Humbly need Help

I have some type of malware/virus that directs me to other links, usually when I've done a google search. I've tried removing it with MalwareBytes and I use NOD as my virus protector. Any help would be greatly appreciated. Here are my dds logs: . DDS (Ver_2011-08-26.01) - NTFSx86 Internet Explorer: 6.0.2900.5512 BrowserJavaVersion: 10.2.0 Run by [removed] at 18:32:43 on 2012-05-11 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.485.230 [GMT -4:00] . AV: ESET NOD32 Antivirus 4.2 *Enabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0} . ============== Running Processes =============== . C:\WINDOWS\system32\svchost.exe -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\SOUNDMAN.EXE C:\WINDOWS\ALCWZRD.EXE C:\Program Files\AirPort\APAgent.exe C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe svchost.exe C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe C:\WINDOWS\system32\svchost.exe -k imgsvc . ============== Pseudo HJT Report =============== . uStart Page = hxxp://www.google.com/ mStart Page = about:blank BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre7\bin\jp2ssv.dll mRun: [LogitechQuickCamRibbon] "c:\program files\logitech\logitech webcam software\LWS.exe" /hide mRun: [High Definition Audio Property Page Shortcut] HDAudPropShortcut.exe mRun: [SoundMan] SOUNDMAN.EXE mRun: [AlcWzrd] ALCWZRD.EXE mRun: [Alcmtr] ALCMTR.EXE mRun: [AirPort Base Station Agent] "c:\program files\airport\APAgent.exe" mRun: [egui] "c:\program files\eset\eset nod32 antivirus\egui.exe" /hide /waitservice mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://www.apple.com/qtactivex/qtplugin.cab DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1169705253312 DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1240972999800 DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_02-windows-i586.cab DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab DPF: {CAFEEFAC-0017-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_02-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_02-windows-i586.cab TCP: DhcpNameServer = 192.168.2.1 TCP: Interfaces\{3927DF1E-CE09-4489-BA32-6E78017C63DC} : DhcpNameServer = 192.168.2.1 Notify: igfxcui - igfxsrvc.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SEH: {4F07DA45-8170-4859-9B5F-037EF2970034} - No File . ================= FIREFOX =================== . FF - ProfilePath - c:\documents and settings\owner\application data\mozilla\firefox\profiles\ihg2zc8p.default\ FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll FF - plugin: c:\program files\java\jre7\bin\new_plugin\npjp2.dll . ============= SERVICES / DRIVERS =============== . R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-3-31 64160] R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [2010-12-21 115008] R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2010-12-21 94872] R2 ekrn;ESET Service;c:\program files\eset\eset nod32 antivirus\ekrn.exe [2011-1-12 810144] R3 DLKRTS;D-Link DFE-530TX+ PCI Adapter;c:\windows\system32\drivers\DLKRTS.SYS [2005-9-7 45568] S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\googleupdate.exe /svc –> c:\program files\google\update\GoogleUpdate.exe [?] S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\googleupdate.exe /medsvc –> c:\program files\google\update\GoogleUpdate.exe [?] S3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\mozilla maintenance service\maintenanceservice.exe [2012-4-25 129976] S3 ZD1201U;ZyDAS ZD1201 IEEE 802.11b Wireless LAN Driver (USB);c:\windows\system32\drivers\ZD1201U.sys [2005-6-27 38656] S3 ZDNDIS5;ZDNDIS5 Protocol Driver;\??\c:\windows\system32\zdndis5.sys –> c:\windows\system32\ZDNDIS5.SYS [?] S4 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;"c:\program files\lavasoft\ad-aware\aawservice.exe" –> c:\program files\lavasoft\ad-aware\AAWService.exe [?] . =============== Created Last 30 ================ . 2012-04-28 16:48:03 ——– d—–w- c:\program files\ESET 2012-04-25 18:06:49 ——– d—–w- c:\program files\Mozilla Maintenance Service 2012-04-25 18:06:31 129976 —-a-w- c:\program files\mozilla firefox\maintenanceservice.exe 2012-04-25 18:06:30 157352 —-a-w- c:\program files\mozilla firefox\maintenanceservice_installer.exe 2012-04-12 03:03:10 ——– d—–w- c:\program files\AVAST Software 2012-04-12 03:03:10 ——– d—–w- c:\documents and settings\all users\application data\AVAST Software . ==================== Find3M ==================== . 2012-04-11 13:12:06 1862272 —-a-w- c:\windows\system32\win32k.sys 2012-04-11 13:10:58 2192640 —-a-w- c:\windows\system32\ntoskrnl.exe 2012-04-11 12:35:52 2069120 —-a-w- c:\windows\system32\ntkrnlpa.exe 2012-04-04 19:56:40 22344 —-a-w- c:\windows\system32\drivers\mbam.sys 2012-03-11 04:03:39 81920 -c–a-w- c:\windows\ALCFDRTM.VER 2012-03-11 04:03:39 81920 -c–a-w- c:\windows\ALCFDRTM.EXE 2012-02-29 14:10:16 177664 —-a-w- c:\windows\system32\wintrust.dll 2012-02-29 14:10:16 148480 —-a-w- c:\windows\system32\imagehlp.dll 2012-02-28 18:50:30 667136 —-a-w- c:\windows\system32\wininet.dll 2012-02-28 18:50:30 61952 —-a-w- c:\windows\system32\tdc.ocx 2012-02-28 18:50:29 81920 —-a-w- c:\windows\system32\ieencode.dll 2012-02-28 13:50:54 369664 —-a-w- c:\windows\system32\html.iec . ============= FINISH: 18:34:05.98 =============== UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2011-08-26.01) . Microsoft Windows XP Home Edition Boot Device: \Device\HarddiskVolume1 Install Date: 6/2/2005 9:35:40 PM System Uptime: 5/11/2012 6:15:50 PM (0 hours ago) . Motherboard: Intel Corporation | | D915GAG Processor: Intel® Pentium® 4 CPU 3.06GHz | | 3066/533mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 145 GiB total, 43.431 GiB free. D: is FIXED (FAT32) - 4 GiB total, 1.677 GiB free. E: is CDROM () F: is CDROM () H: is Removable I: is Removable J: is Removable K: is CDROM () L: is Removable . ==== Disabled Device Manager Items ============= . ==== System Restore Points =================== . No restore point in system. . ==== Installed Programs ====================== . AC3File (remove only) Adobe Download Manager Adobe Flash Player 10 ActiveX Adobe Flash Player 11 Plugin Adobe Photoshop 7.0.1 Adobe Reader 8.1.2 Adobe Shockwave Player 11.5 Adobe SVG Viewer 3.0 Advanced Video FX Utility AiO_Scan_CDA AirPort Apple Software Update AutoUpdate AVIcodec (remove only) Canon iP6310D Canon MP180 Canon MP250 series MP Drivers Compatibility Pack for the 2007 Office system CP_Package_Variety1 CP_Package_Variety2 CP_Package_Variety3 Creative WebCam Instant Driver (1.01.02.0729) Critical Update for Windows Media Player 11 (KB959772) Digital Media Reader DivX Codec DivX Content Uploader DivX Converter DivX Player DivX Web Player DocumentViewerQFolder Dr Watson for Microsoft Windows OneCare Live v1.1.1067.14 DVD Flick 1.3.0.7 ESET NOD32 Antivirus eSupportQFolder FullDPAppQFolder GdiplusUpgrade Get Yahoo! Messenger Google Update Helper High Definition Audio Driver Package - KB835221 HiJackThis HijackThis 1.99.1 Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595) Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484) Hotfix for Windows Media Format 11 SDK (KB929399) Hotfix for Windows Media Player 11 (KB939683) Hotfix for Windows XP (KB2158563) Hotfix for Windows XP (KB2443685) Hotfix for Windows XP (KB2570791) Hotfix for Windows XP (KB2633952) Hotfix for Windows XP (KB952287) Hotfix for Windows XP (KB954550-v5) Hotfix for Windows XP (KB961118) Hotfix for Windows XP (KB970653-v3) Hotfix for Windows XP (KB976098-v2) Hotfix for Windows XP (KB979306) Hotfix for Windows XP (KB981793) HP Multimedia Keyboard Driver V2.0.W-137A9 MUL HP Photosmart, Officejet and Deskjet 7.0.A ImagXpress ImgBurn Intel® Graphics Media Accelerator Driver Intel® PRO Network Adapters and Drivers Java Auto Updater Java™ 7 Update 2 Logitech High Quality Video Logitech Legacy USB Camera Driver Package Logitech Webcam Software Logitech Webcam Software Driver Package Malwarebytes Anti-Malware version 1.61.0.1400 Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Security Update (KB2656353) Microsoft .NET Framework 1.1 Security Update (KB2656370) Microsoft .NET Framework 1.1 Security Update (KB979906) Microsoft .NET Framework 2.0 Service Pack 2 Microsoft .NET Framework 3.0 Service Pack 2 Microsoft .NET Framework 3.5 SP1 Microsoft Application Error Reporting Microsoft Compression Client Pack 1.0 for Windows XP Microsoft IntelliPoint 5.2 Microsoft Internationalized Domain Names Mitigation APIs Microsoft Kernel-Mode Driver Framework Feature Pack 1.5 Microsoft National Language Support Downlevel APIs Microsoft Office 97, Professional Edition Microsoft User-Mode Driver Framework Feature Pack 1.0 Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022.218 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft Windows Media Video 9 VCM Mozilla Firefox 12.0 (x86 en-US) Mozilla Maintenance Service MSN MSN Music Assistant MSXML 4.0 SP2 (KB927978) MSXML 4.0 SP2 (KB936181) MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) MSXML 4.0 SP2 Parser and SDK Multimedia Keyboard Driver neroxml PowerDVD Realtek High Definition Audio Driver Rhapsody Player Engine Scan SecureVideo Plug-in Security Update for CAPICOM (KB931906) Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424) Security Update for Microsoft Windows (KB2564958) Security Update for Windows Media Player (KB2378111) Security Update for Windows Media Player (KB952069) Security Update for Windows Media Player (KB954155) Security Update for Windows Media Player (KB968816) Security Update for Windows Media Player (KB973540) Security Update for Windows Media Player (KB975558) Security Update for Windows Media Player (KB978695) Security Update for Windows Media Player 10 (KB917734) Security Update for Windows Media Player 11 (KB936782) Security Update for Windows Media Player 11 (KB954154) Security Update for Windows Media Player 6.4 (KB925398) Security Update for Windows XP (KB2079403) Security Update for Windows XP (KB2115168) Security Update for Windows XP (KB2121546) Security Update for Windows XP (KB2160329) Security Update for Windows XP (KB2183461) Security Update for Windows XP (KB2229593) Security Update for Windows XP (KB2259922) Security Update for Windows XP (KB2279986) Security Update for Windows XP (KB2286198) Security Update for Windows XP (KB2296011) Security Update for Windows XP (KB2296199) Security Update for Windows XP (KB2347290) Security Update for Windows XP (KB2360131) Security Update for Windows XP (KB2360937) Security Update for Windows XP (KB2387149) Security Update for Windows XP (KB2393802) Security Update for Windows XP (KB2412687) Security Update for Windows XP (KB2416400) Security Update for Windows XP (KB2419632) Security Update for Windows XP (KB2423089) Security Update for Windows XP (KB2436673) Security Update for Windows XP (KB2440591) Security Update for Windows XP (KB2443105) Security Update for Windows XP (KB2476490) Security Update for Windows XP (KB2476687) Security Update for Windows XP (KB2478960) Security Update for Windows XP (KB2478971) Security Update for Windows XP (KB2479628) Security Update for Windows XP (KB2479943) Security Update for Windows XP (KB2481109) Security Update for Windows XP (KB2482017) Security Update for Windows XP (KB2483185) Security Update for Windows XP (KB2485376) Security Update for Windows XP (KB2485663) Security Update for Windows XP (KB2497640) Security Update for Windows XP (KB2503658) Security Update for Windows XP (KB2503665) Security Update for Windows XP (KB2506212) Security Update for Windows XP (KB2506223) Security Update for Windows XP (KB2507618) Security Update for Windows XP (KB2507938) Security Update for Windows XP (KB2508272) Security Update for Windows XP (KB2508429) Security Update for Windows XP (KB2509553) Security Update for Windows XP (KB2510581) Security Update for Windows XP (KB2511455) Security Update for Windows XP (KB2524375) Security Update for Windows XP (KB2530548) Security Update for Windows XP (KB2535512) Security Update for Windows XP (KB2536276-v2) Security Update for Windows XP (KB2536276) Security Update for Windows XP (KB2544521) Security Update for Windows XP (KB2544893-v2) Security Update for Windows XP (KB2544893) Security Update for Windows XP (KB2555917) Security Update for Windows XP (KB2559049) Security Update for Windows XP (KB2562937) Security Update for Windows XP (KB2566454) Security Update for Windows XP (KB2567053) Security Update for Windows XP (KB2567680) Security Update for Windows XP (KB2570222) Security Update for Windows XP (KB2570947) Security Update for Windows XP (KB2584146) Security Update for Windows XP (KB2585542) Security Update for Windows XP (KB2586448) Security Update for Windows XP (KB2592799) Security Update for Windows XP (KB2598479) Security Update for Windows XP (KB2603381) Security Update for Windows XP (KB2618444) Security Update for Windows XP (KB2618451) Security Update for Windows XP (KB2619339) Security Update for Windows XP (KB2620712) Security Update for Windows XP (KB2621440) Security Update for Windows XP (KB2624667) Security Update for Windows XP (KB2631813) Security Update for Windows XP (KB2633171) Security Update for Windows XP (KB2639417) Security Update for Windows XP (KB2641653) Security Update for Windows XP (KB2646524) Security Update for Windows XP (KB2647516) Security Update for Windows XP (KB2647518) Security Update for Windows XP (KB2653956) Security Update for Windows XP (KB2660465) Security Update for Windows XP (KB2675157) Security Update for Windows XP (KB2676562) Security Update for Windows XP (KB923561) Security Update for Windows XP (KB938464-v2) Security Update for Windows XP (KB938464) Security Update for Windows XP (KB941569) Security Update for Windows XP (KB946648) Security Update for Windows XP (KB950759) Security Update for Windows XP (KB950760) Security Update for Windows XP (KB950762) Security Update for Windows XP (KB950974) Security Update for Windows XP (KB951066) Security Update for Windows XP (KB951376-v2) Security Update for Windows XP (KB951376) Security Update for Windows XP (KB951698) Security Update for Windows XP (KB951748) Security Update for Windows XP (KB952004) Security Update for Windows XP (KB952954) Security Update for Windows XP (KB953838) Security Update for Windows XP (KB953839) Security Update for Windows XP (KB954211) Security Update for Windows XP (KB954459) Security Update for Windows XP (KB954600) Security Update for Windows XP (KB955069) Security Update for Windows XP (KB956390) Security Update for Windows XP (KB956391) Security Update for Windows XP (KB956572) Security Update for Windows XP (KB956744) Security Update for Windows XP (KB956802) Security Update for Windows XP (KB956803) Security Update for Windows XP (KB956841) Security Update for Windows XP (KB956844) Security Update for Windows XP (KB957095) Security Update for Windows XP (KB957097) Security Update for Windows XP (KB958215) Security Update for Windows XP (KB958644) Security Update for Windows XP (KB958687) Security Update for Windows XP (KB958690) Security Update for Windows XP (KB958869) Security Update for Windows XP (KB959426) Security Update for Windows XP (KB960225) Security Update for Windows XP (KB960714) Security Update for Windows XP (KB960715) Security Update for Windows XP (KB960803) Security Update for Windows XP (KB960859) Security Update for Windows XP (KB961371) Security Update for Windows XP (KB961373) Security Update for Windows XP (KB961501) Security Update for Windows XP (KB963027) Security Update for Windows XP (KB968537) Security Update for Windows XP (KB969059) Security Update for Windows XP (KB969897) Security Update for Windows XP (KB969898) Security Update for Windows XP (KB969947) Security Update for Windows XP (KB970238) Security Update for Windows XP (KB970430) Security Update for Windows XP (KB971468) Security Update for Windows XP (KB971486) Security Update for Windows XP (KB971557) Security Update for Windows XP (KB971633) Security Update for Windows XP (KB971657) Security Update for Windows XP (KB971961) Security Update for Windows XP (KB972260) Security Update for Windows XP (KB972270) Security Update for Windows XP (KB973346) Security Update for Windows XP (KB973354) Security Update for Windows XP (KB973507) Security Update for Windows XP (KB973525) Security Update for Windows XP (KB973869) Security Update for Windows XP (KB973904) Security Update for Windows XP (KB974112) Security Update for Windows XP (KB974318) Security Update for Windows XP (KB974392) Security Update for Windows XP (KB974455) Security Update for Windows XP (KB974571) Security Update for Windows XP (KB975025) Security Update for Windows XP (KB975467) Security Update for Windows XP (KB975560) Security Update for Windows XP (KB975561) Security Update for Windows XP (KB975562) Security Update for Windows XP (KB975713) Security Update for Windows XP (KB976325) Security Update for Windows XP (KB977165) Security Update for Windows XP (KB977816) Security Update for Windows XP (KB977914) Security Update for Windows XP (KB978037) Security Update for Windows XP (KB978251) Security Update for Windows XP (KB978262) Security Update for Windows XP (KB978338) Security Update for Windows XP (KB978542) Security Update for Windows XP (KB978601) Security Update for Windows XP (KB978706) Security Update for Windows XP (KB979309) Security Update for Windows XP (KB979482) Security Update for Windows XP (KB979559) Security Update for Windows XP (KB979683) Security Update for Windows XP (KB979687) Security Update for Windows XP (KB980195) Security Update for Windows XP (KB980218) Security Update for Windows XP (KB980232) Security Update for Windows XP (KB980436) Security Update for Windows XP (KB981322) Security Update for Windows XP (KB981349) Security Update for Windows XP (KB981852) Security Update for Windows XP (KB981957) Security Update for Windows XP (KB981997) Security Update for Windows XP (KB982132) Security Update for Windows XP (KB982214) Security Update for Windows XP (KB982381) Security Update for Windows XP (KB982665) Security Update for Windows XP (KB982802) SoftV92 Data Fax Modem with SmartCP SolutionCenter Update for Microsoft .NET Framework 3.5 SP1 (KB963707) Update for Windows XP (KB2141007) Update for Windows XP (KB2345886) Update for Windows XP (KB2467659) Update for Windows XP (KB2541763) Update for Windows XP (KB2607712) Update for Windows XP (KB2616676-v2) Update for Windows XP (KB2641690) Update for Windows XP (KB951072-v2) Update for Windows XP (KB951978) Update for Windows XP (KB955759) Update for Windows XP (KB955839) Update for Windows XP (KB961503) Update for Windows XP (KB967715) Update for Windows XP (KB968389) Update for Windows XP (KB971029) Update for Windows XP (KB971737) Update for Windows XP (KB973687) Update for Windows XP (KB973815) Update for Windows XP (KB976749) Update for Windows XP (KB978207) Update for Windows XP (KB980182) Visual C++ 2008 x86 Runtime - (v9.0.30729) Visual C++ 2008 x86 Runtime - v9.0.30729.01 VLC media player 1.1.10 WebCam Instant Product Registration WebFldrs XP WebReg Windows Backup Utility Windows Genuine Advantage Notifications (KB905474) Windows Genuine Advantage v1.3.0254.0 Windows Imaging Component Windows Media Format 11 runtime Windows Media Player 11 Windows XP Service Pack 3 WinRAR archiver WinZip Yahoo! Messenger Yahoo! Software Update . ==== Event Viewer Messages From Past Week ======== . 5/9/2012 5:03:26 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: nvport 5/9/2012 5:03:26 PM, error: Service Control Manager [7000] - The Google Update Service (gupdate) service failed to start due to the following error: The system cannot find the file specified. 5/8/2012 10:30:14 PM, error: DCOM [10000] - Unable to start a DCOM Server: {4CB43D7F-7EEE-4906-8698-60DA1C38F2FE}. The error: "%2" Happened while starting this command: C:\WINDOWS\system32\DllHost.exe /Processid:{B366DEBE-645B-43A5-B865-DDD82C345492} 5/6/2012 8:10:43 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the stisvc service. 5/11/2012 4:40:11 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD ehdrv epfwtdir Fips intelppm IPSec MRxSmb NetBIOS NetBT nvport RasAcd Rdbss Tcpip Tcpip6 WS2IFSL 5/11/2012 4:40:11 PM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error: A device attached to the system is not functioning. 5/11/2012 4:40:11 PM, error: Service Control Manager [7001] - The IPv6 Helper Service service depends on the Microsoft IPv6 Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning. 5/11/2012 4:40:11 PM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning. 5/11/2012 4:40:11 PM, error: Service Control Manager [7001] - The IP Traffic Filter Driver service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning. 5/11/2012 4:40:11 PM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning. 5/11/2012 4:40:11 PM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning. 5/11/2012 4:39:33 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF} 5/11/2012 4:39:23 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E} 5/11/2012 1:49:22 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: abp480n5 adpu160m agp440 agpCPQ Aha154x aic78u2 aic78xx AliIde alim1541 amdagp amsint asc asc3350p asc3550 cbidf cd20xrnt CmdIde Cpqarray dac2w2k dac960nt dpti2o hpn i2omp ini910u IntelIde mraid35x nvport perc2 perc2hib ql1080 Ql10wnt ql12160 ql1240 ql1280 sisagp Sparrow symc810 symc8xx sym_hi sym_u3 TosIde ultra viaagp ViaIde . ==== End Of File ===========================

Thank you so much for your help. Here are the logs:

ER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2012-05-12 16:54:07
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-17 WDC_WD1600JD-22HBB0 rev.08.02D08
Running: gmer.exe; Driver: C:\DOCUME~1\Owner\LOCALS~1\Temp\pxtdrpob.sys


—- System - GMER 1.0.15 —-

SSDT \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET) ZwAssignProcessToJobObject [0xAA2B1610]
SSDT Lbd.sys (Boot Driver/Lavasoft AB) ZwCreateKey [0xF764E87E]
SSDT \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET) ZwDebugActiveProcess [0xAA2B1C10]
SSDT \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET) ZwDuplicateObject [0xAA2B1730]
SSDT \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET) ZwOpenProcess [0xAA2B14B0]
SSDT \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET) ZwOpenThread [0xAA2B1570]
SSDT \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET) ZwProtectVirtualMemory [0xAA2B16D0]
SSDT \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET) ZwQueueApcThread [0xAA2B1790]
SSDT \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET) ZwSetContextThread [0xAA2B1690]
SSDT \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET) ZwSetInformationThread [0xAA2B1650]
SSDT \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET) ZwSetSecurityObject [0xAA2B17D0]
SSDT Lbd.sys (Boot Driver/Lavasoft AB) ZwSetValueKey [0xF764EC10]
SSDT \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET) ZwSuspendProcess [0xAA2B1510]
SSDT \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET) ZwSuspendThread [0xAA2B1590]
SSDT \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET) ZwTerminateProcess [0xAA2B14D0]
SSDT \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET) ZwTerminateThread [0xAA2B15D0]
SSDT \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET) ZwWriteVirtualMemory [0xAA2B1750]

—- Kernel code sections - GMER 1.0.15 —-

.text ntkrnlpa.exe!ZwCallbackReturn + 2420 80501C30 4 Bytes [7E, E8, 64, F7]
init C:\WINDOWS\System32\Drivers\sunkfilt39.sys entry point in "init" section [0xF78DE360]

—- User code sections - GMER 1.0.15 —-

.text C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[1484] kernel32.dll!SetUnhandledExceptionFilter 7C84495D 4 Bytes [C2, 04, 00, 00]

—- Devices - GMER 1.0.15 —-

AttachedDevice \FileSystem\Ntfs \Ntfs eamon.sys (Amon monitor/ESET)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 Maestro1.sys (KeyMaestro Sys for Windows NT, 2000, .../BTC)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 Maestro1.sys (KeyMaestro Sys for Windows NT, 2000, .../BTC)
AttachedDevice \Driver\Tcpip \Device\Tcp epfwtdir.sys (ESET Antivirus Network Redirector/ESET)
AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\Fastfat \Fat eamon.sys (Amon monitor/ESET)

—- Registry - GMER 1.0.15 —-

Reg HKLM\SOFTWARE\Classes\CLSID\{A40F8BBE-77CD-78A3-DF6D-3C14B7105899}\InprocServer32@ C:\Program Files\Movie Maker\wmm2filt.dll
Reg HKLM\SOFTWARE\Classes\CLSID\{A40F8BBE-77CD-78A3-DF6D-3C14B7105899}\InprocServer32@ThreadingModel Both

—- EOF - GMER 1.0.15 —-



aswMBR version 0.9.9.1532 Copyright© 2011 AVAST Software
Run date: 2012-05-12 16:57:08
—————————–
16:57:08.500 OS Version: Windows 5.1.2600 Service Pack 3
16:57:08.500 Number of processors: 1 586 0x401
16:57:08.500 ComputerName: RYAN UserName:
16:57:08.937 Initialize success
17:00:06.187 AVAST engine defs: 12051201
17:00:49.343 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-17
17:00:49.343 Disk 0 Vendor: WDC_WD1600JD-22HBB0 08.02D08 Size: 152627MB BusType: 3
17:00:49.375 Disk 0 MBR read successfully
17:00:49.375 Disk 0 MBR scan
17:00:49.546 Disk 0 unknown MBR code
17:00:49.578 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 148311 MB offset 8835750
17:00:49.593 Disk 0 Partition 2 00 0B FAT32 RECOVERY 4314 MB offset 63
17:00:49.640 Disk 0 scanning sectors +312576705
17:00:49.828 Disk 0 scanning C:\WINDOWS\system32\drivers
17:01:35.500 Service scanning
17:01:36.968 Modules scanning
17:02:08.296 Disk 0 trace - called modules:
17:02:08.328 ntkrnlpa.exe CLASSPNP.SYS disk.sys atapi.sys hal.dll pciide.sys PCIIDEX.SYS
17:02:08.703 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x85f8f7a8]
17:02:08.718 3 CLASSPNP.SYS[f763efd7] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP1T0L0-17[0x85fa6030]
17:02:09.125 AVAST engine scan C:\WINDOWS
17:02:48.328 AVAST engine scan C:\WINDOWS\system32
17:08:33.890 AVAST engine scan C:\WINDOWS\system32\drivers
17:09:25.609 AVAST engine scan C:\Documents and Settings\Owner
17:11:46.343 File: C:\Documents and Settings\Owner\Local Settings\Application Data\Apple Computer\Adobe\uwcytciv.dll **INFECTED** Win32:Sefnit-GU [Drp]
17:12:54.718 File: C:\Documents and Settings\Owner\Local Settings\temp\nsk10FF.tmp\uwcytciv.dll **INFECTED** Win32:Sefnit-GU [Drp]
17:14:54.484 AVAST engine scan C:\Documents and Settings\All Users
17:16:01.875 Scan finished successfully
19:29:47.218 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Owner\Desktop\MBR.dat"
19:29:47.546 The log file has been saved successfully to "C:\Documents and Settings\Owner\Desktop\aswMBR.txt"

Hello jockster789

Thank you for the logs.

If you use this machine for any kind of financial transactions please go to an uninfected system and change all of your passwords.

• Please create a System Restore point
  
  
  
  • Click on "Start" > "All Programs" > "Accessories" > "System tools" > "System Restore".
  • In the dialogue box that appears select "Create a Restore Point".
  • Click "Next".
  • Enter a name
  • e.g. Todays date.
  • Click "Create".
  
  
• TDSS Killer
  
  
  
  • Please read carefully and follow these steps.
  • Download TDSSKiller and save it to your Desktop.
  • Extract its contents to your desktop.
  • Once extracted, open the TDSSKiller folder and Right click on TDSSKiller.exe and select "Run as Administrator" to run the application.
  • When the window opens, click on Change Parameters.
  • Under ”Additional options”, put a check mark in the box next to “Detect TDLFS File System”.
  • Click on Start Scan.
  • If an infected file is detected, the default action will be Cure, click on Continue.
  • If a suspicious file is detected, the default action will be Skip, click on Continue.
  • It may ask you to reboot the computer to complete the process. Click on Reboot Now.
  • If no reboot is required, click on Report. A log file should appear. Please copy and paste the contents of that file here.
  • If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.
  
  
• Combofix
  
  
  
  • Download ComboFix from one of the following locations:
    
    Link 1
    Link 2
  
  
  • VERY IMPORTANT !!! Save ComboFix.exe to your Desktop
  
  
  • IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here .
  • Double click on ComboFix.exe & follow the prompts.
  
  
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
  • Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.
  
  [external image: Posted Image]
  
  
  • Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
  
  [external image: Posted Image]
  
  
  • Click on Yes, to continue scanning for malware.
  • When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
  • Notes: Do not mouse-click Combofix's window while it is running. That may cause it to stall.
  • Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
  • Should there be issues with internet afterward:
    
    In IE: Tools Menu -> Internet Options -> Connections Tab -> Lan Settings -> uncheck "use a proxy server" or reconfigure the Proxy server again in case you have set it previously.
    
    In Firefox: Tools Menu -> Options… -> Advanced Tab -> Network Tab -> "Settings" under Connection and uncheck the proxyserver, set it to No Proxy.
  
  Please post the TDSSKiller log and the Combofix log in your next reply.

Ok Thanks.

Here are the logs. Combofix stalled three straight times in a row so I had to run it in Safe Mode.

Also, Was I supposed to go ahead and set Firefox to No Proxy? I did.


14:07:13.0984 3180 TDSS rootkit removing tool 2.7.34.0 May 2 2012 09:59:18
14:07:14.0656 3180 ============================================================
14:07:14.0656 3180 Current date / time: 2012/05/13 14:07:14.0656
14:07:14.0656 3180 SystemInfo:
14:07:14.0656 3180
14:07:14.0656 3180 OS Version: 5.1.2600 ServicePack: 3.0
14:07:14.0656 3180 Product type: Workstation
14:07:14.0656 3180 ComputerName: RYAN
14:07:14.0656 3180 UserName: Owner
14:07:14.0656 3180 Windows directory: C:\WINDOWS
14:07:14.0656 3180 System windows directory: C:\WINDOWS
14:07:14.0656 3180 Processor architecture: Intel x86
14:07:14.0656 3180 Number of processors: 1
14:07:14.0656 3180 Page size: 0x1000
14:07:14.0656 3180 Boot type: Normal boot
14:07:14.0656 3180 ============================================================
14:07:17.0953 3180 Drive \Device\Harddisk0\DR0 - Size: 0x25433D6000 (149.05 Gb), SectorSize: 0x200, Cylinders: 0x4C01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054
14:07:18.0078 3180 ============================================================
14:07:18.0078 3180 \Device\Harddisk0\DR0:
14:07:18.0078 3180 MBR partitions:
14:07:18.0078 3180 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x86D2A6, BlocksNum 0x121AB81B
14:07:18.0078 3180 \Device\Harddisk0\DR0\Partition1: MBR, Type 0xB, StartLBA 0x3F, BlocksNum 0x86D267
14:07:18.0078 3180 ============================================================
14:07:18.0125 3180 C: <-> \Device\Harddisk0\DR0\Partition0
14:07:18.0125 3180 D: <-> \Device\Harddisk0\DR0\Partition1
14:07:18.0125 3180 ============================================================
14:07:18.0125 3180 Initialize success
14:07:18.0125 3180 ============================================================
14:08:10.0093 2620 ============================================================
14:08:10.0093 2620 Scan started
14:08:10.0093 2620 Mode: Manual; TDLFS;
14:08:10.0093 2620 ============================================================
14:08:10.0437 2620 6to4 (c07d5197410aab28d0d93f943f59656d) C:\WINDOWS\System32\6to4svc.dll
14:08:10.0437 2620 6to4 - ok
14:08:10.0500 2620 Abiosdsk - ok
14:08:10.0515 2620 abp480n5 (6abb91494fe6c59089b9336452ab2ea3) C:\WINDOWS\system32\DRIVERS\ABP480N5.SYS
14:08:10.0531 2620 abp480n5 - ok
14:08:10.0578 2620 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys
14:08:10.0609 2620 ACPI - ok
14:08:10.0640 2620 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys
14:08:10.0671 2620 ACPIEC - ok
14:08:10.0781 2620 Adobe LM Service (8b46d5a1d3ef08232c04d0eafb871fb2) C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
14:08:10.0781 2620 Adobe LM Service - ok
14:08:10.0796 2620 adpu160m (9a11864873da202c996558b2106b0bbc) C:\WINDOWS\system32\DRIVERS\adpu160m.sys
14:08:10.0828 2620 adpu160m - ok
14:08:10.0843 2620 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
14:08:10.0875 2620 aec - ok
14:08:10.0921 2620 AFD (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys
14:08:10.0937 2620 AFD - ok
14:08:10.0984 2620 agp440 (08fd04aa961bdc77fb983f328334e3d7) C:\WINDOWS\system32\DRIVERS\agp440.sys
14:08:11.0000 2620 agp440 - ok
14:08:11.0015 2620 agpCPQ (03a7e0922acfe1b07d5db2eeb0773063) C:\WINDOWS\system32\DRIVERS\agpCPQ.sys
14:08:11.0031 2620 agpCPQ - ok
14:08:11.0046 2620 Aha154x (c23ea9b5f46c7f7910db3eab648ff013) C:\WINDOWS\system32\DRIVERS\aha154x.sys
14:08:11.0062 2620 Aha154x - ok
14:08:11.0078 2620 aic78u2 (19dd0fb48b0c18892f70e2e7d61a1529) C:\WINDOWS\system32\DRIVERS\aic78u2.sys
14:08:11.0093 2620 aic78u2 - ok
14:08:11.0109 2620 aic78xx (b7fe594a7468aa0132deb03fb8e34326) C:\WINDOWS\system32\DRIVERS\aic78xx.sys
14:08:11.0125 2620 aic78xx - ok
14:08:11.0156 2620 Alerter (a9a3daa780ca6c9671a19d52456705b4) C:\WINDOWS\system32\alrsvc.dll
14:08:11.0156 2620 Alerter - ok
14:08:11.0187 2620 ALG (8c515081584a38aa007909cd02020b3d) C:\WINDOWS\System32\alg.exe
14:08:11.0187 2620 ALG - ok
14:08:11.0203 2620 AliIde (1140ab9938809700b46bb88e46d72a96) C:\WINDOWS\system32\DRIVERS\aliide.sys
14:08:11.0218 2620 AliIde - ok
14:08:11.0234 2620 alim1541 (cb08aed0de2dd889a8a820cd8082d83c) C:\WINDOWS\system32\DRIVERS\alim1541.sys
14:08:11.0250 2620 alim1541 - ok
14:08:11.0265 2620 amdagp (95b4fb835e28aa1336ceeb07fd5b9398) C:\WINDOWS\system32\DRIVERS\amdagp.sys
14:08:11.0281 2620 amdagp - ok
14:08:11.0296 2620 amsint (79f5add8d24bd6893f2903a3e2f3fad6) C:\WINDOWS\system32\DRIVERS\amsint.sys
14:08:11.0312 2620 amsint - ok
14:08:11.0328 2620 AppMgmt - ok
14:08:11.0359 2620 Arp1394 (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
14:08:11.0375 2620 Arp1394 - ok
14:08:11.0390 2620 asc (62d318e9a0c8fc9b780008e724283707) C:\WINDOWS\system32\DRIVERS\asc.sys
14:08:11.0421 2620 asc - ok
14:08:11.0437 2620 asc3350p (69eb0cc7714b32896ccbfd5edcbea447) C:\WINDOWS\system32\DRIVERS\asc3350p.sys
14:08:11.0453 2620 asc3350p - ok
14:08:11.0453 2620 asc3550 (5d8de112aa0254b907861e9e9c31d597) C:\WINDOWS\system32\DRIVERS\asc3550.sys
14:08:11.0484 2620 asc3550 - ok
14:08:11.0609 2620 aspnet_state (0e5e4957549056e2bf2c49f4f6b601ad) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
14:08:11.0625 2620 aspnet_state - ok
14:08:11.0656 2620 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
14:08:11.0671 2620 AsyncMac - ok
14:08:11.0703 2620 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
14:08:11.0703 2620 atapi - ok
14:08:11.0703 2620 Atdisk - ok
14:08:11.0734 2620 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
14:08:11.0765 2620 Atmarpc - ok
14:08:11.0812 2620 AudioSrv (def7a7882bec100fe0b2ce2549188f9d) C:\WINDOWS\System32\audiosrv.dll
14:08:11.0812 2620 AudioSrv - ok
14:08:11.0828 2620 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
14:08:11.0859 2620 audstub - ok
14:08:11.0875 2620 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
14:08:11.0890 2620 Beep - ok
14:08:11.0921 2620 BITS (574738f61fca2935f5265dc4e5691314) C:\WINDOWS\system32\qmgr.dll
14:08:12.0078 2620 BITS - ok
14:08:12.0109 2620 Browser (a06ce3399d16db864f55faeb1f1927a9) C:\WINDOWS\System32\browser.dll
14:08:12.0125 2620 Browser - ok
14:08:12.0265 2620 catchme - ok
14:08:12.0312 2620 cbidf (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\DRIVERS\cbidf2k.sys
14:08:12.0343 2620 cbidf - ok
14:08:12.0343 2620 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
14:08:12.0343 2620 cbidf2k - ok
14:08:12.0390 2620 CCDECODE (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
14:08:12.0421 2620 CCDECODE - ok
14:08:12.0421 2620 cd20xrnt (f3ec03299634490e97bbce94cd2954c7) C:\WINDOWS\system32\DRIVERS\cd20xrnt.sys
14:08:12.0453 2620 cd20xrnt - ok
14:08:12.0468 2620 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
14:08:12.0484 2620 Cdaudio - ok
14:08:12.0515 2620 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
14:08:12.0546 2620 Cdfs - ok
14:08:12.0593 2620 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
14:08:12.0609 2620 Cdrom - ok
14:08:12.0625 2620 Changer - ok
14:08:12.0687 2620 CiSvc (1cfe720eb8d93a7158a4ebc3ab178bde) C:\WINDOWS\system32\cisvc.exe
14:08:12.0687 2620 CiSvc - ok
14:08:12.0734 2620 ClipSrv (34cbe729f38138217f9c80212a2a0c82) C:\WINDOWS\system32\clipsrv.exe
14:08:12.0734 2620 ClipSrv - ok
14:08:12.0765 2620 clr_optimization_v2.0.50727_32 (d87acaed61e417bba546ced5e7e36d9c) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
14:08:12.0968 2620 clr_optimization_v2.0.50727_32 - ok
14:08:12.0984 2620 CmdIde (e5dcb56c533014ecbc556a8357c929d5) C:\WINDOWS\system32\DRIVERS\cmdide.sys
14:08:13.0000 2620 CmdIde - ok
14:08:13.0000 2620 COMSysApp - ok
14:08:13.0031 2620 Cpqarray (3ee529119eed34cd212a215e8c40d4b6) C:\WINDOWS\system32\DRIVERS\cpqarray.sys
14:08:13.0046 2620 Cpqarray - ok
14:08:13.0078 2620 CryptSvc (3d4e199942e29207970e04315d02ad3b) C:\WINDOWS\System32\cryptsvc.dll
14:08:13.0078 2620 CryptSvc - ok
14:08:13.0156 2620 dac2w2k (e550e7418984b65a78299d248f0a7f36) C:\WINDOWS\system32\DRIVERS\dac2w2k.sys
14:08:13.0171 2620 dac2w2k - ok
14:08:13.0187 2620 dac960nt (683789caa3864eb46125ae86ff677d34) C:\WINDOWS\system32\DRIVERS\dac960nt.sys
14:08:13.0203 2620 dac960nt - ok
14:08:13.0265 2620 DcomLaunch (6b27a5c03dfb94b4245739065431322c) C:\WINDOWS\system32\rpcss.dll
14:08:13.0296 2620 DcomLaunch - ok
14:08:13.0343 2620 Dhcp (5e38d7684a49cacfb752b046357e0589) C:\WINDOWS\System32\dhcpcsvc.dll
14:08:13.0359 2620 Dhcp - ok
14:08:13.0390 2620 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
14:08:13.0406 2620 Disk - ok
14:08:13.0453 2620 DLKRTS (93be41e734ee36bfe71262fc8d684a86) C:\WINDOWS\system32\DRIVERS\DLKRTS.SYS
14:08:13.0484 2620 DLKRTS - ok
14:08:13.0484 2620 dmadmin - ok
14:08:13.0531 2620 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys
14:08:13.0562 2620 dmboot - ok
14:08:13.0609 2620 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys
14:08:13.0625 2620 dmio - ok
14:08:13.0640 2620 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
14:08:13.0656 2620 dmload - ok
14:08:13.0671 2620 dmserver (57edec2e5f59f0335e92f35184bc8631) C:\WINDOWS\System32\dmserver.dll
14:08:13.0671 2620 dmserver - ok
14:08:13.0718 2620 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
14:08:13.0718 2620 DMusic - ok
14:08:13.0765 2620 Dnscache (5f7e24fa9eab896051ffb87f840730d2) C:\WINDOWS\System32\dnsrslvr.dll
14:08:13.0765 2620 Dnscache - ok
14:08:13.0828 2620 Dot3svc (0f0f6e687e5e15579ef4da8dd6945814) C:\WINDOWS\System32\dot3svc.dll
14:08:13.0828 2620 Dot3svc - ok
14:08:13.0843 2620 dpti2o (40f3b93b4e5b0126f2f5c0a7a5e22660) C:\WINDOWS\system32\DRIVERS\dpti2o.sys
14:08:13.0859 2620 dpti2o - ok
14:08:13.0875 2620 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
14:08:13.0890 2620 drmkaud - ok
14:08:13.0937 2620 E100B (7d91dc6342248369f94d6eba0cf42e99) C:\WINDOWS\system32\DRIVERS\e100b325.sys
14:08:13.0968 2620 E100B - ok
14:08:14.0031 2620 eamon (d42dd9021acd47683b33adf21bca49aa) C:\WINDOWS\system32\DRIVERS\eamon.sys
14:08:14.0046 2620 eamon - ok
14:08:14.0078 2620 EapHost (2187855a7703adef0cef9ee4285182cc) C:\WINDOWS\System32\eapsvc.dll
14:08:14.0093 2620 EapHost - ok
14:08:14.0125 2620 ehdrv (fe7824239d132ad9ebd8645fe1199b30) C:\WINDOWS\system32\DRIVERS\ehdrv.sys
14:08:14.0156 2620 ehdrv - ok
14:08:14.0250 2620 EhttpSrv (68d91a34ce51cf15c45dd68f7f1257e8) C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
14:08:14.0250 2620 EhttpSrv - ok
14:08:14.0312 2620 ekrn (191d8eccc40f05b52fac0513f35ba01d) C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
14:08:14.0359 2620 ekrn - ok
14:08:14.0375 2620 epfwtdir (aa0667eb9a92414abb784c101a6c7fec) C:\WINDOWS\system32\DRIVERS\epfwtdir.sys
14:08:14.0406 2620 epfwtdir - ok
14:08:14.0453 2620 ERSvc (bc93b4a066477954555966d77fec9ecb) C:\WINDOWS\System32\ersvc.dll
14:08:14.0453 2620 ERSvc - ok
14:08:14.0515 2620 Eventlog (65df52f5b8b6e9bbd183505225c37315) C:\WINDOWS\system32\services.exe
14:08:14.0515 2620 Eventlog - ok
14:08:14.0562 2620 EventSystem (d4991d98f2db73c60d042f1aef79efae) C:\WINDOWS\system32\es.dll
14:08:14.0562 2620 EventSystem - ok
14:08:14.0593 2620 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
14:08:14.0625 2620 Fastfat - ok
14:08:14.0671 2620 FastUserSwitchingCompatibility (99bc0b50f511924348be19c7c7313bbf) C:\WINDOWS\System32\shsvcs.dll
14:08:14.0703 2620 FastUserSwitchingCompatibility - ok
14:08:14.0734 2620 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys
14:08:14.0750 2620 Fdc - ok
14:08:14.0796 2620 FilterService (a75ddc492d2d1d6558ad8003a4adb73a) C:\WINDOWS\system32\DRIVERS\lvuvcflt.sys
14:08:14.0828 2620 FilterService - ok
14:08:14.0828 2620 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys
14:08:14.0859 2620 Fips - ok
14:08:14.0859 2620 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
14:08:14.0875 2620 Flpydisk - ok
14:08:14.0890 2620 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
14:08:14.0921 2620 FltMgr - ok
14:08:15.0015 2620 FontCache3.0.0.0 (8ba7c024070f2b7fdd98ed8a4ba41789) c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
14:08:15.0015 2620 FontCache3.0.0.0 - ok
14:08:15.0062 2620 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
14:08:15.0078 2620 Fs_Rec - ok
14:08:15.0093 2620 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
14:08:15.0109 2620 Ftdisk - ok
14:08:15.0171 2620 GEARAspiWDM (6f55305289a0765bd8ae8e8d32f17117) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
14:08:15.0187 2620 GEARAspiWDM - ok
14:08:15.0250 2620 getPlusHelper (0879dc7444a201df84e69c5dd5083d61) C:\Program Files\NOS\bin\getPlus_Helper.dll
14:08:15.0265 2620 getPlusHelper - ok
14:08:15.0281 2620 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
14:08:15.0312 2620 Gpc - ok
14:08:15.0343 2620 gupdate - ok
14:08:15.0343 2620 gupdatem - ok
14:08:15.0390 2620 HdAudAddService (160b24fd894e79e71c983ea403a6e6e7) C:\WINDOWS\system32\drivers\HdAudio.sys
14:08:15.0406 2620 HdAudAddService - ok
14:08:15.0421 2620 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
14:08:15.0453 2620 HDAudBus - ok
14:08:15.0515 2620 helpsvc (4fcca060dfe0c51a09dd5c3843888bcd) C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
14:08:15.0515 2620 helpsvc - ok
14:08:15.0546 2620 HidServ (deb04da35cc871b6d309b77e1443c796) C:\WINDOWS\System32\hidserv.dll
14:08:15.0546 2620 HidServ - ok
14:08:15.0578 2620 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
14:08:15.0609 2620 HidUsb - ok
14:08:15.0640 2620 hkmsvc (8878bd685e490239777bfe51320b88e9) C:\WINDOWS\System32\kmsvc.dll
14:08:15.0656 2620 hkmsvc - ok
14:08:15.0765 2620 HP Port Resolver (c5f00d15aa15cb7f55a027ff75e44bb7) C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE
14:08:15.0765 2620 HP Port Resolver - ok
14:08:15.0781 2620 HP Status Server (c5a288e4ceef5a26d105117baa3763ab) C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE
14:08:15.0781 2620 HP Status Server - ok
14:08:15.0828 2620 hpn (b028377dea0546a5fcfba928a8aefae0) C:\WINDOWS\system32\DRIVERS\hpn.sys
14:08:15.0859 2620 hpn - ok
14:08:15.0875 2620 HPZid412 (30ca91e657cede2f95359d6ef186f650) C:\WINDOWS\system32\DRIVERS\HPZid412.sys
14:08:15.0890 2620 HPZid412 - ok
14:08:15.0906 2620 HPZipr12 (efd31afa752aa7c7bbb57bcbe2b01c78) C:\WINDOWS\system32\DRIVERS\HPZipr12.sys
14:08:15.0921 2620 HPZipr12 - ok
14:08:15.0968 2620 HPZius12 (7ac43c38ca8fd7ed0b0a4466f753e06e) C:\WINDOWS\system32\DRIVERS\HPZius12.sys
14:08:15.0984 2620 HPZius12 - ok
14:08:16.0015 2620 HSFHWBS2 (33dfc0afa95f9a2c753ff2adb7d4a21f) C:\WINDOWS\system32\DRIVERS\HSFHWBS2.sys
14:08:16.0031 2620 HSFHWBS2 - ok
14:08:16.0078 2620 HSF_DP (b2dfc168d6f7512faea085253c5a37ad) C:\WINDOWS\system32\DRIVERS\HSF_DP.sys
14:08:16.0140 2620 HSF_DP - ok
14:08:16.0203 2620 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
14:08:16.0250 2620 HTTP - ok
14:08:16.0281 2620 HTTPFilter (6100a808600f44d999cebdef8841c7a3) C:\WINDOWS\System32\w3ssl.dll
14:08:16.0281 2620 HTTPFilter - ok
14:08:16.0312 2620 i2omgmt (9368670bd426ebea5e8b18a62416ec28) C:\WINDOWS\system32\drivers\i2omgmt.sys
14:08:16.0343 2620 i2omgmt - ok
14:08:16.0343 2620 i2omp (f10863bf1ccc290babd1a09188ae49e0) C:\WINDOWS\system32\DRIVERS\i2omp.sys
14:08:16.0375 2620 i2omp - ok
14:08:16.0406 2620 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
14:08:16.0468 2620 i8042prt - ok
14:08:16.0531 2620 ialm (0acebb31989cbf9a5663fe4a33d28d21) C:\WINDOWS\system32\DRIVERS\ialmnt5.sys
14:08:16.0593 2620 ialm - ok
14:08:16.0625 2620 ICAM5USB (0a8a464d0dfd3257b72792248b44fc93) C:\WINDOWS\system32\Drivers\Icam5USB.sys
14:08:16.0640 2620 ICAM5USB - ok
14:08:16.0734 2620 IDriverT (1cf03c69b49acb70c722df92755c0c8c) C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
14:08:16.0750 2620 IDriverT - ok
14:08:16.0890 2620 idsvc (c01ac32dc5c03076cfb852cb5da5229c) c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
14:08:16.0937 2620 idsvc - ok
14:08:16.0953 2620 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
14:08:16.0984 2620 Imapi - ok
14:08:17.0031 2620 ImapiService (30deaf54a9755bb8546168cfe8a6b5e1) C:\WINDOWS\system32\imapi.exe
14:08:17.0031 2620 ImapiService - ok
14:08:17.0078 2620 ini910u (4a40e045faee58631fd8d91afc620719) C:\WINDOWS\system32\DRIVERS\ini910u.sys
14:08:17.0109 2620 ini910u - ok
14:08:17.0296 2620 IntcAzAudAddService (a30685283f90ae02f1cd50972c6065e3) C:\WINDOWS\system32\drivers\RtkHDAud.sys
14:08:17.0484 2620 IntcAzAudAddService - ok
14:08:17.0625 2620 IntelIde (b5466a9250342a7aa0cd1fba13420678) C:\WINDOWS\system32\DRIVERS\intelide.sys
14:08:17.0640 2620 IntelIde - ok
14:08:17.0656 2620 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys
14:08:17.0687 2620 intelppm - ok
14:08:17.0734 2620 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
14:08:17.0765 2620 Ip6Fw - ok
14:08:17.0796 2620 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
14:08:17.0843 2620 IpFilterDriver - ok
14:08:17.0875 2620 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
14:08:17.0890 2620 IpInIp - ok
14:08:17.0906 2620 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
14:08:17.0937 2620 IpNat - ok
14:08:17.0953 2620 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
14:08:17.0968 2620 IPSec - ok
14:08:17.0984 2620 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
14:08:18.0000 2620 IRENUM - ok
14:08:18.0015 2620 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys
14:08:18.0046 2620 isapnp - ok
14:08:18.0078 2620 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
14:08:18.0109 2620 Kbdclass - ok
14:08:18.0140 2620 KeyMaestro (9cd7dc0710a3d3137e3ce9ebd807656c) C:\WINDOWS\system32\DRIVERS\Maestro1.sys
14:08:18.0140 2620 KeyMaestro - ok
14:08:18.0171 2620 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
14:08:18.0171 2620 kmixer - ok
14:08:18.0218 2620 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
14:08:18.0234 2620 KSecDD - ok
14:08:18.0250 2620 L8042Kbd (d1968dea7baff4a917858c384339cec8) C:\WINDOWS\system32\DRIVERS\L8042Kbd.sys
14:08:18.0250 2620 L8042Kbd - ok
14:08:18.0281 2620 L8042mou (d6fc755ff505d99e6cc73e83492310df) C:\WINDOWS\system32\DRIVERS\L8042mou.Sys
14:08:18.0281 2620 L8042mou - ok
14:08:18.0343 2620 lanmanserver (3a7c3cbe5d96b8ae96ce81f0b22fb527) C:\WINDOWS\System32\srvsvc.dll
14:08:18.0343 2620 lanmanserver - ok
14:08:18.0406 2620 lanmanworkstation (a8888a5327621856c0cec4e385f69309) C:\WINDOWS\System32\wkssvc.dll
14:08:18.0406 2620 lanmanworkstation - ok
14:08:18.0453 2620 Lavasoft Ad-Aware Service - ok
14:08:18.0484 2620 Lbd (52320254d74ea11b6f129e7df1016975) C:\WINDOWS\system32\DRIVERS\Lbd.sys
14:08:18.0500 2620 Lbd - ok
14:08:18.0500 2620 lbrtfdc - ok
14:08:18.0546 2620 LHidFilt (c91206ca84684057118265e8377c77b6) C:\WINDOWS\system32\DRIVERS\LHidFilt.Sys
14:08:18.0562 2620 LHidFilt - ok
14:08:18.0593 2620 LmHosts (a7db739ae99a796d91580147e919cc59) C:\WINDOWS\System32\lmhsvc.dll
14:08:18.0609 2620 LmHosts - ok
14:08:18.0609 2620 LMouFilt (9f03720fa5e6d14cd4dfea610f2c1a7c) C:\WINDOWS\system32\DRIVERS\LMouFilt.Sys
14:08:18.0625 2620 LMouFilt - ok
14:08:18.0640 2620 LMouKE (c149bdad13194df16ea33f9f601ed7bf) C:\WINDOWS\system32\DRIVERS\LMouKE.Sys
14:08:18.0671 2620 LMouKE - ok
14:08:18.0703 2620 LUsbFilt (9bc5a8f08cc4770c95f9c55d992de929) C:\WINDOWS\system32\Drivers\LUsbFilt.Sys
14:08:18.0718 2620 LUsbFilt - ok
14:08:18.0734 2620 LVcKap - ok
14:08:18.0734 2620 LVMVDrv - ok
14:08:18.0781 2620 lvpopflt (01f0e010acb61472163e9d02d3ff531a) C:\WINDOWS\system32\DRIVERS\lvpopflt.sys
14:08:18.0812 2620 lvpopflt - ok
14:08:18.0828 2620 LVPr2Mon (c57c48fb9ae3efb9848af594e3123a63) C:\WINDOWS\system32\Drivers\LVPr2Mon.sys
14:08:18.0828 2620 LVPr2Mon - ok
14:08:18.0859 2620 LVPrcSrv (5c7b88695ce461d8bda4fe0c0e57e71d) C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
14:08:18.0859 2620 LVPrcSrv - ok
14:08:18.0921 2620 LVRS (87ecce893d8aec5a9337b917742d339c) C:\WINDOWS\system32\DRIVERS\lvrs.sys
14:08:18.0921 2620 LVRS - ok
14:08:18.0968 2620 LVUSBSta (259690a8ea2d9164aba9cb80a9c3ddb1) C:\WINDOWS\system32\drivers\lvusbsta.sys
14:08:18.0984 2620 LVUSBSta - ok
14:08:19.0250 2620 LVUVC (291f69b3dda0f033d2490c5ba5179f7c) C:\WINDOWS\system32\DRIVERS\lvuvc.sys
14:08:19.0484 2620 LVUVC - ok
14:08:19.0687 2620 MCSTRM (5bb01b9f582259d1fb7653c5c1da3653) C:\WINDOWS\system32\drivers\MCSTRM.sys
14:08:19.0703 2620 MCSTRM - ok
14:08:19.0812 2620 MDM (7cf1b716372b89568ae4c0fe769f5869) C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
14:08:19.0812 2620 MDM - ok
14:08:19.0843 2620 mdmxsdk (3c318b9cd391371bed62126581ee9961) C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys
14:08:19.0875 2620 mdmxsdk - ok
14:08:19.0890 2620 Messenger (986b1ff5814366d71e0ac5755c88f2d3) C:\WINDOWS\System32\msgsvc.dll
14:08:19.0890 2620 Messenger - ok
14:08:19.0937 2620 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
14:08:19.0953 2620 mnmdd - ok
14:08:19.0968 2620 mnmsrvc (d18f1f0c101d06a1c1adf26eed16fcdd) C:\WINDOWS\system32\mnmsrvc.exe
14:08:19.0984 2620 mnmsrvc - ok
14:08:20.0015 2620 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys
14:08:20.0031 2620 Modem - ok
14:08:20.0078 2620 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys
14:08:20.0109 2620 Mouclass - ok
14:08:20.0156 2620 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys
14:08:20.0171 2620 mouhid - ok
14:08:20.0203 2620 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
14:08:20.0234 2620 MountMgr - ok
14:08:20.0265 2620 MozillaMaintenance (96aa8ba23142cc8e2b30f3cae0c80254) C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
14:08:20.0265 2620 MozillaMaintenance - ok
14:08:20.0281 2620 mraid35x (3f4bb95e5a44f3be34824e8e7caf0737) C:\WINDOWS\system32\DRIVERS\mraid35x.sys
14:08:20.0296 2620 mraid35x - ok
14:08:20.0328 2620 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
14:08:20.0375 2620 MRxDAV - ok
14:08:20.0421 2620 MRxSmb (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
14:08:20.0453 2620 MRxSmb - ok
14:08:20.0468 2620 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
14:08:20.0484 2620 Msfs - ok
14:08:20.0500 2620 MSIServer - ok
14:08:20.0531 2620 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
14:08:20.0546 2620 MSKSSRV - ok
14:08:20.0562 2620 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
14:08:20.0578 2620 MSPCLOCK - ok
14:08:20.0593 2620 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
14:08:20.0625 2620 MSPQM - ok
14:08:20.0671 2620 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
14:08:20.0687 2620 mssmbios - ok
14:08:20.0703 2620 MSTEE (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys
14:08:20.0734 2620 MSTEE - ok
14:08:20.0765 2620 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
14:08:20.0796 2620 Mup - ok
14:08:20.0796 2620 mxnic (e1cdf20697d992cf83ff86dd04df1285) C:\WINDOWS\system32\DRIVERS\mxnic.sys
14:08:20.0828 2620 mxnic - ok
14:08:20.0843 2620 NABTSFEC (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
14:08:20.0875 2620 NABTSFEC - ok
14:08:20.0921 2620 napagent (0102140028fad045756796e1c685d695) C:\WINDOWS\System32\qagentrt.dll
14:08:20.0937 2620 napagent - ok
14:08:20.0953 2620 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
14:08:20.0968 2620 NDIS - ok
14:08:20.0984 2620 NdisIP (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
14:08:21.0000 2620 NdisIP - ok
14:08:21.0046 2620 NdisTapi (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
14:08:21.0062 2620 NdisTapi - ok
14:08:21.0093 2620 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
14:08:21.0109 2620 Ndisuio - ok
14:08:21.0125 2620 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
14:08:21.0140 2620 NdisWan - ok
14:08:21.0171 2620 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
14:08:21.0187 2620 NDProxy - ok
14:08:21.0218 2620 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
14:08:21.0250 2620 NetBIOS - ok
14:08:21.0265 2620 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
14:08:21.0296 2620 NetBT - ok
14:08:21.0343 2620 NetDDE (b857ba82860d7ff85ae29b095645563b) C:\WINDOWS\system32\netdde.exe
14:08:21.0343 2620 NetDDE - ok
14:08:21.0359 2620 NetDDEdsdm (b857ba82860d7ff85ae29b095645563b) C:\WINDOWS\system32\netdde.exe
14:08:21.0359 2620 NetDDEdsdm - ok
14:08:21.0406 2620 Netlogon (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe
14:08:21.0421 2620 Netlogon - ok
14:08:21.0453 2620 Netman (13e67b55b3abd7bf3fe7aae5a0f9a9de) C:\WINDOWS\System32\netman.dll
14:08:21.0453 2620 Netman - ok
14:08:21.0562 2620 NetTcpPortSharing (d34612c5d02d026535b3095d620626ae) c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
14:08:21.0578 2620 NetTcpPortSharing - ok
14:08:21.0625 2620 netwg311 (49be034256b60e913cf0a69811a248ee) C:\WINDOWS\system32\DRIVERS\netwg311.sys
14:08:21.0656 2620 netwg311 - ok
14:08:21.0687 2620 NIC1394 (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys
14:08:21.0703 2620 NIC1394 - ok
14:08:21.0765 2620 Nla (943337d786a56729263071623bbb9de5) C:\WINDOWS\System32\mswsock.dll
14:08:21.0765 2620 Nla - ok
14:08:21.0781 2620 nm (1e421a6bcf2203cc61b821ada9de878b) C:\WINDOWS\system32\DRIVERS\NMnt.sys
14:08:21.0812 2620 nm - ok
14:08:21.0812 2620 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
14:08:21.0843 2620 Npfs - ok
14:08:21.0890 2620 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
14:08:21.0906 2620 Ntfs - ok
14:08:21.0921 2620 NtLmSsp (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe
14:08:21.0921 2620 NtLmSsp - ok
14:08:21.0968 2620 NtmsSvc (156f64a3345bd23c600655fb4d10bc08) C:\WINDOWS\system32\ntmssvc.dll
14:08:21.0984 2620 NtmsSvc - ok
14:08:22.0031 2620 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
14:08:22.0046 2620 Null - ok
14:08:22.0109 2620 nv (2b298519edbfcf451d43e0f1e8f1006d) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
14:08:22.0187 2620 nv - ok
14:08:22.0312 2620 nvport - ok
14:08:22.0328 2620 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
14:08:22.0343 2620 NwlnkFlt - ok
14:08:22.0343 2620 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
14:08:22.0375 2620 NwlnkFwd - ok
14:08:22.0406 2620 NwlnkIpx (8b8b1be2dba4025da6786c645f77f123) C:\WINDOWS\system32\DRIVERS\nwlnkipx.sys
14:08:22.0437 2620 NwlnkIpx - ok
14:08:22.0453 2620 NwlnkNb (56d34a67c05e94e16377c60609741ff8) C:\WINDOWS\system32\DRIVERS\nwlnknb.sys
14:08:22.0484 2620 NwlnkNb - ok
14:08:22.0531 2620 NwlnkSpx (c0bb7d1615e1acbdc99757f6ceaf8cf0) C:\WINDOWS\system32\DRIVERS\nwlnkspx.sys
14:08:22.0546 2620 NwlnkSpx - ok
14:08:22.0593 2620 NwSapAgent (4b83fcbbe72af5f99d109798653e8b78) C:\WINDOWS\System32\ipxsap.dll
14:08:22.0609 2620 NwSapAgent - ok
14:08:22.0625 2620 ohci1394 (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
14:08:22.0671 2620 ohci1394 - ok
14:08:22.0718 2620 P3 (c90018bafdc7098619a4a95b046b30f3) C:\WINDOWS\system32\DRIVERS\p3.sys
14:08:22.0734 2620 P3 - ok
14:08:22.0750 2620 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\DRIVERS\parport.sys
14:08:22.0781 2620 Parport - ok
14:08:22.0796 2620 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
14:08:22.0812 2620 PartMgr - ok
14:08:22.0843 2620 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
14:08:22.0859 2620 ParVdm - ok
14:08:22.0875 2620 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys
14:08:22.0890 2620 PCI - ok
14:08:22.0906 2620 PCIDump - ok
14:08:22.0921 2620 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys
14:08:22.0937 2620 PCIIde - ok
14:08:22.0984 2620 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys
14:08:23.0031 2620 Pcmcia - ok
14:08:23.0078 2620 PD0620VID (4431f2fa27f56f4bc654b0af5810cc91) C:\WINDOWS\system32\DRIVERS\P0620Vid.sys
14:08:23.0093 2620 PD0620VID - ok
14:08:23.0109 2620 PDCOMP - ok
14:08:23.0125 2620 PDFRAME - ok
14:08:23.0125 2620 PDRELI - ok
14:08:23.0140 2620 PDRFRAME - ok
14:08:23.0187 2620 pepifilter (b20f958b207e6aaac5f70d04dd2c30d8) C:\WINDOWS\system32\DRIVERS\lv302af.sys
14:08:23.0187 2620 pepifilter - ok
14:08:23.0187 2620 perc2 (6c14b9c19ba84f73d3a86dba11133101) C:\WINDOWS\system32\DRIVERS\perc2.sys
14:08:23.0218 2620 perc2 - ok
14:08:23.0218 2620 perc2hib (f50f7c27f131afe7beba13e14a3b9416) C:\WINDOWS\system32\DRIVERS\perc2hib.sys
14:08:23.0250 2620 perc2hib - ok
14:08:23.0296 2620 pfc (da86016f0672ada925f589ede715f185) C:\WINDOWS\system32\drivers\pfc.sys
14:08:23.0312 2620 pfc - ok
14:08:23.0328 2620 PID_08A0 - ok
14:08:23.0328 2620 PID_0928 - ok
14:08:23.0453 2620 PID_PEPI (dd184d9adfe2a8a21741dbdfe9e22f5c) C:\WINDOWS\system32\DRIVERS\LV302V32.SYS
14:08:23.0562 2620 PID_PEPI - ok
14:08:23.0703 2620 PlugPlay (65df52f5b8b6e9bbd183505225c37315) C:\WINDOWS\system32\services.exe
14:08:23.0718 2620 PlugPlay - ok
14:08:23.0765 2620 Pml Driver HPZ12 (2d091a99624fb9e7eef0a86d872ec0c3) C:\WINDOWS\system32\HPZipm12.exe
14:08:23.0765 2620 Pml Driver HPZ12 - ok
14:08:23.0812 2620 Point32 (3b6973d60bde757c53bb76842d31318e) C:\WINDOWS\system32\DRIVERS\point32.sys
14:08:23.0828 2620 Point32 - ok
14:08:23.0859 2620 PolicyAgent (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe
14:08:23.0859 2620 PolicyAgent - ok
14:08:23.0921 2620 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
14:08:23.0937 2620 PptpMiniport - ok
14:08:23.0953 2620 ProtectedStorage (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe
14:08:23.0953 2620 ProtectedStorage - ok
14:08:23.0968 2620 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
14:08:23.0984 2620 Ptilink - ok
14:08:24.0031 2620 PxHelp20 (d86b4a68565e444d76457f14172c875a) C:\WINDOWS\system32\Drivers\PxHelp20.sys
14:08:24.0046 2620 PxHelp20 - ok
14:08:24.0062 2620 ql1080 (0a63fb54039eb5662433caba3b26dba7) C:\WINDOWS\system32\DRIVERS\ql1080.sys
14:08:24.0109 2620 ql1080 - ok
14:08:24.0109 2620 Ql10wnt (6503449e1d43a0ff0201ad5cb1b8c706) C:\WINDOWS\system32\DRIVERS\ql10wnt.sys
14:08:24.0140 2620 Ql10wnt - ok
14:08:24.0140 2620 ql12160 (156ed0ef20c15114ca097a34a30d8a01) C:\WINDOWS\system32\DRIVERS\ql12160.sys
14:08:24.0171 2620 ql12160 - ok
14:08:24.0171 2620 ql1240 (70f016bebde6d29e864c1230a07cc5e6) C:\WINDOWS\system32\DRIVERS\ql1240.sys
14:08:24.0218 2620 ql1240 - ok
14:08:24.0234 2620 ql1280 (907f0aeea6bc451011611e732bd31fcf) C:\WINDOWS\system32\DRIVERS\ql1280.sys
14:08:24.0250 2620 ql1280 - ok
14:08:24.0296 2620 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
14:08:24.0328 2620 RasAcd - ok
14:08:24.0328 2620 RasAuto (ad188be7bdf94e8df4ca0a55c00a5073) C:\WINDOWS\System32\rasauto.dll
14:08:24.0343 2620 RasAuto - ok
14:08:24.0359 2620 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
14:08:24.0390 2620 Rasl2tp - ok
14:08:24.0421 2620 RasMan (76a9a3cbeadd68cc57cda5e1d7448235) C:\WINDOWS\System32\rasmans.dll
14:08:24.0437 2620 RasMan - ok
14:08:24.0453 2620 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
14:08:24.0468 2620 RasPppoe - ok
14:08:24.0484 2620 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
14:08:24.0500 2620 Raspti - ok
14:08:24.0515 2620 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
14:08:24.0593 2620 Rdbss - ok
14:08:24.0593 2620 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
14:08:24.0625 2620 RDPCDD - ok
14:08:24.0656 2620 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
14:08:24.0671 2620 rdpdr - ok
14:08:24.0718 2620 RDPWD (5b3055daa788bd688594d2f5981f2a83) C:\WINDOWS\system32\drivers\RDPWD.sys
14:08:24.0734 2620 RDPWD - ok
14:08:24.0750 2620 RDSessMgr (3c37bf86641bda977c3bf8a840f3b7fa) C:\WINDOWS\system32\sessmgr.exe
14:08:24.0750 2620 RDSessMgr - ok
14:08:24.0781 2620 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys
14:08:24.0796 2620 redbook - ok
14:08:24.0828 2620 RemoteAccess (7e699ff5f59b5d9de5390e3c34c67cf5) C:\WINDOWS\System32\mprdim.dll
14:08:24.0828 2620 RemoteAccess - ok
14:08:24.0875 2620 RpcLocator (aaed593f84afa419bbae8572af87cf6a) C:\WINDOWS\system32\locator.exe
14:08:24.0875 2620 RpcLocator - ok
14:08:24.0937 2620 RpcSs (6b27a5c03dfb94b4245739065431322c) C:\WINDOWS\System32\rpcss.dll
14:08:24.0937 2620 RpcSs - ok
14:08:25.0000 2620 RSVP (471b3f9741d762abe75e9deea4787e47) C:\WINDOWS\system32\rsvp.exe
14:08:25.0000 2620 RSVP - ok
14:08:25.0062 2620 rtl8139 (d507c1400284176573224903819ffda3) C:\WINDOWS\system32\DRIVERS\RTL8139.SYS
14:08:25.0078 2620 rtl8139 - ok
14:08:25.0109 2620 SamSs (bf2466b3e18e970d8a976fb95fc1ca85) C:\WINDOWS\system32\lsass.exe
14:08:25.0109 2620 SamSs - ok
14:08:25.0125 2620 SCardSvr (86d007e7a654b9a71d1d7d856b104353) C:\WINDOWS\System32\SCardSvr.exe
14:08:25.0125 2620 SCardSvr - ok
14:08:25.0187 2620 Schedule (0a9a7365a1ca4319aa7c1d6cd8e4eafa) C:\WINDOWS\system32\schedsvc.dll
14:08:25.0187 2620 Schedule - ok
14:08:25.0250 2620 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
14:08:25.0281 2620 Secdrv - ok
14:08:25.0312 2620 seclogon (cbe612e2bb6a10e3563336191eda1250) C:\WINDOWS\System32\seclogon.dll
14:08:25.0312 2620 seclogon - ok
14:08:25.0328 2620 SENS (7fdd5d0684eca8c1f68b4d99d124dcd0) C:\WINDOWS\system32\sens.dll
14:08:25.0328 2620 SENS - ok
14:08:25.0343 2620 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
14:08:25.0359 2620 serenum - ok
14:08:25.0375 2620 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\DRIVERS\serial.sys
14:08:25.0421 2620 Serial - ok
14:08:25.0453 2620 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
14:08:25.0484 2620 Sfloppy - ok
14:08:25.0531 2620 SharedAccess (83f41d0d89645d7235c051ab1d9523ac) C:\WINDOWS\System32\ipnathlp.dll
14:08:25.0546 2620 SharedAccess - ok
14:08:25.0593 2620 ShellHWDetection (99bc0b50f511924348be19c7c7313bbf) C:\WINDOWS\System32\shsvcs.dll
14:08:25.0593 2620 ShellHWDetection - ok
14:08:25.0609 2620 Simbad - ok
14:08:25.0656 2620 sisagp (6b33d0ebd30db32e27d1d78fe946a754) C:\WINDOWS\system32\DRIVERS\sisagp.sys
14:08:25.0671 2620 sisagp - ok
14:08:25.0703 2620 SLIP (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys
14:08:25.0718 2620 SLIP - ok
14:08:25.0750 2620 Sparrow (83c0f71f86d3bdaf915685f3d568b20e) C:\WINDOWS\system32\DRIVERS\sparrow.sys
14:08:25.0796 2620 Sparrow - ok
14:08:25.0812 2620 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
14:08:25.0828 2620 splitter - ok
14:08:25.0890 2620 Spooler (60784f891563fb1b767f70117fc2428f) C:\WINDOWS\system32\spoolsv.exe
14:08:25.0890 2620 Spooler - ok
14:08:25.0921 2620 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys
14:08:25.0937 2620 sr - ok
14:08:26.0000 2620 srservice (3805df0ac4296a34ba4bf93b346cc378) C:\WINDOWS\system32\srsvc.dll
14:08:26.0000 2620 srservice - ok
14:08:26.0062 2620 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
14:08:26.0093 2620 Srv - ok
14:08:26.0109 2620 SSDPSRV (0a5679b3714edab99e357057ee88fca6) C:\WINDOWS\System32\ssdpsrv.dll
14:08:26.0125 2620 SSDPSRV - ok
14:08:26.0156 2620 StillCam (a9573045baa16eab9b1085205b82f1ed) C:\WINDOWS\system32\DRIVERS\serscan.sys
14:08:26.0187 2620 StillCam - ok
14:08:26.0250 2620 stisvc (8bad69cbac032d4bbacfce0306174c30) C:\WINDOWS\system32\wiaservc.dll
14:08:26.0250 2620 stisvc - ok
14:08:26.0281 2620 streamip (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
14:08:26.0296 2620 streamip - ok
14:08:26.0359 2620 SunkFilt (9152dc78005a58a17e79390aa0853bb1) C:\WINDOWS\System32\Drivers\sunkfilt.sys
14:08:26.0375 2620 SunkFilt - ok
14:08:26.0390 2620 SunkFilt39 (ed67900e1553b2fc56daa64aab4b304f) C:\WINDOWS\System32\Drivers\sunkfilt39.sys
14:08:26.0437 2620 SunkFilt39 - ok
14:08:26.0437 2620 Sunkfiltp - ok
14:08:26.0453 2620 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
14:08:26.0468 2620 swenum - ok
14:08:26.0500 2620 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
14:08:26.0546 2620 swmidi - ok
14:08:26.0593 2620 symc810 (1ff3217614018630d0a6758630fc698c) C:\WINDOWS\system32\DRIVERS\symc810.sys
14:08:26.0625 2620 symc810 - ok
14:08:26.0640 2620 symc8xx (070e001d95cf725186ef8b20335f933c) C:\WINDOWS\system32\DRIVERS\symc8xx.sys
14:08:26.0656 2620 symc8xx - ok
14:08:26.0734 2620 SYMIDSCO - ok
14:08:26.0750 2620 sym_hi (80ac1c4abbe2df3b738bf15517a51f2c) C:\WINDOWS\system32\DRIVERS\sym_hi.sys
14:08:26.0765 2620 sym_hi - ok
14:08:26.0781 2620 sym_u3 (bf4fab949a382a8e105f46ebb4937058) C:\WINDOWS\system32\DRIVERS\sym_u3.sys
14:08:26.0796 2620 sym_u3 - ok
14:08:26.0828 2620 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
14:08:26.0828 2620 sysaudio - ok
14:08:26.0890 2620 SysmonLog (c7abbc59b43274b1109df6b24d617051) C:\WINDOWS\system32\smlogsvc.exe
14:08:26.0890 2620 SysmonLog - ok
14:08:26.0937 2620 TapiSrv (3cb78c17bb664637787c9a1c98f79c38) C:\WINDOWS\System32\tapisrv.dll
14:08:26.0953 2620 TapiSrv - ok
14:08:27.0015 2620 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
14:08:27.0031 2620 Tcpip - ok
14:08:27.0078 2620 Tcpip6 (4e53bbcc4be37d7a4bd6ef1098c89ff7) C:\WINDOWS\system32\DRIVERS\tcpip6.sys
14:08:27.0093 2620 Tcpip6 - ok
14:08:27.0109 2620 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
14:08:27.0140 2620 TDPIPE - ok
14:08:27.0171 2620 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
14:08:27.0187 2620 TDTCP - ok
14:08:27.0203 2620 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
14:08:27.0250 2620 TermDD - ok
14:08:27.0296 2620 TermService (ff3477c03be7201c294c35f684b3479f) C:\WINDOWS\System32\termsrv.dll
14:08:27.0312 2620 TermService - ok
14:08:27.0343 2620 Themes (99bc0b50f511924348be19c7c7313bbf) C:\WINDOWS\System32\shsvcs.dll
14:08:27.0359 2620 Themes - ok
14:08:27.0390 2620 TosIde (f2790f6af01321b172aa62f8e1e187d9) C:\WINDOWS\system32\DRIVERS\toside.sys
14:08:27.0406 2620 TosIde - ok
14:08:27.0437 2620 TrkWks (55bca12f7f523d35ca3cb833c725f54e) C:\WINDOWS\system32\trkwks.dll
14:08:27.0453 2620 TrkWks - ok
14:08:27.0515 2620 tunmp (8f861eda21c05857eb8197300a92501c) C:\WINDOWS\system32\DRIVERS\tunmp.sys
14:08:27.0531 2620 tunmp - ok
14:08:27.0562 2620 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
14:08:27.0578 2620 Udfs - ok
14:08:27.0593 2620 ultra (1b698a51cd528d8da4ffaed66dfc51b9) C:\WINDOWS\system32\DRIVERS\ultra.sys
14:08:27.0640 2620 ultra - ok
14:08:27.0671 2620 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
14:08:27.0718 2620 Update - ok
14:08:27.0750 2620 upnphost (1ebafeb9a3fbdc41b8d9c7f0f687ad91) C:\WINDOWS\System32\upnphost.dll
14:08:27.0750 2620 upnphost - ok
14:08:27.0765 2620 UPS (05365fb38fca1e98f7a566aaaf5d1815) C:\WINDOWS\System32\ups.exe
14:08:27.0765 2620 UPS - ok
14:08:27.0812 2620 usbaudio (e919708db44ed8543a7c017953148330) C:\WINDOWS\system32\drivers\usbaudio.sys
14:08:27.0843 2620 usbaudio - ok
14:08:27.0890 2620 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
14:08:27.0906 2620 usbccgp - ok
14:08:27.0921 2620 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
14:08:27.0953 2620 usbehci - ok
14:08:27.0968 2620 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
14:08:27.0984 2620 usbhub - ok
14:08:28.0000 2620 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
14:08:28.0015 2620 usbprint - ok
14:08:28.0031 2620 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
14:08:28.0046 2620 usbscan - ok
14:08:28.0062 2620 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
14:08:28.0078 2620 USBSTOR - ok
14:08:28.0093 2620 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
14:08:28.0109 2620 usbuhci - ok
14:08:28.0140 2620 usbvideo (63bbfca7f390f4c49ed4b96bfb1633e0) C:\WINDOWS\system32\Drivers\usbvideo.sys
14:08:28.0140 2620 usbvideo - ok
14:08:28.0171 2620 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
14:08:28.0187 2620 VgaSave - ok
14:08:28.0218 2620 viaagp (754292ce5848b3738281b4f3607eaef4) C:\WINDOWS\system32\DRIVERS\viaagp.sys
14:08:28.0265 2620 viaagp - ok
14:08:28.0281 2620 ViaIde (3b3efcda263b8ac14fdf9cbdd0791b2e) C:\WINDOWS\system32\DRIVERS\viaide.sys
14:08:28.0296 2620 ViaIde - ok
14:08:28.0312 2620 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys
14:08:28.0328 2620 VolSnap - ok
14:08:28.0375 2620 VSS (7a9db3a67c333bf0bd42e42b8596854b) C:\WINDOWS\System32\vssvc.exe
14:08:28.0375 2620 VSS - ok
14:08:28.0406 2620 W32Time (54af4b1d5459500ef0937f6d33b1914f) C:\WINDOWS\system32\w32time.dll
14:08:28.0406 2620 W32Time - ok
14:08:28.0437 2620 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
14:08:28.0453 2620 Wanarp - ok
14:08:28.0468 2620 wanatw - ok
14:08:28.0515 2620 Wdf01000 (fd47474bd21794508af449d9d91af6e6) C:\WINDOWS\system32\DRIVERS\Wdf01000.sys
14:08:28.0546 2620 Wdf01000 - ok
14:08:28.0562 2620 WDICA - ok
14:08:28.0578 2620 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
14:08:28.0593 2620 wdmaud - ok
14:08:28.0625 2620 WebClient (77a354e28153ad2d5e120a5a8687bc06) C:\WINDOWS\System32\webclnt.dll
14:08:28.0625 2620 WebClient - ok
14:08:28.0687 2620 winachsf (2dc7c0b6175a0a8ed84a4f70199c93b5) C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys
14:08:28.0734 2620 winachsf - ok
14:08:28.0812 2620 winmgmt (2d0e4ed081963804ccc196a0929275b5) C:\WINDOWS\system32\wbem\WMIsvc.dll
14:08:28.0812 2620 winmgmt - ok
14:08:28.0859 2620 WmdmPmSN (c51b4a5c05a5475708e3c81c7765b71d) C:\WINDOWS\system32\MsPMSNSv.dll
14:08:28.0875 2620 WmdmPmSN - ok
14:08:28.0906 2620 WmiApSrv (e0673f1106e62a68d2257e376079f821) C:\WINDOWS\system32\wbem\wmiapsrv.exe
14:08:28.0921 2620 WmiApSrv - ok
14:08:29.0046 2620 WMPNetworkSvc (f74e3d9a7fa9556c3bbb14d4e5e63d3b) C:\Program Files\Windows Media Player\WMPNetwk.exe
14:08:29.0093 2620 WMPNetworkSvc - ok
14:08:29.0187 2620 WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys
14:08:29.0203 2620 WS2IFSL - ok
14:08:29.0250 2620 wscsvc (7c278e6408d1dce642230c0585a854d5) C:\WINDOWS\system32\wscsvc.dll
14:08:29.0281 2620 wscsvc - ok
14:08:29.0328 2620 WSTCODEC (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
14:08:29.0343 2620 WSTCODEC - ok
14:08:29.0390 2620 wuauserv (35321fb577cdc98ce3eb3a3eb9e4610a) C:\WINDOWS\system32\wuauserv.dll
14:08:29.0421 2620 wuauserv - ok
14:08:29.0468 2620 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
14:08:29.0484 2620 WudfPf - ok
14:08:29.0500 2620 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
14:08:29.0500 2620 WudfRd - ok
14:08:29.0515 2620 WudfSvc (05231c04253c5bc30b26cbaae680ed89) C:\WINDOWS\System32\WUDFSvc.dll
14:08:29.0531 2620 WudfSvc - ok
14:08:29.0578 2620 WZCSVC (81dc3f549f44b1c1fff022dec9ecf30b) C:\WINDOWS\System32\wzcsvc.dll
14:08:29.0593 2620 WZCSVC - ok
14:08:29.0625 2620 xmlprov (295d21f14c335b53cb8154e5b1f892b9) C:\WINDOWS\System32\xmlprov.dll
14:08:29.0640 2620 xmlprov - ok
14:08:29.0781 2620 YahooAUService (dd0042f0c3b606a6a8b92d49afb18ad6) C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
14:08:29.0828 2620 YahooAUService - ok
14:08:29.0906 2620 ZD1201U (7ebcf6441b3e3521b5726b933107793c) C:\WINDOWS\system32\DRIVERS\zd1201u.sys
14:08:29.0921 2620 ZD1201U - ok
14:08:29.0937 2620 ZDNDIS5 - ok
14:08:29.0984 2620 MBR (0x1B8) (b20939cd98b7710036274839082ae757) \Device\Harddisk0\DR0
14:08:30.0046 2620 \Device\Harddisk0\DR0 - ok
14:08:30.0078 2620 Boot (0x1200) (7d015b0c110e7f0649acdc67d591f9f8) \Device\Harddisk0\DR0\Partition0
14:08:30.0078 2620 \Device\Harddisk0\DR0\Partition0 - ok
14:08:30.0093 2620 Boot (0x1200) (fd053606a107482e05786d758885b743) \Device\Harddisk0\DR0\Partition1
14:08:30.0093 2620 \Device\Harddisk0\DR0\Partition1 - ok
14:08:30.0093 2620 ============================================================
14:08:30.0093 2620 Scan finished
14:08:30.0093 2620 ============================================================
14:08:30.0109 3648 Detected object count: 0
14:08:30.0109 3648 Actual detected object count: 0
14:10:59.0000 1296 Deinitialize success


ComboFix 12-05-11.03 - Owner 05/13/2012 16:09:31.12.1 - x86 MINIMAL
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.485.287 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: ESET NOD32 Antivirus 4.2 *Disabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Owner\Local Settings\Application Data\Apple Computer\Adobe\uwcytciv.dll
.
.
((((((((((((((((((((((((( Files Created from 2012-04-13 to 2012-05-13 )))))))))))))))))))))))))))))))
.
.
2012-05-13 04:01 . 2012-05-13 04:01 ——– d—–w- c:\windows\LastGood
2012-05-12 01:31 . 2012-05-12 01:31 ——– d—–w- C:\TDSSKiller_Quarantine
2012-04-28 16:48 . 2012-04-28 16:48 ——– d—–w- c:\program files\ESET
2012-04-28 16:48 . 2012-04-28 16:48 ——– d—–w- c:\documents and settings\All Users\Application Data\ESET
2012-04-25 18:06 . 2012-04-25 18:06 ——– d—–w- c:\program files\Mozilla Maintenance Service
2012-04-25 18:06 . 2012-04-25 18:06 129976 —-a-w- c:\program files\Mozilla Firefox\maintenanceservice.exe
2012-04-25 18:06 . 2012-04-25 18:06 157352 —-a-w- c:\program files\Mozilla Firefox\maintenanceservice_installer.exe
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-04-11 13:12 . 2004-08-26 16:12 1862272 —-a-w- c:\windows\system32\win32k.sys
2012-04-11 13:10 . 2004-08-26 16:12 2192640 —-a-w- c:\windows\system32\ntoskrnl.exe
2012-04-11 12:35 . 2004-08-04 05:59 2069120 —-a-w- c:\windows\system32\ntkrnlpa.exe
2012-04-04 19:56 . 2010-05-09 03:01 22344 —-a-w- c:\windows\system32\drivers\mbam.sys
2012-03-11 04:03 . 2006-07-30 08:56 81920 -c–a-w- c:\windows\ALCFDRTM.VER
2012-03-11 04:03 . 2006-07-30 08:56 81920 -c–a-w- c:\windows\ALCFDRTM.EXE
2012-02-29 14:10 . 2004-08-26 16:12 177664 —-a-w- c:\windows\system32\wintrust.dll
2012-02-29 14:10 . 2004-08-26 16:11 148480 —-a-w- c:\windows\system32\imagehlp.dll
2012-02-28 18:50 . 2004-08-26 16:12 667136 —-a-w- c:\windows\system32\wininet.dll
2012-02-28 18:50 . 2004-08-26 16:12 61952 —-a-w- c:\windows\system32\tdc.ocx
2012-02-28 18:50 . 2004-08-26 16:11 81920 —-a-w- c:\windows\system32\ieencode.dll
2012-02-28 13:50 . 2004-08-26 16:11 369664 —-a-w- c:\windows\system32\html.iec
2012-04-25 18:06 . 2012-02-18 06:29 97208 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LogitechQuickCamRibbon"="c:\program files\Logitech\Logitech WebCam Software\LWS.exe" [2009-05-08 2780432]
"High Definition Audio Property Page Shortcut"="HDAudPropShortcut.exe" [2004-03-17 61952]
"SoundMan"="SOUNDMAN.EXE" [2005-09-21 86016]
"AlcWzrd"="ALCWZRD.EXE" [2005-09-21 2807808]
"AirPort Base Station Agent"="c:\program files\AirPort\APAgent.exe" [2007-07-11 643072]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2011-01-12 2219184]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Find Fast.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Find Fast.lnk
backup=c:\windows\pss\Microsoft Find Fast.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Office Startup.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Office Startup.lnk
backup=c:\windows\pss\Office Startup.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeUpdater]
2009-05-06 09:42 2356088 —-a-w- c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechQuickCamRibbon]
2009-05-08 14:35 2780432 —-a-w- c:\program files\Logitech\Logitech WebCam Software\LWS.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)]
2010-06-01 14:17 5252408 —-a-w- c:\progra~1\Yahoo!\MESSEN~1\YahooMessenger.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"MDM"=2 (0x2)
"YahooAUService"=2 (0x2)
"JavaQuickStarterService"=2 (0x2)
"LVPrcSrv"=2 (0x2)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableNotifications"= 1 (0x1)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Windows Media Player\\wmplayer.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Program Files\\Java\\jre6\\launch4j-tmp\\JDownloader.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\America Online 9.0\\waol.exe"=
"c:\\Program Files\\AirPort\\APAgent.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:UDP"= 5353:UDP:Bonjour
.
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [3/31/2009 3:40 AM 64160]
S1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [12/21/2010 3:04 PM 115008]
S1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [12/21/2010 1:47 PM 94872]
S2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [1/12/2011 4:41 PM 810144]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe /svc –> c:\program files\Google\Update\GoogleUpdate.exe [?]
S3 DLKRTS;D-Link DFE-530TX+ PCI Adapter;c:\windows\system32\drivers\DLKRTS.SYS [9/7/2005 10:37 PM 45568]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe /medsvc –> c:\program files\Google\Update\GoogleUpdate.exe [?]
S3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [4/25/2012 2:06 PM 129976]
S3 ZD1201U;ZyDAS ZD1201 IEEE 802.11b Wireless LAN Driver (USB);c:\windows\system32\drivers\ZD1201U.sys [6/27/2005 4:56 PM 38656]
S3 ZDNDIS5;ZDNDIS5 Protocol Driver;\??\c:\windows\system32\ZDNDIS5.SYS –> c:\windows\system32\ZDNDIS5.SYS [?]
S4 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;"c:\program files\Lavasoft\Ad-Aware\AAWService.exe" –> c:\program files\Lavasoft\Ad-Aware\AAWService.exe [?]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
mStart Page = about:blank
FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\ihg2zc8p.default\
.
- - - - ORPHANS REMOVED - - - -
.
HKCU-Run-Adobe - c:\documents and settings\Owner\Local Settings\Application Data\Apple Computer\Adobe\uwcytciv.dll
HKU-Default-Run-Adobe - c:\documents and settings\Owner\Local Settings\Application Data\Apple Computer\Adobe\uwcytciv.dll
SafeBoot-21960706.sys
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-05-13 16:24
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
Completion time: 2012-05-13 16:29:06
ComboFix-quarantined-files.txt 2012-05-13 20:29
ComboFix2.txt 2012-05-12 00:09
ComboFix3.txt 2012-02-03 22:28
.
Pre-Run: 46,580,543,488 bytes free
Post-Run: 46,695,063,552 bytes free
.
- - End Of File - - 144562ECB7EA625650E7E82C322F54E8

Yes, it is still redirecting.

Ok, here are the links for virustotal:

sunkfilt39.sys https://www.virustotal.com/file/0f1deb9407d…sis/1337016044/


Virustotal says this file does not exist C:\Documents and Settings\Owner\Local Settings\temp\nsk10FF.tmp\uwcytciv.dll


ALCFDRTM.VER https://www.virustotal.com/file/db331ed8005…sis/1337016273/


ALCFDRTM.EXE https://www.virustotal.com/file/db331ed8005…sis/1337016497/




SystemLook 30.07.11 by jpshortstuff
Log created at 13:34 on 14/05/2012 by Owner
Administrator - Elevation successful

========== filefind ==========

Searching for "*sunkfilt39.sys*"
C:\WINDOWS\system32\drivers\Sunkfilt39.sys –a—- 42968 bytes [22:05 18/10/2004] [22:05 18/10/2004] ED67900E1553B2FC56DAA64AAB4B304F

-= EOF =-



Rooter.exe (v1.0.2) by Eric_71
.
SeDebugPrivilege granted successfully …
.
Windows XP Home Edition (5.1.2600) Service Pack 3
[32_bits] - x86 Family 15 Model 4 Stepping 1, GenuineIntel
.
[wscsvc] (Security Center) RUNNING (state:4)
[SharedAccess] RUNNING (state:4)
Windows Firewall -> Enabled
.
Internet Explorer 6.0.2900.5512
Mozilla Firefox 12.0 (en-US)
.
C:\ [Fixed-NTFS] .. ( Total:144 Go - Free:42 Go )
D:\ [Fixed-FAT32] .. ( Total:4 Go - Free:1 Go )
E:\ [CD_Rom]
F:\ [CD_Rom]
G:\ [Removable]
H:\ [Removable]
I:\ [Removable]
J:\ [Removable]
L:\ [Removable]
.
Scan : 13:39.04
Path : C:\Documents and Settings\Owner\Desktop\Rooter.exe
User : Owner ( Administrator -> YES )
.
———————-\\ Processes
.
Locked [System Process] (0)
______ System (4)
______ \SystemRoot\System32\smss.exe (584)
______ \??\C:\WINDOWS\system32\csrss.exe (660)
______ \??\C:\WINDOWS\system32\winlogon.exe (688)
______ C:\WINDOWS\system32\services.exe (732)
______ C:\WINDOWS\system32\lsass.exe (744)
______ C:\WINDOWS\system32\svchost.exe (896)
______ C:\WINDOWS\system32\svchost.exe (956)
______ C:\WINDOWS\System32\svchost.exe (1044)
______ C:\WINDOWS\system32\svchost.exe (1100)
______ C:\WINDOWS\system32\svchost.exe (1272)
______ C:\WINDOWS\Explorer.EXE (1532)
______ C:\WINDOWS\system32\spoolsv.exe (1704)
______ C:\WINDOWS\SOUNDMAN.EXE (140)
______ C:\WINDOWS\ALCWZRD.EXE (160)
______ C:\Program Files\AirPort\APAgent.exe (192)
______ C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe (204)
______ C:\WINDOWS\system32\svchost.exe (1388)
______ C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe (1428)
______ C:\WINDOWS\system32\svchost.exe (1556)
______ C:\WINDOWS\System32\alg.exe (1328)
______ C:\Documents and Settings\Owner\Desktop\Rooter.exe (3916)
.
———————-\\ Device\Harddisk0\
.
\Device\Harddisk0 [Sectors : 63 x 512 Bytes]
.
\Device\Harddisk0\Partition1 –[ MBR ]– (Start_Offset:4523904000 | Length:155515368960)
\Device\Harddisk0\Partition2 (Start_Offset:32256 | Length:4523871744)
.
———————-\\ Scheduled Tasks
.
C:\WINDOWS\Tasks\desktop.ini
C:\WINDOWS\Tasks\SA.DAT
.
———————-\\ Registry
.
.
———————-\\ Files & Folders
.
———————-\\ Scan completed at 13:39.21
.
C:\Rooter$\Rooter_1.txt - (14/05/2012 | 13:39.21)

Yes, I just checked Internet Explorer and I am being redirected in both it and Firefox.

Here are the logs; thank you so very much:


OTL logfile created on: 5/15/2012 9:11:44 PM - Run 1
OTL by OldTimer - Version 3.2.43.0 Folder = C:\Documents and Settings\Owner\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

484.98 Mb Total Physical Memory | 232.07 Mb Available Physical Memory | 47.85% Memory free
1.13 Gb Paging File | 0.87 Gb Available in Paging File | 76.82% Paging File free
Paging file location(s): C:\pagefile.sys 756 1512 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 144.83 Gb Total Space | 43.02 Gb Free Space | 29.71% Space Free | Partition Type: NTFS
Drive D: | 4.20 Gb Total Space | 1.68 Gb Free Space | 39.89% Space Free | Partition Type: FAT32
Drive H: | 1.90 Gb Total Space | 1.44 Gb Free Space | 75.68% Space Free | Partition Type: FAT

Computer Name: RYAN | User Name: Owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/05/15 21:10:16 | 000,595,456 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Owner\Desktop\OTL.exe
PRC - [2011/01/12 16:41:42 | 000,810,144 | —- | M] (ESET) – C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
PRC - [2011/01/12 16:41:24 | 002,219,184 | —- | M] (ESET) – C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
PRC - [2009/05/08 10:35:50 | 002,780,432 | —- | M] () – C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe
PRC - [2009/05/08 10:34:08 | 000,559,888 | —- | M] () – C:\Program Files\Common Files\LogiShrd\LQCVFX\COCIManager.exe
PRC - [2008/04/13 20:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) – C:\WINDOWS\explorer.exe
PRC - [2007/07/11 16:54:34 | 000,643,072 | —- | M] (Apple Inc.) – C:\Program Files\AirPort\APAgent.exe
PRC - [2005/09/21 16:32:56 | 002,807,808 | —- | M] (RealTek Semicoductor Corp.) – C:\WINDOWS\ALCWZRD.EXE
PRC - [2005/09/21 11:24:02 | 000,086,016 | —- | M] (Realtek Semiconductor Corp.) – C:\WINDOWS\SOUNDMAN.EXE


========== Modules (No Company Name) ==========

MOD - [2009/05/08 10:35:50 | 002,780,432 | —- | M] () – C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe
MOD - [2009/05/08 10:34:08 | 000,559,888 | —- | M] () – C:\Program Files\Common Files\LogiShrd\LQCVFX\COCIManager.exe
MOD - [2007/05/08 17:10:08 | 000,128,512 | —- | M] () – C:\Program Files\WinRAR\RarExt.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] – C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe – (Lavasoft Ad-Aware Service)
SRV - File not found [On_Demand | Stopped] – C:\Program Files\Google\Update\GoogleUpdate.exe /medsvc – (gupdatem) Google Update Service (gupdatem)
SRV - File not found [Auto | Stopped] – C:\Program Files\Google\Update\GoogleUpdate.exe /svc – (gupdate) Google Update Service (gupdate)
SRV - File not found [On_Demand | Unknown] – C:\WINDOWS\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235} – (COMSysApp)
SRV - File not found [On_Demand | Stopped] – %SystemRoot%\System32\appmgmts.dll – (AppMgmt)
SRV - [2012/04/25 14:06:31 | 000,129,976 | —- | M] (Mozilla Foundation) [On_Demand | Stopped] – C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe – (MozillaMaintenance)
SRV - [2011/01/12 16:44:02 | 000,033,584 | —- | M] (ESET) [On_Demand | Stopped] – C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe – (EhttpSrv)
SRV - [2011/01/12 16:41:42 | 000,810,144 | —- | M] (ESET) [Auto | Running] – C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe – (ekrn)
SRV - [2010/03/29 08:51:54 | 000,068,000 | —- | M] (NOS Microsystems Ltd.) [On_Demand | Stopped] – C:\Program Files\NOS\bin\getPlus_Helper.dll – (getPlusHelper) getPlus®
SRV - [2009/04/30 16:01:10 | 000,154,136 | —- | M] (Logitech Inc.) [Disabled | Stopped] – C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe – (LVPrcSrv)
SRV - [2008/11/09 16:48:14 | 000,602,392 | —- | M] (Yahoo! Inc.) [Disabled | Stopped] – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe – (YahooAUService)
SRV - [2007/02/20 21:35:02 | 000,073,728 | —- | M] (HP) [Disabled | Stopped] – C:\WINDOWS\system32\HPZipm12.exe – (Pml Driver HPZ12)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\ZDNDIS5.SYS – (ZDNDIS5)
DRV - File not found [Kernel | On_Demand | Stopped] – – (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\wanatw4.sys – (wanatw) WAN Miniport (ATW)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\PROGRA~1\COMMON~1\SYMANT~1\SymcData\IDS-DI~1\20050901.036\symidsco.sys – (SYMIDSCO)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\WINDOWS\System32\Drivers\sunkfiltp.sys – (Sunkfiltp)
DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\LV561AV.SYS – (PID_0928) Logitech QuickCam Express(PID_0928)
DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\LV302AV.SYS – (PID_08A0) Logitech QuickCam IM(PID_08A0)
DRV - File not found [Kernel | On_Demand | Stopped] – – (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] – – (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] – – (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] – – (PDCOMP)
DRV - File not found [Kernel | System | Stopped] – – (PCIDump)
DRV - File not found [Kernel | System | Stopped] – C:\WINDOWS\system32\Drivers\nvport.sys – (nvport)
DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\LVMVDrv.sys – (LVMVDrv)
DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\LVcKap.sys – (LVcKap)
DRV - File not found [Kernel | System | Stopped] – – (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] – – (Changer)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\DOCUME~1\Owner\LOCALS~1\Temp\catchme.sys – (catchme)
DRV - [2010/12/21 15:04:06 | 000,141,264 | —- | M] (ESET) [File_System | Auto | Running] – C:\WINDOWS\system32\drivers\eamon.sys – (eamon)
DRV - [2010/12/21 15:04:06 | 000,115,008 | —- | M] (ESET) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\ehdrv.sys – (ehdrv)
DRV - [2010/12/21 13:47:38 | 000,094,872 | —- | M] (ESET) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\epfwtdir.sys – (epfwtdir)
DRV - [2010/02/11 08:02:15 | 000,226,880 | —- | M] (Microsoft Corporation) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\tcpip6.sys – (Tcpip6)
DRV - [2009/04/30 19:03:30 | 000,023,832 | R— | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\lvuvcflt.sys – (FilterService)
DRV - [2009/04/30 19:03:08 | 006,754,712 | R— | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\lvuvc.sys – (LVUVC) Logitech Webcam 300(UVC)
DRV - [2009/04/30 19:01:36 | 000,265,496 | R— | M] (Logitech Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\lvrs.sys – (LVRS)
DRV - [2009/04/30 19:00:00 | 000,114,712 | R— | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\lvpopflt.sys – (lvpopflt)
DRV - [2009/04/30 18:55:58 | 002,687,512 | R— | M] (Logitech Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\LV302V32.SYS – (PID_PEPI) Logitech QuickCam IM(PID_PEPI)
DRV - [2009/04/30 18:55:34 | 000,013,976 | R— | M] (Logitech Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\lv302af.sys – (pepifilter)
DRV - [2009/04/30 16:00:12 | 000,025,624 | —- | M] () [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\LVPr2Mon.sys – (LVPr2Mon)
DRV - [2009/03/09 15:06:56 | 000,064,160 | —- | M] (Lavasoft AB) [File_System | Boot | Running] – C:\WINDOWS\system32\drivers\Lbd.sys – (Lbd)
DRV - [2008/04/13 14:56:06 | 000,088,320 | —- | M] (Microsoft Corporation) [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\nwlnkipx.sys – (NwlnkIpx)
DRV - [2008/04/13 14:53:09 | 000,040,320 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\nmnt.sys – (nm)
DRV - [2008/02/29 04:13:36 | 000,079,120 | —- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\LMouKE.Sys – (LMouKE)
DRV - [2008/02/29 04:12:56 | 000,063,120 | —- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\L8042mou.Sys – (L8042mou)
DRV - [2008/02/29 04:12:48 | 000,020,240 | —- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\L8042Kbd.sys – (L8042Kbd)
DRV - [2007/01/23 16:45:00 | 000,034,576 | —- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\LHidFilt.Sys – (LHidFilt)
DRV - [2007/01/23 16:45:00 | 000,033,296 | —- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\LMouFilt.Sys – (LMouFilt)
DRV - [2007/01/23 16:45:00 | 000,028,176 | —- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\LUsbFilt.sys – (LUsbFilt)
DRV - [2006/12/14 22:41:56 | 000,041,248 | —- | M] (Logitech Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\LVUSBSta.sys – (LVUSBSta)
DRV - [2006/02/08 12:55:24 | 000,009,856 | —- | M] (Padus, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\pfc.sys – (pfc)
DRV - [2005/09/23 19:56:28 | 003,966,976 | —- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\RtkHDAud.sys – (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2005/07/28 15:43:41 | 000,008,413 | —- | M] (RealNetworks, Inc.) [Kernel | Auto | Running] – C:\WINDOWS\System32\drivers\mcstrm.sys – (MCSTRM)
DRV - [2004/10/20 15:39:32 | 000,040,724 | —- | M] (Alcor Micro Corp.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\Sunkfilt.sys – (SunkFilt)
DRV - [2004/10/18 18:05:12 | 000,042,968 | —- | M] (Alcor Micro Corp.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\Sunkfilt39.sys – (SunkFilt39)
DRV - [2004/08/04 15:00:00 | 000,063,232 | —- | M] (Microsoft Corporation) [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\nwlnknb.sys – (NwlnkNb)
DRV - [2004/08/04 15:00:00 | 000,055,936 | —- | M] (Microsoft Corporation) [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\nwlnkspx.sys – (NwlnkSpx)
DRV - [2004/08/03 22:31:34 | 000,020,992 | —- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\RTL8139.sys – (rtl8139) Realtek RTL8139(A/B/C)
DRV - [2004/07/29 14:14:22 | 000,091,577 | —- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\P0620Vid.sys – (PD0620VID)
DRV - [2004/06/17 18:56:22 | 000,220,032 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\HSFHWBS2.sys – (HSFHWBS2)
DRV - [2004/06/17 18:55:38 | 000,685,056 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\HSF_CNXT.sys – (winachsf)
DRV - [2004/06/17 18:55:04 | 001,041,536 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\HSF_DP.sys – (HSF_DP)
DRV - [2004/04/15 21:34:52 | 000,385,792 | R— | M] (NETGEAR, Inc ) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\netwg311.sys – (netwg311)
DRV - [2004/03/17 19:10:40 | 000,113,664 | —- | M] (Windows ® Server 2003 DDK provider) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\Hdaudio.sys – (HdAudAddService)
DRV - [2003/07/18 01:57:34 | 000,007,850 | —- | M] (BTC) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\Maestro1.sys – (KeyMaestro)
DRV - [2003/05/15 18:29:42 | 000,038,656 | —- | M] (ZyDAS Technology Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\ZD1201U.sys – (ZD1201U) ZyDAS ZD1201 IEEE 802.11b Wireless LAN Driver (USB)
DRV - [2002/06/23 17:31:20 | 000,045,568 | R— | M] (D-Link Corporation ) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\DLKRTS.SYS – (DLKRTS)
DRV - [2001/08/17 17:06:20 | 000,100,992 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\Icam5USB.sys – (ICAM5USB) Intel®
DRV - [2001/08/17 16:49:32 | 000,019,968 | —- | M] (Macronix International Co., Ltd. ) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\mxnic.sys – (mxnic)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\..\SearchScopes,DefaultScope = MSN
IE - HKCU\..\SearchScopes\Google: "URL" = http://www.google.com/search?sourceid=ie7&…e=utf8&q;=%s
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..network.proxy.type: 4
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.1: C:\Program Files\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.1.10: C:\Program Files\VideoLAN\VLC\npvlc.dll (the VideoLAN Team)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/04/25 14:06:31 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/02/04 23:30:47 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\[removed]: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird [2012/04/28 12:48:04 | 000,000,000 | —D | M]

[2011/05/28 16:24:42 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Owner\Application Data\Mozilla\Extensions
[2012/05/14 04:31:57 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\ihg2zc8p.default\extensions
[2011/05/30 00:26:10 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\ihg2zc8p.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}(2)
[2012/05/14 04:32:09 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\ks4k1kin.New\extensions
[2012/05/14 04:32:19 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\ofjvt90x.New2\extensions
[2012/02/18 02:29:01 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2012/05/14 04:31:57 | 000,004,733 | —- | M] () (No name found) – C:\DOCUMENTS AND SETTINGS\OWNER\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\IHG2ZC8P.DEFAULT\EXTENSIONS\[removed]
[2009/08/21 00:41:44 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION
[2012/04/25 14:06:30 | 000,097,208 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012/02/16 06:42:53 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/02/16 06:42:53 | 000,002,040 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\twitter.xml

O1 HOSTS File: ([2012/05/13 16:24:23 | 000,000,027 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O4 - HKLM..\Run: [AirPort Base Station Agent] C:\Program Files\AirPort\APAgent.exe (Apple Inc.)
O4 - HKLM..\Run: [AlcWzrd] C:\WINDOWS\ALCWZRD.EXE (RealTek Semicoductor Corp.)
O4 - HKLM..\Run: [egui] C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe (ESET)
O4 - HKLM..\Run: [High Definition Audio Property Page Shortcut] C:\WINDOWS\System32\Hdaudpropshortcut.exe (Windows ® Server 2003 DDK provider)
O4 - HKLM..\Run: [LogitechQuickCamRibbon] C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe ()
O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
O4 - HKCU..\Run: C:\Documents and Settings\Owner\Local Settings\Application Data\Sun\Help\hlvpvugpx.dll (Samsung Printer)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} http://www.apple.com/qtactivex/qtplugin.cab (Reg Error: Key error.)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/…b?1169705253312 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdat…b?1240972999800 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0_02)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0017-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0_02)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Java Plug-in 1.7.0_02)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{3927DF1E-CE09-4489-BA32-6E78017C63DC}: DhcpNameServer = 192.168.2.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - (igfxsrvc.dll) - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/08/26 14:04:39 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2003/08/08 17:24:26 | 000,000,045 | -HS- | M] () - D:\autorun.inf.aug.8 – [ FAT32 ]
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (lsdelete)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

NetSvcs: AppMgmt - %SystemRoot%\System32\appmgmts.dll File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: WmdmPmSp - File not found

CREATERESTOREPOINT
Unable to start System Restore Service. Error code 1056

========== Files/Folders - Created Within 30 Days ==========

[2012/05/15 21:09:57 | 000,595,456 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Owner\Desktop\OTL.exe
[2012/05/14 13:39:21 | 000,000,000 | —D | C] – C:\Rooter$
[2012/05/14 13:38:16 | 000,173,119 | —- | C] (Eric_71) – C:\Documents and Settings\Owner\Desktop\Rooter.exe
[2012/05/14 03:58:33 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Desktop\images
[2012/05/13 16:29:09 | 000,000,000 | —D | C] – C:\WINDOWS\temp
[2012/05/13 14:04:51 | 002,075,184 | —- | C] (Kaspersky Lab ZAO) – C:\Documents and Settings\Owner\Desktop\TDSSKiller.exe
[2012/05/11 21:31:14 | 000,000,000 | —D | C] – C:\TDSSKiller_Quarantine
[2012/05/11 21:27:47 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Desktop\GooredFix Backups
[2012/05/11 21:26:50 | 000,071,398 | —- | C] (jpshortstuff) – C:\Documents and Settings\Owner\Desktop\GooredFix.exe
[2012/05/11 19:28:46 | 000,518,144 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2012/05/11 19:28:46 | 000,406,528 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2012/05/11 19:28:46 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2012/05/11 19:28:46 | 000,060,416 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2012/05/11 19:26:04 | 004,490,638 | R— | C] (Swearware) – C:\Documents and Settings\Owner\Desktop\ComboFix.exe
[2012/05/10 23:48:12 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Desktop\Born
[2012/05/09 14:35:23 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Desktop\Uneedit
[2012/04/28 12:48:03 | 000,000,000 | —D | C] – C:\Program Files\ESET
[2012/04/28 12:48:03 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\ESET
[2012/04/28 12:48:03 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\ESET
[2012/04/25 14:06:50 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Mozilla
[2012/04/25 14:06:49 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Maintenance Service
[2 C:\Documents and Settings\Owner\Desktop\*.tmp files -> C:\Documents and Settings\Owner\Desktop\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/05/15 21:10:16 | 000,595,456 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Owner\Desktop\OTL.exe
[2012/05/15 03:02:55 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2012/05/15 03:02:54 | 508,608,512 | -HS- | M] () – C:\hiberfil.sys
[2012/05/14 13:38:16 | 000,173,119 | —- | M] (Eric_71) – C:\Documents and Settings\Owner\Desktop\Rooter.exe
[2012/05/14 13:31:45 | 000,139,264 | —- | M] () – C:\Documents and Settings\Owner\Desktop\SystemLook.exe
[2012/05/14 03:59:08 | 000,030,156 | —- | M] () – C:\Documents and Settings\Owner\Desktop\tumblr_lr24ybkKbw1r2dxnxo1_500.jpg
[2012/05/14 03:58:33 | 000,000,417 | —- | M] () – C:\Documents and Settings\Owner\Desktop\tumblr_lr24ybkKbw1r2dxnxo1.html
[2012/05/14 01:19:19 | 000,017,408 | —- | M] () – C:\Documents and Settings\Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/05/13 16:24:23 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2012/05/13 14:03:52 | 002,055,783 | —- | M] () – C:\Documents and Settings\Owner\Desktop\tdsskiller.zip
[2012/05/12 15:43:59 | 000,002,353 | —- | M] () – C:\Picture 73.jpg
[2012/05/12 15:29:57 | 000,375,784 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2012/05/12 15:29:57 | 000,060,682 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2012/05/12 15:17:57 | 000,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2012/05/11 21:26:51 | 000,071,398 | —- | M] (jpshortstuff) – C:\Documents and Settings\Owner\Desktop\GooredFix.exe
[2012/05/11 19:26:47 | 004,490,638 | R— | M] (Swearware) – C:\Documents and Settings\Owner\Desktop\ComboFix.exe
[2012/05/10 00:30:46 | 000,410,288 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2012/05/08 11:36:57 | 000,483,171 | —- | M] () – C:\Documents and Settings\Owner\Desktop\DSC_0020.jpg
[2012/05/08 11:36:40 | 000,837,535 | —- | M] () – C:\Documents and Settings\Owner\Desktop\DSC_0027.jpg
[2012/05/03 23:58:15 | 000,012,599 | —- | M] () – C:\Picture 72.jpg
[2012/05/02 10:00:04 | 002,075,184 | —- | M] (Kaspersky Lab ZAO) – C:\Documents and Settings\Owner\Desktop\TDSSKiller.exe
[2012/05/01 22:40:30 | 000,000,784 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012/05/01 16:26:31 | 000,000,000 | —- | M] () – C:\WINDOWS\System32\drivers\lvuvc.hs
[2012/05/01 14:24:22 | 000,000,000 | —- | M] () – C:\WINDOWS\System32\drivers\logiflt.iad
[2012/04/27 04:06:02 | 005,454,470 | —- | M] () – C:\Documents and Settings\Owner\My Documents\Video 35.wmv
[2012/04/24 22:18:29 | 000,018,383 | —- | M] () – C:\Documents and Settings\Owner\Desktop\IDdi.jpg
[2 C:\Documents and Settings\Owner\Desktop\*.tmp files -> C:\Documents and Settings\Owner\Desktop\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/05/14 13:31:44 | 000,139,264 | —- | C] () – C:\Documents and Settings\Owner\Desktop\SystemLook.exe
[2012/05/14 03:59:01 | 000,030,156 | —- | C] () – C:\Documents and Settings\Owner\Desktop\tumblr_lr24ybkKbw1r2dxnxo1_500.jpg
[2012/05/14 03:58:33 | 000,000,417 | —- | C] () – C:\Documents and Settings\Owner\Desktop\tumblr_lr24ybkKbw1r2dxnxo1.html
[2012/05/13 21:21:12 | 001,593,741 | —- | C] () – C:\Documents and Settings\Owner\My Documents\Grandkids 064.jpg
[2012/05/13 21:20:54 | 002,553,847 | —- | C] () – C:\Documents and Settings\Owner\My Documents\Grandkids 102.jpg
[2012/05/13 21:20:35 | 002,525,665 | —- | C] () – C:\Documents and Settings\Owner\My Documents\Grandkids 100.jpg
[2012/05/13 21:20:23 | 002,741,360 | —- | C] () – C:\Documents and Settings\Owner\My Documents\Grandkids 099.jpg
[2012/05/13 21:19:22 | 001,499,378 | —- | C] () – C:\Documents and Settings\Owner\My Documents\DSC_0005.JPG
[2012/05/13 21:19:13 | 002,890,408 | —- | C] () – C:\Documents and Settings\Owner\My Documents\DSC_0002.JPG
[2012/05/13 18:18:21 | 508,608,512 | -HS- | C] () – C:\hiberfil.sys
[2012/05/13 14:03:34 | 002,055,783 | —- | C] () – C:\Documents and Settings\Owner\Desktop\tdsskiller.zip
[2012/05/12 15:43:59 | 000,002,353 | —- | C] () – C:\Picture 73.jpg
[2012/05/12 15:34:26 | 000,302,592 | —- | C] () – C:\Documents and Settings\Owner\Desktop\gmer.exe
[2012/05/11 19:28:46 | 000,256,000 | —- | C] () – C:\WINDOWS\PEV.exe
[2012/05/11 19:28:46 | 000,208,896 | —- | C] () – C:\WINDOWS\MBR.exe
[2012/05/11 19:28:46 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2012/05/11 19:28:46 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2012/05/11 19:28:46 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2012/05/08 11:36:51 | 000,483,171 | —- | C] () – C:\Documents and Settings\Owner\Desktop\DSC_0020.jpg
[2012/05/08 11:36:31 | 000,837,535 | —- | C] () – C:\Documents and Settings\Owner\Desktop\DSC_0027.jpg
[2012/05/03 23:58:15 | 000,012,599 | —- | C] () – C:\Picture 72.jpg
[2012/04/30 17:34:01 | 005,454,470 | —- | C] () – C:\Documents and Settings\Owner\My Documents\Video 35.wmv
[2012/04/24 22:18:29 | 000,018,383 | —- | C] () – C:\Documents and Settings\Owner\Desktop\IDdi.jpg
[2012/01/08 01:46:19 | 000,003,960 | -HS- | C] () – C:\Documents and Settings\All Users\Application Data\tg2241df7qlm73d86m436gn8m8y1hmqoy104oqcv2y87vy
[2011/12/17 16:28:22 | 000,095,232 | —- | C] () – C:\WINDOWS\System32\LFKODAK.DLL
[2011/12/17 16:28:21 | 000,306,688 | —- | C] () – C:\WINDOWS\System32\LFFPX7.DLL
[2011/12/17 16:27:48 | 000,044,544 | —- | C] () – C:\WINDOWS\System32\gif89.dll
[2011/12/17 16:26:45 | 000,000,065 | —- | C] () – C:\WINDOWS\SIERRA.INI
[2011/05/29 22:10:20 | 000,004,360 | -HS- | C] () – C:\Documents and Settings\All Users\Application Data\5tj76a8lhem5hw5065kc0t1ls4prx67h17ci0hn6l4qr
[2011/05/28 00:51:55 | 000,011,424 | -HS- | C] () – C:\Documents and Settings\All Users\Application Data\lrw1w302ja8i6ne
[2010/07/25 05:01:40 | 000,000,664 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat

========== LOP Check ==========

[2012/04/12 00:08:58 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AVAST Software
[2009/07/15 21:52:43 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\CanonBJ
[2012/03/06 00:24:39 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Driver Tool
[2012/04/28 12:48:03 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\ESET
[2005/07/01 00:45:28 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Aim
[2012/02/06 03:43:49 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Blackboard
[2012/02/06 03:15:48 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Collaborate
[2012/02/22 04:10:53 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\ImgBurn
[2005/06/30 02:18:26 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\MSNInstaller
[2005/11/14 03:18:51 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Netscape
[2010/05/08 06:11:46 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\SampleView
[2005/06/28 04:16:15 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Template

========== Purity Check ==========



========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >

< MD5 for: AGP440.SYS >
[2004/08/04 15:00:00 | 018,738,937 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2008/09/26 05:23:36 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2004/08/04 15:00:00 | 018,738,937 | —- | M] () .cab file – C:\WINDOWS\I386\sp2.cab:AGP440.sys
[2008/09/26 05:23:36 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
[2008/04/13 14:36:38 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 – C:\WINDOWS\ERDNT\cache\agp440.sys
[2008/04/13 14:36:38 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 – C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008/04/13 14:36:38 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 – C:\WINDOWS\system32\drivers\agp440.sys
[2004/08/04 09:07:42 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB – C:\WINDOWS\$NtServicePackUninstall$\agp440.sys

< MD5 for: ATAPI.SYS >
[2004/08/04 15:00:00 | 018,738,937 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2008/09/26 05:23:36 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2004/08/04 15:00:00 | 018,738,937 | —- | M] () .cab file – C:\WINDOWS\I386\sp2.cab:atapi.sys
[2008/09/26 05:23:36 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2008/04/13 14:40:30 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\ERDNT\cache\atapi.sys
[2008/04/13 14:40:30 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008/04/13 14:40:30 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\system32\drivers\atapi.sys
[2004/08/04 08:59:44 | 000,095,360 | —- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 – C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
[2004/08/04 08:59:44 | 000,095,360 | —- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 – C:\WINDOWS\system32\ReinstallBackups\0002\DriverFiles\i386\atapi.sys
[2004/08/04 02:59:44 | 000,095,360 | —- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 – C:\WINDOWS\system32\ReinstallBackups\0013\DriverFiles\i386\atapi.sys

< MD5 for: EVENTLOG.DLL >
[2008/04/13 20:11:53 | 000,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\ERDNT\cache\eventlog.dll
[2008/04/13 20:11:53 | 000,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008/04/13 20:11:53 | 000,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\system32\eventlog.dll
[2004/08/04 15:00:00 | 000,055,808 | —- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 – C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll

< MD5 for: NETLOGON.DLL >
[2008/04/13 20:12:01 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\ERDNT\cache\netlogon.dll
[2008/04/13 20:12:01 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008/04/13 20:12:01 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\system32\netlogon.dll
[2004/08/04 15:00:00 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A – C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll

< MD5 for: SCECLI.DLL >
[2004/08/04 15:00:00 | 000,180,224 | —- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A – C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
[2008/04/13 20:12:05 | 000,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\ERDNT\cache\scecli.dll
[2008/04/13 20:12:05 | 000,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008/04/13 20:12:05 | 000,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\system32\scecli.dll

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2004/08/26 06:53:19 | 000,094,208 | —- | M] () – C:\WINDOWS\System32\config\default.sav
[2004/08/26 06:53:18 | 000,634,880 | —- | M] () – C:\WINDOWS\System32\config\software.sav
[2004/08/26 06:53:18 | 000,864,256 | —- | M] () – C:\WINDOWS\System32\config\system.sav

< %systemroot%\system32\drivers\*.sys /90 >
[2012/04/04 15:56:40 | 000,022,344 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\system32\drivers\mbam.sys

========== Files - Unicode (All) ==========
[2006/08/11 05:21:31 | 000,000,000 | —D | M](C:\Do????nts and Settings) – C:\Doጓᐔᐔጓnts and Settings
[2006/08/11 05:21:31 | 000,000,000 | —D | C](C:\Do????nts and Settings) – C:\Doጓᐔᐔጓnts and Settings

========== Alternate Data Streams ==========

@Alternate Data Stream - 304 bytes -> C:\Documents and Settings\Owner\My Documents\NewButt.jpg:SummaryInformation
@Alternate Data Stream - 304 bytes -> C:\Documents and Settings\Owner\My Documents\MER.png:SummaryInformation
@Alternate Data Stream - 304 bytes -> C:\Documents and Settings\Owner\My Documents\Dwntwn2.JPG:SummaryInformation
@Alternate Data Stream - 304 bytes -> C:\Documents and Settings\Owner\My Documents\DBR.png:SummaryInformation
@Alternate Data Stream - 304 bytes -> C:\Documents and Settings\Owner\My Documents\DBR.jpg:SummaryInformation
@Alternate Data Stream - 304 bytes -> C:\Documents and Settings\Owner\My Documents\Buttss.jpg:SummaryInformation
@Alternate Data Stream - 304 bytes -> C:\Documents and Settings\Owner\My Documents\ButtProject1.jpg:SummaryInformation
@Alternate Data Stream - 304 bytes -> C:\Documents and Settings\Owner\My Documents\Buttoc.jpg:SummaryInformation
@Alternate Data Stream - 304 bytes -> C:\Documents and Settings\Owner\My Documents\buProject1.jpg:SummaryInformation
@Alternate Data Stream - 304 bytes -> C:\Documents and Settings\Owner\My Documents\Bribriii.jpg:SummaryInformation
@Alternate Data Stream - 304 bytes -> C:\Documents and Settings\Owner\My Documents\BBBBBB.jpg:SummaryInformation
@Alternate Data Stream - 304 bytes -> C:\Documents and Settings\Owner\My Documents\BBB.jpg:SummaryInformation
@Alternate Data Stream - 304 bytes -> C:\Documents and Settings\Owner\My Documents\BB.jpg:SummaryInformation

< End of report >

OTL Extras logfile created on: 5/15/2012 9:11:44 PM - Run 1
OTL by OldTimer - Version 3.2.43.0 Folder = C:\Documents and Settings\Owner\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

484.98 Mb Total Physical Memory | 232.07 Mb Available Physical Memory | 47.85% Memory free
1.13 Gb Paging File | 0.87 Gb Available in Paging File | 76.82% Paging File free
Paging file location(s): C:\pagefile.sys 756 1512 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 144.83 Gb Total Space | 43.02 Gb Free Space | 29.71% Space Free | Partition Type: NTFS
Drive D: | 4.20 Gb Total Space | 1.68 Gb Free Space | 39.89% Space Free | Partition Type: FAT32
Drive H: | 1.90 Gb Total Space | 1.44 Gb Free Space | 75.68% Space Free | Partition Type: FAT

Computer Name: RYAN | User Name: Owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.url [@ = InternetShortcut] – rundll32.exe shdocvw.dll,OpenURL %l

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] – "%1" %*
htmlfile – Reg Error: Key error.
InternetShortcut [open] – rundll32.exe shdocvw.dll,OpenURL %l
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] – "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file –playlist-enqueue "%1" ()
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] – "C:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file –no-playlist-enqueue "%1" ()
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"UpdatesDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"AntiVirusOverride" = 1
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DoNotAllowExceptions" = 0
"DisableNotifications" = 1
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"5353:UDP" = 5353:UDP:*:Enabled:Bonjour

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" = C:\Program Files\Common Files\AOL\ACS\AOLDial.exe:*:Enabled:AOL
"C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe" = C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe:*:Enabled:AOL
"C:\Program Files\America Online 9.0\waol.exe" = C:\Program Files\America Online 9.0\waol.exe:*:Enabled:America Online 9.0 – (America Online, Inc.)
"C:\Program Files\AIM\aim.exe" = C:\Program Files\AIM\aim.exe:*:Enabled:AOL Instant Messenger
"C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger
"C:\Program Files\MSN Messenger\livecall.exe" = C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\WINDOWS\system32\dpvsetup.exe" = C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test – (Microsoft Corporation)
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" = C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger – (Yahoo! Inc.)
"C:\Program Files\VideoLAN\VLC\vlc.exe" = C:\Program Files\VideoLAN\VLC\vlc.exe:*:Enabled:VLC media player – ()
"C:\Program Files\Java\jre6\launch4j-tmp\JDownloader.exe" = C:\Program Files\Java\jre6\launch4j-tmp\JDownloader.exe:*:Enabled:Java™ Platform SE binary – (Sun Microsystems, Inc.)
"C:\Program Files\America Online 9.0\waol.exe" = C:\Program Files\America Online 9.0\waol.exe:*:Disabled:America Online 9.0 – (America Online, Inc.)
"C:\Program Files\AirPort\APAgent.exe" = C:\Program Files\AirPort\APAgent.exe:*:Enabled:APAgent – (Apple Inc.)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0611BD4E-4FE4-4a62-B0C0-18A4CC463428}" = CP_Package_Variety1
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_iP6310D" = Canon iP6310D
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP180" = Canon MP180
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP250_series" = Canon MP250 series MP Drivers
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{1C139D7D-9FEA-468d-A9C8-2A6E3BDE564A}" = CP_Package_Variety3
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83217002FF}" = Java™ 7 Update 2
"{281D28EC-1357-4778-B2D7-DEA56D70EF96}" = Logitech High Quality Video
"{2DFF31F9-7893-4922-AF66-C9A1EB4EBB31}" = Rhapsody Player Engine
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3A316611-45D1-429C-AA26-B71259C44689}" = HP Photosmart, Officejet and Deskjet 7.0.A
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{53EE9E42-CECB-4C92-BF76-9CA65DAF8F1C}" = FullDPAppQFolder
"{5421155F-B033-49DB-9B33-8F80F233D4D5}" = GdiplusUpgrade
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{56F8AFC3-FA98-4ff1-9673-8A026CBF85BE}" = WebReg
"{63569CE9-FA00-469C-AF5C-E5D4D93ACF91}" = Windows Genuine Advantage v1.3.0254.0
"{64635543-70E7-436D-8D6D-4A721595029E}" = Microsoft IntelliPoint 5.2
"{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder
"{67317F3C-4B7B-4CE7-B0F6-2157EA019C46}" = AirPort
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{74EC78BC-B379-4E29-9006-8F161DCAABA6}" = Apple Software Update
"{76EFFC7C-17A6-479D-9E47-8E658C1695AE}" = Windows Backup Utility
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{7C03270C-4FAB-4F5C-B10D-52FEDA190790}" = DocumentViewerQFolder
"{81EED1A1-AE78-4B11-BE47-C6AE9F5E87F1}" = Digital Media Reader
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel® Graphics Media Accelerator Driver
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A66242A1-9101-425D-9BE5-D19A50E1D0D8}" = ESET NOD32 Antivirus
"{A8F2089B-1F79-4BF6-B385-A2C2B0B9A74D}" = ImagXpress
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1033-7B44-A81200000003}" = Adobe Reader 8.1.2
"{AC96671C-2001-432C-9826-5266D84EF1DC}" = Logitech Webcam Software
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{B824B5C9-849F-4b9e-9EA7-6FD8CD8116DA}" = CP_Package_Variety2
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C544F99D-39EF-4E6D-95BE-4E41C1D8C4CB}" = Dr Watson for Microsoft Windows OneCare Live v1.1.1067.14
"{C8753E28-2680-49BF-BD48-DD38FD086EFE}" = AiO_Scan_CDA
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D050D7362D214723AD585B541FFB6C11}" = DivX Content Uploader
"{E2883E8F-472F-4fb0-9522-AC9BF37916A7}" = Adobe Download Manager
"{E503B4BF-F7BB-3D5F-8BC8-F694B1CFF942}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022.218
"{EA103B64-C0E4-4C0E-A506-751590E1653D}" = SolutionCenter
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"{F3760724-B29D-465B-BC53-E5D72095BCC4}" = Scan
"{FF262740-C85A-11D5-BBEC-00D0B740900A}" = Multimedia Keyboard Driver
"AC3File" = AC3File (remove only)
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Photoshop 7.0.1" = Adobe Photoshop 7.0.1
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Adobe SVG Viewer" = Adobe SVG Viewer 3.0
"Advanced Video FX Utility" = Advanced Video FX Utility
"AVIcodec" = AVIcodec (remove only)
"BtcMaestro" = HP Multimedia Keyboard Driver V2.0.W-137A9 MUL
"CNXT_MODEM_PCI_VEN_14F1&DEV_2F20&SUBSYS_200014F1" = SoftV92 Data Fax Modem with SmartCP
"Creative PD0620" = Creative WebCam Instant Driver (1.01.02.0729)
"DVD Flick_is1" = DVD Flick 1.3.0.7
"Get Yahoo! Messenger" = Get Yahoo! Messenger
"HijackThis" = HijackThis 1.99.1
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ImgBurn" = ImgBurn
"InstallShield_{81EED1A1-AE78-4B11-BE47-C6AE9F5E87F1}" = Digital Media Reader
"legacyqcam_10.50" = Logitech Legacy USB Camera Driver Package
"lvdrivers_12.0" = Logitech Webcam Software Driver Package
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.61.0.1400
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox 12.0 (x86 en-US)" = Mozilla Firefox 12.0 (x86 en-US)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"MSN Music Assistant" = MSN Music Assistant
"MSNINST" = MSN
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"Office8.0" = Microsoft Office 97, Professional Edition
"PROSet" = Intel® PRO Network Adapters and Drivers
"SecureVideo Plug-in_is1" = SecureVideo Plug-in
"VLC media player" = VLC media player 1.1.10
"Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
"WebCam Instant Product Registration" = WebCam Instant Product Registration
"WIC" = Windows Imaging Component
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinRAR archiver" = WinRAR archiver
"WinZip" = WinZip
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"WMV9_VCM" = Microsoft Windows Media Video 9 VCM
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"Yahoo! Messenger" = Yahoo! Messenger
"Yahoo! Software Update" = Yahoo! Software Update

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 4/26/2012 12:11:58 PM | Computer Name = RYAN | Source = MsiInstaller | ID = 11404
Description = Product: ESET NOD32 Antivirus – Error 1404. Could not delete key
\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe.
System error . Verify that you have sufficient access to that key, or contact
your support personnel.

Error - 4/26/2012 12:11:59 PM | Computer Name = RYAN | Source = MsiInstaller | ID = 11404
Description = Product: ESET NOD32 Antivirus – Error 1404. Could not delete key
\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe.
System error . Verify that you have sufficient access to that key, or contact
your support personnel.

Error - 4/26/2012 12:12:02 PM | Computer Name = RYAN | Source = MsiInstaller | ID = 11404
Description = Product: ESET NOD32 Antivirus – Error 1404. Could not delete key
\Software\ESET\ESET Security. System error . Verify that you have sufficient access
to that key, or contact your support personnel.

Error - 4/27/2012 8:30:38 PM | Computer Name = RYAN | Source = Application Error | ID = 1000
Description = Faulting application logonui.exe, version 6.0.2900.5512, faulting
module msgina.dll, version 5.1.2600.5512, fault address 0x0000e806.

Error - 4/30/2012 1:18:54 PM | Computer Name = RYAN | Source = Application Hang | ID = 1002
Description = Hanging application explorer.exe, version 6.0.2900.5512, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 4/30/2012 1:18:55 PM | Computer Name = RYAN | Source = Application Hang | ID = 1002
Description = Hanging application explorer.exe, version 6.0.2900.5512, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 4/30/2012 1:18:55 PM | Computer Name = RYAN | Source = Application Hang | ID = 1002
Description = Hanging application explorer.exe, version 6.0.2900.5512, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 4/30/2012 2:08:28 PM | Computer Name = RYAN | Source = Application Hang | ID = 1002
Description = Hanging application LWS.exe, version 12.0.1280.0, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 5/11/2012 4:01:28 PM | Computer Name = RYAN | Source = Application Hang | ID = 1002
Description = Hanging application vlc.exe, version 1.1.10.0, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 5/12/2012 4:55:54 PM | Computer Name = RYAN | Source = Application Hang | ID = 1002
Description = Hanging application gmer.exe, version 1.0.15.15641, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

[ OSession Events ]
Error - 6/27/2009 2:06:13 AM | Computer Name = RYAN | Source = Microsoft Office 12 Sessions | ID = 7001
Description =

[ System Events ]
Error - 5/13/2012 9:35:57 PM | Computer Name = RYAN | Source = Service Control Manager | ID = 7000
Description = The Google Update Service (gupdate) service failed to start due to
the following error: %%2

Error - 5/13/2012 9:36:08 PM | Computer Name = RYAN | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
nvport

Error - 5/13/2012 10:02:19 PM | Computer Name = RYAN | Source = DCOM | ID = 10000
Description = Unable to start a DCOM Server: {4CB43D7F-7EEE-4906-8698-60DA1C38F2FE}.
The
error: "%2" Happened while starting this command: C:\WINDOWS\system32\DllHost.exe
/Processid:{B366DEBE-645B-43A5-B865-DDD82C345492}

Error - 5/14/2012 10:10:31 PM | Computer Name = RYAN | Source = DCOM | ID = 10000
Description = Unable to start a DCOM Server: {4CB43D7F-7EEE-4906-8698-60DA1C38F2FE}.
The
error: "%2" Happened while starting this command: C:\WINDOWS\system32\DllHost.exe
/Processid:{B366DEBE-645B-43A5-B865-DDD82C345492}

Error - 5/15/2012 3:02:57 AM | Computer Name = RYAN | Source = Dhcp | ID = 1002
Description = The IP address lease 192.168.2.3 for the Network Card with network
address 0011119E62E2 has been denied by the DHCP server 192.168.2.1 (The DHCP Server
sent a DHCPNACK message).

Error - 5/15/2012 3:03:12 AM | Computer Name = RYAN | Source = Service Control Manager | ID = 7000
Description = The Google Update Service (gupdate) service failed to start due to
the following error: %%2

Error - 5/15/2012 3:03:22 AM | Computer Name = RYAN | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
nvport

Error - 5/15/2012 3:11:31 AM | Computer Name = RYAN | Source = DCOM | ID = 10000
Description = Unable to start a DCOM Server: {4CB43D7F-7EEE-4906-8698-60DA1C38F2FE}.
The
error: "%2" Happened while starting this command: C:\WINDOWS\system32\DllHost.exe
/Processid:{B366DEBE-645B-43A5-B865-DDD82C345492}

Error - 5/15/2012 9:07:41 PM | Computer Name = RYAN | Source = Service Control Manager | ID = 7011
Description = Timeout (30000 milliseconds) waiting for a transaction response from
the Netman service.

Error - 5/15/2012 9:13:20 PM | Computer Name = RYAN | Source = DCOM | ID = 10005
Description = DCOM got error "%1058" attempting to start the service MDM with arguments
"" in order to run the server: {0C0A3666-30C9-11D0-8F20-00805F2CD064}


< End of report >

Ok, here is the log for OTL.

Just a note: almost every time I have shut down my computer, the "not responding window" has popped up for the rundll32 program or whatever it is. It also happened with the reboot for OTL and I had to click the End Now button. I just wanted to make sure it didn't affect anything or the cleaning of files.

Thanks
Ryan

All processes killed
========== OTL ==========
No active process named explorer.exe was found!
Prefs.js: 4 removed from network.proxy.type
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\Help deleted successfully.
C:\Documents and Settings\Owner\Local Settings\Application Data\Sun\Help\hlvpvugpx.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Infodelivery\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Restrictions\ deleted successfully.
Registry key HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel\ deleted successfully.
Starting removal of ActiveX control {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B}
C:\WINDOWS\Downloaded Program Files\QTPlugin.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{02BF25D5-8C17-4B23-BC80-D3488ABDDC6B}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02BF25D5-8C17-4B23-BC80-D3488ABDDC6B}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{02BF25D5-8C17-4B23-BC80-D3488ABDDC6B}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02BF25D5-8C17-4B23-BC80-D3488ABDDC6B}\ not found.
Starting removal of ActiveX control {8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
C:\WINDOWS\Downloaded Program Files\erma.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
C:\Documents and Settings\All Users\Application Data\tg2241df7qlm73d86m436gn8m8y1hmqoy104oqcv2y87vy moved successfully.
C:\Documents and Settings\All Users\Application Data\5tj76a8lhem5hw5065kc0t1ls4prx67h17ci0hn6l4qr moved successfully.
C:\Documents and Settings\All Users\Application Data\lrw1w302ja8i6ne moved successfully.
C:\Documents and Settings\Owner\Desktop\~WRL3302.tmp deleted successfully.
C:\Documents and Settings\Owner\Desktop\~WRL3670.tmp deleted successfully.
ADS C:\Documents and Settings\Owner\My Documents\NewButt.jpg:SummaryInformation deleted successfully.
ADS C:\Documents and Settings\Owner\My Documents\MER.png:SummaryInformation deleted successfully.
ADS C:\Documents and Settings\Owner\My Documents\Dwntwn2.JPG:SummaryInformation deleted successfully.
ADS C:\Documents and Settings\Owner\My Documents\DBR.png:SummaryInformation deleted successfully.
ADS C:\Documents and Settings\Owner\My Documents\DBR.jpg:SummaryInformation deleted successfully.
ADS C:\Documents and Settings\Owner\My Documents\Buttss.jpg:SummaryInformation deleted successfully.
ADS C:\Documents and Settings\Owner\My Documents\ButtProject1.jpg:SummaryInformation deleted successfully.
ADS C:\Documents and Settings\Owner\My Documents\Buttoc.jpg:SummaryInformation deleted successfully.
ADS C:\Documents and Settings\Owner\My Documents\buProject1.jpg:SummaryInformation deleted successfully.
ADS C:\Documents and Settings\Owner\My Documents\Bribriii.jpg:SummaryInformation deleted successfully.
ADS C:\Documents and Settings\Owner\My Documents\BBBBBB.jpg:SummaryInformation deleted successfully.
ADS C:\Documents and Settings\Owner\My Documents\BBB.jpg:SummaryInformation deleted successfully.
ADS C:\Documents and Settings\Owner\My Documents\BB.jpg:SummaryInformation deleted successfully.
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Documents and Settings\Owner\Desktop\cmd.bat deleted successfully.
C:\Documents and Settings\Owner\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Administrator.RYAN
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Guest
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Flash cache emptied: 0 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Owner
->Temp folder emptied: 1569249 bytes
->Temporary Internet Files folder emptied: 3236519 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 142922333 bytes
->Flash cache emptied: 90509 bytes

User: RyRy
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 664 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 141.00 mb


[EMPTYFLASH]

User: Administrator

User: Administrator.RYAN
->Flash cache emptied: 0 bytes

User: All Users

User: Default User

User: Guest
->Flash cache emptied: 0 bytes

User: LocalService
->Flash cache emptied: 0 bytes

User: NetworkService

User: Owner
->Flash cache emptied: 0 bytes

User: RyRy
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb


OTL by OldTimer - Version 3.2.43.0 log created on 05162012_132442

Files\Folders moved on Reboot…

Registry entries deleted on Reboot…