What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

infected by something [Solved]

6 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hi,
Today my computer totally crashed. I was able to restore it with a recovery disk but lost all personal info to do so. I had a black screen saying part of windows was missing. I have a functioning computer, but am trying to do all the updates and get it back to normal. I pulled some type of trojan off it with mcafee today. It is slower than normal. Last week I did open something my hubby sent me (some coupon carp**) that assumed was safe because everything is scanned at his work, but when I opened it I got directed to a strange page that was not what it was supposed to be. That attachment may have been the culprit. Lesson learned. Here are OTL, Hijack this, and DDS logs. Thanks for the help.



OTL logfile created on: 5/7/2012 7:03:50 PM - Run 1
OTL by OldTimer - Version 3.2.42.3 Folder = C:\Documents and Settings\HP_Administrator\Desktop
Windows XP Media Center Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.99 Gb Total Physical Memory | 1.37 Gb Available Physical Memory | 68.83% Memory free
3.84 Gb Paging File | 3.22 Gb Available in Paging File | 83.87% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 224.23 Gb Total Space | 208.32 Gb Free Space | 92.90% Space Free | Partition Type: NTFS
Drive D: | 8.63 Gb Total Space | 0.44 Gb Free Space | 5.14% Space Free | Partition Type: FAT32

Computer Name: YOUR-4DACD0EA75 | User Name: HP_Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\HP_Administrator\Desktop\OTL.exe (OldTimer Tools)
PRC - c:\PROGRA~1\mcafee\VIRUSS~1\mcvsshld.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
PRC - C:\WINDOWS\System32\mfevtps.exe (McAfee, Inc.)
PRC - C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe (McAfee, Inc.)
PRC - C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe (McAfee, Inc.)
PRC - c:\PROGRA~1\mcafee\VIRUSS~1\mcvsmap.exe (McAfee, Inc.)
PRC - C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
PRC - C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe (Hewlett-Packard)
PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe (Intel Corporation)
PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe (Intel Corporation)
PRC - C:\Program Files\Intel\IntelDH\Intel® Quick Resume Technology Drivers\Elservice.exe (Intel Corporation)
PRC - C:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe (Sonic Solutions)
PRC - C:\Program Files\DISC\DISCover.exe (Digital Interactive Systems Corporation)
PRC - C:\Program Files\DISC\DiscUpdMgr.exe (Digital Interactive Systems Corporation, Inc.)
PRC - C:\Program Files\DISC\DiscStreamHub.exe (Digital Interactive Systems Corporation, Inc.)
PRC - C:\WINDOWS\Explorer.EXE (Microsoft Corporation)


========== Modules (No Company Name) ==========

MOD - c:\windows\assembly\nativeimages1_v1.1.4322\mscorlib\1.0.5000.0__b77a5c561934e089_ebaade3c\mscorlib.dll ()
MOD - c:\windows\assembly\nativeimages1_v1.1.4322\system.drawing\1.0.5000.0__b03f5f7f11d50a3a_b345acb4\system.drawing.dll ()
MOD - c:\windows\assembly\nativeimages1_v1.1.4322\system.xml\1.0.5000.0__b77a5c561934e089_4339de62\system.xml.dll ()
MOD - c:\windows\assembly\nativeimages1_v1.1.4322\system.windows.forms\1.0.5000.0__b77a5c561934e089_1d980ded\system.windows.forms.dll ()
MOD - c:\windows\assembly\nativeimages1_v1.1.4322\system\1.0.5000.0__b77a5c561934e089_25d4ad14\system.dll ()
MOD - c:\windows\assembly\gac\system\1.0.5000.0__b77a5c561934e089\system.dll ()
MOD - c:\windows\assembly\gac\system.web\1.0.5000.0__b03f5f7f11d50a3a\system.web.dll ()
MOD - C:\Program Files\Updates from HP\9972322\6.3.2.116-9972322\Program\bwfiles.dll ()
MOD - C:\Program Files\Updates from HP\9972322\6.3.2.116-9972322\Program\FrExt.dll ()
MOD - C:\Program Files\Updates from HP\9972322\6.3.2.116-9972322\Program\clntutil.dll ()
MOD - c:\windows\assembly\gac\system.xml\1.0.5000.0__b77a5c561934e089\system.xml.dll ()
MOD - c:\windows\assembly\gac\system.drawing\1.0.5000.0__b03f5f7f11d50a3a\system.drawing.dll ()
MOD - c:\windows\assembly\gac\system.windows.forms\1.0.5000.0__b77a5c561934e089\system.windows.forms.dll ()
MOD - c:\windows\assembly\gac\system.web.services\1.0.5000.0__b03f5f7f11d50a3a\system.web.services.dll ()
MOD - c:\windows\assembly\gac\microsoft.visualbasic\7.0.5000.0__b03f5f7f11d50a3a\microsoft.visualbasic.dll ()
MOD - c:\windows\assembly\gac\system.enterpriseservices\1.0.5000.0__b03f5f7f11d50a3a\system.enterpriseservices.dll ()
MOD - C:\Program Files\Updates from HP\9972322\Program\HPClientExt.dll ()
MOD - C:\Program Files\HP\Digital Imaging\bin\crm\xmltok.dll ()
MOD - C:\Program Files\HP\Digital Imaging\bin\crm\xmlparse.dll ()


========== Win32 Services (SafeList) ==========

SRV - (HidServ) – %SystemRoot%\System32\hidserv.dll File not found
SRV - (AdobeFlashPlayerUpdateSvc) – C:\WINDOWS\System32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (McODS) – C:\Program Files\McAfee\VirusScan\mcods.exe (McAfee, Inc.)
SRV - (mfevtp) – C:\WINDOWS\System32\mfevtps.exe (McAfee, Inc.)
SRV - (mfefire) – C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe ()
SRV - (McShield) – C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe ()
SRV - (McProxy) – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McNASvc) – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McNaiAnn) – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (mcmscsvc) – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McMPFSvc) – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McAfee SiteAdvisor Service) – C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (spupdsvc) – C:\WINDOWS\System32\spupdsvc.exe (Microsoft Corporation)
SRV - (IAANTMON) Intel® – C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe (Intel Corporation)
SRV - (ELService) Intel® – C:\Program Files\Intel\IntelDH\Intel® Quick Resume Technology Drivers\Elservice.exe (Intel Corporation)
SRV - (Pml Driver HPZ12) – C:\WINDOWS\System32\HPZipm12.exe (HP)


========== Driver Services (SafeList) ==========

DRV - (WDICA) – File not found
DRV - (PDRFRAME) – File not found
DRV - (PDRELI) – File not found
DRV - (PDFRAME) – File not found
DRV - (PDCOMP) – File not found
DRV - (PCIDump) – File not found
DRV - (mfeavfk01) – File not found
DRV - (lbrtfdc) – File not found
DRV - (i2omgmt) – File not found
DRV - (Changer) – File not found
DRV - (mfehidk) – C:\WINDOWS\System32\drivers\mfehidk.sys (McAfee, Inc.)
DRV - (mfefirek) – C:\WINDOWS\System32\drivers\mfefirek.sys (McAfee, Inc.)
DRV - (mfeavfk) – C:\WINDOWS\System32\drivers\mfeavfk.sys (McAfee, Inc.)
DRV - (mfeapfk) – C:\WINDOWS\System32\drivers\mfeapfk.sys (McAfee, Inc.)
DRV - (mfetdi2k) – C:\WINDOWS\System32\drivers\mfetdi2k.sys (McAfee, Inc.)
DRV - (mferkdet) – C:\WINDOWS\System32\drivers\mferkdet.sys (McAfee, Inc.)
DRV - (mfendiskmp) – C:\WINDOWS\System32\DRIVERS\mfendisk.sys (McAfee, Inc.)
DRV - (mfendisk) – C:\WINDOWS\System32\DRIVERS\mfendisk.sys (McAfee, Inc.)
DRV - (mfebopk) – C:\WINDOWS\System32\drivers\mfebopk.sys (McAfee, Inc.)
DRV - (cfwids) – C:\WINDOWS\System32\drivers\cfwids.sys (McAfee, Inc.)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) – C:\WINDOWS\System32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (ELacpi) – C:\WINDOWS\System32\DRIVERS\ELacpi.sys (Intel Corporation)
DRV - (ELmon) – C:\WINDOWS\System32\Drivers\Elmon.sys (Intel Corporation)
DRV - (ELkbd) – C:\WINDOWS\System32\Drivers\Elkbd.sys (Intel Corporation)
DRV - (ELmou) – C:\WINDOWS\System32\Drivers\Elmou.sys (Intel Corporation)
DRV - (ELhid) – C:\WINDOWS\System32\Drivers\Elhid.sys (Intel Corporation)
DRV - (Ps2) – C:\WINDOWS\System32\DRIVERS\PS2.sys (Hewlett-Packard Company)
DRV - (HSXHWBS2) – C:\WINDOWS\System32\DRIVERS\HSXHWBS2.sys (Conexant Systems, Inc.)
DRV - (HSX_DP) – C:\WINDOWS\System32\DRIVERS\HSX_DP.sys (Conexant Systems, Inc.)
DRV - (ftsata2) – C:\WINDOWS\System32\DRIVERS\ftsata2.sys (Promise Technology, Inc.)
DRV - (rtl8139) Realtek RTL8139(A/B/C) – C:\WINDOWS\System32\DRIVERS\RTL8139.SYS (Realtek Semiconductor Corporation)
DRV - (bb-run) – C:\WINDOWS\System32\DRIVERS\bb-run.sys (Promise Technology, Inc.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf;=desktop
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf;=desktop
IE - HKLM\..\SearchScopes,DefaultScope = {6F967B3C-49E6-46D8-8C45-4DC5DD21A356}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…ferrer:source?}
IE - HKLM\..\SearchScopes\{6F967B3C-49E6-46D8-8C45-4DC5DD21A356}: "URL" = http://www.google.com/search?q={searchTerm…mp;sourceid=ie7

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf;=desktop
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf;=desktop
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf;=desktop
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf;=desktop
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\..\URLSearchHook: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
IE - HKCU\..\SearchScopes,DefaultScope = {6F967B3C-49E6-46D8-8C45-4DC5DD21A356}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…amp;Form=IE8SRC
IE - HKCU\..\SearchScopes\{6F967B3C-49E6-46D8-8C45-4DC5DD21A356}: "URL" = http://www.google.com/search?q={searchTerm…1I7ADFA_enUS483
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0


========== FireFox ==========

FF - HKLM\Software\MozillaPlugins\@mcafee.com/MSC,version=10: c:\progra~1\mcafee\msc\npmcsn~1.dll ()
FF - HKLM\Software\MozillaPlugins\@mcafee.com/SAFFPlugin: C:\Program Files\McAfee\SiteAdvisor\npmcffplg32.dll (McAfee, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/DownloadManager,version=1.1: C:\WINDOWS\ [2012/05/07 18:47:07 | 000,000,000 | —D | M]
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.11.2321: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.2.2379: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.1483: C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=8: C:\Program Files\Google\Update\1.2.183.39\npGoogleOneClick8.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{D19CA586-DD6C-4a0a-96F8-14644F340D60}: C:\Program Files\Common Files\McAfee\SystemCore [2012/05/07 18:18:58 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{4ED1F68A-5463-4931-9384-8FFF5ED91D92}: C:\Program Files\McAfee\SiteAdvisor [2012/05/07 17:55:36 | 000,000,000 | —D | M]


O1 HOSTS File: ([2004/08/10 06:00:00 | 000,000,734 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Yahoo! Toolbar Helper) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\Mcafee\SystemCore\ScriptSn.20120507133653.dll (McAfee, Inc.)
O2 - BHO: (hpWebHelper Class) - {AAAE832A-5FFF-4661-9C8F-369692D1DCB9} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\WebHelper.dll (Hewlett-Packard)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.7227.1100\swg.dll (Google Inc.)
O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {C4069E3A-68F1-403E-B40E-20066696354B} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [DMAScheduler] c:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe (Sonic Solutions)
O4 - HKLM..\Run: [ftutil2] C:\WINDOWS\System32\ftutil2.dll (Promise Technology, Inc.)
O4 - HKLM..\Run: [HPBootOp] C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe (Intel Corporation)
O4 - HKLM..\Run: [mcui_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
O4 - HKLM..\Run: [PCDrProfiler] "C:\Program Files\PC-Doctor 5 for Windows\RunProfiler.exe" -r File not found
O4 - HKLM..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE ()
O4 - HKCU..\RunOnce: [TSClientAXDisabler] C:\WINDOWS\System32\cmd.exe (Microsoft Corporation)
O4 - HKCU..\RunOnce: [TSClientMSIUninstaller] C:\WINDOWS\System32\cmd.exe (Microsoft Corporation)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Updates From HP.lnk = C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe (Hewlett-Packard)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoControlPanel = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme [2005/11/14 20:59:04 | 000,000,000 | —D | M]
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000 File not found
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\NPJPI150_06.dll (Sun Microsystems, Inc.)
O9 - Extra Button: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm ()
O9 - Extra 'Tools' menuitem : Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm ()
O15 - HKLM\..Trusted Domains: trymedia.com ([]http in Trusted sites)
O15 - HKLM\..Trusted Domains: trymedia.com ([]https in Trusted sites)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_06)
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_06)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_06)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1385C8F6-DC8E-4FC4-B6D3-C90E62F6704E}: DhcpNameServer = [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{892900FC-9814-4488-99C0-81491C1EE93D}: DhcpNameServer = [removed] [removed] [removed] [removed]
O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Filter\application/x-mfe-ipt {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files\McAfee\MSC\McSnIePl.dll (McAfee, Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/08/19 23:47:54 | 000,000,100 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2001/07/27 08:07:38 | 000,000,000 | -HS- | M] () - D:\AUTOEXEC.BAT – [ FAT32 ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

NetSvcs: 6to4 - File not found
NetSvcs: HidServ - %SystemRoot%\System32\hidserv.dll File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\WINDOWS\System32\DivX.dll (DivXNetworks, Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax ()
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll ()
Drivers32: vidc.LEAD - LCODCCMP.DLL File not found

CREATERESTOREPOINT
Unable to start System Restore Service. Error code 1056

========== Files/Folders - Created Within 30 Days ==========

[2012/05/07 18:41:12 | 000,000,000 | —D | C] – C:\Documents and Settings\HP_Administrator\Application Data\HPQ
[2012/05/07 18:39:49 | 000,000,000 | —D | C] – C:\WINDOWS\LastGood
[2012/05/07 18:34:53 | 000,000,000 | —D | C] – C:\WINDOWS\System32\scripting
[2012/05/07 18:34:53 | 000,000,000 | —D | C] – C:\WINDOWS\l2schemas
[2012/05/07 18:34:53 | 000,000,000 | —D | C] – C:\WINDOWS\System32\en
[2012/05/07 18:34:53 | 000,000,000 | —D | C] – C:\WINDOWS\System32\bits
[2012/05/07 18:32:41 | 000,000,000 | —D | C] – C:\WINDOWS\network diagnostic
[2012/05/07 18:30:51 | 000,000,000 | -H-D | C] – C:\WINDOWS\$NtServicePackUninstall$
[2012/05/07 18:25:16 | 000,000,000 | R–D | C] – C:\Documents and Settings\HP_Administrator\Start Menu\Programs\Administrative Tools
[2012/05/07 18:25:06 | 000,607,260 | R— | C] (Swearware) – C:\Documents and Settings\HP_Administrator\Desktop\dds.scr
[2012/05/07 18:24:34 | 000,388,608 | —- | C] (Trend Micro Inc.) – C:\Documents and Settings\HP_Administrator\Desktop\HiJackThis.exe
[2012/05/07 18:23:31 | 000,595,456 | —- | C] (OldTimer Tools) – C:\Documents and Settings\HP_Administrator\Desktop\OTL.exe
[2012/05/07 18:20:15 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\McAfee
[2012/05/07 18:11:49 | 000,000,000 | —D | C] – C:\WINDOWS\ServicePackFiles
[2012/05/07 18:07:35 | 000,017,920 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msyuv.dll
[2012/05/07 17:51:25 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Temp
[2012/05/07 17:51:00 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Google
[2012/05/07 17:49:55 | 000,000,000 | —D | C] – C:\Program Files\MSXML 4.0
[2012/05/07 17:47:01 | 000,000,000 | —D | C] – C:\Documents and Settings\HP_Administrator\Application Data\Adobe
[2012/05/07 17:46:58 | 000,000,000 | —D | C] – C:\Documents and Settings\HP_Administrator\Application Data\Google
[2012/05/07 17:46:39 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Google
[2012/05/07 17:46:18 | 000,000,000 | —D | C] – C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Google
[2012/05/07 17:46:04 | 000,000,000 | —D | C] – C:\Program Files\Google
[2012/05/07 17:46:04 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Google
[2012/05/07 17:45:58 | 000,419,488 | —- | C] (Adobe Systems Incorporated) – C:\WINDOWS\System32\FlashPlayerApp.exe
[2012/05/07 17:45:58 | 000,070,304 | —- | C] (Adobe Systems Incorporated) – C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2012/05/07 17:29:56 | 000,025,471 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\drivers\watv10nt.sys
[2012/05/07 17:29:56 | 000,022,271 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\drivers\watv06nt.sys
[2012/05/07 17:29:56 | 000,011,935 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\drivers\wadv11nt.sys
[2012/05/07 17:29:56 | 000,011,871 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\drivers\wadv09nt.sys
[2012/05/07 17:29:56 | 000,011,807 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\drivers\wadv07nt.sys
[2012/05/07 17:29:56 | 000,011,295 | —- | C] (Intel® Corporation) – C:\WINDOWS\System32\drivers\wadv08nt.sys
[2012/05/07 17:29:52 | 000,095,424 | —- | C] (Smart Link) – C:\WINDOWS\System32\drivers\slnthal.sys
[2012/05/07 17:29:52 | 000,013,240 | —- | C] (Smart Link) – C:\WINDOWS\System32\drivers\slwdmsup.sys
[2012/05/07 17:29:51 | 000,404,990 | —- | C] (Smart Link) – C:\WINDOWS\System32\drivers\slntamr.sys
[2012/05/07 17:29:51 | 000,129,535 | —- | C] (Smart Link) – C:\WINDOWS\System32\drivers\slnt7554.sys
[2012/05/07 17:29:50 | 000,166,912 | —- | C] (S3 Graphics, Inc.) – C:\WINDOWS\System32\drivers\s3gnbm.sys
[2012/05/07 17:29:49 | 000,013,776 | —- | C] (Smart Link) – C:\WINDOWS\System32\drivers\recagent.sys
[2012/05/07 17:29:48 | 000,180,360 | —- | C] (Smart Link) – C:\WINDOWS\System32\drivers\ntmtlfax.sys
[2012/05/07 17:29:47 | 000,452,736 | —- | C] (Matrox Graphics Inc.) – C:\WINDOWS\System32\drivers\mtxparhm.sys
[2012/05/07 17:29:46 | 001,309,184 | —- | C] (Smart Link) – C:\WINDOWS\System32\drivers\mtlstrm.sys
[2012/05/07 17:29:46 | 000,126,686 | —- | C] (Smart Link) – C:\WINDOWS\System32\drivers\mtlmnt5.sys
[2012/05/07 17:29:10 | 000,701,440 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\ati2mtag.sys
[2012/05/07 17:29:10 | 000,327,040 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\ati2mtaa.sys
[2012/05/07 17:29:10 | 000,104,960 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\atinrvxx.sys
[2012/05/07 17:29:10 | 000,073,216 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\atintuxx.sys
[2012/05/07 17:29:10 | 000,063,663 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\ati1rvxx.sys
[2012/05/07 17:29:10 | 000,063,488 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\atinxsxx.sys
[2012/05/07 17:29:10 | 000,057,856 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\atinbtxx.sys
[2012/05/07 17:29:10 | 000,056,623 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\ati1btxx.sys
[2012/05/07 17:29:10 | 000,052,224 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\atinraxx.sys
[2012/05/07 17:29:10 | 000,036,463 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\ati1tuxx.sys
[2012/05/07 17:29:10 | 000,034,735 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\ati1xsxx.sys
[2012/05/07 17:29:10 | 000,031,744 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\atinxbxx.sys
[2012/05/07 17:29:10 | 000,030,671 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\ati1raxx.sys
[2012/05/07 17:29:10 | 000,029,455 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\ati1xbxx.sys
[2012/05/07 17:29:10 | 000,028,672 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\atinsnxx.sys
[2012/05/07 17:29:10 | 000,026,367 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\ati1snxx.sys
[2012/05/07 17:29:10 | 000,021,343 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\ati1ttxx.sys
[2012/05/07 17:29:10 | 000,014,336 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\atinpdxx.sys
[2012/05/07 17:29:10 | 000,013,824 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\atinttxx.sys
[2012/05/07 17:29:10 | 000,013,824 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\atinmdxx.sys
[2012/05/07 17:29:10 | 000,012,047 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\ati1pdxx.sys
[2012/05/07 17:29:10 | 000,011,615 | —- | C] (ATI Technologies Inc.) – C:\WINDOWS\System32\drivers\ati1mdxx.sys
[2012/05/07 17:18:36 | 000,272,128 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\bthport.sys
[2012/05/07 17:18:12 | 000,353,792 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\srv.sys
[2012/05/07 17:17:56 | 000,455,680 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mrxsmb.sys
[2012/05/07 17:17:54 | 000,471,552 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\aclayers.dll
[2012/05/07 17:17:48 | 000,744,448 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\helpsvc.exe
[2012/05/07 17:17:32 | 000,119,808 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\t2embed.dll
[2012/05/07 17:17:32 | 000,081,920 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\fontsub.dll
[2012/05/07 17:17:27 | 000,730,112 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\lsasrv.dll
[2012/05/07 17:17:26 | 002,146,304 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ntkrnlmp.exe
[2012/05/07 17:17:25 | 002,189,952 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ntoskrnl.exe
[2012/05/07 17:17:24 | 002,024,448 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ntkrpamp.exe
[2012/05/07 17:16:59 | 000,023,040 | —- | C] (Microsoft Corporation) – C:\WINDOWS\kb913800.exe
[2012/05/07 17:16:07 | 000,203,136 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\rmcast.sys
[2012/05/07 17:14:33 | 000,337,408 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\netapi32.dll
[2012/05/07 17:12:46 | 000,000,000 | —D | C] – C:\WINDOWS\System32\PreInstall
[2012/05/07 16:19:03 | 000,000,000 | —D | C] – C:\WINDOWS\System32\LogFiles
[2012/05/07 14:03:08 | 000,000,000 | -HSD | C] – C:\System Volume Information
[2012/05/07 13:46:57 | 000,000,000 | R–D | C] – C:\Documents and Settings\All Users\Start Menu
[2012/05/07 13:46:57 | 000,000,000 | R–D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Games
[2012/05/07 13:46:57 | 000,000,000 | R–D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Administrative Tools
[2012/05/07 13:46:57 | 000,000,000 | R–D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Accessories
[2012/05/07 13:46:42 | 000,000,000 | R–D | C] – C:\Documents and Settings\All Users\Documents\My Videos
[2012/05/07 13:46:37 | 000,000,000 | R–D | C] – C:\Documents and Settings\All Users\Documents\My Pictures
[2012/05/07 13:46:17 | 000,000,000 | R–D | C] – C:\Documents and Settings\All Users\Documents\My Music
[2012/05/07 13:46:17 | 000,000,000 | R–D | C] – C:\Documents and Settings\All Users\Documents
[2012/05/07 13:44:44 | 000,000,000 | R-SD | C] – C:\WINDOWS\assembly
[2012/05/07 13:44:37 | 000,000,000 | R–D | C] – C:\WINDOWS\Offline Web Pages
[2012/05/07 13:41:23 | 000,000,000 | RHSD | C] – C:\WINDOWS\System32\dllcache
[2012/05/07 13:36:53 | 000,009,608 | —- | C] (McAfee, Inc.) – C:\WINDOWS\System32\drivers\mfeclnk.sys
[2012/05/07 13:36:52 | 000,340,920 | —- | C] (McAfee, Inc.) – C:\WINDOWS\System32\drivers\mfefirek.sys
[2012/05/07 13:36:52 | 000,089,792 | —- | C] (McAfee, Inc.) – C:\WINDOWS\System32\drivers\mfetdi2k.sys
[2012/05/07 13:36:52 | 000,087,656 | —- | C] (McAfee, Inc.) – C:\WINDOWS\System32\drivers\mferkdet.sys
[2012/05/07 13:36:52 | 000,083,856 | —- | C] (McAfee, Inc.) – C:\WINDOWS\System32\drivers\mfendisk.sys
[2012/05/07 13:36:51 | 000,180,848 | —- | C] (McAfee, Inc.) – C:\WINDOWS\System32\drivers\mfeavfk.sys
[2012/05/07 13:36:51 | 000,059,456 | —- | C] (McAfee, Inc.) – C:\WINDOWS\System32\drivers\mfebopk.sys
[2012/05/07 13:36:51 | 000,057,600 | —- | C] (McAfee, Inc.) – C:\WINDOWS\System32\drivers\cfwids.sys
[2012/05/07 13:36:50 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Mcafee
[2012/05/07 13:36:49 | 000,000,000 | —D | C] – C:\Program Files\McAfee.com
[2012/05/07 13:36:44 | 000,000,000 | —D | C] – C:\Program Files\McAfee
[2012/05/07 13:30:22 | 000,151,880 | —- | C] (McAfee, Inc.) – C:\WINDOWS\System32\mfevtps.exe
[2012/05/07 13:30:19 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\McAfee
[2012/05/07 13:27:30 | 000,000,000 | -HSD | C] – C:\Documents and Settings\HP_Administrator\PrivacIE
[2012/05/07 13:24:52 | 000,000,000 | -HSD | C] – C:\Documents and Settings\HP_Administrator\IETldCache
[2012/05/07 13:22:12 | 000,000,000 | —D | C] – C:\WINDOWS\ie8updates
[2012/05/07 13:21:55 | 000,000,000 | —D | C] – C:\WINDOWS\WBEM
[2012/05/07 13:21:41 | 000,000,000 | -H-D | C] – C:\WINDOWS\ie8
[2012/05/07 13:21:41 | 000,000,000 | —D | C] – C:\WINDOWS\System32\en-US
[2012/05/07 13:14:50 | 000,000,000 | RH-D | C] – C:\Documents and Settings\HP_Administrator\Recent
[2012/05/07 13:10:40 | 000,000,000 | —D | C] – C:\Program Files\MSECache
[2012/05/07 13:06:26 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Download Manager
[2012/05/07 13:06:26 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Download Manager
[2012/05/07 12:59:48 | 000,000,000 | —D | C] – C:\Documents and Settings\HP_Administrator\Application Data\Macromedia
[2012/05/07 12:58:52 | 000,599,040 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msfeeds.dll
[2012/05/07 12:58:52 | 000,055,296 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msfeedsbs.dll
[2012/05/07 12:58:51 | 001,985,536 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iertutil.dll
[2012/05/07 12:58:51 | 000,743,424 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iedvtool.dll
[2012/05/07 12:58:49 | 011,076,096 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ieframe.dll
[2012/05/07 12:52:55 | 000,000,000 | —D | C] – C:\Documents and Settings\HP_Administrator\Application Data\HP
[2012/05/07 12:52:43 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\HP
[2012/05/07 12:50:03 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Hewlett-Packard
[2012/05/07 12:38:03 | 000,000,000 | –SD | C] – C:\Documents and Settings\HP_Administrator\UserData
[2012/05/07 12:36:12 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2012/05/07 12:32:59 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Office Tools
[2012/05/07 12:32:58 | 000,000,000 | —D | C] – C:\Program Files\Microsoft ActiveSync
[2012/05/07 12:32:28 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Visual Studio
[2012/05/07 12:32:28 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Designer
[2012/05/07 12:31:46 | 000,000,000 | —D | C] – C:\WINDOWS\ShellNew
[2012/05/07 12:31:44 | 000,000,000 | —D | C] – C:\Program Files\Common Files\L&H;
[2012/05/07 12:29:00 | 000,038,400 | —- | C] (Hewlett-Packard Company) – C:\WINDOWS\System32\hpz3l054.dll
[2012/05/07 12:27:39 | 000,204,800 | —- | C] (HP) – C:\WINDOWS\System32\HPZipr12.dll
[2012/05/07 12:27:39 | 000,094,208 | —- | C] (HP) – C:\WINDOWS\System32\HPZipt12.dll
[2012/05/07 12:27:39 | 000,057,344 | —- | C] (HP) – C:\WINDOWS\System32\HPZisn12.dll
[2012/05/07 12:27:38 | 000,278,584 | —- | C] (HP) – C:\WINDOWS\System32\HPZidr12.dll
[2012/05/07 12:27:38 | 000,069,632 | —- | C] (HP) – C:\WINDOWS\System32\HPZipm12.exe
[2012/05/07 12:27:38 | 000,065,536 | —- | C] (HP) – C:\WINDOWS\System32\HPZinw12.exe
[2012/05/07 12:24:41 | 000,254,026 | R— | C] (Hewlett-Packard Development Company, L.P.) – C:\WINDOWS\System32\hpovst09.dll
[2012/05/07 12:24:40 | 000,827,392 | R— | C] (Hewlett-Packard Development Company, L.P.) – C:\WINDOWS\System32\hpotiop2.dll
[2012/05/07 12:24:37 | 000,659,456 | R— | C] (Hewlett-Packard) – C:\WINDOWS\System32\hpowiax2.dll
[2012/05/07 12:14:06 | 000,000,000 | -HSD | C] – C:\cmdcons
[2012/05/07 12:14:02 | 000,000,000 | —D | C] – C:\WINDOWS\setup.pss
[2012/05/07 12:07:29 | 000,000,000 | –SD | C] – C:\Documents and Settings\HP_Administrator\Application Data\Microsoft
[2012/05/07 12:07:29 | 000,000,000 | RH-D | C] – C:\Documents and Settings\HP_Administrator\SendTo
[2012/05/07 12:07:29 | 000,000,000 | RH-D | C] – C:\Documents and Settings\HP_Administrator\Application Data
[2012/05/07 12:07:29 | 000,000,000 | R–D | C] – C:\Documents and Settings\HP_Administrator\Start Menu\Programs\Startup
[2012/05/07 12:07:29 | 000,000,000 | R–D | C] – C:\Documents and Settings\HP_Administrator\Start Menu
[2012/05/07 12:07:29 | 000,000,000 | R–D | C] – C:\Documents and Settings\HP_Administrator\My Documents\My Videos
[2012/05/07 12:07:29 | 000,000,000 | R–D | C] – C:\Documents and Settings\HP_Administrator\My Documents\My Pictures
[2012/05/07 12:07:29 | 000,000,000 | R–D | C] – C:\Documents and Settings\HP_Administrator\My Documents\My Music
[2012/05/07 12:07:29 | 000,000,000 | R–D | C] – C:\Documents and Settings\HP_Administrator\My Documents
[2012/05/07 12:07:29 | 000,000,000 | R–D | C] – C:\Documents and Settings\HP_Administrator\Favorites
[2012/05/07 12:07:29 | 000,000,000 | R–D | C] – C:\Documents and Settings\HP_Administrator\Start Menu\Programs\Accessories
[2012/05/07 12:07:29 | 000,000,000 | -HSD | C] – C:\Documents and Settings\HP_Administrator\Cookies
[2012/05/07 12:07:29 | 000,000,000 | -H-D | C] – C:\Documents and Settings\HP_Administrator\Templates
[2012/05/07 12:07:29 | 000,000,000 | -H-D | C] – C:\Documents and Settings\HP_Administrator\PrintHood
[2012/05/07 12:07:29 | 000,000,000 | -H-D | C] – C:\Documents and Settings\HP_Administrator\NetHood
[2012/05/07 12:07:29 | 000,000,000 | -H-D | C] – C:\Documents and Settings\HP_Administrator\Local Settings
[2012/05/07 12:07:29 | 000,000,000 | —D | C] – C:\Documents and Settings\HP_Administrator\WINDOWS
[2012/05/07 12:07:29 | 000,000,000 | —D | C] – C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Wildtangent
[2012/05/07 12:07:29 | 000,000,000 | —D | C] – C:\Documents and Settings\HP_Administrator\Application Data\Real
[2012/05/07 12:07:29 | 000,000,000 | —D | C] – C:\Documents and Settings\HP_Administrator\Start Menu\Programs\Online Services
[2012/05/07 12:07:29 | 000,000,000 | —D | C] – C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Microsoft
[2012/05/07 12:07:29 | 000,000,000 | —D | C] – C:\Documents and Settings\HP_Administrator\Application Data\Intuit
[2012/05/07 12:07:29 | 000,000,000 | —D | C] – C:\Documents and Settings\HP_Administrator\Application Data\Identities
[2012/05/07 12:07:29 | 000,000,000 | —D | C] – C:\Documents and Settings\HP_Administrator\Desktop
[2012/05/07 12:07:29 | 000,000,000 | —D | C] – C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\ApplicationHistory
[2012/05/07 12:07:29 | 000,000,000 | —D | C] – C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\{3248F0A6-6813-11D6-A77B-00B0D0150060}
[2012/05/07 12:05:24 | 000,000,000 | —D | C] – C:\WINDOWS\System32\SoftwareDistribution
[6 C:\WINDOWS\Fonts\*.tmp files -> C:\WINDOWS\Fonts\*.tmp -> ]
[252 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/05/07 18:51:00 | 000,000,906 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2012/05/07 18:47:12 | 000,003,023 | —- | M] () – C:\WINDOWS\System32\spupdsvc.inf
[2012/05/07 18:32:32 | 000,250,048 | RHS- | M] () – C:\ntldr
[2012/05/07 18:25:11 | 000,607,260 | R— | M] (Swearware) – C:\Documents and Settings\HP_Administrator\Desktop\dds.scr
[2012/05/07 18:24:49 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Documents and Settings\HP_Administrator\Desktop\HiJackThis.exe
[2012/05/07 18:23:57 | 000,595,456 | —- | M] (OldTimer Tools) – C:\Documents and Settings\HP_Administrator\Desktop\OTL.exe
[2012/05/07 18:20:15 | 000,001,606 | —- | M] () – C:\Documents and Settings\All Users\Desktop\McAfee AntiVirus Plus.lnk
[2012/05/07 18:19:49 | 000,382,022 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2012/05/07 18:19:49 | 000,053,640 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2012/05/07 18:17:15 | 000,000,179 | —- | M] () – C:\WINDOWS\System\hpsysdrv.DAT
[2012/05/07 18:15:45 | 000,316,640 | —- | M] () – C:\WINDOWS\WMSysPr9.prx
[2012/05/07 18:14:47 | 000,000,902 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2012/05/07 18:14:39 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2012/05/07 18:14:38 | 2137,473,024 | -HS- | M] () – C:\hiberfil.sys
[2012/05/07 18:14:38 | 000,219,248 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2012/05/07 18:12:01 | 000,000,830 | —- | M] () – C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012/05/07 17:58:01 | 000,000,803 | —- | M] () – C:\Documents and Settings\HP_Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Microsoft Outlook.lnk
[2012/05/07 17:45:58 | 000,419,488 | —- | M] (Adobe Systems Incorporated) – C:\WINDOWS\System32\FlashPlayerApp.exe
[2012/05/07 17:45:58 | 000,070,304 | —- | M] (Adobe Systems Incorporated) – C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2012/05/07 13:24:55 | 000,000,826 | —- | M] () – C:\Documents and Settings\HP_Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2012/05/07 13:06:26 | 000,001,892 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Microsoft Download Manager.lnk
[2012/05/07 12:52:48 | 000,118,704 | —- | M] () – C:\WINDOWS\hpoins09.dat
[2012/05/07 12:52:23 | 000,000,744 | —- | M] () – C:\Documents and Settings\All Users\Desktop\HP Photosmart Essential.lnk
[2012/05/07 12:51:07 | 000,001,819 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
[2012/05/07 12:50:55 | 000,000,995 | —- | M] () – C:\Documents and Settings\All Users\Desktop\HP Solution Center.lnk
[2012/05/07 12:33:39 | 000,000,376 | —- | M] () – C:\WINDOWS\ODBC.INI
[2012/05/07 12:32:59 | 000,001,741 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
[2012/05/07 12:14:38 | 000,000,281 | RHS- | M] () – C:\boot.ini
[2012/05/07 12:14:28 | 000,001,879 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Updates From HP.lnk
[2012/05/07 12:12:21 | 000,001,489 | —- | M] () – C:\Documents and Settings\HP_Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Media Center.lnk
[2012/05/07 12:12:19 | 000,001,953 | RHS- | M] () – C:\WINDOWS\System32\drivers\103C_HP_CPC_RC663AA-ABA a1640n_YC_0Pavi_QMXF636_E64NAemMPA3_48_IBuckeye_SASUSTek Computer INC._V1.05_B3.16_T070430_WXP2_L409_M2039_J250_7Intel_8Core2 6300_91.87_#120507_N8086104C_Z14F12F20_G808629A2.MRK
[2012/05/07 12:07:26 | 000,001,158 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2012/05/07 12:06:23 | 000,001,111 | —- | M] () – C:\WINDOWS\System32\$winnt$.inf
[2012/05/07 12:05:49 | 000,000,211 | RHS- | M] () – C:\BOOT.BAK
[252 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/05/07 18:39:44 | 000,003,023 | —- | C] () – C:\WINDOWS\System32\spupdsvc.inf
[2012/05/07 18:07:35 | 001,291,776 | —- | C] () – C:\WINDOWS\System32\dllcache\quartz.dll
[2012/05/07 17:58:01 | 000,000,803 | —- | C] () – C:\Documents and Settings\HP_Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Microsoft Outlook.lnk
[2012/05/07 17:46:33 | 000,000,906 | —- | C] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2012/05/07 17:46:32 | 000,000,902 | —- | C] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2012/05/07 17:46:03 | 000,000,830 | —- | C] () – C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012/05/07 17:29:47 | 000,067,866 | —- | C] () – C:\WINDOWS\System32\drivers\netwlan5.img
[2012/05/07 17:29:32 | 000,129,045 | —- | C] () – C:\WINDOWS\System32\drivers\cxthsfs2.cty
[2012/05/07 17:29:10 | 000,064,352 | —- | C] () – C:\WINDOWS\System32\drivers\ativmc20.cod
[2012/05/07 14:04:27 | 000,000,179 | —- | C] () – C:\WINDOWS\System\hpsysdrv.DAT
[2012/05/07 14:01:52 | 2137,473,024 | -HS- | C] () – C:\hiberfil.sys
[2012/05/07 13:37:29 | 000,001,606 | —- | C] () – C:\Documents and Settings\All Users\Desktop\McAfee AntiVirus Plus.lnk
[2012/05/07 13:06:26 | 000,001,892 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Microsoft Download Manager.lnk
[2012/05/07 12:52:23 | 000,000,744 | —- | C] () – C:\Documents and Settings\All Users\Desktop\HP Photosmart Essential.lnk
[2012/05/07 12:51:32 | 000,000,731 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\I.R.I.S. OCR Registration.lnk
[2012/05/07 12:51:07 | 000,001,819 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
[2012/05/07 12:50:55 | 000,000,995 | —- | C] () – C:\Documents and Settings\All Users\Desktop\HP Solution Center.lnk
[2012/05/07 12:46:03 | 000,118,704 | —- | C] () – C:\WINDOWS\hpoins09.dat
[2012/05/07 12:33:39 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2012/05/07 12:32:59 | 000,002,489 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Word.lnk
[2012/05/07 12:32:59 | 000,002,046 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Outlook.lnk
[2012/05/07 12:32:59 | 000,002,030 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Excel.lnk
[2012/05/07 12:32:59 | 000,002,002 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft PowerPoint.lnk
[2012/05/07 12:32:59 | 000,001,990 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Access.lnk
[2012/05/07 12:32:59 | 000,001,741 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
[2012/05/07 12:14:37 | 000,000,211 | RHS- | C] () – C:\BOOT.BAK
[2012/05/07 12:14:29 | 000,260,272 | RHS- | C] () – C:\cmldr
[2012/05/07 12:14:28 | 000,001,879 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Updates From HP.lnk
[2012/05/07 12:12:17 | 000,001,953 | RHS- | C] () – C:\WINDOWS\System32\drivers\103C_HP_CPC_RC663AA-ABA a1640n_YC_0Pavi_QMXF636_E64NAemMPA3_48_IBuckeye_SASUSTek Computer INC._V1.05_B3.16_T070430_WXP2_L409_M2039_J250_7Intel_8Core2 6300_91.87_#120507_N8086104C_Z14F12F20_G808629A2.MRK
[2012/05/07 12:07:34 | 000,000,876 | —- | C] () – C:\Documents and Settings\HP_Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\DISCover My Games™.lnk
[2012/05/07 12:07:34 | 000,000,826 | —- | C] () – C:\Documents and Settings\HP_Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2012/05/07 12:07:33 | 000,002,138 | —- | C] () – C:\Documents and Settings\HP_Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\My HP Games.lnk
[2012/05/07 12:07:33 | 000,001,489 | —- | C] () – C:\Documents and Settings\HP_Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Media Center.lnk
[2012/05/07 12:07:33 | 000,000,926 | —- | C] () – C:\Documents and Settings\HP_Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\RealPlayer.lnk
[2012/05/07 12:07:33 | 000,000,659 | —- | C] () – C:\Documents and Settings\HP_Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Rhapsody.lnk
[2012/05/07 12:07:33 | 000,000,079 | —- | C] () – C:\Documents and Settings\HP_Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf
[2012/05/07 12:07:31 | 000,000,136 | —- | C] () – C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\fusioncache.dat
[2012/05/07 12:07:29 | 000,001,599 | —- | C] () – C:\Documents and Settings\HP_Administrator\Start Menu\Programs\Remote Assistance.lnk
[2012/05/07 12:07:29 | 000,000,814 | —- | C] () – C:\Documents and Settings\HP_Administrator\Start Menu\Programs\Internet Explorer.lnk
[2012/05/07 12:07:29 | 000,000,803 | —- | C] () – C:\Documents and Settings\HP_Administrator\Start Menu\Programs\Windows Media Player.lnk
[2012/05/07 12:07:29 | 000,000,749 | —- | C] () – C:\Documents and Settings\HP_Administrator\Start Menu\Programs\Outlook Express.lnk
[2012/05/07 12:06:20 | 000,001,908 | —- | C] () – C:\Documents and Settings\All Users\Desktop\eBay.lnk
[2012/05/07 12:06:20 | 000,001,580 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Quicken New User Edition 2006.lnk
[2012/05/07 12:06:20 | 000,000,908 | —- | C] () – C:\Documents and Settings\All Users\Desktop\RealPlayer.lnk
[2012/05/07 12:06:20 | 000,000,641 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Rhapsody.lnk

========== LOP Check ==========

[2006/08/19 23:42:39 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Digital Interactive Systems Corporation
[2006/08/19 23:42:13 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\WildTangent

========== Purity Check ==========



========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2006/08/19 23:47:54 | 000,000,100 | —- | M] () – C:\AUTOEXEC.BAT
[2012/05/07 12:05:49 | 000,000,211 | RHS- | M] () – C:\BOOT.BAK
[2012/05/07 12:14:38 | 000,000,281 | RHS- | M] () – C:\boot.ini
[2004/08/09 16:00:00 | 000,260,272 | RHS- | M] () – C:\cmldr
[2005/08/30 23:02:02 | 000,000,000 | —- | M] () – C:\CONFIG.SYS
[2012/05/07 18:14:38 | 2137,473,024 | -HS- | M] () – C:\hiberfil.sys
[2006/08/19 23:54:50 | 000,000,051 | —- | M] () – C:\hpWebHelper.log
[2005/08/30 23:02:02 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2005/08/30 23:02:02 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2004/08/09 16:00:00 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2012/05/07 18:32:32 | 000,250,048 | RHS- | M] () – C:\ntldr
[2012/05/07 18:14:36 | 2145,386,496 | -HS- | M] () – C:\pagefile.sys

< %systemroot%\Fonts\*.com >

< %systemroot%\Fonts\*.dll >
[2006/02/19 12:28:56 | 000,012,288 | —- | M] (Hewlett-Packard Development Company, L.P.) – C:\WINDOWS\Fonts\RandFont.dll
[6 C:\WINDOWS\Fonts\*.tmp files -> C:\WINDOWS\Fonts\*.tmp -> ]

< %systemroot%\Fonts\*.ini >
[2005/08/30 23:01:20 | 000,000,067 | -HS- | M] () – C:\WINDOWS\Fonts\desktop.ini
[6 C:\WINDOWS\Fonts\*.tmp files -> C:\WINDOWS\Fonts\*.tmp -> ]

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2006/02/09 15:43:24 | 000,074,240 | —- | M] (Hewlett-Packard Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\hpzpp054.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2005/08/30 15:51:10 | 000,094,208 | —- | M] () – C:\WINDOWS\System32\config\default.sav
[2005/08/30 15:51:10 | 000,659,456 | —- | M] () – C:\WINDOWS\System32\config\software.sav
[2005/08/30 15:51:10 | 000,888,832 | —- | M] () – C:\WINDOWS\System32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2012/05/07 18:35:49 | 000,000,272 | -HS- | M] () – C:\Documents and Settings\All Users\Start Menu\desktop.ini

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2012/05/07 12:14:15 | 000,000,170 | -HS- | M] () – C:\Documents and Settings\HP_Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
[2005/08/30 23:06:40 | 000,000,079 | —- | M] () – C:\Documents and Settings\HP_Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

< %USERPROFILE%\Desktop\*.exe >
[2012/05/07 18:24:49 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Documents and Settings\HP_Administrator\Desktop\HiJackThis.exe
[2012/05/07 18:23:57 | 000,595,456 | —- | M] (OldTimer Tools) – C:\Documents and Settings\HP_Administrator\Desktop\OTL.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2012-05-07 23:47:14

< End of report >

OTL Extras logfile created on: 5/7/2012 7:03:50 PM - Run 1
OTL by OldTimer - Version 3.2.42.3 Folder = C:\Documents and Settings\HP_Administrator\Desktop
Windows XP Media Center Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.99 Gb Total Physical Memory | 1.37 Gb Available Physical Memory | 68.83% Memory free
3.84 Gb Paging File | 3.22 Gb Available in Paging File | 83.87% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 224.23 Gb Total Space | 208.32 Gb Free Space | 92.90% Space Free | Partition Type: NTFS
Drive D: | 8.63 Gb Total Space | 0.44 Gb Free Space | 5.14% Space Free | Partition Type: FAT32

Computer Name: YOUR-4DACD0EA75 | User Name: HP_Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] – "%1" %*
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 1
"FirewallDisableNotify" = 1
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe" = C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe:*:Enabled:Updates from HP – (Hewlett-Packard)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\DISC\DISCover.exe" = C:\Program Files\DISC\DISCover.exe:*:Enabled:DISCover Drop & Play System – (Digital Interactive Systems Corporation)
"C:\Program Files\DISC\DiscStreamHub.exe" = C:\Program Files\DISC\DiscStreamHub.exe:*:Enabled:DISCover Stream Hub – (Digital Interactive Systems Corporation, Inc.)
"C:\Program Files\DISC\myFTP.exe" = C:\Program Files\DISC\myFTP.exe:*:Enabled:DISCover FTP – (Digital Interactive Systems Corporation, Inc.)
"C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe" = C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe:*:Enabled:Updates from HP – (Hewlett-Packard)
"C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" = C:\Program Files\EarthLink TotalAccess\TaskPanl.exe:*:Enabled:Earthlink
"C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe" = C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe – (Hewlett-Packard Development Company, L.P.)
"C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe" = C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe – (Hewlett-Packard Development Company, L.P.)
"C:\Program Files\HP\Digital Imaging\bin\hposid01.exe" = C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe – (Hewlett-Packard Development Company, L.P.)
"C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe:*:Enabled:hpqcopy.exe – (Hewlett-Packard Development Company, L.P.)
"C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe" = C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe:*:Enabled:hpfccopy.exe – (Hewlett-Packard)
"C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe" = C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe – (Hewlett-Packard Development Company, L.P.)
"C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe" = C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe:*:Enabled:hpqphunl.exe – (Hewlett-Packard)
"C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe" = C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe:*:Enabled:hpqdia.exe – ( )
"C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe" = C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe – (Hewlett-Packard Development Company, L.P.)
"C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe" = C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe:*:Enabled:McAfee Shared Service Host – (McAfee, Inc.)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{075473F5-846A-448B-BCB3-104AA1760205}" = Sonic RecordNow Data
"{0A65A3BD-54B5-4d0d-B084-7688507813F5}" = SlideShow
"{1341D838-719C-4A05-B50F-49420CA1B4BB}" = HP Boot Optimizer
"{15C0AF59-4877-49B6-B8C6-A61CE54515F5}" = cp_OnlineProjectsConfig
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{21657574-BD54-48A2-9450-EB03B2C7FC29}" = Sonic MyDVD Plus
"{23012310-3E05-46A5-88A9-C6CBCABCAC79}" = Customer Experience Enhancement
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{2376813B-2E5A-4641-B7B3-A0D5ADB55229}" = HPPhotoSmartExpress
"{2818095F-FB6C-42C8-827E-0A406CC9AFF5}" = Quicken 2006
"{2F58D60D-2BFD-4467-9B4D-64E7355C329D}" = Sonic_PrimoSDK
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Sonic Update Manager
"{3248F0A8-6813-11D6-A77B-00B0D0150060}" = J2SE Runtime Environment 5.0 Update 6
"{33BF0960-DBA3-4187-B6CC-C969FCFA2D25}" = SkinsHP1
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{363790D2-DA98-41DD-9C9F-69FA36B169DE}" = PanoStandAlone
"{36D620AD-EEBA-4973-BA86-0C9AE6396620}" = OptionalContentQFolder
"{416D80BA-6F6D-4672-B7CF-F54DA2F80B44}" = Microsoft Works
"{41E776A5-9B12-416D-9A12-B4F7B044EBED}" = CP_Package_Basic1
"{45B8A76B-57EC-4242-B019-066400CD8428}" = BufferChm
"{45D707E9-F3C4-11D9-A373-0050BAE317E1}" = HP DVD Play 2.1
"{4EA684E9-5C81-4033-A696-3019EC57AC3A}" = HPProductAssistant
"{53EE9E42-CECB-4C92-BF76-9CA65DAF8F1C}" = FullDPAppQFolder
"{5FDD0538-C67A-4F67-B3F8-09D1AAF04D99}" = muvee autoProducer unPlugged 2.0
"{654977DB-0001-0002-0001-EABD228DDE8B}" = Microsoft Download Manager
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Sonic Express Labeler
"{66910000-8B30-4973-A159-6371345AFFA5}" = WebReg
"{6696D9A4-28A8-4F5A-8E9A-2E8974C8C39C}" = RandMap
"{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder
"{68763C27-235D-4165-A961-FDEA228CE504}" = AiOSoftwareNPI
"{6909F917-5499-482e-9AA1-FAD06A99F231}" = Toolbox
"{6994491D-D491-48F1-AE1F-E179C1FFFC2F}" = HP Photosmart Essential
"{736C803C-DD3B-4015-BC51-AFB9E67B9076}" = Readme
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX
"{7E7B7865-6C80-4373-8BC1-C2EB9431F9DE}" = ProductContextNPI
"{8105684D-8CA6-440D-8F58-7E5FD67A499D}" = Easy Internet Sign-up
"{82081779-4175-4666-A457-AB711CD37EF0}" = cp_LightScribeConfig
"{829DAAD6-BB11-4BB7-921B-07FFB703F944}" = CP_Package_Variety3
"{82E55892-6FFD-403F-AA97-D726846768AA}" = CP_AtenaShokunin1Config
"{8331C3EA-0C91-43AA-A4D4-27221C631139}" = Status
"{866A0078-DEA7-4348-9C9A-999AF2991EAA}" = SlideShowMusic
"{87E2B986-07E8-477a-93DC-AF0B6758B192}" = DocProcQFolder
"{8A4CE7FD-9657-4B06-9943-E1819F3D5D67}" = DocProc
"{8A534F71-3202-4464-A422-B767295E67B9}" = CP_Package_Variety2
"{8CE4E6E9-9D55-43FB-9DDB-688C976BFC05}" = Unload
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager
"{91110409-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional
"{93E5A317-24EC-4744-812C-16FECFE86E6A}" = CP_Package_Variety1
"{996512CF-F35B-48DE-9291-557FA5316967}" = ScannerCopy
"{9F7AF7CD-E3D0-4C68-A3BA-C76C359B3AA8}" = LightScribe 1.4.105.1
"{9FC8D8F8-AF3A-4488-98AF-51C6DEC732F2}" = c3100_Help
"{A29800BA-0BF1-4E63-9F31-DF05A87F4104}" = InstantShareDevices
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9F5421F-DA70-4C77-BB97-8D77EC33ED5E}" = HP Photosmart and Deskjet 7.0.A
"{AB708C9B-97C8-4AC9-899B-DBF226AC9382}" = Sonic RecordNow Audio
"{AC76BA86-7AD7-1033-7B44-A70500000002}" = Adobe Reader 7.0.5
"{B12665F4-4E93-4AB4-B7FC-37053B524629}" = Sonic RecordNow Copy
"{B2157760-AA3C-4E2E-BFE6-D20BC52495D9}" = cp_PosterPrintConfig
"{B6286A44-7505-471A-A72B-04EC2DB2F442}" = CueTour
"{B69CFE29-FD03-4E0A-87A7-6ED97F98E5B3}" = CP_Panorama1Config
"{BB85ED9C-AFC9-43BD-B8DC-258C3C7DF72E}" = HP Software Update
"{C1C6767D-B395-43CB-BF99-051B58B86DA6}" = PhotoGallery
"{C3FAA091-B278-44A7-BF48-190811C5F9F7}" = cp_UpdateProjectsConfig
"{C7F54CF8-D6FB-4E0A-93A3-E68AE0D6C476}" = SolutionCenter
"{C8753E28-2680-49BF-BD48-DD38FD086EFE}" = AiO_Scan_CDA
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{DAAD5187-62C5-4AD6-A526-803C18C4944D}" = HP Web Helper
"{DB518BA6-CB74-4EB6-9ABD-880B6D6E1F38}" = HpSdpAppCoreApp
"{DBC20735-34E6-4E97-A9E5-2066B66B243D}" = TrayApp
"{EB8C9964-09AC-48bf-8B98-027609C78251}" = C3100
"{ED2C557E-9C18-41FF-B58E-A05EEF0B3B5F}" = CP_CalendarTemplates1
"{EEFEBB48-329E-46F6-AEB8-929A5BAFDB2F}" = Intel® Viiv™ Software
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F157460F-720E-482f-8625-AD7843891E5F}" = InstantShareDevicesMFC
"{F3760724-B29D-465B-BC53-E5D72095BCC4}" = Scan
"{F6076EF9-08E1-442F-B6A2-BFB61B295A14}" = Fax_CDA
"{F80239D8-7811-4D5E-B033-0D0BBFE32920}" = HP DigitalMedia Archive
"{FB15E224-67C3-491F-9F5C-F257BC418412}" = Destinations
"{FB4740B3-2530-452D-A825-F7AB246CA7DF}" = muvee autoProducer 5.0
"{FBB980B0-63F8-4B48-8D65-90F1D9F81D9F}" = NewCopy_CDA
"12133444-BF36-4d4e-B7FB-A3424C645DE4" = GemMaster Mystic
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"CNXT_MODEM_PCI_VEN_14F1&DEV;_2F20&SUBSYS;_200C14F1" = Data Fax SoftModem with SmartCP
"DISCover" = DISCover
"EL" = Intel® Quick Resume Technology Drivers
"HDMI" = Intel® Graphics Media Accelerator Driver
"HP Imaging Device Functions" = HP Imaging Device Functions 7.0
"HP Photo & Imaging" = HP Photosmart Premier Software 6.5
"HP Photosmart for Media Center PC" = HP Photosmart for Media Center PC
"HP Solution Center & Imaging Support Tools" = HP Solution Center 7.0
"HPOCR" = OCR Software by I.R.I.S 7.0
"HPOOVClient-9972322 Uninstaller" = Updates from HP (remove only)
"ie8" = Windows Internet Explorer 8
"InstallShield_{23012310-3E05-46A5-88A9-C6CBCABCAC79}" = Customer Experience Enhancement
"InstallShield_{8105684D-8CA6-440D-8F58-7E5FD67A499D}" = Easy Internet Sign-up
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"MSC" = McAfee AntiVirus Plus
"PROSet" = Intel® PRO Network Connections Drivers
"RealPlayer 6.0" = RealPlayer
"Rhapsody" = Rhapsody
"WildTangent CDA" = WildTangent Web Driver
"WildTangent hpmedia Master Uninstall" = My HP Games
"Windows Media Format Runtime" = Windows Media Format Runtime
"Windows XP Service Pack" = Windows XP Service Pack 3
"Yahoo! Companion" = Yahoo! Toolbar for Internet Explorer
"Yahoo! Toolbar" = Yahoo! Toolbar

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 5/7/2012 1:29:10 PM | Computer Name = YOUR-4DACD0EA75 | Source = Application Hang | ID = 1002
Description = Hanging application hpzdui01.exe, version 0.0.0.0, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 5/7/2012 1:29:10 PM | Computer Name = YOUR-4DACD0EA75 | Source = Application Hang | ID = 1002
Description = Hanging application hpzdui01.exe, version 0.0.0.0, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 5/7/2012 6:32:42 PM | Computer Name = YOUR-4DACD0EA75 | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 8.0.6001.18702, faulting
module unknown, version 0.0.0.0, fault address 0x00000000.

[ System Events ]
Error - 5/7/2012 1:09:21 PM | Computer Name = YOUR-4DACD0EA75 | Source = Service Control Manager | ID = 7022
Description = The Intel® Quick Resume technology service hung on starting.

Error - 5/7/2012 1:37:19 PM | Computer Name = YOUR-4DACD0EA75 | Source = DCOM | ID = 10010
Description = The server {62F84090-A87D-4FA9-BF65-2AAB91B61CE5} did not register
with DCOM within the required timeout.

Error - 5/7/2012 6:59:04 PM | Computer Name = YOUR-4DACD0EA75 | Source = Windows Update Agent | ID = 20
Description = Installation Failure: Windows failed to install the following update
with error 0x80070643: Microsoft GDI+ Detection Tool (KB873374).

Error - 5/7/2012 7:00:05 PM | Computer Name = YOUR-4DACD0EA75 | Source = Windows Update Agent | ID = 20
Description = Installation Failure: Windows failed to install the following update
with error 0x8024200d: Security Update for Windows XP (KB975560).


< End of report >


Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 7:18:53 PM, on 5/7/2012
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\mfevtps.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\IntelDH\Intel® Quick Resume Technology Drivers\Elservice.exe
C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe
C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
C:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\HP\KBD\KBD.EXE
c:\windows\system\hpsysdrv.exe
C:\Program Files\DISC\DISCover.exe
C:\Program Files\DISC\DiscUpdMgr.exe
C:\Program Files\DISC\DiscStreamHub.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\HP_Administrator\Desktop\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf;=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf;=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf;=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf;=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf;=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf;=desktop
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
R3 - URLSearchHook: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20120507133653.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: hpWebHelper Class - {AAAE832A-5FFF-4661-9C8F-369692D1DCB9} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\WebHelper.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.7227.1100\swg.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [ftutil2] rundll32.exe ftutil2.dll,SetWriteCacheMode
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
O4 - HKLM\..\Run: [DMAScheduler] "c:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe"
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [PCDrProfiler] "C:\Program Files\PC-Doctor 5 for Windows\RunProfiler.exe" -r
O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [mcui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKLM\..\RunOnce: [KB923561] rundll32.exe apphelp.dll,ShimFlushCache
O4 - HKLM\..\RunOnce: [KB955759] rundll32.exe apphelp.dll,ShimFlushCache
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\RunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.vbs"
O4 - HKCU\..\RunOnce: [TSClientAXDisabler] cmd.exe /C "%systemroot%\Installer\TSClientMsiTrans\tscdsbl.bat"
O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
O4 - .DEFAULT User Startup: PinMcLnk.lnk = C:\hp\bin\cloaker.exe (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Updates From HP.lnk = C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://*.trymedia.com (HKLM)
O18 - Protocol: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O18 - Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\progra~1\mcafee\msc\mcsniepl.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Intel® Quick Resume technology (ELService) - Intel Corporation - C:\Program Files\Intel\IntelDH\Intel® Quick Resume Technology Drivers\Elservice.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: McAfee SiteAdvisor Service - McAfee, Inc. - C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
O23 - Service: McAfee Personal Firewall Service (McMPFSvc) - McAfee, Inc. - C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
O23 - Service: McAfee VirusScan Announcer (McNaiAnn) - McAfee, Inc. - C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe
O23 - Service: McAfee Firewall Core Service (mfefire) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe
O23 - Service: McAfee Validation Trust Protection Service (mfevtp) - McAfee, Inc. - C:\WINDOWS\system32\mfevtps.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

–
End of file - 11409 bytes
.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 8.0.6001.18702
Run by [removed] at 19:19:23 on 2012-05-07
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2038.1419 [GMT -5:00]
.
AV: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Firewall *Enabled*
.
============== Running Processes ===============
.
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
svchost.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\mfevtps.exe
svchost.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Intel\IntelDH\Intel® Quick Resume Technology Drivers\Elservice.exe
C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe
C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
C:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\HP\KBD\KBD.EXE
c:\windows\system\hpsysdrv.exe
C:\Program Files\DISC\DISCover.exe
C:\Program Files\DISC\DiscUpdMgr.exe
C:\Program Files\DISC\DiscStreamHub.exe
C:\WINDOWS\system32\wuauclt.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com/
uSearch Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp;=iesearch&locale;=EN_US&c;=64&bd;=PAVILION&pf;=desktop
uDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp;=iehome&locale;=EN_US&c;=64&bd;=PAVILION&pf;=desktop
uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp;=iesearch&locale;=EN_US&c;=64&bd;=PAVILION&pf;=desktop
uSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp;=iesearch&locale;=EN_US&c;=64&bd;=PAVILION&pf;=desktop
mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp;=iesearch&locale;=EN_US&c;=64&bd;=PAVILION&pf;=desktop
mSearchAssistant = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp;=iesearch&locale;=EN_US&c;=64&bd;=PAVILION&pf;=desktop
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
uURLSearchHooks: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
BHO: Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.5.0_06\bin\ssv.dll
BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\common files\mcafee\systemcore\ScriptSn.20120507133653.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: hpWebHelper Class: {aaae832a-5fff-4661-9c8f-369692d1dcb9} - c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\plugin\WebHelper.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.7.7227.1100\swg.dll
BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
uRunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.vbs"
uRunOnce: [TSClientAXDisabler] cmd.exe /C "%systemroot%\Installer\TSClientMsiTrans\tscdsbl.bat"
mRun: [ehTray] c:\windows\ehome\ehtray.exe
mRun: [ftutil2] rundll32.exe ftutil2.dll,SetWriteCacheMode
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [IAAnotif] c:\program files\intel\intel matrix storage manager\Iaanotif.exe
mRun: [DMAScheduler] "c:\program files\hp digitalmedia archive\DMAScheduler.exe"
mRun: [Recguard] c:\windows\sminst\RECGUARD.EXE
mRun: []
mRun: [PCDrProfiler] "c:\program files\pc-doctor 5 for windows\RunProfiler.exe" -r
mRun: [HPBootOp] "c:\program files\hewlett-packard\hp boot optimizer\HPBootOp.exe" /run
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [mcui_exe] "c:\program files\mcafee.com\agent\mcagent.exe" /runkey
mRunOnce: [KB923561] rundll32.exe apphelp.dll,ShimFlushCache
mRunOnce: [KB955759] rundll32.exe apphelp.dll,ShimFlushCache
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\update~1.lnk - c:\program files\updates from hp\9972322\program\Updates from HP.exe
IE: E&xport; to Microsoft Excel - c:\progra~1\micros~4\office10\EXCEL.EXE/3000
IE: {E2D4D26B-0180-43a4-B05F-462D6D54C789} - c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\iebutton\support.htm
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC} - c:\program files\java\jre1.5.0_06\bin\ssv.dll
Trusted Zone: trymedia.com
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
TCP: DhcpNameServer = [removed] [removed]
TCP: Interfaces\{1385C8F6-DC8E-4FC4-B6D3-C90E62F6704E} : DhcpNameServer = [removed] [removed]
TCP: Interfaces\{892900FC-9814-4488-99C0-81491C1EE93D} : DhcpNameServer = [removed] [removed] [removed] [removed]
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\progra~1\mcafee\msc\McSnIePl.dll
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll
Notify: igfxcui - igfxdev.dll
.
============= SERVICES / DRIVERS ===============
.
R0 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2012-2-22 464304]
R1 mfetdi2k;McAfee Inc. mfetdi2k;c:\windows\system32\drivers\mfetdi2k.sys [2012-5-7 89792]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\common files\mcafee\mcsvchost\McSvHost.exe [2012-5-7 214904]
R2 McMPFSvc;McAfee Personal Firewall Service;c:\program files\common files\mcafee\mcsvchost\McSvHost.exe [2012-5-7 214904]
R2 McNaiAnn;McAfee VirusScan Announcer;c:\program files\common files\mcafee\mcsvchost\McSvHost.exe [2012-5-7 214904]
R2 McProxy;McAfee Proxy Service;c:\program files\common files\mcafee\mcsvchost\McSvHost.exe [2012-5-7 214904]
R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328]
R2 McShield;McAfee McShield;c:\program files\common files\mcafee\systemcore\mcshield.exe [2012-5-7 166288]
R2 mfefire;McAfee Firewall Core Service;c:\program files\common files\mcafee\systemcore\mfefire.exe [2012-5-7 161632]
R2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [2012-5-7 151880]
R3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [2012-5-7 57600]
R3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2012-5-7 180848]
R3 mfebopk;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2012-5-7 59456]
R3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [2012-5-7 340920]
R3 mfendiskmp;mfendiskmp;c:\windows\system32\drivers\mfendisk.sys [2012-5-7 83856]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2012-5-7 136176]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\macromed\flash\FlashPlayerUpdateService.exe [2012-5-7 257696]
S3 mfendisk;McAfee Core NDIS Intermediate Filter;c:\windows\system32\drivers\mfendisk.sys [2012-5-7 83856]
S3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [2012-5-7 87656]
.
=============== Created Last 30 ================
.
2012-05-07 23:41:12 ——– d—–w- c:\documents and settings\hp_administrator\application data\HPQ
2012-05-07 23:34:53 ——– d—–w- c:\windows\system32\scripting
2012-05-07 23:34:53 ——– d—–w- c:\windows\system32\en
2012-05-07 23:34:53 ——– d—–w- c:\windows\system32\bits
2012-05-07 23:34:53 ——– d—–w- c:\windows\l2schemas
2012-05-07 23:32:41 ——– d—–w- c:\windows\network diagnostic
2012-05-07 23:11:49 ——– d—–w- c:\windows\ServicePackFiles
2012-05-07 23:07:35 17920 ——w- c:\windows\system32\dllcache\msyuv.dll
2012-05-07 23:07:35 1291776 ——w- c:\windows\system32\dllcache\quartz.dll
2012-05-07 22:49:55 ——– d—–w- c:\program files\MSXML 4.0
2012-05-07 22:46:18 ——– d—–w- c:\documents and settings\hp_administrator\local settings\application data\Google
2012-05-07 22:45:58 70304 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-05-07 22:45:58 419488 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2012-05-07 22:18:36 272128 ——w- c:\windows\system32\dllcache\bthport.sys
2012-05-07 22:18:35 272128 ——w- c:\windows\system32\drivers\bthport.sys
2012-05-07 22:18:12 353792 ——w- c:\windows\system32\dllcache\srv.sys
2012-05-07 22:16:59 23040 ——w- c:\windows\kb913800.exe
2012-05-07 22:16:08 1172480 ——w- c:\windows\system32\SET1552.tmp
2012-05-07 22:16:07 203136 ——w- c:\windows\system32\dllcache\rmcast.sys
2012-05-07 22:14:33 337408 ——w- c:\windows\system32\SET14FF.tmp
2012-05-07 22:14:33 337408 ——w- c:\windows\system32\dllcache\netapi32.dll
2012-05-07 22:14:14 2560 ——w- c:\windows\system32\xpsp4res.dll
2012-05-07 22:14:14 215552 —-a-w- c:\program files\windows nt\accessories\SET146F.tmp
2012-05-07 22:14:14 215552 ——w- c:\windows\system32\dllcache\wordpad.exe
2012-05-07 22:12:46 ——– d—–w- c:\windows\system32\PreInstall
2012-05-07 21:19:03 ——– d—–w- c:\windows\system32\LogFiles
2012-05-07 19:03:46 25856 —-a-w- c:\windows\system32\drivers\usbprint.sys
2012-05-07 19:03:44 32128 —-a-w- c:\windows\system32\drivers\usbccgp.sys
2012-05-07 18:46:17 ——– d—–r- c:\documents and settings\all users\Documents
2012-05-07 18:44:37 ——– d—–r- c:\windows\Offline Web Pages
2012-05-07 18:41:23 ——– d-sh–r- c:\windows\system32\dllcache
2012-05-07 18:36:53 9608 —-a-w- c:\windows\system32\drivers\mfeclnk.sys
2012-05-07 18:36:52 89792 —-a-w- c:\windows\system32\drivers\mfetdi2k.sys
2012-05-07 18:36:52 87656 —-a-w- c:\windows\system32\drivers\mferkdet.sys
2012-05-07 18:36:52 83856 —-a-w- c:\windows\system32\drivers\mfendisk.sys
2012-05-07 18:36:52 340920 —-a-w- c:\windows\system32\drivers\mfefirek.sys
2012-05-07 18:36:51 59456 —-a-w- c:\windows\system32\drivers\mfebopk.sys
2012-05-07 18:36:51 57600 —-a-w- c:\windows\system32\drivers\cfwids.sys
2012-05-07 18:36:51 180848 —-a-w- c:\windows\system32\drivers\mfeavfk.sys
2012-05-07 18:36:50 ——– d—–w- c:\program files\common files\Mcafee
2012-05-07 18:36:49 ——– d—–w- c:\program files\McAfee.com
2012-05-07 18:36:44 ——– d—–w- c:\program files\McAfee
2012-05-07 18:30:22 151880 —-a-w- c:\windows\system32\mfevtps.exe
2012-05-07 18:27:30 ——– d-sh–w- c:\documents and settings\hp_administrator\PrivacIE
2012-05-07 18:24:52 ——– d-sh–w- c:\documents and settings\hp_administrator\IETldCache
2012-05-07 18:22:12 ——– d—–w- c:\windows\ie8updates
2012-05-07 18:21:41 ——– dc-h–w- c:\windows\ie8
2012-05-07 18:10:40 ——– d—–w- c:\program files\MSECache
2012-05-07 18:06:26 ——– d—–w- c:\program files\Microsoft Download Manager
2012-05-07 17:58:52 599040 ——w- c:\windows\system32\dllcache\msfeeds.dll
2012-05-07 17:58:52 55296 ——w- c:\windows\system32\dllcache\msfeedsbs.dll
2012-05-07 17:58:52 12800 ——w- c:\windows\system32\dllcache\xpshims.dll
2012-05-07 17:58:51 743424 ——w- c:\windows\system32\dllcache\iedvtool.dll
2012-05-07 17:58:51 247808 ——w- c:\windows\system32\dllcache\ieproxy.dll
2012-05-07 17:58:51 1985536 ——w- c:\windows\system32\dllcache\iertutil.dll
2012-05-07 17:58:49 11076096 ——w- c:\windows\system32\dllcache\ieframe.dll
2012-05-07 17:50:03 ——– d—–w- c:\program files\common files\Hewlett-Packard
2012-05-07 17:38:03 ——– d-s—w- c:\documents and settings\hp_administrator\UserData
2012-05-07 17:32:58 ——– d—–w- c:\program files\Microsoft ActiveSync
2012-05-07 17:31:46 ——– d—–w- c:\windows\ShellNew
2012-05-07 17:31:44 ——– d—–w- c:\program files\common files\L&H;
2012-05-07 17:29:00 74240 —-a-w- c:\windows\system32\spool\prtprocs\w32x86\hpzpp054.dll
2012-05-07 17:29:00 38400 —-a-w- c:\windows\system32\hpz3l054.dll
2012-05-07 17:27:39 94208 —-a-w- c:\windows\system32\HPZipt12.dll
2012-05-07 17:27:39 57344 —-a-w- c:\windows\system32\HPZisn12.dll
2012-05-07 17:27:39 204800 —-a-w- c:\windows\system32\HPZipr12.dll
2012-05-07 17:27:38 69632 —-a-w- c:\windows\system32\HPZipm12.exe
2012-05-07 17:27:38 65536 —-a-w- c:\windows\system32\HPZinw12.exe
2012-05-07 17:27:38 278584 —-a-w- c:\windows\system32\HPZidr12.dll
2012-05-07 17:24:41 254026 —-a-r- c:\windows\system32\hpovst09.dll
2012-05-07 17:24:40 827392 —-a-r- c:\windows\system32\hpotiop2.dll
2012-05-07 17:24:37 659456 —-a-r- c:\windows\system32\hpowiax2.dll
2012-05-07 17:24:33 15104 —-a-w- c:\windows\system32\drivers\usbscan.sys
2012-05-07 17:14:06 ——– d-sh–w- C:\cmdcons
2012-05-07 17:14:02 ——– d—–w- c:\windows\setup.pss
2012-05-07 17:05:24 ——– d—–w- c:\windows\system32\SoftwareDistribution
.
==================== Find3M ====================
.
2012-05-07 23:38:18 208896 —-a-w- c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\plugin\WebHelper.dll
2012-05-07 23:37:48 45056 —-a-w- c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\uninstallui\eHelpSetup.exe
2012-05-07 23:37:42 44032 —-a-w- c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\scripts\devcon.exe
2012-05-07 23:37:42 40960 —-a-w- c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\plugin\ScDmi.dll
2012-05-07 23:37:42 32768 —-a-w- c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\plugin\uploadHSC.dll
2012-05-07 23:37:42 32768 —-a-w- c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\plugin\Scom.dll
2012-05-07 23:37:41 61440 —-a-w- c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\plugin\modemutil.dll
2012-05-07 23:37:41 341048 —-a-w- c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\plugin\HPBasicDetection3.dll
2012-05-07 23:37:41 163840 —-a-w- c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\plugin\modemcheck.dll
2012-02-22 18:29:46 464304 —-a-w- c:\windows\system32\drivers\mfehidk.sys
2012-02-22 18:29:46 121544 —-a-w- c:\windows\system32\drivers\mfeapfk.sys
.
============= FINISH: 19:20:59.92 ===============

Attachments:

Post #2
Hi wilma1313,

:welcome:

My name is Tomk. I would be glad to take a look at your log and help you with solving any malware problems. Logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

  • I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
  • The fixes are specific to your problem and should only be used for the issues on this machine.
  • Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.


Your logs aren't showing anything nefarious - but you have alot of updates to install. You need to install SP3 and all of it's updates as well as update your java. I suspect that you are experiencing some slowdown as these updates are trying to download.

Try to get all of your updates installed and then see how things react. Then let me know how it's going.
Post #3
I think I'm caught up - I'd say at least 100 updates installed since Mon and the computer is starting to look like what I am used to again. It still seems slow, but it is old and has been thru alot. It is a relief you don't see any problems now .
Post #4
Great.

Now let's try this:

Download ComboFix from one of these locations:

Link 1
Link 2
Link 3

* IMPORTANT !!! Save ComboFix.exe to your Desktop


  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link –> http://forums.whatthetech.com/How_Disable_…ams_t96260.html

  • Double click on ComboFix.exe & follow the prompts.

  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.


[external image: Posted Image]



Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]


Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.


Notes:

1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
4. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
5. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
Post #5
" Combofix prevents autorun of ALL CD, floppy and USB devices " So what does that mean in practical terms to me? What do I have to do to run my stuff? Does it affect my printer? plugging in my Ipod? Garmin?
Post #6
It will not effect those things. What will happen is if you insert a CD into your drive… it will not begin automatically. It will only play if you tell it to. The autoplay function was heavily exploited by malware on XP machines. What would happen is if malware was present on a removable devise… it would load and spread before security systems could scan it or you could stop it. This is why this function was revised for Windows Vista and Windows 7.
Post #9
Sorry. Final exams and did not get to this til just now. Crazy couple weeks. Free now! thanks for looking at them.





ComboFix 12-05-14.03 - HP_Administrator 05/14/2012 13:18:48.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2038.1433 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: McAfee Anti-Virus and Anti-Spyware *Disabled/Updated* {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Firewall *Disabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\docume~1\HP_ADM~1\LOCALS~1\Temp\IadHide5.dll
c:\documents and settings\Administrator\WINDOWS
c:\documents and settings\All Users\Application Data\TEMP
c:\documents and settings\Default User\WINDOWS
c:\documents and settings\HP_Administrator\Local Settings\Temp\IadHide5.dll
c:\documents and settings\HP_Administrator\WINDOWS
c:\windows\system32\config\systemprofile\WINDOWS
.
.
((((((((((((((((((((((((( Files Created from 2012-04-14 to 2012-05-14 )))))))))))))))))))))))))))))))
.
.
2012-05-14 13:30 . 2012-05-14 13:30 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Apple
2012-05-09 18:28 . 2009-05-18 18:17 26600 —-a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2012-05-09 18:28 . 2008-04-17 17:12 107368 —-a-w- c:\windows\system32\GEARAspi.dll
2012-05-09 18:27 . 2012-05-09 18:27 ——– d—–w- c:\program files\iPod
2012-05-09 18:27 . 2012-05-09 18:28 ——– d—–w- c:\program files\iTunes
2012-05-09 18:27 . 2012-05-09 18:28 ——– d—–w- c:\documents and settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2012-05-09 18:27 . 2012-05-09 18:27 ——– d—–w- c:\documents and settings\All Users\Application Data\Apple Computer
2012-05-09 18:26 . 2012-05-09 18:26 ——– d—–w- c:\program files\Apple Software Update
2012-05-09 18:26 . 2012-05-09 18:26 ——– d—–w- c:\documents and settings\LocalService\Application Data\Apple Computer
2012-05-09 18:26 . 2012-05-09 18:26 ——– d—–w- c:\program files\Bonjour
2012-05-09 18:25 . 2012-05-09 18:27 ——– d—–w- c:\program files\Common Files\Apple
2012-05-09 18:25 . 2012-05-09 18:26 ——– d—–w- c:\documents and settings\All Users\Application Data\Apple
2012-05-09 18:22 . 2012-05-09 18:22 73728 —-a-w- c:\windows\system32\javacpl.cpl
2012-05-09 18:22 . 2012-05-09 18:22 476960 —-a-w- c:\windows\system32\npdeployJava1.dll
2012-05-09 18:22 . 2012-05-09 18:22 472864 —-a-w- c:\windows\system32\deployJava1.dll
2012-05-09 02:01 . 2012-05-09 02:01 ——– d—–w- c:\program files\SUPERAntiSpyware
2012-05-09 02:01 . 2012-05-09 02:01 ——– d—–w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2012-05-08 15:22 . 2012-01-11 19:06 3072 ——w- c:\windows\system32\iacenc.dll
2012-05-08 01:43 . 2012-05-08 01:43 ——– d—–w- c:\program files\SpywareBlaster
2012-05-08 01:41 . 2012-05-09 18:22 ——– d—–w- c:\program files\SpywareGuard
2012-05-08 01:37 . 2012-05-08 01:37 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2012-05-08 01:37 . 2012-05-08 01:37 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2012-05-08 01:37 . 2012-04-04 20:56 22344 —-a-w- c:\windows\system32\drivers\mbam.sys
2012-05-07 23:34 . 2012-05-07 23:34 ——– d—–w- c:\windows\system32\scripting
2012-05-07 23:34 . 2012-05-07 23:34 ——– d—–w- c:\windows\system32\en
2012-05-07 23:34 . 2012-05-07 23:34 ——– d—–w- c:\windows\system32\bits
2012-05-07 23:34 . 2012-05-07 23:34 ——– d—–w- c:\windows\l2schemas
2012-05-07 23:11 . 2012-05-07 23:33 ——– d—–w- c:\windows\ServicePackFiles
2012-05-07 22:51 . 2012-05-07 22:51 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Temp
2012-05-07 22:51 . 2012-05-08 03:51 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Google
2012-05-07 22:49 . 2012-05-07 22:49 ——– d—–w- c:\program files\MSXML 4.0
2012-05-07 22:46 . 2012-05-07 22:46 ——– d—–w- c:\documents and settings\LocalService\Local Settings\Application Data\Google
2012-05-07 22:46 . 2012-05-07 22:46 ——– d—–w- c:\program files\Google
2012-05-07 22:45 . 2012-05-07 22:45 70304 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-05-07 22:45 . 2012-05-07 22:45 419488 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2012-05-07 22:18 . 2008-06-13 11:05 272128 ——w- c:\windows\system32\drivers\bthport.sys
2012-05-07 22:16 . 2006-03-21 03:23 23040 ——w- c:\windows\kb913800.exe
2012-05-07 22:14 . 2011-02-17 12:32 5120 —-a-w- c:\windows\system32\xpsp4res.dll
2012-05-07 21:19 . 2012-05-07 21:19 ——– d—–w- c:\windows\system32\LogFiles
2012-05-07 19:03 . 2008-04-13 18:47 25856 —-a-w- c:\windows\system32\drivers\usbprint.sys
2012-05-07 19:03 . 2008-04-13 18:45 32128 —-a-w- c:\windows\system32\drivers\usbccgp.sys
2012-05-07 18:46 . 2012-05-07 18:55 ——– d—–r- c:\documents and settings\All Users\Documents
2012-05-07 18:41 . 2012-05-10 08:00 ——– d-sh–r- c:\windows\system32\dllcache
2012-05-07 18:36 . 2012-02-22 18:29 9608 —-a-w- c:\windows\system32\drivers\mfeclnk.sys
2012-05-07 18:36 . 2012-02-22 18:29 89792 —-a-w- c:\windows\system32\drivers\mfetdi2k.sys
2012-05-07 18:36 . 2012-02-22 18:29 87656 —-a-w- c:\windows\system32\drivers\mferkdet.sys
2012-05-07 18:36 . 2012-02-22 18:29 83856 —-a-w- c:\windows\system32\drivers\mfendisk.sys
2012-05-07 18:36 . 2012-02-22 18:29 340920 —-a-w- c:\windows\system32\drivers\mfefirek.sys
2012-05-07 18:36 . 2012-02-22 18:29 59456 —-a-w- c:\windows\system32\drivers\mfebopk.sys
2012-05-07 18:36 . 2012-02-22 18:29 57600 —-a-w- c:\windows\system32\drivers\cfwids.sys
2012-05-07 18:36 . 2012-02-22 18:29 180848 —-a-w- c:\windows\system32\drivers\mfeavfk.sys
2012-05-07 18:36 . 2012-05-07 18:37 ——– d—–w- c:\program files\Common Files\Mcafee
2012-05-07 18:36 . 2012-05-09 01:48 ——– d—–w- c:\program files\McAfee
2012-05-07 18:30 . 2012-03-20 18:11 151880 —-a-w- c:\windows\system32\mfevtps.exe
2012-05-07 18:30 . 2012-05-07 21:37 ——– d—–w- c:\documents and settings\All Users\Application Data\McAfee
2012-05-07 18:25 . 2012-05-07 18:25 ——– d-sh–w- c:\documents and settings\NetworkService\IETldCache
2012-05-07 18:21 . 2012-05-07 18:21 ——– dc-h–w- c:\windows\ie8
2012-05-07 18:10 . 2012-05-07 18:10 ——– d—–w- c:\program files\MSECache
2012-05-07 18:06 . 2012-05-07 18:06 ——– d—–w- c:\program files\Microsoft Download Manager
2012-05-07 17:52 . 2012-05-07 17:52 ——– d—–w- c:\documents and settings\All Users\Application Data\HP
2012-05-07 17:50 . 2012-05-07 17:50 ——– d—–w- c:\program files\Common Files\Hewlett-Packard
2012-05-07 17:32 . 2012-05-07 17:32 ——– d—–w- c:\program files\Microsoft ActiveSync
2012-05-07 17:31 . 2012-05-07 17:32 ——– d—–w- c:\windows\ShellNew
2012-05-07 17:31 . 2012-05-07 17:31 ——– d—–w- c:\program files\Common Files\L&H
2012-05-07 17:29 . 2006-02-09 20:45 38400 —-a-w- c:\windows\system32\hpz3l054.dll
2012-05-07 17:29 . 2006-02-09 20:43 74240 —-a-w- c:\windows\system32\Spool\prtprocs\w32x86\hpzpp054.dll
2012-05-07 17:27 . 2005-03-15 06:35 204800 —-a-w- c:\windows\system32\HPZipr12.dll
2012-05-07 17:27 . 2005-03-09 06:25 57344 —-a-w- c:\windows\system32\HPZisn12.dll
2012-05-07 17:27 . 2005-03-09 06:25 94208 —-a-w- c:\windows\system32\HPZipt12.dll
2012-05-07 17:27 . 2005-11-23 02:58 69632 —-a-w- c:\windows\system32\HPZipm12.exe
2012-05-07 17:27 . 2005-03-15 08:09 65536 —-a-w- c:\windows\system32\HPZinw12.exe
2012-05-07 17:27 . 2005-03-15 06:33 278584 —-a-w- c:\windows\system32\HPZidr12.dll
2012-05-07 17:24 . 2006-02-15 20:06 254026 —-a-r- c:\windows\system32\hpovst09.dll
2012-05-07 17:24 . 2006-02-15 20:06 827392 —-a-r- c:\windows\system32\hpotiop2.dll
2012-05-07 17:24 . 2006-02-15 20:06 659456 —-a-r- c:\windows\system32\hpowiax2.dll
2012-05-07 17:24 . 2008-04-13 18:45 15104 —-a-w- c:\windows\system32\drivers\usbscan.sys
2012-05-07 17:07 . 2012-05-14 18:22 ——– d—–w- c:\documents and settings\HP_Administrator
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-05-07 23:38 . 2012-05-07 23:37 208896 —-a-w- c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\WebHelper.dll
2012-05-07 23:37 . 2012-05-07 23:37 45056 —-a-w- c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\uninstallUI\eHelpSetup.exe
2012-05-07 23:37 . 2012-05-07 23:37 44032 —-a-w- c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\Scripts\devcon.exe
2012-05-07 23:37 . 2012-05-07 23:37 40960 —-a-w- c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\ScDmi.dll
2012-05-07 23:37 . 2012-05-07 23:37 32768 —-a-w- c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\uploadHSC.dll
2012-05-07 23:37 . 2012-05-07 23:37 32768 —-a-w- c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\Scom.dll
2012-05-07 23:37 . 2012-05-07 23:37 61440 —-a-w- c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\modemutil.dll
2012-05-07 23:37 . 2012-05-07 23:37 341048 —-a-w- c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\HPBasicDetection3.dll
2012-05-07 23:37 . 2012-05-07 23:37 163840 —-a-w- c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\modemcheck.dll
2012-04-11 13:14 . 2004-08-10 11:00 2148352 ——w- c:\windows\system32\ntoskrnl.exe
2012-04-11 13:12 . 2004-08-10 04:00 1862272 —-a-w- c:\windows\system32\win32k.sys
2012-04-11 12:35 . 2004-08-10 11:00 2026496 ——w- c:\windows\system32\ntkrnlpa.exe
2012-03-01 11:01 . 2004-08-10 04:00 916992 —-a-w- c:\windows\system32\wininet.dll
2012-03-01 11:01 . 2004-08-10 04:00 43520 —-a-w- c:\windows\system32\licmgr10.dll
2012-03-01 11:01 . 2004-08-10 04:00 1469440 ——w- c:\windows\system32\inetcpl.cpl
2012-02-29 14:10 . 2004-08-10 11:00 148480 ——w- c:\windows\system32\imagehlp.dll
2012-02-29 14:10 . 2004-08-10 04:00 177664 —-a-w- c:\windows\system32\wintrust.dll
2012-02-29 12:17 . 2004-08-10 04:00 385024 —-a-w- c:\windows\system32\html.iec
2012-02-22 18:29 . 2012-02-22 18:29 464304 —-a-w- c:\windows\system32\drivers\mfehidk.sys
2012-02-22 18:29 . 2012-02-22 18:29 121544 —-a-w- c:\windows\system32\drivers\mfeapfk.sys
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2012-05-07 39408]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2012-05-01 3905920]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-09-30 67584]
"ftutil2"="ftutil2.dll" [2004-06-07 106496]
"RTHDCPL"="RTHDCPL.EXE" [2006-06-14 16239616]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2006-06-23 86016]
"Persistence"="c:\windows\system32\igfxpers.exe" [2006-06-23 81920]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2006-07-06 151552]
"DMAScheduler"="c:\program files\HP DigitalMedia Archive\DMAScheduler.exe" [2006-04-13 90112]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2005-07-23 237568]
"HPBootOp"="c:\program files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2006-02-16 249856]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 49152]
"mcui_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2012-03-22 1318816]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-21 59240]
.
c:\documents and settings\HP_Administrator\Start Menu\Programs\Startup\
SpywareGuard.lnk - c:\program files\SpywareGuard\sgmain.exe [2003-8-29 360448]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-2-19 288472]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
Updates From HP.lnk - c:\program files\Updates from HP\9972322\Program\Updates from HP.exe [2006-8-19 36903]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2011-07-19 113024]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2011-05-04 17:54 551296 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\DISC\\DISCover.exe"=
"c:\\Program Files\\DISC\\DiscStreamHub.exe"=
"c:\\Program Files\\DISC\\myFTP.exe"=
"c:\\Program Files\\Updates from HP\\9972322\\Program\\Updates from HP.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\Common Files\\Mcafee\\McSvcHost\\McSvHost.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
.
R1 mfetdi2k;McAfee Inc. mfetdi2k;c:\windows\system32\drivers\mfetdi2k.sys [5/7/2012 1:36 PM 89792]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [7/22/2011 11:27 AM 12880]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [7/12/2011 4:55 PM 67664]
R2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCore.exe [8/11/2011 6:38 PM 116608]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;"c:\program files\Common Files\Mcafee\McSvcHost\McSvHost.exe" /McCoreSvc [5/7/2012 1:36 PM 214904]
R2 McMPFSvc;McAfee Personal Firewall Service;"c:\program files\Common Files\Mcafee\McSvcHost\McSvHost.exe" /McCoreSvc [5/7/2012 1:36 PM 214904]
R2 McNaiAnn;McAfee VirusScan Announcer;"c:\program files\Common Files\Mcafee\McSvcHost\McSvHost.exe" /McCoreSvc [5/7/2012 1:36 PM 214904]
R2 mfefire;McAfee Firewall Core Service;c:\program files\Common Files\Mcafee\SystemCore\mfefire.exe [5/7/2012 1:37 PM 161632]
R2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [5/7/2012 1:30 PM 151880]
R3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [5/7/2012 1:36 PM 57600]
R3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [5/7/2012 1:36 PM 340920]
R3 mfendiskmp;mfendiskmp;c:\windows\system32\drivers\mfendisk.sys [5/7/2012 1:36 PM 83856]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [5/7/2012 5:46 PM 136176]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [5/7/2012 5:46 PM 257696]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [5/7/2012 5:46 PM 136176]
S3 mfendisk;McAfee Core NDIS Intermediate Filter;c:\windows\system32\drivers\mfendisk.sys [5/7/2012 1:36 PM 83856]
S3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [5/7/2012 1:36 PM 87656]
.
— Other Services/Drivers In Memory —
.
*NewlyCreated* - WS2IFSL
*Deregistered* - mfeavfk01
.
Contents of the 'Scheduled Tasks' folder
.
2012-05-14 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-07 22:46]
.
2012-05-14 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 22:57]
.
2012-05-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-05-07 22:46]
.
2012-05-14 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-05-07 22:46]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=64&bd=PAVILION&pf=desktop
mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=64&bd=PAVILION&pf=desktop
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office10\EXCEL.EXE/3000
Trusted Zone: trymedia.com
TCP: DhcpNameServer = [removed] [removed]
.
- - - - ORPHANS REMOVED - - - -
.
HKLM-Run-PCDrProfiler - c:\program files\PC-Doctor 5 for Windows\RunProfiler.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-05-14 13:28
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(1116)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\WININET.dll
.
- - - - - - - > 'explorer.exe'(484)
c:\windows\system32\WININET.dll
c:\progra~1\mcafee\SITEAD~1\saHook.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
———————— Other Running Processes ————————
.
c:\windows\RTHDCPL.EXE
c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\eHome\ehRecvr.exe
c:\windows\eHome\ehSched.exe
c:\program files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
c:\windows\system32\wdfmgr.exe
c:\windows\ehome\mcrdsvc.exe
c:\program files\Common Files\McAfee\SystemCore\mcshield.exe
c:\program files\Intel\IntelDH\Intel® Quick Resume Technology Drivers\Elservice.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\dllhost.exe
c:\windows\eHome\ehmsas.exe
c:\windows\system32\wscntfy.exe
c:\hp\KBD\KBD.EXE
c:\progra~1\mcafee\VIRUSS~1\mcvsshld.exe
.
**************************************************************************
.
Completion time: 2012-05-14 13:36:24 - machine was rebooted
ComboFix-quarantined-files.txt 2012-05-14 18:36
.
Pre-Run: 221,017,559,040 bytes free
Post-Run: 221,447,159,808 bytes free
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect
.
- - End Of File - - 7DB8107A96872E0D31A64DEE4BB7BBA3
Post #10
Good.

Let's get an online scan:

ESET Online Scanner:

Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.

Vista users: You will need to to right-click on the either the IE or FF icon in the Start Menu or Quick Launch Bar on the Taskbar and select Run as Administrator from the context menu.

  • Please go here then click on: [external image: Posted Image]

    Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
    All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.

  • Select the option YES, I accept the Terms of Use then click on: [external image: Posted Image]
  • When prompted allow the Add-On/Active X to install.
  • Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
  • Now click on Advanced Settings and select the following:
    • Scan for potentially unwanted applications
    • Scan for potentially unsafe applications
    • Enable Anti-Stealth Technology
  • Now click on: [external image: Posted Image]
  • The virus signature database… will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
  • When completed the Online Scan will begin automatically.
  • Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
  • When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
  • Now click on: [external image: Posted Image]
  • Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
  • Copy and paste that log as a reply to this topic.

Note: Do not forget to re-enable your Anti-Virus application after running the above scan!
Post #11
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP1\A0000160.exe a variant of Win32/AdInstaller application
Post #12 last edited
That is just a ghost of an old infection stored in a restore point. We will clear them out as part of housekeeping.

You might want to post in the Windows Forum and see if the Tech Team can help you tune things up a little and get a bit more speed going. If you choose to do that, I suggest that you include a link to this thread in your post in case there is something in one of the logs that you provided that will be beneficial to the Tech Team.

Log looks good :D


Time for some housekeeping
  • Click START then RUN
  • Now type ComboFix /Uninstall in the runbox and click OK.
  • Note the space between the X and the U, it needs to be there.
  • [external image: Posted Image]
The above procedure will:
  • Implement some cleanup procedures.
  • Reset System Restore.

  • Double click on OTL to run it.
  • Click on CleanUp!
  • When done, you will be prompted to restart your computer. Please restart your computer.

Please re-enable any security that was disabled.


The following is my standard advice for the future. Use what you can and pat yourself on the back for what you're already doing.

Please take time to read Preventing Malware - Tools and Practices for Safe Computing. Very important information for your consideration is contained therein.

I would also suggest you read this:
So how did I get infected in the first place?
by Tony Klein


Also: "How to prevent malware"
by miekiemoes

Please respond back that you understand the above and let me know if you have any questions. Otherwise, this thread will be closed Resolved. :thumbup:

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI