What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Desktop suddenly slow every startup

35 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
OTL runfix as described and rebooted
When logging in after the reboot, OTL had been selected automatically and was asking for confirmation to run,
out of habit I selected Cancel

I then invoked OTL directly, run-As admin and got the 1st log below (stored under C:\_OTL\MovedFiles)
I then ran again as normal in case this is what you meant and got the 2nd full log
SystemLook posted as 3rd log entry

All processes killed
========== SERVICES/DRIVERS ==========
========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\ deleted successfully.
C:\WINDOWS\003163_.tmp deleted successfully.
C:\WINDOWS\DUMP79d3.tmp deleted successfully.
C:\WINDOWS\DUMP7a7f.tmp deleted successfully.
C:\WINDOWS\msdownld.tmp folder deleted successfully.
C:\WINDOWS\system.tmp deleted successfully.
C:\WINDOWS\win.tmp deleted successfully.
C:\WINDOWS\System32\CONFIG.TMP deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Bex
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Flash cache emptied: 300 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Guest
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Flash cache emptied: 5166 bytes

User: HP_Owner
->Temp folder emptied: 2358494 bytes
->Temporary Internet Files folder emptied: 9282532 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 28243442 bytes
->Flash cache emptied: 2138 bytes

User: LocalService
->Temp folder emptied: 65748 bytes
->Temporary Internet Files folder emptied: 49286 bytes

User: Martin
->Temp folder emptied: 4084053 bytes
->Temporary Internet Files folder emptied: 14153111 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 133392634 bytes
->Flash cache emptied: 9821 bytes

User: NetworkService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 32902 bytes

User: Sofie
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 78991 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 39180 bytes

User: Sue
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 78991 bytes
->Java cache emptied: 1284252 bytes
->FireFox cache emptied: 21092587 bytes
->Flash cache emptied: 50643 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 228625 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 205.00 mb


OTL by OldTimer - Version 3.2.69.0 log created on 02062013_073426

Files\Folders moved on Reboot…
File\Folder C:\Documents and Settings\Martin\Local Settings\Temp\~DFC75C.tmp not found!
File\Folder C:\Documents and Settings\Martin\Local Settings\Temp\~DFCA02.tmp not found!
C:\Documents and Settings\Martin\Local Settings\Temp\~DFCC20.tmp moved successfully.
File\Folder C:\Documents and Settings\Martin\Local Settings\Temp\~DFD1E8.tmp not found!
File\Folder C:\Documents and Settings\Martin\Local Settings\Temp\~DFD1F3.tmp not found!
C:\Documents and Settings\Martin\Local Settings\Temporary Internet Files\Content.IE5\W7XW11JK\index[2].php moved successfully.
C:\Documents and Settings\Martin\Local Settings\Temporary Internet Files\Content.IE5\2UGPRMRQ\iframe[1].htm moved successfully.
C:\Documents and Settings\Martin\Local Settings\Temporary Internet Files\AntiPhishing\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat moved successfully.

PendingFileRenameOperations files…

Registry entries deleted on Reboot…






OTL logfile created on: 06/02/2013 07:51:43 - Run 3
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\Martin\Desktop\WhatThetech etc
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

3.00 Gb Total Physical Memory | 2.38 Gb Available Physical Memory | 79.51% Memory free
3.59 Gb Paging File | 3.00 Gb Available in Paging File | 83.60% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 226.88 Gb Total Space | 108.02 Gb Free Space | 47.61% Space Free | Partition Type: NTFS
Drive D: | 5.99 Gb Total Space | 1.66 Gb Free Space | 27.72% Space Free | Partition Type: FAT32

Computer Name: BLADE2 | User Name: HP_Owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Martin\Desktop\WhatThetech etc\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\AVG Secure Search\vprot.exe ()
PRC - C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\14.0.1\ToolbarUpdater.exe ()
PRC - C:\Program Files\AVG\AVG2013\avgui.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2013\avgidsagent.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2013\avgrsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2013\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2013\avgnsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2013\avgemcx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG2013\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe (TomTom)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\WINDOWS\ALCWZRD.EXE (RealTek Semicoductor Corp.)
PRC - C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
PRC - C:\WINDOWS\system32\ps2.EXE (Hewlett-Packard Company)
PRC - C:\hp\drivers\hplsbwatcher\LSBurnWatcher.exe (Hewlett-Packard Company)
PRC - C:\WINDOWS\system32\HPZipm12.exe (HP)


========== Modules (No Company Name) ==========

MOD - C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\14.0.1\ToolbarUpdater.exe ()
MOD - C:\WINDOWS\system32\Primomonnt.dll ()
MOD - C:\WINDOWS\system32\spool\drivers\w32x86\3\cl31clf.dll ()
MOD - C:\WINDOWS\system32\spool\drivers\w32x86\3\cl31cum.dll ()
MOD - C:\WINDOWS\system32\spool\drivers\w32x86\3\cl31csf.dll ()
MOD - C:\WINDOWS\system32\spool\drivers\w32x86\3\cl31csc.dll ()
MOD - C:\WINDOWS\system32\cl31cl3.dll ()


========== Services (SafeList) ==========

SRV - (AVG Security Toolbar Service) – C:\Program Files\AVG\AVG10\Toolbar\ToolbarBroker.exe File not found
SRV - (AppMgmt) – %SystemRoot%\System32\appmgmts.dll File not found
SRV - (vToolbarUpdater14.0.1) – C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\14.0.1\ToolbarUpdater.exe ()
SRV - (AdobeFlashPlayerUpdateSvc) – C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (AVGIDSAgent) – C:\Program Files\AVG\AVG2013\avgidsagent.exe (AVG Technologies CZ, s.r.o.)
SRV - (avgwd) – C:\Program Files\AVG\AVG2013\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (TomTomHOMEService) – C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe (TomTom)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MsMpEng.exe (Microsoft Corporation)
SRV - (Pml Driver HPZ12) – C:\WINDOWS\system32\HPZipm12.exe (HP)


========== Driver Services (SafeList) ==========

DRV - (WDICA) – File not found
DRV - (vsdatant) – System32\vsdatant.sys File not found
DRV - (VMnetAdapter) – system32\DRIVERS\vmnetadapter.sys File not found
DRV - (SSPORT) – C:\WINDOWS\system32\Drivers\SSPORT.sys File not found
DRV - (PDRFRAME) – File not found
DRV - (PDRELI) – File not found
DRV - (PDFRAME) – File not found
DRV - (PDCOMP) – File not found
DRV - (PCIDump) – File not found
DRV - (lbrtfdc) – File not found
DRV - (i2omgmt) – File not found
DRV - (DgiVecp) – C:\WINDOWS\system32\Drivers\DgiVecp.sys File not found
DRV - (Changer) – File not found
DRV - (catchme) – C:\DOCUME~1\HP_Owner\LOCALS~1\Temp\catchme.sys File not found
DRV - (avgtp) – C:\WINDOWS\system32\drivers\avgtpx86.sys (AVG Technologies)
DRV - (Avgmfx86) – C:\WINDOWS\system32\drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AVGIDSDriver) – C:\WINDOWS\system32\drivers\avgidsdriverx.sys (AVG Technologies CZ, s.r.o. )
DRV - (AVGIDSHX) – C:\WINDOWS\system32\drivers\avgidshx.sys (AVG Technologies CZ, s.r.o. )
DRV - (Avgldx86) – C:\WINDOWS\system32\drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgtdix) – C:\WINDOWS\system32\drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avglogx) – C:\WINDOWS\system32\drivers\avglogx.sys (AVG Technologies CZ, s.r.o.)
DRV - (AVGIDSShim) – C:\WINDOWS\system32\drivers\avgidsshimx.sys (AVG Technologies CZ, s.r.o. )
DRV - (Avgrkx86) – C:\WINDOWS\system32\drivers\avgrkx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (fssfltr) – C:\WINDOWS\system32\drivers\fssfltr_tdi.sys (Microsoft Corporation)
DRV - (RTL8023xp) – C:\WINDOWS\system32\drivers\Rtnicxp.sys (Realtek Semiconductor Corporation )
DRV - (MPE) – C:\WINDOWS\system32\drivers\mpe.sys (Microsoft Corporation)
DRV - (AgereSoftModem) – C:\WINDOWS\system32\drivers\AGRSM.sys (Agere Systems)
DRV - (PCANDIS5) – C:\WINDOWS\system32\PCANDIS5.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (BDA_Loader_225) – C:\WINDOWS\system32\drivers\BDA_Loader_225.sys (WideView Technology Inc.)
DRV - (BDA_Capture_225) – C:\WINDOWS\system32\drivers\BDA_Capture_225.sys (WideViewer Electronics CO., LTD)
DRV - (IntcAzAudAddService) – C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (Afc) – C:\WINDOWS\system32\drivers\afc.sys (Arcsoft, Inc.)
DRV - (rtl8139) – C:\WINDOWS\system32\drivers\RTL8139.sys (Realtek Semiconductor Corporation)
DRV - (HdAudAddService) – C:\WINDOWS\system32\drivers\Hdaudio.sys (Windows ® Server 2003 DDK provider)
DRV - (Ps2) – C:\WINDOWS\system32\drivers\PS2.sys (Hewlett-Packard Company)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…ferrer:source?}
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…mp;sourceid=ie7
IE - HKLM\..\SearchScopes\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}: "URL" = http://us.yhs.search.yahoo.com/avg/search?…p={searchTerms}

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…amp;Form=IE8SRC
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…1I7PCTA_enGB350
IE - HKCU\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = https://isearch.avg.com/search?cid={FD17001…mp;d=2012-09-24 16:53:27&v=12.2.5.34&sap=dsp&q={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "about:blank"
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: {1E73965B-8B48-48be-9C8D-68B920ABC1C4}:10.0.0.1423
FF - prefs.js..extensions.enabledItems: avg@toolbar:11.1.0.12
FF - prefs.js..keyword.URL: "https://isearch.avg.com/search?cid={FD17001D-3658-474A-A7D0-BC71EC5BD71E}&mid=3f05b4dc341d47d6b99ed1191024e9fb-003760f4d9065511168fea5cf168a4a58301e9c1&lang=us&ds=AVG&pr=fr&d=2011-12-08 10:23:13&v=12.2.5.32&sap=ku&q="
FF - prefs.js..network.proxy.no_proxies_on: "localhost,127.0.0.1"
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_5_502_146.dll ()
FF - HKLM\Software\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin: C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\14.0.1\\npsitesafety.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\avg@igeared: C:\Program Files\AVG\AVG10\Toolbar\Firefox\avg@igeared
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\avg@toolbar: C:\Documents and Settings\All Users\Application Data\AVG Secure Search\FireFoxExt\14.0.2.14 [2013/01/25 08:45:12 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/09/13 17:00:43 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013/01/13 17:19:15 | 000,000,000 | —D | M]

[2011/05/23 08:16:52 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Extensions
[2011/05/23 08:16:52 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Extensions\[removed]
[2012/04/21 06:46:50 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\70vjyhhd.default\extensions
[2011/07/02 13:23:16 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\70vjyhhd.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2012/12/15 11:27:57 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2010/08/26 10:41:57 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010/12/07 13:53:47 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011/02/16 21:07:17 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
[2012/07/09 17:52:15 | 000,000,000 | —D | M] (AVG Security Toolbar) – C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\AVG SECURE SEARCH\11.1.0.12
[2012/09/24 15:53:33 | 000,000,000 | —D | M] (AVG Security Toolbar) – C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\AVG SECURE SEARCH\12.2.5.34\
File not found (No name found) – C:\PROGRAM FILES\AVG\AVG10\FIREFOX4
[2009/03/21 13:21:47 | 000,000,000 | —D | M] (Java Quick Starter) – C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2011/02/02 21:40:24 | 000,472,808 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2010/04/01 16:56:49 | 000,001,538 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\amazon-en-GB.xml
[2013/01/25 08:43:43 | 000,003,591 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\avg-secure-search.xml
[2010/04/01 16:56:50 | 000,000,947 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\chambers-en-GB.xml
[2010/04/01 16:56:50 | 000,000,769 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\eBay-en-GB.xml
[2010/04/01 16:56:50 | 000,001,135 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: ([2013/02/03 15:37:39 | 000,000,027 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\14.0.2.14\AVG Secure Search_toolbar.dll ()
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.8313.1002\swg.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\14.0.2.14\AVG Secure Search_toolbar.dll ()
O3 - HKLM\..\Toolbar: (HP view) - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll (Hewlett-Packard Company)
O3 - HKCU\..\Toolbar\ShellBrowser: (HP view) - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll (Hewlett-Packard Company)
O3 - HKCU\..\Toolbar\WebBrowser: (HP view) - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll (Hewlett-Packard Company)
O4 - HKLM..\Run: [AlcWzrd] C:\WINDOWS\ALCWZRD.EXE (RealTek Semicoductor Corp.)
O4 - HKLM..\Run: [AVG_UI] C:\Program Files\AVG\AVG2013\avgui.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4 - HKLM..\Run: [High Definition Audio Property Page Shortcut] C:\WINDOWS\System32\Hdaudpropshortcut.exe (Windows ® Server 2003 DDK provider)
O4 - HKLM..\Run: [HPHUPD06] c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe (Hewlett-Packard)
O4 - HKLM..\Run: [IJNetworkScanUtility] C:\Program Files\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe (CANON INC.)
O4 - HKLM..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\LSBurnWatcher.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [PS2] C:\WINDOWS\system32\ps2.EXE (Hewlett-Packard Company)
O4 - HKLM..\Run: [Recguard] C:\WINDOWS\SMINST\Recguard.exe ()
O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [vProt] C:\Program Files\AVG Secure Search\vprot.exe ()
O4 - HKCU..\Run: [ROC_JAN2013_TB] C:\Program Files\AVG Secure Search\ROC_JAN2013_TB.exe ()
O4 - HKCU..\Run: [TomTomHOME.exe] C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe (TomTom)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\npjpi160_24.dll (Sun Microsystems, Inc.)
O9 - Extra Button: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm ()
O9 - Extra 'Tools' menuitem : Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm ()
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Reg Error: Key error.)
O16 - DPF: {200B3EE9-7242-4EFD-B1E4-D97EE825BA53} http://h20270.www2.hp.com/ediags/gmn/insta…staller_gmn.cab (VerifyGMN Class)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/…b?1141845025035 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/microsoftu…b?1200144945578 (MUWebControl Class)
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab (HP Download Manager)
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} http://h20270.www2.hp.com/ediags/gmn2/inst…tDetection2.cab (GMNRev Class)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (Reg Error: Key error.)
O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} http://download.zonelabs.com/bin/promotion…canner37960.cab (ICSScanner Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} http://www.crucial.com/controls/cpcScanner.cab (Crucial cpcScan)
O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A506B63D-CD0A-40CA-9B53-A381F05999D5}: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\viprotocol {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\14.0.1\ViProtocol.dll ()
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\HP_Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\HP_Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - C:\Program Files\Windows Defender\MpShHook.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/11/09 20:20:04 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2001/07/28 07:07:38 | 000,000,000 | -HS- | M] () - D:\AUTOEXEC.BAT – [ FAT32 ]
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG2013\avgrsx.exe /sync /restart)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2013/02/06 07:34:26 | 000,000,000 | —D | C] – C:\_OTL
[2013/02/03 16:46:53 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2013/02/03 15:22:21 | 000,518,144 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2013/02/03 15:22:21 | 000,406,528 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2013/02/03 15:22:21 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2013/02/03 15:22:21 | 000,060,416 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2013/02/03 15:22:01 | 000,000,000 | —D | C] – C:\Qoobox
[2013/01/31 20:35:27 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\HijackThis
[2013/01/31 20:35:25 | 000,000,000 | —D | C] – C:\Program Files\Trend Micro
[2013/01/31 20:16:39 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\AVG
[2013/01/14 18:10:16 | 000,000,000 | –SD | C] – C:\Documents and Settings\HP_Owner\My Documents\My Data Sources
[2013/01/12 16:24:16 | 000,000,000 | —D | C] – C:\Documents and Settings\HP_Owner\Local Settings\Application Data\Temp

========== Files - Modified Within 30 Days ==========

[2013/02/06 07:42:15 | 000,000,886 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2013/02/06 07:41:21 | 000,000,882 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2013/02/06 07:41:21 | 000,000,342 | —- | M] () – C:\WINDOWS\tasks\ROC_JAN2013_TB_rmv.job
[2013/02/06 07:39:36 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2013/02/05 20:11:00 | 000,000,830 | —- | M] () – C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2013/02/04 06:56:57 | 000,000,185 | —- | M] () – C:\WINDOWS\System\hpsysdrv.DAT
[2013/02/04 06:55:48 | 000,000,320 | —- | M] () – C:\WINDOWS\tasks\ROC_JAN2013_TB_HP_Owner.job
[2013/02/03 20:35:24 | 000,001,158 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2013/02/03 20:30:47 | 000,000,795 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2013/02/03 20:28:29 | 000,000,575 | —- | M] () – C:\Documents and Settings\HP_Owner\Desktop\Martin Desktop.lnk
[2013/02/03 15:37:39 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2013/01/31 20:44:55 | 000,011,518 | —- | M] () – C:\Documents and Settings\HP_Owner\Desktop\hijackthis 20130131
[2013/01/31 20:35:27 | 000,001,745 | —- | M] () – C:\Documents and Settings\HP_Owner\Desktop\HijackThis.lnk
[2013/01/25 08:42:44 | 000,031,576 | —- | M] (AVG Technologies) – C:\WINDOWS\System32\drivers\avgtpx86.sys
[2013/01/14 18:29:47 | 000,020,480 | —- | M] () – C:\Documents and Settings\HP_Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2013/01/13 18:07:02 | 000,204,920 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2013/01/13 18:05:27 | 000,443,370 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2013/01/13 18:05:27 | 000,072,636 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2013/01/13 17:59:12 | 000,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2013/01/12 18:12:16 | 000,697,864 | —- | M] (Adobe Systems Incorporated) – C:\WINDOWS\System32\FlashPlayerApp.exe
[2013/01/12 18:12:16 | 000,074,248 | —- | M] (Adobe Systems Incorporated) – C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2013/01/12 17:21:41 | 000,000,395 | —- | M] () – C:\WINDOWS\CROCCLIP.INI

========== Files Created - No Company Name ==========

[2013/02/04 06:55:34 | 000,000,320 | —- | C] () – C:\WINDOWS\tasks\ROC_JAN2013_TB_HP_Owner.job
[2013/02/03 20:30:47 | 000,000,795 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2013/02/03 20:28:29 | 000,000,575 | —- | C] () – C:\Documents and Settings\HP_Owner\Desktop\Martin Desktop.lnk
[2013/02/03 15:22:21 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2013/02/03 15:22:21 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2013/02/03 15:22:21 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2013/01/31 20:44:55 | 000,011,518 | —- | C] () – C:\Documents and Settings\HP_Owner\Desktop\hijackthis 20130131
[2013/01/31 20:35:27 | 000,001,745 | —- | C] () – C:\Documents and Settings\HP_Owner\Desktop\HijackThis.lnk
[2013/01/25 08:45:10 | 000,000,342 | —- | C] () – C:\WINDOWS\tasks\ROC_JAN2013_TB_rmv.job
[2012/04/01 09:43:27 | 000,003,072 | —- | C] () – C:\WINDOWS\System32\iacenc.dll
[2011/02/20 12:32:39 | 000,000,212 | —- | C] () – C:\WINDOWS\IconWrks.INI
[2011/02/16 20:35:46 | 000,232,968 | —- | C] () – C:\WINDOWS\System32\nvdrsdb0.bin
[2011/02/16 20:35:44 | 000,232,968 | —- | C] () – C:\WINDOWS\System32\nvdrsdb1.bin
[2011/02/16 20:35:44 | 000,000,001 | —- | C] () – C:\WINDOWS\System32\nvdrssel.bin
[2008/01/12 14:25:00 | 000,001,751 | —- | C] () – C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2007/08/01 20:38:40 | 000,020,480 | —- | C] () – C:\Documents and Settings\HP_Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2006/11/08 16:28:17 | 000,278,528 | —- | C] () – C:\Program Files\Common Files\FDEUnInstaller.exe
[2006/05/20 17:42:05 | 000,000,131 | —- | C] () – C:\Documents and Settings\HP_Owner\Local Settings\Application Data\fusioncache.dat

========== ZeroAccess Check ==========

[2005/01/02 04:58:47 | 000,000,227 | RHS- | M] () – C:\WINDOWS\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll – [2008/04/14 04:42:06 | 001,499,136 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll – [2009/02/09 12:10:48 | 000,473,600 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll – [2008/04/14 04:42:10 | 000,273,920 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

< End of report >




SystemLook 30.07.11 by jpshortstuff
Log created at 08:00 on 06/02/2013 by HP_Owner
Administrator - Elevation successful

========== dir ==========

C:\RECYCLER - Parameters: "(none)"

—Files—
None found.

—Folders—
S-1-5-21-3882495902-1733513528-3747878165-1008 d–hs– [07:35 06/02/2013]
S-1-5-21-3882495902-1733513528-3747878165-1009 d–hs– [16:46 03/02/2013]

-= EOF =-
Post #17
Download RogueKiller and save it on your Desktop.
  • Quit all programs.
  • Start RogueKiller.exe. For Vista or Windows 7, right-click on the program, select Run as Administrator to start, then when prompted, press Allow to run.
  • Wait until Pre-scan has finished.
  • Click on Scan.
  • Wait for the scan to complete.
  • When the scan completes, close the program.
  • The report has been created on the Desktop.
  • Please post the contents of the RKreport.txt file located on your Desktop.
Post #18
As you didnt mention running as admin for xp, I used my restricted account

During the run RK mentioned ALCWIZARD.exe and at roughly the same time AVG detection kicked in against the RK.exe
I clicked to accept and Rk appears to complete although the RK dialog screen flashes with ZeroAccess and is suggesting to delete the process 7 registry items



RogueKiller V8.4.4 [Feb 5 2013] by Tigzy
mail : tigzyRKgmailcom
Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/
Website : http://tigzy.geekstogo.com/roguekiller.php
Blog : http://tigzyrk.blogspot.com/

Operating System : Windows XP (5.1.2600 Service Pack 3) 32 bits version
Started in : Normal mode
User : Martin [Restricted rights]
Mode : Scan – Date : 02/06/2013 16:10:31
| ARK || MBR |

¤¤¤ Bad processes : 1 ¤¤¤
[SUSP PATH] ALCWZRD.EXE – C:\WINDOWS\ALCWZRD.EXE -> KILLED [TermProc]

¤¤¤ Registry Entries : 4 ¤¤¤
[HJPOL] HKLM\[…]\System : DisableRegistryTools (0) -> FOUND
[HJ SMENU] HKCU\[…]\Advanced : Start_ShowPrinters (0) -> FOUND
[HJ DESK] HKLM\[…]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
[HOSTS] HKLM\[…]\Parameters : DataBasePath () -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [NOT LOADED] ¤¤¤

¤¤¤ Infection : ZeroAccess ¤¤¤
[ZeroAccess] (LOCKED) windir\NtUpdateKBxxxx present!

¤¤¤ HOSTS File: ¤¤¤
–> C:\WINDOWS\system32\drivers\etc\hosts

127.0.0.1 localhost


¤¤¤ MBR Check: ¤¤¤

Finished : << RKreport[1]_S_02062013_02d1610.txt >>
RKreport[1]_S_02062013_02d1610.txt
Post #19

¤¤¤ Infection : ZeroAccess ¤¤¤
[ZeroAccess] (LOCKED) windir\NtUpdateKBxxxx present!

You have ZeroAccess rootkit, can be nasty.


Please download TDSSKiller.zip
  • Extract it to your desktop
  • Double click TDSSKiller.exe
  • Press Start Scan
    • Only if Malicious objects are found then ensure Cure is selected
      If suspicious objects are found select skip
    • Then click Continue > Reboot now
  • Copy and paste the log in your next reply
    • A copy of the log will be saved automatically to the root of the drive (typically C:\)
Post #20
I ran using runas admin from my restricted user I did not disable AVG The dialog indicated no threats found, but only processed 314 objects 08:30:52.0640 3868 TDSS rootkit removing tool 2.8.15.0 Oct 31 2012 21:47:35 08:30:52.0984 3868 ============================================================ 08:30:52.0984 3868 Current date / time: 2013/02/07 08:30:52.0984 08:30:52.0984 3868 SystemInfo: 08:30:52.0984 3868 08:30:52.0984 3868 OS Version: 5.1.2600 ServicePack: 3.0 08:30:52.0984 3868 Product type: Workstation 08:30:52.0984 3868 ComputerName: BLADE2 08:30:52.0984 3868 UserName: HP_Owner 08:30:52.0984 3868 Windows directory: C:\WINDOWS 08:30:52.0984 3868 System windows directory: C:\WINDOWS 08:30:52.0984 3868 Processor architecture: Intel x86 08:30:52.0984 3868 Number of processors: 1 08:30:52.0984 3868 Page size: 0x1000 08:30:52.0984 3868 Boot type: Normal boot 08:30:52.0984 3868 ============================================================ 08:30:57.0984 3868 Drive \Device\Harddisk0\DR0 - Size: 0x3A38B2E000 (232.89 Gb), SectorSize: 0x200, Cylinders: 0x7E2D, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xF0, Type 'K0', Flags 0x00000054 08:30:58.0109 3868 ============================================================ 08:30:58.0109 3868 \Device\Harddisk0\DR0: 08:30:58.0125 3868 MBR partitions: 08:30:58.0125 3868 \Device\Harddisk0\DR0\Partition1: MBR, Type 0xC, StartLBA 0x3F, BlocksNum 0xBFF3C1 08:30:58.0125 3868 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0xBFF400, BlocksNum 0x1C5C12C0 08:30:58.0125 3868 ============================================================ 08:30:58.0203 3868 C: <-> \Device\Harddisk0\DR0\Partition2 08:30:58.0203 3868 D: <-> \Device\Harddisk0\DR0\Partition1 08:30:58.0203 3868 ============================================================ 08:30:58.0203 3868 Initialize success 08:30:58.0203 3868 ============================================================ 08:31:03.0984 1356 ============================================================ 08:31:03.0984 1356 Scan started 08:31:03.0984 1356 Mode: Manual; 08:31:03.0984 1356 ============================================================ 08:31:05.0734 1356 ================ Scan system memory ======================== 08:31:05.0734 1356 System memory - ok 08:31:05.0750 1356 ================ Scan services ============================= 08:31:06.0968 1356 Abiosdsk - ok 08:31:07.0000 1356 abp480n5 - ok 08:31:07.0109 1356 [ 8FD99680A539792A30E97944FDAECF17 ] ACPI C:\WINDOWS\system32\DRIVERS\ACPI.sys 08:31:07.0265 1356 ACPI - ok 08:31:07.0312 1356 [ 9859C0F6936E723E4892D7141B1327D5 ] ACPIEC C:\WINDOWS\system32\drivers\ACPIEC.sys 08:31:07.0359 1356 ACPIEC - ok 08:31:07.0562 1356 [ 424877CB9D5517F980FF7BACA2EB379D ] AdobeFlashPlayerUpdateSvc C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe 08:31:07.0687 1356 AdobeFlashPlayerUpdateSvc - ok 08:31:07.0687 1356 adpu160m - ok 08:31:07.0765 1356 [ 8BED39E3C35D6A489438B8141717A557 ] aec C:\WINDOWS\system32\drivers\aec.sys 08:31:07.0937 1356 aec - ok 08:31:08.0062 1356 [ A7B8A3A79D35215D798A300DF49ED23F ] Afc C:\WINDOWS\system32\drivers\Afc.sys 08:31:08.0140 1356 Afc - ok 08:31:08.0250 1356 [ 1E44BC1E83D8FD2305F8D452DB109CF9 ] AFD C:\WINDOWS\System32\drivers\afd.sys 08:31:08.0296 1356 AFD - ok 08:31:08.0796 1356 [ 9074E4D73BB8B06758E530A20C592DAC ] AgereSoftModem C:\WINDOWS\system32\DRIVERS\AGRSM.sys 08:31:09.0359 1356 AgereSoftModem - ok 08:31:09.0359 1356 Aha154x - ok 08:31:09.0375 1356 aic78u2 - ok 08:31:09.0375 1356 aic78xx - ok 08:31:09.0421 1356 [ A9A3DAA780CA6C9671A19D52456705B4 ] Alerter C:\WINDOWS\system32\alrsvc.dll 08:31:09.0437 1356 Alerter - ok 08:31:09.0484 1356 [ 8C515081584A38AA007909CD02020B3D ] ALG C:\WINDOWS\System32\alg.exe 08:31:09.0484 1356 ALG - ok 08:31:09.0484 1356 AliIde - ok 08:31:09.0531 1356 amsint - ok 08:31:09.0531 1356 AppMgmt - ok 08:31:09.0609 1356 [ B5B8A80875C1DEDEDA8B02765642C32F ] Arp1394 C:\WINDOWS\system32\DRIVERS\arp1394.sys 08:31:09.0687 1356 Arp1394 - ok 08:31:09.0718 1356 asc - ok 08:31:09.0718 1356 asc3350p - ok 08:31:09.0734 1356 asc3550 - ok 08:31:09.0984 1356 [ 0E5E4957549056E2BF2C49F4F6B601AD ] aspnet_state C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe 08:31:10.0031 1356 aspnet_state - ok 08:31:10.0062 1356 [ B153AFFAC761E7F5FCFA822B9C4E97BC ] AsyncMac C:\WINDOWS\system32\DRIVERS\asyncmac.sys 08:31:10.0109 1356 AsyncMac - ok 08:31:10.0187 1356 [ 9F3A2F5AA6875C72BF062C712CFA2674 ] atapi C:\WINDOWS\system32\DRIVERS\atapi.sys 08:31:10.0187 1356 atapi - ok 08:31:10.0218 1356 Atdisk - ok 08:31:10.0265 1356 [ 9916C1225104BA14794209CFA8012159 ] Atmarpc C:\WINDOWS\system32\DRIVERS\atmarpc.sys 08:31:10.0296 1356 Atmarpc - ok 08:31:10.0359 1356 [ DEF7A7882BEC100FE0B2CE2549188F9D ] AudioSrv C:\WINDOWS\System32\audiosrv.dll 08:31:10.0359 1356 AudioSrv - ok 08:31:10.0421 1356 [ D9F724AA26C010A217C97606B160ED68 ] audstub C:\WINDOWS\system32\DRIVERS\audstub.sys 08:31:10.0437 1356 audstub - ok 08:31:10.0546 1356 AVG Security Toolbar Service - ok 08:31:12.0937 1356 [ 4AFC14AFA58878FAA1D249E7E90EA54B ] AVGIDSAgent C:\Program Files\AVG\AVG2013\avgidsagent.exe 08:31:14.0937 1356 AVGIDSAgent - ok 08:31:15.0031 1356 [ 7BB2C605094DBCA536D127B434214862 ] AVGIDSDriver C:\WINDOWS\system32\DRIVERS\avgidsdriverx.sys 08:31:15.0125 1356 AVGIDSDriver - ok 08:31:15.0187 1356 [ 8F50F98686C9A397A19FCBAE284DB1C5 ] AVGIDSHX C:\WINDOWS\system32\DRIVERS\avgidshx.sys 08:31:15.0218 1356 AVGIDSHX - ok 08:31:15.0296 1356 [ A8DE230CC8536790CA07D37FBCD87A74 ] AVGIDSShim C:\WINDOWS\system32\DRIVERS\avgidsshimx.sys 08:31:15.0359 1356 AVGIDSShim - ok 08:31:15.0484 1356 [ D53D35031365A0ECCB1DC1BC1B15B18E ] Avgldx86 C:\WINDOWS\system32\DRIVERS\avgldx86.sys 08:31:15.0500 1356 Avgldx86 - ok 08:31:15.0562 1356 [ 95889A9D23F3133250FA8AD13C982D58 ] Avglogx C:\WINDOWS\system32\DRIVERS\avglogx.sys 08:31:15.0687 1356 Avglogx - ok 08:31:15.0750 1356 [ AF7AA9BA434CD28833A66E90993E8DFD ] Avgmfx86 C:\WINDOWS\system32\DRIVERS\avgmfx86.sys 08:31:15.0828 1356 Avgmfx86 - ok 08:31:15.0875 1356 [ F3D57358DE0B8B3491013C615754A7C7 ] Avgrkx86 C:\WINDOWS\system32\DRIVERS\avgrkx86.sys 08:31:15.0921 1356 Avgrkx86 - ok 08:31:16.0031 1356 [ BA73B38E9033FC6018DB736B635706AE ] Avgtdix C:\WINDOWS\system32\DRIVERS\avgtdix.sys 08:31:16.0093 1356 Avgtdix - ok 08:31:16.0156 1356 [ 740970262714E0575F23A917A2A53A31 ] avgtp C:\WINDOWS\system32\drivers\avgtpx86.sys 08:31:16.0234 1356 avgtp - ok 08:31:16.0359 1356 [ 6B72E1E329C4E98C6B6FDD2D265E3BA3 ] avgwd C:\Program Files\AVG\AVG2013\avgwdsvc.exe 08:31:16.0359 1356 avgwd - ok 08:31:16.0546 1356 [ A4EBA783397B64B92E470EA038E555F9 ] BDA_Capture_225 C:\WINDOWS\system32\Drivers\BDA_Capture_225.sys 08:31:16.0578 1356 BDA_Capture_225 - ok 08:31:16.0625 1356 [ D6A7BA293C33B17A1173DDE6A9574C03 ] BDA_Loader_225 C:\WINDOWS\system32\Drivers\BDA_Loader_225.sys 08:31:16.0765 1356 BDA_Loader_225 - ok 08:31:16.0828 1356 [ DA1F27D85E0D1525F6621372E7B685E9 ] Beep C:\WINDOWS\system32\drivers\Beep.sys 08:31:16.0890 1356 Beep - ok 08:31:17.0046 1356 [ 574738F61FCA2935F5265DC4E5691314 ] BITS C:\WINDOWS\system32\qmgr.dll 08:31:17.0312 1356 BITS - ok 08:31:17.0390 1356 [ CFD4E51402DA9838B5A04AE680AF54A0 ] Browser C:\WINDOWS\System32\browser.dll 08:31:17.0390 1356 Browser - ok 08:31:17.0500 1356 catchme - ok 08:31:17.0531 1356 [ 90A673FC8E12A79AFBED2576F6A7AAF9 ] cbidf2k C:\WINDOWS\system32\drivers\cbidf2k.sys 08:31:17.0546 1356 cbidf2k - ok 08:31:17.0578 1356 [ 0BE5AEF125BE881C4F854C554F2B025C ] CCDECODE C:\WINDOWS\system32\DRIVERS\CCDECODE.sys 08:31:17.0593 1356 CCDECODE - ok 08:31:17.0593 1356 cd20xrnt - ok 08:31:17.0625 1356 [ C1B486A7658353D33A10CC15211A873B ] Cdaudio C:\WINDOWS\system32\drivers\Cdaudio.sys 08:31:17.0656 1356 Cdaudio - ok 08:31:17.0703 1356 [ C885B02847F5D2FD45A24E219ED93B32 ] Cdfs C:\WINDOWS\system32\drivers\Cdfs.sys 08:31:17.0734 1356 Cdfs - ok 08:31:17.0796 1356 [ 1F4260CC5B42272D71F79E570A27A4FE ] Cdrom C:\WINDOWS\system32\DRIVERS\cdrom.sys 08:31:17.0828 1356 Cdrom - ok 08:31:17.0843 1356 Changer - ok 08:31:17.0875 1356 [ 1CFE720EB8D93A7158A4EBC3AB178BDE ] CiSvc C:\WINDOWS\system32\cisvc.exe 08:31:17.0875 1356 CiSvc - ok 08:31:17.0921 1356 [ 34CBE729F38138217F9C80212A2A0C82 ] ClipSrv C:\WINDOWS\system32\clipsrv.exe 08:31:17.0937 1356 ClipSrv - ok 08:31:18.0046 1356 [ D87ACAED61E417BBA546CED5E7E36D9C ] clr_optimization_v2.0.50727_32 C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 08:31:18.0359 1356 clr_optimization_v2.0.50727_32 - ok 08:31:18.0359 1356 CmdIde - ok 08:31:18.0375 1356 COMSysApp - ok 08:31:18.0390 1356 Cpqarray - ok 08:31:18.0453 1356 [ 3D4E199942E29207970E04315D02AD3B ] CryptSvc C:\WINDOWS\System32\cryptsvc.dll 08:31:18.0453 1356 CryptSvc - ok 08:31:18.0468 1356 dac2w2k - ok 08:31:18.0468 1356 dac960nt - ok 08:31:18.0671 1356 [ 6B27A5C03DFB94B4245739065431322C ] DcomLaunch C:\WINDOWS\system32\rpcss.dll 08:31:18.0828 1356 DcomLaunch - ok 08:31:18.0843 1356 DgiVecp - ok 08:31:18.0921 1356 [ 5E38D7684A49CACFB752B046357E0589 ] Dhcp C:\WINDOWS\System32\dhcpcsvc.dll 08:31:18.0921 1356 Dhcp - ok 08:31:18.0984 1356 [ 044452051F3E02E7963599FC8F4F3E25 ] Disk C:\WINDOWS\system32\DRIVERS\disk.sys 08:31:19.0031 1356 Disk - ok 08:31:19.0031 1356 dmadmin - ok 08:31:19.0296 1356 [ D992FE1274BDE0F84AD826ACAE022A41 ] dmboot C:\WINDOWS\system32\drivers\dmboot.sys 08:31:19.0562 1356 dmboot - ok 08:31:19.0625 1356 [ 7C824CF7BBDE77D95C08005717A95F6F ] dmio C:\WINDOWS\system32\drivers\dmio.sys 08:31:19.0687 1356 dmio - ok 08:31:19.0718 1356 [ E9317282A63CA4D188C0DF5E09C6AC5F ] dmload C:\WINDOWS\system32\drivers\dmload.sys 08:31:19.0734 1356 dmload - ok 08:31:19.0781 1356 [ 57EDEC2E5F59F0335E92F35184BC8631 ] dmserver C:\WINDOWS\System32\dmserver.dll 08:31:19.0796 1356 dmserver - ok 08:31:19.0828 1356 [ 8A208DFCF89792A484E76C40E5F50B45 ] DMusic C:\WINDOWS\system32\drivers\DMusic.sys 08:31:19.0859 1356 DMusic - ok 08:31:19.0906 1356 [ 5F7E24FA9EAB896051FFB87F840730D2 ] Dnscache C:\WINDOWS\System32\dnsrslvr.dll 08:31:19.0937 1356 Dnscache - ok 08:31:20.0015 1356 [ 0F0F6E687E5E15579EF4DA8DD6945814 ] Dot3svc C:\WINDOWS\System32\dot3svc.dll 08:31:20.0062 1356 Dot3svc - ok 08:31:20.0078 1356 dpti2o - ok 08:31:20.0109 1356 [ 8F5FCFF8E8848AFAC920905FBD9D33C8 ] drmkaud C:\WINDOWS\system32\drivers\drmkaud.sys 08:31:20.0140 1356 drmkaud - ok 08:31:20.0187 1356 [ 2187855A7703ADEF0CEF9EE4285182CC ] EapHost C:\WINDOWS\System32\eapsvc.dll 08:31:20.0218 1356 EapHost - ok 08:31:20.0265 1356 [ BC93B4A066477954555966D77FEC9ECB ] ERSvc C:\WINDOWS\System32\ersvc.dll 08:31:20.0265 1356 ERSvc - ok 08:31:20.0359 1356 [ 65DF52F5B8B6E9BBD183505225C37315 ] Eventlog C:\WINDOWS\system32\services.exe 08:31:20.0406 1356 Eventlog - ok 08:31:20.0500 1356 [ D4991D98F2DB73C60D042F1AEF79EFAE ] EventSystem C:\WINDOWS\system32\es.dll 08:31:20.0562 1356 EventSystem - ok 08:31:20.0656 1356 [ 38D332A6D56AF32635675F132548343E ] Fastfat C:\WINDOWS\system32\drivers\Fastfat.sys 08:31:20.0703 1356 Fastfat - ok 08:31:20.0828 1356 [ 99BC0B50F511924348BE19C7C7313BBF ] FastUserSwitchingCompatibility C:\WINDOWS\System32\shsvcs.dll 08:31:20.0828 1356 FastUserSwitchingCompatibility - ok 08:31:20.0968 1356 [ E97D6A8684466DF94FF3BC24FB787A07 ] Fax C:\WINDOWS\system32\fxssvc.exe 08:31:21.0078 1356 Fax - ok 08:31:21.0109 1356 [ 92CDD60B6730B9F50F6A1A0C1F8CDC81 ] Fdc C:\WINDOWS\system32\DRIVERS\fdc.sys 08:31:21.0125 1356 Fdc - ok 08:31:21.0187 1356 [ D45926117EB9FA946A6AF572FBE1CAA3 ] Fips C:\WINDOWS\system32\drivers\Fips.sys 08:31:21.0187 1356 Fips - ok 08:31:21.0218 1356 [ 9D27E7B80BFCDF1CDD9B555862D5E7F0 ] Flpydisk C:\WINDOWS\system32\DRIVERS\flpydisk.sys 08:31:21.0250 1356 Flpydisk - ok 08:31:21.0343 1356 [ B2CF4B0786F8212CB92ED2B50C6DB6B0 ] FltMgr C:\WINDOWS\system32\drivers\fltmgr.sys 08:31:21.0406 1356 FltMgr - ok 08:31:21.0515 1356 [ 8BA7C024070F2B7FDD98ED8A4BA41789 ] FontCache3.0.0.0 c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe 08:31:21.0593 1356 FontCache3.0.0.0 - ok 08:31:21.0656 1356 [ E0087225B137E57239FF40F8AE82059B ] fssfltr C:\WINDOWS\system32\DRIVERS\fssfltr_tdi.sys 08:31:21.0656 1356 fssfltr - ok 08:31:21.0968 1356 [ 45B52394F9624237F33A8A3D73C0B221 ] fsssvc C:\Program Files\Windows Live\Family Safety\fsssvc.exe 08:31:22.0281 1356 fsssvc - ok 08:31:22.0343 1356 [ 3E1E2BD4F39B0E2B7DC4F4D2BCC2779A ] Fs_Rec C:\WINDOWS\system32\drivers\Fs_Rec.sys 08:31:22.0390 1356 Fs_Rec - ok 08:31:22.0484 1356 [ 6AC26732762483366C3969C9E4D2259D ] Ftdisk C:\WINDOWS\system32\DRIVERS\ftdisk.sys 08:31:22.0562 1356 Ftdisk - ok 08:31:22.0593 1356 [ 0A02C63C8B144BD8C86B103DEE7C86A2 ] Gpc C:\WINDOWS\system32\DRIVERS\msgpc.sys 08:31:22.0656 1356 Gpc - ok 08:31:22.0843 1356 [ 8F0DE4FEF8201E306F9938B0905AC96A ] gupdate C:\Program Files\Google\Update\GoogleUpdate.exe 08:31:22.0875 1356 gupdate - ok 08:31:22.0937 1356 [ 8F0DE4FEF8201E306F9938B0905AC96A ] gupdatem C:\Program Files\Google\Update\GoogleUpdate.exe 08:31:22.0953 1356 gupdatem - ok 08:31:23.0109 1356 [ 5D4BC124FAAE6730AC002CDB67BF1A1C ] gusvc C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe 08:31:23.0203 1356 gusvc - ok 08:31:23.0296 1356 [ 160B24FD894E79E71C983EA403A6E6E7 ] HdAudAddService C:\WINDOWS\system32\drivers\HdAudio.sys 08:31:23.0359 1356 HdAudAddService - ok 08:31:23.0453 1356 [ 573C7D0A32852B48F3058CFD8026F511 ] HDAudBus C:\WINDOWS\system32\DRIVERS\HDAudBus.sys 08:31:23.0468 1356 HDAudBus - ok 08:31:23.0593 1356 [ 4FCCA060DFE0C51A09DD5C3843888BCD ] helpsvc C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll 08:31:23.0593 1356 helpsvc - ok 08:31:23.0656 1356 [ DEB04DA35CC871B6D309B77E1443C796 ] HidServ C:\WINDOWS\System32\hidserv.dll 08:31:23.0656 1356 HidServ - ok 08:31:23.0703 1356 [ CCF82C5EC8A7326C3066DE870C06DAF1 ] hidusb C:\WINDOWS\system32\DRIVERS\hidusb.sys 08:31:23.0718 1356 hidusb - ok 08:31:23.0765 1356 [ 8878BD685E490239777BFE51320B88E9 ] hkmsvc C:\WINDOWS\System32\kmsvc.dll 08:31:23.0843 1356 hkmsvc - ok 08:31:23.0843 1356 hpn - ok 08:31:23.0984 1356 [ F80A415EF82CD06FFAF0D971528EAD38 ] HTTP C:\WINDOWS\system32\Drivers\HTTP.sys 08:31:24.0062 1356 HTTP - ok 08:31:24.0109 1356 [ 6100A808600F44D999CEBDEF8841C7A3 ] HTTPFilter C:\WINDOWS\System32\w3ssl.dll 08:31:24.0109 1356 HTTPFilter - ok 08:31:24.0125 1356 i2omgmt - ok 08:31:24.0140 1356 i2omp - ok 08:31:24.0218 1356 [ 4A0B06AA8943C1E332520F7440C0AA30 ] i8042prt C:\WINDOWS\system32\DRIVERS\i8042prt.sys 08:31:24.0265 1356 i8042prt - ok 08:31:24.0406 1356 [ 6F95324909B502E2651442C1548AB12F ] IDriverT C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe 08:31:24.0562 1356 IDriverT - ok 08:31:24.0890 1356 [ C01AC32DC5C03076CFB852CB5DA5229C ] idsvc C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe 08:31:25.0218 1356 idsvc - ok 08:31:25.0265 1356 [ 083A052659F5310DD8B6A6CB05EDCF8E ] Imapi C:\WINDOWS\system32\drivers\Imapi.sys 08:31:25.0296 1356 Imapi - ok 08:31:25.0406 1356 [ 30DEAF54A9755BB8546168CFE8A6B5E1 ] ImapiService C:\WINDOWS\system32\imapi.exe 08:31:25.0437 1356 ImapiService - ok 08:31:25.0453 1356 ini910u - ok 08:31:26.0937 1356 [ A30685283F90AE02F1CD50972C6065E3 ] IntcAzAudAddService C:\WINDOWS\system32\drivers\RtkHDAud.sys 08:31:26.0968 1356 IntcAzAudAddService - ok 08:31:27.0015 1356 [ B5466A9250342A7AA0CD1FBA13420678 ] IntelIde C:\WINDOWS\system32\DRIVERS\intelide.sys 08:31:27.0031 1356 IntelIde - ok 08:31:27.0078 1356 [ 8C953733D8F36EB2133F5BB58808B66B ] intelppm C:\WINDOWS\system32\DRIVERS\intelppm.sys 08:31:27.0109 1356 intelppm - ok 08:31:27.0140 1356 [ 3BB22519A194418D5FEC05D800A19AD0 ] Ip6Fw C:\WINDOWS\system32\drivers\ip6fw.sys 08:31:27.0171 1356 Ip6Fw - ok 08:31:27.0218 1356 [ 731F22BA402EE4B62748ADAF6363C182 ] IpFilterDriver C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys 08:31:27.0250 1356 IpFilterDriver - ok 08:31:27.0265 1356 [ B87AB476DCF76E72010632B5550955F5 ] IpInIp C:\WINDOWS\system32\DRIVERS\ipinip.sys 08:31:27.0281 1356 IpInIp - ok 08:31:27.0390 1356 [ CC748EA12C6EFFDE940EE98098BF96BB ] IpNat C:\WINDOWS\system32\DRIVERS\ipnat.sys 08:31:27.0453 1356 IpNat - ok 08:31:27.0500 1356 [ 23C74D75E36E7158768DD63D92789A91 ] IPSec C:\WINDOWS\system32\DRIVERS\ipsec.sys 08:31:27.0546 1356 IPSec - ok 08:31:27.0578 1356 [ C93C9FF7B04D772627A3646D89F7BF89 ] IRENUM C:\WINDOWS\system32\DRIVERS\irenum.sys 08:31:27.0609 1356 IRENUM - ok 08:31:27.0656 1356 [ 05A299EC56E52649B1CF2FC52D20F2D7 ] isapnp C:\WINDOWS\system32\DRIVERS\isapnp.sys 08:31:27.0687 1356 isapnp - ok 08:31:27.0921 1356 [ 5E06A9D23727DAF96FAA796F1135FDCD ] JavaQuickStarterService C:\Program Files\Java\jre6\bin\jqs.exe 08:31:27.0921 1356 JavaQuickStarterService - ok 08:31:27.0968 1356 [ 463C1EC80CD17420A542B7F36A36F128 ] Kbdclass C:\WINDOWS\system32\DRIVERS\kbdclass.sys 08:31:27.0984 1356 Kbdclass - ok 08:31:28.0031 1356 [ 9EF487A186DEA361AA06913A75B3FA99 ] kbdhid C:\WINDOWS\system32\DRIVERS\kbdhid.sys 08:31:28.0062 1356 kbdhid - ok 08:31:28.0171 1356 [ 692BCF44383D056AED41B045A323D378 ] kmixer C:\WINDOWS\system32\drivers\kmixer.sys 08:31:28.0234 1356 kmixer - ok 08:31:28.0328 1356 [ B467646C54CC746128904E1654C750C1 ] KSecDD C:\WINDOWS\system32\drivers\KSecDD.sys 08:31:28.0343 1356 KSecDD - ok 08:31:28.0421 1356 [ 3A7C3CBE5D96B8AE96CE81F0B22FB527 ] lanmanserver C:\WINDOWS\System32\srvsvc.dll 08:31:28.0453 1356 lanmanserver - ok 08:31:28.0546 1356 [ A8888A5327621856C0CEC4E385F69309 ] lanmanworkstation C:\WINDOWS\System32\wkssvc.dll 08:31:28.0562 1356 lanmanworkstation - ok 08:31:28.0578 1356 lbrtfdc - ok 08:31:28.0687 1356 [ 9BD7ADD61B031307DD075E5E6A917C4D ] LightScribeService c:\Program Files\Common Files\LightScribe\LSSrvc.exe 08:31:28.0687 1356 LightScribeService - ok 08:31:28.0781 1356 [ A7DB739AE99A796D91580147E919CC59 ] LmHosts C:\WINDOWS\System32\lmhsvc.dll 08:31:28.0781 1356 LmHosts - ok 08:31:28.0843 1356 [ 986B1FF5814366D71E0AC5755C88F2D3 ] Messenger C:\WINDOWS\System32\msgsvc.dll 08:31:28.0906 1356 Messenger - ok 08:31:28.0953 1356 [ 4AE068242760A1FB6E1A44BF4E16AFA6 ] mnmdd C:\WINDOWS\system32\drivers\mnmdd.sys 08:31:29.0000 1356 mnmdd - ok 08:31:29.0031 1356 [ D18F1F0C101D06A1C1ADF26EED16FCDD ] mnmsrvc C:\WINDOWS\system32\mnmsrvc.exe 08:31:29.0078 1356 mnmsrvc - ok 08:31:29.0125 1356 [ DFCBAD3CEC1C5F964962AE10E0BCC8E1 ] Modem C:\WINDOWS\system32\drivers\Modem.sys 08:31:29.0187 1356 Modem - ok 08:31:29.0218 1356 [ 35C9E97194C8CFB8430125F8DBC34D04 ] Mouclass C:\WINDOWS\system32\DRIVERS\mouclass.sys 08:31:29.0265 1356 Mouclass - ok 08:31:29.0312 1356 [ B1C303E17FB9D46E87A98E4BA6769685 ] mouhid C:\WINDOWS\system32\DRIVERS\mouhid.sys 08:31:29.0359 1356 mouhid - ok 08:31:29.0390 1356 [ A80B9A0BAD1B73637DBCBBA7DF72D3FD ] MountMgr C:\WINDOWS\system32\drivers\MountMgr.sys 08:31:29.0500 1356 MountMgr - ok 08:31:29.0531 1356 [ C0F8E0C2C3C0437CF37C6781896DC3EC ] MPE C:\WINDOWS\system32\DRIVERS\MPE.sys 08:31:29.0546 1356 MPE - ok 08:31:29.0562 1356 mraid35x - ok 08:31:29.0640 1356 [ 11D42BB6206F33FBB3BA0288D3EF81BD ] MRxDAV C:\WINDOWS\system32\DRIVERS\mrxdav.sys 08:31:29.0765 1356 MRxDAV - ok 08:31:29.0984 1356 [ 7D304A5EB4344EBEEAB53A2FE3FFB9F0 ] MRxSmb C:\WINDOWS\system32\DRIVERS\mrxsmb.sys 08:31:30.0125 1356 MRxSmb - ok 08:31:30.0156 1356 [ A137F1470499A205ABBB9AAFB3B6F2B1 ] MSDTC C:\WINDOWS\system32\msdtc.exe 08:31:30.0203 1356 MSDTC - ok 08:31:30.0234 1356 [ C941EA2454BA8350021D774DAF0F1027 ] Msfs C:\WINDOWS\system32\drivers\Msfs.sys 08:31:30.0296 1356 Msfs - ok 08:31:30.0296 1356 MSIServer - ok 08:31:30.0343 1356 [ D1575E71568F4D9E14CA56B7B0453BF1 ] MSKSSRV C:\WINDOWS\system32\drivers\MSKSSRV.sys 08:31:30.0406 1356 MSKSSRV - ok 08:31:30.0421 1356 [ 325BB26842FC7CCC1FCCE2C457317F3E ] MSPCLOCK C:\WINDOWS\system32\drivers\MSPCLOCK.sys 08:31:30.0437 1356 MSPCLOCK - ok 08:31:30.0453 1356 [ BAD59648BA099DA4A17680B39730CB3D ] MSPQM C:\WINDOWS\system32\drivers\MSPQM.sys 08:31:30.0468 1356 MSPQM - ok 08:31:30.0500 1356 [ AF5F4F3F14A8EA2C26DE30F7A1E17136 ] mssmbios C:\WINDOWS\system32\DRIVERS\mssmbios.sys 08:31:30.0531 1356 mssmbios - ok 08:31:30.0578 1356 [ E53736A9E30C45FA9E7B5EAC55056D1D ] MSTEE C:\WINDOWS\system32\drivers\MSTEE.sys 08:31:30.0593 1356 MSTEE - ok 08:31:30.0656 1356 [ DE6A75F5C270E756C5508D94B6CF68F5 ] Mup C:\WINDOWS\system32\drivers\Mup.sys 08:31:30.0671 1356 Mup - ok 08:31:30.0765 1356 [ 5B50F1B2A2ED47D560577B221DA734DB ] NABTSFEC C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys 08:31:30.0843 1356 NABTSFEC - ok 08:31:30.0984 1356 [ 0102140028FAD045756796E1C685D695 ] napagent C:\WINDOWS\System32\qagentrt.dll 08:31:31.0109 1356 napagent - ok 08:31:31.0203 1356 [ 1DF7F42665C94B825322FAE71721130D ] NDIS C:\WINDOWS\system32\drivers\NDIS.sys 08:31:31.0312 1356 NDIS - ok 08:31:31.0343 1356 [ 7FF1F1FD8609C149AA432F95A8163D97 ] NdisIP C:\WINDOWS\system32\DRIVERS\NdisIP.sys 08:31:31.0421 1356 NdisIP - ok 08:31:31.0468 1356 [ 0109C4F3850DFBAB279542515386AE22 ] NdisTapi C:\WINDOWS\system32\DRIVERS\ndistapi.sys 08:31:31.0468 1356 NdisTapi - ok 08:31:31.0531 1356 [ F927A4434C5028758A842943EF1A3849 ] Ndisuio C:\WINDOWS\system32\DRIVERS\ndisuio.sys 08:31:31.0546 1356 Ndisuio - ok 08:31:31.0593 1356 [ EDC1531A49C80614B2CFDA43CA8659AB ] NdisWan C:\WINDOWS\system32\DRIVERS\ndiswan.sys 08:31:31.0625 1356 NdisWan - ok 08:31:31.0671 1356 [ 9282BD12DFB069D3889EB3FCC1000A9B ] NDProxy C:\WINDOWS\system32\drivers\NDProxy.sys 08:31:31.0671 1356 NDProxy - ok 08:31:31.0734 1356 [ 5D81CF9A2F1A3A756B66CF684911CDF0 ] NetBIOS C:\WINDOWS\system32\DRIVERS\netbios.sys 08:31:31.0765 1356 NetBIOS - ok 08:31:31.0828 1356 [ 74B2B2F5BEA5E9A3DC021D685551BD3D ] NetBT C:\WINDOWS\system32\DRIVERS\netbt.sys 08:31:31.0890 1356 NetBT - ok 08:31:31.0968 1356 [ B857BA82860D7FF85AE29B095645563B ] NetDDE C:\WINDOWS\system32\netdde.exe 08:31:32.0015 1356 NetDDE - ok 08:31:32.0062 1356 [ B857BA82860D7FF85AE29B095645563B ] NetDDEdsdm C:\WINDOWS\system32\netdde.exe 08:31:32.0062 1356 NetDDEdsdm - ok 08:31:32.0125 1356 [ BF2466B3E18E970D8A976FB95FC1CA85 ] Netlogon C:\WINDOWS\system32\lsass.exe 08:31:32.0125 1356 Netlogon - ok 08:31:32.0234 1356 [ 13E67B55B3ABD7BF3FE7AAE5A0F9A9DE ] Netman C:\WINDOWS\System32\netman.dll 08:31:32.0234 1356 Netman - ok 08:31:32.0328 1356 [ D34612C5D02D026535B3095D620626AE ] NetTcpPortSharing C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe 08:31:32.0390 1356 NetTcpPortSharing - ok 08:31:32.0437 1356 [ E9E47CFB2D461FA0FC75B7A74C6383EA ] NIC1394 C:\WINDOWS\system32\DRIVERS\nic1394.sys 08:31:32.0484 1356 NIC1394 - ok 08:31:32.0625 1356 [ 943337D786A56729263071623BBB9DE5 ] Nla C:\WINDOWS\System32\mswsock.dll 08:31:32.0703 1356 Nla - ok 08:31:32.0750 1356 [ 3182D64AE053D6FB034F44B6DEF8034A ] Npfs C:\WINDOWS\system32\drivers\Npfs.sys 08:31:32.0781 1356 Npfs - ok 08:31:33.0000 1356 [ 78A08DD6A8D65E697C18E1DB01C5CDCA ] Ntfs C:\WINDOWS\system32\drivers\Ntfs.sys 08:31:33.0218 1356 Ntfs - ok 08:31:33.0250 1356 [ BF2466B3E18E970D8A976FB95FC1CA85 ] NtLmSsp C:\WINDOWS\system32\lsass.exe 08:31:33.0250 1356 NtLmSsp - ok 08:31:33.0421 1356 [ 156F64A3345BD23C600655FB4D10BC08 ] NtmsSvc C:\WINDOWS\system32\ntmssvc.dll 08:31:33.0578 1356 NtmsSvc - ok 08:31:33.0609 1356 [ 73C1E1F395918BC2C6DD67AF7591A3AD ] Null C:\WINDOWS\system32\drivers\Null.sys 08:31:33.0625 1356 Null - ok 08:31:37.0328 1356 [ BCCCED4253057E51782EEE166D2CED3C ] nv C:\WINDOWS\system32\DRIVERS\nv4_mini.sys 08:31:41.0375 1356 nv - ok 08:31:41.0500 1356 [ D288CCC65509ED0293573A16AC23FA37 ] NVSvc C:\WINDOWS\system32\nvsvc32.exe 08:31:41.0500 1356 NVSvc - ok 08:31:41.0546 1356 [ B305F3FAD35083837EF46A0BBCE2FC57 ] NwlnkFlt C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys 08:31:41.0593 1356 NwlnkFlt - ok 08:31:41.0609 1356 [ C99B3415198D1AAB7227F2C88FD664B9 ] NwlnkFwd C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys 08:31:41.0640 1356 NwlnkFwd - ok 08:31:41.0687 1356 [ CA33832DF41AFB202EE7AEB05145922F ] ohci1394 C:\WINDOWS\system32\DRIVERS\ohci1394.sys 08:31:41.0734 1356 ohci1394 - ok 08:31:41.0812 1356 [ 5575FAF8F97CE5E713D108C2A58D7C7C ] Parport C:\WINDOWS\system32\DRIVERS\parport.sys 08:31:41.0890 1356 Parport - ok 08:31:41.0953 1356 [ BEB3BA25197665D82EC7065B724171C6 ] PartMgr C:\WINDOWS\system32\drivers\PartMgr.sys 08:31:42.0000 1356 PartMgr - ok 08:31:42.0031 1356 [ 70E98B3FD8E963A6A46A2E6247E0BEA1 ] ParVdm C:\WINDOWS\system32\drivers\ParVdm.sys 08:31:42.0093 1356 ParVdm - ok 08:31:42.0140 1356 [ 2F9806B52CB3748B1E49222744B28E3C ] PCANDIS5 C:\WINDOWS\system32\PCANDIS5.SYS 08:31:42.0203 1356 PCANDIS5 - ok 08:31:42.0265 1356 [ A219903CCF74233761D92BEF471A07B1 ] PCI C:\WINDOWS\system32\DRIVERS\pci.sys 08:31:42.0312 1356 PCI - ok 08:31:42.0328 1356 PCIDump - ok 08:31:42.0328 1356 [ CCF5F451BB1A5A2A522A76E670000FF0 ] PCIIde C:\WINDOWS\system32\DRIVERS\pciide.sys 08:31:42.0375 1356 PCIIde - ok 08:31:42.0453 1356 [ 9E89EF60E9EE05E3F2EEF2DA7397F1C1 ] Pcmcia C:\WINDOWS\system32\drivers\Pcmcia.sys 08:31:42.0484 1356 Pcmcia - ok 08:31:42.0500 1356 PDCOMP - ok 08:31:42.0500 1356 PDFRAME - ok 08:31:42.0515 1356 PDRELI - ok 08:31:42.0531 1356 PDRFRAME - ok 08:31:42.0531 1356 perc2 - ok 08:31:42.0546 1356 perc2hib - ok 08:31:42.0625 1356 [ 65DF52F5B8B6E9BBD183505225C37315 ] PlugPlay C:\WINDOWS\system32\services.exe 08:31:42.0625 1356 PlugPlay - ok 08:31:42.0703 1356 [ 9D84376931440F3679BEEF2A414FA493 ] Pml Driver HPZ12 C:\WINDOWS\system32\HPZipm12.exe 08:31:42.0703 1356 Pml Driver HPZ12 - ok 08:31:42.0734 1356 [ BF2466B3E18E970D8A976FB95FC1CA85 ] PolicyAgent C:\WINDOWS\system32\lsass.exe 08:31:42.0734 1356 PolicyAgent - ok 08:31:42.0796 1356 [ EFEEC01B1D3CF84F16DDD24D9D9D8F99 ] PptpMiniport C:\WINDOWS\system32\DRIVERS\raspptp.sys 08:31:42.0828 1356 PptpMiniport - ok 08:31:42.0843 1356 [ BF2466B3E18E970D8A976FB95FC1CA85 ] ProtectedStorage C:\WINDOWS\system32\lsass.exe 08:31:42.0843 1356 ProtectedStorage - ok 08:31:42.0890 1356 [ BFFDB363485501A38F0BCA83AEC810DB ] Ps2 C:\WINDOWS\system32\DRIVERS\PS2.sys 08:31:42.0937 1356 Ps2 - ok 08:31:42.0984 1356 [ 09298EC810B07E5D582CB3A3F9255424 ] PSched C:\WINDOWS\system32\DRIVERS\psched.sys 08:31:43.0000 1356 PSched - ok 08:31:43.0046 1356 [ 80D317BD1C3DBC5D4FE7B1678C60CADD ] Ptilink C:\WINDOWS\system32\DRIVERS\ptilink.sys 08:31:43.0062 1356 Ptilink - ok 08:31:43.0109 1356 [ 7C81AE3C9B82BA2DA437ED4D31BC56CF ] PxHelp20 C:\WINDOWS\system32\Drivers\PxHelp20.sys 08:31:43.0125 1356 PxHelp20 - ok 08:31:43.0125 1356 ql1080 - ok 08:31:43.0140 1356 Ql10wnt - ok 08:31:43.0171 1356 ql12160 - ok 08:31:43.0187 1356 ql1240 - ok 08:31:43.0187 1356 ql1280 - ok 08:31:43.0218 1356 [ FE0D99D6F31E4FAD8159F690D68DED9C ] RasAcd C:\WINDOWS\system32\DRIVERS\rasacd.sys 08:31:43.0250 1356 RasAcd - ok 08:31:43.0296 1356 [ AD188BE7BDF94E8DF4CA0A55C00A5073 ] RasAuto C:\WINDOWS\System32\rasauto.dll 08:31:43.0343 1356 RasAuto - ok 08:31:43.0390 1356 [ 11B4A627BC9614B885C4969BFA5FF8A6 ] Rasl2tp C:\WINDOWS\system32\DRIVERS\rasl2tp.sys 08:31:43.0421 1356 Rasl2tp - ok 08:31:43.0546 1356 [ 76A9A3CBEADD68CC57CDA5E1D7448235 ] RasMan C:\WINDOWS\System32\rasmans.dll 08:31:43.0562 1356 RasMan - ok 08:31:43.0578 1356 [ 5BC962F2654137C9909C3D4603587DEE ] RasPppoe C:\WINDOWS\system32\DRIVERS\raspppoe.sys 08:31:43.0593 1356 RasPppoe - ok 08:31:43.0625 1356 [ FDBB1D60066FCFBB7452FD8F9829B242 ] Raspti C:\WINDOWS\system32\DRIVERS\raspti.sys 08:31:43.0640 1356 Raspti - ok 08:31:43.0765 1356 [ 7AD224AD1A1437FE28D89CF22B17780A ] Rdbss C:\WINDOWS\system32\DRIVERS\rdbss.sys 08:31:43.0843 1356 Rdbss - ok 08:31:43.0875 1356 [ 4912D5B403614CE99C28420F75353332 ] RDPCDD C:\WINDOWS\system32\DRIVERS\RDPCDD.sys 08:31:43.0890 1356 RDPCDD - ok 08:31:44.0000 1356 [ 43AF5212BD8FB5BA6EED9754358BD8F7 ] RDPWD C:\WINDOWS\system32\drivers\RDPWD.sys 08:31:44.0046 1356 RDPWD - ok 08:31:44.0125 1356 [ 3C37BF86641BDA977C3BF8A840F3B7FA ] RDSessMgr C:\WINDOWS\system32\sessmgr.exe 08:31:44.0187 1356 RDSessMgr - ok 08:31:44.0234 1356 [ F828DD7E1419B6653894A8F97A0094C5 ] redbook C:\WINDOWS\system32\DRIVERS\redbook.sys 08:31:44.0281 1356 redbook - ok 08:31:44.0343 1356 [ 7E699FF5F59B5D9DE5390E3C34C67CF5 ] RemoteAccess C:\WINDOWS\System32\mprdim.dll 08:31:44.0359 1356 RemoteAccess - ok 08:31:44.0421 1356 [ AAED593F84AFA419BBAE8572AF87CF6A ] RpcLocator C:\WINDOWS\system32\locator.exe 08:31:44.0468 1356 RpcLocator - ok 08:31:44.0671 1356 [ 6B27A5C03DFB94B4245739065431322C ] RpcSs C:\WINDOWS\System32\rpcss.dll 08:31:44.0671 1356 RpcSs - ok 08:31:44.0750 1356 [ 471B3F9741D762ABE75E9DEEA4787E47 ] RSVP C:\WINDOWS\system32\rsvp.exe 08:31:44.0812 1356 RSVP - ok 08:31:44.0921 1356 [ CF84B1F0E8B14D4120AAF9CF35CBB265 ] RTL8023xp C:\WINDOWS\system32\DRIVERS\Rtnicxp.sys 08:31:45.0015 1356 RTL8023xp - ok 08:31:45.0031 1356 [ D507C1400284176573224903819FFDA3 ] rtl8139 C:\WINDOWS\system32\DRIVERS\RTL8139.SYS 08:31:45.0046 1356 rtl8139 - ok 08:31:45.0093 1356 [ BF2466B3E18E970D8A976FB95FC1CA85 ] SamSs C:\WINDOWS\system32\lsass.exe 08:31:45.0109 1356 SamSs - ok 08:31:45.0171 1356 [ 86D007E7A654B9A71D1D7D856B104353 ] SCardSvr C:\WINDOWS\System32\SCardSvr.exe 08:31:45.0218 1356 SCardSvr - ok 08:31:45.0343 1356 [ 0A9A7365A1CA4319AA7C1D6CD8E4EAFA ] Schedule C:\WINDOWS\system32\schedsvc.dll 08:31:45.0359 1356 Schedule - ok 08:31:45.0390 1356 [ 90A3935D05B494A5A39D37E71F09A677 ] Secdrv C:\WINDOWS\system32\DRIVERS\secdrv.sys 08:31:45.0390 1356 Secdrv - ok 08:31:45.0437 1356 [ CBE612E2BB6A10E3563336191EDA1250 ] seclogon C:\WINDOWS\System32\seclogon.dll 08:31:45.0437 1356 seclogon - ok 08:31:45.0468 1356 [ 7FDD5D0684ECA8C1F68B4D99D124DCD0 ] SENS C:\WINDOWS\system32\sens.dll 08:31:45.0468 1356 SENS - ok 08:31:45.0515 1356 [ 0F29512CCD6BEAD730039FB4BD2C85CE ] serenum C:\WINDOWS\system32\DRIVERS\serenum.sys 08:31:45.0515 1356 serenum - ok 08:31:45.0578 1356 [ CCA207A8896D4C6A0C9CE29A4AE411A7 ] Serial C:\WINDOWS\system32\DRIVERS\serial.sys 08:31:45.0625 1356 Serial - ok 08:31:45.0671 1356 [ 8E6B8C671615D126FDC553D1E2DE5562 ] Sfloppy C:\WINDOWS\system32\drivers\Sfloppy.sys 08:31:45.0687 1356 Sfloppy - ok 08:31:45.0843 1356 [ 83F41D0D89645D7235C051AB1D9523AC ] SharedAccess C:\WINDOWS\System32\ipnathlp.dll 08:31:45.0859 1356 SharedAccess - ok 08:31:45.0953 1356 [ 99BC0B50F511924348BE19C7C7313BBF ] ShellHWDetection C:\WINDOWS\System32\shsvcs.dll 08:31:45.0953 1356 ShellHWDetection - ok 08:31:45.0968 1356 Simbad - ok 08:31:46.0000 1356 [ 866D538EBE33709A5C9F5C62B73B7D14 ] SLIP C:\WINDOWS\system32\DRIVERS\SLIP.sys 08:31:46.0000 1356 SLIP - ok 08:31:46.0015 1356 Sparrow - ok 08:31:46.0046 1356 [ AB8B92451ECB048A4D1DE7C3FFCB4A9F ] splitter C:\WINDOWS\system32\drivers\splitter.sys 08:31:46.0062 1356 splitter - ok 08:31:46.0109 1356 [ 60784F891563FB1B767F70117FC2428F ] Spooler C:\WINDOWS\system32\spoolsv.exe 08:31:46.0109 1356 Spooler - ok 08:31:46.0171 1356 [ 76BB022C2FB6902FD5BDD4F78FC13A5D ] sr C:\WINDOWS\system32\DRIVERS\sr.sys 08:31:46.0234 1356 sr - ok 08:31:46.0343 1356 [ 3805DF0AC4296A34BA4BF93B346CC378 ] srservice C:\WINDOWS\system32\srsvc.dll 08:31:46.0343 1356 srservice - ok 08:31:46.0484 1356 [ 47DDFC2F003F7F9F0592C6874962A2E7 ] Srv C:\WINDOWS\system32\DRIVERS\srv.sys 08:31:46.0593 1356 Srv - ok 08:31:46.0640 1356 [ 0A5679B3714EDAB99E357057EE88FCA6 ] SSDPSRV C:\WINDOWS\System32\ssdpsrv.dll 08:31:46.0656 1356 SSDPSRV - ok 08:31:46.0671 1356 SSPORT - ok 08:31:46.0859 1356 [ 8BAD69CBAC032D4BBACFCE0306174C30 ] stisvc C:\WINDOWS\system32\wiaservc.dll 08:31:46.0906 1356 stisvc - ok 08:31:46.0953 1356 [ 77813007BA6265C4B6098187E6ED79D2 ] streamip C:\WINDOWS\system32\DRIVERS\StreamIP.sys 08:31:47.0046 1356 streamip - ok 08:31:47.0078 1356 [ 3941D127AEF12E93ADDF6FE6EE027E0F ] swenum C:\WINDOWS\system32\DRIVERS\swenum.sys 08:31:47.0140 1356 swenum - ok 08:31:47.0171 1356 [ 8CE882BCC6CF8A62F2B2323D95CB3D01 ] swmidi C:\WINDOWS\system32\drivers\swmidi.sys 08:31:47.0265 1356 swmidi - ok 08:31:47.0265 1356 SwPrv - ok 08:31:47.0296 1356 symc810 - ok 08:31:47.0312 1356 symc8xx - ok 08:31:47.0359 1356 sym_hi - ok 08:31:47.0359 1356 sym_u3 - ok 08:31:47.0406 1356 [ 8B83F3ED0F1688B4958F77CD6D2BF290 ] sysaudio C:\WINDOWS\system32\drivers\sysaudio.sys 08:31:47.0500 1356 sysaudio - ok 08:31:47.0562 1356 [ C7ABBC59B43274B1109DF6B24D617051 ] SysmonLog C:\WINDOWS\system32\smlogsvc.exe 08:31:47.0625 1356 SysmonLog - ok 08:31:47.0718 1356 [ 3CB78C17BB664637787C9A1C98F79C38 ] TapiSrv C:\WINDOWS\System32\tapisrv.dll 08:31:47.0843 1356 TapiSrv - ok 08:31:48.0031 1356 [ 9AEFA14BD6B182D61E3119FA5F436D3D ] Tcpip C:\WINDOWS\system32\DRIVERS\tcpip.sys 08:31:48.0156 1356 Tcpip - ok 08:31:48.0187 1356 [ 6471A66807F5E104E4885F5B67349397 ] TDPIPE C:\WINDOWS\system32\drivers\TDPIPE.sys 08:31:48.0250 1356 TDPIPE - ok 08:31:48.0265 1356 [ C56B6D0402371CF3700EB322EF3AAF61 ] TDTCP C:\WINDOWS\system32\drivers\TDTCP.sys 08:31:48.0328 1356 TDTCP - ok 08:31:48.0406 1356 [ 88155247177638048422893737429D9E ] TermDD C:\WINDOWS\system32\DRIVERS\termdd.sys 08:31:48.0437 1356 TermDD - ok 08:31:48.0609 1356 [ FF3477C03BE7201C294C35F684B3479F ] TermService C:\WINDOWS\System32\termsrv.dll 08:31:48.0640 1356 TermService - ok 08:31:48.0718 1356 [ 99BC0B50F511924348BE19C7C7313BBF ] Themes C:\WINDOWS\System32\shsvcs.dll 08:31:48.0734 1356 Themes - ok 08:31:48.0875 1356 [ 3199A477F0F06EEDE41BD55179F8EB05 ] TomTomHOMEService C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe 08:31:48.0875 1356 TomTomHOMEService - ok 08:31:48.0890 1356 TosIde - ok 08:31:48.0984 1356 [ 55BCA12F7F523D35CA3CB833C725F54E ] TrkWks C:\WINDOWS\system32\trkwks.dll 08:31:49.0000 1356 TrkWks - ok 08:31:49.0093 1356 [ 5787B80C2E3C5E2F56C2A233D91FA2C9 ] Udfs C:\WINDOWS\system32\drivers\Udfs.sys 08:31:49.0187 1356 Udfs - ok 08:31:49.0218 1356 ultra - ok 08:31:49.0421 1356 [ 402DDC88356B1BAC0EE3DD1580C76A31 ] Update C:\WINDOWS\system32\DRIVERS\update.sys 08:31:49.0593 1356 Update - ok 08:31:49.0687 1356 [ 1EBAFEB9A3FBDC41B8D9C7F0F687AD91 ] upnphost C:\WINDOWS\System32\upnphost.dll 08:31:49.0765 1356 upnphost - ok 08:31:49.0796 1356 [ 05365FB38FCA1E98F7A566AAAF5D1815 ] UPS C:\WINDOWS\System32\ups.exe 08:31:49.0812 1356 UPS - ok 08:31:49.0859 1356 [ 173F317CE0DB8E21322E71B7E60A27E8 ] usbccgp C:\WINDOWS\system32\DRIVERS\usbccgp.sys 08:31:49.0890 1356 usbccgp - ok 08:31:49.0937 1356 [ 65DCF09D0E37D4C6B11B5B0B76D470A7 ] usbehci C:\WINDOWS\system32\DRIVERS\usbehci.sys 08:31:49.0968 1356 usbehci - ok 08:31:50.0015 1356 [ 1AB3CDDE553B6E064D2E754EFE20285C ] usbhub C:\WINDOWS\system32\DRIVERS\usbhub.sys 08:31:50.0062 1356 usbhub - ok 08:31:50.0093 1356 [ A717C8721046828520C9EDF31288FC00 ] usbprint C:\WINDOWS\system32\DRIVERS\usbprint.sys 08:31:50.0109 1356 usbprint - ok 08:31:50.0156 1356 [ A0B8CF9DEB1184FBDD20784A58FA75D4 ] usbscan C:\WINDOWS\system32\DRIVERS\usbscan.sys 08:31:50.0218 1356 usbscan - ok 08:31:50.0343 1356 [ A32426D9B14A089EAA1D922E0C5801A9 ] usbstor C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS 08:31:50.0421 1356 usbstor - ok 08:31:50.0453 1356 [ 26496F9DEE2D787FC3E61AD54821FFE6 ] usbuhci C:\WINDOWS\system32\DRIVERS\usbuhci.sys 08:31:50.0484 1356 usbuhci - ok 08:31:50.0500 1356 [ 0D3A8FAFCEACD8B7625CD549757A7DF1 ] VgaSave C:\WINDOWS\System32\drivers\vga.sys 08:31:50.0515 1356 VgaSave - ok 08:31:50.0531 1356 [ 3B3EFCDA263B8AC14FDF9CBDD0791B2E ] ViaIde C:\WINDOWS\system32\DRIVERS\viaide.sys 08:31:50.0531 1356 ViaIde - ok 08:31:50.0546 1356 VMnetAdapter - ok 08:31:50.0750 1356 [ 4C8FCB5CC53AAB716D810740FE59D025 ] VolSnap C:\WINDOWS\system32\drivers\VolSnap.sys 08:31:50.0781 1356 VolSnap - ok 08:31:50.0781 1356 vsdatant - ok 08:31:50.0937 1356 [ 7A9DB3A67C333BF0BD42E42B8596854B ] VSS C:\WINDOWS\System32\vssvc.exe 08:31:51.0031 1356 VSS - ok 08:31:51.0421 1356 [ 50D3941555FEFDF46424431702EC5FB6 ] vToolbarUpdater14.0.1 C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\14.0.1\ToolbarUpdater.exe 08:31:51.0625 1356 vToolbarUpdater14.0.1 - ok 08:31:51.0718 1356 [ 54AF4B1D5459500EF0937F6D33B1914F ] W32Time C:\WINDOWS\system32\w32time.dll 08:31:51.0734 1356 W32Time - ok 08:31:51.0796 1356 [ E20B95BAEDB550F32DD489265C1DA1F6 ] Wanarp C:\WINDOWS\system32\DRIVERS\wanarp.sys 08:31:51.0796 1356 Wanarp - ok 08:31:51.0812 1356 WDICA - ok 08:31:51.0859 1356 [ 6768ACF64B18196494413695F0C3A00F ] wdmaud C:\WINDOWS\system32\drivers\wdmaud.sys 08:31:51.0890 1356 wdmaud - ok 08:31:51.0953 1356 [ 77A354E28153AD2D5E120A5A8687BC06 ] WebClient C:\WINDOWS\System32\webclnt.dll 08:31:51.0953 1356 WebClient - ok 08:31:52.0078 1356 [ F45DD1E1365D857DD08BC23563370D0E ] WinDefend C:\Program Files\Windows Defender\MsMpEng.exe 08:31:52.0078 1356 WinDefend - ok 08:31:52.0281 1356 [ 2D0E4ED081963804CCC196A0929275B5 ] winmgmt C:\WINDOWS\system32\wbem\WMIsvc.dll 08:31:52.0296 1356 winmgmt - ok 08:31:52.0687 1356 [ 18F347402DA544A780949B8FDF83351B ] WinRM C:\WINDOWS\system32\WsmSvc.dll 08:31:53.0062 1356 WinRM - ok 08:31:53.0125 1356 [ C51B4A5C05A5475708E3C81C7765B71D ] WmdmPmSN C:\WINDOWS\system32\MsPMSNSv.dll 08:31:53.0140 1356 WmdmPmSN - ok 08:31:53.0218 1356 [ E0673F1106E62A68D2257E376079F821 ] WmiApSrv C:\WINDOWS\system32\wbem\wmiapsrv.exe 08:31:53.0265 1356 WmiApSrv - ok 08:31:53.0609 1356 [ F74E3D9A7FA9556C3BBB14D4E5E63D3B ] WMPNetworkSvc C:\Program Files\Windows Media Player\WMPNetwk.exe 08:31:53.0953 1356 WMPNetworkSvc - ok 08:31:54.0031 1356 [ 6ABE6E225ADB5A751622A9CC3BC19CE8 ] WS2IFSL C:\WINDOWS\System32\drivers\ws2ifsl.sys 08:31:54.0078 1356 WS2IFSL - ok 08:31:54.0171 1356 [ 7C278E6408D1DCE642230C0585A854D5 ] wscsvc C:\WINDOWS\system32\wscsvc.dll 08:31:54.0171 1356 wscsvc - ok 08:31:54.0265 1356 [ C98B39829C2BBD34E454150633C62C78 ] WSTCODEC C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS 08:31:54.0312 1356 WSTCODEC - ok 08:31:54.0359 1356 [ 35321FB577CDC98CE3EB3A3EB9E4610A ] wuauserv C:\WINDOWS\system32\wuauserv.dll 08:31:54.0359 1356 wuauserv - ok 08:31:54.0421 1356 [ F15FEAFFFBB3644CCC80C5DA584E6311 ] WudfPf C:\WINDOWS\system32\DRIVERS\WudfPf.sys 08:31:54.0562 1356 WudfPf - ok 08:31:54.0625 1356 [ 28B524262BCE6DE1F7EF9F510BA3985B ] WudfRd C:\WINDOWS\system32\DRIVERS\wudfrd.sys 08:31:54.0734 1356 WudfRd - ok 08:31:54.0765 1356 [ 05231C04253C5BC30B26CBAAE680ED89 ] WudfSvc C:\WINDOWS\System32\WUDFSvc.dll 08:31:54.0859 1356 WudfSvc - ok 08:31:55.0046 1356 [ 81DC3F549F44B1C1FFF022DEC9ECF30B ] WZCSVC C:\WINDOWS\System32\wzcsvc.dll 08:31:55.0062 1356 WZCSVC - ok 08:31:55.0140 1356 [ 295D21F14C335B53CB8154E5B1F892B9 ] xmlprov C:\WINDOWS\System32\xmlprov.dll 08:31:55.0203 1356 xmlprov - ok 08:31:55.0265 1356 ================ Scan global =============================== 08:31:55.0312 1356 [ 42F1F4C0AFB08410E5F02D4B13EBB623 ] C:\WINDOWS\system32\basesrv.dll 08:31:55.0421 1356 [ 8C7DCA4B158BF16894120786A7A5F366 ] C:\WINDOWS\system32\winsrv.dll 08:31:55.0578 1356 [ 8C7DCA4B158BF16894120786A7A5F366 ] C:\WINDOWS\system32\winsrv.dll 08:31:55.0656 1356 [ 65DF52F5B8B6E9BBD183505225C37315 ] C:\WINDOWS\system32\services.exe 08:31:55.0656 1356 [Global] - ok 08:31:55.0671 1356 ================ Scan MBR ================================== 08:31:55.0703 1356 [ 0AC6D996BCE152AED9600E6D6B797E2E ] \Device\Harddisk0\DR0 08:31:56.0312 1356 \Device\Harddisk0\DR0 - ok 08:31:56.0312 1356 ================ Scan VBR ================================== 08:31:56.0328 1356 [ AE05D80D53CADF32BC89BD8E275E4776 ] \Device\Harddisk0\DR0\Partition1 08:31:56.0328 1356 \Device\Harddisk0\DR0\Partition1 - ok 08:31:56.0343 1356 [ B80F0A7F7E764E6F529B6380E4C9CDD1 ] \Device\Harddisk0\DR0\Partition2 08:31:56.0343 1356 \Device\Harddisk0\DR0\Partition2 - ok 08:31:56.0343 1356 ============================================================ 08:31:56.0343 1356 Scan finished 08:31:56.0343 1356 ============================================================ 08:31:56.0359 1360 Detected object count: 0 08:31:56.0359 1360 Actual detected object count: 0
Post #21
Just as a quick aside. As I believe this was caused by using a USB disk from a friend, is there any recommended method/tool to scan USB disks. I did scan it with Symantec 11.0.7 using a separate laptop and nothing was reported although I realise that not all av/spyware products are 100% I then naively copied the files onto my desktop without using AVG to perform another scan. I expect that even if I had kept teh files on teh USB and not copied them I would still be having the same issues, ie once invoked/accessed they would infect my desktpp. Having followed some of the cleanup steps so far, I notice that many of the tools do not appear to offer the ability to scan other drives ?
Post #22
I don't know of any specific tools tool to scan USB disks. but this stops programs from running automatically, just run and follow its instructions http://download.bleepingcomputer.com//sUBs…Disinfector.exe




Delete the combofix you have on desktop and download a fresh one from below,

Link 1
Link 2



COMBOFIX-Script

  • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below: 

    File:: 
C:\RECYCLER\S-1-5-21-3882495902-1733513528-3747878165-1008 
C:\RECYCLER\S-1-5-21-3882495902-1733513528-3747878165-1009
  • Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

    [external image: Posted Image]
  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • If you need help to disable your protection programs see here.
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.
CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
Post #23
Have two logs for you.
When I tried to drag the file logged in as a restricted user I found I couldnt use runas, so I though I could use runas and then drag,. But this kicked off combofix and so I let it run through and complete, 1st log details below
I then logged in as the admin and ran again, with the 2nd log below.

RUN1 - no cfscript
Note I got a C++ error dialog reported lsburnwatcher ? I have a screenshot if required
Also a dialog about the printspooler not running

ComboFix 13-02-07.01 - HP_Owner 07/02/2013 18:50:10.3.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.44.1033.18.3071.2581 [GMT 0:00]
Running from: c:\documents and settings\[removed]\Desktop\WhatThetech etc\ComboFix.exe
AV: AVG Anti-Virus Free Edition 2013 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\EventSystem.log
c:\windows\iun6002.exe
.
.
((((((((((((((((((((((((( Files Created from 2013-01-07 to 2013-02-07 )))))))))))))))))))))))))))))))
.
.
2013-02-06 07:34 . 2013-02-06 07:34 ——– d—–w- C:\_OTL
2013-01-31 20:35 . 2013-01-31 20:35 ——– d—–w- c:\program files\Trend Micro
2013-01-12 16:24 . 2013-01-12 16:24 ——– d—–w- c:\documents and settings\HP_Owner\Local Settings\Application Data\Temp
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-01-25 08:42 . 2012-09-05 04:46 31576 —-a-w- c:\windows\system32\drivers\avgtpx86.sys
2013-01-12 18:12 . 2012-04-01 09:39 697864 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2013-01-12 18:12 . 2011-07-02 13:26 74248 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-12-16 12:23 . 2004-08-04 12:00 290560 —-a-w- c:\windows\system32\atmfd.dll
2012-12-14 16:49 . 2010-05-19 18:25 21104 —-a-w- c:\windows\system32\drivers\mbam.sys
2012-11-15 23:33 . 2010-09-07 03:48 94048 —-a-w- c:\windows\system32\drivers\avgmfx86.sys
2012-11-13 01:25 . 2004-08-04 12:00 1866368 —-a-w- c:\windows\system32\win32k.sys
2006-11-08 16:28 . 2006-11-08 16:28 278528 —-a-w- c:\program files\Common Files\FDEUnInstaller.exe
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}]
2013-01-25 08:42 1883824 —-a-w- c:\program files\AVG Secure Search\14.0.2.14\AVG Secure Search_toolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{95B7759C-8C7F-4BF1-B163-73684A933233}"= "c:\program files\AVG Secure Search\14.0.2.14\AVG Secure Search_toolbar.dll" [2013-01-25 1883824]
.
[HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}]
[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj.1]
[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-10-19 68856]
"TomTomHOME.exe"="c:\program files\TomTom HOME 2\TomTomHOMERunner.exe" [2012-01-23 247728]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 204288]
"ROC_JAN2013_TB"="c:\program files\AVG Secure Search\ROC_JAN2013_TB.exe" [2013-01-25 1177168]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]
"High Definition Audio Property Page Shortcut"="HDAudPropShortcut.exe" [2004-03-17 61952]
"AGRSMMSG"="AGRSMMSG.exe" [2004-06-29 88363]
"HPHUPD06"="c:\program files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe" [2004-06-07 49152]
"HPHmon06"="c:\windows\system32\hphmon06.exe" [2004-06-07 659456]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2004-04-14 233472]
"PS2"="c:\windows\system32\ps2.exe" [2004-10-25 90112]
"LSBWatcher"="c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe" [2004-10-14 253952]
"SoundMan"="SOUNDMAN.EXE" [2005-09-21 86016]
"AlcWzrd"="ALCWZRD.EXE" [2005-09-21 2807808]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2010-03-24 2516296]
"IJNetworkScanUtility"="c:\program files\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe" [2010-03-02 140640]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-07-29 110696]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-07-29 13923432]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-11-29 421888]
"vProt"="c:\program files\AVG Secure Search\vprot.exe" [2013-01-25 1101488]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352]
"AVG_UI"="c:\program files\AVG\AVG2013\avgui.exe" [2012-12-11 3147384]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-5 258048]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG2013\avgrsx.exe /sync /restart
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\AVG\\AVG2013\\avgmfapx.exe"=
"c:\\Program Files\\AVG\\AVG2013\\avgnsx.exe"=
"c:\\Program Files\\AVG\\AVG2013\\avgdiagex.exe"=
"c:\\Program Files\\AVG\\AVG2013\\avgemcx.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management
.
R0 AVGIDSHX;AVGIDSHX;c:\windows\system32\drivers\avgidshx.sys [17/09/2012 17:58 55776]
R0 Avglogx;AVG Logging Driver;c:\windows\system32\drivers\avglogx.sys [09/08/2012 12:56 177376]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [07/09/2010 03:48 35552]
R1 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\avgidsdriverx.sys [13/08/2012 15:40 179936]
R1 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\avgidsshimx.sys [10/08/2012 03:52 19936]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [07/09/2010 03:48 159712]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [07/09/2010 03:49 164832]
R1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx86.sys [05/09/2012 04:46 31576]
R2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2013\avgwdsvc.exe [22/10/2012 13:05 196664]
R2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [23/01/2012 04:43 92592]
R2 vToolbarUpdater14.0.1;vToolbarUpdater14.0.1;c:\program files\Common Files\AVG Secure Search\vToolbarUpdater\14.0.1\ToolbarUpdater.exe [25/01/2013 08:44 945328]
S2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2013\avgidsagent.exe [15/11/2012 23:34 5814904]
S2 SSPORT;SSPORT;\??\c:\windows\system32\Drivers\SSPORT.sys –> c:\windows\system32\Drivers\SSPORT.sys [?]
S2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [03/11/2006 18:19 13592]
S3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\AVG\AVG10\Toolbar\ToolbarBroker.exe –> c:\program files\AVG\AVG10\Toolbar\ToolbarBroker.exe [?]
S3 BDA_Capture_225;USB Digital-TV receiver Driver 2.0.1.8;c:\windows\system32\drivers\BDA_Capture_225.sys [29/09/2007 10:08 14592]
S3 BDA_Loader_225;USB Digital-TV Receiver Firmware Loader 6.5.8.0;c:\windows\system32\drivers\BDA_Loader_225.sys [29/09/2007 10:07 18944]
.
Contents of the 'Scheduled Tasks' folder
.
2013-02-07 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-01 18:12]
.
2006-08-18 c:\windows\Tasks\Easy Internet Sign-up.job
- c:\program files\Easy Internet signup\HPSdpApp.exe [2005-03-03 18:04]
.
2013-02-07 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-06 16:19]
.
2013-02-07 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-06 16:19]
.
2013-02-04 c:\windows\Tasks\ROC_JAN2013_TB_HP_Owner.job
- c:\program files\AVG Secure Search\ROC_JAN2013_TB.exe [2013-01-25 08:42]
.
2013-02-07 c:\windows\Tasks\ROC_JAN2013_TB_rmv.job
- c:\program files\AVG Secure Search\PostInstall\ROC.exe [2013-01-25 08:42]
.
.
——- Supplementary Scan ——-
.
uStart Page = about:blank
uInternet Settings,ProxyOverride =
TCP: DhcpNameServer = 192.168.1.1
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\Common Files\AVG Secure Search\ViProtocolInstaller\14.0.1\ViProtocol.dll
DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} - hxxp://download.zonelabs.com/bin/promotions/spywaredetector/ICSScanner37960.cab
FF - ProfilePath - c:\documents and settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\70vjyhhd.default\
FF - prefs.js: browser.startup.homepage - about:blank
FF - prefs.js: keyword.URL - hxxps://isearch.avg.com/search?cid={FD17001D-3658-474A-A7D0-BC71EC5BD71E}∣=3f05b4dc341d47d6b99ed1191024e9fb-003760f4d9065511168fea5cf168a4a58301e9c1⟨=us&ds;=AVG≺=fr&d;=2011-12-08 10:23&v;=12.2.5.32&sap;=ku&q;=
.
- - - - ORPHANS REMOVED - - - -
.
AddRemove-Cool's_Codec_pack_4.12 - c:\windows\iun6002.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-02-07 19:01
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_5_502_146_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_5_502_146_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
Completion time: 2013-02-07 19:04:56
ComboFix-quarantined-files.txt 2013-02-07 19:04
ComboFix2.txt 2013-02-03 15:41
.
Pre-Run: 115,982,082,048 bytes free
Post-Run: 115,996,209,152 bytes free
.
- - End Of File - - 504681DDCD6961B2B1C1B36DB7CF9F66



RUN2 - with cfscript
Also got the printspooler dialog


ComboFix 13-02-07.01 - HP_Owner 07/02/2013 19:38:16.4.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.44.1033.18.3071.2533 [GMT 0:00]
Running from: c:\documents and settings\[removed]\Desktop\WhatThetech etc\ComboFix.exe
Command switches used :: c:\documents and settings\Martin\Desktop\WhatThetech etc\cfscript.txt
AV: AVG Anti-Virus Free Edition 2013 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
FILE ::
"c:\recycler\S-1-5-21-3882495902-1733513528-3747878165-1008"
"c:\recycler\S-1-5-21-3882495902-1733513528-3747878165-1009"
.
.
((((((((((((((((((((((((( Files Created from 2013-01-07 to 2013-02-07 )))))))))))))))))))))))))))))))
.
.
2013-02-06 07:34 . 2013-02-06 07:34 ——– d—–w- C:\_OTL
2013-01-31 20:35 . 2013-01-31 20:35 ——– d—–w- c:\program files\Trend Micro
2013-01-12 16:24 . 2013-01-12 16:24 ——– d—–w- c:\documents and settings\HP_Owner\Local Settings\Application Data\Temp
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-01-25 08:42 . 2012-09-05 04:46 31576 —-a-w- c:\windows\system32\drivers\avgtpx86.sys
2013-01-12 18:12 . 2012-04-01 09:39 697864 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2013-01-12 18:12 . 2011-07-02 13:26 74248 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-12-16 12:23 . 2004-08-04 12:00 290560 —-a-w- c:\windows\system32\atmfd.dll
2012-12-14 16:49 . 2010-05-19 18:25 21104 —-a-w- c:\windows\system32\drivers\mbam.sys
2012-11-15 23:33 . 2010-09-07 03:48 94048 —-a-w- c:\windows\system32\drivers\avgmfx86.sys
2012-11-13 01:25 . 2004-08-04 12:00 1866368 —-a-w- c:\windows\system32\win32k.sys
2006-11-08 16:28 . 2006-11-08 16:28 278528 —-a-w- c:\program files\Common Files\FDEUnInstaller.exe
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}]
2013-01-25 08:42 1883824 —-a-w- c:\program files\AVG Secure Search\14.0.2.14\AVG Secure Search_toolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{95B7759C-8C7F-4BF1-B163-73684A933233}"= "c:\program files\AVG Secure Search\14.0.2.14\AVG Secure Search_toolbar.dll" [2013-01-25 1883824]
.
[HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}]
[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj.1]
[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-10-19 68856]
"TomTomHOME.exe"="c:\program files\TomTom HOME 2\TomTomHOMERunner.exe" [2012-01-23 247728]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 204288]
"ROC_JAN2013_TB"="c:\program files\AVG Secure Search\ROC_JAN2013_TB.exe" [2013-01-25 1177168]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]
"High Definition Audio Property Page Shortcut"="HDAudPropShortcut.exe" [2004-03-17 61952]
"AGRSMMSG"="AGRSMMSG.exe" [2004-06-29 88363]
"HPHUPD06"="c:\program files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe" [2004-06-07 49152]
"HPHmon06"="c:\windows\system32\hphmon06.exe" [2004-06-07 659456]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2004-04-14 233472]
"PS2"="c:\windows\system32\ps2.exe" [2004-10-25 90112]
"LSBWatcher"="c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe" [2004-10-14 253952]
"SoundMan"="SOUNDMAN.EXE" [2005-09-21 86016]
"AlcWzrd"="ALCWZRD.EXE" [2005-09-21 2807808]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2010-03-24 2516296]
"IJNetworkScanUtility"="c:\program files\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe" [2010-03-02 140640]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-07-29 110696]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-07-29 13923432]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-11-29 421888]
"vProt"="c:\program files\AVG Secure Search\vprot.exe" [2013-01-25 1101488]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352]
"AVG_UI"="c:\program files\AVG\AVG2013\avgui.exe" [2012-12-11 3147384]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-5 258048]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG2013\avgrsx.exe /sync /restart
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\AVG\\AVG2013\\avgmfapx.exe"=
"c:\\Program Files\\AVG\\AVG2013\\avgnsx.exe"=
"c:\\Program Files\\AVG\\AVG2013\\avgdiagex.exe"=
"c:\\Program Files\\AVG\\AVG2013\\avgemcx.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management
.
R0 AVGIDSHX;AVGIDSHX;c:\windows\system32\drivers\avgidshx.sys [17/09/2012 17:58 55776]
R0 Avglogx;AVG Logging Driver;c:\windows\system32\drivers\avglogx.sys [09/08/2012 12:56 177376]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [07/09/2010 03:48 35552]
R1 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\avgidsdriverx.sys [13/08/2012 15:40 179936]
R1 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\avgidsshimx.sys [10/08/2012 03:52 19936]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [07/09/2010 03:48 159712]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [07/09/2010 03:49 164832]
R1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx86.sys [05/09/2012 04:46 31576]
R2 avgwd;AVG WatchDog;c:\program files\AVG\AVG2013\avgwdsvc.exe [22/10/2012 13:05 196664]
R2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [23/01/2012 04:43 92592]
R2 vToolbarUpdater14.0.1;vToolbarUpdater14.0.1;c:\program files\Common Files\AVG Secure Search\vToolbarUpdater\14.0.1\ToolbarUpdater.exe [25/01/2013 08:44 945328]
S2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG2013\avgidsagent.exe [15/11/2012 23:34 5814904]
S2 SSPORT;SSPORT;\??\c:\windows\system32\Drivers\SSPORT.sys –> c:\windows\system32\Drivers\SSPORT.sys [?]
S2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [03/11/2006 18:19 13592]
S3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\AVG\AVG10\Toolbar\ToolbarBroker.exe –> c:\program files\AVG\AVG10\Toolbar\ToolbarBroker.exe [?]
S3 BDA_Capture_225;USB Digital-TV receiver Driver 2.0.1.8;c:\windows\system32\drivers\BDA_Capture_225.sys [29/09/2007 10:08 14592]
S3 BDA_Loader_225;USB Digital-TV Receiver Firmware Loader 6.5.8.0;c:\windows\system32\drivers\BDA_Loader_225.sys [29/09/2007 10:07 18944]
.
Contents of the 'Scheduled Tasks' folder
.
2013-02-07 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-01 18:12]
.
2006-08-18 c:\windows\Tasks\Easy Internet Sign-up.job
- c:\program files\Easy Internet signup\HPSdpApp.exe [2005-03-03 18:04]
.
2013-02-07 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-06 16:19]
.
2013-02-07 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-06 16:19]
.
2013-02-07 c:\windows\Tasks\ROC_JAN2013_TB_HP_Owner.job
- c:\program files\AVG Secure Search\ROC_JAN2013_TB.exe [2013-01-25 08:42]
.
2013-02-07 c:\windows\Tasks\ROC_JAN2013_TB_rmv.job
- c:\program files\AVG Secure Search\PostInstall\ROC.exe [2013-01-25 08:42]
.
.
——- Supplementary Scan ——-
.
uStart Page = about:blank
uInternet Settings,ProxyOverride =
TCP: DhcpNameServer = 192.168.1.1
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\Common Files\AVG Secure Search\ViProtocolInstaller\14.0.1\ViProtocol.dll
DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} - hxxp://download.zonelabs.com/bin/promotions/spywaredetector/ICSScanner37960.cab
FF - ProfilePath - c:\documents and settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\70vjyhhd.default\
FF - prefs.js: browser.startup.homepage - about:blank
FF - prefs.js: keyword.URL - hxxps://isearch.avg.com/search?cid={FD17001D-3658-474A-A7D0-BC71EC5BD71E}∣=3f05b4dc341d47d6b99ed1191024e9fb-003760f4d9065511168fea5cf168a4a58301e9c1⟨=us&ds;=AVG≺=fr&d;=2011-12-08 10:23&v;=12.2.5.32&sap;=ku&q;=
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2013-02-07 19:48
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_5_502_146_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_5_502_146_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'explorer.exe'(1896)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2013-02-07 19:52:07
ComboFix-quarantined-files.txt 2013-02-07 19:52
ComboFix2.txt 2013-02-07 19:04
ComboFix3.txt 2013-02-03 15:41
.
Pre-Run: 116,006,072,320 bytes free
Post-Run: 115,997,851,648 bytes free
.
- - End Of File - - 083BB3813FE00D0010EA04FEECF0339B
Post #25
RK Log as requested

It mentioned ALCWZRD again and the registry entries, but no ZeroAccess flashing
When I closed RK down it did prompt to say that I hadnt cleaned/fixed anything.


RogueKiller V8.4.4 [Feb 5 2013] by Tigzy
mail : tigzyRKgmailcom
Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/
Website : http://tigzy.geekstogo.com/roguekiller.php
Blog : http://tigzyrk.blogspot.com/

Operating System : Windows XP (5.1.2600 Service Pack 3) 32 bits version
Started in : Normal mode
User : HP_Owner [Admin rights]
Mode : Scan – Date : 02/08/2013 08:27:10
| ARK || MBR |

¤¤¤ Bad processes : 1 ¤¤¤
[SUSP PATH] ALCWZRD.EXE – C:\WINDOWS\ALCWZRD.EXE -> KILLED [TermProc]

¤¤¤ Registry Entries : 4 ¤¤¤
[HJPOL] HKLM\[…]\System : DisableRegistryTools (0) -> FOUND
[HJ SMENU] HKCU\[…]\Advanced : Start_ShowRecentDocs (0) -> FOUND
[HJ SMENU] HKCU\[…]\Advanced : Start_ShowPrinters (0) -> FOUND
[HJ DESK] HKLM\[…]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [LOADED] ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
–> C:\WINDOWS\system32\drivers\etc\hosts

127.0.0.1 localhost


¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: ST3250823AS +++++
— User —
[MBR] 38bf8abec4338cff104aeabb410c4c47
[BSP] 8a7884da59e414827f91c43dcf324e78 : Toshiba tatooed MBR Code
Partition table:
0 - [XXXXXX] FAT32-LBA (0x0c) [VISIBLE] Offset (sectors): 63 | Size: 6142 Mo
1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 12579840 | Size: 232322 Mo
User = LL1 … OK!
User = LL2 … OK!

Finished : << RKreport[1]_S_02082013_02d0827.txt >>
RKreport[1]_S_02082013_02d0827.txt
Post #26
Run Roguekiller again, click the registry tab and make this entry checked and the others unchecked [HJPOL] HKLM\[…]\System : DisableRegistryTools (0) -> FOUND How is it running now?
Post #27
I checked justthe single entry as described and then clicked delete
After completeion I rebooted,

It seems to be running better, but I still get the fan kicking in when i dont expect
e.g. while entering text in this box, the cpu is CPU is constantly kicking between 30 & 100% in task manager.
spoolsv.exe keeps jumping up the CPU

Also, I still get IE indicating it is not the default browser when I keep selecting it as that.
I am being prompted to install an MS patch for IE8 and/or upgrade to IE 9 which I have held off as I didnt want to change anything whilst trying to resolve issues.

RogueKiller V8.4.4 [Feb 5 2013] by Tigzy
mail : tigzyRKgmailcom
Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/
Website : http://tigzy.geekstogo.com/roguekiller.php
Blog : http://tigzyrk.blogspot.com/

Operating System : Windows XP (5.1.2600 Service Pack 3) 32 bits version
Started in : Normal mode
User : HP_Owner [Admin rights]
Mode : Remove – Date : 02/08/2013 14:53:31
| ARK || MBR |

¤¤¤ Bad processes : 1 ¤¤¤
[SUSP PATH] ALCWZRD.EXE – C:\WINDOWS\ALCWZRD.EXE -> KILLED [TermProc]

¤¤¤ Registry Entries : 4 ¤¤¤
[HJPOL] HKLM\[…]\System : DisableRegistryTools (0) -> DELETED
[HJ SMENU] HKCU\[…]\Advanced : Start_ShowRecentDocs (0) -> NOT SELECTED
[HJ SMENU] HKCU\[…]\Advanced : Start_ShowPrinters (0) -> NOT SELECTED
[HJ DESK] HKLM\[…]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> NOT SELECTED

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [LOADED] ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
–> C:\WINDOWS\system32\drivers\etc\hosts

127.0.0.1 localhost


¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: ST3250823AS +++++
— User —
[MBR] 38bf8abec4338cff104aeabb410c4c47
[BSP] 8a7884da59e414827f91c43dcf324e78 : Toshiba tatooed MBR Code
Partition table:
0 - [XXXXXX] FAT32-LBA (0x0c) [VISIBLE] Offset (sectors): 63 | Size: 6142 Mo
1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 12579840 | Size: 232322 Mo
User = LL1 … OK!
User = LL2 … OK!

Finished : << RKreport[2]_D_02082013_02d1453.txt >>
RKreport[1]_S_02082013_02d1450.txt ; RKreport[2]_D_02082013_02d1453.txt
Post #28
I can see no more signs of malware in the logs now so you can try asking in the Microsoft Windows section of the forum for advice about the errors you are getting. Will clean up now.


Right click and select delete for any tools used apart from CF and OTL.


ComboFix - Cleanup
Time for some housekeeping
  • Click Start…select Run from the menu.
  • Copy and paste the following into the text entry box:
    Combofix /Uninstall
  • Click the OK button. (See image below as reference.)
🖼Click to load external image (Posted Image)









Clean up with OTL:
  • Double-click OTL.exe to start the program.
  • Close all other programs apart from OTL as this step will require a reboot
  • On the OTL main screen, press the CLEANUP button
  • Say Yes to the prompt and then allow the program to reboot your computer.






[external image: Posted Image]
Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.
  • Download the latest version of Java Runtime Environment (JRE) 7 and save it to your desktop.
  • Scroll down to where it says JDK 7 (JDK or JRE)
  • Click the Download JRE button to the right
  • Select the Windows platform from the dropdown menu.
  • Read the License Agreement and then check the box that says: "I agree to the Java SE Runtime Environment 7 with JavaFX 1 License Agreement". Click on Continue.The page will refresh.
  • Click on the link to download Windows Offline Installation and save the file to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Control Panel, double-click on Add or Remove Programs and remove all older versions of Java.
  • Check (highlight) any item with Java Runtime Environment (JRE or J2SE or Java™ 6) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-7-windows-i586-p.exe to install the newest version.
  • After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
    • On the General tab, under Temporary Internet Files, click the Settings button.
    • Next, click on the Delete Files button
    • There are two options in the window to clear the cache - Leave BOTH CheckedApplications and Applets
      Trace and Log Files
  • Click OK on Delete Temporary Files Window
    Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
  • Click OK to leave the Temporary Files Window
  • Click OK to leave the Java Control Panel.











Here are some recommendations to help you stay clean.


Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.

Visit Microsoft often to get the latest updates for your computer.
http://www.update.microsoft.com/



Make sure you are running a FIREWALL.The windows firewall is not sufficient to protect your system. It doesn't monitor outgoing traffic and this is a must.
Please read this article 'Safe Computing Practices'.
So how did I get infected in the first place.

please take a moment to read quietman7's excellent prevention tips in post 3 here
Click >>>> Tips to protect yourself against malware and reduce the potential for re-infection:

Preventing Infections in the Future

Please also have a look at the following links, giving some advice and Tips to protect yourself against malware and reduce the potential for re-infection:
  • Avoid gaming sites, underground web pages, pirated software sites, and peer-to-peer (P2P) file sharing programs. They are a security risk which can make your computer susceptible to a smörgåsbord of malware infections, remote attacks, exposure of personal information, and identity theft. Many malicious worms and Trojans spread across P2P file sharing networks, gaming and underground sites. Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and Flash ads that install viruses, Trojans and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users. The best way to reduce the risk of infection is to avoid these types of web sites and not use any P2P applications. Read P2P Software User Advisories and Risks of File-Sharing Technology.

Update Non-Microsoft Programs

It is also a good idea to check for the latest versions of commonly installed applications that are regularly patched to fix vulnerabilities. You can check these by visiting Secunia Software Inspector and Calendar of Updates.


Thats it you are good to go.Safe surfing
Post #29
Hi Mowman Thx for the help. I will go ahead and perform the cleanups & updates as suggested.& proceed with teh spoolsv issue in teh windows forums Regarding the firewall , I previously used ZoneAlarm as well as the Windows version but was told that I should not run both. Should I thereofore reinstall ZoneAlarm and disable Windiows firewall?
Post #30

Should I thereofore reinstall ZoneAlarm and disable Windiows firewall?

Yes the xp firewall is not very good.


You're welcome,glad we could help :)


Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI