[nohwpro]

My Husband's computer got infected Saturday. Read your site and first ran TFC and the computer would not go down for the reboot, so when I "helped it", it would no longer come back up. After finally getting the Windows XP OS to repair, brought it back up last night. Ran erunt, mbam, TFC and gmer rootkit detection. I have logs but I cannot access them because when I ran OTL it came up with an access violation error and is now been sitting there almost 3 hours doing nothing with the message at the bottom - creating restore point, do not interrupt.

I tried to get the logs that I had and post them, but file manager is hourglassing and all the icon's disappeared when I tried to bring up firefox to post this from the computer where the logs are.

Now what do I do? Please help.

[Advertisements]

hi


Backup Your Registry with ERUNT

• Please use the following link and scroll down to ERUNT and download it.
  http://aumha.org/freeware/freeware.php
• For version with the Installer:
  Use the setup program to install ERUNT on your computer
• For the zipped version:
  Unzip all the files into a folder of your choice.

Click Erunt.exe to backup your registry to the folder of your choice.

Note: to restore your registry, go to the folder and start ERDNT.exe



Download SysRestorePoint to your desktop and unzip it to it's own folder.

• Double click SysRestorePoint.exe so that we can make a new system restore point.
• A box will pop up after it has made a new point, usually after a few seconds. Close that window and exit the program.

Step 2 : The fix



Download OTL to your Desktop

• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
• Under the Custom Scans/Fixes box at the bottom, paste in the following
  
  

  :Reg
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
  "Shell"="explorer.exe"
  "Userinit"="C:\\WINDOWS\\system32\\Userinit.exe,"
  [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
  "DisableTaskMgr"=-
  [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
  "DisableTaskMgr"=-
  [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
  "NoSetActiveDesktop"=-
  "NoActiveDesktopChanges"=-
  [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
  "NoSetActiveDesktop"=-
  "NoActiveDesktopChanges"=-
  
  :Files
  helper32.dll /lsp
  winhelper86.dll /lsp
  %HOMEDRIVE%\Internet Security 2010.lnk /s
  %systemroot%\System32\winlogon32.exe
  %systemroot%\System32\smss32.exe
  %systemroot%\System32\AVR10.exe
  %systemroot%\System32\helper32.dll
  %systemroot%\System32\winlogon32.exe
  %systemroot%\System32\smss32.exe
  %systemroot%\System32\warning.html
  %systemroot%\system32\IS15.exe
  %systemroot%\System32\winhelper86.dll
  %HOMEDRIVE%\trhh.exe
  %HOMEDRIVE%\sdigdvmg.exe
  %HOMEDRIVE%\wgqi.exe
  %HOMEDRIVE%\byyk.exe
  %systemroot%\lsass.exe 
  %systemroot%\odbn0.exe
  %systemroot%\System32\sdra64.exe
  %systemroot%\System32\41.exe
  %systemroot%\System32\153.exe
  %systemroot%\System32\292.exe
  %systemroot%\System32\491.exe
  %systemroot%\System32\1869.exe
  %systemroot%\system32\2876.exe
  %systemroot%\System32\2995.exe
  %systemroot%\System32\3902.exe
  %systemroot%\System32\4827.exe
  %systemroot%\System32\5436.exe
  %systemroot%\System32\5447.exe
  %systemroot%\System32\5705.exe
  %systemroot%\System32\6334.exe
  %systemroot%\System32\7376.exe
  %systemroot%\System32\9961.exe
  %systemroot%\System32\11478.exe
  %systemroot%\System32\11538.exe
  %systemroot%\System32\11942.exe
  %systemroot%\System32\12382.exe
  %systemroot%\system32\12662.exe
  %systemroot%\System32\13931.exe
  %systemroot%\system32\14070.exe
  %systemroot%\System32\14604.exe
  %systemroot%\System32\14771.exe
  %systemroot%\System32\15724.exe
  %systemroot%\System32\16827.exe
  %systemroot%\System32\16944.exe
  %systemroot%\system32\17125.exe
  %systemroot%\System32\17421.exe
  %systemroot%\System32\18467.exe
  %systemroot%\System32\18716.exe
  %systemroot%\System32\19169.exe
  %systemroot%\System32\19718.exe
  %systemroot%\System32\19895.exe
  %systemroot%\system32\19905.exe
  %systemroot%\System32\19912.exe
  %systemroot%\system32\21386.exe
  %systemroot%\System32\21726.exe
  %systemroot%\system32\22934.exe
  %systemroot%\System32\23281.exe
  %systemroot%\system32\24242.exe
  %systemroot%\System32\24464.exe
  %systemroot%\system32\24478.exe
  %systemroot%\System32\26308.exe
  %systemroot%\System32\26500.exe
  %systemroot%\System32\26962.exe
  %systemroot%\system32\27213.exe
  %systemroot%\System32\28145.exe
  %systemroot%\system32\28466.exe
  %systemroot%\System32\29358.exe
  %systemroot%\System32\32391.exe
  %systemroot%\System32\32439.exe
  %systemroot%\system32\ndisdrv.sys
  %HOMEDRIVE%\s
  %systemroot%\system32\kbdsock.dll
  %systemroot%\system32\mshlps.dll 
  %systemroot%\system32\drivers\kdrhkukb.sys 
  %PROGRAMFILES%\InternetSecurity2010
  %systemroot%\System32\lowsec
  
  :Services
  lmuytnv
  ndisdrv
  qvazdxe
  
  :Commands
  [purity]
  [CREATERESTOREPOINT] 
  [resethosts]
  [emptytemp]

• Then click the Run Fix button at the top
• Let the program run unhindered, it wont take long.

Please download Malwarebytes' Anti-Malware from Here

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
• The scan may take some time to finish,so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected.
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.


Reboot your PC and see if the infection is gone.



The infection should hopefully be removed after these steps. Tell me how the machine is running and if you had any problems.

[Rorschach112]

hi


Backup Your Registry with ERUNT

• Please use the following link and scroll down to ERUNT and download it.
  http://aumha.org/freeware/freeware.php
• For version with the Installer:
  Use the setup program to install ERUNT on your computer
• For the zipped version:
  Unzip all the files into a folder of your choice.

Click Erunt.exe to backup your registry to the folder of your choice.

Note: to restore your registry, go to the folder and start ERDNT.exe



Download SysRestorePoint to your desktop and unzip it to it's own folder.

• Double click SysRestorePoint.exe so that we can make a new system restore point.
• A box will pop up after it has made a new point, usually after a few seconds. Close that window and exit the program.

Step 2 : The fix



Download OTL to your Desktop

• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
• Under the Custom Scans/Fixes box at the bottom, paste in the following
  
  

  :Reg
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
  "Shell"="explorer.exe"
  "Userinit"="C:\\WINDOWS\\system32\\Userinit.exe,"
  [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
  "DisableTaskMgr"=-
  [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
  "DisableTaskMgr"=-
  [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
  "NoSetActiveDesktop"=-
  "NoActiveDesktopChanges"=-
  [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
  "NoSetActiveDesktop"=-
  "NoActiveDesktopChanges"=-
  
  :Files
  helper32.dll /lsp
  winhelper86.dll /lsp
  %HOMEDRIVE%\Internet Security 2010.lnk /s
  %systemroot%\System32\winlogon32.exe
  %systemroot%\System32\smss32.exe
  %systemroot%\System32\AVR10.exe
  %systemroot%\System32\helper32.dll
  %systemroot%\System32\winlogon32.exe
  %systemroot%\System32\smss32.exe
  %systemroot%\System32\warning.html
  %systemroot%\system32\IS15.exe
  %systemroot%\System32\winhelper86.dll
  %HOMEDRIVE%\trhh.exe
  %HOMEDRIVE%\sdigdvmg.exe
  %HOMEDRIVE%\wgqi.exe
  %HOMEDRIVE%\byyk.exe
  %systemroot%\lsass.exe 
  %systemroot%\odbn0.exe
  %systemroot%\System32\sdra64.exe
  %systemroot%\System32\41.exe
  %systemroot%\System32\153.exe
  %systemroot%\System32\292.exe
  %systemroot%\System32\491.exe
  %systemroot%\System32\1869.exe
  %systemroot%\system32\2876.exe
  %systemroot%\System32\2995.exe
  %systemroot%\System32\3902.exe
  %systemroot%\System32\4827.exe
  %systemroot%\System32\5436.exe
  %systemroot%\System32\5447.exe
  %systemroot%\System32\5705.exe
  %systemroot%\System32\6334.exe
  %systemroot%\System32\7376.exe
  %systemroot%\System32\9961.exe
  %systemroot%\System32\11478.exe
  %systemroot%\System32\11538.exe
  %systemroot%\System32\11942.exe
  %systemroot%\System32\12382.exe
  %systemroot%\system32\12662.exe
  %systemroot%\System32\13931.exe
  %systemroot%\system32\14070.exe
  %systemroot%\System32\14604.exe
  %systemroot%\System32\14771.exe
  %systemroot%\System32\15724.exe
  %systemroot%\System32\16827.exe
  %systemroot%\System32\16944.exe
  %systemroot%\system32\17125.exe
  %systemroot%\System32\17421.exe
  %systemroot%\System32\18467.exe
  %systemroot%\System32\18716.exe
  %systemroot%\System32\19169.exe
  %systemroot%\System32\19718.exe
  %systemroot%\System32\19895.exe
  %systemroot%\system32\19905.exe
  %systemroot%\System32\19912.exe
  %systemroot%\system32\21386.exe
  %systemroot%\System32\21726.exe
  %systemroot%\system32\22934.exe
  %systemroot%\System32\23281.exe
  %systemroot%\system32\24242.exe
  %systemroot%\System32\24464.exe
  %systemroot%\system32\24478.exe
  %systemroot%\System32\26308.exe
  %systemroot%\System32\26500.exe
  %systemroot%\System32\26962.exe
  %systemroot%\system32\27213.exe
  %systemroot%\System32\28145.exe
  %systemroot%\system32\28466.exe
  %systemroot%\System32\29358.exe
  %systemroot%\System32\32391.exe
  %systemroot%\System32\32439.exe
  %systemroot%\system32\ndisdrv.sys
  %HOMEDRIVE%\s
  %systemroot%\system32\kbdsock.dll
  %systemroot%\system32\mshlps.dll 
  %systemroot%\system32\drivers\kdrhkukb.sys 
  %PROGRAMFILES%\InternetSecurity2010
  %systemroot%\System32\lowsec
  
  :Services
  lmuytnv
  ndisdrv
  qvazdxe
  
  :Commands
  [purity]
  [CREATERESTOREPOINT] 
  [resethosts]
  [emptytemp]

• Then click the Run Fix button at the top
• Let the program run unhindered, it wont take long.

Please download Malwarebytes' Anti-Malware from Here

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
• The scan may take some time to finish,so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected.
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.


Reboot your PC and see if the infection is gone.



The infection should hopefully be removed after these steps. Tell me how the machine is running and if you had any problems.

[nohwpro]

My Problem is that I was on step 4 of the cleaning guide and OTL hit a access violation and I think it is HUNG. Has been this way for over 4 hours. Can I kill the process and start over with your list?

I already has done TFC, ERUNT, Malwarebytes'Anti-Malware run, reboot, Rootkit Detection, and then was trying to do step 5 OTL.

There is a window that would not go away that was still up when OTL started. I would kill it and it kept going... It was called Status.

Can I kill OTL?

[Rorschach112]

yes go ahead, then post me the GMER and OTL logs

[nohwpro]

Thanks - I'm posting from another computer as the infected ones is still not working correctly.

I clicked on the X for OTL but all the icons and tool bar were gone so I rebooted.

Host came up again - all icons have highlighted text underneath them a window labeled Status is trying to run.

The feature you are trying to use is on a network resource that is unavailable.

click okay to try again, or enter an alternate path to a folder containing the installation package 'status.msi' in the box below -
C: \DOC......\Temp\7

if I click OK or the X to close the box it keeps trying to install, erroring and showing this window.

It has the CPU at 100% and I can't do much.
I brought up Firefox to post the log, but then I tried to bring up the log to copy and paste and now it is hourglassing.

[Rorschach112]

do this

Download ComboFix here :

Link 1
Link 2


* IMPORTANT !!! Save ComboFix.exe to your Desktop

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you don't know how to disable them then just continue on.
  
  
• Double click on ComboFix.exe & follow the prompts.
  
  
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:




Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix\ComboFix.txt log in your next reply.

[nohwpro]

Malwarebytes' Anti-Malware 1.44
Database version: 3642
Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

1/26/2010 6:09:54 PM
mbam-log-2010-01-26 (18-09-54).txt

Scan type: Quick Scan
Objects scanned: 132395
Time elapsed: 4 minute(s), 17 second(s)

Memory Processes Infected: 2
Memory Modules Infected: 1
Registry Keys Infected: 1
Registry Values Infected: 4
Registry Data Items Infected: 10
Folders Infected: 1
Files Infected: 6

Memory Processes Infected:
C:\WINDOWS\system32\smss32.exe (Malware.Packer.Gen) -> Unloaded process successfully.
C:\Program Files\InternetSecurity2010\IS2010.exe (Rogue.Installer) -> Unloaded process successfully.

Memory Modules Infected:
C:\WINDOWS\system32\helper32.dll (Trojan.BHO) -> Delete on reboot.

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\IS2010 (Rogue.InternetSecurity2010) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss32.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\internet security 2010 (Rogue.Installer) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\internet security 2010 (Rogue.Installer) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\General\wallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Malware.Packer.Gen) -> Data: c:\windows\system32\winlogon32.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Malware.Packer.Gen) -> Data: system32\winlogon32.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Hijack.UserInit) -> Bad: (C:\WINDOWS\system32\winlogon32.exe) Good: (userinit.exe) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\NoChangingWallpaper (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetActiveDesktop (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\activedesktop\NoChangingWallpaper (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetActiveDesktop (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
C:\Program Files\InternetSecurity2010 (Rogue.InternetSecurity2010) -> Quarantined and deleted successfully.

Files Infected:
C:\WINDOWS\system32\helper32.dll (Trojan.BHO) -> Delete on reboot.
C:\WINDOWS\system32\smss32.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Program Files\InternetSecurity2010\IS2010.exe (Rogue.Installer) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\winlogon32.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\41.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\warning.html (Trojan.FakeAlert) -> Quarantined and deleted successfully.



GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-01-27 05:08:52
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:\DOCUME~1\WILLIA~1\LOCALS~1\Temp\fwlyapod.sys


---- System - GMER 1.0.15 ----

SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwConnectPort [0x9BE53600]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwCreateFile [0x9BE4CD50]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwCreateKey [0x9BE71040]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwCreatePort [0x9BE53E10]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwCreateProcess [0x9BE6AD00]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwCreateProcessEx [0x9BE6B120]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwCreateSection [0x9BE75210]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwCreateWaitablePort [0x9BE53F80]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwDeleteFile [0x9BE4DC30]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwDeleteKey [0x9BE72750]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwDeleteValueKey [0x9BE72130]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwDuplicateObject [0x9BE69E40]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwLoadDriver [0x9BE468E0]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwLoadKey [0x9BE73050]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwLoadKey2 [0x9BE73280]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwMapViewOfSection [0x9BE755C0]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwOpenFile [0x9BE4D720]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwOpenProcess [0x9BE6D420]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwOpenThread [0x9BE6CFF0]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwProtectVirtualMemory [0x9BE6F470]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwRenameKey [0x9BE74400]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwReplaceKey [0x9BE73A10]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwRequestWaitReplyPort [0x9BE53150]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwRestoreKey [0x9BE740A0]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwSecureConnectPort [0x9BE538E0]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwSetInformationFile [0x9BE4E050]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwSetInformationObject [0x9BE6F340]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwSetSecurityObject [0x9BE748B0]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwSetSystemInformation [0x9BE46010]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwSetValueKey [0x9BE71940]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwSystemDebugControl [0x9BE6BCF0]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwTerminateProcess [0x9BE6BA20]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD) ZwUnloadDriver [0x9BE46D30]

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs SymSnap.sys (StorageCraft Volume Snap-Shot/StorageCraft)

Device \Driver\Tcpip \Device\Ip vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
Device \Driver\Tcpip \Device\Tcp vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)

AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume1 SymSnap.sys (StorageCraft Volume Snap-Shot/StorageCraft)
AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume2 SymSnap.sys (StorageCraft Volume Snap-Shot/StorageCraft)
AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume3 SymSnap.sys (StorageCraft Volume Snap-Shot/StorageCraft)
AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume4 SymSnap.sys (StorageCraft Volume Snap-Shot/StorageCraft)

Device \Driver\Tcpip \Device\Udp vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
Device \Driver\Tcpip \Device\RawIp vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
Device \Driver\Tcpip \Device\IPMULTICAST vsdatant.sys (TrueVector Device Driver/Check Point Software Technologies LTD)
Device \FileSystem\Fastfat \Fat 951A5D20

AttachedDevice \FileSystem\Fastfat \Fat SymSnap.sys (StorageCraft Volume Snap-Shot/StorageCraft)

---- EOF - GMER 1.0.15 ----



Okay rebooted again before it got to 100% - extracted log to zip drive - hope I am not infecting this other computer.

Still want to do Combo - or Try OTL again?

[Rorschach112]

try OTL once more

[nohwpro]

Thank you. Host rebooted as part of the process - the Status program is still trying to install but managed to kill it in task manager before it escalated usage.

Here is OTL log:
All processes killed
========== REGISTRY ==========
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\"Shell"|"explorer.exe" /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\"Userinit"|"C:\\WINDOWS\\system32\\Userinit.exe," /E : value set successfully!
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\\DisableTaskMgr deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\\DisableTaskMgr not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\\NoSetActiveDesktop deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\\NoActiveDesktopChanges deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\\NoSetActiveDesktop deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\\NoActiveDesktopChanges deleted successfully.
========== FILES ==========
C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Security 2010.lnk moved successfully.
C:\WINDOWS\system32\config\systemprofile\Desktop\Internet Security 2010.lnk moved successfully.
C:\WINDOWS\system32\config\systemprofile\Start Menu\Internet Security 2010.lnk moved successfully.
File/Folder C:\WINDOWS\System32\winlogon32.exe not found.
File/Folder C:\WINDOWS\System32\smss32.exe not found.
File/Folder C:\WINDOWS\System32\AVR10.exe not found.
File/Folder C:\WINDOWS\System32\helper32.dll not found.
File/Folder C:\WINDOWS\System32\winlogon32.exe not found.
File/Folder C:\WINDOWS\System32\smss32.exe not found.
File/Folder C:\WINDOWS\System32\warning.html not found.
File/Folder C:\WINDOWS\system32\IS15.exe not found.
File/Folder C:\WINDOWS\System32\winhelper86.dll not found.
File/Folder C:\trhh.exe not found.
File/Folder C:\sdigdvmg.exe not found.
File/Folder C:\wgqi.exe not found.
File/Folder C:\byyk.exe not found.
File/Folder C:\WINDOWS\lsass.exe not found.
File/Folder C:\WINDOWS\odbn0.exe not found.
File/Folder C:\WINDOWS\System32\sdra64.exe not found.
File/Folder C:\WINDOWS\System32\41.exe not found.
File/Folder C:\WINDOWS\System32\153.exe not found.
File/Folder C:\WINDOWS\System32\292.exe not found.
File/Folder C:\WINDOWS\System32\491.exe not found.
File/Folder C:\WINDOWS\System32\1869.exe not found.
File/Folder C:\WINDOWS\system32\2876.exe not found.
File/Folder C:\WINDOWS\System32\2995.exe not found.
File/Folder C:\WINDOWS\System32\3902.exe not found.
File/Folder C:\WINDOWS\System32\4827.exe not found.
File/Folder C:\WINDOWS\System32\5436.exe not found.
File/Folder C:\WINDOWS\System32\5447.exe not found.
File/Folder C:\WINDOWS\System32\5705.exe not found.
File/Folder C:\WINDOWS\System32\6334.exe not found.
File/Folder C:\WINDOWS\System32\7376.exe not found.
File/Folder C:\WINDOWS\System32\9961.exe not found.
File/Folder C:\WINDOWS\System32\11478.exe not found.
File/Folder C:\WINDOWS\System32\11538.exe not found.
File/Folder C:\WINDOWS\System32\11942.exe not found.
File/Folder C:\WINDOWS\System32\12382.exe not found.
File/Folder C:\WINDOWS\system32\12662.exe not found.
File/Folder C:\WINDOWS\System32\13931.exe not found.
File/Folder C:\WINDOWS\system32\14070.exe not found.
File/Folder C:\WINDOWS\System32\14604.exe not found.
File/Folder C:\WINDOWS\System32\14771.exe not found.
File/Folder C:\WINDOWS\System32\15724.exe not found.
File/Folder C:\WINDOWS\System32\16827.exe not found.
File/Folder C:\WINDOWS\System32\16944.exe not found.
File/Folder C:\WINDOWS\system32\17125.exe not found.
File/Folder C:\WINDOWS\System32\17421.exe not found.
File/Folder C:\WINDOWS\System32\18467.exe not found.
File/Folder C:\WINDOWS\System32\18716.exe not found.
File/Folder C:\WINDOWS\System32\19169.exe not found.
File/Folder C:\WINDOWS\System32\19718.exe not found.
File/Folder C:\WINDOWS\System32\19895.exe not found.
File/Folder C:\WINDOWS\system32\19905.exe not found.
File/Folder C:\WINDOWS\System32\19912.exe not found.
File/Folder C:\WINDOWS\system32\21386.exe not found.
File/Folder C:\WINDOWS\System32\21726.exe not found.
File/Folder C:\WINDOWS\system32\22934.exe not found.
File/Folder C:\WINDOWS\System32\23281.exe not found.
File/Folder C:\WINDOWS\system32\24242.exe not found.
File/Folder C:\WINDOWS\System32\24464.exe not found.
File/Folder C:\WINDOWS\system32\24478.exe not found.
File/Folder C:\WINDOWS\System32\26308.exe not found.
File/Folder C:\WINDOWS\System32\26500.exe not found.
File/Folder C:\WINDOWS\System32\26962.exe not found.
File/Folder C:\WINDOWS\system32\27213.exe not found.
File/Folder C:\WINDOWS\System32\28145.exe not found.
File/Folder C:\WINDOWS\system32\28466.exe not found.
File/Folder C:\WINDOWS\System32\29358.exe not found.
File/Folder C:\WINDOWS\System32\32391.exe not found.
File/Folder C:\WINDOWS\System32\32439.exe not found.
File/Folder C:\WINDOWS\system32\ndisdrv.sys not found.
File/Folder C:\s not found.
File/Folder C:\WINDOWS\system32\kbdsock.dll not found.
File/Folder C:\WINDOWS\system32\mshlps.dll not found.
File/Folder C:\WINDOWS\system32\drivers\kdrhkukb.sys not found.
File/Folder C:\Program Files\InternetSecurity2010 not found.
File/Folder C:\WINDOWS\System32\lowsec not found.
========== SERVICES/DRIVERS ==========
Error: No service named lmuytnv was found to stop!
Unable to stop service lmuytnv!
Error: No service named ndisdrv was found to stop!
Unable to stop service ndisdrv!
Error: No service named qvazdxe was found to stop!
Unable to stop service qvazdxe!
========== COMMANDS ==========
Restore point Set: OTL Restore Point (64424509440)
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: LocalService
->Temp folder emptied: 65984 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Ruth McNay
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: William McNay
->Temp folder emptied: 1113270 bytes
->Temporary Internet Files folder emptied: 46994 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 8218376 bytes
->Google Chrome cache emptied: 0 bytes
->Apple Safari cache emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 48615875 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 55.00 mb


OTL by OldTimer - Version 3.1.27.0 log created on 01272010_114733

Files\Folders moved on Reboot...
C:\Documents and Settings\William McNay\Local Settings\Temp\~DF41CC.tmp moved successfully.
File\Folder C:\WINDOWS\temp\av2.tmp not found!
C:\WINDOWS\temp\iswift.dat moved successfully.
C:\WINDOWS\temp\sfdb.dat moved successfully.
File\Folder C:\WINDOWS\temp\ZLT055aa.TMP not found!

Registry entries deleted on Reboot...


Thanks so much for Helping. What next?

[Rorschach112]

open OTL click quick scan post that log

[nohwpro]

OTL logfile created on: 1/27/2010 4:12:51 PM - Run 1
OTL by OldTimer - Version 3.1.27.0 Folder = C:\Documents and Settings\William McNay\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 77.00% Memory free
5.00 Gb Paging File | 4.00 Gb Available in Paging File | 87.00% Paging File free
Paging file location(s): c:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 455.93 Gb Total Space | 268.75 Gb Free Space | 58.95% Space Free | Partition Type: NTFS
Drive D: | 596.40 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
Drive H: | 931.51 Gb Total Space | 151.88 Gb Free Space | 16.30% Space Free | Partition Type: NTFS
Drive I: | 1.86 Gb Total Space | 1.83 Gb Free Space | 98.38% Space Free | Partition Type: FAT

Computer Name: BILLMCNAY
Current User Name: William McNay
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 14 Days
Output = Standard
Quick Scan

========== Processes (SafeList) ==========

PRC - [2010/01/27 10:16:52 | 00,548,864 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\William McNay\Desktop\OTL.exe
PRC - [2010/01/07 12:08:11 | 00,908,248 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2009/10/28 20:21:26 | 00,141,600 | ---- | M] (Apple Inc.) -- C:\Program Files\iTunes\iTunesHelper.exe
PRC - [2009/10/28 20:21:14 | 00,545,568 | ---- | M] (Apple Inc.) -- C:\Program Files\iPod\bin\iPodService.exe
PRC - [2009/10/17 01:41:10 | 02,384,240 | ---- | M] (Check Point Software Technologies LTD) -- C:\WINDOWS\system32\ZoneLabs\vsmon.exe
PRC - [2009/10/17 01:39:40 | 01,037,192 | ---- | M] (Check Point Software Technologies LTD) -- C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
PRC - [2009/10/10 13:32:18 | 00,305,664 | ---- | M] (ArcSoft Inc.) -- C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac
PRC - [2009/10/10 13:32:18 | 00,203,264 | ---- | M] (ArcSoft Inc.) -- C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
PRC - [2009/10/09 13:11:12 | 25,623,336 | R--- | M] (Skype Technologies S.A.) -- C:\Program Files\Skype\Phone\Skype.exe
PRC - [2009/10/09 13:11:12 | 00,078,008 | R--- | M] (Skype Technologies) -- C:\Program Files\Skype\Plugin Manager\skypePM.exe
PRC - [2009/10/05 20:01:56 | 00,198,160 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Common Files\Real\Update_OB\realsched.exe
PRC - [2009/09/28 09:42:50 | 00,109,056 | ---- | M] (ArcSoft Inc.) -- C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
PRC - [2009/09/10 11:15:42 | 00,870,672 | ---- | M] (SonicWALL, Inc.) -- C:\Program Files\Zone Labs\ZoneAlarm\MailFrontier\mantispm.exe
PRC - [2009/06/05 11:48:14 | 00,144,712 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
PRC - [2009/05/08 10:35:50 | 02,780,432 | ---- | M] () -- C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe
PRC - [2009/05/08 10:34:08 | 00,559,888 | ---- | M] () -- C:\Program Files\Common Files\LogiShrd\LQCVFX\COCIManager.exe
PRC - [2009/05/02 12:31:13 | 00,822,424 | ---- | M] (Symantec Corporation) -- C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
PRC - [2009/04/30 16:01:10 | 00,154,136 | ---- | M] (Logitech Inc.) -- C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
PRC - [2009/04/20 08:10:48 | 00,084,464 | ---- | M] () -- C:\Program Files\Roxio Creator 2009 Ultimate\5.0\CPMonitor.exe
PRC - [2009/01/04 23:57:03 | 00,039,408 | ---- | M] (Google Inc.) -- C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
PRC - [2008/12/12 11:17:38 | 00,238,888 | ---- | M] (Apple Inc.) -- C:\Program Files\Bonjour\mDNSResponder.exe
PRC - [2008/10/04 12:58:04 | 00,201,968 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files\Dell Support Center\bin\sprtsvc.exe
PRC - [2008/10/04 12:58:02 | 00,206,064 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files\Dell Support Center\bin\sprtcmd.exe
PRC - [2008/09/16 12:03:18 | 00,169,312 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe
PRC - [2008/09/09 17:57:50 | 00,573,440 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\system32\ati2evxx.exe
PRC - [2008/08/18 18:01:52 | 00,203,296 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\nvraidservice.exe
PRC - [2008/08/01 11:59:26 | 00,125,424 | ---- | M] () -- C:\Program Files\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe
PRC - [2008/04/14 05:00:00 | 01,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2008/04/14 05:00:00 | 00,016,896 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wbem\unsecapp.exe
PRC - [2008/04/04 10:56:46 | 01,879,552 | ---- | M] (TiVo Inc.) -- C:\Program Files\TiVo\Desktop\TiVoServer.exe
PRC - [2008/04/04 10:54:58 | 00,394,240 | ---- | M] (TiVo Inc.) -- C:\Program Files\TiVo\Desktop\TiVoNotify.exe
PRC - [2008/04/04 10:54:34 | 01,193,984 | ---- | M] (TiVo Inc.) -- C:\Program Files\Common Files\TiVo Shared\Transfer\TiVoTransfer.exe
PRC - [2008/04/04 10:53:56 | 00,868,864 | ---- | M] (TiVo Inc.) -- C:\Program Files\Common Files\TiVo Shared\Beacon\TiVoBeacon.exe
PRC - [2008/01/15 12:31:58 | 00,155,648 | ---- | M] (NVIDIA) -- C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
PRC - [2008/01/14 20:10:28 | 16,855,552 | ---- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\RTHDCPL.EXE
PRC - [2007/10/14 21:17:32 | 00,049,152 | ---- | M] (Hewlett-Packard) -- C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
PRC - [2007/04/10 12:01:16 | 02,066,024 | ---- | M] (Symantec Corporation) -- C:\Program Files\Norton Ghost\Agent\VProSvc.exe
PRC - [2007/04/10 12:01:06 | 01,537,640 | ---- | M] (Symantec Corporation) -- C:\Program Files\Norton Ghost\Agent\GhostTray.exe
PRC - [2007/01/09 17:32:04 | 00,181,864 | ---- | M] (Symantec Corporation) -- C:\Program Files\Common Files\Symantec Shared\CCSETMGR.EXE
PRC - [2007/01/09 17:32:02 | 00,198,248 | ---- | M] (Symantec Corporation) -- C:\Program Files\Common Files\Symantec Shared\CCEVTMGR.EXE
PRC - [2007/01/09 17:32:02 | 00,058,984 | ---- | M] (Symantec Corporation) -- C:\Program Files\Common Files\Symantec Shared\CCAPP.EXE
PRC - [2007/01/04 14:38:08 | 00,024,652 | ---- | M] (Viewpoint Corporation) -- C:\Program Files\Viewpoint\Common\ViewpointService.exe
PRC - [2006/09/25 08:12:20 | 00,045,056 | ---- | M] (ATI Technologies Inc.) -- C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
PRC - [2005/09/09 19:09:10 | 00,053,248 | ---- | M] (GEAR Software) -- C:\WINDOWS\system32\gearsec.exe
PRC - [2005/09/09 03:24:30 | 00,102,400 | ---- | M] () -- C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
PRC - [2005/09/09 01:18:10 | 00,057,344 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Adobe\Photoshop Elements 4.0\apdproxy.exe


========== Modules (SafeList) ==========

MOD - [2010/01/27 10:16:52 | 00,548,864 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\William McNay\Desktop\OTL.exe
MOD - [2009/10/05 20:03:11 | 00,102,400 | ---- | M] (RealPlayer) -- C:\Program Files\Real\RealPlayer\browserrecord\chrome\hook\rpchromebrowserrecordhelper.dll
MOD - [2009/09/10 11:15:48 | 00,013,072 | ---- | M] () -- C:\Program Files\Zone Labs\ZoneAlarm\MailFrontier\MlfHook.dll
MOD - [2009/08/13 06:55:04 | 01,748,992 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.6001.22319_x-ww_f0b4c2df\GdiPlus.dll
MOD - [2009/06/29 16:06:46 | 00,348,160 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msvcr71.dll
MOD - [2006/07/11 19:35:42 | 00,503,808 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\MsVcP71.dll


========== Win32 Services (SafeList) ==========

SRV - [2009/10/28 20:21:14 | 00,545,568 | ---- | M] (Apple Inc.) [On_Demand | Running] -- C:\Program Files\iPod\bin\iPodService.exe -- (iPod Service)
SRV - [2009/10/17 01:41:10 | 02,384,240 | ---- | M] (Check Point Software Technologies LTD) [Auto | Running] -- C:\WINDOWS\System32\ZoneLabs\vsmon.exe -- (vsmon)
SRV - [2009/09/28 09:42:50 | 00,109,056 | ---- | M] (ArcSoft Inc.) [Auto | Running] -- C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe -- (ACDaemon)
SRV - [2009/09/23 16:37:30 | 00,051,168 | ---- | M] (NOS Microsystems Ltd.) [On_Demand | Stopped] -- C:\Program Files\NOS\bin\getPlus_Helper.dll -- (getPlusHelper) getPlus®
SRV - [2009/06/29 16:03:55 | 00,133,104 | ---- | M] (Google Inc.) [Auto | Stopped] -- C:\Program Files\Google\Update\GoogleUpdate.exe -- (gupdate1c9f90dfc34ac32) Google Update Service (gupdate1c9f90dfc34ac32)
SRV - [2009/06/05 11:48:14 | 00,144,712 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe -- (Apple Mobile Device)
SRV - [2009/05/21 20:21:18 | 00,248,832 | ---- | M] (Hewlett-Packard Co.) [On_Demand | Running] -- C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll -- (hpqcxs08)
SRV - [2009/05/02 12:31:13 | 00,822,424 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe -- (Symantec Core LC)
SRV - [2009/04/30 16:01:10 | 00,154,136 | ---- | M] (Logitech Inc.) [Auto | Running] -- C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe -- (LVPrcSrv)
SRV - [2009/04/22 19:14:56 | 00,182,768 | ---- | M] (Google) [On_Demand | Stopped] -- C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe -- (gusvc)
SRV - [2009/02/03 17:31:08 | 00,651,720 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2009/01/09 06:46:25 | 01,122,304 | R--- | M] (Sonic Solutions) [On_Demand | Stopped] -- C:\Program Files\Common Files\Roxio Shared\11.0\SharedCOM\RoxMediaDB11.exe -- (RoxMediaDB11)
SRV - [2009/01/05 00:03:01 | 00,016,680 | ---- | M] (Citrix Online, a division of Citrix Systems, Inc.) [On_Demand | Stopped] -- C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe -- (GoToAssist)
SRV - [2008/12/12 11:17:38 | 00,238,888 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files\Bonjour\mDNSResponder.exe -- (Bonjour Service)
SRV - [2008/10/04 12:58:04 | 00,201,968 | ---- | M] (SupportSoft, Inc.) [Auto | Running] -- C:\Program Files\Dell Support Center\bin\sprtsvc.exe -- (sprtsvc_DellSupportCenter) SupportSoft Sprocket Service (DellSupportCenter)
SRV - [2008/09/16 12:03:18 | 00,169,312 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe -- (AdobeActiveFileMonitor7.0)
SRV - [2008/09/09 17:57:50 | 00,573,440 | ---- | M] (ATI Technologies Inc.) [Auto | Running] -- C:\WINDOWS\system32\ati2evxx.exe -- (Ati HotKey Poller)
SRV - [2008/08/14 00:25:24 | 00,367,088 | ---- | M] (Sonic Solutions) [Auto | Stopped] -- C:\Program Files\Roxio Creator 2009 Ultimate\Digital Home 11\RoxioUpnpService11.exe -- (Roxio Upnp Server 11)
SRV - [2008/08/14 00:25:20 | 00,313,840 | ---- | M] (Sonic Solutions) [On_Demand | Stopped] -- C:\Program Files\Roxio Creator 2009 Ultimate\Digital Home 11\RoxioUPnPRenderer11.exe -- (Roxio UPnP Renderer 11)
SRV - [2008/08/14 00:24:06 | 00,309,744 | ---- | M] (Sonic Solutions) [Auto | Stopped] -- C:\Program Files\Common Files\Roxio Shared\11.0\SharedCOM\RoxLiveShare11.exe -- (RoxLiveShare11)
SRV - [2008/08/14 00:24:02 | 00,170,480 | ---- | M] (Sonic Solutions) [Auto | Stopped] -- C:\Program Files\Common Files\Roxio Shared\11.0\SharedCOM\RoxWatch11.exe -- (RoxWatch11)
SRV - [2008/08/01 11:59:26 | 00,125,424 | ---- | M] () [Auto | Running] -- C:\Program Files\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe -- (9734BF6A-2DCD-40f0-BAB0-5AAFEEBE1269)
SRV - [2008/07/18 13:13:20 | 00,053,760 | ---- | M] (Hewlett-Packard) [Auto | Running] -- C:\WINDOWS\system32\HPZipm12.dll -- (Pml Driver HPZ12)
SRV - [2008/07/18 13:13:20 | 00,044,032 | ---- | M] (Hewlett-Packard) [Auto | Running] -- C:\WINDOWS\system32\HPZinw12.dll -- (Net Driver HPZ12)
SRV - [2008/04/04 10:53:56 | 00,868,864 | ---- | M] (TiVo Inc.) [Auto | Running] -- C:\Program Files\Common Files\TiVo Shared\Beacon\TiVoBeacon.exe -- (TivoBeacon2)
SRV - [2008/03/25 21:27:36 | 00,135,168 | ---- | M] (Hewlett-Packard Co.) [Auto | Running] -- C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll -- (hpqddsvc)
SRV - [2008/03/24 06:35:22 | 00,074,384 | R--- | M] (MicroVision Development, Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\SureThing Shared\stllssvr.exe -- (stllssvr)
SRV - [2008/01/15 12:31:58 | 00,155,648 | ---- | M] (NVIDIA) [Auto | Running] -- C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe -- (nTuneService)
SRV - [2007/04/10 12:01:16 | 02,066,024 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Norton Ghost\Agent\VProSvc.exe -- (Norton Ghost)
SRV - [2007/01/09 17:32:04 | 00,181,864 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe -- (ccSetMgr)
SRV - [2007/01/09 17:32:04 | 00,079,464 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe -- (ccPwdSvc)
SRV - [2007/01/09 17:32:02 | 00,198,248 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe -- (ccEvtMgr)
SRV - [2007/01/04 14:38:08 | 00,024,652 | ---- | M] (Viewpoint Corporation) [Auto | Running] -- C:\Program Files\Viewpoint\Common\ViewpointService.exe -- (Viewpoint Manager Service)
SRV - [2005/09/09 19:09:10 | 00,053,248 | ---- | M] (GEAR Software) [Auto | Running] -- C:\WINDOWS\system32\gearsec.exe -- (GEARSecurity)
SRV - [2005/09/09 03:24:30 | 00,102,400 | ---- | M] () [Auto | Running] -- C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe -- (AdobeActiveFileMonitor4.0)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=1090105
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Start Page = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=1090105

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=1090105
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.co...html?channel=us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.co...m...tf8&oe=utf8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "AIM Search"
FF - prefs.js..browser.search.defaulturl: "http://slirsredirect...fftrie7&query="
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://aimzones.aol.com/homepage"
FF - prefs.js..extensions.enabledItems: {E2883E8F-472F-4fb0-9522-AC9BF37916A7}:1
FF - prefs.js..extensions.enabledItems: 6
FF - prefs.js..extensions.enabledItems: 2
FF - prefs.js..extensions.enabledItems: 48
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.0
FF - prefs.js..keyword.URL: "http://slirsredirect...0fftrab&query="
FF - prefs.js..network.proxy.no_proxies_on: "*.local"


FF - HKLM\software\mozilla\Mozilla Firefox 3.5.7\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/01/07 12:08:16 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.7\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/01/15 16:49:59 | 00,000,000 | ---D | M]

[2009/01/24 12:03:41 | 00,000,000 | ---D | M] -- C:\Documents and Settings\William McNay\Application Data\Mozilla\Extensions
[2010/01/27 12:14:00 | 00,000,000 | ---D | M] -- C:\Documents and Settings\William McNay\Application Data\Mozilla\Firefox\Profiles\vzyg7drz.default\extensions
[2009/10/05 20:05:02 | 00,000,000 | ---D | M] (Adobe DLM (powered by getPlus®)) -- C:\Documents and Settings\William McNay\Application Data\Mozilla\Firefox\Profiles\vzyg7drz.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
[2009/11/17 17:40:19 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2007/04/16 10:07:12 | 00,180,293 | ---- | M] () -- C:\Program Files\Mozilla Firefox\plugins\npViewpoint.dll

O1 HOSTS File: ([2010/01/27 11:50:48 | 00,000,098 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (HP Print Enhancer) - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll (Google Inc.)
O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll (Dell Inc.)
O2 - BHO: (HP Smart BHO Class) - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Adobe ARM] C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Adobe Photo Downloader] C:\Program Files\Adobe\Photoshop Elements 4.0\apdproxy.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\ALCMTR.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe (Apple Inc.)
O4 - HKLM..\Run: [ArcSoft Connection Service] C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)
O4 - HKLM..\Run: [ATICCC] C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe ()
O4 - HKLM..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe (Symantec Corporation)
O4 - HKLM..\Run: [CPMonitor] C:\Program Files\Roxio Creator 2009 Ultimate\5.0\CPMonitor.exe ()
O4 - HKLM..\Run: [dellsupportcenter] C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
O4 - HKLM..\Run: [DWQueuedReporting] c:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\hpwuSchd2.exe (Hewlett-Packard)
O4 - HKLM..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\HpqSRmon.exe (Hewlett-Packard)
O4 - HKLM..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
O4 - HKLM..\Run: [LogitechQuickCamRibbon] C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe ()
O4 - HKLM..\Run: [Norton Ghost 10.0] C:\Program Files\Norton Ghost\Agent\GhostTray.exe (Symantec Corporation)
O4 - HKLM..\Run: [NVRaidService] C:\WINDOWS\system32\nvraidservice.exe (NVIDIA Corporation)
O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\QTTask.exe (Apple Inc.)
O4 - HKLM..\Run: [RoxWatchTray] C:\Program Files\Common Files\Roxio Shared\11.0\SharedCOM\RoxWatchTray11.exe (Sonic Solutions)
O4 - HKLM..\Run: [RTHDCPL] C:\WINDOWS\RTHDCPL.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [ZoneAlarm Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe (Check Point Software Technologies LTD)
O4 - HKCU..\Run: [NVIDIA nTune] C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe (NVIDIA)
O4 - HKCU..\Run: [Skype] C:\Program Files\Skype\Phone\Skype.exe (Skype Technologies S.A.)
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - HKCU..\Run: [TivoNotify] C:\Program Files\TiVo\Desktop\TiVoNotify.exe (TiVo Inc.)
O4 - HKCU..\Run: [TivoServer] C:\Program Files\TiVo\Desktop\TiVoServer.exe (TiVo Inc.)
O4 - HKCU..\Run: [TivoTransfer] C:\Program Files\Common Files\TiVo Shared\Transfer\TiVoTransfer.exe (TiVo Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Event Reminder.lnk = C:\Program Files\PrintMaster Platinum 18\Remind.exe (Broderbund Properties LLC)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
O4 - Startup: C:\Documents and Settings\William McNay\Start Menu\Programs\Startup\Logitech . Product Registration.lnk = C:\Program Files\Logitech\QuickCam\eReg.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Google Sidewiki... - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll (Google Inc.)
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll (Sun Microsystems, Inc.)
O9 - Extra Button: Researcher - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Program Files\Common Files\Microsoft Shared\Encarta Researcher\EROPROJ.DLL (Microsoft Corporation)
O9 - Extra Button: HP Smart Select - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} http://dlm.tools.aka...vex-2.2.4.1.cab (DLM Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_07)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 68.105.28.11 68.105.29.11 68.105.28.12
O18 - Protocol\Handler\msero {B0D92A71-886B-453B-A649-1B91F93801E7} - C:\Program Files\Common Files\Microsoft Shared\Encarta Researcher\MSERO.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O20 - Winlogon\Notify\GoToAssist: DllName - C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll - C:\Program Files\Citrix\GoToAssist\514\g2awinlogon.dll (Citrix Online, a division of Citrix Systems, Inc.)
O24 - Desktop WallPaper: C:\WINDOWS\Dell.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Dell.bmp
O32 - HKLM CDRom: AutoRun - 0
O32 - AutoRun File - [2008/04/25 14:29:32 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2008/04/14 05:00:00 | 00,000,110 | R--- | M] () - D:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\{7d50fdc6-ea55-11dd-b4aa-0022191ad20c}\Shell\AutoRun\command - "" = .\Encryption Tool\MaxtorEncryption.exe
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - comfile [open] -- "%1" %*
O35 - exefile [open] -- "%1" %*

[CREATERESTOREPOINT]
Restore point Set: OTL Restore Point (16891891626803200)

========== Files/Folders - Created Within 14 Days ==========

[2010/01/27 11:47:33 | 00,000,000 | ---D | C] -- C:\_OTL
[2010/01/27 11:45:32 | 00,791,393 | ---- | C] (Lars Hederer ) -- C:\Documents and Settings\William McNay\Desktop\erunt-setup.exe
[2010/01/26 16:02:47 | 00,000,000 | ---D | C] -- C:\Documents and Settings\William McNay\Application Data\Malwarebytes
[2010/01/26 16:02:43 | 00,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/01/26 16:02:42 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2010/01/26 16:02:41 | 00,019,160 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010/01/26 16:02:41 | 00,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010/01/26 16:01:20 | 00,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2010/01/26 16:00:51 | 00,000,000 | ---D | C] -- C:\Program Files\ERUNT
[2010/01/26 15:56:40 | 00,548,864 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\William McNay\Desktop\OTL.exe
[2010/01/26 15:56:36 | 05,115,824 | ---- | C] (Malwarebytes Corporation ) -- C:\Documents and Settings\William McNay\Desktop\mbam-setup.exe
[2010/01/26 15:56:08 | 00,791,393 | ---- | C] (Lars Hederer ) -- C:\Documents and Settings\William McNay\Desktop\erunt_setup.exe
[2010/01/26 15:28:31 | 00,000,000 | ---D | C] -- C:\WINDOWS\Prefetch
[2010/01/26 15:25:03 | 00,079,872 | ---- | C] (Ricoh Co., Ltd.) -- C:\WINDOWS\System32\dllcache\rwia330.dll
[2010/01/26 15:25:03 | 00,079,872 | ---- | C] (Ricoh Co., Ltd.) -- C:\WINDOWS\System32\dllcache\rwia001.dll
[2010/01/26 15:25:03 | 00,029,184 | ---- | C] (Ricoh Co., Ltd.) -- C:\WINDOWS\System32\dllcache\rw330ext.dll
[2010/01/26 15:24:12 | 00,057,856 | ---- | C] (SEIKO EPSON CORP.) -- C:\WINDOWS\System32\dllcache\esuimgd.dll
[2010/01/26 15:24:12 | 00,045,056 | ---- | C] (SEIKO EPSON CORP.) -- C:\WINDOWS\System32\dllcache\esunid.dll
[2010/01/26 15:24:12 | 00,031,744 | ---- | C] (SEIKO EPSON CORP.) -- C:\WINDOWS\System32\dllcache\esucmd.dll
[2010/01/26 15:23:59 | 00,054,528 | ---- | C] (Philips Semiconductors GmbH) -- C:\WINDOWS\System32\dllcache\cap7146.sys
[2010/01/26 08:03:59 | 00,000,000 | ---D | C] -- C:\WINDOWS\Dell
[2010/01/23 11:23:34 | 00,439,808 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\William McNay\Desktop\TFC.exe
[2009/11/03 17:24:46 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Temp
[2009/06/29 17:17:23 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Google
[2009/06/29 16:04:44 | 00,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Google
[2009/03/05 19:16:13 | 00,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Application Data\Microsoft
[2009/02/26 21:57:41 | 00,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\SupportSoft
[2009/02/06 19:19:30 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[2009/02/05 19:09:00 | 00,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Apple
[2009/01/27 17:42:49 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\TiVo Desktop
[2009/01/27 15:37:06 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\Roxio
[2009/01/04 23:52:36 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\NVIDIA Corporation
[2008/04/25 14:32:29 | 00,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
[2008/04/25 14:29:24 | 00,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Application Data\Microsoft

========== Files - Modified Within 14 Days ==========

[2010/01/27 15:37:00 | 00,000,886 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/01/27 12:11:14 | 00,004,212 | -H-- | M] () -- C:\WINDOWS\System32\zllictbl.dat
[2010/01/27 11:55:27 | 00,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/01/27 11:53:33 | 00,000,882 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/01/27 11:53:29 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010/01/27 11:53:23 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/01/27 11:53:22 | 00,003,568 | ---- | M] () -- C:\WINDOWS\System32\ativvaxx.cap
[2010/01/27 11:52:35 | 04,980,736 | -H-- | M] () -- C:\Documents and Settings\William McNay\NTUSER.DAT
[2010/01/27 11:52:35 | 00,000,178 | -HS- | M] () -- C:\Documents and Settings\William McNay\ntuser.ini
[2010/01/27 11:50:48 | 00,000,098 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\Hosts
[2010/01/27 11:43:46 | 03,838,616 | ---- | M] () -- C:\Documents and Settings\William McNay\Desktop\ComboFix2.exe
[2010/01/27 11:42:38 | 03,838,616 | ---- | M] () -- C:\Documents and Settings\William McNay\Desktop\ComboFix.exe
[2010/01/27 10:18:22 | 05,115,824 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\William McNay\Desktop\mbam-setup.exe
[2010/01/27 10:16:52 | 00,548,864 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\William McNay\Desktop\OTL.exe
[2010/01/27 10:16:34 | 00,009,334 | ---- | M] () -- C:\Documents and Settings\William McNay\Desktop\SysRestorePoint_v13.zip
[2010/01/27 10:16:06 | 00,791,393 | ---- | M] (Lars Hederer ) -- C:\Documents and Settings\William McNay\Desktop\erunt-setup.exe
[2010/01/26 16:02:45 | 00,000,738 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/01/26 16:01:52 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\7338.exe
[2010/01/26 16:00:51 | 00,000,653 | ---- | M] () -- C:\Documents and Settings\William McNay\Desktop\NTREGOPT.lnk
[2010/01/26 16:00:51 | 00,000,634 | ---- | M] () -- C:\Documents and Settings\William McNay\Desktop\ERUNT.lnk
[2010/01/26 15:35:11 | 00,526,522 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2010/01/26 15:35:11 | 00,444,230 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010/01/26 15:35:11 | 00,072,776 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010/01/26 15:27:48 | 00,879,128 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010/01/26 15:26:21 | 00,000,317 | ---- | M] () -- C:\WINDOWS\System32\$winnt$.inf
[2010/01/26 15:22:39 | 00,316,640 | ---- | M] () -- C:\WINDOWS\WMSysPr9.prx
[2010/01/26 15:22:38 | 00,023,392 | ---- | M] () -- C:\WINDOWS\System32\nscompat.tlb
[2010/01/26 15:22:38 | 00,016,832 | ---- | M] () -- C:\WINDOWS\System32\amcompat.tlb
[2010/01/26 15:22:28 | 00,004,328 | ---- | M] () -- C:\WINDOWS\ODBCINST.INI
[2010/01/26 15:21:29 | 00,000,488 | RH-- | M] () -- C:\WINDOWS\System32\WindowsLogon.manifest
[2010/01/26 15:21:29 | 00,000,488 | RH-- | M] () -- C:\WINDOWS\System32\logonui.exe.manifest
[2010/01/26 15:21:23 | 00,000,749 | RH-- | M] () -- C:\WINDOWS\System32\wuaucpl.cpl.manifest
[2010/01/26 15:21:23 | 00,000,749 | RH-- | M] () -- C:\WINDOWS\WindowsShell.Manifest
[2010/01/26 15:21:23 | 00,000,749 | RH-- | M] () -- C:\WINDOWS\System32\sapi.cpl.manifest
[2010/01/26 15:21:23 | 00,000,749 | RH-- | M] () -- C:\WINDOWS\System32\nwc.cpl.manifest
[2010/01/26 15:21:23 | 00,000,749 | RH-- | M] () -- C:\WINDOWS\System32\ncpa.cpl.manifest
[2010/01/26 15:21:23 | 00,000,749 | RH-- | M] () -- C:\WINDOWS\System32\cdplayer.exe.manifest
[2010/01/26 15:21:12 | 00,000,542 | ---- | M] () -- C:\WINDOWS\win.ini
[2010/01/26 15:20:07 | 00,023,444 | ---- | M] () -- C:\WINDOWS\System32\emptyregdb.dat
[2010/01/26 15:19:51 | 00,000,535 | ---- | M] () -- C:\WINDOWS\System32\mapisvc.inf
[2010/01/26 15:19:11 | 00,000,211 | -HS- | M] () -- C:\boot.ini
[2010/01/26 15:11:50 | 00,000,231 | ---- | M] () -- C:\WINDOWS\system.ini
[2010/01/23 11:20:12 | 00,436,450 | ---- | M] () -- C:\WINDOWS\setupapi.old
[2010/01/23 11:15:00 | 00,439,808 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\William McNay\Desktop\TFC.exe
[2010/01/23 11:06:34 | 00,284,915 | ---- | M] () -- C:\Documents and Settings\William McNay\Desktop\gmer.zip
[2010/01/23 11:04:30 | 00,791,393 | ---- | M] (Lars Hederer ) -- C:\Documents and Settings\William McNay\Desktop\erunt_setup.exe
[2010/01/23 06:52:30 | 00,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010/01/23 06:52:30 | 00,000,552 | ---- | M] () -- C:\WINDOWS\System32\d3d8caps.dat
[2010/01/23 03:16:53 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\drivers\lvuvc.hs
[2010/01/23 03:16:50 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\drivers\logiflt.iad
[2010/01/23 03:00:39 | 00,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2010/01/22 15:19:54 | 00,036,371 | ---- | M] () -- C:\Documents and Settings\William McNay\Desktop\Bill'sBP.doc
[2010/01/22 14:51:17 | 00,096,256 | ---- | M] () -- C:\Documents and Settings\William McNay\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/01/21 19:09:01 | 00,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/01/20 15:49:10 | 02,743,085 | ---- | M] () -- C:\Documents and Settings\William McNay\Desktop\Kindle User's Guide, 4A Ed. - English.pdf
[2010/01/14 03:17:49 | 00,004,096 | -HS- | M] () -- C:\VSNAP.IDX

========== Files Created - No Company Name ==========

[2010/01/27 11:46:11 | 00,009,334 | ---- | C] () -- C:\Documents and Settings\William McNay\Desktop\SysRestorePoint_v13.zip
[2010/01/27 11:45:30 | 03,838,616 | ---- | C] () -- C:\Documents and Settings\William McNay\Desktop\ComboFix.exe
[2010/01/27 11:45:29 | 03,838,616 | ---- | C] () -- C:\Documents and Settings\William McNay\Desktop\ComboFix2.exe
[2010/01/26 19:06:32 | 00,293,376 | ---- | C] () -- C:\Documents and Settings\William McNay\Desktop\gmer.exe
[2010/01/26 16:02:45 | 00,000,738 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/01/26 16:01:52 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\7338.exe
[2010/01/26 16:00:51 | 00,000,653 | ---- | C] () -- C:\Documents and Settings\William McNay\Desktop\NTREGOPT.lnk
[2010/01/26 16:00:51 | 00,000,634 | ---- | C] () -- C:\Documents and Settings\William McNay\Desktop\ERUNT.lnk
[2010/01/26 15:57:06 | 00,284,915 | ---- | C] () -- C:\Documents and Settings\William McNay\Desktop\gmer.zip
[2010/01/26 15:25:29 | 00,028,288 | ---- | C] () -- C:\WINDOWS\System32\dllcache\xjis.nls
[2010/01/26 15:24:58 | 00,083,748 | ---- | C] () -- C:\WINDOWS\System32\dllcache\prcp.nls
[2010/01/26 15:24:58 | 00,083,748 | ---- | C] () -- C:\WINDOWS\System32\dllcache\prc.nls
[2010/01/26 15:24:57 | 00,175,104 | ---- | C] () -- C:\WINDOWS\System32\dllcache\pintlcsa.dll
[2010/01/26 15:24:34 | 00,047,066 | ---- | C] () -- C:\WINDOWS\System32\dllcache\ksc.nls
[2010/01/26 15:24:33 | 01,158,818 | ---- | C] () -- C:\WINDOWS\System32\dllcache\korwbrkr.lex
[2010/01/26 15:24:27 | 00,196,665 | ---- | C] () -- C:\WINDOWS\System32\dllcache\imjpinst.exe
[2010/01/26 15:24:27 | 00,059,392 | ---- | C] () -- C:\WINDOWS\System32\dllcache\imscinst.exe
[2010/01/26 15:24:26 | 00,134,339 | ---- | C] () -- C:\WINDOWS\System32\dllcache\imekr.lex
[2010/01/26 15:24:20 | 13,463,552 | ---- | C] () -- C:\WINDOWS\System32\dllcache\hwxjpn.dll
[2010/01/26 15:24:17 | 00,108,827 | ---- | C] () -- C:\WINDOWS\System32\dllcache\hanja.lex
[2010/01/26 15:24:14 | 00,094,208 | ---- | C] () -- C:\WINDOWS\System32\dllcache\fpencode.dll
[2010/01/26 15:24:02 | 00,173,568 | ---- | C] () -- C:\WINDOWS\System32\dllcache\chtskf.dll
[2010/01/26 15:23:58 | 00,066,594 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_864.nls
[2010/01/26 15:23:58 | 00,066,594 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_862.nls
[2010/01/26 15:23:58 | 00,066,594 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_858.nls
[2010/01/26 15:23:58 | 00,066,594 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_720.nls
[2010/01/26 15:23:58 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_870.nls
[2010/01/26 15:23:58 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_708.nls
[2010/01/26 15:23:58 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_28596.nls
[2010/01/26 15:23:58 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_21027.nls
[2010/01/26 15:23:58 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_21025.nls
[2010/01/26 15:23:57 | 00,180,770 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20932.nls
[2010/01/26 15:23:57 | 00,177,698 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20949.nls
[2010/01/26 15:23:57 | 00,173,602 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20936.nls
[2010/01/26 15:23:57 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20924.nls
[2010/01/26 15:23:57 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20880.nls
[2010/01/26 15:23:57 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20871.nls
[2010/01/26 15:23:57 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20838.nls
[2010/01/26 15:23:57 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20833.nls
[2010/01/26 15:23:57 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20424.nls
[2010/01/26 15:23:57 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20423.nls
[2010/01/26 15:23:57 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20420.nls
[2010/01/26 15:23:57 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20297.nls
[2010/01/26 15:23:57 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20290.nls
[2010/01/26 15:23:57 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20285.nls
[2010/01/26 15:23:57 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20284.nls
[2010/01/26 15:23:57 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20280.nls
[2010/01/26 15:23:57 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20278.nls
[2010/01/26 15:23:57 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20277.nls
[2010/01/26 15:23:57 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20273.nls
[2010/01/26 15:23:56 | 00,189,986 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_1361.nls
[2010/01/26 15:23:56 | 00,187,938 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20005.nls
[2010/01/26 15:23:56 | 00,186,402 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20001.nls
[2010/01/26 15:23:56 | 00,185,378 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20003.nls
[2010/01/26 15:23:56 | 00,180,258 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20004.nls
[2010/01/26 15:23:56 | 00,180,258 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20000.nls
[2010/01/26 15:23:56 | 00,173,602 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20002.nls
[2010/01/26 15:23:56 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20269.nls
[2010/01/26 15:23:56 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20108.nls
[2010/01/26 15:23:56 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20107.nls
[2010/01/26 15:23:56 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20106.nls
[2010/01/26 15:23:56 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_20105.nls
[2010/01/26 15:23:55 | 00,195,618 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_10002.nls
[2010/01/26 15:23:55 | 00,177,698 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_10003.nls
[2010/01/26 15:23:55 | 00,173,602 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_10008.nls
[2010/01/26 15:23:55 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_1149.nls
[2010/01/26 15:23:55 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_1148.nls
[2010/01/26 15:23:55 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_1147.nls
[2010/01/26 15:23:55 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_1146.nls
[2010/01/26 15:23:55 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_1145.nls
[2010/01/26 15:23:55 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_1144.nls
[2010/01/26 15:23:55 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_1143.nls
[2010/01/26 15:23:55 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_1142.nls
[2010/01/26 15:23:55 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_1141.nls
[2010/01/26 15:23:55 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_1140.nls
[2010/01/26 15:23:55 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_1047.nls
[2010/01/26 15:23:55 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_10021.nls
[2010/01/26 15:23:55 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_10005.nls
[2010/01/26 15:23:55 | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_10004.nls
[2010/01/26 15:23:54 | 00,162,850 | ---- | C] () -- C:\WINDOWS\System32\dllcache\c_10001.nls
[2010/01/26 15:23:54 | 00,082,172 | ---- | C] () -- C:\WINDOWS\System32\dllcache\bopomofo.nls
[2010/01/26 15:23:53 | 00,066,728 | ---- | C] () -- C:\WINDOWS\System32\dllcache\big5.nls
[2010/01/26 15:21:29 | 00,000,488 | RH-- | C] () -- C:\WINDOWS\System32\logonui.exe.manifest
[2010/01/26 15:21:23 | 00,000,749 | RH-- | C] () -- C:\WINDOWS\System32\wuaucpl.cpl.manifest
[2010/01/26 15:21:23 | 00,000,749 | RH-- | C] () -- C:\WINDOWS\WindowsShell.Manifest
[2010/01/26 15:21:23 | 00,000,749 | RH-- | C] () -- C:\WINDOWS\System32\sapi.cpl.manifest
[2010/01/26 15:21:23 | 00,000,749 | RH-- | C] () -- C:\WINDOWS\System32\nwc.cpl.manifest
[2010/01/26 15:21:23 | 00,000,749 | RH-- | C] () -- C:\WINDOWS\System32\ncpa.cpl.manifest
[2010/01/26 15:11:38 | 01,296,669 | ---- | C] () -- C:\WINDOWS\System32\dllcache\SP3.CAT
[2010/01/26 15:11:38 | 00,797,189 | ---- | C] () -- C:\WINDOWS\System32\dllcache\NT5IIS.CAT
[2010/01/26 15:11:38 | 00,399,645 | ---- | C] () -- C:\WINDOWS\System32\dllcache\MAPIMIG.CAT
[2010/01/26 15:11:38 | 00,144,484 | ---- | C] () -- C:\WINDOWS\System32\dllcache\netfx.cat
[2010/01/26 15:11:38 | 00,112,918 | ---- | C] () -- C:\WINDOWS\System32\dllcache\tabletpc.cat
[2010/01/26 15:11:38 | 00,037,484 | ---- | C] () -- C:\WINDOWS\System32\dllcache\MW770.CAT
[2010/01/26 15:11:38 | 00,034,747 | ---- | C] () -- C:\WINDOWS\System32\dllcache\mediactr.cat
[2010/01/26 15:11:38 | 00,034,063 | ---- | C] () -- C:\WINDOWS\System32\dllcache\FP4.CAT
[2010/01/26 15:11:38 | 00,026,991 | ---- | C] () -- C:\WINDOWS\System32\dllcache\msn7.cat
[2010/01/26 15:11:38 | 00,016,535 | ---- | C] () -- C:\WINDOWS\System32\dllcache\IMS.CAT
[2010/01/26 15:11:38 | 00,014,433 | ---- | C] () -- C:\WINDOWS\System32\dllcache\msn9.cat
[2010/01/26 15:11:38 | 00,013,472 | ---- | C] () -- C:\WINDOWS\System32\dllcache\HPCRDP.CAT
[2010/01/26 15:11:38 | 00,012,363 | ---- | C] () -- C:\WINDOWS\System32\dllcache\MSMSGS.CAT
[2010/01/26 15:11:38 | 00,010,027 | ---- | C] () -- C:\WINDOWS\System32\dllcache\MSTSWEB.CAT
[2010/01/26 15:11:38 | 00,008,574 | ---- | C] () -- C:\WINDOWS\System32\dllcache\IASNT4.CAT
[2010/01/26 15:11:38 | 00,007,710 | ---- | C] () -- C:\WINDOWS\System32\dllcache\OEMBIOS.CAT
[2010/01/26 15:11:38 | 00,007,334 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wmerrenu.cat
[2010/01/26 15:11:37 | 02,144,487 | ---- | C] () -- C:\WINDOWS\System32\dllcache\NT5.CAT
[2010/01/26 15:11:37 | 00,522,220 | ---- | C] () -- C:\WINDOWS\System32\dllcache\NT5INF.CAT
[2010/01/23 06:52:30 | 00,000,552 | ---- | C] () -- C:\WINDOWS\System32\d3d8caps.dat
[2010/01/20 15:49:10 | 02,743,085 | ---- | C] () -- C:\Documents and Settings\William McNay\Desktop\Kindle User's Guide, 4A Ed. - English.pdf
[2009/11/04 13:57:32 | 00,000,696 | ---- | C] () -- C:\Documents and Settings\William McNay\Application Data\wklnhst.dat
[2009/08/03 16:52:18 | 00,082,289 | ---- | C] () -- C:\WINDOWS\System32\lvcoinst.ini
[2009/08/03 15:07:42 | 00,403,816 | ---- | C] () -- C:\WINDOWS\System32\OGACheckControl.dll
[2009/06/29 16:08:10 | 00,000,167 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
[2009/06/20 14:23:29 | 00,000,021 | ---- | C] () -- C:\WINDOWS\atid.ini
[2009/06/17 16:40:19 | 00,036,864 | ---- | C] () -- C:\WINDOWS\System32\msvcvm20.dll
[2009/06/17 16:39:17 | 00,217,088 | ---- | C] () -- C:\WINDOWS\System32\testOCXmfc_.dll
[2009/06/17 16:39:02 | 00,315,392 | ---- | C] () -- C:\WINDOWS\System32\bvid21.dll
[2009/06/11 08:26:14 | 00,000,000 | ---- | C] () -- C:\WINDOWS\hpqEmlSz.INI
[2009/06/05 18:48:42 | 00,215,144 | R--- | C] () -- C:\WINDOWS\patchw32.dll
[2009/06/05 18:47:35 | 00,215,144 | R--- | C] () -- C:\WINDOWS\pw32a.dll
[2009/05/11 18:57:29 | 00,000,000 | ---- | C] () -- C:\Documents and Settings\William McNay\Local Settings\Application Data\rx_image32.Cache
[2009/05/08 10:13:04 | 00,013,584 | ---- | C] () -- C:\WINDOWS\System32\drivers\iKeyLFT2.dll
[2009/04/30 16:00:12 | 00,025,624 | ---- | C] () -- C:\WINDOWS\System32\drivers\LVPr2Mon.sys
[2009/02/19 17:36:21 | 00,096,256 | ---- | C] () -- C:\Documents and Settings\William McNay\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/01/26 17:41:40 | 00,000,000 | ---- | C] () -- C:\WINDOWS\OpPrintServer.INI
[2009/01/25 17:44:20 | 00,004,138 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\hpzinstall.log
[2009/01/24 11:45:32 | 00,000,136 | ---- | C] () -- C:\Documents and Settings\William McNay\Local Settings\Application Data\fusioncache.dat
[2009/01/05 01:40:40 | 00,001,154 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2009/01/05 00:10:19 | 00,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2008/04/25 14:26:32 | 00,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
[2008/04/13 22:42:04 | 00,363,520 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2006/04/30 00:34:04 | 00,049,152 | ---- | C] () -- C:\WINDOWS\System32\WbxRMenu.dll
[2006/04/13 23:18:24 | 00,196,608 | ---- | C] () -- C:\WINDOWS\System32\atonres.dll
[2006/04/13 23:18:24 | 00,131,072 | ---- | C] () -- C:\WINDOWS\System32\WbxMSAI.dll
[2006/04/13 23:18:24 | 00,098,304 | ---- | C] () -- C:\WINDOWS\System32\atonecli.dll

========== LOP Check ==========

[2009/06/20 14:23:05 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\acccore
[2010/01/01 16:52:39 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AIM
[2009/02/20 17:11:08 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Broderbund Software
[2009/01/29 14:28:07 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\espionServerData
[2009/11/07 08:02:29 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Kaspersky SDK
[2009/01/24 13:00:36 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MailFrontier
[2009/08/01 15:15:39 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PC Drivers HeadQuarters
[2009/01/05 00:05:30 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PC-Doctor
[2009/01/05 00:05:30 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PCDr
[2009/01/27 15:02:57 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SmartSound Software Inc
[2009/01/05 00:05:32 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SupportSoft
[2009/01/27 17:43:08 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TiVo
[2009/01/27 15:15:49 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Uninstall
[2009/08/02 17:28:06 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint
[2009/04/02 14:39:50 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
[2009/09/10 19:30:54 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2009/04/30 19:37:04 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2009/06/20 14:24:44 | 00,000,000 | ---D | M] -- C:\Documents and Settings\William McNay\Application Data\acccore
[2009/08/02 17:54:54 | 00,000,000 | ---D | M] -- C:\Documents and Settings\William McNay\Application Data\AIM
[2009/11/07 07:39:21 | 00,000,000 | ---D | M] -- C:\Documents and Settings\William McNay\Application Data\CheckPoint
[2009/09/24 16:00:36 | 00,000,000 | ---D | M] -- C:\Documents and Settings\William McNay\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2009/06/20 13:34:48 | 00,000,000 | ---D | M] -- C:\Documents and Settings\William McNay\Application Data\Leadertech
[2009/01/25 15:40:38 | 00,000,000 | ---D | M] -- C:\Documents and Settings\William McNay\Application Data\MailFrontier
[2009/04/13 17:09:09 | 00,000,000 | ---D | M] -- C:\Documents and Settings\William McNay\Application Data\Template

========== Purity Check ==========



========== Custom Scans ==========


< :Reg >

< [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] >

< "Shell"="explorer.exe" >

< "Userinit"="C:\\WINDOWS\\system32\\Userinit.exe," >

< [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System] >

< "DisableTaskMgr"=- >

< [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] >

< "DisableTaskMgr"=- >

< [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] >

< "NoSetActiveDesktop"=- >

< "NoActiveDesktopChanges"=- >

< [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] >

< "NoSetActiveDesktop"=- >

< "NoActiveDesktopChanges"=- >

< >

< :Files >

< helper32.dll /lsp >
Invalid Switch: lsp

< winhelper86.dll /lsp >
Invalid Switch: lsp


< %HOMEDRIVE%\Internet Security 2010.lnk /s >
[2010/01/23 09:34:29 | 00,000,828 | ---- | M] () -- C:\_OTL\MovedFiles\01272010_114733\C_WINDOWS\system32\config\systemprofile\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Security 2010.lnk
[2010/01/23 09:34:29 | 00,000,810 | ---- | M] () -- C:\_OTL\MovedFiles\01272010_114733\C_WINDOWS\system32\config\systemprofile\Desktop\Internet Security 2010.lnk
[2010/01/23 09:34:29 | 00,000,810 | ---- | M] () -- C:\_OTL\MovedFiles\01272010_114733\C_WINDOWS\system32\config\systemprofile\Start Menu\Internet Security 2010.lnk

< %systemroot%\System32\winlogon32.exe >

< %systemroot%\System32\smss32.exe >

< %systemroot%\System32\AVR10.exe >

< %systemroot%\System32\helper32.dll >

< %systemroot%\System32\winlogon32.exe >

< %systemroot%\System32\smss32.exe >

< %systemroot%\System32\warning.html >

< %systemroot%\system32\IS15.exe >

< %systemroot%\System32\winhelper86.dll >

< %HOMEDRIVE%\trhh.exe >

< %HOMEDRIVE%\sdigdvmg.exe >

< %HOMEDRIVE%\wgqi.exe >

< %HOMEDRIVE%\byyk.exe >

< %systemroot%\lsass.exe >

< %systemroot%\odbn0.exe >

< %systemroot%\System32\sdra64.exe >

< %systemroot%\System32\41.exe >

< %systemroot%\System32\153.exe >

< %systemroot%\System32\292.exe >

< %systemroot%\System32\491.exe >

< %systemroot%\System32\1869.exe >

< %systemroot%\system32\2876.exe >

< %systemroot%\System32\2995.exe >

< %systemroot%\System32\3902.exe >

< %systemroot%\System32\4827.exe >

< %systemroot%\System32\5436.exe >

< %systemroot%\System32\5447.exe >

< %systemroot%\System32\5705.exe >

< %systemroot%\System32\6334.exe >

< %systemroot%\System32\7376.exe >

< %systemroot%\System32\9961.exe >

< %systemroot%\System32\11478.exe >

< %systemroot%\System32\11538.exe >

< %systemroot%\System32\11942.exe >

< %systemroot%\System32\12382.exe >

< %systemroot%\system32\12662.exe >

< %systemroot%\System32\13931.exe >

< %systemroot%\system32\14070.exe >

< %systemroot%\System32\14604.exe >

< %systemroot%\System32\14771.exe >

< %systemroot%\System32\15724.exe >

< %systemroot%\System32\16827.exe >

< %systemroot%\System32\16944.exe >

< %systemroot%\system32\17125.exe >

< %systemroot%\System32\17421.exe >

< %systemroot%\System32\18467.exe >

< %systemroot%\System32\18716.exe >

< %systemroot%\System32\19169.exe >

< %systemroot%\System32\19718.exe >

< %systemroot%\System32\19895.exe >

< %systemroot%\system32\19905.exe >

< %systemroot%\System32\19912.exe >

< %systemroot%\system32\21386.exe >

< %systemroot%\System32\21726.exe >

< %systemroot%\system32\22934.exe >

< %systemroot%\System32\23281.exe >

< %systemroot%\system32\24242.exe >

< %systemroot%\System32\24464.exe >

< %systemroot%\system32\24478.exe >

< %systemroot%\System32\26308.exe >

< %systemroot%\System32\26500.exe >

< %systemroot%\System32\26962.exe >

< %systemroot%\system32\27213.exe >

< %systemroot%\System32\28145.exe >

< %systemroot%\system32\28466.exe >

< %systemroot%\System32\29358.exe >

< %systemroot%\System32\32391.exe >

< %systemroot%\System32\32439.exe >

< %systemroot%\system32\ndisdrv.sys >

< %HOMEDRIVE%\s >

< %systemroot%\system32\kbdsock.dll >

< %systemroot%\system32\mshlps.dll >

< %systemroot%\system32\drivers\kdrhkukb.sys >

< %PROGRAMFILES%\InternetSecurity2010 >

< %systemroot%\System32\lowsec >

< >

< :Services >

< lmuytnv >

< ndisdrv >

< qvazdxe >

< >

< :Commands >

< [purity] >

< [resethosts] >

< [emptytemp] >

< End of report >


otl quick scan output

[Rorschach112]

hi

Please download OTM

• Save it to your desktop.
• Please double-click OTM to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
• Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  

  :Processes
  
  :Services
  
  :Reg
  
  :Files
  C:\WINDOWS\System32\7338.exe
  :Commands
  [purity]
  [resethosts]
  [emptytemp]
  [Reboot]

• Return to OTM, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
  
• Click the red Moveit! button.
• Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
• Close OTM and reboot your PC.

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.



Download TFC to your desktop

• Open the file and close any other windows.
• It will close all programs itself when run, make sure to let it run uninterrupted.
• Click the Start button to begin the process. The program should not take long to finish its job
• Once its finished it should reboot your machine, if not, do this yourself to ensure a complete clean

Please download Malwarebytes' Anti-Malware from Here

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
• The scan may take some time to finish,so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected.
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy&Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.






Go to Kaspersky website and perform an online antivirus scan.

• Read through the requirements and privacy statement and click on Accept button.
• It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
• When the downloads have finished, click on Settings.
• Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
  • Spyware, Adware, Dialers, and other potentially dangerous programs
    Archives
    Mail databases
• Click on My Computer under Scan.
• Once the scan is complete, it will display the results. Click on View Scan Report.
• You will see a list of infected items there. Click on Save Report As....
• Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button. Then post it here.

[nohwpro]

Desk top came up with active desktop recovery. The contents of the log file was
All processes killed
========== PROCESSES ==========
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
C:\WINDOWS\System32\7338.exe moved successfully.
========== COMMANDS ==========
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: LocalService
->Temp folder emptied: 65984 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Ruth McNay
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: William McNay
->Temp folder emptied: 694990 bytes
->Temporary Internet Files folder emptied: 46994 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 41924563 bytes
->Google Chrome cache emptied: 0 bytes
->Apple Safari cache emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 417770 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 41.00 mb


OTM by OldTimer - Version 3.1.7.0 log created on 01272010_173234

Files moved on Reboot...
C:\Documents and Settings\William McNay\Local Settings\Temp\~DFCA46.tmp moved successfully.
File C:\WINDOWS\temp\av1.tmp not found!
C:\WINDOWS\temp\iswift.dat moved successfully.
C:\WINDOWS\temp\sfdb.dat moved successfully.
File C:\WINDOWS\temp\ZLT06608.TMP not found!

Registry entries deleted on Reboot...


That showed on the screen after reboot.

that status program keeps trying, I have to kill it every time we reboot. Moving on to next step you gave me.

thank you so much

[nohwpro]

Malwarebytes Log:

Malwarebytes' Anti-Malware 1.44
Database version: 3648
Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

1/27/2010 9:25:53 PM
mbam-log-2010-01-27 (21-25-53).txt

Scan type: Quick Scan
Objects scanned: 132177
Time elapsed: 3 minute(s), 49 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)


Moving on to Kaspersky online scan.

Thank you.

[nohwpro]

Kapersky Scan output:

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0: scan report
Thursday, January 28, 2010
Operating system: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Thursday, January 28, 2010 04:38:36
Records in database: 3378916
--------------------------------------------------------------------------------

Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\
H:\
I:\

Scan statistics:
Objects scanned: 503936
Threats found: 3
Infected objects found: 3
Suspicious objects found: 0
Scan duration: 04:47:23


File name / Threat / Threats count
C:\System Volume Information\_restore{45B5E8B9-949A-471E-999D-F381DA56A2D3}\RP0\A0000009.exe Infected: Trojan-Downloader.Win32.FraudLoad.wxss 1
H:\RuthD\Old Computer\Documents and Settings\Default\Local Settings\Application Data\Microsoft\Outlook\outlook.pst Infected: Trojan-Spy.HTML.Bayfraud.hn 1
H:\RuthD\Old Computer\Program Files\Support.com\backup\Fr\Friends\2608324_5f2b78927_ Infected: Email-Worm.VBS.KakWorm 1

Selected area has been scanned.


Thank You Very Much. I was afraid we were going to have to wipe the computer and lose everything.

Now what next?