229-002078017FBF}" = Modem Helper
"{81A34902-9D0B-4920-A25C-4CDC5D14B328}" = Jasc Paint Shop Pro 8 Dell Edition
"{8777AC6D-89F9-4793-8266-DE406F343E89}" = QFolder
"{88CF28D0-9327-11D4-B090-00E111105300}" = AutoVue SolidModel Pro, Desktop Edition
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel® Graphics Media Accelerator Driver
"{8B677453-F9D2-4387-B030-E669B28B8A08}" = hppToolBoxFX
"{8EF1122E-E90C-4EE9-AB0C-7FDE2BA42C26}" = Musicmatch Jukebox
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9541FED0-327F-4DF0-8B96-EF57EF622F19}" = Sonic RecordNow!
"{993CD8D4-AED6-45E2-8AA5-D7DFAA60DE6F}" = hppScanTo
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9B2CFE3B-7F55-4786-A20D-BB244914F6D8}" = EarthLink Setup Files
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A0B42136-C813-4FB4-84A1-C41E6F12410B}" = hppSendFax
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A5A93185-26A8-4F02-B021-D6E6A4396441}" = hppManuals3390
"{A5CC2A09-E9D3-49EC-923D-03874BBD4C2C}" = Windows Defender Signatures
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.2)
"{AF19F291-F22F-4798-9662-525305AE9E48}" = WordPerfect Office 12
"{B2023017-DEE4-44F7-8A71-CA6084BF534C}" = Brother P-touch Address Book 1.1
"{B376402D-58EA-45EA-BD50-DD924EB67A70}" = HP Memories Disc
"{B5FDA445-CAC4-4BA6-A8FB-A7212BD439DE}" = Microsoft XML Parser
"{B6300A7D-C1B6-4A25-861D-4AED96202FCD}" = Readiris Pro 10
"{B8C2A83F-20B0-49D9-BA2B-6495DD8639ED}" = EarthLink Toolbar
"{BD29EBAC-AD7D-4b27-B727-4CC6AC52D36B}" = MarketResearch
"{C057F6D0-0E4C-4B18-B645-9D0804FCFAFD}" = EarthLink Common Authentication
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CC000127-5E5D-4A1C-90CB-EEAAAC1E3AC0}" = Jasc Paint Shop Photo Album
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D5E31EEE-CD8A-4E01-87F1-119C4A3201FD}" = hppscan3390
"{DB7F1657-6164-40AE-8A94-8F785C0C3E3F}" = hppFaxDrv3390
"{DEDDF868-E272-47E9-A8EA-E5CC7B179077}" = Brother QL-570 User's Guide
"{DF9A6075-9308-4572-8932-A4316243C4D9}" = Brother P-touch Editor 5.0
"{E3BFEE55-39E2-4BE0-B966-89FE583822C1}" = Dell Support Center
"{E646DCF0-5A68-11D5-B229-002078017FBF}" = Digital Line Detect
"{E93E5EF6-D361-481E-849D-F16EF5C78EBC}" = Musicmatch for Windows Media Player
"{E94E150C-762B-4cd1-8A54-7228A07C0710}" = HP LaserJet 3050/3052/3055/3390/3392 2.0
"{F2270CE2-0373-4D39-8783-2F1542B7D310}" = hpzTLBXFX
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"{FE23D063-934D-4829-A0D8-00634CE79B4A}" = Adobe AIR
"{FE3F3C9B-2C29-4FEE-A74F-11E436729F2C}" = Scan
"{FFC18A8F-40A9-4C52-B1CD-BF4F65A61C55}" = MyInvoices & Estimates Deluxe
"Adobe Acrobat 5.0" = Adobe Acrobat 5.0
"Adobe AIR" = Adobe AIR
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"AnswerWorks" = AnswerWorks Runtime
"BroadJump Client Foundation" = BroadJump Client Foundation
"CNXT_MODEM_PCI_VEN_14F1&DEV_2F20&SUBSYS_200F14F1" = Conexant D850 56K V.9x DFVc Modem
"Data Access Objects (DAO) 3.5" = Data Access Objects (DAO) 3.5
"Dell Digital Jukebox Driver" = Dell Digital Jukebox Driver
"FabTraningCDDeinstKey" = FabTrainingCD
"Glary Registry Repair_is1" = Glary Registry Repair 3.0
"Google Updater" = Google Updater
"HPExtendedCapabilities" = HP Extended Capabilities 4.7
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"InstallShield_{B2023017-DEE4-44F7-8A71-CA6084BF534C}" = Brother P-touch Address Book 1.1
"InstallShield_{DEDDF868-E272-47E9-A8EA-E5CC7B179077}" = Brother QL-570 User's Guide
"InstallShield_{DF9A6075-9308-4572-8932-A4316243C4D9}" = Brother P-touch Editor 5.0
"JRE 1.2.2" = Java 2 Runtime Environment Standard Edition v1.2.2
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft Security Client" = Microsoft Security Essentials
"Mozilla Firefox (3.0.10)" = Mozilla Firefox (3.0.10)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"PROSet" = Intel® PRO Network Connections Drivers
"QuickTime" = QuickTime
"RealPlayer 6.0" = RealPlayer Basic
"RealVNC_is1" = VNC Free Edition 4.1.3
"ShockwaveFlash" = Adobe Flash Player 9 ActiveX
"Space Plasma 3D Screensaver_is1" = Space Plasma 3D Screensaver 1.5
"StarOffice 5.0" = StarOffice 5.2
"ViewpointMediaPlayer" = Viewpoint Media Player
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinZip" = WinZip
"WMCSetup" = Windows Media Connect
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"XpsEP" = XPS Essentials Pack 1.0
"Xvid_is1" = Xvid 1.1.2 final uninstall

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-2336832311-1325935186-3394737582-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome

========== Last 10 Event Log Errors ==========

Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!

< End of report >
Post #7
gmer log

GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2012-02-02 11:24:41
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-e ST380013AS rev.8.05
Running: ubv2v1tt.exe; Driver: C:\DOCUME~1\tmiadmin\LOCALS~1\Temp\pxtdypoc.sys


—- User code sections - GMER 1.0.15 —-

.text C:\WINDOWS\system32\SearchIndexer.exe[228] kernel32.dll!WriteFile 7C810E27 7 Bytes JMP 00585C0C C:\WINDOWS\system32\MSSRCH.DLL (mssrch.dll/Microsoft Corporation)

—- Devices - GMER 1.0.15 —-

Device Ntfs.sys (NT File System Driver/Microsoft Corporation)
Device Fastfat.SYS (Fast FAT File System Driver/Microsoft Corporation)
Device mrxsmb.sys (Windows NT SMB Minirdr/Microsoft Corporation)

AttachedDevice fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

Device \FileSystem\Fs_Rec \FileSystem\UdfsCdRomRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\FatCdRomRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\CdfsRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\FatDiskRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Fs_Rec \FileSystem\UdfsDiskRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device \FileSystem\Cdfs \Cdfs tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)

—- EOF - GMER 1.0.15 —-
Post #8
virus definitions updated asw log aswMBR version 0.9.9.1532 Copyright© 2011 AVAST Software Run date: 2012-02-02 11:27:16 —————————– 11:27:16.687 OS Version: Windows 5.1.2600 Service Pack 3 11:27:16.687 Number of processors: 2 586 0x304 11:27:16.687 ComputerName: SHOP UserName: 11:27:18.406 Initialize success 11:29:53.437 AVAST engine defs: 12020201 11:30:41.312 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-e 11:30:41.312 Disk 0 Vendor: ST380013AS 8.05 Size: 76293MB BusType: 3 11:30:41.343 Disk 0 MBR read successfully 11:30:41.343 Disk 0 MBR scan 11:30:41.546 Disk 0 unknown MBR code 11:30:41.578 Disk 0 Partition 1 00 DE Dell Utility Dell 4.1 47 MB offset 63 11:30:41.625 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 72645 MB offset 96390 11:30:41.687 Disk 0 Partition 3 00 DB CP/M / CTOS MSWIN4.1 3584 MB offset 148890420 11:30:41.765 Disk 0 scanning sectors +156232125 11:30:42.312 Disk 0 scanning C:\WINDOWS\system32\drivers 11:31:43.906 Service scanning 11:31:47.203 Modules scanning 11:32:57.921 Disk 0 trace - called modules: 11:32:57.968 ntoskrnl.exe CLASSPNP.SYS disk.sys atapi.sys hal.dll pciide.sys 11:32:57.968 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x82f9eab8] 11:32:57.968 3 CLASSPNP.SYS[f8684fd7] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP1T0L0-e[0x82f4fd98] 11:33:00.046 AVAST engine scan C:\WINDOWS 11:33:51.750 AVAST engine scan C:\WINDOWS\system32 11:47:42.750 AVAST engine scan C:\WINDOWS\system32\drivers 11:49:44.015 AVAST engine scan C:\Documents and Settings\tmiadmin 11:55:41.328 AVAST engine scan C:\Documents and Settings\All Users 11:59:38.531 Scan finished successfully 12:00:20.296 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\tmiadmin\Desktop\avcheck\MBR.dat" 12:00:20.343 The log file has been saved successfully to "C:\Documents and Settings\tmiadmin\Desktop\avcheck\aswMBR.txt"
Post #9
The logs show a few items we will need to change, but also a malware startup loading in the winlogon process we need to address first.

Be sure to continue to temporarily disable any protective software when running the scan tools we use here.


Download ComboFix.exe from here to your desktop, then click that to run that scan. Agree to any warnings you might receive.

Be sure to install the Recovery Console if you are asked to do so. When the scan completes, a text window with your log will open. Please copy and paste that log back here.

A caution - do not touch your mouse/keyboard until the scan has completed. The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled. If this occurs, please reboot to restore the desktop.

Allow the scan to run. When completed a text window will appear - please copy/paste the contents back here. This log can also be found at C:\ComboFix.txt.
Post #10
Thanks for the help
here is the log file

ComboFix 12-02-03.01 - tmiadmin 02/03/2012 7:27.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.502.109 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\avcheck\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\ROBBIE TILLEY\Application Data\Install.dat
c:\documents and settings\ROBBIE TILLEY\My Documents\Readiris.DUS
c:\documents and settings\ROBBIE TILLEY\WINDOWS
c:\program files\Uninstall.exe
c:\windows\system32\cmd.com
c:\windows\system32\SET10F.tmp
c:\windows\system32\SET114.tmp
c:\windows\system32\SET11B.tmp
c:\windows\system32\setb5.tmp
c:\windows\win1.ini
.
.
((((((((((((((((((((((((( Files Created from 2012-01-03 to 2012-02-03 )))))))))))))))))))))))))))))))
.
.
2012-02-02 20:50 . 2012-02-02 20:50 56200 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{E15119F2-C3EB-4F3E-B9D1-995C6C2E2071}\offreg.dll
2012-02-02 20:26 . 2012-01-06 01:19 6557240 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{E15119F2-C3EB-4F3E-B9D1-995C6C2E2071}\mpengine.dll
2012-01-31 20:34 . 2012-01-06 01:19 6557240 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2012-01-31 13:02 . 2012-02-02 21:36 ——– d—–w- C:\SHOP DATA
2012-01-30 20:29 . 2012-01-30 20:29 ——– d—–w- c:\program files\Common Files\Adobe AIR
2012-01-30 19:42 . 2012-01-31 12:44 237072 ——w- c:\windows\system32\MpSigStub.exe
2012-01-30 19:40 . 2012-01-30 19:41 ——– d—–w- c:\program files\Microsoft Security Client
2012-01-30 18:53 . 2001-08-17 18:53 6784 —-a-w- c:\windows\system32\drivers\serscan.sys
2012-01-30 18:53 . 2001-08-17 18:53 6784 —-a-w- c:\windows\system32\dllcache\serscan.sys
2012-01-30 18:52 . 2008-08-27 01:24 55808 ——w- c:\windows\system32\brinsstr.dll
2012-01-30 18:52 . 2008-10-16 14:55 3072 ——w- c:\windows\system32\BrDctF2S.dll
2012-01-30 18:52 . 2007-12-14 03:16 73728 ——w- c:\windows\system32\BrDctF2.dll
2012-01-30 18:52 . 2007-12-14 03:16 5120 ——w- c:\windows\system32\BrDctF2L.dll
2012-01-30 18:52 . 2006-12-21 16:23 176128 —-a-w- c:\windows\system32\BROSNMP.DLL
2012-01-30 18:43 . 2012-01-30 18:43 ——– d—–w- C:\$NtUninstallXPSEP$
2012-01-30 18:43 . 2010-10-05 18:56 14048 ——w- c:\windows\system32\spmsg2.dll
2012-01-30 16:46 . 2012-01-31 15:13 ——– d—–w- C:\SHOP SHARE
2012-01-30 13:34 . 2012-01-30 13:34 ——– d—–w- c:\program files\RealVNC
2012-01-30 13:06 . 2012-01-30 13:06 ——– d—–w- c:\program files\Space Plasma 3D Screensaver
2012-01-30 13:06 . 2007-12-01 18:47 1517056 —-a-w- c:\windows\system32\Space_Plasma_3D_Screensaver.scr
2012-01-30 12:48 . 2012-01-30 12:48 ——– d—–w- c:\documents and settings\tmiadmin
2012-01-30 12:35 . 2012-01-30 12:35 ——– d-sh–w- c:\documents and settings\ROBBIE TILLEY\IECompatCache
2012-01-30 12:35 . 2012-01-30 12:35 ——– d-sh–w- c:\documents and settings\LocalService\IETldCache
2012-01-30 12:34 . 2012-01-30 12:34 ——– d-sh–w- c:\documents and settings\ROBBIE TILLEY\PrivacIE
2012-01-30 12:28 . 2012-01-30 12:29 ——– d—–r- C:\My Documents
2012-01-30 12:25 . 2012-01-30 12:25 ——– d-sh–w- c:\documents and settings\ROBBIE TILLEY\IETldCache
2012-01-27 19:07 . 2011-08-16 10:45 6144 ——w- c:\windows\system32\dllcache\iecompat.dll
2012-01-27 19:05 . 2011-11-04 19:20 12800 ——w- c:\windows\system32\dllcache\xpshims.dll
2012-01-27 19:05 . 2011-11-04 19:20 247808 ——w- c:\windows\system32\dllcache\ieproxy.dll
2012-01-27 19:05 . 2011-11-04 19:20 743424 ——w- c:\windows\system32\dllcache\iedvtool.dll
2012-01-27 19:03 . 2012-01-27 19:05 ——– dc-h–w- c:\windows\ie8
2012-01-27 17:10 . 2012-01-30 12:24 ——– d—–w- c:\windows\SxsCaPendDel
2012-01-27 11:57 . 2012-01-27 11:57 ——– d—–w- c:\documents and settings\ROBBIE TILLEY\Local Settings\Application Data\Temp
2012-01-27 11:49 . 2010-09-18 06:53 954368 ——w- c:\windows\system32\dllcache\mfc40.dll
2012-01-27 11:49 . 2010-09-18 06:53 953856 ——w- c:\windows\system32\dllcache\mfc40u.dll
2012-01-27 11:48 . 2010-08-27 08:02 119808 ——w- c:\windows\system32\dllcache\t2embed.dll
2012-01-27 11:48 . 2009-10-15 16:28 81920 ——w- c:\windows\system32\dllcache\fontsub.dll
2012-01-27 11:47 . 2010-08-23 16:12 617472 ——w- c:\windows\system32\dllcache\comctl32.dll
2012-01-27 11:47 . 2010-11-02 15:17 40960 ——w- c:\windows\system32\dllcache\ndproxy.sys
2012-01-27 11:46 . 2010-06-14 14:31 744448 ——w- c:\windows\system32\dllcache\helpsvc.exe
2012-01-27 11:44 . 2009-11-21 15:51 471552 ——w- c:\windows\system32\dllcache\aclayers.dll
2012-01-27 11:41 . 2009-06-21 21:44 153088 ——w- c:\windows\system32\dllcache\triedit.dll
2012-01-27 11:41 . 2011-06-24 14:10 139656 ——w- c:\windows\system32\dllcache\rdpwd.sys
2012-01-27 11:39 . 2011-04-21 13:37 105472 ——w- c:\windows\system32\dllcache\mup.sys
2012-01-27 11:38 . 2010-06-18 13:36 3558912 ——w- c:\windows\system32\dllcache\moviemk.exe
2012-01-27 11:36 . 2011-07-08 14:02 10496 ——w- c:\windows\system32\dllcache\ndistapi.sys
2012-01-27 11:33 . 2010-10-11 14:59 45568 ——w- c:\windows\system32\dllcache\wab.exe
2012-01-27 11:32 . 2010-08-16 08:45 590848 ——w- c:\windows\system32\dllcache\rpcrt4.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-25 21:57 . 2004-08-04 11:00 293376 —-a-w- c:\windows\system32\winsrv.dll
2011-11-23 13:25 . 2004-08-04 11:00 1859584 —-a-w- c:\windows\system32\win32k.sys
2011-11-18 12:35 . 2004-08-04 11:00 60416 —-a-w- c:\windows\system32\packager.exe
2011-11-16 14:21 . 2004-08-04 11:00 354816 —-a-w- c:\windows\system32\winhttp.dll
2011-11-16 14:21 . 2004-08-04 11:00 152064 —-a-w- c:\windows\system32\schannel.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BrMfcWnd"="c:\program files\Brother\Brmfcmon\BrMfcWnd.exe" [2008-11-13 1122304]
"ControlCenter3"="c:\program files\Brother\ControlCenter3\brctrcen.exe" [2008-08-12 114688]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 997920]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ \0
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk
backup=c:\windows\pss\Digital Line Detect.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 00:12 15360 —-a-w- c:\windows\SYSTEM32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport]
2007-03-15 15:09 460784 —-a-w- c:\program files\DellSupport\DSAgnt.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dla]
2004-08-13 07:05 122939 —-a-w- c:\windows\SYSTEM32\dla\tfswctrl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dscactivate]
2007-11-15 14:24 16384 —-a-w- c:\program files\Dell Support Center\gs_agent\custom\dsca.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher]
2004-08-24 00:19 57344 ——w- c:\program files\CyberLink\PowerDVD\DVDLauncher.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2004-09-13 20:49 49152 —-a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility]
2004-03-24 05:05 172032 —-a-w- c:\windows\SYSTEM32\SPOOL\DRIVERS\W32X86\3\hpztsb10.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPUsageTracking]
2005-09-07 08:25 36864 —-a-w- c:\program files\HP\HP UT\bin\hppusg.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd]
2005-10-14 18:46 77824 —-a-w- c:\windows\SYSTEM32\hkcmd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers]
2005-10-14 18:50 114688 —-a-w- c:\windows\SYSTEM32\igfxpers.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxtray]
2005-10-14 18:49 94208 —-a-w- c:\windows\SYSTEM32\igfxtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mmtask]
2006-01-17 17:03 53248 —-a-w- c:\program files\MUSICMATCH\Musicmatch Jukebox\mmtask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray]
2006-01-17 17:03 135168 —-a-w- c:\program files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCMService]
2004-04-12 02:15 290816 ——w- c:\program files\Dell\Media Experience\PCMService.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2004-11-19 09:23 77824 —-a-w- c:\program files\QuickTime\qttask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
2004-11-19 09:23 26112 —-a-w- c:\program files\Real\RealPlayer\realplay.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SO5 Integrator Pass Two]
2000-05-08 09:20 20480 —-a-w- c:\windows\sointgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2003-11-19 23:48 32881 —-a-w- c:\program files\Java\j2re1.4.2_03\bin\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ToolBoxFX]
2006-02-02 13:12 45056 —-a-w- c:\program files\HP\ToolBoxFX\bin\HPTLBXFX.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Tracker]
2007-11-22 16:55 110592 —-a-w- c:\program files\MySoftware\MyInvoices\Tracker.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateManager]
2004-01-07 07:01 110592 —-a-w- c:\program files\Common Files\Sonic\Update Manager\sgtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WMPNetworkSvc"=2 (0x2)
"WANMiniportService"=2 (0x2)
"sp_rssrv"=2 (0x2)
"Pml Driver HPZ12"=2 (0x2)
"NetSvc"=3 (0x3)
"Lavasoft Ad-Aware Service"=2 (0x2)
"gusvc"=2 (0x2)
"gupdatem"=3 (0x3)
"gupdate1c983ab3ca2ce9e"=2 (0x2)
"DSBrokerService"=3 (0x3)
"Crypkey License"=2 (0x2)
"AOL ACS"=2 (0x2)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Unfold3D\\FABRIWIN\\ORTHO.EXE"=
"c:\\Program Files\\RealVNC\\VNC4\\winvnc4.exe"=
"c:\\Program Files\\Brother\\Brmfl08i\\FAXRX.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5900:TCP"= 5900:TCP:vnc
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"54925:UDP"= 54925:UDP:Brother Network Scanner
.
R3 LNE100;Linksys LNE100TX(v5) Fast Ethernet Adapter;c:\windows\SYSTEM32\DRIVERS\lne100v5.sys [2/21/2005 1:51 PM 36224]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys –> c:\windows\system32\DRIVERS\Lbd.sys [?]
S2 gupdate1c983ab3ca2ce9e;Google Update Service (gupdate1c983ab3ca2ce9e);c:\program files\Google\Update\GoogleUpdate.exe [1/31/2009 8:53 AM 133104]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [1/31/2009 8:53 AM 133104]
.
— Other Services/Drivers In Memory —
.
*NewlyCreated* - 6TO4
*NewlyCreated* - ASWMBR
*NewlyCreated* - IP6FW
*NewlyCreated* - NWLNKIPX
*NewlyCreated* - NWLNKNB
*NewlyCreated* - NWLNKSPX
*NewlyCreated* - PXTDYPOC
*NewlyCreated* - TCPIP6
*Deregistered* - aswMBR
*Deregistered* - pxtdypoc
.
Contents of the 'Scheduled Tasks' folder
.
2012-02-02 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-01-31 13:44]
.
2012-02-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-01-31 13:52]
.
2012-02-03 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-01-31 13:52]
.
2012-02-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2336832311-1325935186-3394737582-1006Core.job
- c:\documents and settings\tmiadmin\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2012-01-30 19:22]
.
2012-02-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2336832311-1325935186-3394737582-1006UA.job
- c:\documents and settings\tmiadmin\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2012-01-30 19:22]
.
2005-01-24 c:\windows\Tasks\ISP signup reminder 1.job
- c:\windows\system32\OOBE\OOBEBALN.EXE [2004-08-04 00:12]
.
2012-02-03 c:\windows\Tasks\User_Feed_Synchronization-{6A30A62C-87F7-4B99-9A80-0FAEE897B8FD}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 09:31]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.dell4me.com/myway
TCP: Interfaces\{9D9D590B-2089-4E24-BBB5-A7BE9F8880CE}: NameServer = 208.67.220.220,208.67.222.222
TCP: Interfaces\{E6DF896F-66C1-49B0-BDF7-7E03FBF249DD}: NameServer = 4.2.2.2,24.25.5.61
DPF: {032C5CBC-2272-438F-AC73-38EA92AF19BD} - hxxp://192.168.1.3/WebViewer.cab
FF - ProfilePath - c:\documents and settings\tmiadmin\Application Data\Mozilla\Firefox\Profiles\j6trukck.default\
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
.
- - - - ORPHANS REMOVED - - - -
.
HKCU-Run-updateMgr - c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe
MSConfigStartUp-Ad-Watch - c:\program files\Lavasoft\Ad-Aware\AAWTray.exe
MSConfigStartUp-gcasServ - c:\program files\Microsoft AntiSpyware\gcasServ.exe
MSConfigStartUp-SpywareTerminator - c:\program files\Spyware Terminator\SpywareTerminatorShield.exe
MSConfigStartUp-Windows Defender - c:\program files\Windows Defender\MSASCui.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-02-03 07:42
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
Completion time: 2012-02-03 07:46:48
ComboFix-quarantined-files.txt 2012-02-03 12:46
.
Pre-Run: 58,660,610,048 bytes free
Post-Run: 58,909,179,904 bytes free
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - 28E30311246CFA63A13FB5ED89101B50
Post #11
That cleaned up some. You have a lot of startups and services disabled through msconfig, including some that have now become orphaned (the software has been uninstalled). Including a still active Ad-Aware driver, and scheduled task. And an early bootup Registry setting that has become corrupted.

Go to Start - Control Panel - Scheduled Tasks, and delete all the entires there, except Add Scheduled Task. Any innocents will be recreated later, as they are needed.

————–

REGEDIT4

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager]
"BootExecute"=-

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager]
"BootExecute"=hex(7):61,75,74,6f,63,68,65,63,6b,20,61,75,74,6f,63,68,6b,20,2a,\
  00,00
Open Notepad (Start - Run, type Notepad then press OK), and copy the text inside the box above and paste it into the open Notepad textbox.

Save this to your desktop as "fixer.reg"

Be sure to include the "" quotes in the name.

Then right click fixer.reg, select Merge, and allow it to merge the new information with the Registry.

————–

Go to Start > Run and type:

cmd.exe

and OK. At the prompt type or copy/paste each of the following, pressing Enter after each:

sc delete lbd

You should get a confirmation the service was removed. Then just type exit and press Enter to close the command window.

—————–

Be sure to continue to temporarily disable any protective software when running the scan tools we use here.

Download Malwarebytes' Anti-Malware from Here.

Double Click mbam-setup-1.60.01800.exe to install the application.

* Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select "Perform quick scan", then click Scan.
* The scan may take some time to finish,so please be patient.
* When the scan is complete, click OK, then Show Results to view the results.
* Make sure that everything is checked, and click Remove Selected.
* When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.
* The log is automatically saved by Malwarebytes and can be viewed by clicking the Logs tab in Malwarebytes.
* Copy and Paste the entire report in your next reply. If it calls for a reboot to complete the repairs do that as well then.

———-

Disable your antivirus program and click here and download the esetsmartinstaller_enu.exe Eset installer. Then click that file to run the scanner.

If you accept the Terms of Use, check the box and click Start. It will take a couple minutes for the scanner to get ready. When the Computer scan settings display shows, check the following boxes:

Remove found threats
Scan unwanted applications

Next to "Current scan targets: Operating memory, Local drives", click the "Change" word. Make sure you place a check next to all disk drives, including any external drives that are attached (no need to check off the floppy or DVD/CD-Rom drives).

Then click the Advanced option, the place a check next to the following (if it is not already checked):

Enable Anti-Stealth technology

Click Start. This scan may take a while, so please be patient.

If infection is found, at the end of the scan click "List of found threats".

In that display, at the bottom, select the option to save the results as a text file, and save that to your desktop. Post that back here please.

Post that log and the Malwarebytes log please.
Post #12
Jintan, REGISTRY MERGE TOOK *********************************** sc delete lbd GAVE THIS RESULTS [sc] OpenService FAILED 1060: the specified service does not exits as an installed service ************************************************************* ESET First run had checked network shares that were not mapped got the blue screen of death about 10% in. After restart just checked local drive ESET FOUND NO INFECTIONS ************************************************************** MALWARE LOG Malwarebytes Anti-Malware 1.60.1.1000 www.malwarebytes.org Database version: v2012.02.06.01 Windows XP Service Pack 3 x86 NTFS Internet Explorer 8.0.6001.18702 tmiadmin :: SHOP [administrator] 2/6/2012 8:15:51 AM mbam-log-2012-02-06 (08-15-51).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 209410 Time elapsed: 12 minute(s), 32 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end) Thanks for your patience and persitance looking forward to your reply Jim
Post #13
? lbd not found is curious, though the system appears to be clean of malware. Open Gmer again. Once it completes it's initial scan, click the >>> at the top, then click the Modules tab. See if Lbd.sys is located in that list. Just in case I am misreading it's use, if it does not show in that list, also click the Services tab and check there. Just let me know if it shows please.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI