Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Windows restore virus

Started by griruco , May 02 2011 08:11 AM

This topic is locked

#1
griruco

Posted 02 May 2011 - 08:11 AM

Member

Member
74 posts

I have encountered the "windows restore virus" It has hidden desktop icons, except in safe mode. RAM and HD space is apparently running at critical leves. Malware is inactivated. I'm not sure where to start to disinfect. The system is a Pentium 1400mHz, 1.39GHz, 512 MB RAM using Windows XP pro 2002 SP-3.Thank you for your help.

OTL logfile created on: 5/2/2011 8:59:43 AM - Run 2
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Administrator\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

510.00 Mb Total Physical Memory | 323.00 Mb Available Physical Memory | 63.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 90.00% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 27.91 Gb Total Space | 11.63 Gb Free Space | 41.67% Space Free | Partition Type: NTFS
Drive E: | 3.73 Gb Total Space | 3.72 Gb Free Space | 99.95% Space Free | Partition Type: FAT32

Computer Name: JOHNNY | User Name: ja3756 | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/05/02 09:26:24 | 000,580,608 | ---- | M] (OldTimer Tools) -- E:\OTL.exe
PRC - [2011/05/02 09:26:24 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Administrator\Desktop\OTL.exe
PRC - [2011/04/11 01:14:28 | 000,419,840 | ---- | M] (Igor Pavlov) -- C:\Program Files\7-Zip\7zFM.exe
PRC - [2008/04/13 19:12:19 | 001,033,728 | -H-- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe

========== Modules (SafeList) ==========

MOD - [2011/05/02 09:26:24 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Administrator\Desktop\OTL.exe
MOD - [2010/08/23 11:12:02 | 001,054,208 | -H-- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll

========== Win32 Services (SafeList) ==========

SRV - [2007/04/23 04:12:52 | 000,336,944 | -H-- | M] (Cisco Systems, Inc.) [Auto | Stopped] -- C:\Program Files\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe -- (vpnagent)
SRV - [2006/04/20 08:34:26 | 001,520,688 | -H-- | M] (Cisco Systems, Inc.) [Auto | Stopped] -- C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe -- (CVPND)
SRV - [2005/05/27 09:12:38 | 000,073,728 | -H-- | M] () [Auto | Stopped] -- c:\alice5\exe\asw_service.exe -- (AliceSleepware)
SRV - [2004/05/27 01:14:58 | 000,053,337 | -H-- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe -- (PACSPTISVR)
SRV - [2004/05/27 01:13:00 | 000,069,718 | -H-- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe -- (SPTISRV)
SRV - [2003/11/13 13:29:40 | 000,452,608 | -H-- | M] () [Auto | Stopped] -- C:\Program Files\Linksys\Wireless-N Network Monitor\NICServ.exe -- (NICSer_WPC300N)
SRV - [2003/08/21 17:06:56 | 000,245,760 | -H-- | M] (Networks Associates Technology, Inc) [On_Demand | Stopped] -- C:\Program Files\McAfee.com\Agent\mcupdmgr.exe -- (mcupdmgr.exe)
SRV - [2003/08/08 17:04:38 | 000,106,496 | -H-- | M] (Networks Associates Technology, Inc) [Auto | Stopped] -- c:\Program Files\McAfee.com\VSO\mcvsrte.exe -- (MCVSRte)
SRV - [2003/04/29 15:29:54 | 000,139,264 | -H-- | M] (Intel® Corporation) [On_Demand | Stopped] -- C:\Program Files\Intel\NCS\Sync\NetSvc.exe -- (NetSvc)
SRV - [2002/03/13 08:50:34 | 000,225,375 | -H-- | M] () [On_Demand | Stopped] -- c:\Program Files\McAfee.com\VSO\McShield.exe -- (McShield)

========== Driver Services (SafeList) ==========

DRV - [2010/01/25 11:38:27 | 000,816,672 | RH-- | M] (Ralink Technology, Corp.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\AE1000XP.sys -- (AE1000)
DRV - [2008/04/13 13:56:49 | 000,012,800 | -H-- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\usb8023.sys -- (USB_RNDIS_XP)
DRV - [2008/04/13 13:56:06 | 000,088,320 | -H-- | M] (Microsoft Corporation) [Kernel | Auto | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\nwlnkipx.sys -- (NwlnkIpx)
DRV - [2008/04/13 13:36:41 | 000,063,744 | -H-- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\mf.sys -- (mf)
DRV - [2007/04/23 04:09:58 | 000,024,176 | -H-- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\vpnva.sys -- (vpnva)
DRV - [2007/03/22 12:57:14 | 000,028,672 | --S- | M] (Gteko Ltd.) [Kernel | Auto | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\elagopro.sys -- (elagopro)
DRV - [2007/03/22 12:57:14 | 000,005,376 | --S- | M] (Gteko Ltd.) [Kernel | Auto | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\elaunidr.sys -- (elaunidr)
DRV - [2006/04/24 23:51:08 | 000,543,104 | -H-- | M] (Linksys, A Division of Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\BCMWL5.SYS -- (BCM43XX)
DRV - [2006/04/20 08:33:40 | 000,303,740 | -H-- | M] (Cisco Systems, Inc.) [Kernel | Auto | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\CVPNDRVA.sys -- (CVPNDRVA)
DRV - [2005/06/29 19:50:30 | 000,110,080 | -H-- | M] (Deterministic Networks, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\dne2000.sys -- (DNE)
DRV - [2005/05/18 13:52:56 | 000,173,056 | -H-- | M] (Funk Software, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\odysseyIM4.sys -- (odysseyIM4)
DRV - [2005/05/17 04:51:34 | 000,005,315 | -H-- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\CVirtA.sys -- (CVirtA)
DRV - [2005/03/03 12:23:08 | 000,023,040 | -H-- | M] (Iomega) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\IABFilt.sys -- (IABFilt)
DRV - [2005/01/26 06:22:20 | 000,280,344 | -H-- | M] (Zone Labs LLC) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\vsdatant.sys -- (vsdatant)
DRV - [2004/08/04 00:29:49 | 000,019,455 | -H-- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\wvchntxx.sys -- (iAimFP4)
DRV - [2004/08/04 00:29:47 | 000,012,063 | -H-- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\wsiintxx.sys -- (iAimFP3)
DRV - [2004/08/04 00:29:45 | 000,023,615 | -H-- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\wch7xxnt.sys -- (iAimTV4)
DRV - [2004/08/04 00:29:43 | 000,033,599 | -H-- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\watv04nt.sys -- (iAimTV3)
DRV - [2004/08/04 00:29:42 | 000,019,551 | -H-- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\watv02nt.sys -- (iAimTV1)
DRV - [2004/08/04 00:29:41 | 000,029,311 | -H-- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\watv01nt.sys -- (iAimTV0)
DRV - [2004/08/04 00:29:37 | 000,012,415 | -H-- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\wadv01nt.sys -- (iAimFP0)
DRV - [2004/08/04 00:29:37 | 000,012,127 | -H-- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\wadv02nt.sys -- (iAimFP1)
DRV - [2004/08/04 00:29:37 | 000,011,775 | -H-- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\wadv05nt.sys -- (iAimFP2)
DRV - [2004/08/04 00:29:36 | 000,161,020 | -H-- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\i81xnt5.sys -- (i81x)
DRV - [2003/12/14 23:13:06 | 000,008,552 | -H-- | M] (Windows ® 2000 DDK provider) [Kernel | Auto | Stopped] -- C:\WINDOWS\System32\drivers\asctrm.sys -- (ASCTRM)
DRV - [2003/11/28 10:35:33 | 000,206,464 | -H-- | M] (Roxio) [File_System | System | Running] -- C:\WINDOWS\System32\drivers\udfreadr_xp.sys -- (UdfReadr_xp)
DRV - [2003/11/28 10:35:33 | 000,143,834 | -H-- | M] (Roxio) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\pwd_2K.sys -- (pwd_2k)
DRV - [2003/11/28 10:35:33 | 000,030,630 | -H-- | M] (Roxio) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\Mmc_2k.sys -- (mmc_2K)
DRV - [2003/11/28 10:35:33 | 000,025,898 | -H-- | M] (Roxio) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\Dvd_2k.sys -- (dvd_2K)
DRV - [2003/07/16 22:28:02 | 000,017,142 | -H-- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\CBTNDIS5.SYS -- (CBTNDIS5)
DRV - [2003/06/10 22:35:58 | 000,093,700 | -H-- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\Apfiltr.sys -- (ApfiltrService)
DRV - [2003/05/30 19:45:16 | 000,477,403 | -H-- | M] (PCtel, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\vpctcom.sys -- (Vpctcom)
DRV - [2003/05/30 18:50:46 | 000,690,973 | -H-- | M] (PCTEL, INC.) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\vmodem.sys -- (Vmodem)
DRV - [2003/05/28 13:08:12 | 000,066,111 | -H-- | M] (PCtel, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\vvoice.sys -- (Vvoice)
DRV - [2003/04/25 18:10:52 | 000,220,176 | -H-- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\STAC97.sys -- (STAC97) Audio Driver (WDM)
DRV - [2003/02/24 16:30:02 | 000,135,292 | -H-- | M] (PCTEL, INC.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\ptserial.sys -- (Ptserial)
DRV - [2003/02/15 01:12:20 | 000,032,311 | -H-- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\wa301b.sys -- ({E2B953A7-195A-44F9-9BA3-3D5F4E32BB55})
DRV - [2003/02/15 01:12:20 | 000,032,311 | -H-- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\wa301a.sys -- ({E2B953A6-195A-44F9-9BA3-3D5F4E32BB55})
DRV - [2003/01/10 17:13:04 | 000,033,588 | -H-- | M] (America Online, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\wanatw4.sys -- (wanatw) WAN Miniport (ATW)
DRV - [2003/01/07 16:19:26 | 000,017,217 | -H-- | M] (Dell Computer Corporation) [Kernel | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\omci.sys -- (omci)
DRV - [2002/12/17 13:32:58 | 000,061,424 | -H-- | M] (Roxio) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\cdr4_xp.sys -- (Cdr4_xp)
DRV - [2002/12/17 13:32:46 | 000,023,436 | -H-- | M] (Roxio) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\cdralw2k.sys -- (Cdralw2k)
DRV - [2002/12/17 13:27:32 | 000,241,152 | -H-- | M] (Roxio) [File_System | System | Running] -- C:\WINDOWS\System32\drivers\cdudf_xp.sys -- (cdudf_xp)
DRV - [2002/11/22 21:01:26 | 000,020,096 | -H-- | M] (Intel Corporation ) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\iqvw32.sys -- (NAL)
DRV - [2002/11/18 18:20:44 | 000,030,976 | -H-- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\gv3.sys -- (gv3)
DRV - [2002/08/29 06:00:00 | 000,063,232 | -H-- | M] (Microsoft Corporation) [Kernel | Auto | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\NWLNKNB.SYS -- (NwlnkNb)
DRV - [2002/08/29 06:00:00 | 000,055,936 | -H-- | M] (Microsoft Corporation) [Kernel | Auto | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\NWLNKSPX.SYS -- (NwlnkSpx)
DRV - [2002/06/19 03:16:02 | 000,011,840 | -H-- | M] (Roxio) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\MRFilter.sys -- (MrFilter)
DRV - [2002/03/13 08:50:36 | 000,023,296 | -H-- | M] () [File_System | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\NaiFiltr.sys -- (NaiFiltr)
DRV - [2001/08/17 13:12:12 | 000,002,944 | -H-- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\BrFilt.sys -- (brfilt)
DRV - [2001/08/17 13:11:06 | 000,066,591 | -H-- | M] (3Com Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\EL90XBC5.SYS -- (EL90XBC)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

O1 HOSTS File: ([2011/04/09 13:09:26 | 000,000,888 | RH-- | M]) - C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts
O1 - Hosts: 209.172.52.73 www.google.com
O1 - Hosts: 209.172.52.74 search.yahoo.com
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: () - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (AcroIEToolbarHelper Class) - {AE7CD045-E861-484f-8273-0445EE161910} - c:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll ()
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - c:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll ()
O3 - HKLM\..\Toolbar: (McAfee VirusScan) - {BA52B914-B692-46c4-B683-905236F6F655} - c:\Program Files\McAfee.com\VSO\mcvsshl.dll (Networks Associates Technology, Inc)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\ShellBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - c:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - c:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [AdaptecDirectCD] C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe ()
O4 - HKLM..\Run: [Adobe Photo Downloader] C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe ()
O4 - HKLM..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe ()
O4 - HKLM..\Run: [BearShare] File not found
O4 - HKLM..\Run: [cleanhdd] C:\Documents and Settings\ja3756\Application Data\cleanhdd.exe ()
O4 - HKLM..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe (Brother Industries, Ltd.)
O4 - HKLM..\Run: [DVDSentry] C:\WINDOWS\SYSTEM32\DSentry.exe (Dell - Advanced Desktop Engineering)
O4 - HKLM..\Run: [ezShieldProtector for Px] C:\WINDOWS\SYSTEM32\ezSP_Px.exe (Easy Systems Japan Ltd.)
O4 - HKLM..\Run: [IndexSearch] C:\Program Files\Dell\Dell Laser MFP 1600n\PaperPort\IndexSearch.exe ()
O4 - HKLM..\Run: [Linksys Wireless-N Notebook Adapter] C:\Program Files\Linksys\Wireless-N Network Monitor\WPC300N.exe ()
O4 - HKLM..\Run: [MCAgentExe] c:\Program Files\McAfee.com\Agent\mcagent.exe ()
O4 - HKLM..\Run: [MCUpdateExe] C:\Program Files\McAfee.com\Agent\McUpdate.exe ()
O4 - HKLM..\Run: [PaperPort PTD] C:\Program Files\Dell\Dell Laser MFP 1600n\PaperPort\pptd40nt.exe ()
O4 - HKLM..\Run: [PCTVOICE] C:\WINDOWS\System32\pctspk.exe ()
O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\qttask .exe ()
O4 - HKLM..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [VirusScan Online] c:\Program Files\McAfee.com\VSO\mcvsshld.exe ()
O4 - HKLM..\Run: [VSOCheckTask] c:\Program Files\McAfee.com\VSO\mcmnhdlr.exe ()
O4 - HKCU..\Run: [EasyLinkAdvisor] C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe ()
O4 - HKCU..\Run: [Iomega Automatic Backup Pro] File not found
O4 - HKCU..\Run: [MsnMsgr] File not found
O4 - HKCU..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe ()
O4 - HKCU..\Run: [XFPwmcpwlYCi] C:\Documents and Settings\All Users\Application Data\XFPwmcpwlYCi.exe ()
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Cisco Systems VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\vpngui.exe (Cisco Systems, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe (Intuit Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableCAD = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\SYSTEM32\nwprovau.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKCU\..Trusted Domains: ([]msn in My Computer)
O15 - HKCU\..Trusted Domains: ameritrade.com ([]https in Trusted sites)
O15 - HKCU\..Trusted Domains: aol.com ([objects] * is out of zone range - 5)
O15 - HKCU\..Trusted Domains: tdameritrade.com ([]https in Trusted sites)
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} http://download.av.a...77/mcinsctl.cab (McAfee.com Operating System Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.mi...b?1192329505873 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.4.2)
O16 - DPF: {9059F30F-4EB1-4BD2-9FDC-36F43A218F4A} http://206.30.161.128/tsweb/msrdp.cab (Microsoft RDP Client Control (redist))
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} http://messenger.msn...pDownloader.cab (MsnMessengerSetupDownloadControl Class)
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} http://download.av.a...,18/mcgdmgr.cab (DwnldGroupMgr Class)
O16 - DPF: {CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.4.2)
O16 - DPF: {D1ACD2D8-7312-4D06-BECD-90EB094D2277} http://mediaplayer.w...ler/install.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 74.128.17.114 74.128.19.102
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: GinaDLL - (VPNGina.dll) - C:\WINDOWS\System32\vpngina.dll (Cisco Systems, Inc.)
O20 - Winlogon\Notify\glowext: DllName - C:\Documents and Settings\NetworkService\Local Settings\Application Data\glowext.dll - C:\Documents and Settings\NetworkService\Local Settings\Application Data\glowext.dll ()
O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\ja3756\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\ja3756\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2002/09/03 14:36:02 | 000,000,000 | -H-- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/05/02 08:39:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\7-Zip
[2011/05/02 08:39:54 | 000,000,000 | ---D | C] -- C:\Program Files\7-Zip
[2011/05/02 08:31:48 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\ja3756\Recent
[2011/04/10 08:51:25 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\ja3756\Start Menu\Programs\Windows Restore
[2011/04/10 07:38:15 | 000,050,000 | -H-- | C] (ООО Закриптуй) -- C:\WINDOWS\System32\a98ms7aca.dll
[2011/04/10 07:34:56 | 000,000,000 | -H-D | C] -- C:\Temp
[2011/04/10 07:34:46 | 000,557,056 | -H-- | C] (GPA) -- C:\Documents and Settings\All Users\Application Data\XFPwmcpwlYCi .exe
[2011/04/10 07:34:42 | 000,062,976 | -HS- | C] (Microsoft Corporation) -- C:\Documents and Settings\ja3756\Application Data\cleanhdd .exe
[2011/04/10 07:34:42 | 000,053,760 | -HS- | C] (Microsoft Corporation) -- C:\Documents and Settings\ja3756\Application Data\cleanhdd.dll
[2011/04/10 07:33:15 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\NetworkService\Application Data\AdobeUM
[2011/04/10 07:30:48 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Adobe
[2011/04/10 07:30:26 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\NetworkService\Application Data\Sun
[2011/04/09 08:39:27 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\NetworkService\Application Data\Adobe
[2011/04/08 17:34:05 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\NetworkService\Application Data\Apple Computer
[2008/03/14 23:39:47 | 045,144,176 | -H-- | C] (SleepEx Systems, Inc. ) -- C:\Program Files\SleepEx.2.3.build.2.3.0.17.Install.AllUsers.exe
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/05/02 08:39:22 | 000,001,170 | -H-- | M] () -- C:\WINDOWS\System32\WPA.DBL
[2011/05/02 08:38:06 | 000,002,048 | -H-- | M] () -- C:\WINDOWS\BOOTSTAT.DAT
[2011/05/02 08:35:00 | 000,000,498 | -H-- | M] () -- C:\WINDOWS\tasks\McAfee.com Update Check (JOHNNY-obailey).job
[2011/05/02 08:34:06 | 000,000,496 | -H-- | M] () -- C:\WINDOWS\tasks\McAfee.com Update Check (JOHNNY-ja3756).job
[2011/05/02 08:34:00 | 000,000,498 | -H-- | M] () -- C:\WINDOWS\tasks\McAfee.com Update Check (JOHNNY-Valledo).job
[2011/04/10 08:59:53 | 000,000,104 | -H-- | M] () -- C:\Documents and Settings\All Users\Application Data\~18407220
[2011/04/10 08:52:01 | 000,000,136 | -H-- | M] () -- C:\Documents and Settings\All Users\Application Data\~18407220r
[2011/04/10 08:51:29 | 000,000,811 | -H-- | M] () -- C:\Documents and Settings\ja3756\Desktop\Windows Restore.lnk
[2011/04/10 08:51:08 | 000,000,344 | -H-- | M] () -- C:\Documents and Settings\All Users\Application Data\18407220
[2011/04/10 08:50:38 | 000,479,232 | -H-- | M] () -- C:\Documents and Settings\All Users\Application Data\18407220.exe
[2011/04/10 07:38:15 | 000,050,000 | -H-- | M] (ООО Закриптуй) -- C:\WINDOWS\System32\a98ms7aca.dll
[2011/04/10 07:35:06 | 000,073,732 | -H-- | M] () -- C:\Documents and Settings\All Users\Application Data\XFPwmcpwlYCi.exe
[2011/04/10 07:35:02 | 000,072,712 | -H-- | M] () -- C:\Documents and Settings\ja3756\Application Data\cleanhdd.exe
[2011/04/10 07:34:12 | 000,072,708 | -H-- | M] () -- C:\WINDOWS\System32\pctspk.exe
[2011/04/10 07:34:10 | 000,557,056 | -H-- | M] (GPA) -- C:\Documents and Settings\All Users\Application Data\XFPwmcpwlYCi .exe
[2011/04/09 13:09:26 | 000,000,888 | RH-- | M] () -- C:\WINDOWS\System32\drivers\ETC\hosts
[2011/04/06 23:00:29 | 000,423,936 | -H-- | M] () -- C:\Documents and Settings\ja3756\My Documents\pc_update107_2190.exe
[2011/04/03 20:02:56 | 000,054,996 | -H-- | M] () -- C:\WINDOWS\System32\mlfcache.dat
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/04/10 08:52:01 | 000,000,136 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\~18407220r
[2011/04/10 08:52:01 | 000,000,104 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\~18407220
[2011/04/10 08:51:29 | 000,000,811 | -H-- | C] () -- C:\Documents and Settings\ja3756\Desktop\Windows Restore.lnk
[2011/04/10 08:51:08 | 000,000,344 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\18407220
[2011/04/10 08:50:37 | 000,479,232 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\18407220.exe
[2011/04/10 07:34:46 | 000,073,732 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\XFPwmcpwlYCi.exe
[2011/04/10 07:34:42 | 000,072,712 | -H-- | C] () -- C:\Documents and Settings\ja3756\Application Data\cleanhdd.exe
[2011/04/10 07:32:26 | 000,011,264 | -H-- | C] () -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\glowext.dll
[2011/04/06 23:00:28 | 000,423,936 | -H-- | C] () -- C:\Documents and Settings\ja3756\My Documents\pc_update107_2190.exe
[2011/04/03 20:02:56 | 000,054,996 | -H-- | C] () -- C:\WINDOWS\System32\mlfcache.dat
[2010/06/27 15:07:51 | 000,683,801 | -H-- | C] () -- C:\WINDOWS\unins000.exe
[2010/06/27 15:07:51 | 000,001,067 | -H-- | C] () -- C:\WINDOWS\unins000.dat
[2010/05/24 08:55:41 | 000,013,931 | RH-- | C] () -- C:\WINDOWS\System32\RaCoInst.dat
[2009/08/03 15:07:42 | 000,403,816 | -H-- | C] () -- C:\WINDOWS\System32\OGACheckControl.dll
[2009/08/03 15:07:42 | 000,230,768 | -H-- | C] () -- C:\WINDOWS\System32\OGAEXEC.exe
[2007/09/03 22:20:13 | 000,000,027 | -H-- | C] () -- C:\WINDOWS\BRPP2KA.INI
[2007/09/03 22:18:58 | 000,000,225 | -H-- | C] () -- C:\WINDOWS\Brpfx04a.ini
[2007/09/03 22:18:58 | 000,000,093 | -H-- | C] () -- C:\WINDOWS\brpcfx.ini
[2007/09/03 22:18:58 | 000,000,050 | -H-- | C] () -- C:\WINDOWS\System32\bridf06a.dat
[2007/09/03 22:16:04 | 000,106,496 | -H-- | C] () -- C:\WINDOWS\System32\BrMuSNMP.dll
[2007/09/03 22:16:04 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\brdfxspd.dat
[2007/09/03 19:17:01 | 000,000,061 | -H-- | C] () -- C:\WINDOWS\init.ini
[2007/09/03 18:12:35 | 000,027,019 | -H-- | C] () -- C:\WINDOWS\maxlink.ini
[2007/09/03 15:41:53 | 000,001,155 | -H-- | C] () -- C:\WINDOWS\checkip.dat
[2007/02/26 09:29:38 | 000,197,680 | -H-- | C] () -- C:\WINDOWS\System32\vpnapi.dll
[2006/08/22 14:45:17 | 000,007,680 | -H-- | C] () -- C:\WINDOWS\System32\CNMVS64.DLL
[2006/08/22 09:07:08 | 000,029,752 | -H-- | C] () -- C:\WINDOWS\System32\InstHelper.dll
[2006/02/24 21:27:26 | 000,000,006 | -H-- | C] () -- C:\WINDOWS\msoffice.ini
[2006/02/11 12:59:53 | 000,000,000 | -H-- | C] () -- C:\Documents and Settings\ja3756\Application Data\dm.ini
[2005/11/08 16:42:22 | 000,081,920 | RH-- | C] () -- C:\WINDOWS\System32\WIAEH.dll
[2005/11/08 16:42:22 | 000,077,824 | RH-- | C] () -- C:\WINDOWS\System32\WIAIPH.dll
[2005/11/08 16:42:22 | 000,053,315 | RH-- | C] () -- C:\WINDOWS\System32\Sswiadrv.dll
[2005/11/08 16:42:22 | 000,049,152 | RH-- | C] () -- C:\WINDOWS\System32\WIASTIIO.dll
[2005/11/04 10:21:24 | 000,193,584 | -H-- | C] () -- C:\WINDOWS\System32\CSGina.dll
[2005/09/20 19:57:19 | 000,000,419 | -H-- | C] () -- C:\WINDOWS\BRWMARK.INI
[2005/09/20 19:57:19 | 000,000,034 | -H-- | C] () -- C:\WINDOWS\System32\BD7820N.DAT
[2005/03/28 13:28:56 | 000,000,000 | -H-- | C] () -- C:\Documents and Settings\ja3756\Local Settings\Application Data\dlm.dat
[2004/12/25 19:38:07 | 000,049,152 | -H-- | C] () -- C:\WINDOWS\System32\pxhpinst.exe
[2004/11/18 07:44:41 | 000,000,129 | -H-- | C] () -- C:\Documents and Settings\ja3756\Local Settings\Application Data\fusioncache.dat
[2004/11/16 12:06:44 | 000,000,035 | -H-- | C] () -- C:\WINDOWS\webica.ini
[2004/09/07 11:00:26 | 000,004,569 | -H-- | C] () -- C:\WINDOWS\System32\secupd.dat
[2004/07/06 13:28:56 | 000,007,168 | -H-- | C] () -- C:\Documents and Settings\ja3756\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2004/05/24 12:44:38 | 000,000,407 | -H-- | C] () -- C:\WINDOWS\LEXSTAT.INI
[2004/05/23 09:45:23 | 000,000,050 | -H-- | C] () -- C:\WINDOWS\upth.ini
[2004/05/23 09:45:23 | 000,000,024 | -H-- | C] () -- C:\WINDOWS\atid.ini
[2004/05/19 11:16:52 | 000,023,296 | -H-- | C] () -- C:\WINDOWS\System32\drivers\NaiFiltr.sys
[2004/03/29 11:48:56 | 000,000,560 | -H-- | C] () -- C:\WINDOWS\DELLSTAT.INI
[2004/01/12 15:13:52 | 000,002,656 | -H-- | C] () -- C:\WINDOWS\ACTWIN2.INI
[2003/12/14 23:14:38 | 000,000,715 | -H-- | C] () -- C:\WINDOWS\aolback.exe.lnk
[2003/12/14 23:10:10 | 000,000,335 | -H-- | C] () -- C:\WINDOWS\nsreg.dat
[2003/11/28 10:38:01 | 000,000,061 | -H-- | C] () -- C:\WINDOWS\smscfg.ini
[2003/11/28 10:27:53 | 000,000,376 | -H-- | C] () -- C:\WINDOWS\ODBC.INI
[2003/11/28 10:16:00 | 000,000,791 | -H-- | C] () -- C:\WINDOWS\orun32.ini
[2003/11/28 10:07:50 | 000,028,768 | -H-- | C] () -- C:\WINDOWS\System32\javaw.exe
[2003/11/28 10:07:50 | 000,024,670 | -H-- | C] () -- C:\WINDOWS\System32\java.exe
[2003/11/28 09:59:48 | 000,002,048 | -H-- | C] () -- C:\WINDOWS\BOOTSTAT.DAT
[2003/11/28 09:58:50 | 000,401,652 | -H-- | C] () -- C:\WINDOWS\System32\PERFH009.DAT
[2003/11/28 09:58:50 | 000,061,660 | -H-- | C] () -- C:\WINDOWS\System32\PERFC009.DAT
[2003/11/28 09:57:35 | 000,001,536 | -H-- | C] () -- C:\WINDOWS\System32\TrueSoft.dat
[2003/11/28 09:45:32 | 000,000,545 | -H-- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2003/01/07 16:05:08 | 000,002,695 | -H-- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2002/09/03 14:42:36 | 000,262,232 | -H-- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2002/09/03 14:35:18 | 000,004,161 | -H-- | C] () -- C:\WINDOWS\ODBCINST.INI
[2002/09/03 14:31:48 | 000,021,640 | -H-- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2002/09/03 09:31:46 | 013,107,200 | -H-- | C] () -- C:\WINDOWS\System32\OEMBIOS.BIN
[2002/09/03 09:31:44 | 000,004,594 | -H-- | C] () -- C:\WINDOWS\System32\OEMBIOS.DAT
[2002/08/29 06:00:00 | 000,673,088 | -H-- | C] () -- C:\WINDOWS\System32\MLANG.DAT
[2002/08/29 06:00:00 | 000,272,128 | -H-- | C] () -- C:\WINDOWS\System32\PERFI009.DAT
[2002/08/29 06:00:00 | 000,218,003 | -H-- | C] () -- C:\WINDOWS\System32\DSSEC.DAT
[2002/08/29 06:00:00 | 000,046,258 | -H-- | C] () -- C:\WINDOWS\System32\MIB.BIN
[2002/08/29 06:00:00 | 000,028,626 | -H-- | C] () -- C:\WINDOWS\System32\PERFD009.DAT
[2002/08/29 06:00:00 | 000,001,804 | -H-- | C] () -- C:\WINDOWS\System32\dcache.bin
[2002/08/29 06:00:00 | 000,000,741 | -H-- | C] () -- C:\WINDOWS\System32\NOISE.DAT
[2002/03/04 10:16:34 | 000,110,592 | RH-- | C] () -- C:\WINDOWS\System32\Jpeg32.dll
[2001/10/24 16:00:40 | 000,524,288 | -H-- | C] () -- C:\WINDOWS\System32\TDI-SonyOMG.dll
[1980/01/01 01:00:00 | 000,163,840 | -H-- | C] () -- C:\WINDOWS\System32\pctspk .exe
[1980/01/01 01:00:00 | 000,072,708 | -H-- | C] () -- C:\WINDOWS\System32\pctspk.exe
[1980/01/01 01:00:00 | 000,045,056 | -H-- | C] () -- C:\WINDOWS\System32\mdmmoh.dll
[1980/01/01 01:00:00 | 000,016,384 | -H-- | C] () -- C:\WINDOWS\System32\e100bmsg.dll
[1980/01/01 01:00:00 | 000,000,456 | -H-- | C] () -- C:\WINDOWS\System32\pthsp.dat

========== LOP Check ==========

[2007/12/29 09:40:49 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\Cisco
[2010/05/24 07:29:23 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\Cisco Systems
[2010/06/27 15:17:32 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\myitlab
[2007/09/03 18:11:29 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\ScanSoft
[2008/07/18 14:12:41 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint
[2011/03/27 18:30:11 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2004/11/16 12:07:12 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\ja3756\Application Data\ICAClient
[2004/02/11 21:12:09 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\ja3756\Application Data\InterVideo
[2006/02/24 07:21:24 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\ja3756\Application Data\Iomega Automatic Backup Pro
[2006/02/24 07:10:53 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\ja3756\Application Data\Leadertech
[2005/06/28 20:18:34 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\ja3756\Application Data\Learn2.com
[2005/07/07 21:43:54 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\ja3756\Application Data\Respironics
[2008/07/18 14:12:43 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\ja3756\Application Data\Viewpoint

========== Purity Check ==========

< End of report >

Attached Files

OTL.Txt 65.15KB 96 downloads

Edited by Essexboy, 02 May 2011 - 09:14 AM.

#2
Essexboy

Posted 02 May 2011 - 09:21 AM

GeekU Moderator

Retired Staff
69,964 posts

Hi there lets fix this for you

Run OTL

Under the Custom Scans/Fixes box at the bottom, paste in the following

:OTL
O4 - HKLM..\Run: [BearShare] File not found
O4 - HKLM..\Run: [cleanhdd] C:\Documents and Settings\ja3756\Application Data\cleanhdd.exe ()
O4 - HKCU..\Run: [XFPwmcpwlYCi] C:\Documents and Settings\All Users\Application Data\XFPwmcpwlYCi.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O20 - Winlogon\Notify\glowext: DllName - C:\Documents and Settings\NetworkService\Local Settings\Application Data\glowext.dll - C:\Documents and Settings\NetworkService\Local Settings\Application Data\glowext.dll ()
[2011/04/10 08:51:25 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\ja3756\Start Menu\Programs\Windows Restore
[2011/04/10 07:38:15 | 000,050,000 | -H-- | C] (ООО Закриптуй) -- C:\WINDOWS\System32\a98ms7aca.dll
[2011/04/10 07:34:46 | 000,557,056 | -H-- | C] (GPA) -- C:\Documents and Settings\All Users\Application Data\XFPwmcpwlYCi .exe
[2011/04/10 07:34:42 | 000,062,976 | -HS- | C] (Microsoft Corporation) -- C:\Documents and Settings\ja3756\Application Data\cleanhdd .exe
[2011/04/10 07:34:42 | 000,053,760 | -HS- | C] (Microsoft Corporation) -- C:\Documents and Settings\ja3756\Application Data\cleanhdd.dll
[2011/04/10 08:59:53 | 000,000,104 | -H-- | M] () -- C:\Documents and Settings\All Users\Application Data\~18407220
[2011/04/10 08:52:01 | 000,000,136 | -H-- | M] () -- C:\Documents and Settings\All Users\Application Data\~18407220r
[2011/04/10 08:51:29 | 000,000,811 | -H-- | M] () -- C:\Documents and Settings\ja3756\Desktop\Windows Restore.lnk
[2011/04/10 08:51:08 | 000,000,344 | -H-- | M] () -- C:\Documents and Settings\All Users\Application Data\18407220
[2011/04/10 08:50:38 | 000,479,232 | -H-- | M] () -- C:\Documents and Settings\All Users\Application Data\18407220.exe
[2011/04/10 07:38:15 | 000,050,000 | -H-- | M] (ООО Закриптуй) -- C:\WINDOWS\System32\a98ms7aca.dll
[2011/04/10 07:35:06 | 000,073,732 | -H-- | M] () -- C:\Documents and Settings\All Users\Application Data\XFPwmcpwlYCi.exe
[2011/04/10 07:35:02 | 000,072,712 | -H-- | M] () -- C:\Documents and Settings\ja3756\Application Data\cleanhdd.exe
[2011/04/10 07:34:12 | 000,072,708 | -H-- | M] () -- C:\WINDOWS\System32\pctspk.exe
[2011/04/10 07:34:10 | 000,557,056 | -H-- | M] (GPA) -- C:\Documents and Settings\All Users\Application Data\XFPwmcpwlYCi .exe
[2011/04/06 23:00:29 | 000,423,936 | -H-- | M] () -- C:\Documents and Settings\ja3756\My Documents\pc_update107_2190.exe
[2011/04/10 08:52:01 | 000,000,136 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\~18407220r
[2011/04/10 08:52:01 | 000,000,104 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\~18407220
[2011/04/10 08:51:29 | 000,000,811 | -H-- | C] () -- C:\Documents and Settings\ja3756\Desktop\Windows Restore.lnk
[2011/04/10 08:51:08 | 000,000,344 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\18407220
[2011/04/10 08:50:37 | 000,479,232 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\18407220.exe
[2011/04/10 07:34:46 | 000,073,732 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\XFPwmcpwlYCi.exe
[2011/04/10 07:34:42 | 000,072,712 | -H-- | C] () -- C:\Documents and Settings\ja3756\Application Data\cleanhdd.exe
[2011/04/10 07:32:26 | 000,011,264 | -H-- | C] () -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\glowext.dll
[2011/04/06 23:00:28 | 000,423,936 | -H-- | C] () -- C:\Documents and Settings\ja3756\My Documents\pc_update107_2190.exe

:Files
ipconfig /flushdns /c

:Commands
[purity]
[resethosts]
[emptytemp]
[EMPTYFLASH]
[CREATERESTOREPOINT]
[Reboot]
Then click the Run Fix button at the top
Let the program run unhindered, reboot the PC when it is done
Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

THEN

Download RogueKiller to your desktop

Quit all running programs
For Vista/Seven, right click -> run as administrator, for XP simply run RogueKiller.exe
When prompted, type 6 and validate
The RKreport.txt shall be generated next to the executable.
If the program is blocked, do not hesitate to try several times. If it really does not work (it could happen), rename it to winlogon.exe

Please post the contents of the RKreport.txt in your next Reply.

FINALLY FOR NOW

Download aswMBR.exe ( 511KB ) to your desktop.

Double click the aswMBR.exe to run it

Click the "Scan" button to start scan
Posted Image

On completion of the scan click save log, save it to your desktop and post in your next reply
Posted Image

#3
griruco

Posted 02 May 2011 - 11:32 AM

Member

Topic Starter
Member
74 posts

Everything ran w/out a hitch.Here are the logs. Thank you.

OTL logfile created on: 5/2/2011 11:25:02 AM - Run 3
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Administrator\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

510.00 Mb Total Physical Memory | 360.00 Mb Available Physical Memory | 71.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 93.00% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 27.91 Gb Total Space | 12.47 Gb Free Space | 44.67% Space Free | Partition Type: NTFS
Drive E: | 3.73 Gb Total Space | 3.72 Gb Free Space | 99.92% Space Free | Partition Type: FAT32

Computer Name: JOHNNY | User Name: ja3756 | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/05/02 09:26:24 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Administrator\Desktop\OTL.exe
PRC - [2011/04/11 01:14:28 | 000,419,840 | ---- | M] (Igor Pavlov) -- C:\Program Files\7-Zip\7zFM.exe
PRC - [2008/04/13 19:12:19 | 001,033,728 | -H-- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe

========== Modules (SafeList) ==========

MOD - [2011/05/02 09:26:24 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Administrator\Desktop\OTL.exe
MOD - [2010/08/23 11:12:02 | 001,054,208 | -H-- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll

========== Win32 Services (SafeList) ==========

SRV - [2007/04/23 04:12:52 | 000,336,944 | -H-- | M] (Cisco Systems, Inc.) [Auto | Stopped] -- C:\Program Files\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe -- (vpnagent)
SRV - [2006/04/20 08:34:26 | 001,520,688 | -H-- | M] (Cisco Systems, Inc.) [Auto | Stopped] -- C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe -- (CVPND)
SRV - [2005/05/27 09:12:38 | 000,073,728 | -H-- | M] () [Auto | Stopped] -- c:\alice5\exe\asw_service.exe -- (AliceSleepware)
SRV - [2004/05/27 01:14:58 | 000,053,337 | -H-- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe -- (PACSPTISVR)
SRV - [2004/05/27 01:13:00 | 000,069,718 | -H-- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe -- (SPTISRV)
SRV - [2003/11/13 13:29:40 | 000,452,608 | -H-- | M] () [Auto | Stopped] -- C:\Program Files\Linksys\Wireless-N Network Monitor\NICServ.exe -- (NICSer_WPC300N)
SRV - [2003/08/21 17:06:56 | 000,245,760 | -H-- | M] (Networks Associates Technology, Inc) [On_Demand | Stopped] -- C:\Program Files\McAfee.com\Agent\mcupdmgr.exe -- (mcupdmgr.exe)
SRV - [2003/08/08 17:04:38 | 000,106,496 | -H-- | M] (Networks Associates Technology, Inc) [Auto | Stopped] -- c:\Program Files\McAfee.com\VSO\mcvsrte.exe -- (MCVSRte)
SRV - [2003/04/29 15:29:54 | 000,139,264 | -H-- | M] (Intel® Corporation) [On_Demand | Stopped] -- C:\Program Files\Intel\NCS\Sync\NetSvc.exe -- (NetSvc)
SRV - [2002/03/13 08:50:34 | 000,225,375 | -H-- | M] () [On_Demand | Stopped] -- c:\Program Files\McAfee.com\VSO\McShield.exe -- (McShield)

========== Driver Services (SafeList) ==========

DRV - [2010/01/25 11:38:27 | 000,816,672 | RH-- | M] (Ralink Technology, Corp.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\AE1000XP.sys -- (AE1000)
DRV - [2008/04/13 13:56:49 | 000,012,800 | -H-- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\usb8023.sys -- (USB_RNDIS_XP)
DRV - [2008/04/13 13:56:06 | 000,088,320 | -H-- | M] (Microsoft Corporation) [Kernel | Auto | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\nwlnkipx.sys -- (NwlnkIpx)
DRV - [2008/04/13 13:36:41 | 000,063,744 | -H-- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\mf.sys -- (mf)
DRV - [2007/04/23 04:09:58 | 000,024,176 | -H-- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\vpnva.sys -- (vpnva)
DRV - [2007/03/22 12:57:14 | 000,028,672 | --S- | M] (Gteko Ltd.) [Kernel | Auto | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\elagopro.sys -- (elagopro)
DRV - [2007/03/22 12:57:14 | 000,005,376 | --S- | M] (Gteko Ltd.) [Kernel | Auto | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\elaunidr.sys -- (elaunidr)
DRV - [2006/04/24 23:51:08 | 000,543,104 | -H-- | M] (Linksys, A Division of Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\BCMWL5.SYS -- (BCM43XX)
DRV - [2006/04/20 08:33:40 | 000,303,740 | -H-- | M] (Cisco Systems, Inc.) [Kernel | Auto | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\CVPNDRVA.sys -- (CVPNDRVA)
DRV - [2005/06/29 19:50:30 | 000,110,080 | -H-- | M] (Deterministic Networks, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\dne2000.sys -- (DNE)
DRV - [2005/05/18 13:52:56 | 000,173,056 | -H-- | M] (Funk Software, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\odysseyIM4.sys -- (odysseyIM4)
DRV - [2005/05/17 04:51:34 | 000,005,315 | -H-- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\CVirtA.sys -- (CVirtA)
DRV - [2005/03/03 12:23:08 | 000,023,040 | -H-- | M] (Iomega) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\IABFilt.sys -- (IABFilt)
DRV - [2005/01/26 06:22:20 | 000,280,344 | -H-- | M] (Zone Labs LLC) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\vsdatant.sys -- (vsdatant)
DRV - [2004/08/04 00:29:49 | 000,019,455 | -H-- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\wvchntxx.sys -- (iAimFP4)
DRV - [2004/08/04 00:29:47 | 000,012,063 | -H-- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\wsiintxx.sys -- (iAimFP3)
DRV - [2004/08/04 00:29:45 | 000,023,615 | -H-- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\wch7xxnt.sys -- (iAimTV4)
DRV - [2004/08/04 00:29:43 | 000,033,599 | -H-- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\watv04nt.sys -- (iAimTV3)
DRV - [2004/08/04 00:29:42 | 000,019,551 | -H-- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\watv02nt.sys -- (iAimTV1)
DRV - [2004/08/04 00:29:41 | 000,029,311 | -H-- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\watv01nt.sys -- (iAimTV0)
DRV - [2004/08/04 00:29:37 | 000,012,415 | -H-- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\wadv01nt.sys -- (iAimFP0)
DRV - [2004/08/04 00:29:37 | 000,012,127 | -H-- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\wadv02nt.sys -- (iAimFP1)
DRV - [2004/08/04 00:29:37 | 000,011,775 | -H-- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\wadv05nt.sys -- (iAimFP2)
DRV - [2004/08/04 00:29:36 | 000,161,020 | -H-- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\i81xnt5.sys -- (i81x)
DRV - [2003/12/14 23:13:06 | 000,008,552 | -H-- | M] (Windows ® 2000 DDK provider) [Kernel | Auto | Stopped] -- C:\WINDOWS\System32\drivers\asctrm.sys -- (ASCTRM)
DRV - [2003/11/28 10:35:33 | 000,206,464 | -H-- | M] (Roxio) [File_System | System | Running] -- C:\WINDOWS\System32\drivers\udfreadr_xp.sys -- (UdfReadr_xp)
DRV - [2003/11/28 10:35:33 | 000,143,834 | -H-- | M] (Roxio) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\pwd_2K.sys -- (pwd_2k)
DRV - [2003/11/28 10:35:33 | 000,030,630 | -H-- | M] (Roxio) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\Mmc_2k.sys -- (mmc_2K)
DRV - [2003/11/28 10:35:33 | 000,025,898 | -H-- | M] (Roxio) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\Dvd_2k.sys -- (dvd_2K)
DRV - [2003/07/16 22:28:02 | 000,017,142 | -H-- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\CBTNDIS5.SYS -- (CBTNDIS5)
DRV - [2003/06/10 22:35:58 | 000,093,700 | -H-- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\Apfiltr.sys -- (ApfiltrService)
DRV - [2003/05/30 19:45:16 | 000,477,403 | -H-- | M] (PCtel, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\vpctcom.sys -- (Vpctcom)
DRV - [2003/05/30 18:50:46 | 000,690,973 | -H-- | M] (PCTEL, INC.) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\vmodem.sys -- (Vmodem)
DRV - [2003/05/28 13:08:12 | 000,066,111 | -H-- | M] (PCtel, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\vvoice.sys -- (Vvoice)
DRV - [2003/04/25 18:10:52 | 000,220,176 | -H-- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\STAC97.sys -- (STAC97) Audio Driver (WDM)
DRV - [2003/02/24 16:30:02 | 000,135,292 | -H-- | M] (PCTEL, INC.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\ptserial.sys -- (Ptserial)
DRV - [2003/02/15 01:12:20 | 000,032,311 | -H-- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\wa301b.sys -- ({E2B953A7-195A-44F9-9BA3-3D5F4E32BB55})
DRV - [2003/02/15 01:12:20 | 000,032,311 | -H-- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\wa301a.sys -- ({E2B953A6-195A-44F9-9BA3-3D5F4E32BB55})
DRV - [2003/01/10 17:13:04 | 000,033,588 | -H-- | M] (America Online, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\wanatw4.sys -- (wanatw) WAN Miniport (ATW)
DRV - [2003/01/07 16:19:26 | 000,017,217 | -H-- | M] (Dell Computer Corporation) [Kernel | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\omci.sys -- (omci)
DRV - [2002/12/17 13:32:58 | 000,061,424 | -H-- | M] (Roxio) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\cdr4_xp.sys -- (Cdr4_xp)
DRV - [2002/12/17 13:32:46 | 000,023,436 | -H-- | M] (Roxio) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\cdralw2k.sys -- (Cdralw2k)
DRV - [2002/12/17 13:27:32 | 000,241,152 | -H-- | M] (Roxio) [File_System | System | Running] -- C:\WINDOWS\System32\drivers\cdudf_xp.sys -- (cdudf_xp)
DRV - [2002/11/22 21:01:26 | 000,020,096 | -H-- | M] (Intel Corporation ) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\iqvw32.sys -- (NAL)
DRV - [2002/11/18 18:20:44 | 000,030,976 | -H-- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\gv3.sys -- (gv3)
DRV - [2002/08/29 06:00:00 | 000,063,232 | -H-- | M] (Microsoft Corporation) [Kernel | Auto | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\NWLNKNB.SYS -- (NwlnkNb)
DRV - [2002/08/29 06:00:00 | 000,055,936 | -H-- | M] (Microsoft Corporation) [Kernel | Auto | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\NWLNKSPX.SYS -- (NwlnkSpx)
DRV - [2002/06/19 03:16:02 | 000,011,840 | -H-- | M] (Roxio) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\MRFilter.sys -- (MrFilter)
DRV - [2002/03/13 08:50:36 | 000,023,296 | -H-- | M] () [File_System | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\NaiFiltr.sys -- (NaiFiltr)
DRV - [2001/08/17 13:12:12 | 000,002,944 | -H-- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\BrFilt.sys -- (brfilt)
DRV - [2001/08/17 13:11:06 | 000,066,591 | -H-- | M] (3Com Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\EL90XBC5.SYS -- (EL90XBC)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

O1 HOSTS File: ([2011/05/02 11:21:32 | 000,000,098 | ---- | M]) - C:\WINDOWS\SYSTEM32\DRIVERS\ETC\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: () - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (AcroIEToolbarHelper Class) - {AE7CD045-E861-484f-8273-0445EE161910} - c:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll ()
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - c:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll ()
O3 - HKLM\..\Toolbar: (McAfee VirusScan) - {BA52B914-B692-46c4-B683-905236F6F655} - c:\Program Files\McAfee.com\VSO\mcvsshl.dll (Networks Associates Technology, Inc)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\ShellBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - c:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - c:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [AdaptecDirectCD] C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe ()
O4 - HKLM..\Run: [Adobe Photo Downloader] C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe ()
O4 - HKLM..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe ()
O4 - HKLM..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe (Brother Industries, Ltd.)
O4 - HKLM..\Run: [DVDSentry] C:\WINDOWS\SYSTEM32\DSentry.exe (Dell - Advanced Desktop Engineering)
O4 - HKLM..\Run: [ezShieldProtector for Px] C:\WINDOWS\SYSTEM32\ezSP_Px.exe (Easy Systems Japan Ltd.)
O4 - HKLM..\Run: [IndexSearch] C:\Program Files\Dell\Dell Laser MFP 1600n\PaperPort\IndexSearch.exe ()
O4 - HKLM..\Run: [Linksys Wireless-N Notebook Adapter] C:\Program Files\Linksys\Wireless-N Network Monitor\WPC300N.exe ()
O4 - HKLM..\Run: [MCAgentExe] c:\Program Files\McAfee.com\Agent\mcagent.exe ()
O4 - HKLM..\Run: [MCUpdateExe] C:\Program Files\McAfee.com\Agent\McUpdate.exe ()
O4 - HKLM..\Run: [PaperPort PTD] C:\Program Files\Dell\Dell Laser MFP 1600n\PaperPort\pptd40nt.exe ()
O4 - HKLM..\Run: [PCTVOICE] File not found
O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\qttask .exe ()
O4 - HKLM..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [VirusScan Online] c:\Program Files\McAfee.com\VSO\mcvsshld.exe ()
O4 - HKLM..\Run: [VSOCheckTask] c:\Program Files\McAfee.com\VSO\mcmnhdlr.exe ()
O4 - HKCU..\Run: [EasyLinkAdvisor] C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe ()
O4 - HKCU..\Run: [Iomega Automatic Backup Pro] File not found
O4 - HKCU..\Run: [MsnMsgr] File not found
O4 - HKCU..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe ()
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Cisco Systems VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\vpngui.exe (Cisco Systems, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe (Intuit Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableCAD = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\SYSTEM32\nwprovau.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKCU\..Trusted Domains: ([]msn in My Computer)
O15 - HKCU\..Trusted Domains: ameritrade.com ([]https in Trusted sites)
O15 - HKCU\..Trusted Domains: aol.com ([objects] * is out of zone range - 5)
O15 - HKCU\..Trusted Domains: tdameritrade.com ([]https in Trusted sites)
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} http://download.av.a...77/mcinsctl.cab (McAfee.com Operating System Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.mi...b?1192329505873 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.4.2)
O16 - DPF: {9059F30F-4EB1-4BD2-9FDC-36F43A218F4A} http://206.30.161.128/tsweb/msrdp.cab (Microsoft RDP Client Control (redist))
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} http://messenger.msn...pDownloader.cab (MsnMessengerSetupDownloadControl Class)
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} http://download.av.a...,18/mcgdmgr.cab (DwnldGroupMgr Class)
O16 - DPF: {CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.4.2)
O16 - DPF: {D1ACD2D8-7312-4D06-BECD-90EB094D2277} http://mediaplayer.w...ler/install.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 74.128.17.114 74.128.19.102
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: GinaDLL - (VPNGina.dll) - C:\WINDOWS\System32\vpngina.dll (Cisco Systems, Inc.)
O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\ja3756\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\ja3756\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2002/09/03 14:36:02 | 000,000,000 | -H-- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/05/02 11:16:30 | 000,000,000 | ---D | C] -- C:\_OTL
[2011/05/02 08:39:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\7-Zip
[2011/05/02 08:39:54 | 000,000,000 | ---D | C] -- C:\Program Files\7-Zip
[2011/05/02 08:31:48 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\ja3756\Recent
[2011/04/10 07:34:56 | 000,000,000 | -H-D | C] -- C:\Temp
[2011/04/10 07:33:15 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\NetworkService\Application Data\AdobeUM
[2011/04/10 07:30:48 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Adobe
[2011/04/10 07:30:26 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\NetworkService\Application Data\Sun
[2011/04/09 08:39:27 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\NetworkService\Application Data\Adobe
[2011/04/08 17:34:05 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\NetworkService\Application Data\Apple Computer
[2008/03/14 23:39:47 | 045,144,176 | -H-- | C] (SleepEx Systems, Inc. ) -- C:\Program Files\SleepEx.2.3.build.2.3.0.17.Install.AllUsers.exe

========== Files - Modified Within 30 Days ==========

[2011/05/02 11:24:31 | 000,001,170 | -H-- | M] () -- C:\WINDOWS\System32\WPA.DBL
[2011/05/02 11:24:02 | 000,002,048 | -H-- | M] () -- C:\WINDOWS\BOOTSTAT.DAT
[2011/05/02 11:21:32 | 000,000,098 | ---- | M] () -- C:\WINDOWS\System32\drivers\ETC\Hosts
[2011/05/02 08:35:00 | 000,000,498 | -H-- | M] () -- C:\WINDOWS\tasks\McAfee.com Update Check (JOHNNY-obailey).job
[2011/05/02 08:34:06 | 000,000,496 | -H-- | M] () -- C:\WINDOWS\tasks\McAfee.com Update Check (JOHNNY-ja3756).job
[2011/05/02 08:34:00 | 000,000,498 | -H-- | M] () -- C:\WINDOWS\tasks\McAfee.com Update Check (JOHNNY-Valledo).job
[2011/04/03 20:02:56 | 000,054,996 | -H-- | M] () -- C:\WINDOWS\System32\mlfcache.dat

========== Files Created - No Company Name ==========

[2011/04/03 20:02:56 | 000,054,996 | -H-- | C] () -- C:\WINDOWS\System32\mlfcache.dat
[2010/06/27 15:07:51 | 000,683,801 | -H-- | C] () -- C:\WINDOWS\unins000.exe
[2010/06/27 15:07:51 | 000,001,067 | -H-- | C] () -- C:\WINDOWS\unins000.dat
[2010/05/24 08:55:41 | 000,013,931 | RH-- | C] () -- C:\WINDOWS\System32\RaCoInst.dat
[2009/08/03 15:07:42 | 000,403,816 | -H-- | C] () -- C:\WINDOWS\System32\OGACheckControl.dll
[2009/08/03 15:07:42 | 000,230,768 | -H-- | C] () -- C:\WINDOWS\System32\OGAEXEC.exe
[2007/09/03 22:20:13 | 000,000,027 | -H-- | C] () -- C:\WINDOWS\BRPP2KA.INI
[2007/09/03 22:18:58 | 000,000,225 | -H-- | C] () -- C:\WINDOWS\Brpfx04a.ini
[2007/09/03 22:18:58 | 000,000,093 | -H-- | C] () -- C:\WINDOWS\brpcfx.ini
[2007/09/03 22:18:58 | 000,000,050 | -H-- | C] () -- C:\WINDOWS\System32\bridf06a.dat
[2007/09/03 22:16:04 | 000,106,496 | -H-- | C] () -- C:\WINDOWS\System32\BrMuSNMP.dll
[2007/09/03 22:16:04 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\brdfxspd.dat
[2007/09/03 19:17:01 | 000,000,061 | -H-- | C] () -- C:\WINDOWS\init.ini
[2007/09/03 18:12:35 | 000,027,019 | -H-- | C] () -- C:\WINDOWS\maxlink.ini
[2007/09/03 15:41:53 | 000,001,155 | -H-- | C] () -- C:\WINDOWS\checkip.dat
[2007/02/26 09:29:38 | 000,197,680 | -H-- | C] () -- C:\WINDOWS\System32\vpnapi.dll
[2006/08/22 14:45:17 | 000,007,680 | -H-- | C] () -- C:\WINDOWS\System32\CNMVS64.DLL
[2006/08/22 09:07:08 | 000,029,752 | -H-- | C] () -- C:\WINDOWS\System32\InstHelper.dll
[2006/02/24 21:27:26 | 000,000,006 | -H-- | C] () -- C:\WINDOWS\msoffice.ini
[2006/02/11 12:59:53 | 000,000,000 | -H-- | C] () -- C:\Documents and Settings\ja3756\Application Data\dm.ini
[2005/11/08 16:42:22 | 000,081,920 | RH-- | C] () -- C:\WINDOWS\System32\WIAEH.dll
[2005/11/08 16:42:22 | 000,077,824 | RH-- | C] () -- C:\WINDOWS\System32\WIAIPH.dll
[2005/11/08 16:42:22 | 000,053,315 | RH-- | C] () -- C:\WINDOWS\System32\Sswiadrv.dll
[2005/11/08 16:42:22 | 000,049,152 | RH-- | C] () -- C:\WINDOWS\System32\WIASTIIO.dll
[2005/11/04 10:21:24 | 000,193,584 | -H-- | C] () -- C:\WINDOWS\System32\CSGina.dll
[2005/09/20 19:57:19 | 000,000,419 | -H-- | C] () -- C:\WINDOWS\BRWMARK.INI
[2005/09/20 19:57:19 | 000,000,034 | -H-- | C] () -- C:\WINDOWS\System32\BD7820N.DAT
[2005/03/28 13:28:56 | 000,000,000 | -H-- | C] () -- C:\Documents and Settings\ja3756\Local Settings\Application Data\dlm.dat
[2004/12/25 19:38:07 | 000,049,152 | -H-- | C] () -- C:\WINDOWS\System32\pxhpinst.exe
[2004/11/18 07:44:41 | 000,000,129 | -H-- | C] () -- C:\Documents and Settings\ja3756\Local Settings\Application Data\fusioncache.dat
[2004/11/16 12:06:44 | 000,000,035 | -H-- | C] () -- C:\WINDOWS\webica.ini
[2004/09/07 11:00:26 | 000,004,569 | -H-- | C] () -- C:\WINDOWS\System32\secupd.dat
[2004/07/06 13:28:56 | 000,007,168 | -H-- | C] () -- C:\Documents and Settings\ja3756\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2004/05/24 12:44:38 | 000,000,407 | -H-- | C] () -- C:\WINDOWS\LEXSTAT.INI
[2004/05/23 09:45:23 | 000,000,050 | -H-- | C] () -- C:\WINDOWS\upth.ini
[2004/05/23 09:45:23 | 000,000,024 | -H-- | C] () -- C:\WINDOWS\atid.ini
[2004/05/19 11:16:52 | 000,023,296 | -H-- | C] () -- C:\WINDOWS\System32\drivers\NaiFiltr.sys
[2004/03/29 11:48:56 | 000,000,560 | -H-- | C] () -- C:\WINDOWS\DELLSTAT.INI
[2004/01/12 15:13:52 | 000,002,656 | -H-- | C] () -- C:\WINDOWS\ACTWIN2.INI
[2003/12/14 23:14:38 | 000,000,715 | -H-- | C] () -- C:\WINDOWS\aolback.exe.lnk
[2003/12/14 23:10:10 | 000,000,335 | -H-- | C] () -- C:\WINDOWS\nsreg.dat
[2003/11/28 10:38:01 | 000,000,061 | -H-- | C] () -- C:\WINDOWS\smscfg.ini
[2003/11/28 10:27:53 | 000,000,376 | -H-- | C] () -- C:\WINDOWS\ODBC.INI
[2003/11/28 10:16:00 | 000,000,791 | -H-- | C] () -- C:\WINDOWS\orun32.ini
[2003/11/28 10:07:50 | 000,028,768 | -H-- | C] () -- C:\WINDOWS\System32\javaw.exe
[2003/11/28 10:07:50 | 000,024,670 | -H-- | C] () -- C:\WINDOWS\System32\java.exe
[2003/11/28 09:59:48 | 000,002,048 | -H-- | C] () -- C:\WINDOWS\BOOTSTAT.DAT
[2003/11/28 09:58:50 | 000,401,652 | -H-- | C] () -- C:\WINDOWS\System32\PERFH009.DAT
[2003/11/28 09:58:50 | 000,061,660 | -H-- | C] () -- C:\WINDOWS\System32\PERFC009.DAT
[2003/11/28 09:57:35 | 000,001,536 | -H-- | C] () -- C:\WINDOWS\System32\TrueSoft.dat
[2003/11/28 09:45:32 | 000,000,545 | -H-- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2003/01/07 16:05:08 | 000,002,695 | -H-- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2002/09/03 14:42:36 | 000,262,232 | -H-- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2002/09/03 14:35:18 | 000,004,161 | -H-- | C] () -- C:\WINDOWS\ODBCINST.INI
[2002/09/03 14:31:48 | 000,021,640 | -H-- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2002/09/03 09:31:46 | 013,107,200 | -H-- | C] () -- C:\WINDOWS\System32\OEMBIOS.BIN
[2002/09/03 09:31:44 | 000,004,594 | -H-- | C] () -- C:\WINDOWS\System32\OEMBIOS.DAT
[2002/08/29 06:00:00 | 000,673,088 | -H-- | C] () -- C:\WINDOWS\System32\MLANG.DAT
[2002/08/29 06:00:00 | 000,272,128 | -H-- | C] () -- C:\WINDOWS\System32\PERFI009.DAT
[2002/08/29 06:00:00 | 000,218,003 | -H-- | C] () -- C:\WINDOWS\System32\DSSEC.DAT
[2002/08/29 06:00:00 | 000,046,258 | -H-- | C] () -- C:\WINDOWS\System32\MIB.BIN
[2002/08/29 06:00:00 | 000,028,626 | -H-- | C] () -- C:\WINDOWS\System32\PERFD009.DAT
[2002/08/29 06:00:00 | 000,001,804 | -H-- | C] () -- C:\WINDOWS\System32\dcache.bin
[2002/08/29 06:00:00 | 000,000,741 | -H-- | C] () -- C:\WINDOWS\System32\NOISE.DAT
[2002/03/04 10:16:34 | 000,110,592 | RH-- | C] () -- C:\WINDOWS\System32\Jpeg32.dll
[2001/10/24 16:00:40 | 000,524,288 | -H-- | C] () -- C:\WINDOWS\System32\TDI-SonyOMG.dll
[1980/01/01 01:00:00 | 000,163,840 | -H-- | C] () -- C:\WINDOWS\System32\pctspk .exe
[1980/01/01 01:00:00 | 000,045,056 | -H-- | C] () -- C:\WINDOWS\System32\mdmmoh.dll
[1980/01/01 01:00:00 | 000,016,384 | -H-- | C] () -- C:\WINDOWS\System32\e100bmsg.dll
[1980/01/01 01:00:00 | 000,000,456 | -H-- | C] () -- C:\WINDOWS\System32\pthsp.dat

========== LOP Check ==========

[2007/12/29 09:40:49 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\Cisco
[2010/05/24 07:29:23 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\Cisco Systems
[2010/06/27 15:17:32 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\myitlab
[2007/09/03 18:11:29 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\ScanSoft
[2008/07/18 14:12:41 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint
[2011/03/27 18:30:11 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2004/11/16 12:07:12 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\ja3756\Application Data\ICAClient
[2004/02/11 21:12:09 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\ja3756\Application Data\InterVideo
[2006/02/24 07:21:24 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\ja3756\Application Data\Iomega Automatic Backup Pro
[2006/02/24 07:10:53 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\ja3756\Application Data\Leadertech
[2005/06/28 20:18:34 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\ja3756\Application Data\Learn2.com
[2005/07/07 21:43:54 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\ja3756\Application Data\Respironics
[2008/07/18 14:12:43 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\ja3756\Application Data\Viewpoint

========== Purity Check ==========

< End of report >
aswMBR version 0.9.5.247 Copyright© 2011 AVAST Software
Run date: 2011-05-02 12:30:20
-----------------------------
12:30:20.182 OS Version: Windows 5.1.2600 Service Pack 3
12:30:20.182 Number of processors: 1 586 0x905
12:30:20.182 ComputerName: JOHNNY UserName: ja3756
12:30:21.424 Initialize success
12:30:26.872 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdePort0
12:30:26.882 Disk 0 Vendor: IC25N030ATMR04-0 MOAOAD0A Size: 28615MB BusType: 3
12:30:26.892 Device \Device\Ide\IdeDeviceP0T0L0-3 -> \??\IDE#DiskIC25N030ATMR04-0________________________MOAOAD0A#5&2b81b351&0&0.0.0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} not found
12:30:26.902 Device \Driver\atapi -> DriverStartIo 832b327f
12:30:28.915 Disk 0 MBR read successfully
12:30:28.915 Disk 0 MBR scan
12:30:28.925 Disk 0 TDL4@MBR code has been found
12:30:28.935 Disk 0 Windows XP default MBR code found via API
12:30:28.945 Disk 0 MBR hidden
12:30:28.955 Disk 0 MBR [TDL4] **ROOTKIT**
12:30:28.965 Disk 0 trace - called modules:
12:30:28.975 ntoskrnl.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x832b3439]<<
12:30:28.995 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x83385ab8]
12:30:29.005 3 CLASSPNP.SYS[f8876fd7] -> nt!IofCallDriver -> [0x8332c538]
12:30:29.025 \Driver\atapi[0x83271388] -> IRP_MJ_CREATE -> 0x832b3439
12:30:29.045 Scan finished successfully
12:30:55.273 Disk 0 MBR has been saved successfully to "E:\MBR.dat"
12:30:55.303 The log file has been saved successfully to "E:\aswMBR.txt"

Attached Files

aswMBR.txt 1.53KB 117 downloads
OTL2.Txt 57.32KB 103 downloads
RKreport1.txt 879bytes 130 downloads

#4
Essexboy

Posted 02 May 2011 - 11:36 AM

GeekU Moderator

Retired Staff
69,964 posts

OK you have your files and folders back now - so lets get the rootkit next, while I look at the OTL log

Re-Run aswMBR

Click Scan

On completion of the scan

Click the Fix Button
Posted Image

Save the log as before and post in your next reply after rebooting

#5
griruco

Posted 02 May 2011 - 01:32 PM

Member

Topic Starter
Member
74 posts

OK,here's the log. Thank you.

#6
griruco

Posted 02 May 2011 - 01:33 PM

Member

Topic Starter
Member
74 posts

forgot to attach it

aswMBR version 0.9.5.247 Copyright© 2011 AVAST Software
Run date: 2011-05-02 14:30:40
-----------------------------
14:30:40.699 OS Version: Windows 5.1.2600 Service Pack 3
14:30:40.699 Number of processors: 1 586 0x905
14:30:40.699 ComputerName: JOHNNY UserName: ja3756
14:30:41.190 Initialize success
14:30:42.552 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
14:30:42.562 Disk 0 Vendor: IC25N030ATMR04-0 MOAOAD0A Size: 28615MB BusType: 3
14:30:44.625 Disk 0 MBR read successfully
14:30:44.635 Disk 0 MBR scan
14:30:44.635 Disk 0 Windows XP default MBR code
14:30:46.648 Disk 0 scanning sectors +58589055
14:30:46.688 Disk 0 scanning C:\WINDOWS\system32\drivers
14:30:59.406 Service scanning
14:31:05.725 Disk 0 trace - called modules:
14:31:05.755 ntoskrnl.exe CLASSPNP.SYS disk.sys atapi.sys hal.dll pciide.sys PCIIDEX.SYS
14:31:05.765 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x83313ab8]
14:31:05.775 3 CLASSPNP.SYS[f8876fd7] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x83316d98]
14:31:05.785 Scan finished successfully
14:31:12.575 Disk 0 MBR has been saved successfully to "E:\MBR.dat"
14:31:12.605 The log file has been saved successfully to "E:\aswMBR.txt"

Attached Files

aswMBR.txt 1.26KB 114 downloads

#7
Essexboy

Posted 02 May 2011 - 01:33 PM

GeekU Moderator

Retired Staff
69,964 posts

Could you post it please

What are your current problems ?

#8
Essexboy

Posted 02 May 2011 - 01:34 PM

GeekU Moderator

Retired Staff
69,964 posts

OK that now looks good - what problems remain

#9
griruco

Posted 03 May 2011 - 08:09 AM

Member

Topic Starter
Member
74 posts

after using it a bit, I found that upon start up that I get a notepad window that shows the desktop.ini file. It also asks me if I wanted to restore previous homepage or a new one when I go to internet explorer as if it didn't shut down properly when it appeared that it did. Any relevance? Otherwise it looks good. Thank you.

Edited by griruco, 03 May 2011 - 08:14 AM.

#10
Essexboy

Posted 03 May 2011 - 10:59 AM

GeekU Moderator

Retired Staff
69,964 posts

Desktop ini is a system file that we will hide - Reference IE lets see how it runs after I tidy you up

Subject to no further problems :unsure:

I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems

Now the best part of the day ----- Your log now appears clean :yes:

A good workman always cleans up after himself so..The following will implement some cleanup procedures as well as reset System Restore points:

Run OTL

Under the Custom Scans/Fixes box at the bottom, paste in the following

:Commands
[resethosts]
[purity]
[emptytemp]
[EMPTYFLASH]
[CLEARALLRESTOREPOINTS]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot the PC when it is done

Run OTL and hit the cleanup button. It will remove all the programmes we have used plus itself.

We will now confirm that your hidden files are set to that, as some of the tools I use will change that

Click Start.
Open My Computer.
Select the Tools menu and click Folder Options.
Select the View Tab.
Under the Hidden files and folders heading select Do not show hidden files and folders.
Click Yes to confirm.
Click OK.

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version of Java components and upgrade the application.

Upgrading Java:

Go to this site and click Do I have Java
It will check your current version and then offer to update to the latest version

SPRING CLEAN

Download and run Puran Disc Defragmenter
For the first run I would recommend a boot defrag and disk check

Posted Image

Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:

Posted Image

Malwarebytes. Update and run weekly to keep your system clean

Download and install FileHippo update checker and run it monthly it will show you which programmes on your system need updating and give a download link

It is critical to have both a firewall and anti virus to protect your system and to keep them updated.

To keep your operating system up to date visit

Microsoft Windows Update

To learn more about how to protect yourself while on the internet read our little guide How did I get infected in the first place ?
Keep safe

#11
Essexboy

Posted 04 May 2011 - 12:14 PM

GeekU Moderator

Retired Staff
69,964 posts

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.

#12
Essexboy

Posted 06 May 2011 - 10:35 AM

GeekU Moderator

Retired Staff
69,964 posts

User returned

#13
griruco

Posted 06 May 2011 - 07:29 PM

Member

Topic Starter
Member
74 posts

Sorry for the delay returning, and thank you for reopening the topic. Two notepad windows continue to appear upon boot-up. Also, things seem to be running slower than usual. I ran all previous suggestions with success. Thank you.

#14
Essexboy

Posted 07 May 2011 - 04:09 AM

GeekU Moderator

Retired Staff
69,964 posts

OK lets have a look see

Download OTL to your Desktop

Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
Select All Users
Under the Custom Scan box paste this in

netsvcs
%SYSTEMDRIVE%\*.exe
/md5start
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
/md5stop
%systemroot%\*. /mp /s
hklm\software\clients\startmenuinternet|command /rs
hklm\software\clients\startmenuinternet|command /64 /rs
CREATERESTOREPOINT
Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Post both logs

#15
griruco

Posted 09 May 2011 - 08:47 AM

Member

Topic Starter
Member
74 posts

Here they are. Thank you.

OTL logfile created on: 5/9/2011 10:31:07 AM - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Administrator\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

510.00 Mb Total Physical Memory | 147.00 Mb Available Physical Memory | 29.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 70.00% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 27.91 Gb Total Space | 10.47 Gb Free Space | 37.51% Space Free | Partition Type: NTFS
Drive E: | 3.73 Gb Total Space | 3.72 Gb Free Space | 99.93% Space Free | Partition Type: FAT32

Computer Name: JOHNNY | User Name: ja3756 | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/05/02 09:26:24 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Administrator\Desktop\OTL.exe
PRC - [2011/04/11 01:14:28 | 000,419,840 | ---- | M] (Igor Pavlov) -- C:\Program Files\7-Zip\7zFM.exe
PRC - [2011/02/17 06:21:58 | 002,190,688 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\avgtray.exe
PRC - [2011/02/15 05:38:06 | 007,421,280 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
PRC - [2011/02/11 06:25:52 | 001,080,672 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\avgnsx.exe
PRC - [2011/02/10 07:55:18 | 001,148,256 | ---- | M] () -- C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSMonitor.exe
PRC - [2011/02/08 05:33:42 | 000,269,520 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\avgwdsvc.exe
PRC - [2011/02/08 05:33:20 | 000,658,784 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\avgrsx.exe
PRC - [2011/02/08 05:32:48 | 000,351,072 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\avgcsrvx.exe
PRC - [2011/02/08 05:32:46 | 000,656,736 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\avgchsvx.exe
PRC - [2010/08/09 07:47:54 | 000,248,832 | ---- | M] (FileHippo.com) -- C:\Program Files\FileHippo.com\UpdateChecker.exe
PRC - [2008/04/13 19:12:22 | 000,015,360 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\SYSTEM32\INETSRV\inetinfo.exe
PRC - [2008/04/13 19:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007/04/23 04:12:52 | 000,336,944 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe
PRC - [2006/04/20 08:34:26 | 001,520,688 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
PRC - [2005/05/27 09:12:38 | 000,073,728 | ---- | M] () -- c:\alice5\exe\asw_service.exe
PRC - [2005/05/27 09:10:12 | 000,081,920 | ---- | M] (Respironics, Inc.) -- c:\alice5\exe\a5logger.exe
PRC - [2005/05/27 09:07:07 | 000,188,416 | ---- | M] () -- c:\alice5\exe\scanthre.exe
PRC - [2005/05/27 08:59:54 | 000,458,752 | ---- | M] (Respironics, Inc.) -- c:\alice5\exe\sf1serv.exe
PRC - [2003/11/13 13:29:40 | 000,452,608 | ---- | M] () -- C:\Program Files\Linksys\Wireless-N Network Monitor\NICServ.exe
PRC - [2002/08/20 10:29:26 | 000,040,960 | ---- | M] (Easy Systems Japan Ltd.) -- C:\WINDOWS\SYSTEM32\ezSP_Px.exe
PRC - [2002/07/17 11:18:06 | 000,028,672 | ---- | M] (Dell - Advanced Desktop Engineering) -- C:\WINDOWS\SYSTEM32\DSentry.exe

========== Modules (SafeList) ==========

MOD - [2011/05/02 09:26:24 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Administrator\Desktop\OTL.exe
MOD - [2010/08/23 11:12:02 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll

========== Win32 Services (SafeList) ==========

SRV - [2011/02/15 05:38:06 | 007,421,280 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe -- (AVGIDSAgent)
SRV - [2011/02/08 05:33:42 | 000,269,520 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG10\avgwdsvc.exe -- (avgwd)
SRV - [2008/04/13 19:12:22 | 000,015,360 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\SYSTEM32\INETSRV\inetinfo.exe -- (W3SVC)
SRV - [2008/04/13 19:12:22 | 000,015,360 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\SYSTEM32\INETSRV\inetinfo.exe -- (SMTPSVC) Simple Mail Transfer Protocol (SMTP)
SRV - [2008/04/13 19:12:22 | 000,015,360 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\SYSTEM32\INETSRV\inetinfo.exe -- (IISADMIN)
SRV - [2008/04/13 19:12:02 | 000,105,472 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\p2pgasvc.dll -- (p2pgasvc)
SRV - [2008/04/13 19:11:55 | 000,035,328 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\SYSTEM32\iprip.dll -- (Iprip)
SRV - [2007/04/23 04:12:52 | 000,336,944 | ---- | M] (Cisco Systems, Inc.) [Auto | Running] -- C:\Program Files\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe -- (vpnagent)
SRV - [2006/04/20 08:34:26 | 001,520,688 | ---- | M] (Cisco Systems, Inc.) [Auto | Running] -- C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe -- (CVPND)
SRV - [2005/05/27 09:12:38 | 000,073,728 | ---- | M] () [Auto | Running] -- c:\alice5\exe\asw_service.exe -- (AliceSleepware)
SRV - [2004/05/27 01:14:58 | 000,053,337 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe -- (PACSPTISVR)
SRV - [2004/05/27 01:13:00 | 000,069,718 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe -- (SPTISRV)
SRV - [2003/11/13 13:29:40 | 000,452,608 | ---- | M] () [Auto | Running] -- C:\Program Files\Linksys\Wireless-N Network Monitor\NICServ.exe -- (NICSer_WPC300N)
SRV - [2003/04/29 15:29:54 | 000,139,264 | ---- | M] (Intel® Corporation) [On_Demand | Stopped] -- C:\Program Files\Intel\NCS\Sync\NetSvc.exe -- (NetSvc)

========== Driver Services (SafeList) ==========

DRV - [2011/03/30 17:17:22 | 000,134,480 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\AVGIDSDriver.sys -- (AVGIDSDriver)
DRV - [2011/03/01 14:25:18 | 000,034,896 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\avgmfx86.sys -- (Avgmfx86)
DRV - [2011/02/22 08:13:02 | 000,022,992 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\AVGIDSEH.Sys -- (AVGIDSEH)
DRV - [2011/02/10 07:54:00 | 000,296,400 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\avgtdix.sys -- (Avgtdix)
DRV - [2011/02/10 07:53:54 | 000,027,216 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\AVGIDSShim.sys -- (AVGIDSShim)
DRV - [2011/02/10 07:53:52 | 000,024,144 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\AVGIDSFilter.sys -- (AVGIDSFilter)
DRV - [2011/01/19 04:32:56 | 000,032,464 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\avgrkx86.sys -- (Avgrkx86)
DRV - [2011/01/07 06:41:46 | 000,248,656 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\avgldx86.sys -- (Avgldx86)
DRV - [2010/02/11 07:02:15 | 000,226,880 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\tcpip6.sys -- (Tcpip6)
DRV - [2010/01/25 11:38:27 | 000,816,672 | ---- | M] (Ralink Technology, Corp.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\AE1000XP.sys -- (AE1000)
DRV - [2008/04/13 13:56:49 | 000,012,800 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\usb8023.sys -- (USB_RNDIS_XP)
DRV - [2008/04/13 13:56:06 | 000,088,320 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\nwlnkipx.sys -- (NwlnkIpx)
DRV - [2008/04/13 13:36:41 | 000,063,744 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\mf.sys -- (mf)
DRV - [2007/04/23 04:09:58 | 000,024,176 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\vpnva.sys -- (vpnva)
DRV - [2007/03/22 12:57:14 | 000,028,672 | --S- | M] (Gteko Ltd.) [Kernel | Auto | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\elagopro.sys -- (elagopro)
DRV - [2007/03/22 12:57:14 | 000,005,376 | --S- | M] (Gteko Ltd.) [Kernel | Auto | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\elaunidr.sys -- (elaunidr)
DRV - [2006/04/24 23:51:08 | 000,543,104 | ---- | M] (Linksys, A Division of Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\BCMWL5.SYS -- (BCM43XX)
DRV - [2006/04/20 08:33:40 | 000,303,740 | ---- | M] (Cisco Systems, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\CVPNDRVA.sys -- (CVPNDRVA)
DRV - [2005/06/29 19:50:30 | 000,110,080 | ---- | M] (Deterministic Networks, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\dne2000.sys -- (DNE)
DRV - [2005/05/18 13:52:56 | 000,173,056 | ---- | M] (Funk Software, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\odysseyIM4.sys -- (odysseyIM4)
DRV - [2005/05/17 04:51:34 | 000,005,315 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\CVirtA.sys -- (CVirtA)
DRV - [2005/01/26 06:22:20 | 000,280,344 | ---- | M] (Zone Labs LLC) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\vsdatant.sys -- (vsdatant)
DRV - [2004/08/04 00:29:49 | 000,019,455 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\wvchntxx.sys -- (iAimFP4)
DRV - [2004/08/04 00:29:47 | 000,012,063 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\wsiintxx.sys -- (iAimFP3)
DRV - [2004/08/04 00:29:45 | 000,023,615 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\wch7xxnt.sys -- (iAimTV4)
DRV - [2004/08/04 00:29:43 | 000,033,599 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\watv04nt.sys -- (iAimTV3)
DRV - [2004/08/04 00:29:42 | 000,019,551 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\watv02nt.sys -- (iAimTV1)
DRV - [2004/08/04 00:29:41 | 000,029,311 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\watv01nt.sys -- (iAimTV0)
DRV - [2004/08/04 00:29:37 | 000,012,415 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\wadv01nt.sys -- (iAimFP0)
DRV - [2004/08/04 00:29:37 | 000,012,127 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\wadv02nt.sys -- (iAimFP1)
DRV - [2004/08/04 00:29:37 | 000,011,775 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\wadv05nt.sys -- (iAimFP2)
DRV - [2004/08/04 00:29:36 | 000,161,020 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\i81xnt5.sys -- (i81x)
DRV - [2003/11/28 10:35:33 | 000,206,464 | ---- | M] (Roxio) [File_System | System | Running] -- C:\WINDOWS\System32\drivers\udfreadr_xp.sys -- (UdfReadr_xp)
DRV - [2003/11/28 10:35:33 | 000,143,834 | ---- | M] (Roxio) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\pwd_2K.sys -- (pwd_2k)
DRV - [2003/11/28 10:35:33 | 000,030,630 | ---- | M] (Roxio) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\Mmc_2k.sys -- (mmc_2K)
DRV - [2003/11/28 10:35:33 | 000,025,898 | ---- | M] (Roxio) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\Dvd_2k.sys -- (dvd_2K)
DRV - [2003/07/16 22:28:02 | 000,017,142 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\CBTNDIS5.SYS -- (CBTNDIS5)
DRV - [2003/06/10 22:35:58 | 000,093,700 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\Apfiltr.sys -- (ApfiltrService)
DRV - [2003/05/30 19:45:16 | 000,477,403 | ---- | M] (PCtel, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\vpctcom.sys -- (Vpctcom)
DRV - [2003/05/30 18:50:46 | 000,690,973 | ---- | M] (PCTEL, INC.) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\vmodem.sys -- (Vmodem)
DRV - [2003/05/28 13:08:12 | 000,066,111 | ---- | M] (PCtel, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\vvoice.sys -- (Vvoice)
DRV - [2003/04/25 18:10:52 | 000,220,176 | ---- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\STAC97.sys -- (STAC97) Audio Driver (WDM)
DRV - [2003/02/24 16:30:02 | 000,135,292 | ---- | M] (PCTEL, INC.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\ptserial.sys -- (Ptserial)
DRV - [2003/02/15 01:12:20 | 000,032,311 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\wa301b.sys -- ({E2B953A7-195A-44F9-9BA3-3D5F4E32BB55})
DRV - [2003/02/15 01:12:20 | 000,032,311 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\wa301a.sys -- ({E2B953A6-195A-44F9-9BA3-3D5F4E32BB55})
DRV - [2003/01/10 17:13:04 | 000,033,588 | ---- | M] (America Online, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\wanatw4.sys -- (wanatw) WAN Miniport (ATW)
DRV - [2003/01/07 16:19:26 | 000,017,217 | ---- | M] (Dell Computer Corporation) [Kernel | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\omci.sys -- (omci)
DRV - [2002/12/17 13:32:58 | 000,061,424 | ---- | M] (Roxio) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\cdr4_xp.sys -- (Cdr4_xp)
DRV - [2002/12/17 13:32:46 | 000,023,436 | ---- | M] (Roxio) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\cdralw2k.sys -- (Cdralw2k)
DRV - [2002/12/17 13:27:32 | 000,241,152 | ---- | M] (Roxio) [File_System | System | Running] -- C:\WINDOWS\System32\drivers\cdudf_xp.sys -- (cdudf_xp)
DRV - [2002/11/22 21:01:26 | 000,020,096 | ---- | M] (Intel Corporation ) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\iqvw32.sys -- (NAL)
DRV - [2002/11/18 18:20:44 | 000,030,976 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\gv3.sys -- (gv3)
DRV - [2002/08/29 06:00:00 | 000,063,232 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\NWLNKNB.SYS -- (NwlnkNb)
DRV - [2002/08/29 06:00:00 | 000,055,936 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\NWLNKSPX.SYS -- (NwlnkSpx)
DRV - [2002/06/19 03:16:02 | 000,011,840 | ---- | M] (Roxio) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\MRFilter.sys -- (MrFilter)
DRV - [2001/08/17 13:12:12 | 000,002,944 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\BrFilt.sys -- (brfilt)
DRV - [2001/08/17 13:11:06 | 000,066,591 | ---- | M] (3Com Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\EL90XBC5.SYS -- (EL90XBC)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,First Home Page = http://www.dell.com
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,First Home Page = http://www.dell.com
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-4052746277-1771364770-677074465-1008\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
IE - HKU\S-1-5-21-4052746277-1771364770-677074465-1008\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKU\S-1-5-21-4052746277-1771364770-677074465-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-4052746277-1771364770-677074465-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

FF - HKLM\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG10\Firefox4\ [2011/05/02 15:07:04 | 000,000,000 | ---D | M]

O1 HOSTS File: ([2011/05/06 02:41:20 | 000,000,098 | ---- | M]) - C:\WINDOWS\SYSTEM32\DRIVERS\ETC\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG10\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (AcroIEToolbarHelper Class) - {AE7CD045-E861-484f-8273-0445EE161910} - c:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll ()
O2 - BHO: (WiseCleaner Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - c:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll ()
O3 - HKLM\..\Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - No CLSID value found.
O3 - HKLM\..\Toolbar: (WiseCleaner Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKU\S-1-5-21-4052746277-1771364770-677074465-1008\..\Toolbar\ShellBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - c:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll ()
O3 - HKU\S-1-5-21-4052746277-1771364770-677074465-1008\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - c:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll ()
O3 - HKU\S-1-5-21-4052746277-1771364770-677074465-1008\..\Toolbar\WebBrowser: (WiseCleaner Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKU\S-1-5-21-4052746277-1771364770-677074465-1008\..\Toolbar\WebBrowser: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [DVDSentry] C:\WINDOWS\SYSTEM32\DSentry.exe (Dell - Advanced Desktop Engineering)
O4 - HKLM..\Run: [ezShieldProtector for Px] C:\WINDOWS\SYSTEM32\ezSP_Px.exe (Easy Systems Japan Ltd.)
O4 - HKLM..\Run: [PCTVOICE] File not found
O4 - HKU\S-1-5-21-4052746277-1771364770-677074465-1008..\Run: [FileHippo.com] C:\Program Files\FileHippo.com\UpdateChecker.exe (FileHippo.com)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Cisco Systems VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\vpngui.exe (Cisco Systems, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe (Intuit Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableCAD = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: CDRAutoRun = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: CDRAutoRun = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-4052746277-1771364770-677074465-1008\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\SYSTEM32\nwprovau.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKU\S-1-5-21-4052746277-1771364770-677074465-1008\..Trusted Domains: ([]msn in My Computer)
O15 - HKU\S-1-5-21-4052746277-1771364770-677074465-1008\..Trusted Domains: ameritrade.com ([]https in Trusted sites)
O15 - HKU\S-1-5-21-4052746277-1771364770-677074465-1008\..Trusted Domains: aol.com ([objects] * is out of zone range - 5)
O15 - HKU\S-1-5-21-4052746277-1771364770-677074465-1008\..Trusted Domains: tdameritrade.com ([]https in Trusted sites)
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} http://download.av.a...77/mcinsctl.cab (Reg Error: Key error.)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.mi...b?1192329505873 (MUWebControl Class)
O16 - DPF: {9059F30F-4EB1-4BD2-9FDC-36F43A218F4A} http://206.30.161.128/tsweb/msrdp.cab (Microsoft RDP Client Control (redist))
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} http://messenger.msn...pDownloader.cab (MsnMessengerSetupDownloadControl Class)
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} http://download.av.a...,18/mcgdmgr.cab (Reg Error: Key error.)
O16 - DPF: {D1ACD2D8-7312-4D06-BECD-90EB094D2277} http://mediaplayer.w...ler/install.cab (Reg Error: Key error.)
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG10\avgpp.dll (AVG Technologies CZ, s.r.o.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: GinaDLL - (VPNGina.dll) - C:\WINDOWS\System32\vpngina.dll (Cisco Systems, Inc.)
O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\ja3756\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\ja3756\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2002/09/03 14:36:02 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgchsvx.exe /sync) - C:\Program Files\AVG\AVG10\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgrsx.exe /sync /restart) - C:\Program Files\AVG\AVG10\avgrsx.exe (AVG Technologies CZ, s.r.o.)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: Ias - File not found
NetSvcs: Iprip - C:\WINDOWS\SYSTEM32\iprip.dll (Microsoft Corporation)
NetSvcs: Irmon - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

CREATERESTOREPOINT
Error starting restore point: System Restore is disabled.
Error closing restore point: System Restore is disabled.

========== Files/Folders - Created Within 30 Days ==========

[2011/05/06 05:50:43 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\ja3756\Recent
[2011/05/03 12:09:25 | 000,000,000 | ---D | C] -- C:\Documents and Settings\ja3756\Local Settings\Application Data\AskToolbar
[2011/05/03 11:55:31 | 000,000,000 | ---D | C] -- C:\Firefox
[2011/05/03 11:55:31 | 000,000,000 | ---D | C] -- C:\Program Files\Ask.com
[2011/05/03 11:54:34 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Wise Registry Cleaner Free
[2011/05/03 11:44:39 | 000,000,000 | ---D | C] -- C:\WINDOWS\IIS Temporary Compressed Files
[2011/05/03 11:43:44 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\Cache
[2011/05/03 11:37:46 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\Logfiles
[2011/05/03 11:37:46 | 000,000,000 | ---D | C] -- C:\Inetpub
[2011/05/03 11:13:04 | 000,000,000 | ---D | C] -- C:\Documents and Settings\ja3756\Local Settings\Application Data\Temp
[2011/05/03 10:53:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\iTunes
[2011/05/03 10:46:48 | 000,000,000 | ---D | C] -- C:\Program Files\Bonjour
[2011/05/03 09:44:04 | 000,000,000 | ---D | C] -- C:\Program Files\FileHippo.com
[2011/05/03 00:58:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Puran Defrag
[2011/05/03 00:58:18 | 000,000,000 | ---D | C] -- C:\Program Files\Puran Defrag
[2011/05/03 00:50:42 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\CCleaner
[2011/05/03 00:49:49 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2011/05/02 19:33:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\ja3756\Application Data\Malwarebytes
[2011/05/02 19:32:39 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011/05/02 19:32:39 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/05/02 19:32:39 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2011/05/02 19:32:34 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2011/05/02 19:32:34 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2011/05/02 15:55:45 | 000,000,000 | -H-D | C] -- C:\$AVG
[2011/05/02 15:26:29 | 000,000,000 | ---D | C] -- C:\Documents and Settings\ja3756\Application Data\AVG10
[2011/05/02 15:08:37 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\All Users\Application Data\Common Files
[2011/05/02 15:07:34 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\AVG 2011
[2011/05/02 15:02:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\AVG10
[2011/05/02 15:02:38 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\drivers\AVG
[2011/05/02 14:59:19 | 000,000,000 | ---D | C] -- C:\Program Files\AVG
[2011/05/02 14:44:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\MFAData
[2011/05/02 08:39:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\7-Zip
[2011/05/02 08:39:54 | 000,000,000 | ---D | C] -- C:\Program Files\7-Zip
[2011/04/10 07:34:56 | 000,000,000 | ---D | C] -- C:\Temp
[2011/04/10 07:33:15 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\NetworkService\Application Data\AdobeUM
[2011/04/10 07:30:48 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Adobe
[2011/04/10 07:30:26 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\NetworkService\Application Data\Sun
[2008/03/14 23:39:47 | 045,144,176 | ---- | C] (SleepEx Systems, Inc. ) -- C:\Program Files\SleepEx.2.3.build.2.3.0.17.Install.AllUsers.exe

========== Files - Modified Within 30 Days ==========

[2011/05/09 10:40:00 | 000,000,498 | -H-- | M] () -- C:\WINDOWS\tasks\McAfee.com Update Check (JOHNNY-obailey).job
[2011/05/09 10:39:02 | 000,000,498 | -H-- | M] () -- C:\WINDOWS\tasks\McAfee.com Update Check (JOHNNY-Valledo).job
[2011/05/09 10:39:02 | 000,000,496 | -H-- | M] () -- C:\WINDOWS\tasks\McAfee.com Update Check (JOHNNY-ja3756).job
[2011/05/09 10:24:31 | 000,001,170 | ---- | M] () -- C:\WINDOWS\System32\WPA.DBL
[2011/05/09 10:23:19 | 000,002,048 | ---- | M] () -- C:\WINDOWS\BOOTSTAT.DAT
[2011/05/09 10:23:18 | 535,064,576 | -HS- | M] () -- C:\hiberfil.sys
[2011/05/06 06:01:02 | 000,000,236 | ---- | M] () -- C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2011/05/06 05:15:03 | 000,000,017 | ---- | M] () -- C:\WINDOWS\System32\npd6.d
[2011/05/06 02:56:06 | 000,260,640 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011/05/06 02:41:20 | 000,000,098 | ---- | M] () -- C:\WINDOWS\System32\drivers\ETC\Hosts
[2011/05/03 20:41:11 | 114,096,909 | ---- | M] () -- C:\WINDOWS\System32\drivers\AVG\incavi.avm
[2011/05/03 12:09:42 | 000,471,082 | ---- | M] () -- C:\WINDOWS\System32\PERFH009.DAT
[2011/05/03 12:09:42 | 000,088,066 | ---- | M] () -- C:\WINDOWS\System32\PERFC009.DAT
[2011/05/03 12:02:39 | 007,077,888 | ---- | M] () -- C:\Documents and Settings\ja3756\ntuser.bak
[2011/05/03 11:54:52 | 000,001,085 | ---- | M] () -- C:\Documents and Settings\ja3756\Application Data\Microsoft\Internet Explorer\Quick Launch\Wise Registry Cleaner.lnk
[2011/05/03 11:54:51 | 000,001,067 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Wise Registry Cleaner.lnk
[2011/05/03 11:44:45 | 000,000,779 | ---- | M] () -- C:\Documents and Settings\ja3756\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2011/05/03 10:53:37 | 000,001,542 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2011/05/03 10:32:03 | 000,001,734 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader X.lnk
[2011/05/03 09:44:16 | 000,001,632 | ---- | M] () -- C:\Documents and Settings\ja3756\Desktop\Update Checker.lnk
[2011/05/03 00:58:32 | 000,000,740 | ---- | M] () -- C:\Documents and Settings\ja3756\Desktop\Puran Defrag.lnk
[2011/05/03 00:50:41 | 000,000,682 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\CCleaner.lnk
[2011/05/02 19:32:40 | 000,000,784 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/05/02 15:07:42 | 000,000,690 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\AVG 2011.lnk

========== Files Created - No Company Name ==========

[2011/05/03 20:41:11 | 114,096,909 | ---- | C] () -- C:\WINDOWS\System32\drivers\AVG\incavi.avm
[2011/05/03 11:55:49 | 000,000,236 | ---- | C] () -- C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2011/05/03 11:54:52 | 000,001,085 | ---- | C] () -- C:\Documents and Settings\ja3756\Application Data\Microsoft\Internet Explorer\Quick Launch\Wise Registry Cleaner.lnk
[2011/05/03 11:54:51 | 000,001,067 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Wise Registry Cleaner.lnk
[2011/05/03 11:44:45 | 000,000,779 | ---- | C] () -- C:\Documents and Settings\ja3756\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2011/05/03 11:44:44 | 000,000,767 | ---- | C] () -- C:\Documents and Settings\ja3756\Start Menu\Programs\Internet Explorer.lnk
[2011/05/03 11:42:26 | 000,021,791 | ---- | C] () -- C:\WINDOWS\System32\smtpctrs.ini
[2011/05/03 11:42:26 | 000,008,002 | ---- | C] () -- C:\WINDOWS\System32\smtpctrs.h
[2011/05/03 11:42:25 | 000,001,037 | ---- | C] () -- C:\WINDOWS\System32\ntfsdrct.ini
[2011/05/03 11:42:25 | 000,000,773 | ---- | C] () -- C:\WINDOWS\System32\ntfsdrct.h
[2011/05/03 11:41:17 | 000,009,522 | ---- | C] () -- C:\WINDOWS\Zapotec.bmp
[2011/05/03 11:41:16 | 000,065,832 | ---- | C] () -- C:\WINDOWS\Santa Fe Stucco.bmp
[2011/05/03 11:41:16 | 000,026,680 | ---- | C] () -- C:\WINDOWS\River Sumida.bmp
[2011/05/03 11:41:16 | 000,017,362 | ---- | C] () -- C:\WINDOWS\Rhododendron.bmp
[2011/05/03 11:41:15 | 000,065,954 | ---- | C] () -- C:\WINDOWS\Prairie Wind.bmp
[2011/05/03 11:41:15 | 000,026,582 | ---- | C] () -- C:\WINDOWS\Greenstone.bmp
[2011/05/03 11:41:15 | 000,017,336 | ---- | C] () -- C:\WINDOWS\Gone Fishing.bmp
[2011/05/03 11:41:15 | 000,017,062 | ---- | C] () -- C:\WINDOWS\Coffee Bean.bmp
[2011/05/03 11:41:15 | 000,016,730 | ---- | C] () -- C:\WINDOWS\FeatherTexture.bmp
[2011/05/03 11:41:14 | 000,065,978 | ---- | C] () -- C:\WINDOWS\Soap Bubbles.bmp
[2011/05/03 11:41:14 | 000,001,272 | ---- | C] () -- C:\WINDOWS\Blue Lace 16.bmp
[2011/05/03 11:41:02 | 000,038,576 | ---- | C] () -- C:\WINDOWS\System32\w3ctrs.ini
[2011/05/03 11:41:02 | 000,010,225 | ---- | C] () -- C:\WINDOWS\System32\axperf.ini
[2011/05/03 11:41:02 | 000,005,379 | ---- | C] () -- C:\WINDOWS\System32\w3ctrs.h
[2011/05/03 11:41:02 | 000,002,024 | ---- | C] () -- C:\WINDOWS\System32\axctrnm.h
[2011/05/03 11:41:00 | 000,011,435 | ---- | C] () -- C:\WINDOWS\System32\infoctrs.ini
[2011/05/03 11:41:00 | 000,003,276 | ---- | C] () -- C:\WINDOWS\System32\infoctrs.h
[2011/05/03 11:40:57 | 000,049,275 | ---- | C] () -- C:\WINDOWS\System32\wfospf.mib
[2011/05/03 11:40:57 | 000,038,608 | ---- | C] () -- C:\WINDOWS\System32\nipx.mib
[2011/05/03 11:40:57 | 000,034,317 | ---- | C] () -- C:\WINDOWS\System32\msiprip2.mib
[2011/05/03 11:40:57 | 000,026,236 | ---- | C] () -- C:\WINDOWS\System32\wins.mib
[2011/05/03 11:40:57 | 000,013,767 | ---- | C] () -- C:\WINDOWS\System32\msipbtp.mib
[2011/05/03 11:40:57 | 000,004,332 | ---- | C] () -- C:\WINDOWS\System32\smi.mib
[2011/05/03 11:40:57 | 000,000,581 | ---- | C] () -- C:\WINDOWS\System32\msft.mib
[2011/05/03 11:40:56 | 000,107,882 | ---- | C] () -- C:\WINDOWS\System32\mib_ii.mib
[2011/05/03 11:40:56 | 000,048,593 | ---- | C] () -- C:\WINDOWS\System32\hostmib.mib
[2011/05/03 11:40:56 | 000,030,448 | ---- | C] () -- C:\WINDOWS\System32\mcastmib.mib
[2011/05/03 11:40:56 | 000,026,100 | ---- | C] () -- C:\WINDOWS\System32\lmmib2.mib
[2011/05/03 11:40:56 | 000,021,386 | ---- | C] () -- C:\WINDOWS\System32\mipx.mib
[2011/05/03 11:40:56 | 000,020,079 | ---- | C] () -- C:\WINDOWS\System32\http.mib
[2011/05/03 11:40:56 | 000,015,799 | ---- | C] () -- C:\WINDOWS\System32\ipforwd.mib
[2011/05/03 11:40:56 | 000,010,313 | ---- | C] () -- C:\WINDOWS\System32\mripsap.mib
[2011/05/03 11:40:56 | 000,006,179 | ---- | C] () -- C:\WINDOWS\System32\ftp.mib
[2011/05/03 11:40:56 | 000,004,597 | ---- | C] () -- C:\WINDOWS\System32\dhcp.mib
[2011/05/03 11:40:56 | 000,000,698 | ---- | C] () -- C:\WINDOWS\System32\inetsrv.mib
[2011/05/03 11:40:55 | 000,016,617 | ---- | C] () -- C:\WINDOWS\System32\authserv.mib
[2011/05/03 11:40:55 | 000,015,597 | ---- | C] () -- C:\WINDOWS\System32\accserv.mib
[2011/05/03 10:53:37 | 000,001,542 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2011/05/03 10:32:02 | 000,001,734 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader X.lnk
[2011/05/03 10:31:58 | 000,001,804 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Adobe Reader X.lnk
[2011/05/03 09:44:16 | 000,001,638 | ---- | C] () -- C:\Documents and Settings\ja3756\Start Menu\Programs\Update Checker.lnk
[2011/05/03 09:44:14 | 000,001,632 | ---- | C] () -- C:\Documents and Settings\ja3756\Desktop\Update Checker.lnk
[2011/05/03 00:58:48 | 000,000,017 | ---- | C] () -- C:\WINDOWS\System32\npd6.d
[2011/05/03 00:58:32 | 000,000,740 | ---- | C] () -- C:\Documents and Settings\ja3756\Desktop\Puran Defrag.lnk
[2011/05/03 00:50:41 | 000,000,682 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\CCleaner.lnk
[2011/05/02 19:32:40 | 000,000,784 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/05/02 15:07:42 | 000,000,690 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\AVG 2011.lnk
[2011/05/02 14:40:43 | 535,064,576 | -HS- | C] () -- C:\hiberfil.sys
[2011/04/03 20:02:56 | 000,054,996 | ---- | C] () -- C:\WINDOWS\System32\mlfcache.dat
[2010/06/27 15:07:51 | 000,683,801 | ---- | C] () -- C:\WINDOWS\unins000.exe
[2010/06/27 15:07:51 | 000,001,067 | ---- | C] () -- C:\WINDOWS\unins000.dat
[2010/05/24 08:55:41 | 000,013,931 | ---- | C] () -- C:\WINDOWS\System32\RaCoInst.dat
[2009/08/03 15:07:42 | 000,403,816 | ---- | C] () -- C:\WINDOWS\System32\OGACheckControl.dll
[2009/08/03 15:07:42 | 000,230,768 | ---- | C] () -- C:\WINDOWS\System32\OGAEXEC.exe
[2007/09/03 22:20:13 | 000,000,027 | ---- | C] () -- C:\WINDOWS\BRPP2KA.INI
[2007/09/03 22:18:58 | 000,000,225 | -H-- | C] () -- C:\WINDOWS\Brpfx04a.ini
[2007/09/03 22:18:58 | 000,000,093 | -H-- | C] () -- C:\WINDOWS\brpcfx.ini
[2007/09/03 22:18:58 | 000,000,050 | ---- | C] () -- C:\WINDOWS\System32\bridf06a.dat
[2007/09/03 22:16:04 | 000,106,496 | ---- | C] () -- C:\WINDOWS\System32\BrMuSNMP.dll
[2007/09/03 19:17:01 | 000,000,061 | -H-- | C] () -- C:\WINDOWS\init.ini
[2007/09/03 15:41:53 | 000,001,155 | ---- | C] () -- C:\WINDOWS\checkip.dat
[2007/02/26 09:29:38 | 000,197,680 | ---- | C] () -- C:\WINDOWS\System32\vpnapi.dll
[2006/08/22 14:45:17 | 000,007,680 | ---- | C] () -- C:\WINDOWS\System32\CNMVS64.DLL
[2006/08/22 09:07:08 | 000,029,752 | ---- | C] () -- C:\WINDOWS\System32\InstHelper.dll
[2006/02/24 21:27:26 | 000,000,006 | -H-- | C] () -- C:\WINDOWS\msoffice.ini
[2006/02/11 12:59:53 | 000,000,000 | -H-- | C] () -- C:\Documents and Settings\ja3756\Application Data\dm.ini
[2005/11/08 16:42:22 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\WIAEH.dll
[2005/11/08 16:42:22 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\WIAIPH.dll
[2005/11/08 16:42:22 | 000,053,315 | ---- | C] () -- C:\WINDOWS\System32\Sswiadrv.dll
[2005/11/08 16:42:22 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\WIASTIIO.dll
[2005/11/04 10:21:24 | 000,193,584 | ---- | C] () -- C:\WINDOWS\System32\CSGina.dll
[2005/09/20 19:57:19 | 000,000,419 | ---- | C] () -- C:\WINDOWS\BRWMARK.INI
[2005/09/20 19:57:19 | 000,000,034 | ---- | C] () -- C:\WINDOWS\System32\BD7820N.DAT
[2005/03/28 13:28:56 | 000,000,000 | -H-- | C] () -- C:\Documents and Settings\ja3756\Local Settings\Application Data\dlm.dat
[2004/12/25 19:38:07 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\pxhpinst.exe
[2004/11/18 07:44:41 | 000,000,129 | -H-- | C] () -- C:\Documents and Settings\ja3756\Local Settings\Application Data\fusioncache.dat
[2004/11/16 12:06:44 | 000,000,035 | -H-- | C] () -- C:\WINDOWS\webica.ini
[2004/09/07 11:00:26 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2004/07/06 13:28:56 | 000,007,168 | -H-- | C] () -- C:\Documents and Settings\ja3756\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2004/05/24 12:44:38 | 000,000,407 | ---- | C] () -- C:\WINDOWS\LEXSTAT.INI
[2004/05/23 09:45:23 | 000,000,050 | -H-- | C] () -- C:\WINDOWS\upth.ini
[2004/05/23 09:45:23 | 000,000,024 | -H-- | C] () -- C:\WINDOWS\atid.ini
[2004/03/29 11:48:56 | 000,000,560 | ---- | C] () -- C:\WINDOWS\DELLSTAT.INI
[2004/01/12 15:13:52 | 000,002,656 | ---- | C] () -- C:\WINDOWS\ACTWIN2.INI
[2003/12/14 23:14:38 | 000,000,715 | ---- | C] () -- C:\WINDOWS\aolback.exe.lnk
[2003/12/14 23:10:10 | 000,000,335 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2003/11/28 10:38:01 | 000,000,061 | -H-- | C] () -- C:\WINDOWS\smscfg.ini
[2003/11/28 10:27:53 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2003/11/28 10:16:00 | 000,000,791 | -H-- | C] () -- C:\WINDOWS\orun32.ini
[2003/11/28 09:59:48 | 000,002,048 | ---- | C] () -- C:\WINDOWS\BOOTSTAT.DAT
[2003/11/28 09:58:50 | 000,471,082 | ---- | C] () -- C:\WINDOWS\System32\PERFH009.DAT
[2003/11/28 09:58:50 | 000,088,066 | ---- | C] () -- C:\WINDOWS\System32\PERFC009.DAT
[2003/11/28 09:57:35 | 000,001,536 | ---- | C] () -- C:\WINDOWS\System32\TrueSoft.dat
[2003/11/28 09:45:32 | 000,000,545 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2003/01/07 16:05:08 | 000,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2002/09/03 14:42:36 | 000,260,640 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2002/09/03 14:35:18 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2002/09/03 14:31:48 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2002/09/03 09:31:46 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\OEMBIOS.BIN
[2002/09/03 09:31:44 | 000,004,594 | ---- | C] () -- C:\WINDOWS\System32\OEMBIOS.DAT
[2002/08/29 06:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\MLANG.DAT
[2002/08/29 06:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\PERFI009.DAT
[2002/08/29 06:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\DSSEC.DAT
[2002/08/29 06:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\MIB.BIN
[2002/08/29 06:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\PERFD009.DAT
[2002/08/29 06:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2002/08/29 06:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\NOISE.DAT
[2002/03/04 10:16:34 | 000,110,592 | ---- | C] () -- C:\WINDOWS\System32\Jpeg32.dll
[2001/10/24 16:00:40 | 000,524,288 | ---- | C] () -- C:\WINDOWS\System32\TDI-SonyOMG.dll
[1980/01/01 01:00:00 | 000,163,840 | ---- | C] () -- C:\WINDOWS\System32\pctspk .exe
[1980/01/01 01:00:00 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\mdmmoh.dll
[1980/01/01 01:00:00 | 000,016,384 | ---- | C] () -- C:\WINDOWS\System32\e100bmsg.dll
[1980/01/01 01:00:00 | 000,000,456 | ---- | C] () -- C:\WINDOWS\System32\pthsp.dat

========== LOP Check ==========

[2011/05/02 18:14:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVG10
[2007/12/29 09:40:49 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\Cisco
[2010/05/24 07:29:23 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\Cisco Systems
[2011/05/02 15:08:37 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\Common Files
[2011/05/02 15:26:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MFAData
[2010/06/27 15:17:32 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\myitlab
[2011/05/02 19:24:14 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\ScanSoft
[2008/07/18 14:12:41 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint
[2011/03/27 18:30:11 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2011/05/02 15:26:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\ja3756\Application Data\AVG10
[2004/11/16 12:07:12 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\ja3756\Application Data\ICAClient
[2004/02/11 21:12:09 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\ja3756\Application Data\InterVideo
[2006/02/24 07:10:53 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\ja3756\Application Data\Leadertech
[2005/06/28 20:18:34 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\ja3756\Application Data\Learn2.com
[2005/07/07 21:43:54 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\ja3756\Application Data\Respironics
[2008/07/18 14:12:43 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\ja3756\Application Data\Viewpoint
[2011/05/06 06:01:02 | 000,000,236 | ---- | M] () -- C:\WINDOWS\Tasks\Scheduled Update for Ask Toolbar.job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >
[2005/12/05 18:16:46 | 000,010,920 | ---- | M] () -- C:\aolconnfix.exe

< MD5 for: EXPLORER.EXE >
[2008/04/13 19:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS\explorer.exe
[2008/04/13 19:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS\ServicePackFiles\i386\explorer.exe
[2007/06/13 06:26:03 | 001,033,216 | ---- | M] (Microsoft Corporation) MD5=7712DF0CDDE3A5AC89843E61CD5B3658 -- C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
[2007/06/13 05:23:07 | 001,033,216 | ---- | M] (Microsoft Corporation) MD5=97BD6515465659FF8F3B7BE375B2EA87 -- C:\WINDOWS\$NtServicePackUninstall$\explorer.exe
[2004/08/04 02:56:49 | 001,032,192 | ---- | M] (Microsoft Corporation) MD5=A0732187050030AE399B241436565E64 -- C:\WINDOWS\$NtUninstallKB938828$\explorer.exe

< MD5 for: SVCHOST.EXE >
[2002/08/29 06:00:00 | 000,012,800 | ---- | M] (Microsoft Corporation) MD5=0F7D9C87B0CE1FA520473119752C6F79 -- C:\I386\SVCHOST.EXE
[2008/04/13 19:12:36 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 -- C:\WINDOWS\ServicePackFiles\i386\svchost.exe
[2008/04/13 19:12:36 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 -- C:\WINDOWS\SYSTEM32\svchost.exe
[2004/08/04 02:56:57 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=8F078AE4ED187AAABC0A305146DE6716 -- C:\WINDOWS\$NtServicePackUninstall$\svchost.exe

< MD5 for: USERINIT.EXE >
[2004/08/04 02:56:57 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=39B1FFB03C2296323832ACBAE50D2AFF -- C:\WINDOWS\$NtServicePackUninstall$\userinit.exe
[2008/04/13 19:12:38 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe
[2008/04/13 19:12:38 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 -- C:\WINDOWS\SYSTEM32\userinit.exe
[2002/08/29 06:00:00 | 000,022,016 | ---- | M] (Microsoft Corporation) MD5=E931E0A2B8BF0019DB902E98D03662CB -- C:\I386\USERINIT.EXE

< MD5 for: WINLOGON.EXE >
[2004/08/04 02:56:57 | 000,502,272 | ---- | M] (Microsoft Corporation) MD5=01C3346C241652F43AED8E2149881BFE -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
[2002/08/29 06:00:00 | 000,516,608 | ---- | M] (Microsoft Corporation) MD5=2246D8D8F4714A2CEDB21AB9B1849ABB -- C:\I386\WINLOGON.EXE
[2008/04/13 19:12:39 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
[2008/04/13 19:12:39 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E -- C:\WINDOWS\SYSTEM32\winlogon.exe

< %systemroot%\*. /mp /s >

< hklm\software\clients\startmenuinternet|command /rs >
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ReinstallCommand: "C:\WINDOWS\system32\ie4uinit.exe" -reinstall [2011/02/18 06:49:53 | 000,173,568 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\HideIconsCommand: "C:\WINDOWS\system32\ie4uinit.exe" -hide [2011/02/18 06:49:53 | 000,173,568 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ShowIconsCommand: "C:\WINDOWS\system32\ie4uinit.exe" -show [2011/02/18 06:49:53 | 000,173,568 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\naom\command\\: "C:\Program Files\Internet Explorer\iexplore.exe" -extoff [2009/03/08 14:09:26 | 000,638,816 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\open\command\\: C:\Program Files\Internet Explorer\iexplore.exe [2009/03/08 14:09:26 | 000,638,816 | ---- | M] (Microsoft Corporation)

< hklm\software\clients\startmenuinternet|command /64 /rs >
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ReinstallCommand: "C:\WINDOWS\system32\ie4uinit.exe" -reinstall [2011/02/18 06:49:53 | 000,173,568 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\HideIconsCommand: "C:\WINDOWS\system32\ie4uinit.exe" -hide [2011/02/18 06:49:53 | 000,173,568 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ShowIconsCommand: "C:\WINDOWS\system32\ie4uinit.exe" -show [2011/02/18 06:49:53 | 000,173,568 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\naom\command\\: "C:\Program Files\Internet Explorer\iexplore.exe" -extoff [2009/03/08 14:09:26 | 000,638,816 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\open\command\\: C:\Program Files\Internet Explorer\iexplore.exe [2009/03/08 14:09:26 | 000,638,816 | ---- | M] (Microsoft Corporation)

< >

< >

< End of report >