spontaneous odd behaviours: voices, web pages... [Solved]

Hello symbiosis7

Please run TDSSKiller again. When the following is detected:

11:06:38.0937 2580 \Device\Harddisk0\DR0 ( TDSS File System ) - warning
11:06:38.0937 2580 \Device\Harddisk0\DR0 - detected TDSS File System (1)

Use the drop down menu and select delete.

Post the TDSSKiller log and the following logs in your next reply:

• Download and run OTL by Oldtimer
  
  
  
• Please download OTL by Oldtimer by clicking here and save the file (called OTL.exe) to your desktop.
• Close all open windows on your computer then Double click on the OTL.exe icon to run the program.
• Check the boxes beside "LOP Check" and "Purity Check".
• Under Custom Scan paste this in:

netsvcs
%SYSTEMDRIVE%\*.exe
/md5start
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
sceclt.dll
ntelogon.dll
logevent.dll
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
nvrd32.sys
symmpi.sys
adp3132.sys
/md5stop
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\drivers\*.sys /90
CREATERESTOREPOINT

• Click the "Run Scan" button. Do not change any settings unless specifically told to do so. The scan will not take long.

• When the scan completes, it will open two notepad windows: OTL.Txt and Extras.Txt.
• Note: These logs can be located in the OTL. folder on you C:\ drive if they fail to open automatically.
• Please Copy and Paste the contents of both files in your next reply. You may need two posts to fit them both in.

hi jontom - tdss detected only the second of the two threats: 11:06:38.0937 2580 \Device\Harddisk0\DR0 - detected TDSS File System (1). i chose the delete option; log follows.

otl was downloaded and ran without issue. here are all three of the logs; they seem to have fit in one post. and thanks again!

11:18:51.0531 3256 TDSS rootkit removing tool 2.8.8.0 Aug 24 2012 13:27:48
11:18:52.0140 3256 ============================================================
11:18:52.0140 3256 Current date / time: 2012/09/03 11:18:52.0140
11:18:52.0140 3256 SystemInfo:
11:18:52.0140 3256
11:18:52.0140 3256 OS Version: 5.1.2600 ServicePack: 3.0
11:18:52.0140 3256 Product type: Workstation
11:18:52.0140 3256 ComputerName: MAIN
11:18:52.0140 3256 UserName: T. Carlberg
11:18:52.0140 3256 Windows directory: C:\WINDOWS
11:18:52.0140 3256 System windows directory: C:\WINDOWS
11:18:52.0140 3256 Processor architecture: Intel x86
11:18:52.0140 3256 Number of processors: 2
11:18:52.0140 3256 Page size: 0x1000
11:18:52.0140 3256 Boot type: Normal boot
11:18:52.0140 3256 ============================================================
11:18:53.0656 3256 Drive \Device\Harddisk0\DR0 - Size: 0x12A05F2000 (74.51 Gb), SectorSize: 0x200, Cylinders: 0x25FE, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054
11:18:53.0656 3256 Drive \Device\Harddisk1\DR4 - Size: 0x1D1C1115E00 (1863.02 Gb), SectorSize: 0x200, Cylinders: 0x3B601, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
11:18:53.0937 3256 ============================================================
11:18:53.0937 3256 \Device\Harddisk0\DR0:
11:18:53.0953 3256 MBR partitions:
11:18:53.0953 3256 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0xFB04, BlocksNum 0x8DEE830
11:18:53.0953 3256 \Device\Harddisk1\DR4:
11:18:53.0953 3256 MBR partitions:
11:18:53.0953 3256 \Device\Harddisk1\DR4\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0xE8E074C1
11:18:53.0953 3256 ============================================================
11:18:54.0000 3256 C: <-> \Device\Harddisk0\DR0\Partition1
11:18:54.0015 3256 F: <-> \Device\Harddisk1\DR4\Partition1
11:18:54.0015 3256 ============================================================
11:18:54.0015 3256 Initialize success
11:18:54.0015 3256 ============================================================
11:19:02.0703 3292 ============================================================
11:19:02.0703 3292 Scan started
11:19:02.0703 3292 Mode: Manual; TDLFS;
11:19:02.0703 3292 ============================================================
11:19:04.0187 3292 ================ Scan system memory ========================
11:19:04.0203 3292 System memory - ok
11:19:04.0203 3292 ================ Scan services =============================
11:19:05.0328 3292 Abiosdsk - ok
11:19:05.0359 3292 [ 6ABB91494FE6C59089B9336452AB2EA3 ] abp480n5 C:\WINDOWS\system32\DRIVERS\ABP480N5.SYS
11:19:05.0359 3292 abp480n5 - ok
11:19:05.0406 3292 [ 8FD99680A539792A30E97944FDAECF17 ] ACPI C:\WINDOWS\system32\DRIVERS\ACPI.sys
11:19:05.0421 3292 ACPI - ok
11:19:05.0437 3292 [ 9859C0F6936E723E4892D7141B1327D5 ] ACPIEC C:\WINDOWS\system32\drivers\ACPIEC.sys
11:19:05.0453 3292 ACPIEC - ok
11:19:05.0468 3292 [ 9A11864873DA202C996558B2106B0BBC ] adpu160m C:\WINDOWS\system32\DRIVERS\adpu160m.sys
11:19:05.0468 3292 adpu160m - ok
11:19:05.0500 3292 [ 11C04B17ED2ABBB4833694BCD644AC90 ] aeaudio C:\WINDOWS\system32\drivers\aeaudio.sys
11:19:05.0500 3292 aeaudio - ok
11:19:05.0546 3292 [ 8BED39E3C35D6A489438B8141717A557 ] aec C:\WINDOWS\system32\drivers\aec.sys
11:19:05.0546 3292 aec - ok
11:19:05.0593 3292 [ 1E44BC1E83D8FD2305F8D452DB109CF9 ] AFD C:\WINDOWS\System32\drivers\afd.sys
11:19:05.0609 3292 AFD - ok
11:19:05.0640 3292 [ 08FD04AA961BDC77FB983F328334E3D7 ] agp440 C:\WINDOWS\system32\DRIVERS\agp440.sys
11:19:05.0640 3292 agp440 - ok
11:19:05.0640 3292 [ 03A7E0922ACFE1B07D5DB2EEB0773063 ] agpCPQ C:\WINDOWS\system32\DRIVERS\agpCPQ.sys
11:19:05.0640 3292 agpCPQ - ok
11:19:05.0656 3292 [ C23EA9B5F46C7F7910DB3EAB648FF013 ] Aha154x C:\WINDOWS\system32\DRIVERS\aha154x.sys
11:19:05.0656 3292 Aha154x - ok
11:19:05.0687 3292 [ 19DD0FB48B0C18892F70E2E7D61A1529 ] aic78u2 C:\WINDOWS\system32\DRIVERS\aic78u2.sys
11:19:05.0687 3292 aic78u2 - ok
11:19:05.0703 3292 [ B7FE594A7468AA0132DEB03FB8E34326 ] aic78xx C:\WINDOWS\system32\DRIVERS\aic78xx.sys
11:19:05.0703 3292 aic78xx - ok
11:19:05.0750 3292 [ A9A3DAA780CA6C9671A19D52456705B4 ] Alerter C:\WINDOWS\system32\alrsvc.dll
11:19:05.0750 3292 Alerter - ok
11:19:05.0765 3292 [ 8C515081584A38AA007909CD02020B3D ] ALG C:\WINDOWS\System32\alg.exe
11:19:05.0765 3292 ALG - ok
11:19:05.0781 3292 [ 1140AB9938809700B46BB88E46D72A96 ] AliIde C:\WINDOWS\system32\DRIVERS\aliide.sys
11:19:05.0781 3292 AliIde - ok
11:19:05.0781 3292 [ CB08AED0DE2DD889A8A820CD8082D83C ] alim1541 C:\WINDOWS\system32\DRIVERS\alim1541.sys
11:19:05.0781 3292 alim1541 - ok
11:19:05.0828 3292 [ 95B4FB835E28AA1336CEEB07FD5B9398 ] amdagp C:\WINDOWS\system32\DRIVERS\amdagp.sys
11:19:05.0828 3292 amdagp - ok
11:19:05.0828 3292 [ 79F5ADD8D24BD6893F2903A3E2F3FAD6 ] amsint C:\WINDOWS\system32\DRIVERS\amsint.sys
11:19:05.0828 3292 amsint - ok
11:19:05.0843 3292 AppMgmt - ok
11:19:05.0843 3292 [ 62D318E9A0C8FC9B780008E724283707 ] asc C:\WINDOWS\system32\DRIVERS\asc.sys
11:19:05.0843 3292 asc - ok
11:19:05.0859 3292 [ 69EB0CC7714B32896CCBFD5EDCBEA447 ] asc3350p C:\WINDOWS\system32\DRIVERS\asc3350p.sys
11:19:05.0859 3292 asc3350p - ok
11:19:05.0875 3292 [ 5D8DE112AA0254B907861E9E9C31D597 ] asc3550 C:\WINDOWS\system32\DRIVERS\asc3550.sys
11:19:05.0875 3292 asc3550 - ok
11:19:06.0015 3292 [ 0E5E4957549056E2BF2C49F4F6B601AD ] aspnet_state C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
11:19:06.0062 3292 aspnet_state - ok
11:19:06.0093 3292 [ B153AFFAC761E7F5FCFA822B9C4E97BC ] AsyncMac C:\WINDOWS\system32\DRIVERS\asyncmac.sys
11:19:06.0093 3292 AsyncMac - ok
11:19:06.0109 3292 [ 9F3A2F5AA6875C72BF062C712CFA2674 ] atapi C:\WINDOWS\system32\DRIVERS\atapi.sys
11:19:06.0109 3292 atapi - ok
11:19:06.0109 3292 Atdisk - ok
11:19:06.0156 3292 [ 9916C1225104BA14794209CFA8012159 ] Atmarpc C:\WINDOWS\system32\DRIVERS\atmarpc.sys
11:19:06.0171 3292 Atmarpc - ok
11:19:06.0218 3292 [ DEF7A7882BEC100FE0B2CE2549188F9D ] AudioSrv C:\WINDOWS\System32\audiosrv.dll
11:19:06.0218 3292 AudioSrv - ok
11:19:06.0218 3292 [ D9F724AA26C010A217C97606B160ED68 ] audstub C:\WINDOWS\system32\DRIVERS\audstub.sys
11:19:06.0234 3292 audstub - ok
11:19:06.0390 3292 [ D45B7995761253A92AB071D576114F28 ] AVG Security Toolbar Service C:\Program Files\AVG\AVG9\Toolbar\ToolbarBroker.exe
11:19:06.0406 3292 AVG Security Toolbar Service - ok
11:19:06.0453 3292 [ C4D15594DB5BE042D3346EA58DF87D89 ] avg9wd C:\Program Files\AVG\AVG9\avgwdsvc.exe
11:19:06.0468 3292 avg9wd - ok
11:19:06.0515 3292 [ B8C187439D27ABA430DD69FDCF1FA657 ] AvgLdx86 C:\WINDOWS\System32\Drivers\avgldx86.sys
11:19:06.0515 3292 AvgLdx86 - ok
11:19:06.0562 3292 [ 80FF2B1B7EEDA966394F0BAA895BBF4B ] AvgMfx86 C:\WINDOWS\System32\Drivers\avgmfx86.sys
11:19:06.0562 3292 AvgMfx86 - ok
11:19:06.0593 3292 [ 5BBCD8646074A3AF4EE9B321D12C2B64 ] AvgRkx86 C:\WINDOWS\system32\Drivers\avgrkx86.sys
11:19:06.0593 3292 AvgRkx86 - ok
11:19:06.0656 3292 [ 9A7A93388F503A34E7339AE7F9997449 ] AvgTdiX C:\WINDOWS\System32\Drivers\avgtdix.sys
11:19:06.0656 3292 AvgTdiX - ok
11:19:06.0687 3292 [ DA1F27D85E0D1525F6621372E7B685E9 ] Beep C:\WINDOWS\system32\drivers\Beep.sys
11:19:06.0687 3292 Beep - ok
11:19:06.0765 3292 [ 673CF4F6BB1FBE09331B526802FBB892 ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe
11:19:06.0781 3292 Bonjour Service - ok
11:19:06.0812 3292 [ CFD4E51402DA9838B5A04AE680AF54A0 ] Browser C:\WINDOWS\System32\browser.dll
11:19:06.0812 3292 Browser - ok
11:19:06.0843 3292 [ C945DC4EEE3F624DFD07788EA7F0DB0A ] bvrp_pci C:\WINDOWS\system32\drivers\bvrp_pci.sys
11:19:06.0843 3292 bvrp_pci - ok
11:19:06.0984 3292 catchme - ok
11:19:07.0015 3292 [ 90A673FC8E12A79AFBED2576F6A7AAF9 ] cbidf C:\WINDOWS\system32\DRIVERS\cbidf2k.sys
11:19:07.0015 3292 cbidf - ok
11:19:07.0031 3292 [ 90A673FC8E12A79AFBED2576F6A7AAF9 ] cbidf2k C:\WINDOWS\system32\drivers\cbidf2k.sys
11:19:07.0031 3292 cbidf2k - ok
11:19:07.0046 3292 [ F3EC03299634490E97BBCE94CD2954C7 ] cd20xrnt C:\WINDOWS\system32\DRIVERS\cd20xrnt.sys
11:19:07.0046 3292 cd20xrnt - ok
11:19:07.0078 3292 [ C1B486A7658353D33A10CC15211A873B ] Cdaudio C:\WINDOWS\system32\drivers\Cdaudio.sys
11:19:07.0078 3292 Cdaudio - ok
11:19:07.0093 3292 [ C885B02847F5D2FD45A24E219ED93B32 ] Cdfs C:\WINDOWS\system32\drivers\Cdfs.sys
11:19:07.0093 3292 Cdfs - ok
11:19:07.0140 3292 [ 1F4260CC5B42272D71F79E570A27A4FE ] Cdrom C:\WINDOWS\system32\DRIVERS\cdrom.sys
11:19:07.0140 3292 Cdrom - ok
11:19:07.0140 3292 Changer - ok
11:19:07.0187 3292 [ 1CFE720EB8D93A7158A4EBC3AB178BDE ] CiSvc C:\WINDOWS\system32\cisvc.exe
11:19:07.0187 3292 CiSvc - ok
11:19:07.0234 3292 [ 34CBE729F38138217F9C80212A2A0C82 ] ClipSrv C:\WINDOWS\system32\clipsrv.exe
11:19:07.0234 3292 ClipSrv - ok
11:19:07.0281 3292 [ D87ACAED61E417BBA546CED5E7E36D9C ] clr_optimization_v2.0.50727_32 C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
11:19:07.0718 3292 clr_optimization_v2.0.50727_32 - ok
11:19:08.0171 3292 [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
11:19:08.0171 3292 clr_optimization_v4.0.30319_32 - ok
11:19:08.0171 3292 [ E5DCB56C533014ECBC556A8357C929D5 ] CmdIde C:\WINDOWS\system32\DRIVERS\cmdide.sys
11:19:08.0171 3292 CmdIde - ok
11:19:08.0187 3292 COMSysApp - ok
11:19:08.0218 3292 [ 3EE529119EED34CD212A215E8C40D4B6 ] Cpqarray C:\WINDOWS\system32\DRIVERS\cpqarray.sys
11:19:08.0234 3292 Cpqarray - ok
11:19:08.0265 3292 [ 3D4E199942E29207970E04315D02AD3B ] CryptSvc C:\WINDOWS\System32\cryptsvc.dll
11:19:08.0281 3292 CryptSvc - ok
11:19:08.0281 3292 [ E550E7418984B65A78299D248F0A7F36 ] dac2w2k C:\WINDOWS\system32\DRIVERS\dac2w2k.sys
11:19:08.0281 3292 dac2w2k - ok
11:19:08.0296 3292 [ 683789CAA3864EB46125AE86FF677D34 ] dac960nt C:\WINDOWS\system32\DRIVERS\dac960nt.sys
11:19:08.0296 3292 dac960nt - ok
11:19:08.0343 3292 [ 6B27A5C03DFB94B4245739065431322C ] DcomLaunch C:\WINDOWS\system32\rpcss.dll
11:19:08.0406 3292 DcomLaunch - ok
11:19:08.0453 3292 [ 5E38D7684A49CACFB752B046357E0589 ] Dhcp C:\WINDOWS\System32\dhcpcsvc.dll
11:19:08.0453 3292 Dhcp - ok
11:19:08.0515 3292 [ 044452051F3E02E7963599FC8F4F3E25 ] Disk C:\WINDOWS\system32\DRIVERS\disk.sys
11:19:08.0515 3292 Disk - ok
11:19:08.0515 3292 dmadmin - ok
11:19:08.0593 3292 [ D992FE1274BDE0F84AD826ACAE022A41 ] dmboot C:\WINDOWS\system32\drivers\dmboot.sys
11:19:08.0625 3292 dmboot - ok
11:19:08.0640 3292 [ 7C824CF7BBDE77D95C08005717A95F6F ] dmio C:\WINDOWS\system32\drivers\dmio.sys
11:19:08.0640 3292 dmio - ok
11:19:08.0703 3292 [ E9317282A63CA4D188C0DF5E09C6AC5F ] dmload C:\WINDOWS\system32\drivers\dmload.sys
11:19:08.0703 3292 dmload - ok
11:19:08.0750 3292 [ 57EDEC2E5F59F0335E92F35184BC8631 ] dmserver C:\WINDOWS\System32\dmserver.dll
11:19:08.0750 3292 dmserver - ok
11:19:08.0796 3292 [ 8A208DFCF89792A484E76C40E5F50B45 ] DMusic C:\WINDOWS\system32\drivers\DMusic.sys
11:19:08.0796 3292 DMusic - ok
11:19:08.0843 3292 [ 5F7E24FA9EAB896051FFB87F840730D2 ] Dnscache C:\WINDOWS\System32\dnsrslvr.dll
11:19:08.0843 3292 Dnscache - ok
11:19:08.0875 3292 [ 0F0F6E687E5E15579EF4DA8DD6945814 ] Dot3svc C:\WINDOWS\System32\dot3svc.dll
11:19:08.0875 3292 Dot3svc - ok
11:19:08.0875 3292 [ 40F3B93B4E5B0126F2F5C0A7A5E22660 ] dpti2o C:\WINDOWS\system32\DRIVERS\dpti2o.sys
11:19:08.0890 3292 dpti2o - ok
11:19:08.0921 3292 [ 8F5FCFF8E8848AFAC920905FBD9D33C8 ] drmkaud C:\WINDOWS\system32\drivers\drmkaud.sys
11:19:08.0921 3292 drmkaud - ok
11:19:08.0953 3292 [ B15F9E526BA511A48B1B1B8537815740 ] drvmcdb C:\WINDOWS\system32\drivers\drvmcdb.sys
11:19:08.0953 3292 drvmcdb - ok
11:19:08.0984 3292 [ FA4670CAE95AE2BB857C68E535661145 ] drvnddm C:\WINDOWS\system32\drivers\drvnddm.sys
11:19:08.0984 3292 drvnddm - ok
11:19:09.0031 3292 [ 7D91DC6342248369F94D6EBA0CF42E99 ] E100B C:\WINDOWS\system32\DRIVERS\e100b325.sys
11:19:09.0046 3292 E100B - ok
11:19:09.0062 3292 [ 2187855A7703ADEF0CEF9EE4285182CC ] EapHost C:\WINDOWS\System32\eapsvc.dll
11:19:09.0062 3292 EapHost - ok
11:19:09.0109 3292 [ BC93B4A066477954555966D77FEC9ECB ] ERSvc C:\WINDOWS\System32\ersvc.dll
11:19:09.0109 3292 ERSvc - ok
11:19:09.0156 3292 [ 65DF52F5B8B6E9BBD183505225C37315 ] Eventlog C:\WINDOWS\system32\services.exe
11:19:09.0156 3292 Eventlog - ok
11:19:09.0218 3292 [ D4991D98F2DB73C60D042F1AEF79EFAE ] EventSystem C:\WINDOWS\system32\es.dll
11:19:09.0218 3292 EventSystem - ok
11:19:09.0265 3292 [ 38D332A6D56AF32635675F132548343E ] Fastfat C:\WINDOWS\system32\drivers\Fastfat.sys
11:19:09.0265 3292 Fastfat - ok
11:19:09.0312 3292 [ 99BC0B50F511924348BE19C7C7313BBF ] FastUserSwitchingCompatibility C:\WINDOWS\System32\shsvcs.dll
11:19:09.0312 3292 FastUserSwitchingCompatibility - ok
11:19:09.0312 3292 [ 92CDD60B6730B9F50F6A1A0C1F8CDC81 ] Fdc C:\WINDOWS\system32\DRIVERS\fdc.sys
11:19:09.0312 3292 Fdc - ok
11:19:09.0328 3292 [ D45926117EB9FA946A6AF572FBE1CAA3 ] Fips C:\WINDOWS\system32\drivers\Fips.sys
11:19:09.0328 3292 Fips - ok
11:19:09.0375 3292 [ 9D27E7B80BFCDF1CDD9B555862D5E7F0 ] Flpydisk C:\WINDOWS\system32\DRIVERS\flpydisk.sys
11:19:09.0375 3292 Flpydisk - ok
11:19:09.0421 3292 [ B2CF4B0786F8212CB92ED2B50C6DB6B0 ] FltMgr C:\WINDOWS\system32\drivers\fltmgr.sys
11:19:09.0437 3292 FltMgr - ok
11:19:09.0515 3292 [ 8BA7C024070F2B7FDD98ED8A4BA41789 ] FontCache3.0.0.0 C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
11:19:09.0515 3292 FontCache3.0.0.0 - ok
11:19:09.0531 3292 [ 3E1E2BD4F39B0E2B7DC4F4D2BCC2779A ] Fs_Rec C:\WINDOWS\system32\drivers\Fs_Rec.sys
11:19:09.0531 3292 Fs_Rec - ok
11:19:09.0546 3292 [ 6AC26732762483366C3969C9E4D2259D ] Ftdisk C:\WINDOWS\system32\DRIVERS\ftdisk.sys
11:19:09.0546 3292 Ftdisk - ok
11:19:09.0593 3292 [ 8182FF89C65E4D38B2DE4BB0FB18564E ] GEARAspiWDM C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
11:19:09.0593 3292 GEARAspiWDM - ok
11:19:09.0640 3292 [ 0A02C63C8B144BD8C86B103DEE7C86A2 ] Gpc C:\WINDOWS\system32\DRIVERS\msgpc.sys
11:19:09.0640 3292 Gpc - ok
11:19:09.0703 3292 gupdate - ok
11:19:09.0703 3292 gupdatem - ok
11:19:09.0796 3292 [ 4FCCA060DFE0C51A09DD5C3843888BCD ] helpsvc C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
11:19:09.0796 3292 helpsvc - ok
11:19:09.0796 3292 HidServ - ok
11:19:09.0828 3292 [ CCF82C5EC8A7326C3066DE870C06DAF1 ] HidUsb C:\WINDOWS\system32\DRIVERS\hidusb.sys
11:19:09.0828 3292 HidUsb - ok
11:19:09.0890 3292 [ 8878BD685E490239777BFE51320B88E9 ] hkmsvc C:\WINDOWS\System32\kmsvc.dll
11:19:09.0890 3292 hkmsvc - ok
11:19:09.0906 3292 [ B028377DEA0546A5FCFBA928A8AEFAE0 ] hpn C:\WINDOWS\system32\DRIVERS\hpn.sys
11:19:09.0921 3292 hpn - ok
11:19:09.0968 3292 [ 77E4FF0B73BC0AEAAF39BF0C8104231F ] HSFHWBS2 C:\WINDOWS\system32\DRIVERS\HSFHWBS2.sys
11:19:09.0968 3292 HSFHWBS2 - ok
11:19:10.0015 3292 [ 60E1604729A15EF4A3B05F298427B3B1 ] HSF_DP C:\WINDOWS\system32\DRIVERS\HSF_DP.sys
11:19:10.0046 3292 HSF_DP - ok
11:19:10.0093 3292 [ F80A415EF82CD06FFAF0D971528EAD38 ] HTTP C:\WINDOWS\system32\Drivers\HTTP.sys
11:19:10.0093 3292 HTTP - ok
11:19:10.0156 3292 [ 6100A808600F44D999CEBDEF8841C7A3 ] HTTPFilter C:\WINDOWS\System32\w3ssl.dll
11:19:10.0156 3292 HTTPFilter - ok
11:19:10.0156 3292 [ 9368670BD426EBEA5E8B18A62416EC28 ] i2omgmt C:\WINDOWS\system32\drivers\i2omgmt.sys
11:19:10.0156 3292 i2omgmt - ok
11:19:10.0187 3292 [ F10863BF1CCC290BABD1A09188AE49E0 ] i2omp C:\WINDOWS\system32\DRIVERS\i2omp.sys
11:19:10.0218 3292 i2omp - ok
11:19:10.0234 3292 [ 4A0B06AA8943C1E332520F7440C0AA30 ] i8042prt C:\WINDOWS\system32\DRIVERS\i8042prt.sys
11:19:10.0234 3292 i8042prt - ok
11:19:10.0312 3292 [ 5A8E05F1D5C36ABD58CFFA111EB325EA ] ialm C:\WINDOWS\system32\DRIVERS\ialmnt5.sys
11:19:10.0343 3292 ialm - ok
11:19:10.0437 3292 [ C01AC32DC5C03076CFB852CB5DA5229C ] idsvc C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
11:19:10.0500 3292 idsvc - ok
11:19:10.0562 3292 [ 083A052659F5310DD8B6A6CB05EDCF8E ] Imapi C:\WINDOWS\system32\DRIVERS\imapi.sys
11:19:10.0562 3292 Imapi - ok
11:19:10.0609 3292 [ 30DEAF54A9755BB8546168CFE8A6B5E1 ] ImapiService C:\WINDOWS\system32\imapi.exe
11:19:10.0609 3292 ImapiService - ok
11:19:10.0625 3292 [ 4A40E045FAEE58631FD8D91AFC620719 ] ini910u C:\WINDOWS\system32\DRIVERS\ini910u.sys
11:19:10.0625 3292 ini910u - ok
11:19:10.0640 3292 [ B5466A9250342A7AA0CD1FBA13420678 ] IntelIde C:\WINDOWS\system32\DRIVERS\intelide.sys
11:19:10.0640 3292 IntelIde - ok
11:19:10.0703 3292 [ 8C953733D8F36EB2133F5BB58808B66B ] intelppm C:\WINDOWS\system32\DRIVERS\intelppm.sys
11:19:10.0703 3292 intelppm - ok
11:19:10.0890 3292 [ 7BDB4E00E1CB174B56E5B2C31DDE68A7 ] IntuitUpdateService C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
11:19:10.0890 3292 IntuitUpdateService - ok
11:19:10.0968 3292 [ 1663A135865F0BA6E853353E98E67F2A ] IntuitUpdateServiceV4 C:\Program Files\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe
11:19:10.0968 3292 IntuitUpdateServiceV4 - ok
11:19:11.0031 3292 [ 3BB22519A194418D5FEC05D800A19AD0 ] Ip6Fw C:\WINDOWS\system32\drivers\ip6fw.sys
11:19:11.0031 3292 Ip6Fw - ok
11:19:11.0093 3292 [ 731F22BA402EE4B62748ADAF6363C182 ] IpFilterDriver C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
11:19:11.0093 3292 IpFilterDriver - ok
11:19:11.0109 3292 [ B87AB476DCF76E72010632B5550955F5 ] IpInIp C:\WINDOWS\system32\DRIVERS\ipinip.sys
11:19:11.0109 3292 IpInIp - ok
11:19:11.0125 3292 [ CC748EA12C6EFFDE940EE98098BF96BB ] IpNat C:\WINDOWS\system32\DRIVERS\ipnat.sys
11:19:11.0125 3292 IpNat - ok
11:19:11.0187 3292 [ 32CDEDD15E2D1A557CD54552AE78FF86 ] iPod Service C:\Program Files\iPod\bin\iPodService.exe
11:19:11.0218 3292 iPod Service - ok
11:19:11.0265 3292 [ 23C74D75E36E7158768DD63D92789A91 ] IPSec C:\WINDOWS\system32\DRIVERS\ipsec.sys
11:19:11.0265 3292 IPSec - ok
11:19:11.0296 3292 [ C93C9FF7B04D772627A3646D89F7BF89 ] IRENUM C:\WINDOWS\system32\DRIVERS\irenum.sys
11:19:11.0296 3292 IRENUM - ok
11:19:11.0359 3292 [ 05A299EC56E52649B1CF2FC52D20F2D7 ] isapnp C:\WINDOWS\system32\DRIVERS\isapnp.sys
11:19:11.0359 3292 isapnp - ok
11:19:11.0484 3292 [ 381B25DC8E958D905B33130D500BBF29 ] JavaQuickStarterService C:\Program Files\Java\jre6\bin\jqs.exe
11:19:11.0484 3292 JavaQuickStarterService - ok
11:19:11.0500 3292 [ 463C1EC80CD17420A542B7F36A36F128 ] Kbdclass C:\WINDOWS\system32\DRIVERS\kbdclass.sys
11:19:11.0500 3292 Kbdclass - ok
11:19:11.0515 3292 [ 692BCF44383D056AED41B045A323D378 ] kmixer C:\WINDOWS\system32\drivers\kmixer.sys
11:19:11.0515 3292 kmixer - ok
11:19:11.0562 3292 [ B467646C54CC746128904E1654C750C1 ] KSecDD C:\WINDOWS\system32\drivers\KSecDD.sys
11:19:11.0578 3292 KSecDD - ok
11:19:11.0609 3292 [ 3A7C3CBE5D96B8AE96CE81F0B22FB527 ] lanmanserver C:\WINDOWS\System32\srvsvc.dll
11:19:11.0625 3292 lanmanserver - ok
11:19:11.0671 3292 [ A8888A5327621856C0CEC4E385F69309 ] lanmanworkstation C:\WINDOWS\System32\wkssvc.dll
11:19:11.0671 3292 lanmanworkstation - ok
11:19:11.0671 3292 lbrtfdc - ok
11:19:11.0734 3292 [ A7DB739AE99A796D91580147E919CC59 ] LmHosts C:\WINDOWS\System32\lmhsvc.dll
11:19:11.0734 3292 LmHosts - ok
11:19:11.0750 3292 [ EEAEA6514BA7C9D273B5E87C4E1AAB30 ] mdmxsdk C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys
11:19:11.0750 3292 mdmxsdk - ok
11:19:11.0781 3292 [ 986B1FF5814366D71E0AC5755C88F2D3 ] Messenger C:\WINDOWS\System32\msgsvc.dll
11:19:11.0796 3292 Messenger - ok
11:19:12.0078 3292 Microsoft SharePoint Workspace Audit Service - ok
11:19:12.0109 3292 [ 4AE068242760A1FB6E1A44BF4E16AFA6 ] mnmdd C:\WINDOWS\system32\drivers\mnmdd.sys
11:19:12.0109 3292 mnmdd - ok
11:19:12.0156 3292 [ D18F1F0C101D06A1C1ADF26EED16FCDD ] mnmsrvc C:\WINDOWS\system32\mnmsrvc.exe
11:19:12.0156 3292 mnmsrvc - ok
11:19:12.0203 3292 [ DFCBAD3CEC1C5F964962AE10E0BCC8E1 ] Modem C:\WINDOWS\system32\drivers\Modem.sys
11:19:12.0203 3292 Modem - ok
11:19:12.0250 3292 [ 1992E0D143B09653AB0F9C5E04B0FD65 ] MODEMCSA C:\WINDOWS\system32\drivers\MODEMCSA.sys
11:19:12.0250 3292 MODEMCSA - ok
11:19:12.0265 3292 [ 35C9E97194C8CFB8430125F8DBC34D04 ] Mouclass C:\WINDOWS\system32\DRIVERS\mouclass.sys
11:19:12.0265 3292 Mouclass - ok
11:19:12.0296 3292 [ A80B9A0BAD1B73637DBCBBA7DF72D3FD ] MountMgr C:\WINDOWS\system32\drivers\MountMgr.sys
11:19:12.0296 3292 MountMgr - ok
11:19:12.0343 3292 [ 3F4BB95E5A44F3BE34824E8E7CAF0737 ] mraid35x C:\WINDOWS\system32\DRIVERS\mraid35x.sys
11:19:12.0343 3292 mraid35x - ok
11:19:12.0390 3292 [ 6075DE2AD531F6E30C9995DFDA22001F ] mrtRate C:\WINDOWS\system32\drivers\mrtRate.sys
11:19:12.0390 3292 mrtRate - ok
11:19:12.0390 3292 [ 11D42BB6206F33FBB3BA0288D3EF81BD ] MRxDAV C:\WINDOWS\system32\DRIVERS\mrxdav.sys
11:19:12.0390 3292 MRxDAV - ok
11:19:12.0453 3292 [ 7D304A5EB4344EBEEAB53A2FE3FFB9F0 ] MRxSmb C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
11:19:12.0484 3292 MRxSmb - ok
11:19:12.0531 3292 [ A137F1470499A205ABBB9AAFB3B6F2B1 ] MSDTC C:\WINDOWS\system32\msdtc.exe
11:19:12.0531 3292 MSDTC - ok
11:19:12.0578 3292 [ C941EA2454BA8350021D774DAF0F1027 ] Msfs C:\WINDOWS\system32\drivers\Msfs.sys
11:19:12.0578 3292 Msfs - ok
11:19:12.0593 3292 MSIServer - ok
11:19:12.0609 3292 [ D1575E71568F4D9E14CA56B7B0453BF1 ] MSKSSRV C:\WINDOWS\system32\drivers\MSKSSRV.sys
11:19:12.0609 3292 MSKSSRV - ok
11:19:12.0625 3292 [ 325BB26842FC7CCC1FCCE2C457317F3E ] MSPCLOCK C:\WINDOWS\system32\drivers\MSPCLOCK.sys
11:19:12.0625 3292 MSPCLOCK - ok
11:19:12.0671 3292 [ BAD59648BA099DA4A17680B39730CB3D ] MSPQM C:\WINDOWS\system32\drivers\MSPQM.sys
11:19:12.0671 3292 MSPQM - ok
11:19:12.0687 3292 [ AF5F4F3F14A8EA2C26DE30F7A1E17136 ] mssmbios C:\WINDOWS\system32\DRIVERS\mssmbios.sys
11:19:12.0687 3292 mssmbios - ok
11:19:12.0734 3292 [ DE6A75F5C270E756C5508D94B6CF68F5 ] Mup C:\WINDOWS\system32\drivers\Mup.sys
11:19:12.0734 3292 Mup - ok
11:19:12.0781 3292 [ 0102140028FAD045756796E1C685D695 ] napagent C:\WINDOWS\System32\qagentrt.dll
11:19:12.0796 3292 napagent - ok
11:19:12.0828 3292 [ 1DF7F42665C94B825322FAE71721130D ] NDIS C:\WINDOWS\system32\drivers\NDIS.sys
11:19:12.0828 3292 NDIS - ok
11:19:12.0875 3292 [ 0109C4F3850DFBAB279542515386AE22 ] NdisTapi C:\WINDOWS\system32\DRIVERS\ndistapi.sys
11:19:12.0875 3292 NdisTapi - ok
11:19:12.0890 3292 [ F927A4434C5028758A842943EF1A3849 ] Ndisuio C:\WINDOWS\system32\DRIVERS\ndisuio.sys
11:19:12.0890 3292 Ndisuio - ok
11:19:12.0937 3292 [ EDC1531A49C80614B2CFDA43CA8659AB ] NdisWan C:\WINDOWS\system32\DRIVERS\ndiswan.sys
11:19:12.0937 3292 NdisWan - ok
11:19:12.0968 3292 [ 9282BD12DFB069D3889EB3FCC1000A9B ] NDProxy C:\WINDOWS\system32\drivers\NDProxy.sys
11:19:12.0984 3292 NDProxy - ok
11:19:12.0984 3292 [ 5D81CF9A2F1A3A756B66CF684911CDF0 ] NetBIOS C:\WINDOWS\system32\DRIVERS\netbios.sys
11:19:12.0984 3292 NetBIOS - ok
11:19:13.0000 3292 [ 74B2B2F5BEA5E9A3DC021D685551BD3D ] NetBT C:\WINDOWS\system32\DRIVERS\netbt.sys
11:19:13.0015 3292 NetBT - ok
11:19:13.0062 3292 [ B857BA82860D7FF85AE29B095645563B ] NetDDE C:\WINDOWS\system32\netdde.exe
11:19:13.0062 3292 NetDDE - ok
11:19:13.0062 3292 [ B857BA82860D7FF85AE29B095645563B ] NetDDEdsdm C:\WINDOWS\system32\netdde.exe
11:19:13.0078 3292 NetDDEdsdm - ok
11:19:13.0093 3292 [ BF2466B3E18E970D8A976FB95FC1CA85 ] Netlogon C:\WINDOWS\system32\lsass.exe
11:19:13.0093 3292 Netlogon - ok
11:19:13.0125 3292 [ 13E67B55B3ABD7BF3FE7AAE5A0F9A9DE ] Netman C:\WINDOWS\System32\netman.dll
11:19:13.0140 3292 Netman - ok
11:19:13.0265 3292 [ 02D0798F376FCBD0210EDA58476D0B1B ] NetSvc C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
11:19:13.0265 3292 NetSvc - ok
11:19:13.0296 3292 [ D34612C5D02D026535B3095D620626AE ] NetTcpPortSharing C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
11:19:13.0296 3292 NetTcpPortSharing - ok
11:19:13.0343 3292 [ 943337D786A56729263071623BBB9DE5 ] Nla C:\WINDOWS\System32\mswsock.dll
11:19:13.0359 3292 Nla - ok
11:19:13.0359 3292 [ 3182D64AE053D6FB034F44B6DEF8034A ] Npfs C:\WINDOWS\system32\drivers\Npfs.sys
11:19:13.0359 3292 Npfs - ok
11:19:13.0406 3292 [ 78A08DD6A8D65E697C18E1DB01C5CDCA ] Ntfs C:\WINDOWS\system32\drivers\Ntfs.sys
11:19:13.0406 3292 Ntfs - ok
11:19:13.0421 3292 [ BF2466B3E18E970D8A976FB95FC1CA85 ] NtLmSsp C:\WINDOWS\system32\lsass.exe
11:19:13.0421 3292 NtLmSsp - ok
11:19:13.0468 3292 [ 156F64A3345BD23C600655FB4D10BC08 ] NtmsSvc C:\WINDOWS\system32\ntmssvc.dll
11:19:13.0484 3292 NtmsSvc - ok
11:19:13.0500 3292 [ 73C1E1F395918BC2C6DD67AF7591A3AD ] Null C:\WINDOWS\system32\drivers\Null.sys
11:19:13.0500 3292 Null - ok
11:19:13.0578 3292 [ 2B298519EDBFCF451D43E0F1E8F1006D ] nv C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
11:19:13.0625 3292 nv - ok
11:19:13.0656 3292 [ B305F3FAD35083837EF46A0BBCE2FC57 ] NwlnkFlt C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
11:19:13.0656 3292 NwlnkFlt - ok
11:19:13.0671 3292 [ C99B3415198D1AAB7227F2C88FD664B9 ] NwlnkFwd C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
11:19:13.0671 3292 NwlnkFwd - ok
11:19:13.0687 3292 [ 53D5F1278D9EDB21689BBBCECC09108D ] omci C:\WINDOWS\system32\DRIVERS\omci.sys
11:19:13.0687 3292 omci - ok
11:19:13.0796 3292 [ 9D10F99A6712E28F8ACD5641E3A7EA6B ] ose C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
11:19:13.0796 3292 ose - ok
11:19:14.0125 3292 [ 358A9CCA612C68EB2F07DDAD4CE1D8D7 ] osppsvc C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
11:19:14.0343 3292 osppsvc - ok
11:19:14.0406 3292 [ 5575FAF8F97CE5E713D108C2A58D7C7C ] Parport C:\WINDOWS\system32\DRIVERS\parport.sys
11:19:14.0406 3292 Parport - ok
11:19:14.0453 3292 [ BEB3BA25197665D82EC7065B724171C6 ] PartMgr C:\WINDOWS\system32\drivers\PartMgr.sys
11:19:14.0453 3292 PartMgr - ok
11:19:14.0484 3292 [ 70E98B3FD8E963A6A46A2E6247E0BEA1 ] ParVdm C:\WINDOWS\system32\drivers\ParVdm.sys
11:19:14.0484 3292 ParVdm - ok
11:19:14.0484 3292 [ A219903CCF74233761D92BEF471A07B1 ] PCI C:\WINDOWS\system32\DRIVERS\pci.sys
11:19:14.0484 3292 PCI - ok
11:19:14.0500 3292 PCIDump - ok
11:19:14.0515 3292 [ CCF5F451BB1A5A2A522A76E670000FF0 ] PCIIde C:\WINDOWS\system32\DRIVERS\pciide.sys
11:19:14.0515 3292 PCIIde - ok
11:19:14.0546 3292 [ 9E89EF60E9EE05E3F2EEF2DA7397F1C1 ] Pcmcia C:\WINDOWS\system32\drivers\Pcmcia.sys
11:19:14.0546 3292 Pcmcia - ok
11:19:14.0546 3292 PDCOMP - ok
11:19:14.0562 3292 PDFRAME - ok
11:19:14.0562 3292 PDRELI - ok
11:19:14.0578 3292 PDRFRAME - ok
11:19:14.0578 3292 [ 6C14B9C19BA84F73D3A86DBA11133101 ] perc2 C:\WINDOWS\system32\DRIVERS\perc2.sys
11:19:14.0578 3292 perc2 - ok
11:19:14.0593 3292 [ F50F7C27F131AFE7BEBA13E14A3B9416 ] perc2hib C:\WINDOWS\system32\DRIVERS\perc2hib.sys
11:19:14.0593 3292 perc2hib - ok
11:19:14.0656 3292 [ 444F122E68DB44C0589227781F3C8B3F ] pfc C:\WINDOWS\system32\drivers\pfc.sys
11:19:14.0656 3292 pfc - ok
11:19:14.0671 3292 [ 65DF52F5B8B6E9BBD183505225C37315 ] PlugPlay C:\WINDOWS\system32\services.exe
11:19:14.0671 3292 PlugPlay - ok
11:19:14.0687 3292 [ BF2466B3E18E970D8A976FB95FC1CA85 ] PolicyAgent C:\WINDOWS\system32\lsass.exe
11:19:14.0687 3292 PolicyAgent - ok
11:19:14.0750 3292 [ EFEEC01B1D3CF84F16DDD24D9D9D8F99 ] PptpMiniport C:\WINDOWS\system32\DRIVERS\raspptp.sys
11:19:14.0750 3292 PptpMiniport - ok
11:19:14.0750 3292 [ BF2466B3E18E970D8A976FB95FC1CA85 ] ProtectedStorage C:\WINDOWS\system32\lsass.exe
11:19:14.0750 3292 ProtectedStorage - ok
11:19:14.0765 3292 [ 09298EC810B07E5D582CB3A3F9255424 ] PSched C:\WINDOWS\system32\DRIVERS\psched.sys
11:19:14.0765 3292 PSched - ok
11:19:14.0812 3292 [ 80D317BD1C3DBC5D4FE7B1678C60CADD ] Ptilink C:\WINDOWS\system32\DRIVERS\ptilink.sys
11:19:14.0812 3292 Ptilink - ok
11:19:14.0843 3292 [ 1962166E0CEB740704F30FA55AD3D509 ] PxHelp20 C:\WINDOWS\system32\Drivers\PxHelp20.sys
11:19:14.0843 3292 PxHelp20 - ok
11:19:14.0875 3292 [ 0A63FB54039EB5662433CABA3B26DBA7 ] ql1080 C:\WINDOWS\system32\DRIVERS\ql1080.sys
11:19:14.0875 3292 ql1080 - ok
11:19:14.0875 3292 [ 6503449E1D43A0FF0201AD5CB1B8C706 ] Ql10wnt C:\WINDOWS\system32\DRIVERS\ql10wnt.sys
11:19:14.0890 3292 Ql10wnt - ok
11:19:14.0890 3292 [ 156ED0EF20C15114CA097A34A30D8A01 ] ql12160 C:\WINDOWS\system32\DRIVERS\ql12160.sys
11:19:14.0890 3292 ql12160 - ok
11:19:14.0906 3292 [ 70F016BEBDE6D29E864C1230A07CC5E6 ] ql1240 C:\WINDOWS\system32\DRIVERS\ql1240.sys
11:19:14.0906 3292 ql1240 - ok
11:19:14.0906 3292 [ 907F0AEEA6BC451011611E732BD31FCF ] ql1280 C:\WINDOWS\system32\DRIVERS\ql1280.sys
11:19:14.0906 3292 ql1280 - ok
11:19:14.0921 3292 [ FE0D99D6F31E4FAD8159F690D68DED9C ] RasAcd C:\WINDOWS\system32\DRIVERS\rasacd.sys
11:19:14.0921 3292 RasAcd - ok
11:19:14.0968 3292 [ AD188BE7BDF94E8DF4CA0A55C00A5073 ] RasAuto C:\WINDOWS\System32\rasauto.dll
11:19:14.0968 3292 RasAuto - ok
11:19:14.0984 3292 [ 11B4A627BC9614B885C4969BFA5FF8A6 ] Rasl2tp C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
11:19:14.0984 3292 Rasl2tp - ok
11:19:15.0031 3292 [ 76A9A3CBEADD68CC57CDA5E1D7448235 ] RasMan C:\WINDOWS\System32\rasmans.dll
11:19:15.0046 3292 RasMan - ok
11:19:15.0062 3292 [ 5BC962F2654137C9909C3D4603587DEE ] RasPppoe C:\WINDOWS\system32\DRIVERS\raspppoe.sys
11:19:15.0062 3292 RasPppoe - ok
11:19:15.0062 3292 [ FDBB1D60066FCFBB7452FD8F9829B242 ] Raspti C:\WINDOWS\system32\DRIVERS\raspti.sys
11:19:15.0078 3292 Raspti - ok
11:19:15.0093 3292 [ 7AD224AD1A1437FE28D89CF22B17780A ] Rdbss C:\WINDOWS\system32\DRIVERS\rdbss.sys
11:19:15.0093 3292 Rdbss - ok
11:19:15.0093 3292 [ 4912D5B403614CE99C28420F75353332 ] RDPCDD C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
11:19:15.0109 3292 RDPCDD - ok
11:19:15.0187 3292 [ 15CABD0F7C00C47C70124907916AF3F1 ] rdpdr C:\WINDOWS\system32\DRIVERS\rdpdr.sys
11:19:15.0187 3292 rdpdr - ok
11:19:15.0234 3292 [ 43AF5212BD8FB5BA6EED9754358BD8F7 ] RDPWD C:\WINDOWS\system32\drivers\RDPWD.sys
11:19:15.0234 3292 RDPWD - ok
11:19:15.0281 3292 [ 3C37BF86641BDA977C3BF8A840F3B7FA ] RDSessMgr C:\WINDOWS\system32\sessmgr.exe
11:19:15.0281 3292 RDSessMgr - ok
11:19:15.0312 3292 [ F828DD7E1419B6653894A8F97A0094C5 ] redbook C:\WINDOWS\system32\DRIVERS\redbook.sys
11:19:15.0312 3292 redbook - ok
11:19:15.0359 3292 [ 7E699FF5F59B5D9DE5390E3C34C67CF5 ] RemoteAccess C:\WINDOWS\System32\mprdim.dll
11:19:15.0359 3292 RemoteAccess - ok
11:19:15.0390 3292 [ AAED593F84AFA419BBAE8572AF87CF6A ] RpcLocator C:\WINDOWS\system32\locator.exe
11:19:15.0390 3292 RpcLocator - ok
11:19:15.0421 3292 [ 6B27A5C03DFB94B4245739065431322C ] RpcSs C:\WINDOWS\System32\rpcss.dll
11:19:15.0421 3292 RpcSs - ok
11:19:15.0468 3292 [ 471B3F9741D762ABE75E9DEEA4787E47 ] RSVP C:\WINDOWS\system32\rsvp.exe
11:19:15.0468 3292 RSVP - ok
11:19:15.0484 3292 [ BF2466B3E18E970D8A976FB95FC1CA85 ] SamSs C:\WINDOWS\system32\lsass.exe
11:19:15.0500 3292 SamSs - ok
11:19:15.0515 3292 [ 86D007E7A654B9A71D1D7D856B104353 ] SCardSvr C:\WINDOWS\System32\SCardSvr.exe
11:19:15.0515 3292 SCardSvr - ok
11:19:15.0562 3292 [ 0A9A7365A1CA4319AA7C1D6CD8E4EAFA ] Schedule C:\WINDOWS\system32\schedsvc.dll
11:19:15.0562 3292 Schedule - ok
11:19:15.0625 3292 [ 90A3935D05B494A5A39D37E71F09A677 ] Secdrv C:\WINDOWS\system32\DRIVERS\secdrv.sys
11:19:15.0625 3292 Secdrv - ok
11:19:15.0671 3292 [ CBE612E2BB6A10E3563336191EDA1250 ] seclogon C:\WINDOWS\System32\seclogon.dll
11:19:15.0671 3292 seclogon - ok
11:19:15.0718 3292 [ 7FDD5D0684ECA8C1F68B4D99D124DCD0 ] SENS C:\WINDOWS\system32\sens.dll
11:19:15.0734 3292 SENS - ok
11:19:15.0781 3292 [ 0F29512CCD6BEAD730039FB4BD2C85CE ] serenum C:\WINDOWS\system32\DRIVERS\serenum.sys
11:19:15.0781 3292 serenum - ok
11:19:15.0796 3292 [ CCA207A8896D4C6A0C9CE29A4AE411A7 ] Serial C:\WINDOWS\system32\DRIVERS\serial.sys
11:19:15.0796 3292 Serial - ok
11:19:15.0828 3292 [ 8E6B8C671615D126FDC553D1E2DE5562 ] Sfloppy C:\WINDOWS\system32\drivers\Sfloppy.sys
11:19:15.0828 3292 Sfloppy - ok
11:19:15.0890 3292 [ 83F41D0D89645D7235C051AB1D9523AC ] SharedAccess C:\WINDOWS\System32\ipnathlp.dll
11:19:15.0906 3292 SharedAccess - ok
11:19:15.0921 3292 [ 99BC0B50F511924348BE19C7C7313BBF ] ShellHWDetection C:\WINDOWS\System32\shsvcs.dll
11:19:15.0921 3292 ShellHWDetection - ok
11:19:15.0921 3292 Simbad - ok
11:19:15.0968 3292 [ 6B33D0EBD30DB32E27D1D78FE946A754 ] sisagp C:\WINDOWS\system32\DRIVERS\sisagp.sys
11:19:15.0984 3292 sisagp - ok
11:19:16.0015 3292 [ 4AA922332433CDEB8B82C072C212E32E ] smwdm C:\WINDOWS\system32\drivers\smwdm.sys
11:19:16.0031 3292 smwdm - ok
11:19:16.0046 3292 [ 83C0F71F86D3BDAF915685F3D568B20E ] Sparrow C:\WINDOWS\system32\DRIVERS\sparrow.sys
11:19:16.0046 3292 Sparrow - ok
11:19:16.0078 3292 [ AB8B92451ECB048A4D1DE7C3FFCB4A9F ] splitter C:\WINDOWS\system32\drivers\splitter.sys
11:19:16.0078 3292 splitter - ok
11:19:16.0125 3292 [ 60784F891563FB1B767F70117FC2428F ] Spooler C:\WINDOWS\system32\spoolsv.exe
11:19:16.0125 3292 Spooler - ok
11:19:16.0171 3292 [ 76BB022C2FB6902FD5BDD4F78FC13A5D ] sr C:\WINDOWS\system32\DRIVERS\sr.sys
11:19:16.0171 3292 sr - ok
11:19:16.0218 3292 [ 3805DF0AC4296A34BA4BF93B346CC378 ] srservice C:\WINDOWS\system32\srsvc.dll
11:19:16.0218 3292 srservice - ok
11:19:16.0281 3292 [ 47DDFC2F003F7F9F0592C6874962A2E7 ] Srv C:\WINDOWS\system32\DRIVERS\srv.sys
11:19:16.0281 3292 Srv - ok
11:19:16.0328 3292 [ D7968049BE0ADBB6A57CEE3960320911 ] sscdbhk5 C:\WINDOWS\system32\drivers\sscdbhk5.sys
11:19:16.0328 3292 sscdbhk5 - ok
11:19:16.0375 3292 [ 0A5679B3714EDAB99E357057EE88FCA6 ] SSDPSRV C:\WINDOWS\System32\ssdpsrv.dll
11:19:16.0375 3292 SSDPSRV - ok
11:19:16.0390 3292 [ C3FFD65ABFB6441E7606CF74F1155273 ] ssrtln C:\WINDOWS\system32\drivers\ssrtln.sys
11:19:16.0390 3292 ssrtln - ok
11:19:16.0453 3292 [ 8BAD69CBAC032D4BBACFCE0306174C30 ] stisvc C:\WINDOWS\system32\wiaservc.dll
11:19:16.0468 3292 stisvc - ok
11:19:16.0515 3292 [ 3941D127AEF12E93ADDF6FE6EE027E0F ] swenum C:\WINDOWS\system32\DRIVERS\swenum.sys
11:19:16.0515 3292 swenum - ok
11:19:16.0562 3292 [ 8CE882BCC6CF8A62F2B2323D95CB3D01 ] swmidi C:\WINDOWS\system32\drivers\swmidi.sys
11:19:16.0562 3292 swmidi - ok
11:19:16.0562 3292 SwPrv - ok
11:19:16.0578 3292 [ 1FF3217614018630D0A6758630FC698C ] symc810 C:\WINDOWS\system32\DRIVERS\symc810.sys
11:19:16.0578 3292 symc810 - ok
11:19:16.0578 3292 [ 070E001D95CF725186EF8B20335F933C ] symc8xx C:\WINDOWS\system32\DRIVERS\symc8xx.sys
11:19:16.0593 3292 symc8xx - ok
11:19:16.0593 3292 [ 80AC1C4ABBE2DF3B738BF15517A51F2C ] sym_hi C:\WINDOWS\system32\DRIVERS\sym_hi.sys
11:19:16.0593 3292 sym_hi - ok
11:19:16.0609 3292 [ BF4FAB949A382A8E105F46EBB4937058 ] sym_u3 C:\WINDOWS\system32\DRIVERS\sym_u3.sys
11:19:16.0609 3292 sym_u3 - ok
11:19:16.0625 3292 [ 8B83F3ED0F1688B4958F77CD6D2BF290 ] sysaudio C:\WINDOWS\system32\drivers\sysaudio.sys
11:19:16.0625 3292 sysaudio - ok
11:19:16.0671 3292 [ C7ABBC59B43274B1109DF6B24D617051 ] SysmonLog C:\WINDOWS\system32\smlogsvc.exe
11:19:16.0671 3292 SysmonLog - ok
11:19:16.0734 3292 [ 3CB78C17BB664637787C9A1C98F79C38 ] TapiSrv C:\WINDOWS\System32\tapisrv.dll
11:19:16.0750 3292 TapiSrv - ok
11:19:16.0796 3292 [ 9AEFA14BD6B182D61E3119FA5F436D3D ] Tcpip C:\WINDOWS\system32\DRIVERS\tcpip.sys
11:19:16.0812 3292 Tcpip - ok
11:19:16.0875 3292 [ 6471A66807F5E104E4885F5B67349397 ] TDPIPE C:\WINDOWS\system32\drivers\TDPIPE.sys
11:19:16.0875 3292 TDPIPE - ok
11:19:16.0921 3292 [ C56B6D0402371CF3700EB322EF3AAF61 ] TDTCP C:\WINDOWS\system32\drivers\TDTCP.sys
11:19:16.0921 3292 TDTCP - ok
11:19:16.0968 3292 [ 88155247177638048422893737429D9E ] TermDD C:\WINDOWS\system32\DRIVERS\termdd.sys
11:19:16.0968 3292 TermDD - ok
11:19:17.0015 3292 [ FF3477C03BE7201C294C35F684B3479F ] TermService C:\WINDOWS\System32\termsrv.dll
11:19:17.0031 3292 TermService - ok
11:19:17.0078 3292 [ 1D265CD2FB1673A0873BF8CEC19DDC7F ] tfsnboio C:\WINDOWS\system32\dla\tfsnboio.sys
11:19:17.0078 3292 tfsnboio - ok
11:19:17.0078 3292 [ 62E4901295E0467CAC78E5B4B131AE5C ] tfsncofs C:\WINDOWS\system32\dla\tfsncofs.sys
11:19:17.0093 3292 tfsncofs - ok
11:19:17.0093 3292 [ A2F380F9252AB3464C859ADF91EEAD9C ] tfsndrct C:\WINDOWS\system32\dla\tfsndrct.sys
11:19:17.0093 3292 tfsndrct - ok
11:19:17.0109 3292 [ EEE79BBEFE9C6A2A3CE6C8753CFEA950 ] tfsndres C:\WINDOWS\system32\dla\tfsndres.sys
11:19:17.0109 3292 tfsndres - ok
11:19:17.0125 3292 [ 9D644EB11FEC9487450C4CFCD63A5DF4 ] tfsnifs C:\WINDOWS\system32\dla\tfsnifs.sys
11:19:17.0125 3292 tfsnifs - ok
11:19:17.0140 3292 [ E656AF05C67EDB7C0E9230A5DF71ED1B ] tfsnopio C:\WINDOWS\system32\dla\tfsnopio.sys
11:19:17.0140 3292 tfsnopio - ok
11:19:17.0140 3292 [ 64FCCB9CCE703CA507DFFC3CEBF6B2CB ] tfsnpool C:\WINDOWS\system32\dla\tfsnpool.sys
11:19:17.0156 3292 tfsnpool - ok
11:19:17.0156 3292 [ 48BC9D8AB4E4B9BFF70FB18E55CEC3D6 ] tfsnudf C:\WINDOWS\system32\dla\tfsnudf.sys
11:19:17.0156 3292 tfsnudf - ok
11:19:17.0171 3292 [ 79F60822224256B49BFC855DA8D651D5 ] tfsnudfa C:\WINDOWS\system32\dla\tfsnudfa.sys
11:19:17.0171 3292 tfsnudfa - ok
11:19:17.0203 3292 [ 99BC0B50F511924348BE19C7C7313BBF ] Themes C:\WINDOWS\System32\shsvcs.dll
11:19:17.0203 3292 Themes - ok
11:19:17.0218 3292 [ F2790F6AF01321B172AA62F8E1E187D9 ] TosIde C:\WINDOWS\system32\DRIVERS\toside.sys
11:19:17.0218 3292 TosIde - ok
11:19:17.0250 3292 [ 55BCA12F7F523D35CA3CB833C725F54E ] TrkWks C:\WINDOWS\system32\trkwks.dll
11:19:17.0265 3292 TrkWks - ok
11:19:17.0312 3292 [ 5787B80C2E3C5E2F56C2A233D91FA2C9 ] Udfs C:\WINDOWS\system32\drivers\Udfs.sys
11:19:17.0312 3292 Udfs - ok
11:19:17.0328 3292 [ 1B698A51CD528D8DA4FFAED66DFC51B9 ] ultra C:\WINDOWS\system32\DRIVERS\ultra.sys
11:19:17.0328 3292 ultra - ok
11:19:17.0375 3292 [ 402DDC88356B1BAC0EE3DD1580C76A31 ] Update C:\WINDOWS\system32\DRIVERS\update.sys
11:19:17.0406 3292 Update - ok
11:19:17.0453 3292 [ 1EBAFEB9A3FBDC41B8D9C7F0F687AD91 ] upnphost C:\WINDOWS\System32\upnphost.dll
11:19:17.0453 3292 upnphost - ok
11:19:17.0515 3292 [ 05365FB38FCA1E98F7A566AAAF5D1815 ] UPS C:\WINDOWS\System32\ups.exe
11:19:17.0515 3292 UPS - ok
11:19:17.0546 3292 [ 173F317CE0DB8E21322E71B7E60A27E8 ] usbccgp C:\WINDOWS\system32\DRIVERS\usbccgp.sys
11:19:17.0546 3292 usbccgp - ok
11:19:17.0546 3292 [ 65DCF09D0E37D4C6B11B5B0B76D470A7 ] usbehci C:\WINDOWS\system32\DRIVERS\usbehci.sys
11:19:17.0546 3292 usbehci - ok
11:19:17.0593 3292 [ 1AB3CDDE553B6E064D2E754EFE20285C ] usbhub C:\WINDOWS\system32\DRIVERS\usbhub.sys
11:19:17.0593 3292 usbhub - ok
11:19:17.0640 3292 [ A0B8CF9DEB1184FBDD20784A58FA75D4 ] usbscan C:\WINDOWS\system32\DRIVERS\usbscan.sys
11:19:17.0640 3292 usbscan - ok
11:19:17.0687 3292 [ A32426D9B14A089EAA1D922E0C5801A9 ] USBSTOR C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
11:19:17.0687 3292 USBSTOR - ok
11:19:17.0734 3292 [ 26496F9DEE2D787FC3E61AD54821FFE6 ] usbuhci C:\WINDOWS\system32\DRIVERS\usbuhci.sys
11:19:17.0734 3292 usbuhci - ok
11:19:17.0750 3292 [ B6CC50279D6CD28E090A5D33244ADC9A ] usb_rndisx C:\WINDOWS\system32\DRIVERS\usb8023x.sys
11:19:17.0750 3292 usb_rndisx - ok
11:19:17.0796 3292 [ 0D3A8FAFCEACD8B7625CD549757A7DF1 ] VgaSave C:\WINDOWS\System32\drivers\vga.sys
11:19:17.0812 3292 VgaSave - ok
11:19:17.0843 3292 [ 754292CE5848B3738281B4F3607EAEF4 ] viaagp C:\WINDOWS\system32\DRIVERS\viaagp.sys
11:19:17.0843 3292 viaagp - ok
11:19:17.0875 3292 [ 3B3EFCDA263B8AC14FDF9CBDD0791B2E ] ViaIde C:\WINDOWS\system32\DRIVERS\viaide.sys
11:19:17.0875 3292 ViaIde - ok
11:19:17.0890 3292 [ 4C8FCB5CC53AAB716D810740FE59D025 ] VolSnap C:\WINDOWS\system32\drivers\VolSnap.sys
11:19:17.0890 3292 VolSnap - ok
11:19:17.0921 3292 [ 7A9DB3A67C333BF0BD42E42B8596854B ] VSS C:\WINDOWS\System32\vssvc.exe
11:19:17.0937 3292 VSS - ok
11:19:18.0093 3292 [ 8ED347BAD8D1FB7C40B593BFB01786D2 ] vToolbarUpdater11.2.0 C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe
11:19:18.0125 3292 vToolbarUpdater11.2.0 - ok
11:19:18.0156 3292 [ 54AF4B1D5459500EF0937F6D33B1914F ] w32time C:\WINDOWS\system32\w32time.dll
11:19:18.0156 3292 w32time - ok
11:19:18.0171 3292 [ E20B95BAEDB550F32DD489265C1DA1F6 ] Wanarp C:\WINDOWS\system32\DRIVERS\wanarp.sys
11:19:18.0171 3292 Wanarp - ok
11:19:18.0187 3292 wanatw - ok
11:19:18.0187 3292 WDICA - ok
11:19:18.0218 3292 [ 6768ACF64B18196494413695F0C3A00F ] wdmaud C:\WINDOWS\system32\drivers\wdmaud.sys
11:19:18.0218 3292 wdmaud - ok
11:19:18.0250 3292 [ 77A354E28153AD2D5E120A5A8687BC06 ] WebClient C:\WINDOWS\System32\webclnt.dll
11:19:18.0250 3292 WebClient - ok
11:19:18.0296 3292 [ F59ED5A43B988A18EF582BB07B2327A7 ] winachsf C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys
11:19:18.0328 3292 winachsf - ok
11:19:18.0390 3292 [ 2D0E4ED081963804CCC196A0929275B5 ] winmgmt C:\WINDOWS\system32\wbem\WMIsvc.dll
11:19:18.0406 3292 winmgmt - ok
11:19:18.0453 3292 [ C51B4A5C05A5475708E3C81C7765B71D ] WmdmPmSN C:\WINDOWS\system32\MsPMSNSv.dll
11:19:18.0468 3292 WmdmPmSN - ok
11:19:18.0500 3292 [ E0673F1106E62A68D2257E376079F821 ] WmiApSrv C:\WINDOWS\system32\wbem\wmiapsrv.exe
11:19:18.0500 3292 WmiApSrv - ok
11:19:18.0578 3292 [ F74E3D9A7FA9556C3BBB14D4E5E63D3B ] WMPNetworkSvc C:\Program Files\Windows Media Player\WMPNetwk.exe
11:19:18.0609 3292 WMPNetworkSvc - ok
11:19:18.0843 3292 [ DCF3E3EDF5109EE8BC02FE6E1F045795 ] WPFFontCache_v0400 C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
11:19:18.0875 3292 WPFFontCache_v0400 - ok
11:19:18.0906 3292 [ 6ABE6E225ADB5A751622A9CC3BC19CE8 ] WS2IFSL C:\WINDOWS\System32\drivers\ws2ifsl.sys
11:19:18.0906 3292 WS2IFSL - ok
11:19:18.0953 3292 [ 7C278E6408D1DCE642230C0585A854D5 ] wscsvc C:\WINDOWS\system32\wscsvc.dll
11:19:18.0968 3292 wscsvc - ok
11:19:19.0000 3292 [ 35321FB577CDC98CE3EB3A3EB9E4610A ] wuauserv C:\WINDOWS\system32\wuauserv.dll
11:19:19.0000 3292 wuauserv - ok
11:19:19.0031 3292 [ F15FEAFFFBB3644CCC80C5DA584E6311 ] WudfPf C:\WINDOWS\system32\DRIVERS\WudfPf.sys
11:19:19.0031 3292 WudfPf - ok
11:19:19.0062 3292 [ 28B524262BCE6DE1F7EF9F510BA3985B ] WudfRd C:\WINDOWS\system32\DRIVERS\wudfrd.sys
11:19:19.0062 3292 WudfRd - ok
11:19:19.0078 3292 [ 05231C04253C5BC30B26CBAAE680ED89 ] WudfSvc C:\WINDOWS\System32\WUDFSvc.dll
11:19:19.0093 3292 WudfSvc - ok
11:19:19.0140 3292 [ 81DC3F549F44B1C1FFF022DEC9ECF30B ] WZCSVC C:\WINDOWS\System32\wzcsvc.dll
11:19:19.0156 3292 WZCSVC - ok
11:19:19.0203 3292 [ 295D21F14C335B53CB8154E5B1F892B9 ] xmlprov C:\WINDOWS\System32\xmlprov.dll
11:19:19.0203 3292 xmlprov - ok
11:19:19.0218 3292 ================ Scan global ===============================
11:19:19.0250 3292 [ 42F1F4C0AFB08410E5F02D4B13EBB623 ] C:\WINDOWS\system32\basesrv.dll
11:19:19.0312 3292 [ 8C7DCA4B158BF16894120786A7A5F366 ] C:\WINDOWS\system32\winsrv.dll
11:19:19.0343 3292 [ 8C7DCA4B158BF16894120786A7A5F366 ] C:\WINDOWS\system32\winsrv.dll
11:19:19.0359 3292 [ 65DF52F5B8B6E9BBD183505225C37315 ] C:\WINDOWS\system32\services.exe
11:19:19.0359 3292 [Global] - ok
11:19:19.0359 3292 ================ Scan MBR ==================================
11:19:19.0375 3292 [ B16A2359F4962B0C622D81A1C1F4B703 ] \Device\Harddisk0\DR0
11:19:19.0640 3292 \Device\Harddisk0\DR0 ( TDSS File System ) - warning
11:19:19.0640 3292 \Device\Harddisk0\DR0 - detected TDSS File System (1)
11:19:19.0687 3292 [ 5FB38429D5D77768867C76DCBDB35194 ] \Device\Harddisk1\DR4
11:19:19.0859 3292 \Device\Harddisk1\DR4 - ok
11:19:19.0859 3292 ================ Scan VBR ==================================
11:19:19.0859 3292 [ 6755AC694578A40EB27944F7DDA2B76B ] \Device\Harddisk0\DR0\Partition1
11:19:19.0859 3292 \Device\Harddisk0\DR0\Partition1 - ok
11:19:19.0859 3292 [ EF5F60B8846206442E7EC7340E1D509D ] \Device\Harddisk1\DR4\Partition1
11:19:19.0875 3292 \Device\Harddisk1\DR4\Partition1 - ok
11:19:19.0875 3292 ============================================================
11:19:19.0875 3292 Scan finished
11:19:19.0875 3292 ============================================================
11:19:19.0875 3296 Detected object count: 1
11:19:19.0875 3296 Actual detected object count: 1
11:20:12.0640 3296 \Device\Harddisk0\DR0\TDLFS\ldrm - copied to quarantine
11:20:12.0656 3296 \Device\Harddisk0\DR0\TDLFS\cmd.dll - copied to quarantine
11:20:12.0656 3296 \Device\Harddisk0\DR0\TDLFS\cmd64.dll - copied to quarantine
11:20:12.0687 3296 \Device\Harddisk0\DR0\TDLFS\config.ini - copied to quarantine
11:20:12.0687 3296 \Device\Harddisk0\DR0\TDLFS\sub.dll - copied to quarantine
11:20:12.0718 3296 \Device\Harddisk0\DR0\TDLFS\subx.dll - copied to quarantine
11:20:12.0718 3296 \Device\Harddisk0\DR0\TDLFS\drv32 - copied to quarantine
11:20:12.0781 3296 \Device\Harddisk0\DR0\TDLFS\drv64 - copied to quarantine
11:20:12.0812 3296 \Device\Harddisk0\DR0\TDLFS\servers.dat - copied to quarantine
11:20:12.0843 3296 \Device\Harddisk0\DR0\TDLFS\ldr16 - copied to quarantine
11:20:12.0843 3296 \Device\Harddisk0\DR0\TDLFS\ldr32 - copied to quarantine
11:20:12.0843 3296 \Device\Harddisk0\DR0\TDLFS\ldr64 - copied to quarantine
11:20:12.0843 3296 \Device\Harddisk0\DR0\TDLFS\s - copied to quarantine
11:20:12.0859 3296 \Device\Harddisk0\DR0\TDLFS\u - copied to quarantine
11:20:12.0859 3296 \Device\Harddisk0\DR0\TDLFS - deleted
11:20:12.0859 3296 \Device\Harddisk0\DR0 ( TDSS File System ) - User select action: Delete



OTL Extras logfile created on: 9/3/2012 11:22:16 AM - Run 1
OTL by OldTimer - Version 3.2.60.0 Folder = C:\Documents and Settings\T. Carlberg\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1014.07 Mb Total Physical Memory | 462.80 Mb Available Physical Memory | 45.64% Memory free
2.85 Gb Paging File | 2.42 Gb Available in Paging File | 84.87% Paging File free
Paging file location(s): [Binary data over 100 bytes]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 70.97 Gb Total Space | 10.01 Gb Free Space | 14.11% Space Free | Partition Type: NTFS
Drive F: | 1863.01 Gb Total Space | 1342.99 Gb Free Space | 72.09% Space Free | Partition Type: NTFS

Computer Name: MAIN | User Name: T. Carlberg | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.url [@ = InternetShortcut] – rundll32.exe ieframe.dll,OpenURL %l

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] – "%1" %*
htmlfile – "C:\Program Files\Microsoft Office\Office14\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] – "C:\Program Files\Microsoft Office\Office14\msohtmed.exe" /p %1 (Microsoft Corporation)
InternetShortcut [open] – rundll32.exe ieframe.dll,OpenURL %l
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"FirewallDisableNotify" = 0
"AntiVirusOverride" = 1
"FirewallOverride" = 1
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Google\Google Earth\client\googleearth.exe" = C:\Program Files\Google\Google Earth\client\googleearth.exe:*:Enabled:Google Earth – (Google)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00000409-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 Premium
"{00203668-8170-44A0-BE44-B632FA4D780F}" = Adobe AIR
"{09DA4F91-2A09-4232-AB8C-6BC740096DE3}" = Sonic Update Manager
"{0AB76F69-E761-4CFA-B9B0-A1906B4E9E4B}" = WD Diagnostics
"{1206EF92-2E83-4859-ACCB-2048C3CB7DA6}" = Sonic DLA
"{17334AAF-C9E7-483B-9F45-E3FCAF07FFA7}" = Intel® PROSet for Wired Connections
"{196BB40D-1578-3D01-B289-BEFC77A11A1E}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{2637C347-9DAD-11D6-9EA2-00055D0CA761}" = Dell Media Experience
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java™ 6 Update 29
"{2CE5A2E7-3437-4CE7-BCF4-85ED6EEFF9E4}" = iTunes
"{33BB4982-DC52-4886-A03B-F4C5C80BEE89}" = Windows Media Player 10
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{35BDEFF1-A610-4956-A00D-15453C116395}" = Internet Explorer Default Page
"{3881DB80-EAA2-012B-ADAE-000000000000}" = TurboTax 2009 WinPerFedFormset
"{38975F50-EAA2-012B-ADB4-000000000000}" = TurboTax 2009 WinPerReleaseEngine
"{38A34630-EAA2-012B-ADB6-000000000000}" = TurboTax 2009 WinPerTaxSupport
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3C5A81D0-EAA2-012B-AE9F-000000000000}" = TurboTax 2009 wrapper
"{3F92ABBB-6BBF-11D5-B229-002078017FBF}" = NetWaiting
"{47BA74C5-1890-4ED2-954A-AD11186D8E26}" = Garmin TOPO U.S. 2008
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{5905F42D-3F5F-4916-ADA6-94A3646AEE76}" = Dell Driver Reset Tool
"{5A13987D-55F4-4271-A40E-76AC9B1B38FD}" = OpenOffice.org 3.2
"{5C82DAE5-6EB0-4374-9254-BE3319BA4E82}" = Skype™ 3.6
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD 5.3
"{6E45BA47-383C-4C1E-8ED0-0D4845C293D7}" = Microsoft Plus! Digital Media Edition Installer
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{74F7662C-B1DB-489E-A8AC-07A06B24978B}" = Dell System Restore
"{7EC68A50-D653-11D8-A3B3-0010B5C6624C}" = HyperNiche v.1 beta
"{7F142D56-3326-11D5-B229-002078017FBF}" = Modem Helper
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel® Graphics Media Accelerator Driver
"{90140000-0010-0409-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (English) 14
"{90140000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2010
"{90140000-0015-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2010
"{90140000-0016-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2010
"{90140000-0018-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2010
"{90140000-0019-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2010
"{90140000-001A-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2010
"{90140000-001B-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{99ACCA38-6DD3-48A8-96AE-A283C9759279}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUSR_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2010
"{90140000-001F-0C0A-0000-0000000FF1CE}_Office14.PROPLUSR_{DEA87BE2-FFCC-4F33-9946-FCBE55A1E998}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2010
"{90140000-002C-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{7CA93DF4-8902-449E-A42E-4C5923CFBDE3}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2010
"{90140000-0044-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2010
"{90140000-006E-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{4560037C-E356-444A-A015-D21F487D809E}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2010
"{90140000-00A1-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2010
"{90140000-00BA-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2010
"{90140000-0115-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{4560037C-E356-444A-A015-D21F487D809E}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2010
"{90140000-0117-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{6BD185A0-E67F-4F77-8BCD-E34EA6AE76DF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{91140000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2010
"{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{047B0968-E622-4FAA-9B4B-121FA109EDDE}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{9541FED0-327F-4DF0-8B96-EF57EF622F19}" = Sonic RecordNow!
"{99052DB7-9592-4522-A558-5417BBAD48EE}" = Microsoft ActiveSync
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1033-7B44-A94000000001}" = Adobe Reader 9.4.1
"{AF19F291-F22F-4798-9662-525305AE9E48}" = WordPerfect Office 12
"{B3FED300-806C-11E0-A0D0-B8AC6F97B88E}" = Google Earth
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C3ABE126-2BB2-4246-BFE1-6797679B3579}" = LG USB Modem Driver
"{C89269D9-DD02-45DD-99DD-6AE592F6C447}" = TurboTax 2011 wcaiper
"{CAF5B770-082F-40C4-853D-3973BB81BDAA}" = TurboTax 2011 WinPerTaxSupport
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D78653C3-A8FF-415F-92E6-D774E634FF2D}" = Dell ResourceCD
"{D94A8E22-DF2B-4107-9E51-608A60A7671D}" = Personal Ancestral File 5
"{DAEAFD68-BB4A-4507-A241-C8804D2EA66D}" = Apple Application Support
"{DB09C3D8-5ED0-42A3-8EC8-3B9F665971EF}" = WD FAT32 Formatter
"{E463E171-4082-4744-A466-F7CBE8502789}" = TurboTax 2011 WinPerReleaseEngine
"{E646DCF0-5A68-11D5-B229-002078017FBF}" = Digital Line Detect
"{E7004147-2CCA-431C-AA05-2AB166B9785D}" = QuickTime
"{EE556A3E-EB37-4392-9637-BAA8EC2F47FA}" = TurboTax 2011 wrapper
"{EE7C3A14-1D20-49F6-B903-491561076F0F}" = ArcSoft Software Suite
"{F13BA02B-435A-11D2-A597-00104B97152B}" = ER Mapper imagery plugin for ArcView® 3.1 Onwards v2.4
"{FAD3D68B-2F9C-459B-AA79-C04B9090FD72}" = TurboTax 2011 WinPerFedFormset
"{FD6C6B7F-5696-48C5-A601-2EE9E50C3D46}" = WD Firewire HID Driver
"{FF1C31AE-0CDC-40CE-AB85-406F8B70D643}" = Bonjour
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"AVG9Uninstall" = AVG 9.0
"Bejeweled 2 Deluxe" = Bejeweled 2 Deluxe
"CNXT_MODEM_PCI_VEN_14F1&DEV_2F20&SUBSYS_200F14F1" = Conexant D850 56K V.9x DFVc Modem
"DAO 3.5" = DAO 3.5
"DellSupport" = Dell Support 5.0.0 (630)
"ERUNT_is1" = ERUNT 1.1j
"ESET Online Scanner" = ESET Online Scanner v3
"ESRI ArcPad 7.0.1" = ESRI ArcPad 7.0.1
"FileZilla" = FileZilla (remove only)
"HijackThis" = HijackThis 2.0.2
"hp deskjet 990c series" = hp deskjet 990c series (Remove only)
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"Intel AppUp(SM) center 18988" = Intel AppUp(SM) center
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.62.0.1300
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"Office14.PROPLUSR" = Microsoft Office Professional Plus 2010
"PROSet" = Intel® PRO Network Adapters and Drivers
"Quicken Basic 2000" = Quicken Basic 2000
"Quicken Lawyer 2003 Personal" = Quicken Lawyer 2003 Personal
"StreetPlugin" = Learn2 Player (Uninstall Only)
"TurboTax 2009" = TurboTax 2009
"TurboTax 2011" = TurboTax 2011
"Usnscsvr" = Usnscsvr
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinRAR archiver" = WinRAR archiver
"WinZip" = WinZip
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"ArcView GIS 3.2" = ArcView GIS 3.2
"Glucofacts Deluxe Updater 2.0" = Glucofacts Deluxe Updater 2.0
"GoToMeeting" = GoToMeeting 5.1.0.880

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 8/23/2012 9:35:48 PM | Computer Name = MAIN | Source = MsiInstaller | ID = 11706
Description = Product: Microsoft Office 2000 Premium – Error 1706. No valid source
could be found for product Microsoft Office 2000 Premium. The Windows installer
cannot continue.

Error - 8/23/2012 10:51:56 PM | Computer Name = MAIN | Source = MsiInstaller | ID = 11706
Description = Product: Microsoft Office 2000 Premium – Error 1706. No valid source
could be found for product Microsoft Office 2000 Premium. The Windows installer
cannot continue.

Error - 8/23/2012 11:05:10 PM | Computer Name = MAIN | Source = MsiInstaller | ID = 11706
Description = Product: Microsoft Office 2000 Premium – Error 1706. No valid source
could be found for product Microsoft Office 2000 Premium. The Windows installer
cannot continue.

Error - 8/23/2012 11:06:18 PM | Computer Name = MAIN | Source = MsiInstaller | ID = 11706
Description = Product: Microsoft Office 2000 Premium – Error 1706. No valid source
could be found for product Microsoft Office 2000 Premium. The Windows installer
cannot continue.

Error - 8/23/2012 11:07:37 PM | Computer Name = MAIN | Source = MsiInstaller | ID = 11706
Description = Product: Microsoft Office 2000 Premium – Error 1706. No valid source
could be found for product Microsoft Office 2000 Premium. The Windows installer
cannot continue.

Error - 8/24/2012 12:41:37 AM | Computer Name = MAIN | Source = MsiInstaller | ID = 11706
Description = Product: Microsoft Office 2000 Premium – Error 1706. No valid source
could be found for product Microsoft Office 2000 Premium. The Windows installer
cannot continue.

Error - 8/24/2012 1:33:03 AM | Computer Name = MAIN | Source = MsiInstaller | ID = 11706
Description = Product: Microsoft Office 2000 Premium – Error 1706. No valid source
could be found for product Microsoft Office 2000 Premium. The Windows installer
cannot continue.

Error - 8/24/2012 1:33:35 AM | Computer Name = MAIN | Source = MsiInstaller | ID = 11706
Description = Product: Microsoft Office 2000 Premium – Error 1706. No valid source
could be found for product Microsoft Office 2000 Premium. The Windows installer
cannot continue.

Error - 8/28/2012 9:28:47 PM | Computer Name = MAIN | Source = Application Error | ID = 1000
Description = Faulting application aswmbr.exe, version 0.9.9.1665, faulting module
ntdll.dll, version 5.1.2600.6055, fault address 0x00011689.

Error - 8/28/2012 11:01:15 PM | Computer Name = MAIN | Source = Application Error | ID = 1000
Description = Faulting application mbam.exe, version 1.51.0.1118, faulting module
unknown, version 0.0.0.0, fault address 0x00030005.

[ System Events ]
Error - 9/3/2012 2:18:35 PM | Computer Name = MAIN | Source = Service Control Manager | ID = 7001
Description = The Remote Access Connection Manager service depends on the Telephony
service which failed to start because of the following error: %%1058

Error - 9/3/2012 2:18:35 PM | Computer Name = MAIN | Source = Service Control Manager | ID = 7001
Description = The Remote Access Connection Manager service depends on the Telephony
service which failed to start because of the following error: %%1058

Error - 9/3/2012 2:18:37 PM | Computer Name = MAIN | Source = Service Control Manager | ID = 7001
Description = The Remote Access Connection Manager service depends on the Telephony
service which failed to start because of the following error: %%1058

Error - 9/3/2012 2:18:37 PM | Computer Name = MAIN | Source = Service Control Manager | ID = 7001
Description = The Remote Access Connection Manager service depends on the Telephony
service which failed to start because of the following error: %%1058

Error - 9/3/2012 2:18:37 PM | Computer Name = MAIN | Source = Service Control Manager | ID = 7001
Description = The Remote Access Connection Manager service depends on the Telephony
service which failed to start because of the following error: %%1058

Error - 9/3/2012 2:18:37 PM | Computer Name = MAIN | Source = Service Control Manager | ID = 7001
Description = The Remote Access Connection Manager service depends on the Telephony
service which failed to start because of the following error: %%1058

Error - 9/3/2012 2:18:38 PM | Computer Name = MAIN | Source = Service Control Manager | ID = 7001
Description = The Remote Access Connection Manager service depends on the Telephony
service which failed to start because of the following error: %%1058

Error - 9/3/2012 2:18:38 PM | Computer Name = MAIN | Source = Service Control Manager | ID = 7001
Description = The Remote Access Connection Manager service depends on the Telephony
service which failed to start because of the following error: %%1058

Error - 9/3/2012 2:18:39 PM | Computer Name = MAIN | Source = Service Control Manager | ID = 7001
Description = The Remote Access Connection Manager service depends on the Telephony
service which failed to start because of the following error: %%1058

Error - 9/3/2012 2:18:39 PM | Computer Name = MAIN | Source = Service Control Manager | ID = 7001
Description = The Remote Access Connection Manager service depends on the Telephony
service which failed to start because of the following error: %%1058


< End of report >




OTL logfile created on: 9/3/2012 11:22:16 AM - Run 1
OTL by OldTimer - Version 3.2.60.0 Folder = C:\Documents and Settings\T. Carlberg\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1014.07 Mb Total Physical Memory | 462.80 Mb Available Physical Memory | 45.64% Memory free
2.85 Gb Paging File | 2.42 Gb Available in Paging File | 84.87% Paging File free
Paging file location(s): [Binary data over 100 bytes]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 70.97 Gb Total Space | 10.01 Gb Free Space | 14.11% Space Free | Partition Type: NTFS
Drive F: | 1863.01 Gb Total Space | 1342.99 Gb Free Space | 72.09% Space Free | Partition Type: NTFS

Computer Name: MAIN | User Name: T. Carlberg | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/09/03 11:12:35 | 000,599,040 | —- | M] (OldTimer Tools) – C:\Documents and Settings\T. Carlberg\Desktop\OTL.exe
PRC - [2012/07/09 19:44:54 | 000,935,008 | —- | M] () – C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe
PRC - [2012/07/09 19:44:51 | 001,107,552 | —- | M] () – C:\Program Files\AVG Secure Search\vprot.exe
PRC - [2012/01/26 09:08:32 | 002,077,536 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG9\avgtray.exe
PRC - [2011/08/25 18:53:00 | 000,013,672 | —- | M] (Intuit Inc.) – C:\Program Files\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe
PRC - [2010/12/01 07:26:40 | 000,574,216 | —- | M] (Intel Corporation) – C:\Program Files\Intel\IntelAppStore\bin\serviceManager.exe
PRC - [2010/11/27 18:32:46 | 000,725,344 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG9\avgcsrvx.exe
PRC - [2010/09/20 09:46:03 | 000,621,920 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG9\avgnsx.exe
PRC - [2010/06/24 16:12:44 | 000,515,424 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG9\avgrsx.exe
PRC - [2010/06/24 16:12:34 | 000,308,136 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG9\avgwdsvc.exe
PRC - [2010/06/24 16:12:25 | 001,101,152 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG9\avgchsvx.exe
PRC - [2010/06/24 16:12:24 | 000,842,592 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG9\avgam.exe
PRC - [2010/05/21 01:28:00 | 011,312,128 | —- | M] (OpenOffice.org) – C:\Program Files\OpenOffice.org 3\program\soffice.bin
PRC - [2010/05/21 01:27:58 | 011,318,784 | —- | M] (OpenOffice.org) – C:\Program Files\OpenOffice.org 3\program\soffice.exe
PRC - [2009/09/29 09:17:50 | 000,013,088 | —- | M] (Intuit Inc.) – C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
PRC - [2008/04/13 17:12:19 | 001,033,728 | —- | M] (Microsoft Corporation) – C:\WINDOWS\explorer.exe
PRC - [2000/08/07 06:35:37 | 000,192,512 | —- | M] (Hewlett-Packard Company) – C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\hpztsb01.exe
PRC - [1999/08/12 07:59:08 | 000,036,864 | —- | M] (Intuit) – C:\QUICKENW\QWDLLS.EXE


========== Modules (No Company Name) ==========

MOD - [2012/07/09 19:44:54 | 000,935,008 | —- | M] () – C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe
MOD - [2012/07/09 19:44:54 | 000,132,704 | —- | M] () – C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\11.2.0\SiteSafety.dll
MOD - [2012/07/09 19:44:51 | 001,107,552 | —- | M] () – C:\Program Files\AVG Secure Search\vprot.exe
MOD - [2012/06/18 10:44:57 | 000,221,696 | —- | M] () – C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.ServiceProce#\2516a49d10f4418f72e1c25f691815a8\System.ServiceProcess.ni.dll
MOD - [2012/06/18 10:33:23 | 000,212,992 | —- | M] () – C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\8b84bb74d7724e147a642a1d5358feb7\System.ServiceProcess.ni.dll
MOD - [2012/06/18 10:14:23 | 003,186,688 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll
MOD - [2012/06/18 10:14:18 | 002,933,248 | —- | M] () – C:\WINDOWS\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
MOD - [2012/06/18 10:14:16 | 000,425,984 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.dll
MOD - [2012/06/18 10:13:39 | 000,630,784 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
MOD - [2012/06/18 10:13:37 | 000,303,104 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
MOD - [2012/06/18 10:13:31 | 000,258,048 | —- | M] () – C:\WINDOWS\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll
MOD - [2012/06/18 10:13:28 | 000,261,632 | —- | M] () – C:\WINDOWS\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
MOD - [2012/06/18 10:13:23 | 002,048,000 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.Xml.dll
MOD - [2012/06/18 10:13:06 | 000,114,688 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll
MOD - [2012/06/18 10:12:45 | 005,025,792 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
MOD - [2012/06/18 10:03:12 | 013,197,824 | —- | M] () – C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\54d61af44b1dedee6aea0d1bbc46b13a\System.Windows.Forms.ni.dll
MOD - [2012/06/18 09:28:05 | 001,666,048 | —- | M] () – C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Drawing\4a668799513e369a54fdab8b3f74de92\System.Drawing.ni.dll
MOD - [2012/05/10 20:57:36 | 000,762,368 | —- | M] () – C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Runtime.Remo#\0f9d7198d2c0a3953fb59b1aca0d35f7\System.Runtime.Remoting.ni.dll
MOD - [2012/05/10 20:57:33 | 000,786,944 | —- | M] () – C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.EnterpriseSe#\26ee061618887d629a9f7072970ffb85\System.EnterpriseServices.ni.dll
MOD - [2012/05/10 20:57:31 | 000,646,656 | —- | M] () – C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Transactions\ce2aa3a5e89c326055ac8e2a309232f7\System.Transactions.ni.dll
MOD - [2012/05/10 20:43:47 | 007,953,408 | —- | M] () – C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\e4b5afc4da43b1c576f9322f9f2e1bfe\System.ni.dll
MOD - [2012/05/10 20:43:03 | 011,492,352 | —- | M] () – C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\e337c89bc9f81b69d7237aa70e935900\mscorlib.ni.dll
MOD - [2012/05/10 20:16:37 | 006,798,336 | —- | M] () – C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Data\9f5111b0b58258c3a4bbcfb8bf27374c\System.Data.ni.dll
MOD - [2012/05/10 20:14:57 | 005,618,176 | —- | M] () – C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Xml\5ee8bf77e7b3e25cdbff6e1c299574fe\System.Xml.ni.dll
MOD - [2012/05/10 20:14:44 | 000,980,480 | —- | M] () – C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Configuration\0c8e950df17a0abec10888e8ad966cbe\System.Configuration.ni.dll
MOD - [2012/05/10 20:14:34 | 007,052,800 | —- | M] () – C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Core\14ba6251d6ec84c9579ed3d3e10b30c1\System.Core.ni.dll
MOD - [2012/05/10 20:13:48 | 009,090,560 | —- | M] () – C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\6f399163bb35597da7141ccdb7f39d16\System.ni.dll
MOD - [2012/05/10 20:13:18 | 014,412,800 | —- | M] () – C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\mscorlib\3953b1d8b9b57e4957bff8f58145384e\mscorlib.ni.dll
MOD - [2011/07/13 19:49:52 | 000,854,016 | —- | M] () – C:\WINDOWS\assembly\GAC_32\System.Data.SQLite\1.0.61.0__db937bc2d44ff139\System.Data.SQLite.dll
MOD - [2011/07/13 19:49:50 | 000,403,456 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\Intuit.Spc.Map.WindowsFirewallUtilities\5.0.104.0__7ce6deabcb36a8ea\Intuit.Spc.Map.WindowsFirewallUtilities.dll
MOD - [2011/07/13 19:49:50 | 000,270,336 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\log4net\1.2.10.0__1b44e1d426115821\log4net.dll
MOD - [2011/07/13 19:49:49 | 000,471,040 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\Intuit.Spc.Map.Reporter\5.0.104.0__7ce6deabcb36a8ea\Intuit.Spc.Map.Reporter.dll
MOD - [2011/07/13 19:49:46 | 000,419,616 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\Intuit.Spc.Esd.WinClient.Api.Net\3.0.335.0__540d4816ead86321\Intuit.Spc.Esd.WinClient.Api.Net.dll
MOD - [2011/07/13 19:49:46 | 000,046,880 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\Intuit.Spc.Esd.WinClient.Application.UpdateServicePlugin\3.0.335.0__540d4816ead86321\Intuit.Spc.Esd.WinClient.Application.UpdateServicePlugin.dll
MOD - [2011/07/13 19:49:46 | 000,023,840 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\Intuit.Spc.Esd.WinClient.Application.UpdateService\1.0.0.0__540d4816ead86321\Intuit.Spc.Esd.WinClient.Application.UpdateService.dll
MOD - [2011/07/13 19:49:46 | 000,018,720 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\Intuit.Spc.Esd.WinClient.Ipc.Remoting.UpdateServiceWorker\3.0.335.0__540d4816ead86321\Intuit.Spc.Esd.WinClient.Ipc.Remoting.UpdateServiceWorker.dll
MOD - [2011/07/13 19:49:46 | 000,012,064 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\Intuit.Spc.Esd.WinClient.Application.UpdateService.PluginContract\1.0.0.0__540d4816ead86321\Intuit.Spc.Esd.WinClient.Application.UpdateService.PluginContract.dll
MOD - [2011/07/13 19:49:45 | 000,270,112 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\Intuit.Spc.Esd.Core\2.0.445.0__540d4816ead86321\Intuit.Spc.Esd.Core.dll
MOD - [2011/07/13 19:49:45 | 000,120,096 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\Intuit.Spc.Esd.Client.DataAccess\3.0.335.0__540d4816ead86321\Intuit.Spc.Esd.Client.DataAccess.dll
MOD - [2011/07/13 19:49:45 | 000,070,432 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\Intuit.Spc.Esd.Client.Common\3.0.335.0__540d4816ead86321\Intuit.Spc.Esd.Client.Common.dll
MOD - [2011/07/13 19:49:44 | 000,121,632 | —- | M] () – C:\WINDOWS\assembly\GAC_MSIL\Intuit.Spc.Esd.Client.BusinessLogic\3.0.335.0__540d4816ead86321\Intuit.Spc.Esd.Client.BusinessLogic.dll
MOD - [2011/03/17 00:11:16 | 004,297,568 | —- | M] () – C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
MOD - [2011/01/26 09:37:42 | 003,622,128 | —- | M] () – C:\Program Files\Intel\IntelAppStore\bin\plugin\libbizlplugin.dll
MOD - [2010/12/01 07:26:38 | 000,195,584 | —- | M] () – C:\Program Files\Intel\IntelAppStore\bin\libgsoap.dll
MOD - [2010/12/01 07:26:36 | 000,400,384 | —- | M] () – C:\Program Files\Intel\IntelAppStore\bin\sqlite3.dll
MOD - [2010/12/01 07:26:36 | 000,375,808 | —- | M] () – C:\Program Files\Intel\IntelAppStore\bin\QtXml4.dll
MOD - [2010/12/01 07:26:36 | 000,322,048 | —- | M] () – C:\Program Files\Intel\IntelAppStore\bin\log4cplus.dll
MOD - [2010/12/01 07:26:36 | 000,013,312 | —- | M] () – C:\Program Files\Intel\IntelAppStore\bin\featureController.dll
MOD - [2010/12/01 07:26:35 | 002,452,992 | —- | M] () – C:\Program Files\Intel\IntelAppStore\bin\QtCore4.dll
MOD - [2010/12/01 07:26:35 | 001,008,640 | —- | M] () – C:\Program Files\Intel\IntelAppStore\bin\QtNetwork4.dll
MOD - [2010/12/01 07:26:34 | 000,062,464 | —- | M] () – C:\Program Files\Intel\IntelAppStore\bin\zlib1.dll
MOD - [2010/10/20 15:45:26 | 008,801,120 | —- | M] () – C:\Program Files\Microsoft Office\Office14\1033\GrooveIntlResource.dll
MOD - [2010/08/10 00:01:06 | 000,067,872 | —- | M] () – C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2010/05/04 16:36:28 | 000,970,752 | —- | M] () – C:\Program Files\OpenOffice.org 3\program\libxml2.dll
MOD - [2004/04/11 18:57:44 | 000,040,960 | —- | M] () – C:\Program Files\Dell\Media Experience\DirWatcher.dll


========== Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] – %SystemRoot%\System32\hidserv.dll – (HidServ)
SRV - File not found [On_Demand | Stopped] – %SystemRoot%\System32\appmgmts.dll – (AppMgmt)
SRV - [2012/07/09 19:44:54 | 000,935,008 | —- | M] () [Auto | Running] – C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe – (vToolbarUpdater11.2.0)
SRV - [2011/11/10 06:17:31 | 000,167,264 | —- | M] () [On_Demand | Stopped] – C:\Program Files\AVG\AVG9\Toolbar\ToolbarBroker.exe – (AVG Security Toolbar Service)
SRV - [2011/08/25 18:53:00 | 000,013,672 | —- | M] (Intuit Inc.) [Auto | Running] – C:\Program Files\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe – (IntuitUpdateServiceV4)
SRV - [2011/06/12 11:15:00 | 031,125,880 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Program Files\Microsoft Office\Office14\GROOVE.EXE – (Microsoft SharePoint Workspace Audit Service)
SRV - [2010/06/24 16:12:34 | 000,308,136 | —- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] – C:\Program Files\AVG\AVG9\avgwdsvc.exe – (avg9wd)
SRV - [2009/09/29 09:17:50 | 000,013,088 | —- | M] (Intuit Inc.) [Auto | Running] – C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe – (IntuitUpdateService)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] – – (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\wanatw4.sys – (wanatw)
DRV - File not found [Kernel | On_Demand | Stopped] – – (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] – – (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] – – (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] – – (PDCOMP)
DRV - File not found [Kernel | System | Stopped] – – (PCIDump)
DRV - File not found [Kernel | System | Stopped] – – (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] – – (Changer)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\DOCUME~1\T5A5E~1.CAR\LOCALS~1\Temp\catchme.sys – (catchme)
DRV - [2011/09/12 20:17:01 | 000,029,712 | —- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] – C:\WINDOWS\SYSTEM32\DRIVERS\avgmfx86.sys – (AvgMfx86)
DRV - [2011/05/05 10:26:13 | 000,243,152 | —- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] – C:\WINDOWS\SYSTEM32\DRIVERS\avgtdix.sys – (AvgTdiX)
DRV - [2010/06/24 16:12:27 | 000,216,400 | —- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] – C:\WINDOWS\SYSTEM32\DRIVERS\avgldx86.sys – (AvgLdx86)
DRV - [2010/03/04 10:58:11 | 000,052,872 | —- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] – C:\WINDOWS\SYSTEM32\DRIVERS\avgrkx86.sys – (AvgRkx86)
DRV - [2004/03/24 08:12:44 | 000,004,272 | —- | M] () [Kernel | On_Demand | Stopped] – C:\WINDOWS\System32\drivers\bvrp_pci.sys – (bvrp_pci)
DRV - [2003/11/17 13:59:20 | 000,212,224 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\SYSTEM32\DRIVERS\HSFHWBS2.sys – (HSFHWBS2)
DRV - [2003/11/17 13:58:02 | 000,680,704 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\SYSTEM32\DRIVERS\HSF_CNXT.sys – (winachsf)
DRV - [2003/11/17 13:56:26 | 001,042,432 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\SYSTEM32\DRIVERS\HSF_DP.sys – (HSF_DP)
DRV - [2003/09/19 15:47:24 | 000,010,368 | —- | M] (Padus, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\SYSTEM32\DRIVERS\pfc.sys – (pfc)
DRV - [2002/11/08 12:45:06 | 000,017,217 | —- | M] (Dell Computer Corporation) [Kernel | System | Running] – C:\WINDOWS\SYSTEM32\DRIVERS\omci.sys – (omci)
DRV - [1999/08/12 07:59:08 | 000,034,916 | —- | M] (Marimba, Inc.) [Kernel | Auto | Running] – C:\WINDOWS\System32\drivers\MrtRate.sys – (mrtRate)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…ferrer:source?}
IE - HKLM\..\SearchScopes\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}: "URL" = http://us.yhs.search.yahoo.com/avg/search?…p={searchTerms}

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://login.yahoo.com/config/mail?.intl=us
IE - HKCU\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…amp;Form=IE8SRC
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…amp;rlz=1I7GGLR
IE - HKCU\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = http://isearch.avg.com/search?cid={4E0D30D…mp;d=2011-12-13 19:20:45&v=9.0.0.18&sap=dsp&q={searchTerms}
IE - HKCU\..\SearchScopes\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}: "URL" = http://us.yhs.search.yahoo.com/avg/search?…p={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local


========== FireFox ==========

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin: C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\11.2.0\\npsitesafety.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Content Upload Plugin,version=1.0.0: C:\Program Files\DivX\DivX Content Uploader\npUpload.dll File not found
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: File not found
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~4\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@viewpoint.com/VMP: C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll File not found

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\avg@toolbar: C:\Documents and Settings\All Users\Application Data\AVG Secure Search\11.1.0.12\ [2012/07/09 19:45:02 | 000,000,000 | —D | M]


O1 HOSTS File: ([2012/08/20 20:54:30 | 000,000,027 | —- | M]) - C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Skype add-on (mastermind)) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (DriveLetterAccess) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\SYSTEM32\dla\tfswshx.dll (Sonic Solutions)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll ()
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\11.1.0.12\AVG Secure Search_toolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - No CLSID value found.
O4 - HKLM..\Run: [BCSSync] C:\Program Files\Microsoft Office\Office14\BCSSync.exe (Microsoft Corporation)
O4 - HKLM..\Run: [HF_G_Jul] C:\Program Files\AVG Secure Search\HF_G_Jul.exe ()
O4 - HKLM..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\hpztsb01.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [Intel AppUp(SM) center] C:\Program Files\Intel\IntelAppStore\bin\serviceManager.lnk ()
O4 - HKLM..\Run: [ROC_roc_dec12] C:\Program Files\AVG Secure Search\ROC_roc_dec12.exe ()
O4 - HKLM..\Run: [UpdateManager] C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe (Sonic Solutions)
O4 - HKLM..\Run: [vProt] C:\Program Files\AVG Secure Search\vprot.exe ()
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Billminder.lnk = C:\QUICKENW\BILLMIND.EXE (Intuit)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE (Microsoft Corporation)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Quicken Startup.lnk = C:\QUICKENW\QWDLLS.EXE (Intuit)
O4 - Startup: C:\Documents and Settings\T. Carlberg\Start Menu\Programs\Startup\AVG Tray Icon.lnk = C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - Startup: C:\Documents and Settings\T. Carlberg\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Se&nd to OneNote - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O9 - Extra Button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra Button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKCU\..Trusted Domains: intuit.com ([ttlc] https in Trusted sites)
O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/e/2…78f/wvc1dmo.cab (Reg Error: Key error.)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{124E9C0C-7263-4DDD-A928-3A79B1179208}: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\viprotocol {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\11.2.0\ViProtocol.dll ()
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\SYSTEM32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\avgrsstarter: DllName - (avgrsstx.dll) - C:\WINDOWS\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
O24 - Desktop WallPaper: C:\Documents and Settings\T. Carlberg\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\T. Carlberg\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/08/10 12:04:08 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - %SystemRoot%\System32\appmgmts.dll File not found
NetSvcs: HidServ - %SystemRoot%\System32\hidserv.dll File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2012/09/03 11:15:11 | 000,000,000 | RH-D | C] – C:\Documents and Settings\T. Carlberg\Recent
[2012/09/03 11:12:35 | 000,599,040 | —- | C] (OldTimer Tools) – C:\Documents and Settings\T. Carlberg\Desktop\OTL.exe
[2012/09/02 12:36:32 | 000,000,000 | —D | C] – C:\Documents and Settings\T. Carlberg\Application Data\DNRGPS
[2012/09/02 10:54:16 | 002,211,928 | —- | C] (Kaspersky Lab ZAO) – C:\Documents and Settings\T. Carlberg\Desktop\TDSSKiller.exe
[2012/09/01 13:42:48 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2012/09/01 11:37:02 | 000,000,000 | —D | C] – C:\Program Files\ESET
[2012/09/01 10:08:28 | 004,742,651 | R— | C] (Swearware) – C:\Documents and Settings\T. Carlberg\Desktop\ComboFix.exe
[2012/09/01 10:01:23 | 000,000,000 | —D | C] – C:\Documents and Settings\T. Carlberg\Desktop\RK_Quarantine
[2012/08/30 20:11:56 | 000,000,000 | RHSD | C] – C:\cmdcons
[2012/08/24 13:28:40 | 002,211,928 | —- | C] (Kaspersky Lab ZAO) – C:\Documents and Settings\T. Carlberg\Desktop\jontom_20120824.com
[2012/08/24 09:52:17 | 000,000,000 | —D | C] – C:\TDSSKiller_Quarantine
[2012/08/21 21:50:46 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Apple Computer
[2012/08/21 18:18:06 | 000,000,000 | —D | C] – C:\Documents and Settings\T. Carlberg\Desktop\virus_2012
[2012/08/20 20:25:18 | 000,518,144 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2012/08/20 20:25:18 | 000,406,528 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2012/08/20 20:25:18 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2012/08/20 20:25:18 | 000,060,416 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2012/08/20 19:50:11 | 000,000,000 | —D | C] – C:\Qoobox
[2012/08/20 19:27:30 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Sun
[2012/08/19 18:59:55 | 004,731,392 | —- | C] (AVAST Software) – C:\Documents and Settings\T. Carlberg\Desktop\aswMBR.exe
[2012/08/19 18:46:39 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2012/08/19 18:46:35 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Application Data\Adobe
[2012/08/17 23:15:38 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Application Data\Adobe
[2012/08/07 09:09:02 | 000,275,696 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mucltui.dll
[2012/08/07 09:09:02 | 000,017,136 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\mucltui.dll.mui
[2012/08/06 23:12:01 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\SharePoint
[2012/08/06 23:12:01 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Office
[2012/08/06 23:07:17 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Synchronization Services
[2012/08/06 23:07:13 | 000,000,000 | —D | C] – C:\Program Files\Common Files\DESIGNER
[2012/08/06 23:05:27 | 000,000,000 | —D | C] – C:\Program Files\Common Files\ODBC
[2012/08/06 23:05:27 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Sync Framework
[2012/08/06 23:05:27 | 000,000,000 | —D | C] – C:\Program Files\Microsoft SQL Server Compact Edition
[2012/08/06 23:05:27 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Microsoft
[2012/08/06 23:03:13 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Visual Studio 8
[2012/08/06 23:01:34 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Analysis Services
[2012/08/06 23:00:41 | 000,000,000 | —D | C] – C:\Documents and Settings\T. Carlberg\Local Settings\Application Data\Microsoft Help
[2012/08/06 23:00:16 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Microsoft Help
[2012/08/06 22:59:36 | 000,000,000 | R–D | C] – C:\MSOCache
[2006/10/10 14:09:36 | 001,053,198 | —- | C] (Macromedia, Inc.) – C:\Program Files\freemahjongg.exe

========== Files - Modified Within 30 Days ==========

[2012/09/03 11:18:46 | 000,002,206 | —- | M] () – C:\WINDOWS\System32\WPA.DBL
[2012/09/03 11:16:34 | 000,002,048 | –S- | M] () – C:\WINDOWS\BOOTSTAT.DAT
[2012/09/03 11:12:35 | 000,599,040 | —- | M] (OldTimer Tools) – C:\Documents and Settings\T. Carlberg\Desktop\OTL.exe
[2012/09/03 11:06:23 | 093,601,386 | —- | M] () – C:\WINDOWS\System32\drivers\Avg\incavi.avm
[2012/09/02 15:45:35 | 000,002,599 | —- | M] () – C:\WINDOWS\winzip32.ini
[2012/09/02 10:54:16 | 002,211,928 | —- | M] (Kaspersky Lab ZAO) – C:\Documents and Settings\T. Carlberg\Desktop\TDSSKiller.exe
[2012/09/01 11:33:56 | 000,000,512 | —- | M] () – C:\Documents and Settings\T. Carlberg\Desktop\MBR.dat
[2012/09/01 10:08:28 | 004,742,651 | R— | M] (Swearware) – C:\Documents and Settings\T. Carlberg\Desktop\ComboFix.exe
[2012/09/01 09:46:23 | 001,376,768 | —- | M] () – C:\Documents and Settings\T. Carlberg\Desktop\RogueKiller.exe
[2012/08/30 20:12:02 | 000,000,327 | RHS- | M] () – C:\BOOT.INI
[2012/08/29 04:20:12 | 004,165,148 | —- | M] () – C:\Documents and Settings\T. Carlberg\Desktop\lutzoni_file216.pdf
[2012/08/28 20:03:06 | 000,000,784 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012/08/26 01:01:47 | 000,000,572 | —- | M] () – C:\Documents and Settings\T. Carlberg\My Documents\spider.sav
[2012/08/24 13:28:40 | 002,211,928 | —- | M] (Kaspersky Lab ZAO) – C:\Documents and Settings\T. Carlberg\Desktop\jontom_20120824.com
[2012/08/24 12:11:24 | 000,001,043 | —- | M] () – C:\WINDOWS\QUICKEN.INI
[2012/08/24 09:54:48 | 000,000,664 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2012/08/20 20:54:30 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\ETC\hosts
[2012/08/19 18:59:55 | 004,731,392 | —- | M] (AVAST Software) – C:\Documents and Settings\T. Carlberg\Desktop\aswMBR.exe
[2012/08/16 20:14:42 | 000,400,736 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2012/08/15 23:32:52 | 000,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK

========== Files Created - No Company Name ==========

[2012/09/01 09:46:20 | 001,376,768 | —- | C] () – C:\Documents and Settings\T. Carlberg\Desktop\RogueKiller.exe
[2012/08/30 20:12:02 | 000,000,211 | —- | C] () – C:\Boot.bak
[2012/08/29 04:20:03 | 004,165,148 | —- | C] () – C:\Documents and Settings\T. Carlberg\Desktop\lutzoni_file216.pdf
[2012/08/28 20:03:06 | 000,000,784 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012/08/28 19:57:41 | 000,000,512 | —- | C] () – C:\Documents and Settings\T. Carlberg\Desktop\MBR.dat
[2012/08/20 20:25:18 | 000,256,000 | —- | C] () – C:\WINDOWS\PEV.exe
[2012/08/20 20:25:18 | 000,208,896 | —- | C] () – C:\WINDOWS\MBR.exe
[2012/08/20 20:25:18 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2012/08/20 20:25:18 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2012/08/20 20:25:18 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2012/08/18 12:07:53 | 000,092,672 | —- | C] () – C:\Documents and Settings\T. Carlberg\Local Settings\Application Data\{2467be3f-8ab7-f5cc-6154-fac97e53af9e}\U\80000032.@
[2012/08/18 12:07:53 | 000,000,804 | —- | C] () – C:\Documents and Settings\T. Carlberg\Local Settings\Application Data\{2467be3f-8ab7-f5cc-6154-fac97e53af9e}\L\00000004.@
[2012/02/24 16:32:33 | 000,031,942 | —- | C] () – C:\WINDOWS\System32\KEYBRD2.SYS
[2012/02/24 16:32:33 | 000,031,633 | —- | C] () – C:\WINDOWS\System32\KEYBRD3.SYS
[2012/02/24 16:32:33 | 000,013,014 | —- | C] () – C:\WINDOWS\System32\KEYBRD4.SYS
[2012/02/24 16:32:31 | 000,017,175 | —- | C] () – C:\WINDOWS\System32\DISPLAY.SYS
[2012/02/24 16:32:31 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\CONFIG.SYS
[2012/02/24 16:32:30 | 000,021,607 | —- | C] () – C:\WINDOWS\System32\KEYB.COM
[2012/02/21 14:15:13 | 001,238,702 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-824270066-2735176744-1855504183-1006-0.dat
[2012/02/18 12:41:57 | 000,212,382 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat
[2012/02/18 11:52:15 | 000,000,590 | —- | C] () – C:\Documents and Settings\All Users\Application Data\Microsoft.SqlServer.Compact.400.32.bc
[2012/02/16 19:17:26 | 000,003,072 | —- | C] () – C:\WINDOWS\System32\iacenc.dll
[2011/12/23 16:47:50 | 000,051,136 | -H– | C] () – C:\WINDOWS\System32\mlfcache.dat
[2011/09/09 16:13:03 | 000,000,664 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2009/04/02 00:05:11 | 000,002,528 | —- | C] () – C:\Documents and Settings\T. Carlberg\Application Data\$_hpcst$.hpc
[2009/02/10 10:52:23 | 000,000,061 | —- | C] () – C:\Documents and Settings\T. Carlberg\.grassrc6
[2009/02/10 10:52:12 | 000,000,005 | —- | C] () – C:\Documents and Settings\T. Carlberg\.bash_history
[2008/04/09 22:03:39 | 000,000,032 | —- | C] () – C:\Documents and Settings\All Users\Application Data\ezsid.dat
[2007/01/07 12:52:27 | 000,001,369 | —- | C] () – C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2006/11/26 16:28:41 | 000,000,000 | —- | C] () – C:\Documents and Settings\T. Carlberg\bcdrmrke.tpl
[2006/10/12 17:08:39 | 000,000,551 | —- | C] () – C:\Program Files\Shortcut to freemahjongg.exe.lnk
[2004/11/30 10:57:07 | 000,061,678 | —- | C] () – C:\Documents and Settings\T. Carlberg\Application Data\PFP120JPR.{PB
[2004/11/30 10:57:07 | 000,012,358 | —- | C] () – C:\Documents and Settings\T. Carlberg\Application Data\PFP120JCM.{PB
[2004/11/29 15:31:07 | 000,151,040 | —- | C] () – C:\Documents and Settings\T. Carlberg\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2004/08/04 04:00:00 | 000,002,048 | —- | C] () – C:\Documents and Settings\T. Carlberg\Local Settings\Application Data\{2467be3f-8ab7-f5cc-6154-fac97e53af9e}\@

========== LOP Check ==========

[2012/07/09 19:45:02 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AVG Secure Search
[2010/08/16 22:33:40 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AVG Security Toolbar
[2012/08/19 18:45:31 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\avg9
[2004/11/18 01:34:09 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\BVRP Software
[2011/03/14 23:56:13 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\Common Files
[2008/04/20 16:21:06 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Grisoft
[2010/06/26 23:15:59 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\LGMOBILEAX
[2010/07/18 18:04:21 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PopCap Games
[2008/09/08 20:38:33 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\qxwjelar
[2009/04/02 00:09:30 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Trimble
[2005/01/22 00:39:27 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Viewpoint
[2007/11/16 12:37:42 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\WinZip
[2010/10/11 19:19:32 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2009/04/28 19:28:25 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2011/11/02 18:06:59 | 000,000,000 | —D | M] – C:\Documents and Settings\T. Carlberg\Application Data\Amazon
[2011/12/13 20:44:28 | 000,000,000 | —D | M] – C:\Documents and Settings\T. Carlberg\Application Data\AVG Secure Search
[2010/04/19 10:53:35 | 000,000,000 | —D | M] – C:\Documents and Settings\T. Carlberg\Application Data\AVG9
[2012/09/02 19:03:04 | 000,000,000 | —D | M] – C:\Documents and Settings\T. Carlberg\Application Data\DNRGPS
[2012/07/12 20:16:08 | 000,000,000 | —D | M] – C:\Documents and Settings\T. Carlberg\Application Data\GARMIN
[2007/10/11 20:06:47 | 000,000,000 | —D | M] – C:\Documents and Settings\T. Carlberg\Application Data\Grisoft
[2005/01/24 13:54:54 | 000,000,000 | —D | M] – C:\Documents and Settings\T. Carlberg\Application Data\Leadertech
[2006/10/22 21:48:30 | 000,000,000 | —D | M] – C:\Documents and Settings\T. Carlberg\Application Data\Nikon
[2010/11/22 17:07:25 | 000,000,000 | —D | M] – C:\Documents and Settings\T. Carlberg\Application Data\OpenOffice.org
[2009/04/02 00:09:30 | 000,000,000 | —D | M] – C:\Documents and Settings\T. Carlberg\Application Data\Trimble

========== Purity Check ==========



========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >

< MD5 for: AGP440.SYS >
[2004/08/04 04:00:00 | 018,738,937 | —- | M] () .cab file – C:\I386\sp2.cab:AGP440.sys
[2004/08/04 04:00:00 | 018,738,937 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\I386\sp2.cab:AGP440.sys
[2008/10/18 23:19:35 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\I386\sp3.cab:AGP440.sys
[2008/10/18 23:19:35 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
[2008/04/13 11:36:38 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 – C:\WINDOWS\ERDNT\cache\agp440.sys
[2008/04/13 11:36:38 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 – C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008/04/13 11:36:38 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 – C:\WINDOWS\SYSTEM32\DRIVERS\agp440.sys
[2004/08/03 22:07:42 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB – C:\I386\AGP440.SYS

< MD5 for: ATAPI.SYS >
[2004/08/04 04:00:00 | 018,738,937 | —- | M] () .cab file – C:\I386\sp2.cab:atapi.sys
[2004/08/04 04:00:00 | 018,738,937 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\I386\sp2.cab:atapi.sys
[2008/10/18 23:19:35 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\I386\sp3.cab:atapi.sys
[2008/10/18 23:19:35 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2008/04/13 11:40:30 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\ERDNT\cache\atapi.sys
[2008/04/13 11:40:30 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008/04/13 11:40:30 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\SYSTEM32\DRIVERS\atapi.sys
[2004/08/03 21:59:44 | 000,095,360 | —- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 – C:\I386\atapi.sys
[2004/08/03 21:59:44 | 000,095,360 | —- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 – C:\WINDOWS\SYSTEM32\ReinstallBackups\0005\DriverFiles\i386\atapi.sys
[2004/08/03 21:59:44 | 000,095,360 | —- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 – C:\WINDOWS\SYSTEM32\ReinstallBackups\0013\DriverFiles\i386\atapi.sys

< MD5 for: EVENTLOG.DLL >
[2008/04/13 17:11:53 | 000,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\ERDNT\cache\eventlog.dll
[2008/04/13 17:11:53 | 000,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008/04/13 17:11:53 | 000,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\SYSTEM32\eventlog.dll
[2004/08/04 04:00:00 | 000,055,808 | —- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 – C:\I386\EVENTLOG.DLL

< MD5 for: NETLOGON.DLL >
[2008/04/13 17:12:01 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\ERDNT\cache\netlogon.dll
[2008/04/13 17:12:01 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008/04/13 17:12:01 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\SYSTEM32\netlogon.dll
[2004/08/04 04:00:00 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A – C:\I386\NETLOGON.DLL

< MD5 for: SCECLI.DLL >
[2004/08/04 04:00:00 | 000,180,224 | —- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A – C:\I386\SCECLI.DLL
[2008/04/13 17:12:05 | 000,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\ERDNT\cache\scecli.dll
[2008/04/13 17:12:05 | 000,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008/04/13 17:12:05 | 000,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\SYSTEM32\scecli.dll

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2004/08/10 11:56:48 | 000,094,208 | —- | M] () – C:\WINDOWS\System32\config\DEFAULT.SAV
[2004/08/10 11:56:46 | 000,634,880 | —- | M] () – C:\WINDOWS\System32\config\SOFTWARE.SAV
[2004/08/10 11:56:46 | 000,872,448 | —- | M] () – C:\WINDOWS\System32\config\SYSTEM.SAV

< %systemroot%\system32\drivers\*.sys /90 >
[2012/07/03 13:46:44 | 000,022,344 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\system32\drivers\mbam.sys
[2012/07/04 07:05:18 | 000,139,784 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\drivers\rdpwd.sys

< End of report >

hi jontom - sometime during the course of this infection, my folder view settings were changed to *not* show hidden files/folders. i suppose the infection hiding itself a little more; i pretty much always have windows explorer show everything. so… changed the setting back, deleted qxwjelar, emptied the trash, and ran dds. logs follow.

the machine runs as i reported before, which is to say it's about as fast as ever. no spontaneous voices since one of our first "cure" steps, browsers operating normally & not opening random windows.

is there additional protection i should be using?

.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 8.0.6001.18702
Run by [removed] at 10:10:18 on 2012-09-04
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1014.312 [GMT -7:00]
.
AV: AVG Anti-Virus *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
============== Running Processes ===============
.
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
svchost.exe
C:\WINDOWS\system32\svchost.exe -k netsvcs
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
svchost.exe
svchost.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb01.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\AVG\AVG9\avgam.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\Program Files\Intel\IntelAppStore\bin\serviceManager.exe
C:\Program Files\AVG Secure Search\vprot.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\QUICKENW\QWDLLS.EXE
C:\Program Files\AVG\AVG9\avgtray.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\11.2.0\ToolbarUpdater.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = https://login.yahoo.com/config/mail?.intl=us
mWindow Title = Humboldt Internet
uInternet Settings,ProxyOverride = *.local
mURLSearchHooks: H - No File
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Skype add-on (mastermind): {22bf413b-c6d2-4d91-82a9-a0f997ba588c} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll
BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\tfswshx.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\progra~1\micros~4\office14\GROOVEEX.DLL
BHO: AVG Security Toolbar: {95b7759c-8c7f-4bf1-b163-73684a933233} - c:\program files\avg secure search\11.1.0.12\AVG Secure Search_toolbar.dll
BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - c:\progra~1\micros~4\office14\URLREDIR.DLL
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: AVG Security Toolbar: {95b7759c-8c7f-4bf1-b163-73684a933233} - c:\program files\avg secure search\11.1.0.12\AVG Secure Search_toolbar.dll
uRun: [H/PC Connection Agent] "c:\program files\microsoft activesync\wcescomm.exe"
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [PCMService] "c:\program files\dell\media experience\PCMService.exe"
mRun: [DVDLauncher] "c:\program files\cyberlink\powerdvd\DVDLauncher.exe"
mRun: [UpdateManager] "c:\program files\common files\sonic\update manager\sgtray.exe" /r
mRun: [dla] c:\windows\system32\dla\tfswctrl.exe
mRun: [HPDJ Taskbar Utility] c:\windows\system32\spool\drivers\w32x86\3\hpztsb01.exe
mRun: [igfxtray] c:\windows\system32\igfxtray.exe
mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe
mRun: [igfxpers] c:\windows\system32\igfxpers.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [Intel AppUp(SM) center] "c:\program files\intel\intelappstore\bin\serviceManager.lnk"
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [vProt] "c:\program files\avg secure search\vprot.exe"
mRun: [ROC_roc_dec12] "c:\program files\avg secure search\ROC_roc_dec12.exe" /PROMPT /CMPID=roc_dec12
mRun: [HF_G_Jul] "c:\program files\avg secure search\HF_G_Jul.exe" /DoAction
mRun: [BCSSync] "c:\program files\microsoft office\office14\BCSSync.exe" /DelayServices
StartupFolder: c:\docume~1\t5a5e~1.car\startm~1\programs\startup\avgtra~1.lnk - c:\program files\avg\avg9\avgtray.exe
StartupFolder: c:\docume~1\t5a5e~1.car\startm~1\programs\startup\intern~1.lnk - c:\program files\internet explorer\iexplore.exe
StartupFolder: c:\docume~1\t5a5e~1.car\startm~1\programs\startup\openof~1.lnk - c:\program files\openoffice.org 3\program\quickstart.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\billmi~1.lnk - c:\quickenw\BILLMIND.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\digita~1.lnk - c:\program files\digital line detect\DLG.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office\OSA9.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\quicke~1.lnk - c:\quickenw\QWDLLS.EXE
IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~1\micros~4\office14\ONBttnIE.dll/105
IE: {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office14\ONBttnIE.dll
IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\mi3aa1~1\INetRepl.dll
IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\mi3aa1~1\INetRepl.dll
IE: {77BF5300-1474-4EC7-9980-D32B190E9B07} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - c:\program files\microsoft office\office14\ONBttnIELinkedNotes.dll
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
TCP: DhcpNameServer = [removed] [removed]
TCP: Interfaces\{124E9C0C-7263-4DDD-A928-3A79B1179208} : DhcpNameServer = [removed] [removed]
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\common files\microsoft shared\office14\MSOXMLMF.DLL
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg9\avgpp.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\common files\avg secure search\viprotocolinstaller\11.2.0\ViProtocol.dll
Notify: avgrsstarter - avgrsstx.dll
Notify: igfxcui - igfxdev.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~1\micros~4\office14\GROOVEEX.DLL
.
============= SERVICES / DRIVERS ===============
.
R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [2008-4-20 52872]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-4-20 216400]
R1 AvgMfx86;AVG On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2007-1-5 29712]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2008-4-20 243152]
R2 avg9wd;AVG WatchDog;c:\program files\avg\avg9\avgwdsvc.exe [2010-6-24 308136]
R2 IntuitUpdateServiceV4;Intuit Update Service v4;c:\program files\common files\intuit\update service v4\IntuitUpdateService.exe [2011-8-25 13672]
R2 mrtRate;mrtRate;c:\windows\system32\drivers\MrtRate.sys [2004-11-29 34916]
R2 vToolbarUpdater11.2.0;vToolbarUpdater11.2.0;c:\program files\common files\avg secure search\vtoolbarupdater\11.2.0\ToolbarUpdater.exe [2012-7-9 935008]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\avg\avg9\toolbar\ToolbarBroker.exe [2010-10-26 167264]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\microsoft office\office14\GROOVE.EXE [2011-6-12 31125880]
S3 osppsvc;Office Software Protection Platform;c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\OSPPSVC.EXE [2010-1-9 4640000]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
S4 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2009-12-17 135664]
S4 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2009-12-17 135664]
.
=============== Created Last 30 ================
.
2012-09-03 22:27:22 ——– d—–w- C:\_OTL
2012-09-02 19:36:32 ——– d—–w- c:\documents and settings\t. carlberg\application data\DNRGPS
2012-09-01 18:37:02 ——– d—–w- c:\program files\ESET
2012-08-31 03:11:56 ——– d-sha-r- C:\cmdcons
2012-08-24 16:52:17 ——– d—–w- C:\TDSSKiller_Quarantine
2012-08-21 03:25:18 98816 —-a-w- c:\windows\sed.exe
2012-08-21 03:25:18 518144 —-a-w- c:\windows\SWREG.exe
2012-08-21 03:25:18 256000 —-a-w- c:\windows\PEV.exe
2012-08-21 03:25:18 208896 —-a-w- c:\windows\MBR.exe
2012-08-07 16:09:02 275696 —-a-w- c:\windows\system32\mucltui.dll
2012-08-07 16:09:02 214256 —-a-w- c:\windows\system32\muweb.dll
2012-08-07 16:09:02 17136 —-a-w- c:\windows\system32\mucltui.dll.mui
2012-08-07 06:07:17 ——– d—–w- c:\program files\Microsoft Synchronization Services
2012-08-07 06:05:27 ——– d—–w- c:\program files\Microsoft SQL Server Compact Edition
2012-08-07 06:05:27 ——– d—–w- c:\program files\common files\ODBC
2012-08-07 06:05:27 ——– d—–w- c:\documents and settings\all users\Microsoft
2012-08-07 06:03:13 ——– d—–w- c:\program files\Microsoft Visual Studio 8
2012-08-07 06:01:34 ——– d—–w- c:\program files\Microsoft Analysis Services
2012-08-07 06:00:41 ——– d—–w- c:\documents and settings\t. carlberg\local settings\application data\Microsoft Help
.
==================== Find3M ====================
.
2012-08-01 01:20:19 70344 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-08-01 01:20:19 426184 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2012-07-06 13:58:51 78336 —-a-w- c:\windows\system32\browser.dll
2012-07-04 14:05:18 139784 —-a-w- c:\windows\system32\drivers\rdpwd.sys
2012-07-03 20:46:44 22344 —-a-w- c:\windows\system32\drivers\mbam.sys
2012-07-03 13:40:15 1866112 —-a-w- c:\windows\system32\win32k.sys
2012-07-02 17:49:33 916992 —-a-w- c:\windows\system32\wininet.dll
2012-07-02 17:49:32 43520 —-a-w- c:\windows\system32\licmgr10.dll
2012-07-02 17:49:32 1469440 —-a-w- c:\windows\system32\inetcpl.cpl
2012-07-02 12:05:43 385024 —-a-w- c:\windows\system32\html.iec
2006-10-10 21:09:36 1053198 —-a-w- c:\program files\freemahjongg.exe
.
============= FINISH: 10:11:37.35 ===============



.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume2
Install Date: 11/29/2004 2:23:46 PM
System Uptime: 9/4/2012 9:53:34 AM (1 hours ago)
.
Motherboard: Dell Inc. | | 0M3918
Processor: Intel® Pentium® 4 CPU 3.00GHz | Microprocessor | 2992/800mhz
.
==== Disk Partitions =========================
.
A: is Removable
C: is FIXED (NTFS) - 71 GiB total, 9.967 GiB free.
D: is CDROM ()
E: is CDROM ()
F: is FIXED (NTFS) - 1863 GiB total, 1343.182 GiB free.
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP1: 8/21/2012 6:13:20 PM - System Checkpoint
RP2: 8/24/2012 10:12:04 AM - ComboFix created restore point
RP3: 8/30/2012 7:45:20 PM - ComboFix created restore point
RP4: 9/3/2012 11:24:20 AM - OTL Restore Point - 9/3/2012 11:24:12 AM
.
==== Installed Programs ======================
.
.
Adobe AIR
Adobe Flash Player 11 ActiveX
Adobe Reader 9.4.1
Apple Application Support
ArcSoft Software Suite
ArcView GIS 3.2
AVG 9.0
Bejeweled 2 Deluxe
Bonjour
Conexant D850 56K V.9x DFVc Modem
Critical Update for Windows Media Player 11 (KB959772)
DAO 3.5
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition
Dell Driver Reset Tool
Dell Media Experience
Dell ResourceCD
Dell Support 5.0.0 (630)
Dell System Restore
Digital Line Detect
ER Mapper imagery plugin for ArcView® 3.1 Onwards v2.4
ERUNT 1.1j
ESET Online Scanner v3
ESRI ArcPad 7.0.1
FileZilla (remove only)
Garmin TOPO U.S. 2008
Glucofacts Deluxe Updater 2.0
Google Earth
Google Update Helper
GoToMeeting 5.1.0.880
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB2158563)
Hotfix for Windows XP (KB2443685)
Hotfix for Windows XP (KB2570791)
Hotfix for Windows XP (KB2633952)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
Hotfix for Windows XP (KB976098-v2)
Hotfix for Windows XP (KB979306)
Hotfix for Windows XP (KB981793)
hp deskjet 990c series (Remove only)
HyperNiche v.1 beta
Intel AppUp(SM) center
Intel® Graphics Media Accelerator Driver
Intel® PRO Network Adapters and Drivers
Intel® PROSet for Wired Connections
Internet Explorer Default Page
iTunes
Java Auto Updater
Java™ 6 Update 29
Learn2 Player (Uninstall Only)
LG USB Modem Driver
Malwarebytes Anti-Malware version 1.62.0.1300
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB2656353)
Microsoft .NET Framework 1.1 Security Update (KB2656370)
Microsoft .NET Framework 1.1 Security Update (KB979906)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 4 Client Profile
Microsoft ActiveSync
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office 2000 Premium
Microsoft Office 2010 Service Pack 1 (SP1)
Microsoft Office Access MUI (English) 2010
Microsoft Office Access Setup Metadata MUI (English) 2010
Microsoft Office Excel MUI (English) 2010
Microsoft Office Groove MUI (English) 2010
Microsoft Office InfoPath MUI (English) 2010
Microsoft Office OneNote MUI (English) 2010
Microsoft Office Outlook MUI (English) 2010
Microsoft Office PowerPoint MUI (English) 2010
Microsoft Office Professional Plus 2010
Microsoft Office Proof (English) 2010
Microsoft Office Proof (French) 2010
Microsoft Office Proof (Spanish) 2010
Microsoft Office Proofing (English) 2010
Microsoft Office Publisher MUI (English) 2010
Microsoft Office Shared MUI (English) 2010
Microsoft Office Shared Setup Metadata MUI (English) 2010
Microsoft Office Word MUI (English) 2010
Microsoft Plus! Digital Media Edition Installer
Microsoft Software Update for Web Folders (English) 14
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
Modem Helper
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
NetWaiting
OpenOffice.org 3.2
Personal Ancestral File 5
PowerDVD 5.3
Quicken Basic 2000
Quicken Lawyer 2003 Personal
QuickTime
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)
Security Update for Microsoft Excel 2010 (KB2597166) 32-Bit Edition
Security Update for Microsoft InfoPath 2010 (KB2553322) 32-Bit Edition
Security Update for Microsoft InfoPath 2010 (KB2553431) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2553091)
Security Update for Microsoft Office 2010 (KB2553096)
Security Update for Microsoft Office 2010 (KB2553260) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2553371) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2553447) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2589320) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2589322) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2589337) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2597986) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2598243) 32-Bit Edition
Security Update for Microsoft PowerPoint 2010 (KB2553185) 32-Bit Edition
Security Update for Microsoft SharePoint Workspace 2010 (KB2566445)
Security Update for Microsoft Visio Viewer 2010 (KB2598287) 32-Bit Edition
Security Update for Microsoft Windows (KB2564958)
Security Update for Step By Step Interactive Training (KB898458)
Security Update for Step By Step Interactive Training (KB923723)
Security Update for Windows Internet Explorer 7 (KB2183461)
Security Update for Windows Internet Explorer 7 (KB2360131)
Security Update for Windows Internet Explorer 7 (KB2416400)
Security Update for Windows Internet Explorer 7 (KB2482017)
Security Update for Windows Internet Explorer 7 (KB2497640)
Security Update for Windows Internet Explorer 7 (KB2530548)
Security Update for Windows Internet Explorer 7 (KB2544521)
Security Update for Windows Internet Explorer 7 (KB2586448)
Security Update for Windows Internet Explorer 7 (KB2618444)
Security Update for Windows Internet Explorer 7 (KB2647516)
Security Update for Windows Internet Explorer 7 (KB928090)
Security Update for Windows Internet Explorer 7 (KB929969)
Security Update for Windows Internet Explorer 7 (KB931768)
Security Update for Windows Internet Explorer 7 (KB933566)
Security Update for Windows Internet Explorer 7 (KB937143)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB939653)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Internet Explorer 7 (KB969897)
Security Update for Windows Internet Explorer 7 (KB972260)
Security Update for Windows Internet Explorer 7 (KB974455)
Security Update for Windows Internet Explorer 7 (KB976325)
Security Update for Windows Internet Explorer 7 (KB978207)
Security Update for Windows Internet Explorer 7 (KB982381)
Security Update for Windows Internet Explorer 8 (KB2510531)
Security Update for Windows Internet Explorer 8 (KB2544521)
Security Update for Windows Internet Explorer 8 (KB2647516)
Security Update for Windows Internet Explorer 8 (KB2675157)
Security Update for Windows Internet Explorer 8 (KB2699988)
Security Update for Windows Internet Explorer 8 (KB2722913)
Security Update for Windows Media Player (KB2378111)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB975558)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player 10 (KB911565)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 10 (KB936782)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB2079403)
Security Update for Windows XP (KB2115168)
Security Update for Windows XP (KB2121546)
Security Update for Windows XP (KB2160329)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB2259922)
Security Update for Windows XP (KB2279986)
Security Update for Windows XP (KB2286198)
Security Update for Windows XP (KB2296011)
Security Update for Windows XP (KB2296199)
Security Update for Windows XP (KB2347290)
Security Update for Windows XP (KB2360937)
Security Update for Windows XP (KB2387149)
Security Update for Windows XP (KB2393802)
Security Update for Windows XP (KB2412687)
Security Update for Windows XP (KB2419632)
Security Update for Windows XP (KB2423089)
Security Update for Windows XP (KB2436673)
Security Update for Windows XP (KB2440591)
Security Update for Windows XP (KB2443105)
Security Update for Windows XP (KB2476490)
Security Update for Windows XP (KB2476687)
Security Update for Windows XP (KB2478960)
Security Update for Windows XP (KB2478971)
Security Update for Windows XP (KB2479628)
Security Update for Windows XP (KB2479943)
Security Update for Windows XP (KB2481109)
Security Update for Windows XP (KB2483185)
Security Update for Windows XP (KB2485376)
Security Update for Windows XP (KB2485663)
Security Update for Windows XP (KB2503658)
Security Update for Windows XP (KB2503665)
Security Update for Windows XP (KB2506212)
Security Update for Windows XP (KB2506223)
Security Update for Windows XP (KB2507618)
Security Update for Windows XP (KB2507938)
Security Update for Windows XP (KB2508272)
Security Update for Windows XP (KB2508429)
Security Update for Windows XP (KB2509553)
Security Update for Windows XP (KB2510581)
Security Update for Windows XP (KB2511455)
Security Update for Windows XP (KB2524375)
Security Update for Windows XP (KB2535512)
Security Update for Windows XP (KB2536276-v2)
Security Update for Windows XP (KB2536276)
Security Update for Windows XP (KB2544893-v2)
Security Update for Windows XP (KB2544893)
Security Update for Windows XP (KB2562937)
Security Update for Windows XP (KB2566454)
Security Update for Windows XP (KB2567053)
Security Update for Windows XP (KB2567680)
Security Update for Windows XP (KB2570222)
Security Update for Windows XP (KB2570947)
Security Update for Windows XP (KB2584146)
Security Update for Windows XP (KB2585542)
Security Update for Windows XP (KB2592799)
Security Update for Windows XP (KB2598479)
Security Update for Windows XP (KB2603381)
Security Update for Windows XP (KB2618451)
Security Update for Windows XP (KB2619339)
Security Update for Windows XP (KB2620712)
Security Update for Windows XP (KB2621440)
Security Update for Windows XP (KB2624667)
Security Update for Windows XP (KB2631813)
Security Update for Windows XP (KB2633171)
Security Update for Windows XP (KB2639417)
Security Update for Windows XP (KB2641653)
Security Update for Windows XP (KB2646524)
Security Update for Windows XP (KB2647518)
Security Update for Windows XP (KB2653956)
Security Update for Windows XP (KB2655992)
Security Update for Windows XP (KB2659262)
Security Update for Windows XP (KB2660465)
Security Update for Windows XP (KB2661637)
Security Update for Windows XP (KB2676562)
Security Update for Windows XP (KB2685939)
Security Update for Windows XP (KB2686509)
Security Update for Windows XP (KB2691442)
Security Update for Windows XP (KB2695962)
Security Update for Windows XP (KB2698365)
Security Update for Windows XP (KB2705219)
Security Update for Windows XP (KB2707511)
Security Update for Windows XP (KB2709162)
Security Update for Windows XP (KB2712808)
Security Update for Windows XP (KB2718523)
Security Update for Windows XP (KB2719985)
Security Update for Windows XP (KB2723135)
Security Update for Windows XP (KB2731847)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB938464-v2)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977165)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB979687)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB980436)
Security Update for Windows XP (KB981322)
Security Update for Windows XP (KB981349)
Security Update for Windows XP (KB981852)
Security Update for Windows XP (KB981957)
Security Update for Windows XP (KB981997)
Security Update for Windows XP (KB982132)
Security Update for Windows XP (KB982214)
Security Update for Windows XP (KB982665)
Security Update for Windows XP (KB982802)
Skype™ 3.6
Sonic DLA
Sonic RecordNow!
Sonic Update Manager
TurboTax 2009
TurboTax 2009 WinPerFedFormset
TurboTax 2009 WinPerReleaseEngine
TurboTax 2009 WinPerTaxSupport
TurboTax 2009 wrapper
TurboTax 2011
TurboTax 2011 wcaiper
TurboTax 2011 WinPerFedFormset
TurboTax 2011 WinPerReleaseEngine
TurboTax 2011 WinPerTaxSupport
TurboTax 2011 wrapper
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft Office 2010 (KB2553065)
Update for Microsoft Office 2010 (KB2553092)
Update for Microsoft Office 2010 (KB2553181) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553267) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553270) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition
Update for Microsoft Office 2010 (KB2566458)
Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition
Update for Microsoft Office 2010 (KB2598289) 32-Bit Edition
Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition
Update for Microsoft OneNote 2010 (KB2589345) 32-Bit Edition
Update for Microsoft Outlook 2010 (KB2553248) 32-Bit Edition
Update for Microsoft Outlook Social Connector 2010 (KB2553406) 32-Bit Edition
Update for Windows Internet Explorer 7 (KB976749)
Update for Windows Internet Explorer 7 (KB980182)
Update for Windows XP (KB2141007)
Update for Windows XP (KB2345886)
Update for Windows XP (KB2467659)
Update for Windows XP (KB2541763)
Update for Windows XP (KB2641690)
Update for Windows XP (KB2718704)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971029)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
Usnscsvr
WD Diagnostics
WD FAT32 Formatter
WD Firewire HID Driver
WebFldrs XP
Windows Genuine Advantage Notifications (KB905474)
Windows Internet Explorer 7
Windows Internet Explorer 8
Windows Media Format 11 runtime
Windows Media Player 10
Windows Media Player 11
Windows XP Service Pack 3
WinRAR archiver
WinZip
WordPerfect Office 12
.
==== Event Viewer Messages From Past Week ========
.
9/3/2012 9:06:02 PM, error: Service Control Manager [7001] - The Remote Access Connection Manager service depends on the Telephony service which failed to start because of the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
9/3/2012 3:31:57 PM, error: Service Control Manager [7001] - The Remote Access Auto Connection Manager service depends on the Telephony service which failed to start because of the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
9/3/2012 3:27:37 PM, error: Service Control Manager [7034] - The vToolbarUpdater11.2.0 service terminated unexpectedly. It has done this 1 time(s).
9/3/2012 3:27:37 PM, error: Service Control Manager [7034] - The iPod Service service terminated unexpectedly. It has done this 1 time(s).
9/3/2012 3:27:36 PM, error: Service Control Manager [7034] - The Java Quick Starter service terminated unexpectedly. It has done this 1 time(s).
9/3/2012 3:27:31 PM, error: Service Control Manager [7034] - The Intuit Update Service v4 service terminated unexpectedly. It has done this 1 time(s).
9/3/2012 3:27:31 PM, error: Service Control Manager [7034] - The Intuit Update Service service terminated unexpectedly. It has done this 1 time(s).
9/3/2012 3:27:29 PM, error: Service Control Manager [7031] - The AVG WatchDog service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.
.
==== End Of File ===========================

Hello symbiosis7

the machine runs as i reported before, which is to say it's about as fast as ever. no spontaneous voices since one of our first "cure" steps, browsers operating normally & not opening random windows.

Good

Your latest logs appear to be clean

is there additional protection i should be using?

You should only ever have one real time AV and one firewall installed on your machine. Malwarebytes Antimalware (MBAM) can be kept for an "on-demand" scanner. Make sure you keep your AVG and MBAM updated and scan your machine once a week.

If you wish to change from AVG to a different AV product you will find links to trusted applications in the notes that follow.


Please work your way through the following steps:

• Please Uninstall Combofix
  
  
  
  • Click on "Start" and then on "Run".
  • Now type combofix /uninstall in the run box and click "OK". Please note the space between the "x" and the "/Uninstall", it needs to be there.
  
  
• Please perform the following cleanup procedure
  
  
  
  • Double click on the OTL.exe icon on your desktop to run the program.
  • Follow any prompts that you receive.
  
  
• Removal of Tools
  
  
  
  • You no longer need aswMBR, MBRCheck, TDSSKiller, Rogue Killer or SystemLook. Please delete them from your machine.
  
  
• Please update your Java
  
  
  
  • To update your Java, Click on "Start" then on "Control Panel" and then on the Java icon (looks like a coffee cup).
  • In the window that opens, click on the "Update" tab, and then on "Update Now".
  • Your Java should begin to update. Please follow any prompts that you receive.
  
  
  Once you have completed the above steps you should be good to go! If you have any further questions, please feel free to ask.
  
  
• Finally, please take the time to read through the information provided below:
  
  Enhance your System Security
  
  
  • For an excellent list of free anti virus software, free online virus scanners, free spyware detection/removal and free firewalls, click here.
  
  
  • IMPORTANT! Please make sure you only have ONE firewall and ONE real-time antivirus installed on your system. When using "on demand" scanners, first update the detection signature files, then disconnect from the internet and disable your resident security program before running the scan.
  • Once complete, remember to re-engage your resident security before going online.
  
  Web Browsers and Browser Security
  
  Firefox
  
  • You can download Firefox from here.
  
  No-Script
  
  • If you use Firefox as your default browser, No-Script can provide additional security by preventing malicious scripts from being executed on your system.
  • You can download No-Script by clicking here.
  
  Internet Explorer
  
  • The newest version of Internet Explorer is available from here.
  • Please Note: IE9 is not configured to run on XP machines.
  
  SpywareBlaster
  
  • If you use Internet Explorer as your default browser, SpywareBlaster would be a valuable addition to your online security.
  • SpywareBlaster prevents malicious ActiveX objects from being downloaded onto your system.
  • You can download SpywareBlaster by clicking here.
  
  Web of Trust
  
  • When using search engines, Web of Trust provides you with an easy way of telling the good sites from the bad and is compatible with both Firefox and Internet Explorer.
  • Coloured symbols are displayed next to search results, giving you more confidence in the links you choose to click on: Green (To go), Yellow (Caution) and Red (Stop).
  • You can download Web of Trust by clicking here.
  
  Keep your Software Updated
  
  • Outdated software can sometimes have vulnerabilities that are exploitable by malware.
  • Check if there are available updates for your installed software with Secunia's Online Software Inspector by clicking here.
  
  Passwords
  
  • Learn how to create strong passwords by clicking here and test the strength of the passwords you already use by clicking here.
  
  General Reading
  
  • PC Safety and Security - What do I need?
  • How to prevent Malware (by Miekiemoes)
  
  Learn How To Combat Malware
  
  • Would you like to learn how to fight back against malware and help others? Enroll at the What The Tech (Formerly Tom Coyotes) Malware Classroom by clicking here.