Spyware / Malware / Virus Removal

Win32:Rootkit-gen [Rtk] Removal

3 min read

Looking for the outcome? Ask AI

Deleted Member Topic Starter

Post #1August 14, 2012, 9:47 AM UTC

Hello…
Avast has picked up Win32:Rootkit-gen [Rtk] and cannot remove it. Also while downloading the necessary tools suggested to help remove infections such as Malwarebytes, it will not download. Thank you…

Also, a folder was detected in my Windows Folder called X…

I am unable to download HiJackThis as well, but I was able to run an OTL Scan with the parameters mentioned below

Download OTL to your desktop.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Check the boxes beside LOP Check and Purity Check.
Under Custom Scan paste this in

netsvcs
drivers32
%SYSTEMDRIVE%\*.*
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\Fonts\*.exe
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.jpg
%systemroot%\*.png
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\System32\config\*.sav
%PROGRAMFILES%\bak. /s
%systemroot%\system32\bak. /s
%ALLUSERSPROFILE%\Start Menu\*.lnk /x
%systemroot%\system32\config\systemprofile\*.dat /x
%systemroot%\*.config
%systemroot%\system32\*.db
%PROGRAMFILES%\Internet Explorer\*.dat
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
%USERPROFILE%\Desktop\*.exe
%PROGRAMFILES%\Common Files\*.*
%systemroot%\*.src
%systemroot%\install\*.*
%systemroot%\system32\DLL\*.*
%systemroot%\system32\HelpFiles\*.*
%systemroot%\system32\rundll\*.*
%systemroot%\winn32\*.*
%systemroot%\Java\*.*
%systemroot%\system32\test\*.*
%systemroot%\system32\Rundll32\*.*
%systemroot%\AppPatch\Custom\*.*
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs

Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
You may need two posts to fit them both in.

HERE IS A RESULT OF THAT SCAN…

OTL.TXT

OTL logfile created on: 8/14/2012 5:32:47 AM - Run 1
OTL by OldTimer - Version 3.2.57.0 Folder = C:\Documents and Settings\Mamoo\Desktop
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1015.17 Mb Total Physical Memory | 401.87 Mb Available Physical Memory | 39.59% Memory free
2.39 Gb Paging File | 1.80 Gb Available in Paging File | 75.36% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 27.94 Gb Total Space | 24.11 Gb Free Space | 86.29% Space Free | Partition Type: NTFS
Drive E: | 7.46 Gb Total Space | 1.64 Gb Free Space | 21.99% Space Free | Partition Type: NTFS

Computer Name: SPARKTECH | User Name: Mamoo | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Mamoo\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Documents and Settings\Mamoo\Local Settings\Application Data\Google\Chrome\Application\chrome.exe (Google Inc.)
PRC - C:\Program Files\AVAST Software\Avast\AvastUI.exe (AVAST Software)
PRC - C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
PRC - C:\WINDOWS\ATK0100\ATKOSD.exe ()
PRC - C:\WINDOWS\ATK0100\HControl.exe ()
PRC - C:\Program Files\Belkin\F5D9050\Belkinwcui.exe (Belkin)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)

========== Modules (No Company Name) ==========

MOD - C:\Program Files\AVAST Software\Avast\defs\12081301\algo.dll ()
MOD - C:\Documents and Settings\Mamoo\Local Settings\Application Data\Google\Chrome\Application\21.0.1180.77\ppgooglenaclpluginchrome.dll ()
MOD - C:\Documents and Settings\Mamoo\Local Settings\Application Data\Google\Chrome\Application\21.0.1180.77\PepperFlash\pepflashplayer.dll ()
MOD - C:\Documents and Settings\Mamoo\Local Settings\Application Data\Google\Chrome\Application\21.0.1180.77\pdf.dll ()
MOD - C:\Documents and Settings\Mamoo\Local Settings\Application Data\Google\Chrome\Application\21.0.1180.77\avutil-51.dll ()
MOD - C:\Documents and Settings\Mamoo\Local Settings\Application Data\Google\Chrome\Application\21.0.1180.77\avformat-54.dll ()
MOD - C:\Documents and Settings\Mamoo\Local Settings\Application Data\Google\Chrome\Application\21.0.1180.77\avcodec-54.dll ()
MOD - C:\Program Files\Unlocker\UnlockerCOM.dll ()
MOD - C:\WINDOWS\ATK0100\ATKOSD.exe ()
MOD - C:\WINDOWS\ATK0100\HControl.exe ()
MOD - C:\Program Files\Belkin\F5D9050\blkwcapi.dll ()
MOD - C:\Program Files\Belkin\F5D9050\BelkinwcuiDLL.dll ()
MOD - C:\Program Files\Belkin\F5D9050\BelkinHWStatus.dll ()
MOD - C:\Program Files\Belkin\F5D9050\Security.dll ()
MOD - C:\WINDOWS\system32\devenum.dll ()
MOD - C:\WINDOWS\system32\msdmo.dll ()
MOD - C:\WINDOWS\ATK0100\CMSSC.dll ()
MOD - C:\WINDOWS\system32\antiwpa.dll ()

========== Win32 Services (SafeList) ==========

SRV - (HidServ) – %SystemRoot%\System32\hidserv.dll File not found
SRV - (avast! Antivirus) – C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)

========== Driver Services (SafeList) ==========

DRV - (WDICA) – File not found
DRV - (PDRFRAME) – File not found
DRV - (PDRELI) – File not found
DRV - (PDFRAME) – File not found
DRV - (PDCOMP) – File not found
DRV - (PCIDump) – File not found
DRV - (lbrtfdc) – File not found
DRV - (i2omgmt) – File not found
DRV - (Changer) – File not found
DRV - (MDC8021X) – C:\WINDOWS\system32\drivers\mdc8021x.sys (Meetinghouse Data Communications)
DRV - (aswTdi) – C:\WINDOWS\System32\drivers\aswTdi.sys (AVAST Software)
DRV - (aswSnx) – C:\WINDOWS\System32\drivers\aswSnx.sys (AVAST Software)
DRV - (aswSP) – C:\WINDOWS\System32\drivers\aswSP.sys (AVAST Software)
DRV - (aswMon2) – C:\WINDOWS\System32\drivers\aswmon2.sys (AVAST Software)
DRV - (AswRdr) – C:\WINDOWS\System32\drivers\aswRdr.sys (AVAST Software)
DRV - (aswFsBlk) – C:\WINDOWS\System32\drivers\aswFsBlk.sys (AVAST Software)
DRV - (Aavmker4) – C:\WINDOWS\System32\drivers\aavmker4.sys (AVAST Software)
DRV - (UnlockerDriver5) – C:\Program Files\Unlocker\UnlockerDriver5.sys ()
DRV - (RT73) – C:\WINDOWS\system32\drivers\rt73.sys (Ralink Technology, Corp.)
DRV - (StreamSurge) – C:\WINDOWS\system32\drivers\ss.sys (WikiTek Inc.)
DRV - (risdptsk) – C:\WINDOWS\system32\drivers\risdptsk.sys (REDC)
DRV - (IntcAzAudAddService) – C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (BCM43XX) – C:\WINDOWS\system32\drivers\BCMWL5.SYS (Broadcom Corporation)
DRV - (rtl8139) – C:\WINDOWS\system32\drivers\RTL8139.sys (Realtek Semiconductor Corporation)
DRV - (BKNDIS5) – C:\Program Files\Belkin\F5D9050\BKNDIS5.sys (Gemtek Technology Co.)
DRV - (MTsensor) – C:\WINDOWS\system32\drivers\ATKACPI.sys ()
DRV - (HSF_DP) – C:\WINDOWS\system32\drivers\HSF_DP.sys (Conexant Systems, Inc.)
DRV - (winachsf) – C:\WINDOWS\system32\drivers\HSF_CNXT.sys (Conexant Systems, Inc.)
DRV - (HSFHWAZL) – C:\WINDOWS\system32\drivers\HSFHWAZL.sys (Conexant Systems, Inc.)
DRV - (HdAudAddService) – C:\WINDOWS\system32\drivers\HdAudio.sys (Windows ® Server 2003 DDK provider)
DRV - (rimsptsk) – C:\WINDOWS\system32\drivers\rimsptsk.sys (REDC)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Documents and Settings\Mamoo\Local Settings\Application Data\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Documents and Settings\Mamoo\Local Settings\Application Data\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)

========== Chrome ==========

CHR - homepage: http://www.google.tt/
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{g
oogle:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms},
CHR - homepage: http://www.google.tt/
CHR - plugin: Shockwave Flash (Enabled) = C:\Documents and Settings\Mamoo\Local Settings\Application Data\Google\Chrome\Application\21.0.1180.75\PepperFlash\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Documents and Settings\Mamoo\Local Settings\Application Data\Google\Chrome\Application\21.0.1180.77\gcswf32.dll
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Documents and Settings\Mamoo\Local Settings\Application Data\Google\Chrome\Application\21.0.1180.77\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Documents and Settings\Mamoo\Local Settings\Application Data\Google\Chrome\Application\21.0.1180.77\pdf.dll
CHR - plugin: Google Update (Enabled) = C:\Documents and Settings\Mamoo\Local Settings\Application Data\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - Extension: WGT Golf Challenge = C:\Documents and Settings\Mamoo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\dcilimldmomiaihcfkmaldanopfejefg\32.1.0_0\
CHR - Extension: Until AM = C:\Documents and Settings\Mamoo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\kodigjkcpaoeodlnmcnekemakpnmegnk\0.203_0\
CHR - Extension: Google Maps = C:\Documents and Settings\Mamoo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\lneaknkopdijkpnocmklfnjbeapigfbh\5.2.4_0\
CHR - Extension: Google Mail Checker = C:\Documents and Settings\Mamoo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\mihcahmgecmbnbcchbopgniflfhgnkff\3.2_0\
CHR - Extension: Gmail = C:\Documents and Settings\Mamoo\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

O1 HOSTS File: ([2002/12/31 08:00:00 | 000,000,734 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\ALCMTR.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [AlcWzrd] C:\WINDOWS\ALCWZRD.EXE (RealTek Semicoductor Corp.)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [F5D9050] C:\Program Files\Belkin\F5D9050\Belkinwcui.exe (Belkin)
O4 - HKLM..\Run: [HControl] C:\WINDOWS\ATK0100\HControl.exe ()
O4 - HKLM..\Run: [High Definition Audio Property Page Shortcut] C:\WINDOWS\System32\HDAShCut.exe (Windows ® Server 2003 DDK provider)
O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [UIUCU] C:\DOCUME~1\Mamoo\LOCALS~1\Temp\UIUCU.EXE -CLEAN_UP File not found
O4 - HKLM..\Run: [UIUCU2] C:\DOCUME~1\Mamoo\LOCALS~1\Temp\UIUCU2.EXE -CLEAN_UP2 File not found
O4 - HKCU..\Run: [DriverMax] File not found
O4 - HKCU..\Run: [DriverMax_RESTART] File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: ConfirmFileDelete = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktopCleanupWizard = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableStatusMessages = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMHelp = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMConfigurePrograms = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoInternetIcon = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSharedDocuments = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoWindowsUpdate = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveTrack = 1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{57BEA84D-BC71-42F1-AC6B-D97025A820A9}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FCE3DB3E-208A-4744-ABD9-4369CE65A3AB}: NameServer = 196.3.132.153,196.3.132.154
O20 - AppInit_DLLs: (WIKI.DLL) - File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\Antiwpa: DllName - (antiwpa.dll) - C:\WINDOWS\System32\antiwpa.dll ()
O20 - Winlogon\Notify\igfxcui: DllName - (igfxsrvc.dll) - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2012/08/09 16:27:57 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

NetSvcs: 6to4 - File not found
NetSvcs: HidServ - %SystemRoot%\System32\hidserv.dll File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)

CREATERESTOREPOINT
System Restore Service not available.

========== Files/Folders - Created Within 30 Days ==========

[2012/08/14 05:30:06 | 000,596,992 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Mamoo\Desktop\OTL.exe
[2012/08/14 05:25:06 | 000,000,000 | -HSD | C] – C:\System Volume Information
[2012/08/13 18:17:15 | 000,000,000 | —D | C] – C:\Torrents
[2012/08/12 20:01:32 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Mamoo\Recent
[2012/08/11 21:21:04 | 000,000,000 | —D | C] – C:\Documents and Settings\Mamoo\Application Data\FileZilla
[2012/08/11 21:20:54 | 000,000,000 | —D | C] – C:\Documents and Settings\Mamoo\Start Menu\Programs\FileZilla FTP Client
[2012/08/11 21:20:51 | 000,000,000 | —D | C] – C:\Program Files\FileZilla FTP Client
[2012/08/11 14:05:52 | 000,000,000 | —D | C] – C:\WINDOWS\SoftwareDistribution
[2012/08/11 13:52:27 | 000,000,000 | —D | C] – C:\WINDOWS\LastGood
[2012/08/11 13:46:34 | 000,000,000 | —D | C] – C:\Program Files\CONEXANT
[2012/08/11 13:41:18 | 000,051,328 | —- | C] (REDC) – C:\WINDOWS\System32\drivers\rimsptsk.sys
[2012/08/11 13:41:18 | 000,027,136 | —- | C] (REDC) – C:\WINDOWS\System32\drivers\risdptsk.sys
[2012/08/11 13:37:49 | 002,805,248 | R— | C] (RealTek Semicoductor Corp.) – C:\WINDOWS\ALCWZRD.EXE
[2012/08/11 13:37:46 | 000,000,000 | —D | C] – C:\WINDOWS\System32\RTCOM
[2012/08/11 13:37:40 | 000,000,000 | —D | C] – C:\Program Files\Realtek
[2012/08/11 11:47:31 | 000,000,000 | —D | C] – C:\WINDOWS\ATK0100
[2012/08/10 00:07:12 | 000,000,000 | —D | C] – C:\WINDOWS\System32\LogFiles
[2012/08/09 22:43:04 | 000,000,000 | —D | C] – C:\Program Files\Intel
[2012/08/09 22:42:18 | 000,000,000 | —D | C] – C:\WINDOWS\System32\ReinstallBackups
[2012/08/09 22:42:13 | 000,000,000 | -H-D | C] – C:\Program Files\InstallShield Installation Information
[2012/08/09 21:16:35 | 000,000,000 | —D | C] – C:\Documents and Settings\Mamoo\My Documents\Downloads
[2012/08/09 17:40:37 | 000,000,000 | —D | C] – C:\Documents and Settings\Mamoo\Start Menu\Programs\Google Chrome
[2012/08/09 17:31:27 | 000,000,000 | —D | C] – C:\Documents and Settings\Mamoo\Application Data\Macromedia
[2012/08/09 17:31:25 | 000,000,000 | —D | C] – C:\Documents and Settings\Mamoo\Application Data\Adobe
[2012/08/09 17:25:59 | 001,245,184 | —- | C] (Motorola Inc.) – C:\WINDOWS\System32\BCMWLCPL.CPL
[2012/08/09 17:25:43 | 000,163,848 | —- | C] (Motorola Inc.) – C:\WINDOWS\System32\BCMWLU00.EXE
[2012/08/09 17:25:43 | 000,069,640 | —- | C] (Motorola Inc.) – C:\WINDOWS\System32\BCMWLD2K.EXE
[2012/08/09 17:22:29 | 000,000,000 | –SD | C] – C:\WINDOWS\System32\Microsoft
[2012/08/09 17:22:26 | 000,000,000 | —D | C] – C:\Program Files\Google
[2012/08/09 17:22:21 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\avast! Free Antivirus
[2012/08/09 17:22:20 | 000,021,256 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2012/08/09 17:22:19 | 000,353,688 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswSP.sys
[2012/08/09 17:22:14 | 000,054,232 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswTdi.sys
[2012/08/09 17:22:14 | 000,035,928 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswRdr.sys
[2012/08/09 17:22:13 | 000,721,000 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswSnx.sys
[2012/08/09 17:22:12 | 000,097,608 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswmon2.sys
[2012/08/09 17:22:12 | 000,089,624 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswmon.sys
[2012/08/09 17:22:11 | 000,025,256 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aavmker4.sys
[2012/08/09 17:22:07 | 000,000,000 | -H-D | C] – C:\Documents and Settings\Mamoo\Desktop\Apps
[2012/08/09 17:21:50 | 000,245,248 | —- | C] (Ralink Technology, Corp.) – C:\WINDOWS\System32\drivers\rt73.sys
[2012/08/09 17:21:50 | 000,036,864 | —- | C] (WikiTek Inc.) – C:\WINDOWS\System32\ss.dll
[2012/08/09 17:21:50 | 000,019,968 | —- | C] (WikiTek Inc.) – C:\WINDOWS\System32\drivers\ss.sys
[2012/08/09 17:21:49 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Belkin Wireless Network Utility
[2012/08/09 17:21:49 | 000,000,000 | —D | C] – C:\Program Files\Belkin
[2012/08/09 17:21:36 | 000,000,000 | —D | C] – C:\Program Files\Common Files\InstallShield
[2012/08/09 17:21:31 | 000,041,224 | —- | C] (AVAST Software) – C:\WINDOWS\avastSS.scr
[2012/08/09 17:21:30 | 000,227,648 | —- | C] (AVAST Software) – C:\WINDOWS\System32\aswBoot.exe
[2012/08/09 17:21:05 | 000,000,000 | —D | C] – C:\Program Files\AVAST Software
[2012/08/09 17:21:05 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\AVAST Software
[2012/08/09 17:19:22 | 000,000,000 | —D | C] – C:\Program Files\ExplorerXP
[2012/08/09 17:19:22 | 000,000,000 | —D | C] – C:\Documents and Settings\Mamoo\Start Menu\Programs\ExplorerXP
[2012/08/09 17:18:19 | 000,000,000 | —D | C] – C:\Program Files\CCleaner
[2012/08/09 17:18:19 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\CCleaner
[2012/08/09 17:18:09 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\WinZip
[2012/08/09 17:17:55 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\WinZip
[2012/08/09 17:17:51 | 000,000,000 | —D | C] – C:\Program Files\WinZip
[2012/08/09 17:17:28 | 000,000,000 | —D | C] – C:\Program Files\Unlocker
[2012/08/09 17:17:28 | 000,000,000 | —D | C] – C:\Documents and Settings\Mamoo\Start Menu\Programs\Unlocker
[2012/08/09 17:17:13 | 000,000,000 | —D | C] – C:\Documents and Settings\Mamoo\Local Settings\Application Data\Innovative Solutions
[2012/08/09 17:17:13 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\DriverMax
[2012/08/09 17:17:10 | 000,000,000 | —D | C] – C:\Program Files\Innovative Solutions
[2012/08/09 17:16:47 | 000,000,000 | —D | C] – C:\Program Files\uTorrent
[2012/08/09 17:16:24 | 000,000,000 | —D | C] – C:\Documents and Settings\Mamoo\Application Data\uTorrent
[2012/08/09 17:16:09 | 000,000,000 | —D | C] – C:\Documents and Settings\Mamoo\Local Settings\Application Data\Google
[2012/08/09 17:08:16 | 000,000,000 | R–D | C] – C:\Documents and Settings\Mamoo\My Documents\My Pictures
[2012/08/09 17:08:16 | 000,000,000 | R–D | C] – C:\Documents and Settings\Mamoo\My Documents\My Music
[2012/08/09 17:08:11 | 000,000,000 | —D | C] – C:\Documents and Settings\Mamoo\Application Data\Identities
[2012/08/09 17:08:08 | 000,000,000 | —D | C] – C:\Documents and Settings\Mamoo\Local Settings\Application Data\Microsoft
[2012/08/09 17:08:07 | 000,000,000 | –SD | C] – C:\Documents and Settings\Mamoo\Application Data\Microsoft
[2012/08/09 17:08:07 | 000,000,000 | –SD | C] – C:\Documents and Settings\Mamoo\Cookies
[2012/08/09 17:08:07 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Mamoo\SendTo
[2012/08/09 17:08:07 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Mamoo\Application Data
[2012/08/09 17:08:07 | 000,000,000 | R–D | C] – C:\Documents and Settings\Mamoo\Start Menu\Programs\Startup
[2012/08/09 17:08:07 | 000,000,000 | R–D | C] – C:\Documents and Settings\Mamoo\Start Menu
[2012/08/09 17:08:07 | 000,000,000 | R–D | C] – C:\Documents and Settings\Mamoo\My Documents
[2012/08/09 17:08:07 | 000,000,000 | R–D | C] – C:\Documents and Settings\Mamoo\Favorites
[2012/08/09 17:08:07 | 000,000,000 | R–D | C] – C:\Documents and Settings\Mamoo\Start Menu\Programs\Accessories
[2012/08/09 17:08:07 | 000,000,000 | -H-D | C] – C:\Documents and Settings\Mamoo\Templates
[2012/08/09 17:08:07 | 000,000,000 | -H-D | C] – C:\Documents and Settings\Mamoo\PrintHood
[2012/08/09 17:08:07 | 000,000,000 | -H-D | C] – C:\Documents and Settings\Mamoo\NetHood
[2012/08/09 17:08:07 | 000,000,000 | -H-D | C] – C:\Documents and Settings\Mamoo\Local Settings
[2012/08/09 17:08:07 | 000,000,000 | —D | C] – C:\Documents and Settings\Mamoo\Desktop
[2012/08/09 17:07:19 | 000,000,000 | –SD | C] – C:\Documents and Settings\LocalService\Application Data\Microsoft
[2012/08/09 17:07:19 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[2012/08/09 16:29:00 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
[2012/08/09 16:28:58 | 000,000,000 | –SD | C] – C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2012/08/09 16:27:06 | 000,000,000 | R–D | C] – C:\WINDOWS\Offline Web Pages
[2012/08/09 16:27:05 | 000,000,000 | –SD | C] – C:\WINDOWS\Downloaded Program Files
[2012/08/09 16:26:58 | 000,000,000 | R–D | C] – C:\Documents and Settings\All Users\Documents\My Pictures
[2012/08/09 16:26:58 | 000,000,000 | R–D | C] – C:\Documents and Settings\All Users\Documents\My Music
[2012/08/09 16:26:49 | 000,000,000 | —D | C] – C:\Program Files\Online Services
[2012/08/09 16:26:28 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Services
[2012/08/09 16:26:26 | 000,000,000 | —D | C] – C:\Program Files\Common Files\MSSoap
[2012/08/09 16:26:25 | 000,000,000 | —D | C] – C:\WINDOWS\System32\Macromed
[2012/08/09 16:26:17 | 000,000,000 | —D | C] – C:\Program Files\Outlook Express
[2012/08/09 16:26:08 | 000,000,000 | —D | C] – C:\Program Files\Common Files\System
[2012/08/09 16:26:05 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Microsoft Shared
[2012/08/09 16:26:02 | 000,000,000 | —D | C] – C:\Program Files\Internet Explorer
[2012/08/09 16:25:45 | 000,000,000 | —D | C] – C:\Program Files\ComPlus Applications
[2012/08/09 16:25:34 | 000,000,000 | R–D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Administrative Tools
[2012/08/09 16:25:34 | 000,000,000 | —D | C] – C:\WINDOWS\Registration
[2012/08/09 16:24:46 | 000,000,000 | —D | C] – C:\WINDOWS\System32\MsDtc
[2012/08/09 16:24:44 | 000,000,000 | —D | C] – C:\WINDOWS\System32\Com
[2012/08/09 16:23:46 | 000,000,000 | R–D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Accessories
[2012/08/09 11:57:41 | 000,000,000 | -HSD | C] – C:\WINDOWS\Installer
[2012/08/09 11:57:40 | 000,000,000 | R–D | C] – C:\Program Files
[2012/08/09 11:57:40 | 000,000,000 | —D | C] – C:\Program Files\Common Files\ODBC
[2012/08/09 11:57:40 | 000,000,000 | —D | C] – C:\Program Files\Common Files
[2012/08/09 11:57:19 | 000,000,000 | R–D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Startup
[2012/08/09 11:57:19 | 000,000,000 | R–D | C] – C:\Documents and Settings\All Users\Start Menu
[2012/08/09 11:57:19 | 000,000,000 | R–D | C] – C:\Documents and Settings\All Users\Documents
[2012/08/09 11:57:19 | 000,000,000 | -H-D | C] – C:\Documents and Settings\All Users\Templates
[2012/08/09 11:57:19 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Favorites
[2012/08/09 11:57:19 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Desktop
[2012/08/09 11:57:07 | 000,000,000 | —D | C] – C:\WINDOWS\System32\CatRoot2
[2012/08/09 11:57:07 | 000,000,000 | —D | C] – C:\WINDOWS\System32\CatRoot
[2012/08/09 11:57:01 | 000,000,000 | –SD | C] – C:\Documents and Settings\All Users\Application Data\Microsoft
[2012/08/09 11:57:01 | 000,000,000 | RH-D | C] – C:\Documents and Settings\All Users\Application Data
[2012/08/09 11:56:26 | 000,000,000 | —D | C] – C:\Documents and Settings
[2012/08/09 11:53:24 | 000,000,000 | R-SD | C] – C:\WINDOWS\Fonts
[2012/08/09 11:53:24 | 000,000,000 | RHSD | C] – C:\WINDOWS\System32\dllcache
[2012/08/09 11:53:24 | 000,000,000 | R–D | C] – C:\WINDOWS\Web
[2012/08/09 11:53:24 | 000,000,000 | -H-D | C] – C:\WINDOWS\inf
[2012/08/09 11:53:24 | 000,000,000 | —D | C] – C:\WINDOWS\WinSxS
[2012/08/09 11:53:24 | 000,000,000 | —D | C] – C:\WINDOWS\System32\wins
[2012/08/09 11:53:24 | 000,000,000 | —D | C] – C:\WINDOWS
[2012/08/09 11:53:24 | 000,000,000 | —D | C] – C:\WINDOWS\System32\wbem
[2012/08/09 11:53:24 | 000,000,000 | —D | C] – C:\WINDOWS\System32\usmt
[2012/08/09 11:53:24 | 000,000,000 | —D | C] – C:\WINDOWS\twain_32
[2012/08/09 11:53:24 | 000,000,000 | —D | C] – C:\WINDOWS\Temp
[2012/08/09 11:53:24 | 000,000,000 | —D | C] – C:\WINDOWS\system32
[2012/08/09 11:53:24 | 000,000,000 | —D | C] – C:\WINDOWS\system
[2012/08/09 11:53:24 | 000,000,000 | —D | C] – C:\WINDOWS\System32\spool
[2012/08/09 11:53:24 | 000,000,000 | —D | C] – C:\WINDOWS\System32\ShellExt
[2012/08/09 11:53:24 | 000,000,000 | —D | C] – C:\WINDOWS\System32\Setup
[2012/08/09 11:53:24 | 000,000,000 | —D | C] – C:\WINDOWS\security
[2012/08/09 11:53:24 | 000,000,000 | —D | C] – C:\WINDOWS\Resources
[2012/08/09 11:53:24 | 000,000,000 | —D | C] – C:\WINDOWS\repair
[2012/08/09 11:53:24 | 000,000,000 | —D | C] – C:\WINDOWS\System32\ras
[2012/08/09 11:53:24 | 000,000,000 | —D | C] – C:\WINDOWS\Provisioning
[2012/08/09 11:53:24 | 000,000,000 | —D | C] – C:\WINDOWS\PeerNet
[2012/08/09 11:53:24 | 000,000,000 | —D | C] – C:\WINDOWS\pchealth
[2012/08/09 11:53:24 | 000,000,000 | —D | C] – C:\WINDOWS\System32\oobe
[2012/08/09 11:53:24 | 000,000,000 | —D | C] – C:\WINDOWS\System32\npp
[2012/08/09 11:53:24 | 000,000,000 | —D | C] – C:\WINDOWS\System32\mui
[2012/08/09 11:53:24 | 000,000,000 | —D | C] – C:\WINDOWS\mui
[2012/08/09 11:53:24 | 000,000,000 | —D | C] – C:\WINDOWS\msapps
[2012/08/09 11:53:24 | 000,000,000 | —D | C] – C:\WINDOWS\msagent
[2012/08/09 11:53:24 | 000,000,000 | —D | C] – C:\WINDOWS\Media
[2012/08/09 11:53:24 | 000,000,000 | —D | C] – C:\WINDOWS\java
[2012/08/09 11:53:24 | 000,000,000 | —D | C] – C:\WINDOWS\System32\inetsrv
[2012/08/09 11:53:24 | 000,000,000 | —D | C] – C:\WINDOWS\System32\IME
[2012/08/09 11:53:24 | 000,000,000 | —D | C] – C:\WINDOWS\ime
[2012/08/09 11:53:24 | 000,000,000 | —D | C] – C:\WINDOWS\System32\icsxml
[2012/08/09 11:53:24 | 000,000,000 | —D | C] – C:\WINDOWS\System32\ias
[2012/08/09 11:53:24 | 000,000,000 | —D | C] – C:\WINDOWS\Help
[2012/08/09 11:53:24 | 000,000,000 | —D | C] – C:\WINDOWS\System32\export
[2012/08/09 11:53:24 | 000,000,000 | —D | C] – C:\WINDOWS\System32\drivers\etc
[2012/08/09 11:53:24 | 000,000,000 | —D | C] – C:\WINDOWS\ehome
[2012/08/09 11:53:24 | 000,000,000 | —D | C] – C:\WINDOWS\System32\drivers
[2012/08/09 11:53:24 | 000,000,000 | —D | C] – C:\WINDOWS\Driver Cache
[2012/08/09 11:53:24 | 000,000,000 | —D | C] – C:\WINDOWS\System32\drivers\disdn
[2012/08/09 11:53:24 | 000,000,000 | —D | C] – C:\WINDOWS\System32\dhcp
[2012/08/09 11:53:24 | 000,000,000 | —D | C] – C:\WINDOWS\Debug
[2012/08/09 11:53:24 | 000,000,000 | —D | C] – C:\WINDOWS\Cursors
[2012/08/09 11:53:24 | 000,000,000 | —D | C] – C:\WINDOWS\Connection Wizard
[2012/08/09 11:53:24 | 000,000,000 | —D | C] – C:\WINDOWS\System32\config
[2012/08/09 11:53:24 | 000,000,000 | —D | C] – C:\WINDOWS\Config
[2012/08/09 11:53:24 | 000,000,000 | —D | C] – C:\WINDOWS\AppPatch
[2012/08/09 11:53:24 | 000,000,000 | —D | C] – C:\WINDOWS\addins
[2012/08/09 11:53:24 | 000,000,000 | —D | C] – C:\WINDOWS\System32\3com_dmi
[2012/08/09 11:53:24 | 000,000,000 | —D | C] – C:\WINDOWS\System32\3076
[2012/08/09 11:53:24 | 000,000,000 | —D | C] – C:\WINDOWS\System32\2052
[2012/08/09 11:53:24 | 000,000,000 | —D | C] – C:\WINDOWS\System32\1054
[2012/08/09 11:53:24 | 000,000,000 | —D | C] – C:\WINDOWS\System32\1042
[2012/08/09 11:53:24 | 000,000,000 | —D | C] – C:\WINDOWS\System32\1041
[2012/08/09 11:53:24 | 000,000,000 | —D | C] – C:\WINDOWS\System32\1037
[2012/08/09 11:53:24 | 000,000,000 | —D | C] – C:\WINDOWS\System32\1033
[2012/08/09 11:53:24 | 000,000,000 | —D | C] – C:\WINDOWS\System32\1031
[2012/08/09 11:53:24 | 000,000,000 | —D | C] – C:\WINDOWS\System32\1028
[2012/08/09 11:53:24 | 000,000,000 | —D | C] – C:\WINDOWS\System32\1025
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/08/14 05:30:42 | 000,596,992 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Mamoo\Desktop\OTL.exe
[2012/08/14 05:11:44 | 000,030,444 | —- | M] () – C:\Documents and Settings\Mamoo\Desktop\cover.jpg
[2012/08/13 19:41:58 | 000,002,262 | —- | M] () – C:\Documents and Settings\Mamoo\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2012/08/11 13:56:05 | 084,906,626 | —- | M] () – C:\Documents and Settings\Mamoo\Desktop\Asus Z61Ae Windows XP Drivers.zip
[2012/08/11 13:53:00 | 000,309,662 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2012/08/11 13:53:00 | 000,039,124 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2012/08/11 13:48:15 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2012/08/11 13:39:14 | 000,002,206 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2012/08/09 22:51:19 | 000,000,740 | —- | M] () – C:\Documents and Settings\Mamoo\Application Data\Microsoft\Internet Explorer\Quick Launch\Outlook Express.lnk
[2012/08/09 22:46:04 | 000,083,928 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2012/08/09 17:22:12 | 000,002,625 | —- | M] () – C:\WINDOWS\System32\CONFIG.NT
[2012/08/09 17:20:29 | 000,005,802 | —- | M] () – C:\Documents and Settings\Mamoo\My Documents\Registry Backup.reg
[2012/08/09 17:08:16 | 000,000,079 | —- | M] () – C:\Documents and Settings\Mamoo\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf
[2012/08/09 16:29:03 | 000,008,192 | —- | M] () – C:\WINDOWS\REGLOCS.OLD
[2012/08/09 16:28:19 | 000,000,664 | —- | M] () – C:\WINDOWS\System32\$winnt$.inf
[2012/08/09 16:27:57 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2012/08/09 16:27:57 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2012/08/09 16:27:57 | 000,000,000 | —- | M] () – C:\CONFIG.SYS
[2012/08/09 16:27:57 | 000,000,000 | —- | M] () – C:\AUTOEXEC.BAT
[2012/08/09 16:27:48 | 000,004,161 | —- | M] () – C:\WINDOWS\ODBCINST.INI
[2012/08/09 16:26:00 | 000,021,640 | —- | M] () – C:\WINDOWS\System32\emptyregdb.dat
[2012/08/09 16:23:15 | 000,000,211 | -HS- | M] () – C:\boot.ini
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/08/14 05:11:49 | 000,030,444 | —- | C] () – C:\Documents and Settings\Mamoo\Desktop\cover.jpg
[2012/08/11 13:56:05 | 084,906,626 | —- | C] () – C:\Documents and Settings\Mamoo\Desktop\Asus Z61Ae Windows XP Drivers.zip
[2012/08/11 13:46:34 | 000,129,045 | R— | C] () – C:\WINDOWS\System32\drivers\HSFProf.cty
[2012/08/11 13:37:46 | 000,156,672 | R— | C] () – C:\WINDOWS\System32\RTLCPAPI.dll
[2012/08/11 13:37:46 | 000,040,960 | —- | C] () – C:\WINDOWS\System32\ChCfg.exe
[2012/08/09 22:51:19 | 000,000,740 | —- | C] () – C:\Documents and Settings\Mamoo\Application Data\Microsoft\Internet Explorer\Quick Launch\Outlook Express.lnk
[2012/08/09 17:40:51 | 000,002,262 | —- | C] () – C:\Documents and Settings\Mamoo\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2012/08/09 17:35:08 | 000,001,036 | —- | C] () – C:\Documents and Settings\Mamoo\Desktop\CleanTemp.bat
[2012/08/09 17:30:35 | 000,068,112 | R— | C] () – C:\WINDOWS\System32\igfxhhun.lhp
[2012/08/09 17:30:35 | 000,066,013 | R— | C] () – C:\WINDOWS\System32\igfxhkor.lhp
[2012/08/09 17:30:35 | 000,064,513 | R— | C] () – C:\WINDOWS\System32\igfxhtrk.lhp
[2012/08/09 17:30:35 | 000,063,269 | R— | C] () – C:\WINDOWS\System32\igfxhsve.lhp
[2012/08/09 17:30:35 | 000,063,208 | R— | C] () – C:\WINDOWS\System32\igfxhplk.lhp
[2012/08/09 17:30:35 | 000,062,836 | R— | C] () – C:\WINDOWS\System32\igfxhtha.lhp
[2012/08/09 17:30:35 | 000,062,770 | R— | C] () – C:\WINDOWS\System32\igfxhfin.lhp
[2012/08/09 17:30:35 | 000,062,740 | R— | C] () – C:\WINDOWS\System32\igfxhfrc.lhp
[2012/08/09 17:30:35 | 000,062,578 | R— | C] () – C:\WINDOWS\System32\igfxhjpn.lhp
[2012/08/09 17:30:35 | 000,062,465 | R— | C] () – C:\WINDOWS\System32\igfxhptg.lhp
[2012/08/09 17:30:35 | 000,062,454 | R— | C] () – C:\WINDOWS\System32\igfxhfra.lhp
[2012/08/09 17:30:35 | 000,062,339 | R— | C] () – C:\WINDOWS\System32\igfxhdeu.lhp
[2012/08/09 17:30:35 | 000,061,839 | R— | C] () – C:\WINDOWS\System32\igfxhptb.lhp
[2012/08/09 17:30:35 | 000,061,831 | R— | C] () – C:\WINDOWS\System32\igfxhell.lhp
[2012/08/09 17:30:35 | 000,061,414 | R— | C] () – C:\WINDOWS\System32\igfxhrus.lhp
[2012/08/09 17:30:35 | 000,060,786 | R— | C] () – C:\WINDOWS\System32\igfxhesp.lhp
[2012/08/09 17:30:35 | 000,060,659 | R— | C] () – C:\WINDOWS\System32\igfxhcsy.lhp
[2012/08/09 17:30:35 | 000,060,244 | R— | C] () – C:\WINDOWS\System32\igfxhdan.lhp
[2012/08/09 17:30:35 | 000,060,141 | R— | C] () – C:\WINDOWS\System32\igfxhnld.lhp
[2012/08/09 17:30:35 | 000,060,085 | R— | C] () – C:\WINDOWS\System32\igfxhnor.lhp
[2012/08/09 17:30:35 | 000,059,687 | R— | C] () – C:\WINDOWS\System32\igfxhita.lhp
[2012/08/09 17:30:35 | 000,059,471 | R— | C] () – C:\WINDOWS\System32\igfxhheb.lhp
[2012/08/09 17:30:35 | 000,059,354 | R— | C] () – C:\WINDOWS\System32\igfxhcht.lhp
[2012/08/09 17:30:35 | 000,059,200 | R— | C] () – C:\WINDOWS\System32\igfxharb.lhp
[2012/08/09 17:30:35 | 000,059,200 | R— | C] () – C:\WINDOWS\System32\igfxhara.lhp
[2012/08/09 17:30:35 | 000,058,623 | R— | C] () – C:\WINDOWS\System32\igfxheng.lhp
[2012/08/09 17:30:35 | 000,058,430 | R— | C] () – C:\WINDOWS\System32\igfxhchs.lhp
[2012/08/09 17:30:35 | 000,057,801 | R— | C] () – C:\WINDOWS\System32\igfxhenu.lhp
[2012/08/09 17:27:58 | 000,060,416 | —- | C] () – C:\WINDOWS\System32\antiwpa.dll
[2012/08/09 17:26:00 | 000,110,592 | —- | C] () – C:\WINDOWS\System32\AegisI5.exe
[2012/08/09 17:26:00 | 000,057,344 | —- | C] () – C:\WINDOWS\System32\WLTRYSVC.EXE
[2012/08/09 17:21:50 | 000,040,960 | —- | C] () – C:\WINDOWS\System32\F5D9050.dll
[2012/08/09 17:20:28 | 000,005,802 | —- | C] () – C:\Documents and Settings\Mamoo\My Documents\Registry Backup.reg
[2012/08/09 17:08:16 | 000,000,767 | —- | C] () – C:\Documents and Settings\Mamoo\Start Menu\Programs\Internet Explorer.lnk
[2012/08/09 17:08:16 | 000,000,079 | —- | C] () – C:\Documents and Settings\Mamoo\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf
[2012/08/09 17:08:15 | 000,000,738 | —- | C] () – C:\Documents and Settings\Mamoo\Start Menu\Programs\Outlook Express.lnk
[2012/08/09 17:08:07 | 000,001,599 | —- | C] () – C:\Documents and Settings\Mamoo\Start Menu\Programs\Remote Assistance.lnk
[2012/08/09 16:29:03 | 000,008,192 | —- | C] () – C:\WINDOWS\REGLOCS.OLD
[2012/08/09 16:28:16 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2012/08/09 16:27:57 | 000,000,000 | RHS- | C] () – C:\MSDOS.SYS
[2012/08/09 16:27:57 | 000,000,000 | RHS- | C] () – C:\IO.SYS
[2012/08/09 16:27:57 | 000,000,000 | —- | C] () – C:\CONFIG.SYS
[2012/08/09 16:27:57 | 000,000,000 | —- | C] () – C:\AUTOEXEC.BAT
[2012/08/09 16:26:00 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2012/08/09 16:24:55 | 000,003,286 | —- | C] () – C:\WINDOWS\System32\tslabels.h
[2012/08/09 16:24:55 | 000,001,161 | —- | C] () – C:\WINDOWS\System32\usrlogon.cmd
[2012/08/09 16:24:54 | 000,000,768 | —- | C] () – C:\WINDOWS\System32\msdtcprf.h
[2012/08/09 16:24:48 | 000,063,488 | —- | C] () – C:\WINDOWS\System32\wmimgmt.msc
[2012/08/09 11:57:40 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2012/08/09 11:57:19 | 001,042,903 | —- | C] () – C:\WINDOWS\System32\dllcache\SP2.CAT
[2012/08/09 11:57:19 | 000,399,645 | —- | C] () – C:\WINDOWS\System32\dllcache\MAPIMIG.CAT
[2012/08/09 11:57:19 | 000,037,484 | —- | C] () – C:\WINDOWS\System32\dllcache\MW770.CAT
[2012/08/09 11:57:19 | 000,013,472 | —- | C] () – C:\WINDOWS\System32\dllcache\HPCRDP.CAT
[2012/08/09 11:57:19 | 000,008,574 | —- | C] () – C:\WINDOWS\System32\dllcache\IASNT4.CAT
[2012/08/09 11:57:19 | 000,007,382 | —- | C] () – C:\WINDOWS\System32\dllcache\OEMBIOS.CAT
[2012/08/09 11:57:19 | 000,007,245 | —- | C] () – C:\WINDOWS\System32\dllcache\MSTSWEB.CAT
[2012/08/09 11:57:18 | 002,012,670 | —- | C] () – C:\WINDOWS\System32\dllcache\NT5.CAT
[2012/08/09 11:57:18 | 000,502,724 | —- | C] () – C:\WINDOWS\System32\dllcache\NT5INF.CAT
[2012/08/09 11:56:25 | 000,083,928 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2012/08/09 11:55:59 | 000,000,211 | -HS- | C] () – C:\boot.ini
[2012/08/09 11:55:53 | 000,000,664 | —- | C] () – C:\WINDOWS\System32\$winnt$.inf

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2012/08/09 16:27:57 | 000,000,000 | —- | M] () – C:\AUTOEXEC.BAT
[2012/08/09 16:23:15 | 000,000,211 | -HS- | M] () – C:\boot.ini
[2012/08/09 16:27:57 | 000,000,000 | —- | M] () – C:\CONFIG.SYS
[2012/08/09 16:27:57 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2012/08/09 16:27:57 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2004/08/04 01:38:34 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2004/08/04 01:59:34 | 000,250,032 | RHS- | M] () – C:\ntldr
[2012/08/11 13:48:09 | 1598,029,824 | -HS- | M] () – C:\pagefile.sys

< %systemroot%\Fonts\*.com >

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2012/08/09 16:27:36 | 000,000,067 | -HS- | M] () – C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2012/07/03 12:21:32 | 000,041,224 | —- | M] (AVAST Software) – C:\WINDOWS\avastSS.scr
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2012/08/09 11:55:57 | 000,081,920 | —- | M] () – C:\WINDOWS\System32\config\default.sav
[2012/08/09 11:55:57 | 000,618,496 | —- | M] () – C:\WINDOWS\System32\config\software.sav
[2012/08/09 11:55:57 | 000,729,088 | —- | M] () – C:\WINDOWS\System32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2012/08/09 16:28:04 | 000,000,231 | -HS- | M] () – C:\Documents and Settings\All Users\Start Menu\desktop.ini

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2012/08/09 17:08:16 | 000,000,119 | -HS- | M] () – C:\Documents and Settings\Mamoo\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
[2012/08/09 17:08:16 | 000,000,079 | —- | M] () – C:\Documents and Settings\Mamoo\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

< %USERPROFILE%\Desktop\*.exe >
[2012/08/14 05:30:42 | 000,596,992 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Mamoo\Desktop\OTL.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >

< End of report >

EXTRAS.TXT

OTL Extras logfile created on: 8/14/2012 5:32:47 AM - Run 1
OTL by OldTimer - Version 3.2.57.0 Folder = C:\Documents and Settings\Mamoo\Desktop
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1015.17 Mb Total Physical Memory | 401.87 Mb Available Physical Memory | 39.59% Memory free
2.39 Gb Paging File | 1.80 Gb Available in Paging File | 75.36% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 27.94 Gb Total Space | 24.11 Gb Free Space | 86.29% Space Free | Partition Type: NTFS
Drive E: | 7.46 Gb Total Space | 1.64 Gb Free Space | 21.99% Space Free | Partition Type: NTFS

Computer Name: SPARKTECH | User Name: Mamoo | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.url [@ = InternetShortcut] – rundll32.exe shdocvw.dll,OpenURL %l

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = ChromeHTML.7A4YTOGLANQO3VS7EGKKNO2TNY] – C:\Documents and Settings\Mamoo\Local Settings\Application Data\Google\Chrome\Application\chrome.exe (Google Inc.)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] – "%1" %*
InternetShortcut [open] – rundll32.exe shdocvw.dll,OpenURL %l
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\uTorrent\uTorrent.exe" = C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent – (BitTorrent, Inc.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel® Graphics Media Accelerator Driver for Mobile
"{9922FE96-6803-498D-A6AD-4EB5A3B956A5}" = Belkin Wireless G Plus MIMO USB Network Adapter
"{CD95F661-A5C4-44F5-A6AA-ECDD91C240BE}" = WinZip 15.0
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"avast" = avast! Free Antivirus
"CCleaner" = CCleaner
"CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2BFA&SUBSYS_10431966" = HDAUDIO SoftV92 Data Fax Modem with SmartCP
"DMX5_is1" = DriverMax 6
"ExplorerXP" = ExplorerXP (remove only)
"HControl" = ATK0100 ACPI UTILITY
"Motorola Wireless Network Adapter" = Motorola Wireless Network Adapter
"Unlocker" = Unlocker 1.9.1
"uTorrent" = µTorrent

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"FileZilla Client" = FileZilla Client 3.5.3
"Google Chrome" = Google Chrome

========== Last 20 Event Log Errors ==========

[ System Events ]
Error - 8/10/2012 12:05:45 AM | Computer Name = SPARKTECH | Source = PSched | ID = 14103
Description = QoS [Adapter {BA9BBFC4-E203-4E63-B6FF-9E38090ECB17}]: The netcard driver
failed the query for OID_GEN_LINK_SPEED.

Error - 8/10/2012 12:06:45 AM | Computer Name = SPARKTECH | Source = Server | ID = 2505
Description = The server could not bind to the transport \Device\NetbiosSmb because
another computer on the network has the same name. The server could not start.

Error - 8/11/2012 12:07:03 AM | Computer Name = SPARKTECH | Source = PSched | ID = 14103
Description = QoS [Adapter {FCE3DB3E-208A-4744-ABD9-4369CE65A3AB}]: The netcard driver
failed the query for OID_GEN_LINK_SPEED.

Error - 8/11/2012 12:13:03 AM | Computer Name = SPARKTECH | Source = MRxSmb | ID = 8003
Description = The master browser has received a server announcement from the computer
MAINPC that believes that it is the master browser for the domain on transport NetBT_Tcpip_{FCE3DB3E-208A-4744-AB.
The
master browser is stopping or an election is being forced.

Error - 8/11/2012 10:55:18 AM | Computer Name = SPARKTECH | Source = PSched | ID = 14103
Description = QoS [Adapter {FCE3DB3E-208A-4744-ABD9-4369CE65A3AB}]: The netcard driver
failed the query for OID_GEN_LINK_SPEED.

Error - 8/11/2012 1:34:16 PM | Computer Name = SPARKTECH | Source = PSched | ID = 14103
Description = QoS [Adapter {FCE3DB3E-208A-4744-ABD9-4369CE65A3AB}]: The netcard driver
failed the query for OID_GEN_LINK_SPEED.

Error - 8/12/2012 7:59:08 PM | Computer Name = SPARKTECH | Source = PSched | ID = 14103
Description = QoS [Adapter {57BEA84D-BC71-42F1-AC6B-D97025A820A9}]: The netcard driver
failed the query for OID_GEN_LINK_SPEED.

Error - 8/13/2012 2:36:11 PM | Computer Name = SPARKTECH | Source = PSched | ID = 14103
Description = QoS [Adapter {57BEA84D-BC71-42F1-AC6B-D97025A820A9}]: The netcard driver
failed the query for OID_GEN_LINK_SPEED.

Error - 8/13/2012 4:09:31 PM | Computer Name = SPARKTECH | Source = PSched | ID = 14103
Description = QoS [Adapter {57BEA84D-BC71-42F1-AC6B-D97025A820A9}]: The netcard driver
failed the query for OID_GEN_LINK_SPEED.

< End of report >

Thanks a whole lot!

Deleted Member

Post #2August 14, 2012, 9:47 AM UTC

Here is also a DDS.scr Scan Report

DDS.TXT

.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 6.0.2900.2180
Run by [removed] at 5:41:52 on 2012-08-14
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1015.426 [GMT -4:00]
.
.
============== Running Processes ===============
.
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\Program Files\AVAST Software\Avast\avastUI.exe
C:\Program Files\Belkin\F5D9050\Belkinwcui.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\ATK0100\HControl.exe
C:\Documents and Settings\Mamoo\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\WINDOWS\ATK0100\ATKOSD.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Documents and Settings\Mamoo\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Mamoo\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Mamoo\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Mamoo\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Mamoo\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Mamoo\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Mamoo\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Mamoo\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com/
mWinlogon: SfcDisable=-99 (0xffffff9d)
uRun: [DriverMax]
uRun: [DriverMax_RESTART]
uRun: [Google Update] "c:\documents and settings\mamoo\local settings\application data\google\update\GoogleUpdate.exe" /c
mRun: [avast] "c:\program files\avast software\avast\avastUI.exe" /nogui
mRun: [F5D9050] c:\program files\belkin\f5d9050\Belkinwcui.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [UIUCU2] c:\docume~1\mamoo\locals~1\temp\UIUCU2.EXE -CLEAN_UP2
mRun: [HControl] c:\windows\atk0100\HControl.exe
mRun: [UIUCU] c:\docume~1\mamoo\locals~1\temp\UIUCU.EXE -CLEAN_UP
mRun: [High Definition Audio Property Page Shortcut] HDAShCut.exe
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [SoundMan] SOUNDMAN.EXE
mRun: [AlcWzrd] ALCWZRD.EXE
mRun: [Alcmtr] ALCMTR.EXE
uPolicies-explorer: NoSMHelp = 1 (0x1)
uPolicies-explorer: NoSMConfigurePrograms = 1 (0x1)
uPolicies-explorer: NoInternetIcon = 1 (0x1)
uPolicies-explorer: NoInstrumentation = 1 (0x1)
uPolicies-explorer: NoWindowsUpdate = 1 (0x1)
uPolicies-explorer: NoResolveTrack = 1 (0x1)
mPolicies-explorer: NoDesktopCleanupWizard = 1 (0x1)
mPolicies-system: DisableStatusMessages = 1 (0x1)
dPolicies-explorer: NoSMHelp = 1 (0x1)
dPolicies-explorer: NoSMConfigurePrograms = 1 (0x1)
dPolicies-explorer: NoInternetIcon = 1 (0x1)
dPolicies-explorer: NoInstrumentation = 1 (0x1)
dPolicies-explorer: NoWindowsUpdate = 1 (0x1)
dPolicies-explorer: NoResolveTrack = 1 (0x1)
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{57BEA84D-BC71-42F1-AC6B-D97025A820A9} : DhcpNameServer = 192.168.1.1
TCP: Interfaces\{FCE3DB3E-208A-4744-ABD9-4369CE65A3AB} : NameServer = 196.3.132.153,196.3.132.154
Notify: Antiwpa - antiwpa.dll
Notify: igfxcui - igfxsrvc.dll
AppInit_DLLs: WIKI.DLL
.
============= SERVICES / DRIVERS ===============
.
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2012-8-9 721000]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2012-8-9 353688]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2012-8-9 21256]
R2 avast! Antivirus;avast! Antivirus;c:\program files\avast software\avast\AvastSvc.exe [2012-8-9 44808]
R3 BKNDIS5;BKNDIS5 NDIS Protocol Driver;c:\progra~1\belkin\f5d9050\BKNDIS5.SYS [2012-8-9 15872]
R3 StreamSurge;StreamSurge Driver (miniport);c:\windows\system32\drivers\ss.sys [2012-8-9 19968]
.
=============== Created Last 30 ================
.
2012-08-13 22:17:15 ——– d—–w- C:\Torrents
2012-08-11 17:52:07 65536 —-a-r- c:\windows\ALCMTR.EXE
2012-08-11 17:47:13 6400 —-a-w- c:\windows\system32\drivers\splitter.sys
2012-08-11 17:47:11 82944 —-a-w- c:\windows\system32\drivers\wdmaud.sys
2012-08-11 17:47:09 52864 —-a-w- c:\windows\system32\drivers\DMusic.sys
2012-08-11 17:47:07 54272 —-a-w- c:\windows\system32\drivers\swmidi.sys
2012-08-11 17:47:05 142464 —-a-w- c:\windows\system32\drivers\aec.sys
2012-08-11 17:47:03 171776 —-a-w- c:\windows\system32\drivers\kmixer.sys
2012-08-11 17:47:01 2944 —-a-w- c:\windows\system32\drivers\drmkaud.sys
2012-08-11 17:46:59 60800 —-a-w- c:\windows\system32\drivers\sysaudio.sys
2012-08-11 17:46:56 7552 —-a-w- c:\windows\system32\drivers\MSKSSRV.sys
2012-08-11 17:46:54 4992 —-a-w- c:\windows\system32\drivers\MSPQM.sys
2012-08-11 17:46:51 5376 —-a-w- c:\windows\system32\drivers\MSPCLOCK.sys
2012-08-11 17:46:34 86016 —-a-r- c:\windows\system32\mdmxsdk.dll
2012-08-11 17:46:34 39018 —-a-r- c:\windows\system32\hsfci011.dll
2012-08-11 17:46:34 163328 —-a-r- c:\windows\system32\drivers\HSFHWAZL.sys
2012-08-11 17:46:34 13059 —-a-r- c:\windows\system32\drivers\mdmxsdk.sys
2012-08-11 17:46:34 1036928 —-a-r- c:\windows\system32\drivers\HSF_DP.sys
2012-08-11 17:46:34 ——– d—–w- c:\program files\CONEXANT
2012-08-11 17:46:33 702592 —-a-r- c:\windows\system32\drivers\HSF_CNXT.sys
2012-08-11 17:44:51 4096 —-a-w- c:\windows\system32\ksuser.dll
2012-08-11 17:44:51 130048 —-a-w- c:\windows\system32\ksproxy.ax
2012-08-11 17:44:50 60288 —-a-w- c:\windows\system32\drivers\drmk.sys
2012-08-11 17:41:18 90112 —-a-w- c:\windows\system32\snymsico.dll
2012-08-11 17:41:18 51328 —-a-w- c:\windows\system32\drivers\rimsptsk.sys
2012-08-11 17:41:18 27136 —-a-w- c:\windows\system32\drivers\risdptsk.sys
2012-08-11 17:40:32 57344 —-a-w- c:\program files\common files\installshield\professional\runtime\0701\intel32\ctor.dll
2012-08-11 17:40:32 5632 —-a-w- c:\program files\common files\installshield\professional\runtime\0701\intel32\DotNetInstaller.exe
2012-08-11 17:40:32 32768 —-a-w- c:\program files\common files\installshield\professional\runtime\Objectps.dll
2012-08-11 17:40:32 237568 —-a-w- c:\program files\common files\installshield\professional\runtime\0701\intel32\iscript.dll
2012-08-11 17:40:32 155648 —-a-w- c:\program files\common files\installshield\professional\runtime\0701\intel32\iuser.dll
2012-08-11 17:40:31 692224 —-a-w- c:\program files\common files\installshield\professional\runtime\0701\intel32\iKernel.dll
2012-08-11 17:40:31 163972 —-a-w- c:\program files\common files\installshield\professional\runtime\0701\intel32\iGdi.dll
2012-08-11 17:40:30 282756 —-a-w- c:\program files\common files\installshield\professional\runtime\0701\intel32\setup.dll
2012-08-11 17:36:06 22752 —-a-w- c:\windows\system32\spupdsvc.exe
2012-08-11 15:47:31 ——– d—–w- c:\windows\ATK0100
2012-08-10 04:07:12 ——– d—–w- c:\windows\system32\LogFiles
2012-08-10 02:42:18 ——– d—–w- c:\windows\system32\ReinstallBackups
2012-08-09 21:37:15 163840 —-a-r- c:\windows\system32\igfxres.dll
2012-08-09 21:27:58 60416 —-a-w- c:\windows\system32\antiwpa.dll
2012-08-09 21:26:01 15781 —-a-w- c:\windows\system32\drivers\mdc8021x.sys
2012-08-09 21:26:00 913408 ——w- c:\windows\system32\AegisE5.dll
2012-08-09 21:26:00 81920 ——w- c:\windows\system32\wltrynt.dll
2012-08-09 21:26:00 69632 ——w- c:\windows\system32\BCMLogon.dll
2012-08-09 21:26:00 57344 ——w- c:\windows\system32\WLTRYSVC.EXE
2012-08-09 21:26:00 110592 ——w- c:\windows\system32\AegisI5.exe
2012-08-09 21:25:59 671847 ——w- c:\windows\system32\BCMWLTRY.EXE
2012-08-09 21:25:59 1245184 ——w- c:\windows\system32\BCMWLCPL.CPL
2012-08-09 21:25:43 69640 ——w- c:\windows\system32\BCMWLD2K.EXE
2012-08-09 21:25:43 359552 —-a-w- c:\windows\system32\drivers\BCMWL5.SYS
2012-08-09 21:25:43 163848 ——w- c:\windows\system32\BCMWLU00.EXE
2012-08-09 21:22:29 ——– d-s—w- c:\windows\system32\Microsoft
2012-08-09 21:22:13 721000 —-a-w- c:\windows\system32\drivers\aswSnx.sys
2012-08-09 21:22:07 20747 —-a-w- c:\windows\system32\drivers\AegisP.sys
2012-08-09 21:19:22 ——– d—–w- c:\program files\ExplorerXP
2012-08-09 21:18:19 ——– d—–w- c:\program files\CCleaner
2012-08-09 21:17:28 ——– d—–w- c:\program files\Unlocker
2012-08-09 21:17:13 ——– d—–w- c:\documents and settings\mamoo\local settings\application data\Innovative Solutions
2012-08-09 21:17:10 ——– d—–w- c:\program files\Innovative Solutions
2012-08-09 21:16:47 ——– d—–w- c:\program files\uTorrent
2012-08-09 21:16:24 ——– d—–w- c:\documents and settings\mamoo\application data\uTorrent
2012-08-09 21:16:09 ——– d—–w- c:\documents and settings\mamoo\local settings\application data\Google
2012-08-09 20:27:06 ——– d—–r- c:\windows\Offline Web Pages
2012-08-09 20:27:05 ——– d-s—w- c:\windows\Downloaded Program Files
2012-08-09 20:25:34 ——– d—–w- c:\windows\Registration
2012-08-09 20:25:10 ——– d—–w- c:\windows\system32\wbem\repository\FS
2012-08-09 20:25:10 ——– d—–w- c:\windows\system32\wbem\AutoRecover
2012-08-09 20:25:07 ——– d—–w- c:\windows\system32\wbem\Performance
2012-08-09 16:00:55 3072 —-a-w- c:\windows\system32\drivers\audstub.sys
2012-08-09 16:00:06 57472 —-a-w- c:\windows\system32\drivers\redbook.sys
2012-08-09 15:59:36 20992 —-a-w- c:\windows\system32\drivers\RTL8139.sys
2012-08-09 15:59:16 6400 —-a-w- c:\windows\system32\drivers\enum1394.sys
2012-08-09 15:58:48 74240 —-a-w- c:\windows\system32\usbui.dll
2012-08-09 15:58:44 9344 —-a-w- c:\windows\system32\drivers\compbatt.sys
2012-08-09 15:58:43 14080 —-a-w- c:\windows\system32\drivers\CmBatt.sys
2012-08-09 15:58:43 14080 —-a-w- c:\windows\system32\drivers\battc.sys
2012-08-09 15:56:26 ——– d—–w- C:\Documents and Settings
.
==================== Find3M ====================
.
2012-07-03 16:21:32 41224 —-a-w- c:\windows\avastSS.scr
.
============= FINISH: 5:42:18.53 ===============

ATTACH.TXT

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 8/9/2012 4:28:12 PM
System Uptime: 8/12/2012 4:02:48 AM (49 hours ago)
.
Motherboard: ASUSTeK Computer INC. | | Z61Ae
Processor: Intel® Pentium® M processor 1.60GHz | CPU 1 | 1596/100mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 28 GiB total, 24.103 GiB free.
D: is CDROM ()
E: is Removable
.
==== Disabled Device Manager Items =============
.
Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: Realtek RTL8139 Family PCI Fast Ethernet NIC
Device ID: PCI\VEN_10EC&DEV_8139&SUBSYS_10451043&REV_10\4&3AE5ECD5&0&00F0
Manufacturer: Realtek
Name: Realtek RTL8139 Family PCI Fast Ethernet NIC
PNP Device ID: PCI\VEN_10EC&DEV_8139&SUBSYS_10451043&REV_10\4&3AE5ECD5&0&00F0
Service: rtl8139
.
Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: 1394 Net Adapter
Device ID: V1394\NIC1394\338208CE01800
Manufacturer: Microsoft
Name: 1394 Net Adapter
PNP Device ID: V1394\NIC1394\338208CE01800
Service: NIC1394
.
==== System Restore Points ===================
.
No restore point in system.
.
==== Installed Programs ======================
.
µTorrent
ATK0100 ACPI UTILITY
avast! Free Antivirus
Belkin Wireless G Plus MIMO USB Network Adapter
CCleaner
DriverMax 6
ExplorerXP (remove only)
FileZilla Client 3.5.3
Google Chrome
HDAUDIO SoftV92 Data Fax Modem with SmartCP
High Definition Audio Driver Package - KB888111
Intel® Graphics Media Accelerator Driver for Mobile
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Motorola Wireless Network Adapter
Realtek High Definition Audio Driver
Unlocker 1.9.1
WinZip 15.0
.
==== Event Viewer Messages From Past Week ========
.
8/12/2012 7:59:08 PM, error: PSched [14103] - QoS [Adapter {57BEA84D-BC71-42F1-AC6B-D97025A820A9}]: The netcard driver failed the query for OID_GEN_LINK_SPEED.
8/11/2012 12:13:03 AM, error: MRxSmb [8003] - The master browser has received a server announcement from the computer MAINPC that believes that it is the master browser for the domain on transport NetBT_Tcpip_{FCE3DB3E-208A-4744-AB. The master browser is stopping or an election is being forced.
8/11/2012 10:55:18 AM, error: PSched [14103] - QoS [Adapter {FCE3DB3E-208A-4744-ABD9-4369CE65A3AB}]: The netcard driver failed the query for OID_GEN_LINK_SPEED.
8/10/2012 12:06:45 AM, error: Server [2505] - The server could not bind to the transport \Device\NetbiosSmb because another computer on the network has the same name. The server could not start.
8/10/2012 12:05:45 AM, error: PSched [14103] - QoS [Adapter {BA9BBFC4-E203-4E63-B6FF-9E38090ECB17}]: The netcard driver failed the query for OID_GEN_LINK_SPEED.
.
==== End Of File ===========================

JonTom

Post #3August 14, 2012, 2:35 PM UTC

Hello Fadil Khan and

My name is JonTom

Malware Logs can sometimes take a lot of time to research and interpret.
Please be patient while I try to assist with your problem. If at any time you do not understand what is required, please ask for further explanation.
Please note that there is no "Quick Fix" to modern malware infections and we may need to use several different approaches to get your system clean.
Read every reply you receive carefully and thoroughly before carrying out the instructions. You may also find it helpful to print out the instructions you receive, as in some instances you may have to disconnect your computer from the Internet.
PLEASE NOTE: If you do not reply after 3 days your thread will be closed.

Please run the following scans before we continue:

CKScanner
- Download CKScanner by askey127 from here and save it to your Desktop.
- Double click CKScanner.exe then click on Search For Files.
- When the cursor hourglass disappears, click Save List To File.
- A message box will verify the file saved.
- Double click the CKFiles.txt icon on your desktop then copy/paste the contents in your next reply
MGADiag
- Please download MGADiag by clicking here and save it to your desktop.
- Double click the [external image: Posted Image] icon on your desktop.
- Push [external image: Posted Image]
- Push [external image: Posted Image]
- Go to Start -> Run and type in "Notepad"
- Go to Edit -> Paste in notepad.
- "x" out all of the numbers and letters in the line beginning with "Windows Product Key:"
- Copy and paste that log here.
Please post both logs in your next reply.

Deleted Member

Post #4August 15, 2012, 12:17 AM UTC

CKScanner Log CKScanner - Additional Security Risks - These are not necessarily bad c:\windows\system32\antiwpa.dll scanner sequence 3.NA.11.GUABPB —– EOF —– MGADiag Log Diagnostic Report (1.9.0027.0): —————————————– Windows Validation Data–> Validation Status: Invalid Product Key Validation Code: 8 Cached Validation Code: N/A Windows Product Key: xxxxx-xxxxx-xxxxx-xxxxx-xxxxx Windows Product Key Hash: QfvLF5v6XKsbP/68/5fsahlwSgM= Windows Product ID: 55274-640-0214446-23237 Windows Product ID Type: 1 Windows License Type: Volume Windows OS version: 5.1.2600.2.00010100.2.0.pro ID: {1795A817-D0D5-4102-814B-EB8618CBF5B2}(1) Is Admin: Yes TestCab: 0x0 LegitcheckControl ActiveX: N/A, hr = 0x80070002 Signed By: N/A, hr = 0x80070002 Product Name: N/A Architecture: N/A Build lab: N/A TTS Error: N/A Validation Diagnostic: 025D1FF3-230-1_E2AD56EA-765-d003_E2AD56EA-766-0_E2AD56EA-134-80004005 Resolution Status: N/A Vista WgaER Data–> ThreatID(s): N/A Version: N/A Windows XP Notifications Data–> Cached Result: N/A, hr = 0x80070002 File Exists: No Version: N/A, hr = 0x80070002 WgaTray.exe Signed By: N/A, hr = 0x80070002 WgaLogon.dll Signed By: N/A, hr = 0x80070002 OGA Notifications Data–> Cached Result: N/A, hr = 0x80070002 Version: N/A, hr = 0x80070002 OGAExec.exe Signed By: N/A, hr = 0x80070002 OGAAddin.dll Signed By: N/A, hr = 0x80070002 OGA Data–> Office Status: 109 N/A OGA Version: N/A, 0x80070002 Signed By: N/A, hr = 0x80070002 Office Diagnostics: 025D1FF3-230-1 Browser Data–> Proxy settings: N/A User Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Default Browser: C:\Documents and Settings\Mamoo\Local Settings\Application Data\Google\Chrome\Application\chrome.exe Download signed ActiveX controls: Prompt Download unsigned ActiveX controls: Disabled Run ActiveX controls and plug-ins: Allowed Initialize and script ActiveX controls not marked as safe: Disabled Allow scripting of Internet Explorer Webbrowser control: Disabled Active scripting: Allowed Script ActiveX controls marked as safe for scripting: Allowed File Scan Data–> File Mismatch: C:\WINDOWS\system32\syssetup.dll[5.1.2600.2180], Hr = 0x800b0100 Other data–> Office Details: {1795A817-D0D5-4102-814B-EB8618CBF5B2}1.9.0027.05.1.2600.2.00010100.2.0.prox32*****-*****-*****-*****-J96HY55274-640-0214446-232371S-1-5-21-1454471165-861567501-1801674531ASUSTeK Computer INC.Z61AeAmerican Megatrends Inc.0302 20050804000000.000000+000A2D93807018400E204090409SA Western Standard Time(GMT-04:00)03 109 Licensing Data–> N/A Windows Activation Technologies–> N/A HWID Data–> N/A OEM Activation 1.0 Data–> BIOS string matches: yes Marker string from BIOS: 1E840:ASUSTeK Computer Inc|14EF0:ASUSTeK Computer Inc|16B53:GENUINE C&C INC|58B3:Semp Toshiba Informatica Ltda|58B3:TOSHIBA CORPORATION Marker string from OEMBIOS.DAT: N/A, hr = 0x80004005 OEM Activation 2.0 Data–> N/A

Deleted Member

Post #5August 15, 2012, 12:19 AM UTC

Please Note that I am posting these results of the Laptop with the issue on another computer, because I can no longer post anything to this website from that Laptop… Thanks a lot!

JonTom

Post #6August 15, 2012, 1:41 PM UTC

Hello Fadil Khan

The logs you have posted suggest that you have an invalid Windows license key and an illegal software crack used to bypass copy protection for Windows.

Since this forum does not support or condone the use of such illegal material I am unable to continue helping you.

JonTom

Post #7August 16, 2012, 5:54 PM UTC

This thread is now closed.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Win32:Rootkit-gen [Rtk] Removal

✨ Ask AI

Ask AI