Spyware / Malware / Virus Removal

Smart Fortress 2012

278 min read

Looking for the outcome? Ask AI

webster10

Post #16April 13, 2012, 2:06 AM UTC

20:47:36.0406 2076 TDSS rootkit removing tool [removed] Apr 10 2012 16:54:05 20:47:36.0718 2076 ============================================================ 20:47:36.0718 2076 Current date / time: 2012/04/12 20:47:36.0718 20:47:36.0718 2076 SystemInfo: 20:47:36.0718 2076 20:47:36.0718 2076 OS Version: 5.1.2600 ServicePack: 3.0 20:47:36.0718 2076 Product type: Workstation 20:47:36.0718 2076 ComputerName: PEGGY 20:47:36.0718 2076 UserName: Administrator 20:47:36.0718 2076 Windows directory: C:\WINDOWS 20:47:36.0718 2076 System windows directory: C:\WINDOWS 20:47:36.0718 2076 Processor architecture: Intel x86 20:47:36.0718 2076 Number of processors: 1 20:47:36.0718 2076 Page size: 0x1000 20:47:36.0718 2076 Boot type: Normal boot 20:47:36.0718 2076 ============================================================ 20:47:38.0609 2076 Drive \Device\Harddisk0\DR0 - Size: 0x9516AE000 (37.27 Gb), SectorSize: 0x200, Cylinders: 0x1301, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054 20:47:38.0625 2076 \Device\Harddisk0\DR0: 20:47:38.0625 2076 MBR used 20:47:38.0625 2076 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x4A89182 20:47:38.0656 2076 Initialize success 20:47:38.0656 2076 ============================================================ 20:47:57.0859 3700 ============================================================ 20:47:57.0859 3700 Scan started 20:47:57.0859 3700 Mode: Manual; SigCheck; TDLFS; 20:47:57.0859 3700 ============================================================ 20:47:59.0031 3700 Abiosdsk - ok 20:47:59.0312 3700 abp480n5 - ok 20:47:59.0687 3700 ac97intc (0f2d66d5f08ebe2f77bb904288dcf6f0) C:\WINDOWS\system32\drivers\ac97intc.sys 20:48:04.0046 3700 ac97intc - ok 20:48:04.0312 3700 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys 20:48:04.0671 3700 ACPI - ok 20:48:05.0031 3700 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys 20:48:05.0406 3700 ACPIEC - ok 20:48:05.0671 3700 adpu160m (9a11864873da202c996558b2106b0bbc) C:\WINDOWS\system32\DRIVERS\adpu160m.sys 20:48:06.0078 3700 adpu160m - ok 20:48:06.0343 3700 adpu320 (0ea9b1f0c6c90a509c8603775366adb7) C:\WINDOWS\system32\DRIVERS\adpu320.sys 20:48:06.0468 3700 adpu320 ( UnsignedFile.Multi.Generic ) - warning 20:48:06.0468 3700 adpu320 - detected UnsignedFile.Multi.Generic (1) 20:48:06.0687 3700 aeaudio - ok 20:48:07.0062 3700 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys 20:48:07.0359 3700 aec - ok 20:48:07.0625 3700 AFD (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys 20:48:07.0828 3700 AFD - ok 20:48:08.0281 3700 AFS2K (0ebb674888cbdefd5773341c16dd6a07) C:\WINDOWS\system32\drivers\AFS2K.sys 20:48:08.0406 3700 AFS2K - ok 20:48:09.0562 3700 AgereSoftModem - ok 20:48:10.0000 3700 Aha154x - ok 20:48:10.0484 3700 aic78u2 (19dd0fb48b0c18892f70e2e7d61a1529) C:\WINDOWS\system32\DRIVERS\aic78u2.sys 20:48:10.0906 3700 aic78u2 - ok 20:48:11.0187 3700 aic78xx (b7fe594a7468aa0132deb03fb8e34326) C:\WINDOWS\system32\DRIVERS\aic78xx.sys 20:48:11.0578 3700 aic78xx - ok 20:48:11.0828 3700 Alerter (a9a3daa780ca6c9671a19d52456705b4) C:\WINDOWS\system32\alrsvc.dll 20:48:12.0187 3700 Alerter - ok 20:48:12.0500 3700 ALG (8c515081584a38aa007909cd02020b3d) C:\WINDOWS\System32\alg.exe 20:48:12.0781 3700 ALG - ok 20:48:13.0046 3700 AliIde - ok 20:48:13.0578 3700 amsint - ok 20:48:13.0890 3700 Amsp (e1c85e63946b8e71c968a97d6433d3ba) C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe 20:48:14.0671 3700 Amsp - ok 20:48:15.0156 3700 AppMgmt (d8849f77c0b66226335a59d26cb4edc6) C:\WINDOWS\System32\appmgmts.dll 20:48:15.0281 3700 AppMgmt - ok 20:48:15.0546 3700 asc - ok 20:48:16.0078 3700 asc3350p - ok 20:48:16.0359 3700 asc3550 - ok 20:48:16.0859 3700 aspnet_state (0e5e4957549056e2bf2c49f4f6b601ad) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe 20:48:17.0125 3700 aspnet_state - ok 20:48:17.0671 3700 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys 20:48:17.0906 3700 AsyncMac - ok 20:48:18.0406 3700 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys 20:48:18.0593 3700 atapi - ok 20:48:18.0984 3700 Atdisk - ok 20:48:19.0437 3700 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys 20:48:19.0640 3700 Atmarpc - ok 20:48:20.0000 3700 AudioSrv (def7a7882bec100fe0b2ce2549188f9d) C:\WINDOWS\System32\audiosrv.dll 20:48:20.0750 3700 AudioSrv - ok 20:48:21.0203 3700 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys 20:48:21.0468 3700 audstub - ok 20:48:21.0828 3700 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys 20:48:22.0093 3700 Beep - ok 20:48:22.0640 3700 BITS (574738f61fca2935f5265dc4e5691314) C:\WINDOWS\system32\qmgr.dll 20:48:23.0046 3700 BITS - ok 20:48:24.0000 3700 Browser (a06ce3399d16db864f55faeb1f1927a9) C:\WINDOWS\System32\browser.dll 20:48:24.0468 3700 Browser - ok 20:48:24.0484 3700 catchme - ok 20:48:25.0171 3700 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys 20:48:25.0843 3700 cbidf2k - ok 20:48:28.0062 3700 cd20xrnt - ok 20:48:29.0187 3700 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys 20:48:29.0453 3700 Cdaudio - ok 20:48:31.0015 3700 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys 20:48:31.0281 3700 Cdfs - ok 20:48:31.0921 3700 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys 20:48:32.0234 3700 Cdrom - ok 20:48:33.0000 3700 Changer - ok 20:48:33.0687 3700 CiSvc (1cfe720eb8d93a7158a4ebc3ab178bde) C:\WINDOWS\system32\cisvc.exe 20:48:33.0937 3700 CiSvc - ok 20:48:34.0156 3700 ClipSrv (34cbe729f38138217f9c80212a2a0c82) C:\WINDOWS\system32\clipsrv.exe 20:48:34.0343 3700 ClipSrv - ok 20:48:34.0875 3700 clr_optimization_v2.0.50727_32 (d87acaed61e417bba546ced5e7e36d9c) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 20:48:34.0921 3700 clr_optimization_v2.0.50727_32 - ok 20:48:35.0171 3700 CmdIde - ok 20:48:35.0359 3700 COMSysApp - ok 20:48:35.0593 3700 Cpqarray - ok 20:48:35.0828 3700 CryptSvc (3d4e199942e29207970e04315d02ad3b) C:\WINDOWS\System32\cryptsvc.dll 20:48:36.0031 3700 CryptSvc - ok 20:48:36.0250 3700 dac2w2k - ok 20:48:36.0500 3700 dac960nt - ok 20:48:36.0750 3700 DcomLaunch (6b27a5c03dfb94b4245739065431322c) C:\WINDOWS\system32\rpcss.dll 20:48:37.0078 3700 DcomLaunch - ok 20:48:38.0593 3700 Dhcp (5e38d7684a49cacfb752b046357e0589) C:\WINDOWS\System32\dhcpcsvc.dll 20:48:38.0812 3700 Dhcp - ok 20:48:39.0078 3700 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys 20:48:39.0234 3700 Disk - ok 20:48:39.0421 3700 dmadmin - ok 20:48:39.0718 3700 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys 20:48:40.0437 3700 dmboot - ok 20:48:40.0859 3700 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys 20:48:41.0078 3700 dmio - ok 20:48:41.0500 3700 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys 20:48:41.0687 3700 dmload - ok 20:48:41.0984 3700 dmserver (57edec2e5f59f0335e92f35184bc8631) C:\WINDOWS\System32\dmserver.dll 20:48:42.0171 3700 dmserver - ok 20:48:42.0609 3700 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys 20:48:42.0812 3700 DMusic - ok 20:48:43.0078 3700 Dnscache (5f7e24fa9eab896051ffb87f840730d2) C:\WINDOWS\System32\dnsrslvr.dll 20:48:43.0218 3700 Dnscache - ok 20:48:43.0625 3700 Dot3svc (0f0f6e687e5e15579ef4da8dd6945814) C:\WINDOWS\System32\dot3svc.dll 20:48:43.0796 3700 Dot3svc - ok 20:48:44.0140 3700 Dot4 (3e4b043f8bc6be1d4820cc6c9c500306) C:\WINDOWS\system32\DRIVERS\Dot4.sys 20:48:44.0343 3700 Dot4 - ok 20:48:44.0859 3700 Dot4Print (77ce63a8a34ae23d9fe4c7896d1debe7) C:\WINDOWS\system32\DRIVERS\Dot4Prt.sys 20:48:45.0062 3700 Dot4Print - ok 20:48:45.0406 3700 dpti2o (40f3b93b4e5b0126f2f5c0a7a5e22660) C:\WINDOWS\system32\DRIVERS\dpti2o.sys 20:48:45.0625 3700 dpti2o - ok 20:48:46.0078 3700 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys 20:48:46.0234 3700 drmkaud - ok 20:48:46.0687 3700 E1000 (1dc189cd47ad4c8ca214b234b84ca228) C:\WINDOWS\system32\DRIVERS\e1000325.sys 20:48:46.0765 3700 E1000 - ok 20:48:47.0203 3700 E100B (afee15c5b16317ebf17f79cc1843465a) C:\WINDOWS\system32\DRIVERS\e100b325.sys 20:48:47.0265 3700 E100B - ok 20:48:47.0562 3700 EapHost (2187855a7703adef0cef9ee4285182cc) C:\WINDOWS\System32\eapsvc.dll 20:48:47.0750 3700 EapHost - ok 20:48:48.0156 3700 ERSvc (bc93b4a066477954555966d77fec9ecb) C:\WINDOWS\System32\ersvc.dll 20:48:48.0359 3700 ERSvc - ok 20:48:48.0671 3700 Eventlog (65df52f5b8b6e9bbd183505225c37315) C:\WINDOWS\system32\services.exe 20:48:49.0125 3700 Eventlog - ok 20:48:49.0828 3700 EventSystem (d4991d98f2db73c60d042f1aef79efae) C:\WINDOWS\system32\es.dll 20:48:49.0953 3700 EventSystem - ok 20:48:50.0359 3700 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys 20:48:50.0562 3700 Fastfat - ok 20:48:50.0812 3700 FastUserSwitchingCompatibility (99bc0b50f511924348be19c7c7313bbf) C:\WINDOWS\System32\shsvcs.dll 20:48:50.0906 3700 FastUserSwitchingCompatibility - ok 20:48:51.0281 3700 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys 20:48:51.0468 3700 Fdc - ok 20:48:51.0859 3700 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys 20:48:52.0062 3700 Fips - ok 20:48:52.0515 3700 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys 20:48:52.0703 3700 Flpydisk - ok 20:48:53.0093 3700 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys 20:48:53.0484 3700 FltMgr - ok 20:48:53.0750 3700 FontCache3.0.0.0 (8ba7c024070f2b7fdd98ed8a4ba41789) c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe 20:48:53.0796 3700 FontCache3.0.0.0 - ok 20:48:54.0109 3700 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys 20:48:54.0500 3700 Fs_Rec - ok 20:48:54.0750 3700 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys 20:48:55.0140 3700 Ftdisk - ok 20:48:55.0406 3700 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys 20:48:55.0859 3700 Gpc - ok 20:48:56.0125 3700 helpsvc (4fcca060dfe0c51a09dd5c3843888bcd) C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll 20:48:56.0484 3700 helpsvc - ok 20:48:56.0671 3700 HidServ - ok 20:48:56.0843 3700 hkmsvc (8878bd685e490239777bfe51320b88e9) C:\WINDOWS\System32\kmsvc.dll 20:48:57.0265 3700 hkmsvc - ok 20:48:57.0515 3700 hpn - ok 20:48:57.0843 3700 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys 20:48:58.0015 3700 HTTP - ok 20:48:58.0218 3700 HTTPFilter (6100a808600f44d999cebdef8841c7a3) C:\WINDOWS\System32\w3ssl.dll 20:48:58.0640 3700 HTTPFilter - ok 20:48:58.0875 3700 i2omgmt - ok 20:48:59.0125 3700 i2omp - ok 20:48:59.0437 3700 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys 20:48:59.0843 3700 i8042prt - ok 20:49:00.0078 3700 i81x - ok 20:49:00.0359 3700 iAimFP0 - ok 20:49:00.0625 3700 iAimFP1 - ok 20:49:00.0890 3700 iAimFP2 - ok 20:49:01.0156 3700 iAimFP3 - ok 20:49:01.0406 3700 iAimFP4 - ok 20:49:01.0656 3700 iAimFP5 - ok 20:49:01.0984 3700 iAimFP6 - ok 20:49:02.0453 3700 iAimFP7 - ok 20:49:02.0890 3700 iAimTV0 - ok 20:49:03.0328 3700 iAimTV1 - ok 20:49:03.0750 3700 iAimTV3 - ok 20:49:04.0046 3700 iAimTV4 - ok 20:49:04.0343 3700 iAimTV5 - ok 20:49:04.0562 3700 iAimTV6 - ok 20:49:04.0921 3700 ialm - ok 20:49:05.0203 3700 IDriverT (6f95324909b502e2651442c1548ab12f) C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe 20:49:05.0234 3700 IDriverT ( UnsignedFile.Multi.Generic ) - warning 20:49:05.0234 3700 IDriverT - detected UnsignedFile.Multi.Generic (1) 20:49:05.0562 3700 idsvc (c01ac32dc5c03076cfb852cb5da5229c) c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe 20:49:05.0781 3700 idsvc - ok 20:49:06.0046 3700 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys 20:49:06.0312 3700 Imapi - ok 20:49:06.0671 3700 ImapiService (30deaf54a9755bb8546168cfe8a6b5e1) C:\WINDOWS\system32\imapi.exe 20:49:06.0984 3700 ImapiService - ok 20:49:07.0281 3700 ini910u - ok 20:49:07.0812 3700 IntelIde (b5466a9250342a7aa0cd1fba13420678) C:\WINDOWS\system32\DRIVERS\intelide.sys 20:49:08.0046 3700 IntelIde - ok 20:49:08.0343 3700 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys 20:49:08.0734 3700 intelppm - ok 20:49:09.0062 3700 IntuitUpdateService - ok 20:49:09.0390 3700 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys 20:49:09.0593 3700 Ip6Fw - ok 20:49:09.0953 3700 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys 20:49:10.0125 3700 IpFilterDriver - ok 20:49:10.0609 3700 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys 20:49:10.0843 3700 IpInIp - ok 20:49:11.0343 3700 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys 20:49:11.0531 3700 IpNat - ok 20:49:11.0968 3700 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys 20:49:12.0156 3700 IPSec - ok 20:49:12.0578 3700 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys 20:49:12.0687 3700 IRENUM - ok 20:49:13.0625 3700 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys 20:49:13.0812 3700 isapnp - ok 20:49:14.0093 3700 JavaQuickStarterService (890369aed0dde1a98f09f7dc239ca2bd) C:\Program Files\Java\jre6\bin\jqs.exe 20:49:14.0156 3700 JavaQuickStarterService - ok 20:49:14.0468 3700 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys 20:49:14.0671 3700 Kbdclass - ok 20:49:15.0734 3700 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys 20:49:16.0140 3700 kmixer - ok 20:49:16.0406 3700 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys 20:49:16.0656 3700 KSecDD - ok 20:49:16.0890 3700 lanmanserver (3a7c3cbe5d96b8ae96ce81f0b22fb527) C:\WINDOWS\System32\srvsvc.dll 20:49:17.0125 3700 lanmanserver - ok 20:49:17.0328 3700 lanmanworkstation (a8888a5327621856c0cec4e385f69309) C:\WINDOWS\System32\wkssvc.dll 20:49:17.0437 3700 lanmanworkstation - ok 20:49:18.0031 3700 lbrtfdc - ok 20:49:18.0859 3700 LmHosts (a7db739ae99a796d91580147e919cc59) C:\WINDOWS\System32\lmhsvc.dll 20:49:19.0093 3700 LmHosts - ok 20:49:19.0671 3700 McComponentHostService (f453d1e6d881e8f8717e20ccd4199e85) C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe 20:49:19.0812 3700 McComponentHostService - ok 20:49:20.0765 3700 Messenger (986b1ff5814366d71e0ac5755c88f2d3) C:\WINDOWS\System32\msgsvc.dll 20:49:21.0000 3700 Messenger - ok 20:49:21.0921 3700 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys 20:49:22.0156 3700 mnmdd - ok 20:49:23.0000 3700 mnmsrvc (d18f1f0c101d06a1c1adf26eed16fcdd) C:\WINDOWS\system32\mnmsrvc.exe 20:49:23.0234 3700 mnmsrvc - ok 20:49:24.0171 3700 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys 20:49:24.0453 3700 Modem - ok 20:49:25.0468 3700 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys 20:49:25.0671 3700 Mouclass - ok 20:49:26.0328 3700 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys 20:49:26.0500 3700 MountMgr - ok 20:49:27.0031 3700 mraid35x - ok 20:49:27.0359 3700 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys 20:49:27.0640 3700 MRxDAV - ok 20:49:28.0375 3700 MRxSmb (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys 20:49:28.0593 3700 MRxSmb - ok 20:49:28.0828 3700 MSDTC (a137f1470499a205abbb9aafb3b6f2b1) C:\WINDOWS\system32\msdtc.exe 20:49:29.0140 3700 MSDTC - ok 20:49:29.0609 3700 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys 20:49:29.0796 3700 Msfs - ok 20:49:30.0078 3700 MSIServer - ok 20:49:30.0234 3700 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys 20:49:30.0593 3700 MSKSSRV - ok 20:49:30.0968 3700 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys 20:49:31.0156 3700 MSPCLOCK - ok 20:49:31.0453 3700 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys 20:49:31.0812 3700 MSPQM - ok 20:49:32.0203 3700 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys 20:49:32.0375 3700 mssmbios - ok 20:49:32.0734 3700 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys 20:49:33.0031 3700 Mup - ok 20:49:33.0265 3700 napagent (0102140028fad045756796e1c685d695) C:\WINDOWS\System32\qagentrt.dll 20:49:33.0906 3700 napagent - ok 20:49:34.0203 3700 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys 20:49:34.0546 3700 NDIS - ok 20:49:34.0843 3700 NdisTapi (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys 20:49:35.0031 3700 NdisTapi - ok 20:49:35.0343 3700 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys 20:49:35.0546 3700 Ndisuio - ok 20:49:36.0218 3700 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys 20:49:36.0609 3700 NdisWan - ok 20:49:37.0531 3700 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys 20:49:37.0765 3700 NDProxy - ok 20:49:38.0468 3700 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys 20:49:38.0656 3700 NetBIOS - ok 20:49:39.0046 3700 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys 20:49:39.0468 3700 NetBT - ok 20:49:39.0687 3700 NetDDE (b857ba82860d7ff85ae29b095645563b) C:\WINDOWS\system32\netdde.exe 20:49:39.0906 3700 NetDDE - ok 20:49:39.0953 3700 NetDDEdsdm (b857ba82860d7ff85ae29b095645563b) C:\WINDOWS\system32\netdde.exe 20:49:40.0140 3700 NetDDEdsdm - ok 20:49:40.0468 3700 Netlogon (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe 20:49:40.0656 3700 Netlogon - ok 20:49:41.0031 3700 Netman (13e67b55b3abd7bf3fe7aae5a0f9a9de) C:\WINDOWS\System32\netman.dll 20:49:41.0265 3700 Netman - ok 20:49:41.0546 3700 NetTcpPortSharing (d34612c5d02d026535b3095d620626ae) c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe 20:49:41.0578 3700 NetTcpPortSharing - ok 20:49:41.0828 3700 Nla (943337d786a56729263071623bbb9de5) C:\WINDOWS\System32\mswsock.dll 20:49:42.0140 3700 Nla - ok 20:49:42.0546 3700 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys 20:49:42.0734 3700 Npfs - ok 20:49:43.0906 3700 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys 20:49:44.0281 3700 Ntfs - ok 20:49:44.0515 3700 NtLmSsp (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe 20:49:44.0875 3700 NtLmSsp - ok 20:49:45.0093 3700 NtmsSvc (156f64a3345bd23c600655fb4d10bc08) C:\WINDOWS\system32\ntmssvc.dll 20:49:45.0562 3700 NtmsSvc - ok 20:49:45.0812 3700 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys 20:49:46.0187 3700 Null - ok 20:49:46.0437 3700 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys 20:49:46.0765 3700 NwlnkFlt - ok 20:49:47.0015 3700 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys 20:49:47.0203 3700 NwlnkFwd - ok 20:49:47.0328 3700 ose (7a56cf3e3f12e8af599963b16f50fb6a) C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE 20:49:47.0359 3700 ose - ok 20:49:47.0750 3700 P3 (c90018bafdc7098619a4a95b046b30f3) C:\WINDOWS\system32\DRIVERS\p3.sys 20:49:48.0125 3700 P3 - ok 20:49:48.0437 3700 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\DRIVERS\parport.sys 20:49:48.0812 3700 Parport - ok 20:49:49.0187 3700 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys 20:49:49.0546 3700 PartMgr - ok 20:49:49.0906 3700 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys 20:49:50.0125 3700 ParVdm - ok 20:49:50.0468 3700 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys 20:49:50.0781 3700 PCI - ok 20:49:51.0125 3700 PCIDump - ok 20:49:51.0515 3700 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys 20:49:51.0859 3700 PCIIde - ok 20:49:52.0312 3700 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys 20:49:52.0687 3700 Pcmcia - ok 20:49:53.0468 3700 PDCOMP - ok 20:49:53.0750 3700 PDFRAME - ok 20:49:54.0218 3700 PDRELI - ok 20:49:54.0718 3700 PDRFRAME - ok 20:49:55.0000 3700 perc2 - ok 20:49:55.0437 3700 perc2hib - ok 20:49:56.0015 3700 PlugPlay (65df52f5b8b6e9bbd183505225c37315) C:\WINDOWS\system32\services.exe 20:49:56.0234 3700 PlugPlay - ok 20:49:56.0453 3700 PolicyAgent (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe 20:49:56.0859 3700 PolicyAgent - ok 20:49:57.0796 3700 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys 20:49:58.0000 3700 PptpMiniport - ok 20:49:58.0375 3700 ProtectedStorage (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe 20:49:58.0734 3700 ProtectedStorage - ok 20:49:59.0000 3700 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys 20:49:59.0187 3700 PSched - ok 20:49:59.0500 3700 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys 20:49:59.0671 3700 Ptilink - ok 20:49:59.0890 3700 ql1080 - ok 20:50:00.0140 3700 Ql10wnt - ok 20:50:00.0468 3700 ql12160 - ok 20:50:00.0734 3700 ql1240 - ok 20:50:00.0921 3700 ql1280 - ok 20:50:01.0218 3700 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys 20:50:01.0375 3700 RasAcd - ok 20:50:01.0562 3700 RasAuto (ad188be7bdf94e8df4ca0a55c00a5073) C:\WINDOWS\System32\rasauto.dll 20:50:01.0750 3700 RasAuto - ok 20:50:02.0046 3700 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys 20:50:02.0218 3700 Rasl2tp - ok 20:50:02.0484 3700 RasMan (76a9a3cbeadd68cc57cda5e1d7448235) C:\WINDOWS\System32\rasmans.dll 20:50:02.0671 3700 RasMan - ok 20:50:02.0968 3700 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys 20:50:03.0171 3700 RasPppoe - ok 20:50:03.0453 3700 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys 20:50:03.0593 3700 Raspti - ok 20:50:04.0718 3700 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys 20:50:04.0890 3700 Rdbss - ok 20:50:05.0140 3700 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys 20:50:05.0328 3700 RDPCDD - ok 20:50:05.0609 3700 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys 20:50:05.0812 3700 rdpdr - ok 20:50:06.0093 3700 RDPWD (5b3055daa788bd688594d2f5981f2a83) C:\WINDOWS\system32\drivers\RDPWD.sys 20:50:06.0187 3700 RDPWD - ok 20:50:06.0453 3700 RDSessMgr (3c37bf86641bda977c3bf8a840f3b7fa) C:\WINDOWS\system32\sessmgr.exe 20:50:06.0640 3700 RDSessMgr - ok 20:50:06.0921 3700 redbook (bd5b23bc13b4fc0df9a65a6bd6158113) C:\WINDOWS\system32\DRIVERS\redbook.sys 20:50:06.0921 3700 redbook ( Virus.Win32.ZAccess.k ) - infected 20:50:06.0921 3700 redbook - detected Virus.Win32.ZAccess.k (0) 20:50:07.0140 3700 RemoteAccess (7e699ff5f59b5d9de5390e3c34c67cf5) C:\WINDOWS\System32\mprdim.dll 20:50:07.0312 3700 RemoteAccess - ok 20:50:07.0578 3700 RemoteRegistry (5b19b557b0c188210a56a6b699d90b8f) C:\WINDOWS\system32\regsvc.dll 20:50:07.0765 3700 RemoteRegistry - ok 20:50:08.0015 3700 RpcLocator (aaed593f84afa419bbae8572af87cf6a) C:\WINDOWS\system32\locator.exe 20:50:08.0265 3700 RpcLocator - ok 20:50:08.0500 3700 RpcSs (6b27a5c03dfb94b4245739065431322c) C:\WINDOWS\System32\rpcss.dll 20:50:08.0609 3700 RpcSs - ok 20:50:08.0828 3700 RSVP (471b3f9741d762abe75e9deea4787e47) C:\WINDOWS\system32\rsvp.exe 20:50:09.0015 3700 RSVP - ok 20:50:09.0343 3700 RUBotted (1f17555989477b993b6ab2d2f67ee7f5) C:\Program Files\Trend Micro\RUBotted\TMRUBotted.exe 20:50:09.0500 3700 RUBotted - ok 20:50:09.0703 3700 SamSs (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe 20:50:09.0875 3700 SamSs - ok 20:50:10.0046 3700 SASDIFSV (a3281aec37e0720a2bc28034c2df2a56) C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS 20:50:10.0093 3700 SASDIFSV - ok 20:50:10.0140 3700 SASKUTIL (61db0d0756a99506207fd724e3692b25) C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS 20:50:10.0156 3700 SASKUTIL - ok 20:50:10.0359 3700 SCardSvr (86d007e7a654b9a71d1d7d856b104353) C:\WINDOWS\System32\SCardSvr.exe 20:50:10.0531 3700 SCardSvr - ok 20:50:10.0750 3700 Schedule (0a9a7365a1ca4319aa7c1d6cd8e4eafa) C:\WINDOWS\system32\schedsvc.dll 20:50:10.0953 3700 Schedule - ok 20:50:11.0218 3700 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys 20:50:11.0312 3700 Secdrv - ok 20:50:11.0531 3700 seclogon (cbe612e2bb6a10e3563336191eda1250) C:\WINDOWS\System32\seclogon.dll 20:50:11.0734 3700 seclogon - ok 20:50:11.0968 3700 SENS (7fdd5d0684eca8c1f68b4d99d124dcd0) C:\WINDOWS\system32\sens.dll 20:50:12.0125 3700 SENS - ok 20:50:12.0453 3700 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys 20:50:12.0640 3700 serenum - ok 20:50:12.0859 3700 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\DRIVERS\serial.sys 20:50:13.0031 3700 Serial - ok 20:50:13.0328 3700 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys 20:50:13.0500 3700 Sfloppy - ok 20:50:13.0750 3700 SharedAccess (83f41d0d89645d7235c051ab1d9523ac) C:\WINDOWS\System32\ipnathlp.dll 20:50:14.0062 3700 SharedAccess - ok 20:50:14.0343 3700 ShellHWDetection (99bc0b50f511924348be19c7c7313bbf) C:\WINDOWS\System32\shsvcs.dll 20:50:14.0390 3700 ShellHWDetection - ok 20:50:14.0625 3700 Simbad - ok 20:50:14.0953 3700 smwdm (bf208c85119770e6a9b6577019a3d810) C:\WINDOWS\system32\drivers\smwdm.sys 20:50:15.0078 3700 smwdm - ok 20:50:15.0281 3700 Sparrow - ok 20:50:15.0593 3700 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys 20:50:15.0781 3700 splitter - ok 20:50:16.0000 3700 Spooler (60784f891563fb1b767f70117fc2428f) C:\WINDOWS\system32\spoolsv.exe 20:50:16.0062 3700 Spooler - ok 20:50:16.0343 3700 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys 20:50:16.0421 3700 sr - ok 20:50:16.0703 3700 srservice (3805df0ac4296a34ba4bf93b346cc378) C:\WINDOWS\system32\srsvc.dll 20:50:16.0796 3700 srservice - ok 20:50:17.0093 3700 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys 20:50:17.0203 3700 Srv - ok 20:50:17.0406 3700 SSDPSRV (0a5679b3714edab99e357057ee88fca6) C:\WINDOWS\System32\ssdpsrv.dll 20:50:17.0531 3700 SSDPSRV - ok 20:50:17.0750 3700 stisvc (8bad69cbac032d4bbacfce0306174c30) C:\WINDOWS\system32\wiaservc.dll 20:50:17.0953 3700 stisvc - ok 20:50:18.0343 3700 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys 20:50:18.0500 3700 swenum - ok 20:50:19.0093 3700 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys 20:50:19.0343 3700 swmidi - ok 20:50:19.0640 3700 SwPrv - ok 20:50:19.0859 3700 symc810 (1ff3217614018630d0a6758630fc698c) C:\WINDOWS\system32\DRIVERS\symc810.sys 20:50:20.0031 3700 symc810 - ok 20:50:20.0296 3700 symc8xx (070e001d95cf725186ef8b20335f933c) C:\WINDOWS\system32\DRIVERS\symc8xx.sys 20:50:20.0437 3700 symc8xx - ok 20:50:20.0703 3700 Symmpi (f2b7e8416f508368ac6730e2ae1c614f) C:\WINDOWS\system32\DRIVERS\symmpi.sys 20:50:20.0718 3700 Symmpi ( UnsignedFile.Multi.Generic ) - warning 20:50:20.0718 3700 Symmpi - detected UnsignedFile.Multi.Generic (1) 20:50:21.0015 3700 sym_hi (80ac1c4abbe2df3b738bf15517a51f2c) C:\WINDOWS\system32\DRIVERS\sym_hi.sys 20:50:21.0171 3700 sym_hi - ok 20:50:21.0421 3700 sym_u3 (bf4fab949a382a8e105f46ebb4937058) C:\WINDOWS\system32\DRIVERS\sym_u3.sys 20:50:21.0578 3700 sym_u3 - ok 20:50:21.0859 3700 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys 20:50:22.0046 3700 sysaudio - ok 20:50:22.0281 3700 SysmonLog (c7abbc59b43274b1109df6b24d617051) C:\WINDOWS\system32\smlogsvc.exe 20:50:22.0453 3700 SysmonLog - ok 20:50:22.0671 3700 TapiSrv (3cb78c17bb664637787c9a1c98f79c38) C:\WINDOWS\System32\tapisrv.dll 20:50:22.0875 3700 TapiSrv - ok 20:50:23.0171 3700 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys 20:50:23.0250 3700 Tcpip - ok 20:50:23.0484 3700 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys 20:50:23.0656 3700 TDPIPE - ok 20:50:23.0890 3700 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys 20:50:24.0093 3700 TDTCP - ok 20:50:24.0343 3700 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys 20:50:24.0515 3700 TermDD - ok 20:50:24.0734 3700 TermService (ff3477c03be7201c294c35f684b3479f) C:\WINDOWS\System32\termsrv.dll 20:50:24.0937 3700 TermService - ok 20:50:25.0156 3700 Themes (99bc0b50f511924348be19c7c7313bbf) C:\WINDOWS\System32\shsvcs.dll 20:50:25.0171 3700 Themes - ok 20:50:25.0453 3700 TlntSvr (db7205804759ff62c34e3efd8a4cc76a) C:\WINDOWS\system32\tlntsvr.exe 20:50:25.0546 3700 TlntSvr - ok 20:50:25.0828 3700 TMPassthru (690acb48dac04e44a3d5e7654ca3260d) C:\WINDOWS\system32\DRIVERS\TMPassthru.sys 20:50:25.0843 3700 TMPassthru - ok 20:50:25.0875 3700 TMPassthruMP (690acb48dac04e44a3d5e7654ca3260d) C:\WINDOWS\system32\DRIVERS\TMPassthru.sys 20:50:25.0906 3700 TMPassthruMP - ok 20:50:26.0109 3700 TosIde - ok 20:50:26.0343 3700 TrkWks (55bca12f7f523d35ca3cb833c725f54e) C:\WINDOWS\system32\trkwks.dll 20:50:26.0515 3700 TrkWks - ok 20:50:26.0796 3700 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys 20:50:26.0968 3700 Udfs - ok 20:50:27.0203 3700 ultra - ok 20:50:27.0484 3700 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys 20:50:27.0718 3700 Update - ok 20:50:27.0968 3700 upnphost (1ebafeb9a3fbdc41b8d9c7f0f687ad91) C:\WINDOWS\System32\upnphost.dll 20:50:28.0062 3700 upnphost - ok 20:50:28.0328 3700 UPS (05365fb38fca1e98f7a566aaaf5d1815) C:\WINDOWS\System32\ups.exe 20:50:28.0515 3700 UPS - ok 20:50:28.0812 3700 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys 20:50:28.0968 3700 usbehci - ok 20:50:29.0234 3700 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys 20:50:29.0421 3700 usbhub - ok 20:50:29.0656 3700 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys 20:50:29.0859 3700 usbscan - ok 20:50:30.0140 3700 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS 20:50:30.0328 3700 USBSTOR - ok 20:50:30.0593 3700 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys 20:50:30.0781 3700 usbuhci - ok 20:50:31.0015 3700 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys 20:50:31.0187 3700 VgaSave - ok 20:50:31.0406 3700 ViaIde (3b3efcda263b8ac14fdf9cbdd0791b2e) C:\WINDOWS\system32\DRIVERS\viaide.sys 20:50:31.0562 3700 ViaIde - ok 20:50:31.0828 3700 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys 20:50:32.0000 3700 VolSnap - ok 20:50:32.0250 3700 VSS (7a9db3a67c333bf0bd42e42b8596854b) C:\WINDOWS\System32\vssvc.exe 20:50:32.0359 3700 VSS - ok 20:50:32.0562 3700 W32Time (54af4b1d5459500ef0937f6d33b1914f) C:\WINDOWS\system32\w32time.dll 20:50:32.0750 3700 W32Time - ok 20:50:33.0046 3700 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys 20:50:33.0234 3700 Wanarp - ok 20:50:33.0515 3700 WDICA - ok 20:50:33.0812 3700 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys 20:50:34.0000 3700 wdmaud - ok 20:50:34.0203 3700 WebClient (77a354e28153ad2d5e120a5a8687bc06) C:\WINDOWS\System32\webclnt.dll 20:50:34.0390 3700 WebClient - ok 20:50:34.0625 3700 winmgmt (2d0e4ed081963804ccc196a0929275b5) C:\WINDOWS\system32\wbem\WMIsvc.dll 20:50:34.0828 3700 winmgmt - ok 20:50:35.0140 3700 WmdmPmSN (c51b4a5c05a5475708e3c81c7765b71d) C:\WINDOWS\system32\MsPMSNSv.dll 20:50:35.0187 3700 WmdmPmSN - ok 20:50:35.0406 3700 Wmi (e76f8807070ed04e7408a86d6d3a6137) C:\WINDOWS\System32\advapi32.dll 20:50:35.0484 3700 Wmi - ok 20:50:35.0796 3700 WmiApSrv (e0673f1106e62a68d2257e376079f821) C:\WINDOWS\system32\wbem\wmiapsrv.exe 20:50:35.0968 3700 WmiApSrv - ok 20:50:36.0140 3700 WMPNetworkSvc (f74e3d9a7fa9556c3bbb14d4e5e63d3b) C:\Program Files\Windows Media Player\WMPNetwk.exe 20:50:36.0265 3700 WMPNetworkSvc - ok 20:50:36.0515 3700 WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys 20:50:36.0718 3700 WS2IFSL - ok 20:50:36.0984 3700 wscsvc (7c278e6408d1dce642230c0585a854d5) C:\WINDOWS\system32\wscsvc.dll 20:50:37.0156 3700 wscsvc - ok 20:50:37.0390 3700 wuauserv (35321fb577cdc98ce3eb3a3eb9e4610a) C:\WINDOWS\system32\wuauserv.dll 20:50:37.0609 3700 wuauserv - ok 20:50:37.0890 3700 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys 20:50:37.0953 3700 WudfPf - ok 20:50:38.0203 3700 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys 20:50:38.0250 3700 WudfRd - ok 20:50:38.0468 3700 WudfSvc (05231c04253c5bc30b26cbaae680ed89) C:\WINDOWS\System32\WUDFSvc.dll 20:50:38.0515 3700 WudfSvc - ok 20:50:38.0812 3700 WZCSVC (81dc3f549f44b1c1fff022dec9ecf30b) C:\WINDOWS\System32\wzcsvc.dll 20:50:39.0109 3700 WZCSVC - ok 20:50:39.0359 3700 xmlprov (295d21f14c335b53cb8154e5b1f892b9) C:\WINDOWS\System32\xmlprov.dll 20:50:39.0562 3700 xmlprov - ok 20:50:39.0718 3700 z800obex - ok 20:50:39.0906 3700 {6080A529-897E-4629-A488-ABA0C29B635E} - ok 20:50:40.0140 3700 {D31A0762-0CEB-444e-ACFF-B049A1F6FE91} - ok 20:50:40.0218 3700 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk0\DR0 20:50:40.0484 3700 \Device\Harddisk0\DR0 - ok 20:50:40.0515 3700 Boot (0x1200) (b16589e1d0dfd5ac35553509f6652cb7) \Device\Harddisk0\DR0\Partition0 20:50:40.0515 3700 \Device\Harddisk0\DR0\Partition0 - ok 20:50:40.0546 3700 ============================================================ 20:50:40.0546 3700 Scan finished 20:50:40.0546 3700 ============================================================ 20:50:40.0718 4000 Detected object count: 4 20:50:40.0718 4000 Actual detected object count: 4 20:51:34.0750 4000 adpu320 ( UnsignedFile.Multi.Generic ) - skipped by user 20:51:34.0750 4000 adpu320 ( UnsignedFile.Multi.Generic ) - User select action: Skip 20:51:34.0781 4000 IDriverT ( UnsignedFile.Multi.Generic ) - skipped by user 20:51:34.0781 4000 IDriverT ( UnsignedFile.Multi.Generic ) - User select action: Skip 20:51:35.0046 4000 C:\WINDOWS\system32\DRIVERS\redbook.sys - copied to quarantine 20:51:35.0890 4000 VerifyFileNameVersionInfo: GetFileVersionInfoSizeW(C:\WINDOWS\system32\drivers\redbook.sys) error 1813 20:51:38.0281 4000 Backup copy found, using it.. 20:51:38.0296 4000 C:\WINDOWS\system32\DRIVERS\redbook.sys - will be cured on reboot 20:51:54.0093 4000 redbook ( Virus.Win32.ZAccess.k ) - User select action: Cure 20:51:54.0125 4000 Symmpi ( UnsignedFile.Multi.Generic ) - skipped by user 20:51:54.0125 4000 Symmpi ( UnsignedFile.Multi.Generic ) - User select action: Skip 20:52:01.0421 3612 Deinitialize success

webster10

Post #17April 13, 2012, 2:08 AM UTC

Hi I am not having the browser changing the Smart Fortress problems of two days ago. When I posted the TDS log, the computer was really slow. Also, when it rebooted after cure, Windows on its own ran CHKDSK on reboot. It deleted some files, and moved some orphaned files. It did this on its own. THANKS

webster10

Post #18April 13, 2012, 2:21 AM UTC

Hi The browser window is a little too far left and is partially cut off. And there is a narrow black strip on the right of the screen. How to I push it to the right? THANKS

oldman960

Post #19April 13, 2012, 5:41 AM UTC

Hi webster10,

You can move the browser over by clicking the blue bar at the top with your left mouse and sliding it over.

You have some missing files that look like they are related to your display. I don't see where they went to. We'll have a look for a few of them. Do you have ant disks that came with the computer? What is the brand and model of the computer?

Click start and right click My Computer

click the Hardware tab
click the Device Manager button

Anything with a question mark or yellow triangle?

Next, Double click on OTL.exe

Under the Custom Scans/Fixes box at the bottom, paste in the following
Do Not copy the word CODE
please note the script starts with the :

/md5start
AGRSM.*
ialmkchw.*
ialmsbw.*
aeaudio.*
/md5stop

Then click the Run Scan button at the top

Let the program run unhindered
Please save the resulting log to be posted in your next reply.

Please post back with

OTL log

webster10

Post #20April 14, 2012, 2:45 PM UTC

HI Don't have any disks. Can't slide the browser. It won't move. The area of active display is slightly out of line. This is an HP Compaq dx2000 MT. Will post OTL log in next box. PS- It's acting sort of start and stoppish this mornging. Thank you.

webster10

Post #21April 14, 2012, 4:02 PM UTC

copy of device manager list. I think that what had yellow symbols is shown as *.

Attachments:

📎System_Resource_Report.pdf

webster10

Post #22April 14, 2012, 4:20 PM UTC

OTL logfile created on: 4/14/2012 11:03:06 AM - Run 3
OTL by OldTimer - Version 3.2.39.2 Folder = C:\Documents and Settings\Administrator\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

502.80 Mb Total Physical Memory | 178.84 Mb Available Physical Memory | 35.57% Memory free
843.57 Mb Paging File | 484.05 Mb Available in Paging File | 57.38% Paging File free
Paging file location(s): C:\pagefile.sys 372 744 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 37.27 Gb Total Space | 18.68 Gb Free Space | 50.12% Space Free | Partition Type: NTFS

Computer Name: PEGGY | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Administrator\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe (W3i, LLC)
PRC - C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe (Trend Micro Inc.)
PRC - C:\Program Files\Trend Micro\AMSP\coreFrameworkHost.exe (Trend Micro Inc.)
PRC - C:\Program Files\Trend Micro\UniClient\UiFrmwrk\uiWatchDog.exe (Trend Micro Inc.)
PRC - C:\Program Files\Trend Micro\UniClient\UiFrmwrk\uiSeAgnt.exe (Trend Micro Inc.)
PRC - C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
PRC - C:\Program Files\Trend Micro\RUBotted\TMRUBottedTray.exe (Trend Micro Inc.)
PRC - C:\Program Files\Trend Micro\RUBotted\TMRUBotted.exe (Trend Micro Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe (Adobe Systems Incorporated)

========== Modules (No Company Name) ==========

MOD - C:\Program Files\Mozilla Firefox\mozjs.dll ()
MOD - C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
MOD - C:\Program Files\Trend Micro\UniClient\plugins\LUADLL.dll ()
MOD - C:\Program Files\Trend Micro\AMSP\sqlite3.dll ()
MOD - C:\Program Files\Trend Micro\AMSP\libprotobuf.dll ()
MOD - C:\Program Files\Trend Micro\AMSP\boost_date_time-vc80-mt-1_36.dll ()
MOD - C:\Program Files\Trend Micro\AMSP\boost_thread-vc80-mt-1_36.dll ()
MOD - C:\Program Files\Adobe\Reader 9.0\Reader\ViewerPS.dll ()
MOD - C:\Program Files\FileZilla FTP Client\fzshellext.dll ()
MOD - C:\Program Files\Trend Micro\RUBotted\libexpat.dll ()
MOD - C:\Program Files\Trend Micro\RUBotted\sqlite3.dll ()
MOD - C:\WINDOWS\system32\Primomonnt.dll ()

========== Win32 Services (SafeList) ==========

SRV - (z800obex) – %systemroot%\system32\rollbackclientservice.dll File not found
SRV - (IntuitUpdateService) – %systemroot%\system32\imaservice.dll File not found
SRV - (HidServ) – %SystemRoot%\System32\hidserv.dll File not found
SRV - (Amsp) – C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe coreFrameworkHost.exe File not found
SRV - (McComponentHostService) – C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe (McAfee, Inc.)
SRV - (RUBotted) – C:\Program Files\Trend Micro\RUBotted\TMRUBotted.exe (Trend Micro Inc.)

========== Driver Services (SafeList) ==========

DRV - (WDICA) – File not found
DRV - (redbook) – system32\drivers\tsk111.tmp File not found
DRV - (PDRFRAME) – File not found
DRV - (PDRELI) – File not found
DRV - (PDFRAME) – File not found
DRV - (PDCOMP) – File not found
DRV - (PCIDump) – File not found
DRV - (lbrtfdc) – File not found
DRV - (ialm) – system32\DRIVERS\ialmnt5.sys File not found
DRV - (iAimTV6) – system32\DRIVERS\wATV06nt.sys File not found
DRV - (iAimTV5) – system32\DRIVERS\wATV10nt.sys File not found
DRV - (iAimTV4) – system32\DRIVERS\wCh7xxNT.sys File not found
DRV - (iAimTV3) – system32\DRIVERS\wATV04nt.sys File not found
DRV - (iAimTV1) – system32\DRIVERS\wATV02NT.sys File not found
DRV - (iAimTV0) – system32\DRIVERS\wATV01nt.sys File not found
DRV - (iAimFP7) – system32\DRIVERS\wADV09nt.sys File not found
DRV - (iAimFP6) – system32\DRIVERS\wADV08nt.sys File not found
DRV - (iAimFP5) – system32\DRIVERS\wADV07nt.sys File not found
DRV - (iAimFP4) – system32\DRIVERS\wVchNTxx.sys File not found
DRV - (iAimFP3) – system32\DRIVERS\wSiINTxx.sys File not found
DRV - (iAimFP2) – system32\DRIVERS\wADV05NT.sys File not found
DRV - (iAimFP1) – system32\DRIVERS\wADV02NT.sys File not found
DRV - (iAimFP0) – system32\DRIVERS\wADV01nt.sys File not found
DRV - (i81x) – system32\DRIVERS\i81xnt5.sys File not found
DRV - (i2omgmt) – File not found
DRV - (Changer) – File not found
DRV - (catchme) – C:\jgh\catchme.sys File not found
DRV - (AgereSoftModem) – system32\DRIVERS\AGRSM.sys File not found
DRV - (aeaudio) – system32\drivers\aeaudio.sys File not found
DRV - (76851537) – system32\drivers\21461316.sys File not found
DRV - ({D31A0762-0CEB-444e-ACFF-B049A1F6FE91}) Intel® Graphics Chipset (KCH) – system32\drivers\ialmkchw.sys File not found
DRV - ({6080A529-897E-4629-A488-ABA0C29B635E}) Intel® Graphics Platform (SoftBIOS) – system32\drivers\ialmsbw.sys File not found
DRV - (SASKUTIL) – C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASDIFSV) – C:\Program Files\SUPERAntiSpyware\sasdifsv.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (TMPassthruMP) – C:\WINDOWS\system32\drivers\TMPassthru.sys (Trend Micro Inc.)
DRV - (TMPassthru) – C:\WINDOWS\system32\drivers\TMPassthru.sys (Trend Micro Inc.)
DRV - (AFS2K) – C:\WINDOWS\System32\drivers\AFS2K.SYS (Oak Technology Inc.)
DRV - (Symmpi) – C:\WINDOWS\system32\drivers\symmpi.sys (LSI Logic)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://go.compaq.com/1Q00CDT/0409/bl8.asp
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…ferrer:source?}
IE - HKLM\..\SearchScopes\{E4013329-B79F-4680-AD25-5D4D64F28342}: "URL" = http://www.onestepsearch.net/?prt=ONESTEP1…s={searchTerms}

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Yahoo! Search
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://search.yahoo.com/search?p={searchTe…-8&fr=b1ie7
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKCU\..\URLSearchHook: - No CLSID value found
IE - HKCU\..\SearchScopes,DefaultScope = {0C55421B-685A-4156-A691-073C1D6AEBD2}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…amp;Form=IE8SRC
IE - HKCU\..\SearchScopes\{0C55421B-685A-4156-A691-073C1D6AEBD2}: "URL" = http://search.yahoo.com/search?p={searchTe…-8&fr=b1ie7
IE - HKCU\..\SearchScopes\{579457C0-C7D6-481B-8DBF-3CA259316F8C}: "URL" = http://rover.ebay.com/rover/1/711-43047-14…e={searchTerms}
IE - HKCU\..\SearchScopes\{D5EF9B3F-A073-433A-BDDE-BE64509C0AB3}: "URL" = http://www.flickr.com/search/?q={searchTerms}
IE - HKCU\..\SearchScopes\{E58FD494-9104-4DA0-AD13-7C6A590592BD}: "URL" = http://delicious.com/search?p={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Yahoo"
FF - prefs.js..browser.search.defaulturl: "http://search.yahoo.com/search?ei=UTF-8&fr=ytff-&p="
FF - prefs.js..browser.search.param.yahoo-fr: "moz2-ytff-"
FF - prefs.js..browser.search.param.yahoo-fr-cjkt: "moz2-ytff-"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "http://www.yahoo.com/"
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.3.6.20110307083656
FF - prefs.js..keyword.URL: "http://search.yahoo.com/search?ei=UTF-8&fr=ytff-&p="
FF - prefs.js..network.proxy.type: 1

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/npracplug;version=1.0.0.0: C:\Program Files\Real\RealArcade\Plugins\Mozilla\npracplug.dll (RealNetworks)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{22C7F6C6-8D67-4534-92B5-529A0EC09405}: C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1505\6.6.1088\firefoxextension\ [2012/04/11 14:53:20 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/04/12 21:39:30 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/09/01 14:45:18 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 2.0.0.18\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2008/11/25 12:38:29 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 2.0.0.18\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{ABC82C52-8331-11E1-826D-B8AC6F996F26}: C:\Documents and Settings\Administrator\Local Settings\Application Data\{ABC82C52-8331-11E1-826D-B8AC6F996F26}\

[2008/12/23 10:38:55 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Extensions
[2012/02/03 17:55:28 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ugvbjuwp.default\extensions
[2012/01/25 17:25:51 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ugvbjuwp.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2012/04/12 21:39:26 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2012/04/12 21:39:27 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\distribution\extensions
[2012/04/12 21:39:27 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Program Files\Mozilla Firefox\distribution\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2011/11/20 23:04:51 | 000,134,104 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2010/02/03 18:28:29 | 000,028,472 | —- | M] (WebEx Communications, Inc) – C:\Program Files\mozilla firefox\plugins\atgpcdec.dll
[2010/02/03 18:28:29 | 000,185,224 | —- | M] (WebEx Communications, Inc) – C:\Program Files\mozilla firefox\plugins\atgpcext.dll
[2010/02/03 18:28:28 | 000,061,832 | —- | M] (WebEx Communications, Inc) – C:\Program Files\mozilla firefox\plugins\npatgpc.dll
[2011/03/18 13:32:12 | 000,091,552 | —- | M] (Coupons, Inc.) – C:\Program Files\mozilla firefox\plugins\npCouponPrinter.dll
[2011/03/18 13:32:14 | 000,091,552 | —- | M] (Coupons, Inc.) – C:\Program Files\mozilla firefox\plugins\npMozCouponPrinter.dll
[2011/11/20 20:04:05 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2011/11/20 20:04:05 | 000,002,040 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}source
id=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms}

O1 HOSTS File: ([2012/04/12 19:36:46 | 000,000,027 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (TmIEPlugInBHO Class) - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files\Trend Micro\AMSP\module\20004\1.5.1505\6.6.1088\TmIEPlg.dll (Trend Micro Inc.)
O2 - BHO: (TmBpIeBHO Class) - {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.5.1234\6.5.1234\TmBpIe32.dll File not found
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {871F91FD-3A92-4988-A842-16AB2CFF5AF1} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found.
O4 - HKLM..\Run: [Adobe Photo Downloader] C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [SetRefresh] C:\Program Files\Compaq\SetRefresh\SetRefresh.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [srmclean] C:\cpqs\scom\srmclean.exe ()
O4 - HKLM..\Run: [TMRUBottedTray] C:\Program Files\Trend Micro\RUBotted\TMRUBottedTray.exe (Trend Micro Inc.)
O4 - HKLM..\Run: [Trend Micro Client Framework] C:\Program Files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe (Trend Micro Inc.)
O4 - HKLM..\Run: [Trend Micro Titanium] C:\Program Files\Trend Micro\Titanium\UIFramework\uiWinMgr.exe (Trend Micro Inc.)
O4 - HKCU..\Run: [InstallIQUpdater] C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe (W3i, LLC)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk = C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O15 - HKCU\..Trusted Domains: westlaw.com ([]* in Trusted sites)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Reg Error: Key error.)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/C/0…heckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab (Symantec AntiVirus scanner)
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} http://photos.walmart.com/WalmartActivia.cab (Snapfish Activia)
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} http://cdn.scan.onecare.live.com/resource/…lscbase5483.cab (Windows Live Safety Center Base Module)
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab (Symantec RuFSI Utility Class)
O16 - DPF: {6824D897-F7E1-4E41-B84B-B1D3FA4BF1BD} http://utilities.pcpitstop.com/Exterminate…opAntiVirus.dll (PCPitstop AntiVirus)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_06)
O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{293A756F-F0E8-4250-BFB4-F00ACF54F34F}: DhcpNameServer = [removed] [removed] [removed]
O18 - Protocol\Handler\tmbp {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.5.1234\6.5.1234\TmBpIe32.dll File not found
O18 - Protocol\Handler\tmpx {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\module\20004\1.5.1505\6.6.1088\TmIEPlg.dll (Trend Micro Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - (C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL) - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O20 - Winlogon\Notify\igfxcui: DllName - (igfxsrvc.dll) - File not found
O24 - Desktop Components:0 () - http://mail.charter.net/images/portal/msgt…S&v=charter
O24 - Desktop Components:1 (My Current Home Page) - About:Home
O24 - Desktop WallPaper: C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - C:\Program Files\Windows Defender\MpShHook.dll (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2012/04/12 20:51:34 | 000,000,000 | —D | C] – C:\TDSSKiller_Quarantine
[2012/04/12 20:46:01 | 002,071,600 | —- | C] (Kaspersky Lab ZAO) – C:\Documents and Settings\Administrator\Desktop\tdsskiller.exe
[2012/04/12 20:41:09 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2012/04/11 17:53:40 | 000,034,735 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\ati1xsxx.sys
[2012/04/11 17:53:40 | 000,034,735 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\ati1xsxx.sys
[2012/04/11 17:53:39 | 000,036,463 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\ati1tuxx.sys
[2012/04/11 17:53:39 | 000,036,463 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\ati1tuxx.sys
[2012/04/11 17:53:39 | 000,029,455 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\ati1xbxx.sys
[2012/04/11 17:53:39 | 000,029,455 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\ati1xbxx.sys
[2012/04/11 17:53:39 | 000,026,367 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\ati1snxx.sys
[2012/04/11 17:53:39 | 000,026,367 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\ati1snxx.sys
[2012/04/11 17:53:39 | 000,021,343 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\ati1ttxx.sys
[2012/04/11 17:53:39 | 000,021,343 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\ati1ttxx.sys
[2012/04/11 17:53:38 | 000,063,663 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\ati1rvxx.sys
[2012/04/11 17:53:38 | 000,063,663 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\ati1rvxx.sys
[2012/04/11 17:53:38 | 000,030,671 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\ati1raxx.sys
[2012/04/11 17:53:38 | 000,030,671 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\ati1raxx.sys
[2012/04/11 17:53:38 | 000,012,047 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\ati1pdxx.sys
[2012/04/11 17:53:38 | 000,012,047 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\ati1pdxx.sys
[2012/04/11 17:53:37 | 000,056,623 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\ati1btxx.sys
[2012/04/11 17:53:37 | 000,056,623 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\ati1btxx.sys
[2012/04/11 17:53:37 | 000,011,615 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\ati1mdxx.sys
[2012/04/11 17:53:37 | 000,011,615 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\dllcache\ati1mdxx.sys
[2012/04/11 17:35:09 | 000,000,000 | RHSD | C] – C:\cmdcons
[2012/04/11 17:32:03 | 000,518,144 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2012/04/11 17:32:03 | 000,406,528 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2012/04/11 17:32:03 | 000,060,416 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2012/04/11 17:32:02 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2012/04/11 17:31:24 | 000,000,000 | —D | C] – C:\Qoobox
[2012/04/11 17:27:36 | 004,458,963 | R— | C] (Swearware) – C:\Documents and Settings\Administrator\Desktop\jgh.exe
[2012/04/11 11:05:30 | 000,593,920 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Administrator\Desktop\OTL.exe
[2012/04/11 11:03:38 | 004,731,392 | —- | C] (AVAST Software) – C:\Documents and Settings\Administrator\Desktop\aswMBR.exe
[2012/04/11 10:09:41 | 000,040,776 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2012/04/10 17:59:43 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2012/04/10 17:59:35 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Adobe
[2012/03/19 16:11:54 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\My Documents\Amelunke

========== Files - Modified Within 30 Days ==========

[2012/04/14 11:01:02 | 000,000,664 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2012/04/14 09:51:54 | 000,007,025 | —- | M] () – C:\Documents and Settings\Administrator\Application Data\PrimoPDFSet.xml
[2012/04/14 09:51:50 | 000,032,293 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\System Resource Report.pdf
[2012/04/14 09:21:20 | 000,001,158 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2012/04/14 09:20:50 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2012/04/12 21:39:34 | 000,000,742 | —- | M] () – C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2012/04/12 21:39:34 | 000,000,724 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2012/04/12 21:13:56 | 000,349,792 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2012/04/12 20:45:44 | 002,071,600 | —- | M] (Kaspersky Lab ZAO) – C:\Documents and Settings\Administrator\Desktop\tdsskiller.exe
[2012/04/12 19:36:46 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2012/04/12 12:07:59 | 000,115,686 | —- | M] () – C:\WINDOWS\System32\itldvupd.dat
[2012/04/12 03:15:02 | 000,456,014 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2012/04/12 03:15:02 | 000,076,230 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2012/04/12 03:04:14 | 000,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2012/04/11 17:35:31 | 000,000,327 | RHS- | M] () – C:\boot.ini
[2012/04/11 17:26:00 | 004,458,963 | R— | M] (Swearware) – C:\Documents and Settings\Administrator\Desktop\jgh.exe
[2012/04/11 15:27:19 | 000,593,920 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Administrator\Desktop\OTL.exe
[2012/04/11 12:31:03 | 000,002,305 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Adobe Reader 9.lnk
[2012/04/11 11:21:06 | 000,002,463 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\HiJackThis.lnk
[2012/04/11 11:03:54 | 004,731,392 | —- | M] (AVAST Software) – C:\Documents and Settings\Administrator\Desktop\aswMBR.exe
[2012/04/11 10:09:41 | 000,040,776 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2012/04/10 18:52:33 | 000,011,914 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Francis Old.jpg
[2012/04/10 18:52:33 | 000,002,180 | —- | M] () – C:\Documents and Settings\Administrator\.recently-used.xbel
[2012/04/10 18:36:09 | 000,081,049 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Francis Old.gif
[2012/04/10 15:29:48 | 000,000,784 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012/04/07 20:00:11 | 000,054,156 | -H– | M] () – C:\WINDOWS\QTFont.qfn
[2012/04/04 15:56:40 | 000,022,344 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2012/03/29 10:40:26 | 000,002,497 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Microsoft Office Word 2003.lnk

========== Files Created - No Company Name ==========

[2012/04/14 09:51:50 | 000,032,293 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\System Resource Report.pdf
[2012/04/12 16:37:55 | 000,000,664 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2012/04/11 17:35:30 | 000,000,211 | —- | C] () – C:\Boot.bak
[2012/04/11 17:35:14 | 000,260,272 | RHS- | C] () – C:\cmldr
[2012/04/11 17:32:03 | 000,256,000 | —- | C] () – C:\WINDOWS\PEV.exe
[2012/04/11 17:32:03 | 000,208,896 | —- | C] () – C:\WINDOWS\MBR.exe
[2012/04/11 17:32:03 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2012/04/11 17:32:03 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2012/04/11 17:32:03 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2012/04/11 08:59:44 | 000,115,686 | —- | C] () – C:\WINDOWS\System32\itldvupd.dat
[2012/04/10 18:52:33 | 000,002,180 | —- | C] () – C:\Documents and Settings\Administrator\.recently-used.xbel
[2012/04/10 18:42:29 | 000,011,914 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\Francis Old.jpg
[2012/04/10 18:36:09 | 000,081,049 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\Francis Old.gif
[2012/04/10 15:29:48 | 000,000,784 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012/02/15 20:52:17 | 000,003,072 | —- | C] () – C:\WINDOWS\System32\iacenc.dll
[2012/02/07 11:12:33 | 000,201,528 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2011/10/31 15:49:25 | 000,000,020 | —- | C] () – C:\WINDOWS\MainWHnd.INI
[2011/10/31 15:48:17 | 000,000,284 | —- | C] () – C:\WINDOWS\GvSaveImage.ini
[2011/10/31 15:48:13 | 000,000,512 | —- | C] () – C:\WINDOWS\GeoImageProcess_8200.ini
[2011/10/31 15:36:53 | 000,000,390 | —- | C] () – C:\WINDOWS\GeoLan.ini
[2011/10/31 15:36:45 | 000,000,082 | —- | C] () – C:\WINDOWS\GeoDebug61.ini
[2010/08/26 14:47:52 | 000,311,296 | R— | C] () – C:\WINDOWS\System32\SimplyVBUnitLib.dll

========== Custom Scans ==========

< MD5 for: AEAUDIO.SYS >
[2002/04/01 09:15:00 | 000,004,816 | —- | M] (Andrea Electronics Corporation) MD5=11C04B17ED2ABBB4833694BCD644AC90 – C:\Compaq\AUDIO\ADI\SMAXWDM\SE\AEAUDIO.sys
[2002/04/01 09:15:00 | 000,004,816 | —- | M] (Andrea Electronics Corporation) MD5=11C04B17ED2ABBB4833694BCD644AC90 – C:\Compaq\AUDIO\ADI\SMAXWDM\W2K_XP\AEAUDIO.sys
[2002/04/01 09:15:00 | 000,004,816 | —- | M] (Andrea Electronics Corporation) MD5=11C04B17ED2ABBB4833694BCD644AC90 – C:\Compaq\AUDIO\AEAUDIO.sys
[2002/04/01 09:15:00 | 000,004,816 | —- | M] (Andrea Electronics Corporation) MD5=11C04B17ED2ABBB4833694BCD644AC90 – C:\Program Files\Analog Devices\SoundMAX\aeaudio.sys

< MD5 for: AGRSM.SYS >
[2004/06/29 04:07:18 | 001,268,204 | —- | M] (Agere Systems) MD5=593AEFC67283D409F34CC1245D00A509 – C:\Compaq\Modem\AGRSM.sys

< MD5 for: IALMKCHW.SYS >
[2003/08/03 18:16:00 | 000,096,858 | —- | M] (Intel Corporation) MD5=4AFEE4B1625D5146B16526E48953D7A6 – C:\Compaq\VIDEO\ialmkchw.sys

< MD5 for: IALMSBW.SYS >
[2003/08/03 18:16:08 | 000,120,094 | —- | M] (Intel Corporation) MD5=1A301C3C65A3D119803FBAC5AB65897F – C:\Compaq\VIDEO\ialmsbw.sys

< End of report >

oldman960

Post #23April 14, 2012, 6:24 PM UTC

Hi webster10,

I think we can find some replacements. We'll look for the rest and replace them all at once.

Next

Please open OTL.

Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, click the None button near the top (it may looked greyed out)
In the window under Custom Scans/Fixes copy and paste the following

netsvcs
/md5start
ialmnt5.*
wATV06nt.*
wATV10nt.*
wCh7xxNT.*
wATV04nt.*
wATV02NT.*
wATV01nt.*
wADV09nt.*
wADV08nt.*
wADV07nt.*
wVchNTxx.*
wSiINTxx.*
wADV05NT.*
wADV02NT.*
wADV01nt.*
i81xnt5.*
21461316.*
redbook.*
AFS2K.SYS
/md5stop
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AFS2K /s
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open a notepad window, OTL.Txt. Please post this log.

webster10

Post #24April 16, 2012, 2:42 PM UTC

Here it is:

OTL logfile created on: 4/16/2012 9:33:36 AM - Run 4
OTL by OldTimer - Version 3.2.39.2 Folder = C:\Documents and Settings\Administrator\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

502.80 Mb Total Physical Memory | 230.03 Mb Available Physical Memory | 45.75% Memory free
843.57 Mb Paging File | 580.48 Mb Available in Paging File | 68.81% Paging File free
Paging file location(s): C:\pagefile.sys 372 744 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 37.27 Gb Total Space | 18.65 Gb Free Space | 50.04% Space Free | Partition Type: NTFS

Computer Name: PEGGY | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: Off | File Age = 30 Days

NetSvcs: 6to4 - File not found
NetSvcs: HidServ - %SystemRoot%\System32\hidserv.dll File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: z800obex - %systemroot%\system32\rollbackclientservice.dll File not found
NetSvcs: DC21x4 - File not found
NetSvcs: IntuitUpdateService - %systemroot%\system32\imaservice.dll File not found
NetSvcs: dpfusmgr - File not found
NetSvcs: LMIRfsDriver - File not found
NetSvcs: pelmouse - File not found
NetSvcs: stylexpservice - File not found
NetSvcs: qfcoresvc - File not found
NetSvcs: nimdbgk - File not found
NetSvcs: dladresm - File not found
NetSvcs: WmdmPmSp - File not found

========== Custom Scans ==========

< MD5 for: AFS2K.SYS >
[2004/10/07 20:16:04 | 000,035,840 | —- | M] (Oak Technology Inc.) MD5=0EBB674888CBDEFD5773341C16DD6A07 – C:\WINDOWS\system32\drivers\AFS2K.SYS

< MD5 for: I81XNT5.IN_ >
[2004/08/04 07:00:00 | 000,002,604 | —- | M] () MD5=40340A5579115EF96B4E0EA64B1A03F5 – C:\i386\I81XNT5.IN_

< MD5 for: I81XNT5.INF >
[2004/07/17 13:36:30 | 000,011,718 | —- | M] () MD5=465E69000C694FD794168EE2ECD3952F – C:\WINDOWS\inf\i81xnt5.inf
[2004/07/17 13:36:30 | 000,011,718 | —- | M] () MD5=465E69000C694FD794168EE2ECD3952F – C:\WINDOWS\SD_OLD\Download\dd9ab5193501484cf5e6884fa1d22f9e\i81xnt5.inf
[2004/07/17 13:36:30 | 000,011,718 | —- | M] () MD5=465E69000C694FD794168EE2ECD3952F – C:\WINDOWS\ServicePackFiles\i386\i81xnt5.inf

< MD5 for: I81XNT5.PNF >
[2005/03/21 17:15:30 | 000,018,084 | —- | M] () MD5=9C05A433AE3224FE865DEA0BD4E89776 – C:\WINDOWS\inf\i81xnt5.PNF

< MD5 for: I81XNT5.SYS >
[2004/08/03 19:29:38 | 000,161,020 | —- | M] (Intel® Corporation) MD5=06B7EF73BA5F302EECC294CDF7E19702 – C:\WINDOWS\SD_OLD\Download\dd9ab5193501484cf5e6884fa1d22f9e\i81xnt5.sys
[2004/08/03 19:29:38 | 000,161,020 | —- | M] (Intel® Corporation) MD5=06B7EF73BA5F302EECC294CDF7E19702 – C:\WINDOWS\ServicePackFiles\i386\i81xnt5.sys

< MD5 for: IALMNT5.INF >
[2003/09/09 05:57:20 | 000,038,450 | —- | M] () MD5=76516F05D88BAB0B0A8E75AF35F31EF5 – C:\Compaq\VIDEO\ialmnt5.inf

< MD5 for: IALMNT5.PNF >
[2005/03/21 17:17:50 | 000,048,428 | —- | M] () MD5=1FDD8A554481E2DC324AA3E7218BD71C – C:\Compaq\VIDEO\ialmnt5.PNF

< MD5 for: IALMNT5.SYS >
[2003/08/03 18:15:04 | 000,091,419 | —- | M] (Intel Corporation) MD5=50D909FDAF6DF35B04C6B6A4BCB6D675 – C:\Compaq\VIDEO\ialmnt5.sys

< MD5 for: REDBOOK.SYS >
[2004/08/04 01:59:38 | 000,057,472 | —- | M] (Microsoft Corporation) MD5=B31B4588E4086D8D84ADBF9845C2402B – C:\WINDOWS\$NtServicePackUninstall$\redbook.sys
[2008/04/13 13:40:27 | 000,057,600 | —- | M] (Microsoft Corporation) MD5=F828DD7E1419B6653894A8F97A0094C5 – C:\WINDOWS\SD_OLD\Download\dd9ab5193501484cf5e6884fa1d22f9e\redbook.sys
[2008/04/13 13:40:27 | 000,057,600 | —- | M] (Microsoft Corporation) MD5=F828DD7E1419B6653894A8F97A0094C5 – C:\WINDOWS\ServicePackFiles\i386\redbook.sys
[2012/04/12 20:52:57 | 000,057,600 | —- | M] (Microsoft Corporation) MD5=F828DD7E1419B6653894A8F97A0094C5 – C:\WINDOWS\system32\drivers\redbook.sys

< MD5 for: WADV01NT.SYS >
[2004/08/03 19:29:38 | 000,012,415 | —- | M] (Intel® Corporation) MD5=7B5B44EFE5EB9DADFB8EE29700885D23 – C:\WINDOWS\SD_OLD\Download\dd9ab5193501484cf5e6884fa1d22f9e\wadv01nt.sys
[2004/08/03 19:29:38 | 000,012,415 | —- | M] (Intel® Corporation) MD5=7B5B44EFE5EB9DADFB8EE29700885D23 – C:\WINDOWS\ServicePackFiles\i386\wadv01nt.sys

< MD5 for: WADV02NT.SYS >
[2004/08/03 19:29:38 | 000,012,127 | —- | M] (Intel® Corporation) MD5=EB1F6BAB6C22EDE0BA551B527475F7E9 – C:\WINDOWS\SD_OLD\Download\dd9ab5193501484cf5e6884fa1d22f9e\wadv02nt.sys
[2004/08/03 19:29:38 | 000,012,127 | —- | M] (Intel® Corporation) MD5=EB1F6BAB6C22EDE0BA551B527475F7E9 – C:\WINDOWS\ServicePackFiles\i386\wadv02nt.sys

< MD5 for: WADV05NT.SYS >
[2004/08/03 19:29:38 | 000,011,775 | —- | M] (Intel® Corporation) MD5=03CE989D846C1AA81145CB22FCB86D06 – C:\WINDOWS\SD_OLD\Download\dd9ab5193501484cf5e6884fa1d22f9e\wadv05nt.sys
[2004/08/03 19:29:38 | 000,011,775 | —- | M] (Intel® Corporation) MD5=03CE989D846C1AA81145CB22FCB86D06 – C:\WINDOWS\ServicePackFiles\i386\wadv05nt.sys

< MD5 for: WADV07NT.SYS >
[2004/08/03 19:29:40 | 000,011,807 | —- | M] (Intel® Corporation) MD5=0308AEF61941E4AF478FA1A0F83812F5 – C:\WINDOWS\SD_OLD\Download\dd9ab5193501484cf5e6884fa1d22f9e\wadv07nt.sys
[2004/08/03 19:29:40 | 000,011,807 | —- | M] (Intel® Corporation) MD5=0308AEF61941E4AF478FA1A0F83812F5 – C:\WINDOWS\ServicePackFiles\i386\wadv07nt.sys

< MD5 for: WADV08NT.SYS >
[2004/08/03 19:29:40 | 000,011,295 | —- | M] (Intel® Corporation) MD5=714038A8AA5DE08E12062202CD7EAEB5 – C:\WINDOWS\SD_OLD\Download\dd9ab5193501484cf5e6884fa1d22f9e\wadv08nt.sys
[2004/08/03 19:29:40 | 000,011,295 | —- | M] (Intel® Corporation) MD5=714038A8AA5DE08E12062202CD7EAEB5 – C:\WINDOWS\ServicePackFiles\i386\wadv08nt.sys

< MD5 for: WADV09NT.SYS >
[2004/08/03 19:29:42 | 000,011,871 | —- | M] (Intel® Corporation) MD5=7BB3AA595E4507A788DE1CDC63F4C8C4 – C:\WINDOWS\SD_OLD\Download\dd9ab5193501484cf5e6884fa1d22f9e\wadv09nt.sys
[2004/08/03 19:29:42 | 000,011,871 | —- | M] (Intel® Corporation) MD5=7BB3AA595E4507A788DE1CDC63F4C8C4 – C:\WINDOWS\ServicePackFiles\i386\wadv09nt.sys

< MD5 for: WATV01NT.SYS >
[2004/08/03 19:29:42 | 000,029,311 | —- | M] (Intel® Corporation) MD5=D83BDD5C059667A2F647A6BE5703A4D2 – C:\WINDOWS\SD_OLD\Download\dd9ab5193501484cf5e6884fa1d22f9e\watv01nt.sys
[2004/08/03 19:29:42 | 000,029,311 | —- | M] (Intel® Corporation) MD5=D83BDD5C059667A2F647A6BE5703A4D2 – C:\WINDOWS\ServicePackFiles\i386\watv01nt.sys

< MD5 for: WATV02NT.SYS >
[2004/08/03 19:29:44 | 000,019,551 | —- | M] (Intel® Corporation) MD5=ED968D23354DAA0D7C621580C012A1F6 – C:\WINDOWS\SD_OLD\Download\dd9ab5193501484cf5e6884fa1d22f9e\watv02nt.sys
[2004/08/03 19:29:44 | 000,019,551 | —- | M] (Intel® Corporation) MD5=ED968D23354DAA0D7C621580C012A1F6 – C:\WINDOWS\ServicePackFiles\i386\watv02nt.sys

< MD5 for: WATV04NT.SYS >
[2004/08/03 19:29:44 | 000,033,599 | —- | M] (Intel® Corporation) MD5=D738273F218A224C1DDAC04203F27A84 – C:\WINDOWS\SD_OLD\Download\dd9ab5193501484cf5e6884fa1d22f9e\watv04nt.sys
[2004/08/03 19:29:44 | 000,033,599 | —- | M] (Intel® Corporation) MD5=D738273F218A224C1DDAC04203F27A84 – C:\WINDOWS\ServicePackFiles\i386\watv04nt.sys

< MD5 for: WATV06NT.SYS >
[2004/08/03 19:29:46 | 000,022,271 | —- | M] (Intel® Corporation) MD5=352FA0E98BC461CE1CE5D41F64DB558D – C:\WINDOWS\SD_OLD\Download\dd9ab5193501484cf5e6884fa1d22f9e\watv06nt.sys
[2004/08/03 19:29:46 | 000,022,271 | —- | M] (Intel® Corporation) MD5=352FA0E98BC461CE1CE5D41F64DB558D – C:\WINDOWS\ServicePackFiles\i386\watv06nt.sys

< MD5 for: WATV10NT.SYS >
[2004/08/03 19:29:46 | 000,025,471 | —- | M] (Intel® Corporation) MD5=791CC45DE6E50445BE72E8AD6401FF45 – C:\WINDOWS\SD_OLD\Download\dd9ab5193501484cf5e6884fa1d22f9e\watv10nt.sys
[2004/08/03 19:29:46 | 000,025,471 | —- | M] (Intel® Corporation) MD5=791CC45DE6E50445BE72E8AD6401FF45 – C:\WINDOWS\ServicePackFiles\i386\watv10nt.sys

< MD5 for: WCH7XXNT.SYS >
[2004/08/03 19:29:46 | 000,023,615 | —- | M] (Intel® Corporation) MD5=0052D118995CBAB152DAABE6106D1442 – C:\WINDOWS\SD_OLD\Download\dd9ab5193501484cf5e6884fa1d22f9e\wch7xxnt.sys
[2004/08/03 19:29:46 | 000,023,615 | —- | M] (Intel® Corporation) MD5=0052D118995CBAB152DAABE6106D1442 – C:\WINDOWS\ServicePackFiles\i386\wch7xxnt.sys

< MD5 for: WSIINTXX.SYS >
[2004/08/03 19:29:48 | 000,012,063 | —- | M] (Intel® Corporation) MD5=525849B4469DE021D5D61B4DB9BE3A9D – C:\WINDOWS\SD_OLD\Download\dd9ab5193501484cf5e6884fa1d22f9e\wsiintxx.sys
[2004/08/03 19:29:48 | 000,012,063 | —- | M] (Intel® Corporation) MD5=525849B4469DE021D5D61B4DB9BE3A9D – C:\WINDOWS\ServicePackFiles\i386\wsiintxx.sys

< MD5 for: WVCHNTXX.SYS >
[2004/08/03 19:29:50 | 000,019,455 | —- | M] (Intel® Corporation) MD5=589C2BCDB5BD602BF7B63D210407EF8C – C:\WINDOWS\SD_OLD\Download\dd9ab5193501484cf5e6884fa1d22f9e\wvchntxx.sys
[2004/08/03 19:29:50 | 000,019,455 | —- | M] (Intel® Corporation) MD5=589C2BCDB5BD602BF7B63D210407EF8C – C:\WINDOWS\ServicePackFiles\i386\wvchntxx.sys

< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AFS2K /s >
"DisplayName" = AFS2k
"Type" = 1
"Start" = 1
"Group" = SCSI CDROM Class
"Tag" = 1
"ErrorControl" = 1
"DriverMainControl" = 0
"BuildID" = 3.1.21.2(1103)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AFS2K\7-0-0]
"AFS_Enabled" = 0
"TUR_Blocked" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AFS2K\Enum]
"0" = IDE\CdRomSONY_CD-RW__CRX230EE____________________2YS4____\5&1983efef&0&0.0.0
"Count" = 2
"NextInstance" = 2
"1" = IDE\CdRomLITE-ON_CD-ROM_LTN-4891S________________NQS5____\5&1983efef&0&0.1.0

< End of report >

Thank you. Welcome to Monday.

oldman960

Post #25April 16, 2012, 4:00 PM UTC

Hi webster10,

I need you to create two fixes. First create a registry fix.

Open a new Notepad session

Click the Start button, click run
in the run box type notepad
click ok
In the notepad, Click "Format" and be certain that Word Wrap is not checked.
Copy and paste all the text in the code box below into the Notepad. Do Not copy the word CODE

REGEDIT4

[HKEY_LOCAL_MACHINE\System\CrrentControlSet\Services\redbook]
 "ImagePath"=hex(2):73,79,73,74,65,6D,33,32,5C,64,72,69,76,65,\
  72,73,5C,72,65,64,62,6F,6F,6B,2E,73,79,73,00

Ensure there is no space above the REGEDIT4.
ensure the text matches including the space between lines
in notepad go to FILE > SAVE AS and in the dropdown box, set the top box SAVE IN to DESKTOP
in the FILE NAME box type (including the " " marks), "fix.reg"

Click save.

This will create a fix.reg file on your desktop [external image: Posted Image]

To use this file you will need to right click the icon and select merge, accept the warning if it appears and you are done.

Next, create this batch file.

Open a new Notepad session

Click the Start button, click run
in the run box type notepad
click ok
In the notepad, Click "Format" and be certain that Word Wrap is not checked.
Copy and paste all the text in the code box below into the Notepad.

Do Not copy the word CODE

copy "C:\WINDOWS\ServicePackFiles\i386\i81xnt5.sys" "C:\WINDOWS\system32\drivers"
copy "C:\WINDOWS\ServicePackFiles\i386\watv06nt.sys" "C:\WINDOWS\system32\drivers"
copy "C:\WINDOWS\ServicePackFiles\i386\wadv01nt.sys" "C:\WINDOWS\system32\drivers"
copy "C:\WINDOWS\ServicePackFiles\i386\wadv02nt.sys" "C:\WINDOWS\system32\drivers"
copy "C:\WINDOWS\ServicePackFiles\i386\wadv05nt.sys" "C:\WINDOWS\system32\drivers"
copy "C:\WINDOWS\ServicePackFiles\i386\wadv07nt.sys" "C:\WINDOWS\system32\drivers"
copy "C:\WINDOWS\ServicePackFiles\i386\wadv08nt.sys" "C:\WINDOWS\system32\drivers"
copy "C:\WINDOWS\ServicePackFiles\i386\wadv09nt.sys" "C:\WINDOWS\system32\drivers"
copy "C:\WINDOWS\ServicePackFiles\i386\watv01nt.sys" "C:\WINDOWS\system32\drivers"
copy "C:\WINDOWS\ServicePackFiles\i386\watv02nt.sys" "C:\WINDOWS\system32\drivers"
copy "C:\WINDOWS\ServicePackFiles\i386\watv04nt.sys" "C:\WINDOWS\system32\drivers"
copy "C:\WINDOWS\ServicePackFiles\i386\watv06nt.sys" "C:\WINDOWS\system32\drivers"
copy "C:\WINDOWS\ServicePackFiles\i386\watv10nt.sys" "C:\WINDOWS\system32\drivers"
copy "C:\WINDOWS\ServicePackFiles\i386\wch7xxnt.sys" "C:\WINDOWS\system32\drivers"
copy "C:\WINDOWS\ServicePackFiles\i386\wsiintxx.sys" "C:\WINDOWS\system32\drivers"
copy "C:\WINDOWS\ServicePackFiles\i386\wvchntxx.sys" "C:\WINDOWS\system32\drivers"
copy "C:\Compaq\VIDEO\ialmnt5.sys" "C:\WINDOWS\system32\drivers"
copy "C:\Compaq\Modem\AGRSM.sys" "C:\WINDOWS\system32\drivers"
copy "C:\Compaq\AUDIO\AEAUDIO.sys" "C:\WINDOWS\system32\drivers"
copy "C:\Compaq\VIDEO\ialmkchw.sys" "C:\WINDOWS\system32\drivers"
copy "C:\Compaq\VIDEO\ialmsbw.sys" "C:\WINDOWS\system32\drivers"

In the notepad

Click File, Save as…, and set the Save in to your Desktop
In the filename box, type (including quotation marks) as the filename: "myfix.bat"
Click save

You will have a new file on your desktop called myfix.bat with an icon that looks like this 📎bat.jpg

Double click myfix.bat to run it.

Reboot your computer.

Have any of the issues been resolved?

Please rerun OTL Just click the quick scan button and post the log.

webster10

Post #26April 16, 2012, 5:19 PM UTC

quick scan report

OTL logfile created on: 4/16/2012 11:24:42 AM - Run 5
OTL by OldTimer - Version 3.2.39.2 Folder = C:\Documents and Settings\Administrator\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

502.80 Mb Total Physical Memory | 69.74 Mb Available Physical Memory | 13.87% Memory free
843.82 Mb Paging File | 265.64 Mb Available in Paging File | 31.48% Paging File free
Paging file location(s): C:\pagefile.sys 372 744 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 37.27 Gb Total Space | 18.69 Gb Free Space | 50.16% Space Free | Partition Type: NTFS

Computer Name: PEGGY | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Administrator\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe (W3i, LLC)
PRC - C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe (Trend Micro Inc.)
PRC - C:\Program Files\Trend Micro\AMSP\coreFrameworkHost.exe (Trend Micro Inc.)
PRC - C:\Program Files\Trend Micro\UniClient\UiFrmwrk\uiWatchDog.exe (Trend Micro Inc.)
PRC - C:\Program Files\Trend Micro\UniClient\UiFrmwrk\uiSeAgnt.exe (Trend Micro Inc.)
PRC - C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
PRC - C:\Program Files\Trend Micro\RUBotted\TMRUBottedTray.exe (Trend Micro Inc.)
PRC - C:\Program Files\Trend Micro\RUBotted\TMRUBotted.exe (Trend Micro Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe (Adobe Systems Incorporated)

========== Modules (No Company Name) ==========

MOD - C:\Program Files\Trend Micro\UniClient\plugins\LUADLL.dll ()
MOD - C:\Program Files\Trend Micro\AMSP\sqlite3.dll ()
MOD - C:\Program Files\Trend Micro\AMSP\libprotobuf.dll ()
MOD - C:\Program Files\Trend Micro\AMSP\boost_date_time-vc80-mt-1_36.dll ()
MOD - C:\Program Files\Trend Micro\AMSP\boost_thread-vc80-mt-1_36.dll ()
MOD - C:\Program Files\FileZilla FTP Client\fzshellext.dll ()
MOD - C:\Program Files\Trend Micro\RUBotted\libexpat.dll ()
MOD - C:\Program Files\Trend Micro\RUBotted\sqlite3.dll ()
MOD - C:\WINDOWS\system32\Primomonnt.dll ()

========== Win32 Services (SafeList) ==========

SRV - (z800obex) – %systemroot%\system32\rollbackclientservice.dll File not found
SRV - (IntuitUpdateService) – %systemroot%\system32\imaservice.dll File not found
SRV - (HidServ) – %SystemRoot%\System32\hidserv.dll File not found
SRV - (Amsp) – C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe coreFrameworkHost.exe File not found
SRV - (McComponentHostService) – C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe (McAfee, Inc.)
SRV - (RUBotted) – C:\Program Files\Trend Micro\RUBotted\TMRUBotted.exe (Trend Micro Inc.)

========== Driver Services (SafeList) ==========

DRV - (WDICA) – File not found
DRV - (redbook) – system32\drivers\tsk111.tmp File not found
DRV - (PDRFRAME) – File not found
DRV - (PDRELI) – File not found
DRV - (PDFRAME) – File not found
DRV - (PDCOMP) – File not found
DRV - (PCIDump) – File not found
DRV - (lbrtfdc) – File not found
DRV - (ialm) – system32\DRIVERS\ialmnt5.sys File not found
DRV - (iAimTV6) – system32\DRIVERS\wATV06nt.sys File not found
DRV - (iAimTV5) – system32\DRIVERS\wATV10nt.sys File not found
DRV - (iAimTV4) – system32\DRIVERS\wCh7xxNT.sys File not found
DRV - (iAimTV3) – system32\DRIVERS\wATV04nt.sys File not found
DRV - (iAimTV1) – system32\DRIVERS\wATV02NT.sys File not found
DRV - (iAimTV0) – system32\DRIVERS\wATV01nt.sys File not found
DRV - (iAimFP7) – system32\DRIVERS\wADV09nt.sys File not found
DRV - (iAimFP6) – system32\DRIVERS\wADV08nt.sys File not found
DRV - (iAimFP5) – system32\DRIVERS\wADV07nt.sys File not found
DRV - (iAimFP4) – system32\DRIVERS\wVchNTxx.sys File not found
DRV - (iAimFP3) – system32\DRIVERS\wSiINTxx.sys File not found
DRV - (iAimFP2) – system32\DRIVERS\wADV05NT.sys File not found
DRV - (iAimFP1) – system32\DRIVERS\wADV02NT.sys File not found
DRV - (iAimFP0) – system32\DRIVERS\wADV01nt.sys File not found
DRV - (i81x) – system32\DRIVERS\i81xnt5.sys File not found
DRV - (i2omgmt) – File not found
DRV - (Changer) – File not found
DRV - (catchme) – C:\jgh\catchme.sys File not found
DRV - (AgereSoftModem) – system32\DRIVERS\AGRSM.sys File not found
DRV - (aeaudio) – system32\drivers\aeaudio.sys File not found
DRV - (76851537) – system32\drivers\21461316.sys File not found
DRV - ({D31A0762-0CEB-444e-ACFF-B049A1F6FE91}) Intel® Graphics Chipset (KCH) – system32\drivers\ialmkchw.sys File not found
DRV - ({6080A529-897E-4629-A488-ABA0C29B635E}) Intel® Graphics Platform (SoftBIOS) – system32\drivers\ialmsbw.sys File not found
DRV - (SASKUTIL) – C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASDIFSV) – C:\Program Files\SUPERAntiSpyware\sasdifsv.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (TMPassthruMP) – C:\WINDOWS\system32\drivers\TMPassthru.sys (Trend Micro Inc.)
DRV - (TMPassthru) – C:\WINDOWS\system32\drivers\TMPassthru.sys (Trend Micro Inc.)
DRV - (AFS2K) – C:\WINDOWS\System32\drivers\AFS2K.SYS (Oak Technology Inc.)
DRV - (Symmpi) – C:\WINDOWS\system32\drivers\symmpi.sys (LSI Logic)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://go.compaq.com/1Q00CDT/0409/bl8.asp
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…ferrer:source?}
IE - HKLM\..\SearchScopes\{E4013329-B79F-4680-AD25-5D4D64F28342}: "URL" = http://www.onestepsearch.net/?prt=ONESTEP1…s={searchTerms}

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Yahoo! Search
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://search.yahoo.com/search?p={searchTe…-8&fr=b1ie7
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKCU\..\URLSearchHook: - No CLSID value found
IE - HKCU\..\SearchScopes,DefaultScope = {0C55421B-685A-4156-A691-073C1D6AEBD2}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…amp;Form=IE8SRC
IE - HKCU\..\SearchScopes\{0C55421B-685A-4156-A691-073C1D6AEBD2}: "URL" = http://search.yahoo.com/search?p={searchTe…-8&fr=b1ie7
IE - HKCU\..\SearchScopes\{579457C0-C7D6-481B-8DBF-3CA259316F8C}: "URL" = http://rover.ebay.com/rover/1/711-43047-14…e={searchTerms}
IE - HKCU\..\SearchScopes\{D5EF9B3F-A073-433A-BDDE-BE64509C0AB3}: "URL" = http://www.flickr.com/search/?q={searchTerms}
IE - HKCU\..\SearchScopes\{E58FD494-9104-4DA0-AD13-7C6A590592BD}: "URL" = http://delicious.com/search?p={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Yahoo"
FF - prefs.js..browser.search.defaulturl: "http://search.yahoo.com/search?ei=UTF-8&fr=ytff-&p="
FF - prefs.js..browser.search.param.yahoo-fr: "moz2-ytff-"
FF - prefs.js..browser.search.param.yahoo-fr-cjkt: "moz2-ytff-"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "http://www.yahoo.com/"
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.3.6.20110307083656
FF - prefs.js..keyword.URL: "http://search.yahoo.com/search?ei=UTF-8&fr=ytff-&p="
FF - prefs.js..network.proxy.type: 1

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/npracplug;version=1.0.0.0: C:\Program Files\Real\RealArcade\Plugins\Mozilla\npracplug.dll (RealNetworks)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{22C7F6C6-8D67-4534-92B5-529A0EC09405}: C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1505\6.6.1088\firefoxextension\ [2012/04/16 11:19:47 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/04/12 21:39:30 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/09/01 14:45:18 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 2.0.0.18\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2008/11/25 12:38:29 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 2.0.0.18\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{ABC82C52-8331-11E1-826D-B8AC6F996F26}: C:\Documents and Settings\Administrator\Local Settings\Application Data\{ABC82C52-8331-11E1-826D-B8AC6F996F26}\

[2008/12/23 10:38:55 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Extensions
[2012/02/03 17:55:28 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ugvbjuwp.default\extensions
[2012/01/25 17:25:51 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ugvbjuwp.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2012/04/12 21:39:26 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2012/04/12 21:39:27 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\distribution\extensions
[2012/04/12 21:39:27 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Program Files\Mozilla Firefox\distribution\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2011/11/20 23:04:51 | 000,134,104 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2010/02/03 18:28:29 | 000,028,472 | —- | M] (WebEx Communications, Inc) – C:\Program Files\mozilla firefox\plugins\atgpcdec.dll
[2010/02/03 18:28:29 | 000,185,224 | —- | M] (WebEx Communications, Inc) – C:\Program Files\mozilla firefox\plugins\atgpcext.dll
[2010/02/03 18:28:28 | 000,061,832 | —- | M] (WebEx Communications, Inc) – C:\Program Files\mozilla firefox\plugins\npatgpc.dll
[2011/03/18 13:32:12 | 000,091,552 | —- | M] (Coupons, Inc.) – C:\Program Files\mozilla firefox\plugins\npCouponPrinter.dll
[2011/03/18 13:32:14 | 000,091,552 | —- | M] (Coupons, Inc.) – C:\Program Files\mozilla firefox\plugins\npMozCouponPrinter.dll
[2011/11/20 20:04:05 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2011/11/20 20:04:05 | 000,002,040 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}source
id=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms}

O1 HOSTS File: ([2012/04/12 19:36:46 | 000,000,027 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (TmIEPlugInBHO Class) - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files\Trend Micro\AMSP\module\20004\1.5.1505\6.6.1088\TmIEPlg.dll (Trend Micro Inc.)
O2 - BHO: (TmBpIeBHO Class) - {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.5.1234\6.5.1234\TmBpIe32.dll File not found
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {871F91FD-3A92-4988-A842-16AB2CFF5AF1} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found.
O4 - HKLM..\Run: [Adobe Photo Downloader] C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [SetRefresh] C:\Program Files\Compaq\SetRefresh\SetRefresh.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [srmclean] C:\cpqs\scom\srmclean.exe ()
O4 - HKLM..\Run: [TMRUBottedTray] C:\Program Files\Trend Micro\RUBotted\TMRUBottedTray.exe (Trend Micro Inc.)
O4 - HKLM..\Run: [Trend Micro Client Framework] C:\Program Files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe (Trend Micro Inc.)
O4 - HKLM..\Run: [Trend Micro Titanium] C:\Program Files\Trend Micro\Titanium\UIFramework\uiWinMgr.exe (Trend Micro Inc.)
O4 - HKCU..\Run: [InstallIQUpdater] C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe (W3i, LLC)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk = C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O15 - HKCU\..Trusted Domains: westlaw.com ([]* in Trusted sites)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Reg Error: Key error.)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/C/0…heckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab (Symantec AntiVirus scanner)
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} http://photos.walmart.com/WalmartActivia.cab (Snapfish Activia)
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} http://cdn.scan.onecare.live.com/resource/…lscbase5483.cab (Windows Live Safety Center Base Module)
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab (Symantec RuFSI Utility Class)
O16 - DPF: {6824D897-F7E1-4E41-B84B-B1D3FA4BF1BD} http://utilities.pcpitstop.com/Exterminate…opAntiVirus.dll (PCPitstop AntiVirus)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_06)
O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{293A756F-F0E8-4250-BFB4-F00ACF54F34F}: DhcpNameServer = [removed] [removed] [removed]
O18 - Protocol\Handler\tmbp {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.5.1234\6.5.1234\TmBpIe32.dll File not found
O18 - Protocol\Handler\tmpx {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\module\20004\1.5.1505\6.6.1088\TmIEPlg.dll (Trend Micro Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - (C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL) - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O20 - Winlogon\Notify\igfxcui: DllName - (igfxsrvc.dll) - File not found
O24 - Desktop Components:0 () - http://mail.charter.net/images/portal/msgt…S&v=charter
O24 - Desktop Components:1 (My Current Home Page) - About:Home
O24 - Desktop WallPaper: C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - C:\Program Files\Windows Defender\MpShHook.dll (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2012/04/12 20:51:34 | 000,000,000 | —D | C] – C:\TDSSKiller_Quarantine
[2012/04/12 20:46:01 | 002,071,600 | —- | C] (Kaspersky Lab ZAO) – C:\Documents and Settings\Administrator\Desktop\tdsskiller.exe
[2012/04/12 20:41:09 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2012/04/11 17:35:09 | 000,000,000 | RHSD | C] – C:\cmdcons
[2012/04/11 17:32:03 | 000,518,144 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2012/04/11 17:32:03 | 000,406,528 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2012/04/11 17:32:03 | 000,060,416 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2012/04/11 17:32:02 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2012/04/11 17:31:24 | 000,000,000 | —D | C] – C:\Qoobox
[2012/04/11 17:27:36 | 004,458,963 | R— | C] (Swearware) – C:\Documents and Settings\Administrator\Desktop\jgh.exe
[2012/04/11 11:05:30 | 000,593,920 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Administrator\Desktop\OTL.exe
[2012/04/11 11:03:38 | 004,731,392 | —- | C] (AVAST Software) – C:\Documents and Settings\Administrator\Desktop\aswMBR.exe
[2012/04/11 10:09:41 | 000,040,776 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2012/04/10 17:59:43 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2012/04/10 17:59:35 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Adobe
[2012/03/19 16:11:54 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\My Documents\Amelunke

========== Files - Modified Within 30 Days ==========

[2012/04/16 11:17:59 | 000,000,664 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2012/04/16 11:17:43 | 000,001,158 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2012/04/16 11:17:20 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2012/04/16 11:13:30 | 000,003,342 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\myfix.bat
[2012/04/16 11:08:26 | 000,000,185 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\fix.reg
[2012/04/14 09:51:54 | 000,007,025 | —- | M] () – C:\Documents and Settings\Administrator\Application Data\PrimoPDFSet.xml
[2012/04/14 09:51:50 | 000,032,293 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\System Resource Report.pdf
[2012/04/12 21:39:34 | 000,000,742 | —- | M] () – C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2012/04/12 21:39:34 | 000,000,724 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Mozilla Firefox.lnk
[2012/04/12 21:13:56 | 000,349,792 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2012/04/12 20:45:44 | 002,071,600 | —- | M] (Kaspersky Lab ZAO) – C:\Documents and Settings\Administrator\Desktop\tdsskiller.exe
[2012/04/12 19:36:46 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2012/04/12 12:07:59 | 000,115,686 | —- | M] () – C:\WINDOWS\System32\itldvupd.dat
[2012/04/12 03:15:02 | 000,456,014 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2012/04/12 03:15:02 | 000,076,230 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2012/04/12 03:04:14 | 000,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2012/04/11 17:35:31 | 000,000,327 | RHS- | M] () – C:\boot.ini
[2012/04/11 17:26:00 | 004,458,963 | R— | M] (Swearware) – C:\Documents and Settings\Administrator\Desktop\jgh.exe
[2012/04/11 15:27:19 | 000,593,920 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Administrator\Desktop\OTL.exe
[2012/04/11 12:31:03 | 000,002,305 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Adobe Reader 9.lnk
[2012/04/11 11:21:06 | 000,002,463 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\HiJackThis.lnk
[2012/04/11 11:03:54 | 004,731,392 | —- | M] (AVAST Software) – C:\Documents and Settings\Administrator\Desktop\aswMBR.exe
[2012/04/11 10:09:41 | 000,040,776 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2012/04/10 18:52:33 | 000,011,914 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Francis Old.jpg
[2012/04/10 18:52:33 | 000,002,180 | —- | M] () – C:\Documents and Settings\Administrator\.recently-used.xbel
[2012/04/10 18:36:09 | 000,081,049 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Francis Old.gif
[2012/04/10 15:29:48 | 000,000,784 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012/04/07 20:00:11 | 000,054,156 | -H– | M] () – C:\WINDOWS\QTFont.qfn
[2012/04/04 15:56:40 | 000,022,344 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2012/03/29 10:40:26 | 000,002,497 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Microsoft Office Word 2003.lnk
[2012/03/19 14:39:57 | 000,051,464 | —- | M] () – C:\Documents and Settings\Administrator\My Documents\BELLIS General Warranty Deed 2012-1.pdf

========== Files Created - No Company Name ==========

[2012/04/16 11:13:29 | 000,003,342 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\myfix.bat
[2012/04/16 11:08:26 | 000,000,185 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\fix.reg
[2012/04/14 09:51:50 | 000,032,293 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\System Resource Report.pdf
[2012/04/12 16:37:55 | 000,000,664 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2012/04/11 17:35:30 | 000,000,211 | —- | C] () – C:\Boot.bak
[2012/04/11 17:35:14 | 000,260,272 | RHS- | C] () – C:\cmldr
[2012/04/11 17:32:03 | 000,256,000 | —- | C] () – C:\WINDOWS\PEV.exe
[2012/04/11 17:32:03 | 000,208,896 | —- | C] () – C:\WINDOWS\MBR.exe
[2012/04/11 17:32:03 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2012/04/11 17:32:03 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2012/04/11 17:32:03 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2012/04/11 08:59:44 | 000,115,686 | —- | C] () – C:\WINDOWS\System32\itldvupd.dat
[2012/04/10 18:52:33 | 000,002,180 | —- | C] () – C:\Documents and Settings\Administrator\.recently-used.xbel
[2012/04/10 18:42:29 | 000,011,914 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\Francis Old.jpg
[2012/04/10 18:36:09 | 000,081,049 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\Francis Old.gif
[2012/04/10 15:29:48 | 000,000,784 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012/03/19 14:41:22 | 000,051,464 | —- | C] () – C:\Documents and Settings\Administrator\My Documents\BELLIS General Warranty Deed 2012-1.pdf
[2012/02/15 20:52:17 | 000,003,072 | —- | C] () – C:\WINDOWS\System32\iacenc.dll
[2012/02/07 11:12:33 | 000,201,528 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2011/10/31 15:49:25 | 000,000,020 | —- | C] () – C:\WINDOWS\MainWHnd.INI
[2011/10/31 15:48:17 | 000,000,284 | —- | C] () – C:\WINDOWS\GvSaveImage.ini
[2011/10/31 15:48:13 | 000,000,512 | —- | C] () – C:\WINDOWS\GeoImageProcess_8200.ini
[2011/10/31 15:36:53 | 000,000,390 | —- | C] () – C:\WINDOWS\GeoLan.ini
[2011/10/31 15:36:45 | 000,000,082 | —- | C] () – C:\WINDOWS\GeoDebug61.ini
[2010/08/26 14:47:52 | 000,311,296 | R— | C] () – C:\WINDOWS\System32\SimplyVBUnitLib.dll

========== LOP Check ==========

[2011/07/22 15:13:11 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\.oit
[2010/11/21 22:59:45 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Amazon
[2011/04/27 13:07:43 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\FileZilla
[2012/02/06 00:28:56 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Gaia Family Tree
[2012/04/10 18:52:33 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\gtk-2.0
[2007/01/11 16:17:13 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Leadertech
[2011/08/19 14:49:46 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Riyxo
[2010/09/18 11:12:11 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\RootsMagic
[2010/03/13 02:00:09 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\SecondLife
[2007/07/20 21:54:44 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Snapfish
[2008/11/25 12:38:29 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Thunderbird
[2011/08/20 10:41:22 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Vuam
[2011/08/20 10:41:22 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\lB06700CkPbP06700
[2007/06/27 13:35:54 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\n7-89-o9-3r-4t-r9
[2008/11/12 10:40:53 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PCPitstop
[2010/09/18 11:10:03 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\RootsMagic
[2007/06/27 13:36:01 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Sandlot Games
[2006/12/04 11:36:22 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Softdisk LLC
[2011/07/26 17:39:27 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\W3i

========== Purity Check ==========

< End of report >

oldman960

Post #27April 16, 2012, 10:23 PM UTC

Hi webster10,

That didn't seem to work. Did you recieve any error messages? Let's try it this way.

Next, Double click on OTL.exe

Under the Custom Scans/Fixes box at the bottom, paste in the following
Do Not copy the word CODE
please note the fix starts with the :

:Services

:Reg
[HKEY_LOCAL_MACHINE\System\CrrentControlSet\Services\redbook]
"ImagePath"=hex(2):73,79,73,74,65,6D,33,32,5C,64,72,69,76,65,\
  72,73,5C,72,65,64,62,6F,6F,6B,2E,73,79,73,00

:Files
copy "C:\WINDOWS\ServicePackFiles\i386\i81xnt5.sys" "C:\WINDOWS\system32\drivers" /c
copy "C:\WINDOWS\ServicePackFiles\i386\watv06nt.sys" "C:\WINDOWS\system32\drivers" /c
copy "C:\WINDOWS\ServicePackFiles\i386\wadv01nt.sys" "C:\WINDOWS\system32\drivers" /c
copy "C:\WINDOWS\ServicePackFiles\i386\wadv02nt.sys" "C:\WINDOWS\system32\drivers" /c
copy "C:\WINDOWS\ServicePackFiles\i386\wadv05nt.sys" "C:\WINDOWS\system32\drivers" /c
copy "C:\WINDOWS\ServicePackFiles\i386\wadv07nt.sys" "C:\WINDOWS\system32\drivers" /c
copy "C:\WINDOWS\ServicePackFiles\i386\wadv08nt.sys" "C:\WINDOWS\system32\drivers" /c
copy "C:\WINDOWS\ServicePackFiles\i386\wadv09nt.sys" "C:\WINDOWS\system32\drivers" /c
copy "C:\WINDOWS\ServicePackFiles\i386\watv01nt.sys" "C:\WINDOWS\system32\drivers" /c
copy "C:\WINDOWS\ServicePackFiles\i386\watv02nt.sys" "C:\WINDOWS\system32\drivers" /c
copy "C:\WINDOWS\ServicePackFiles\i386\watv04nt.sys" "C:\WINDOWS\system32\drivers" /c
copy "C:\WINDOWS\ServicePackFiles\i386\watv06nt.sys" "C:\WINDOWS\system32\drivers" /c
copy "C:\WINDOWS\ServicePackFiles\i386\watv10nt.sys" "C:\WINDOWS\system32\drivers" /c
copy "C:\WINDOWS\ServicePackFiles\i386\wch7xxnt.sys" "C:\WINDOWS\system32\drivers" /c
copy "C:\WINDOWS\ServicePackFiles\i386\wsiintxx.sys" "C:\WINDOWS\system32\drivers" /c
copy "C:\WINDOWS\ServicePackFiles\i386\wvchntxx.sys" "C:\WINDOWS\system32\drivers" /c
copy "C:\Compaq\VIDEO\ialmnt5.sys" "C:\WINDOWS\system32\drivers" /c
copy "C:\Compaq\Modem\AGRSM.sys" "C:\WINDOWS\system32\drivers" /c
copy "C:\Compaq\AUDIO\AEAUDIO.sys" "C:\WINDOWS\system32\drivers" /c
copy "C:\Compaq\VIDEO\ialmkchw.sys" "C:\WINDOWS\system32\drivers" /c
copy "C:\Compaq\VIDEO\ialmsbw.sys" "C:\WINDOWS\system32\drivers" /c

Then click the Run Fix button at the top

Let the program run unhindered
Please save the resulting log to be posted in your next reply.
Reboot your computer

Please post the OTL fix log along with a new OTL quick scan log.

Thanks

webster10

Post #28April 17, 2012, 3:25 PM UTC

Quick Scan Log

OTL logfile created on: 4/17/2012 10:17:16 AM - Run 6
OTL by OldTimer - Version 3.2.39.2 Folder = C:\Documents and Settings\Administrator\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

502.80 Mb Total Physical Memory | 254.73 Mb Available Physical Memory | 50.66% Memory free
843.82 Mb Paging File | 597.55 Mb Available in Paging File | 70.81% Paging File free
Paging file location(s): C:\pagefile.sys 372 744 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 37.27 Gb Total Space | 18.66 Gb Free Space | 50.07% Space Free | Partition Type: NTFS

Computer Name: PEGGY | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Administrator\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe (W3i, LLC)
PRC - C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe (Trend Micro Inc.)
PRC - C:\Program Files\Trend Micro\AMSP\coreFrameworkHost.exe (Trend Micro Inc.)
PRC - C:\Program Files\Trend Micro\UniClient\UiFrmwrk\uiWatchDog.exe (Trend Micro Inc.)
PRC - C:\Program Files\Trend Micro\UniClient\UiFrmwrk\uiSeAgnt.exe (Trend Micro Inc.)
PRC - C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
PRC - C:\Program Files\Trend Micro\RUBotted\TMRUBottedTray.exe (Trend Micro Inc.)
PRC - C:\Program Files\Trend Micro\RUBotted\TMRUBotted.exe (Trend Micro Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe (Adobe Systems Incorporated)

========== Modules (No Company Name) ==========

MOD - C:\Program Files\Trend Micro\UniClient\plugins\LUADLL.dll ()
MOD - C:\Program Files\Trend Micro\AMSP\sqlite3.dll ()
MOD - C:\Program Files\Trend Micro\AMSP\libprotobuf.dll ()
MOD - C:\Program Files\Trend Micro\AMSP\boost_date_time-vc80-mt-1_36.dll ()
MOD - C:\Program Files\Trend Micro\AMSP\boost_thread-vc80-mt-1_36.dll ()
MOD - C:\Program Files\FileZilla FTP Client\fzshellext.dll ()
MOD - C:\Program Files\Trend Micro\RUBotted\libexpat.dll ()
MOD - C:\Program Files\Trend Micro\RUBotted\sqlite3.dll ()
MOD - C:\WINDOWS\system32\Primomonnt.dll ()

========== Win32 Services (SafeList) ==========

SRV - (z800obex) – %systemroot%\system32\rollbackclientservice.dll File not found
SRV - (IntuitUpdateService) – %systemroot%\system32\imaservice.dll File not found
SRV - (HidServ) – %SystemRoot%\System32\hidserv.dll File not found
SRV - (Amsp) – C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe coreFrameworkHost.exe File not found
SRV - (McComponentHostService) – C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe (McAfee, Inc.)
SRV - (RUBotted) – C:\Program Files\Trend Micro\RUBotted\TMRUBotted.exe (Trend Micro Inc.)

========== Driver Services (SafeList) ==========

DRV - (WDICA) – File not found
DRV - (redbook) – system32\drivers\tsk111.tmp File not found
DRV - (PDRFRAME) – File not found
DRV - (PDRELI) – File not found
DRV - (PDFRAME) – File not found
DRV - (PDCOMP) – File not found
DRV - (PCIDump) – File not found
DRV - (lbrtfdc) – File not found
DRV - (i2omgmt) – File not found
DRV - (Changer) – File not found
DRV - (catchme) – C:\jgh\catchme.sys File not found
DRV - (76851537) – system32\drivers\21461316.sys File not found
DRV - (SASKUTIL) – C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASDIFSV) – C:\Program Files\SUPERAntiSpyware\sasdifsv.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (TMPassthruMP) – C:\WINDOWS\system32\drivers\TMPassthru.sys (Trend Micro Inc.)
DRV - (TMPassthru) – C:\WINDOWS\system32\drivers\TMPassthru.sys (Trend Micro Inc.)
DRV - (AFS2K) – C:\WINDOWS\System32\drivers\AFS2K.SYS (Oak Technology Inc.)
DRV - (iAimFP4) – C:\WINDOWS\system32\drivers\wvchntxx.sys (Intel® Corporation)
DRV - (iAimFP3) – C:\WINDOWS\system32\drivers\wsiintxx.sys (Intel® Corporation)
DRV - (iAimTV5) – C:\WINDOWS\system32\drivers\watv10nt.sys (Intel® Corporation)
DRV - (iAimTV4) – C:\WINDOWS\system32\drivers\wch7xxnt.sys (Intel® Corporation)
DRV - (iAimTV6) – C:\WINDOWS\system32\drivers\watv06nt.sys (Intel® Corporation)
DRV - (iAimTV3) – C:\WINDOWS\system32\drivers\watv04nt.sys (Intel® Corporation)
DRV - (iAimTV1) – C:\WINDOWS\system32\drivers\watv02nt.sys (Intel® Corporation)
DRV - (iAimTV0) – C:\WINDOWS\system32\drivers\watv01nt.sys (Intel® Corporation)
DRV - (iAimFP7) – C:\WINDOWS\system32\drivers\wadv09nt.sys (Intel® Corporation)
DRV - (iAimFP5) – C:\WINDOWS\system32\drivers\wadv07nt.sys (Intel® Corporation)
DRV - (iAimFP6) – C:\WINDOWS\system32\drivers\wadv08nt.sys (Intel® Corporation)
DRV - (i81x) – C:\WINDOWS\system32\drivers\i81xnt5.sys (Intel® Corporation)
DRV - (iAimFP0) – C:\WINDOWS\system32\drivers\wadv01nt.sys (Intel® Corporation)
DRV - (iAimFP1) – C:\WINDOWS\system32\drivers\wadv02nt.sys (Intel® Corporation)
DRV - (iAimFP2) – C:\WINDOWS\system32\drivers\wadv05nt.sys (Intel® Corporation)
DRV - (AgereSoftModem) – C:\WINDOWS\system32\drivers\AGRSM.sys (Agere Systems)
DRV - (Symmpi) – C:\WINDOWS\system32\drivers\symmpi.sys (LSI Logic)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://go.compaq.com/1Q00CDT/0409/bl8.asp
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…ferrer:source?}
IE - HKLM\..\SearchScopes\{E4013329-B79F-4680-AD25-5D4D64F28342}: "URL" = http://www.onestepsearch.net/?prt=ONESTEP1…s={searchTerms}

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Yahoo! Search
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://search.yahoo.com/search?p={searchTe…-8&fr;=b1ie7
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKCU\..\URLSearchHook: - No CLSID value found
IE - HKCU\..\SearchScopes,DefaultScope = {0C55421B-685A-4156-A691-073C1D6AEBD2}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…amp;Form=IE8SRC
IE - HKCU\..\SearchScopes\{0C55421B-685A-4156-A691-073C1D6AEBD2}: "URL" = http://search.yahoo.com/search?p={searchTe…-8&fr;=b1ie7
IE - HKCU\..\SearchScopes\{579457C0-C7D6-481B-8DBF-3CA259316F8C}: "URL" = http://rover.ebay.com/rover/1/711-43047-14…e={searchTerms}
IE - HKCU\..\SearchScopes\{D5EF9B3F-A073-433A-BDDE-BE64509C0AB3}: "URL" = http://www.flickr.com/search/?q={searchTerms}
IE - HKCU\..\SearchScopes\{E58FD494-9104-4DA0-AD13-7C6A590592BD}: "URL" = http://delicious.com/search?p={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Yahoo"
FF - prefs.js..browser.search.defaulturl: "http://search.yahoo.com/search?ei=UTF-8&fr;=ytff-&p;="
FF - prefs.js..browser.search.param.yahoo-fr: "moz2-ytff-"
FF - prefs.js..browser.search.param.yahoo-fr-cjkt: "moz2-ytff-"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "http://www.yahoo.com/"
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.3.6.20110307083656
FF - prefs.js..keyword.URL: "http://search.yahoo.com/search?ei=UTF-8&fr;=ytff-&p;="
FF - prefs.js..network.proxy.type: 1

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/npracplug;version=1.0.0.0: C:\Program Files\Real\RealArcade\Plugins\Mozilla\npracplug.dll (RealNetworks)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{22C7F6C6-8D67-4534-92B5-529A0EC09405}: C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1505\6.6.1088\firefoxextension\ [2012/04/16 11:19:47 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/04/12 21:39:30 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/09/01 14:45:18 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 2.0.0.18\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2008/11/25 12:38:29 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 2.0.0.18\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{ABC82C52-8331-11E1-826D-B8AC6F996F26}: C:\Documents and Settings\Administrator\Local Settings\Application Data\{ABC82C52-8331-11E1-826D-B8AC6F996F26}\

[2008/12/23 10:38:55 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Extensions
[2012/02/03 17:55:28 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ugvbjuwp.default\extensions
[2012/01/25 17:25:51 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ugvbjuwp.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2012/04/12 21:39:26 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2012/04/12 21:39:27 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\distribution\extensions
[2012/04/12 21:39:27 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Program Files\Mozilla Firefox\distribution\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2011/11/20 23:04:51 | 000,134,104 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2010/02/03 18:28:29 | 000,028,472 | —- | M] (WebEx Communications, Inc) – C:\Program Files\mozilla firefox\plugins\atgpcdec.dll
[2010/02/03 18:28:29 | 000,185,224 | —- | M] (WebEx Communications, Inc) – C:\Program Files\mozilla firefox\plugins\atgpcext.dll
[2010/02/03 18:28:28 | 000,061,832 | —- | M] (WebEx Communications, Inc) – C:\Program Files\mozilla firefox\plugins\npatgpc.dll
[2011/03/18 13:32:12 | 000,091,552 | —- | M] (Coupons, Inc.) – C:\Program Files\mozilla firefox\plugins\npCouponPrinter.dll
[2011/03/18 13:32:14 | 000,091,552 | —- | M] (Coupons, Inc.) – C:\Program Files\mozilla firefox\plugins\npMozCouponPrinter.dll
[2011/11/20 20:04:05 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2011/11/20 20:04:05 | 000,002,040 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}source
id=chrome&ie;={inputEncoding}&q;={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?client=chrome&hl;={language}&q;={searchTerms}

O1 HOSTS File: ([2012/04/12 19:36:46 | 000,000,027 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (TmIEPlugInBHO Class) - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files\Trend Micro\AMSP\module\20004\1.5.1505\6.6.1088\TmIEPlg.dll (Trend Micro Inc.)
O2 - BHO: (TmBpIeBHO Class) - {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.5.1234\6.5.1234\TmBpIe32.dll File not found
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {871F91FD-3A92-4988-A842-16AB2CFF5AF1} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found.
O4 - HKLM..\Run: [Adobe Photo Downloader] C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [SetRefresh] C:\Program Files\Compaq\SetRefresh\SetRefresh.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [srmclean] C:\cpqs\scom\srmclean.exe ()
O4 - HKLM..\Run: [TMRUBottedTray] C:\Program Files\Trend Micro\RUBotted\TMRUBottedTray.exe (Trend Micro Inc.)
O4 - HKLM..\Run: [Trend Micro Client Framework] C:\Program Files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe (Trend Micro Inc.)
O4 - HKLM..\Run: [Trend Micro Titanium] C:\Program Files\Trend Micro\Titanium\UIFramework\uiWinMgr.exe (Trend Micro Inc.)
O4 - HKCU..\Run: [InstallIQUpdater] C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe (W3i, LLC)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk = C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O15 - HKCU\..Trusted Domains: westlaw.com ([]* in Trusted sites)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Reg Error: Key error.)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/C/0…heckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab (Symantec AntiVirus scanner)
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} http://photos.walmart.com/WalmartActivia.cab (Snapfish Activia)
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} http://cdn.scan.onecare.live.com/resource/…lscbase5483.cab (Windows Live Safety Center Base Module)
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab (Symantec RuFSI Utility Class)
O16 - DPF: {6824D897-F7E1-4E41-B84B-B1D3FA4BF1BD} http://utilities.pcpitstop.com/Exterminate…opAntiVirus.dll (PCPitstop AntiVirus)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_06)
O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{293A756F-F0E8-4250-BFB4-F00ACF54F34F}: DhcpNameServer = [removed] [removed] [removed]
O18 - Protocol\Handler\tmbp {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.5.1234\6.5.1234\TmBpIe32.dll File not found
O18 - Protocol\Handler\tmpx {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\module\20004\1.5.1505\6.6.1088\TmIEPlg.dll (Trend Micro Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - (C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL) - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O20 - Winlogon\Notify\igfxcui: DllName - (igfxsrvc.dll) - File not found
O24 - Desktop Components:0 () - http://mail.charter.net/images/portal/msgt…S&v;=charter
O24 - Desktop Components:1 (My Current Home Page) - About:Home
O24 - Desktop WallPaper: C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - C:\Program Files\Windows Defender\MpShHook.dll (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2012/04/17 10:15:17 | 001,268,204 | —- | C] (Agere Systems) – C:\WINDOWS\System32\drivers\AGRSM.sys
[2012/04/17 10:15:04 | 000,000,000 | —D | C] – C:\_OTL
[2012/04/12 20:51:34 | 000,000,000 | —D | C] – C:\TDSSKiller_Quarantine
[2012/04/12 20:46:01 | 002,071,600 | —- | C] (Kaspersky Lab ZAO) – C:\Documents and Settings\Administrator\Desktop\tdsskiller.exe
[2012/04/12 20:41:09 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2012/04/11 17:35:09 | 000,000,000 | RHSD | C] – C:\cmdcons
[2012/04/11 17:32:03 | 000,518,144 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2012/04/11 17:32:03 | 000,406,528 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2012/04/11 17:32:03 | 000,060,416 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2012/04/11 17:32:02 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2012/04/11 17:31:24 | 000,000,000 | —D | C] – C:\Qoobox
[2012/04/11 17:27:36 | 004,458,963 | R— | C] (Swearware) – C:\Documents and Settings\Administrator\Desktop\jgh.exe
[2012/04/11 11:05:30 | 000,593,920 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Administrator\Desktop\OTL.exe
[2012/04/11 11:03:38 | 004,731,392 | —- | C] (AVAST Software) – C:\Documents and Settings\Administrator\Desktop\aswMBR.exe
[2012/04/11 10:09:41 | 000,040,776 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2012/04/10 17:59:43 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2012/04/10 17:59:35 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Adobe
[2012/03/19 16:11:54 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\My Documents\Amelunke

========== Files - Modified Within 30 Days ==========

[2012/04/16 15:48:17 | 000,000,664 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2012/04/16 11:17:43 | 000,001,158 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2012/04/16 11:17:20 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2012/04/16 11:13:30 | 000,003,342 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\myfix.bat
[2012/04/16 11:08:26 | 000,000,185 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\fix.reg
[2012/04/14 09:51:54 | 000,007,025 | —- | M] () – C:\Documents and Settings\Administrator\Application Data\PrimoPDFSet.xml
[2012/04/14 09:51:50 | 000,032,293 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\System Resource Report.pdf
[2012/04/12 21:39:34 | 000,000,742 | —- | M] () – C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2012/04/12 21:39:34 | 000,000,724 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Mozilla Firefox.lnk
[2012/04/12 21:13:56 | 000,349,792 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2012/04/12 20:45:44 | 002,071,600 | —- | M] (Kaspersky Lab ZAO) – C:\Documents and Settings\Administrator\Desktop\tdsskiller.exe
[2012/04/12 19:36:46 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2012/04/12 12:07:59 | 000,115,686 | —- | M] () – C:\WINDOWS\System32\itldvupd.dat
[2012/04/12 03:15:02 | 000,456,014 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2012/04/12 03:15:02 | 000,076,230 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2012/04/12 03:04:14 | 000,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2012/04/11 17:35:31 | 000,000,327 | RHS- | M] () – C:\boot.ini
[2012/04/11 17:26:00 | 004,458,963 | R— | M] (Swearware) – C:\Documents and Settings\Administrator\Desktop\jgh.exe
[2012/04/11 15:27:19 | 000,593,920 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Administrator\Desktop\OTL.exe
[2012/04/11 12:31:03 | 000,002,305 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Adobe Reader 9.lnk
[2012/04/11 11:21:06 | 000,002,463 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\HiJackThis.lnk
[2012/04/11 11:03:54 | 004,731,392 | —- | M] (AVAST Software) – C:\Documents and Settings\Administrator\Desktop\aswMBR.exe
[2012/04/11 10:09:41 | 000,040,776 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2012/04/10 18:52:33 | 000,011,914 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Francis Old.jpg
[2012/04/10 18:52:33 | 000,002,180 | —- | M] () – C:\Documents and Settings\Administrator\.recently-used.xbel
[2012/04/10 18:36:09 | 000,081,049 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Francis Old.gif
[2012/04/10 15:29:48 | 000,000,784 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012/04/07 20:00:11 | 000,054,156 | -H– | M] () – C:\WINDOWS\QTFont.qfn
[2012/04/04 15:56:40 | 000,022,344 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2012/03/29 10:40:26 | 000,002,497 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\Microsoft Office Word 2003.lnk
[2012/03/19 14:39:57 | 000,051,464 | —- | M] () – C:\Documents and Settings\Administrator\My Documents\BELLIS General Warranty Deed 2012-1.pdf

========== Files Created - No Company Name ==========

[2012/04/16 11:13:29 | 000,003,342 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\myfix.bat
[2012/04/16 11:08:26 | 000,000,185 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\fix.reg
[2012/04/14 09:51:50 | 000,032,293 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\System Resource Report.pdf
[2012/04/12 16:37:55 | 000,000,664 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2012/04/11 17:35:30 | 000,000,211 | —- | C] () – C:\Boot.bak
[2012/04/11 17:35:14 | 000,260,272 | RHS- | C] () – C:\cmldr
[2012/04/11 17:32:03 | 000,256,000 | —- | C] () – C:\WINDOWS\PEV.exe
[2012/04/11 17:32:03 | 000,208,896 | —- | C] () – C:\WINDOWS\MBR.exe
[2012/04/11 17:32:03 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2012/04/11 17:32:03 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2012/04/11 17:32:03 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2012/04/11 08:59:44 | 000,115,686 | —- | C] () – C:\WINDOWS\System32\itldvupd.dat
[2012/04/10 18:52:33 | 000,002,180 | —- | C] () – C:\Documents and Settings\Administrator\.recently-used.xbel
[2012/04/10 18:42:29 | 000,011,914 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\Francis Old.jpg
[2012/04/10 18:36:09 | 000,081,049 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\Francis Old.gif
[2012/04/10 15:29:48 | 000,000,784 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012/03/19 14:41:22 | 000,051,464 | —- | C] () – C:\Documents and Settings\Administrator\My Documents\BELLIS General Warranty Deed 2012-1.pdf
[2012/02/15 20:52:17 | 000,003,072 | —- | C] () – C:\WINDOWS\System32\iacenc.dll
[2012/02/07 11:12:33 | 000,201,528 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2011/10/31 15:49:25 | 000,000,020 | —- | C] () – C:\WINDOWS\MainWHnd.INI
[2011/10/31 15:48:17 | 000,000,284 | —- | C] () – C:\WINDOWS\GvSaveImage.ini
[2011/10/31 15:48:13 | 000,000,512 | —- | C] () – C:\WINDOWS\GeoImageProcess_8200.ini
[2011/10/31 15:36:53 | 000,000,390 | —- | C] () – C:\WINDOWS\GeoLan.ini
[2011/10/31 15:36:45 | 000,000,082 | —- | C] () – C:\WINDOWS\GeoDebug61.ini
[2010/08/26 14:47:52 | 000,311,296 | R— | C] () – C:\WINDOWS\System32\SimplyVBUnitLib.dll

========== LOP Check ==========

[2011/07/22 15:13:11 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\.oit
[2010/11/21 22:59:45 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Amazon
[2011/04/27 13:07:43 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\FileZilla
[2012/02/06 00:28:56 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Gaia Family Tree
[2012/04/10 18:52:33 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\gtk-2.0
[2007/01/11 16:17:13 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Leadertech
[2011/08/19 14:49:46 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Riyxo
[2010/09/18 11:12:11 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\RootsMagic
[2010/03/13 02:00:09 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\SecondLife
[2007/07/20 21:54:44 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Snapfish
[2008/11/25 12:38:29 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Thunderbird
[2011/08/20 10:41:22 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Vuam
[2011/08/20 10:41:22 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\lB06700CkPbP06700
[2007/06/27 13:35:54 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\n7-89-o9-3r-4t-r9
[2008/11/12 10:40:53 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PCPitstop
[2010/09/18 11:10:03 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\RootsMagic
[2007/06/27 13:36:01 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Sandlot Games
[2006/12/04 11:36:22 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Softdisk LLC
[2011/07/26 17:39:27 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\W3i

========== Purity Check ==========

< End of report >

oldman960

Post #29April 17, 2012, 3:41 PM UTC

Hi webster10, How's the computer?

webster10

Post #30April 17, 2012, 7:27 PM UTC

HI Infection gone, and I think better than before infection. TrendMicro Plat still likes to turn itself off. I read that seems to be a problem with that product. But it was that way before. View is out of line Instead of reading File Edit View ,etc its ile Edit View, etc. If you know who to line it up, great, otherwise I surely can live with it. THANKS

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Smart Fortress 2012

✨ Ask AI

Ask AI