Page 1 of 3 123 LastLast
Results 1 to 10 of 27

Thread: DEP Issues???

  1. 2011-04-04, 23:12 #1
    whistler
    whistler is offline
    Member
    Join Date
    Apr 2009
    Posts
    57

    Default

    Just today I noticed that all the Firefox links on my desktop were greyed out, but they still work. I then noticed that the desktop icon in my TaskBar disappeared. I ran Spybot and it didn't detect anything. But when I tried to update Malwarebytes I received an "access is denied" error message when the updater tried to save the downloaded file. Malwarebytes support suggested that I do a "Run as" the administrator. Which I tried, but each time that I did, I received an operating system Data Execution Prevention message related to Windows Explorer.

    I'm sure that I have some sort of bug here, but I don't know where to begin to look. Can anyone help me here?

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    .
    DDS (Ver_11-03-05.01) - NTFSx86
    Run by Bob at 15:54:23.76 on Mon 04/04/2011
    Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_17
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2037.1340 [GMT -5:00]
    .
    AV: AVG Anti-Virus Free *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
    .
    ============== Running Processes ===============
    .
    C:\WINDOWS\system32\svchost -k DcomLaunch
    svchost.exe
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    svchost.exe
    svchost.exe
    C:\Program Files\AVG\AVG9\avgchsvx.exe
    C:\Program Files\AVG\AVG9\avgrsx.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\AVG\AVG9\avgcsrvx.exe
    svchost.exe
    C:\Program Files\AVG\AVG9\avgwdsvc.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\LogMeIn\x86\LMIGuardianSvc.exe
    C:\Program Files\LogMeIn\x86\RaMaint.exe
    C:\Program Files\LogMeIn\x86\LogMeIn.exe
    C:\Program Files\AVG\AVG9\avgnsx.exe
    C:\Program Files\Norton Ghost\Agent\VProSvc.exe
    C:\WINDOWS\system32\svchost.exe -k imgsvc
    C:\WINDOWS\system32\dllhost.exe
    C:\WINDOWS\system32\dllhost.exe
    C:\WINDOWS\System32\svchost.exe -k HTTPFilter
    C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe
    C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACA.EXE
    C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
    C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe
    C:\WINDOWS\system32\igfxpers.exe
    C:\WINDOWS\RTHDCPL.EXE
    C:\WINDOWS\system32\igfxsrvc.exe
    C:\Program Files\Norton Ghost\Agent\VProTray.exe
    C:\Program Files\My Lockbox\flockbox.exe
    C:\Program Files\LogMeIn\x86\LogMeInSystray.exe
    C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
    C:\Program Files\SlySoft\AnyDVD\AnyDVDtray.exe
    C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe
    C:\Program Files\Skype\Phone\Skype.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\OpenDNS Updater\OpenDNSUpdater.exe
    C:\Program Files\DAEMON Tools Lite\DTLite.exe
    C:\Program Files\Adobe\Adobe Acrobat 6.0\Distillr\acrotray.exe
    C:\Program Files\Omega Research\Program\orschd.exe
    C:\Program Files\Norton Ghost\Shared\Drivers\SymSnapService.exe
    C:\Program Files\Microsoft Office\Office\OSA.EXE
    C:\WINDOWS\explorer.exe
    C:\Program Files\Outlook Express\msimn.exe
    C:\Documents and Settings\Bob\Desktop\dds.scr
    .
    ============== Pseudo HJT Report ===============
    .
    uStart Page = hxxp://twitter.com/
    uSearchURL,(Default) = hxxp://toolbar.ask.com/toolbarv/askRedirect?o=10591&gct=&gc=1&q=%s
    mURLSearchHooks: H - No File
    BHO: HelperObject Class: {00c6482d-c502-44c8-8409-fce54ad9c208} - c:\program files\techsmith\snagit 7\SnagItBHO.dll
    BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
    BHO: Skype add-on (mastermind): {22bf413b-c6d2-4d91-82a9-a0f997ba588c} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll
    BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll
    BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
    BHO: AcroIEToolbarHelper Class: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\adobe\adobe acrobat 6.0\acrobat\AcroIEFavClient.dll
    BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    BHO: EpsonToolBandKicker Class: {e99421fb-68dd-40f0-b4ac-b7027cae2f1a} - c:\program files\epson\epson web-to-page\EPSON Web-To-Page.dll
    TB: SnagIt: {8ff5e183-abde-46eb-b09e-d2aab95cabe3} - c:\program files\techsmith\snagit 7\SnagItIEAddin.dll
    TB: EPSON Web-To-Page: {ee5d279f-081b-4404-994d-c6b60aaeba6d} - c:\program files\epson\epson web-to-page\EPSON Web-To-Page.dll
    TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\adobe\adobe acrobat 6.0\acrobat\AcroIEFavClient.dll
    TB: DAEMON Tools Toolbar: {32099aac-c132-4136-9e9a-4e364a424e17} - c:\program files\daemon tools toolbar\DTToolbar.dll
    uRun: [AnyDVD] c:\program files\slysoft\anydvd\AnyDVDtray.exe
    uRun: [Advanced SystemCare 3] "c:\program files\iobit\advanced systemcare 3\AWC.exe" /startup
    uRun: [Skype] "c:\program files\skype\\phone\Skype.exe" /nosplash /minimized
    uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
    uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
    uRun: [OpenDNS Updater] "c:\program files\opendns updater\OpenDNSUpdater.exe" /autostart
    uRun: [DAEMON Tools Lite] "c:\program files\daemon tools lite\DTLite.exe" -autorun
    mRun: [CloneCDTray] "c:\program files\slysoft\clonecd\CloneCDTray.exe" /s
    mRun: [EPSON Stylus CX3800 Series] c:\windows\system32\spool\drivers\w32x86\3\E_FATIACA.EXE /P26 "EPSON Stylus CX3800 Series" /O6 "USB001" /M "Stylus CX3800"
    mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
    mRun: [AdobeVersionCue] c:\program files\adobe\adobe version cue\controlpanel\VersionCueTray.exe
    mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
    mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
    mRun: [Persistence] c:\windows\system32\igfxpers.exe
    mRun: [RTHDCPL] RTHDCPL.EXE
    mRun: [Norton Ghost 14.0] "c:\program files\norton ghost\agent\VProTray.exe"
    mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
    mRun: [flockbox] c:\program files\my lockbox\flockbox.exe /a
    mRun: [Ad-Watch] c:\program files\lavasoft\ad-aware\AAWTray.exe
    mRun: [ISUSPM Startup] c:\progra~1\common~1\instal~1\update~1\isuspm.exe -startup
    mRun: [LogMeIn GUI] "c:\program files\logmein\x86\LogMeInSystray.exe"
    mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
    mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
    StartupFolder: c:\docume~1\bob\startm~1\programs\startup\erunta~1.lnk - c:\program files\erunt\AUTOBACK.EXE
    StartupFolder: c:\docume~1\bob\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office\FINDFAST.EXE
    StartupFolder: c:\docume~1\bob\startm~1\programs\startup\office~1.lnk - c:\program files\microsoft office\office\OSA.EXE
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\acroba~1.lnk - c:\program files\adobe\adobe acrobat 6.0\distillr\acrotray.exe
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\omegar~1.lnk - c:\program files\omega research\program\orschd.exe
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\paltalk.lnk - c:\program files\paltalk messenger\paltalk.exe
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\window~1.lnk - c:\program files\windows desktop search\WindowsSearch.exe
    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    IE: {FB858B22-55E2-413f-87F5-30ADC5552151} - c:\program files\plotsoft\pdfill\DownloadPDF.exe
    IE: {5067A26B-1337-4436-8AFE-EE169C2DA79F} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll
    IE: {77BF5300-1474-4EC7-9980-D32B190E9B07} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll
    IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
    DPF: {254AA86E-5655-4518-AA87-185D7CC41801} - hxxps://secure.logmeinrescue.com/TechConsole/x86/RescueControl.cab
    DPF: {33564D57-0000-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
    DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos-beta/OnlineScanner.cab
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
    DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
    DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
    DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
    DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} - hxxps://secure.logmein.com/activex/ractrl.cab?lmi=100
    Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg9\avgpp.dll
    Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} -
    Notify: avgrsstarter - avgrsstx.dll
    Notify: igfxcui - igfxdev.dll
    Notify: LMIinit - LMIinit.dll
    SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
    Hosts: 255.255.255.255 hcurltest5
    Hosts: 255.255.255.255 vnsjs1.1stworks.com
    Hosts: 74.208.77.54 hcurltest1
    Hosts: 74.208.223.76 hcurltest2
    Hosts: 255.255.255.255 hcurltest4
    .
    ================= FIREFOX ===================
    .
    FF - ProfilePath - c:\docume~1\bob\applic~1\mozilla\firefox\profiles\vw9a9lod.default\
    FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
    FF - component: c:\documents and settings\bob\application data\mozilla\firefox\profiles\vw9a9lod.default\extensions\dttoolbar@toolbarnet.com\components\DTToolbarFF.dll
    FF - component: c:\documents and settings\bob\application data\mozilla\firefox\profiles\vw9a9lod.default\extensions\twitternotifier@naan.net\platform\winnt\components\nsTwitterFoxSign.dll
    FF - component: c:\program files\avg\avg9\firefox\components\avgssff.dll
    FF - plugin: c:\documents and settings\bob\application data\mozilla\firefox\profiles\vw9a9lod.default\extensions\logmeinclient@logmein.com\plugins\npRACtrl.dll
    FF - plugin: c:\program files\mozilla firefox\plugins\npatgpc.dll
    FF - plugin: c:\program files\netscape\navigator\program\plugins\np32dsw.dll
    FF - plugin: c:\program files\netscape\navigator\program\plugins\NPDOC.DLL
    FF - plugin: c:\program files\netscape\navigator\program\plugins\npdrmv2.dll
    FF - plugin: c:\program files\netscape\navigator\program\plugins\npdsplay.dll
    FF - plugin: c:\program files\netscape\navigator\program\plugins\NPJPI142_06.dll
    FF - plugin: c:\program files\netscape\navigator\program\plugins\nppdf32.dll
    FF - plugin: c:\program files\netscape\navigator\program\plugins\nppl3260.dll
    FF - plugin: c:\program files\netscape\navigator\program\plugins\nprfxins.dll
    FF - plugin: c:\program files\netscape\navigator\program\plugins\nprjplug.dll
    FF - plugin: c:\program files\netscape\navigator\program\plugins\nprpjplug.dll
    FF - plugin: c:\program files\netscape\navigator\program\plugins\NPSVG3.dll
    FF - plugin: c:\program files\netscape\navigator\program\plugins\npwmsdrm.dll
    FF - plugin: c:\program files\netscape\navigator\program\plugins\npyacs.dll
    FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
    FF - Ext: DAEMON Tools Toolbar: DTToolbar@toolbarnet.com - %profile%\extensions\DTToolbar@toolbarnet.com
    FF - Ext: LogMeIn, Inc. Remote Access Plugin: LogMeInClient@logmein.com - %profile%\extensions\LogMeInClient@logmein.com
    FF - Ext: Echofon: twitternotifier@naan.net - %profile%\extensions\twitternotifier@naan.net
    FF - Ext: PDF Download: {37E4D8EA-8BDA-4831-8EA1-89053939A250} - %profile%\extensions\{37E4D8EA-8BDA-4831-8EA1-89053939A250}
    FF - Ext: Ant Video Downloader: anttoolbar@ant.com - %profile%\extensions\anttoolbar@ant.com
    FF - Ext: ReloadEvery: {888d99e7-e8b5-46a3-851e-1ec45da1e644} - %profile%\extensions\{888d99e7-e8b5-46a3-851e-1ec45da1e644}
    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension
    FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\java\jre6\lib\deploy\jqs\ff
    FF - Ext: AVG Safe Search: {3f963a5b-e555-4543-90e2-c3908898db71} - c:\program files\avg\avg9\Firefox
    .
    ---- FIREFOX POLICIES ----
    FF - user.js: capability.policy.policynames - allowclipboard
    FF - user.js: capability.policy.allowclipboard.sites - hxxp://www.insidefutures.com http://www.futuresknowledge.com
    FF - user.js: capability.policy.allowclipboard.Clipboard.cutcopy - allAccess
    FF - user.js: capability.policy.allowclipboard.Clipboard.paste - allAccess
    ============= SERVICES / DRIVERS ===============
    .
    R0 MPRIFL;MPRIFL;c:\windows\system32\drivers\mprifl.sys [2008-4-17 17264]
    R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-5-5 216400]
    R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2009-5-5 29584]
    R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-5-5 243024]
    R2 avg9wd;AVG Free WatchDog;c:\program files\avg\avg9\avgwdsvc.exe [2010-7-15 308136]
    R2 LMIGuardianSvc;LMIGuardianSvc;c:\program files\logmein\x86\LMIGuardianSvc.exe [2010-10-5 374152]
    R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\logmein\x86\rainfo.sys [2010-1-27 12856]
    R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [2010-7-13 47640]
    R2 Symantec SymSnap VSS Provider;Symantec SymSnap VSS Provider;c:\windows\system32\dllhost.exe [2004-8-4 5120]
    R3 SymSnapService;SymSnapService;c:\program files\norton ghost\shared\drivers\SymSnapService.exe [2007-12-20 1553896]
    R3 TotRec7;Total Recorder WDM audio driver;c:\windows\system32\drivers\TotRec7.sys [2009-5-10 127496]
    S0 AVG Anti-Rootkit;AVG Anti-Rootkit;c:\windows\system32\drivers\avgarkt.sys --> c:\windows\system32\drivers\avgarkt.sys [?]
    S0 Lbd;Lbd;c:\windows\system32\drivers\lbd.sys --> c:\windows\system32\drivers\Lbd.sys [?]
    S1 AvgArCln;Avg Anti-Rootkit Clean Driver;c:\windows\system32\drivers\avgarcln.sys --> c:\windows\system32\drivers\AvgArCln.sys [?]
    S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;"c:\program files\lavasoft\ad-aware\aawservice.exe" --> c:\program files\lavasoft\ad-aware\AAWService.exe [?]
    S3 NLNdisMP;NLNdisMP;c:\windows\system32\drivers\nlndis.sys --> c:\windows\system32\drivers\nlndis.sys [?]
    S3 NLNdisPT;NetLimiter Ndis Protocol Service;c:\windows\system32\drivers\nlndis.sys --> c:\windows\system32\drivers\nlndis.sys [?]
    S4 LMIRfsClientNP;LMIRfsClientNP; [x]
    .
    =============== Created Last 30 ================
    .
    2011-04-04 17:33:25 -------- d-----w- c:\windows\system32\wbem\repository\FS
    2011-04-04 17:33:25 -------- d-----w- c:\windows\system32\wbem\Repository
    2011-03-30 13:15:38 -------- d-----w- c:\docume~1\alluse~1\applic~1\iMg28604kIaGl28604
    2011-03-16 21:21:00 -------- d-----w- c:\docume~1\bob\locals~1\applic~1\CliSecure
    2011-03-16 16:31:27 -------- d-----w- c:\program files\SecureTeam
    2011-03-14 15:01:47 -------- d--h--w- c:\docume~1\alluse~1\applic~1\Common Files
    2011-03-09 22:13:00 -------- d-----w- c:\program files\TradeStation Archives
    2011-03-08 13:47:45 -------- d-----w- c:\docume~1\alluse~1\applic~1\kFnPiEf24500
    2011-03-07 12:32:53 -------- d-----w- c:\docume~1\bob\applic~1\ZipGenius
    2011-03-07 12:32:38 -------- d-----w- c:\program files\ZipGenius 6
    2011-03-07 02:08:13 93552 ----a-w- c:\windows\system32\ElbyCDIO.dll
    .
    ==================== Find3M ====================
    .
    2011-02-09 13:53:52 270848 ----a-w- c:\windows\system32\sbe.dll
    2011-02-09 13:53:52 186880 ----a-w- c:\windows\system32\encdec.dll
    2011-02-04 21:09:52 4640 ----a-w- c:\windows\system32\yZkSy3.0
    2011-02-02 07:58:35 2067456 ----a-w- c:\windows\system32\mstscax.dll
    2011-01-27 11:57:06 677888 ----a-w- c:\windows\system32\mstsc.exe
    2011-01-21 14:44:37 439296 ----a-w- c:\windows\system32\shimgvw.dll
    2011-01-07 14:09:02 290048 ----a-w- c:\windows\system32\atmfd.dll
    2011-01-06 02:28:10 86016 ----a-w- c:\windows\system32\NtDirect.dll
    2009-10-03 16:43:23 8410624 ----a-w- c:\program files\HTML Guardian 7.msi
    .
    ============= FINISH: 15:55:33.01 ===============

    I recently noticed another oddity that should be mentioned. When I look at the source code of some pages on the web I can see some code that has been added at the bottom of the page. It looks to me that it is being added on my computer side of things because I don't see it show up on the same pages viewed on other computers. The code does NOT alter the page appearance.

    In doing a little research to see if others have seen this happen, I stumbled on a German board that seems to describe the exact same issue with the exact same text.

    The German page can be found here: http://www.trojaner-board.de/89638-t...quellcode.html

    The Google translated page is here: http://translate.google.com/translat...%26prmd%3Divns

    I thought this might help whoever decides to assist me.
    Last edited by Blade81; 2011-04-08 at 10:10. Reason: Posts merged. Helpers look for topics with 0 replies.
  2. 2011-04-09, 00:59 #2
    ken545
    ken545 is offline
    Emeritus-Security Expert
    Join Date
    Nov 2005
    Location
    Florida's SpaceCoast
    Posts
    15,208

    Default




    Please read Before You Post
    While best efforts are made to assist in removing infections safely, unexpected stuff can happen. It is advisable that you back up your important data before starting any clean up procedure. Neither Safer Networking Forums nor the Analyst providing the advice may be held responsible for any loss.

    Sorry for the delay but we get pretty busy most times


    Until we deem your system clean I am going to ask you not to install or uninstall any software or hardware except for the programs we may run.


    Lets check a few things

    Scan With RootKitUnHooker

    • Please choose one link and download Rootkit Unhooker and save it to your desktop.
      Link 1
      Link 2
      Link 3
    • Now double-click on RKUnhookerLE.exe to run it.
    • Click the Report tab, then click Scan.
    • Check (Tick) Drivers and Stealth
    • Uncheck the rest. then click OK
    • When prompted to Select Disks for Scan, make sure C:\ is checked and click OK
    • Wait till the scanner has finished and then click File > Save Report.
    • Save the report somewhere where you can find it. Click Close.
    • Copy the entire contents of the report and paste it in your next reply.


    Note** you may get the following warning, just click OK and continue.

    "Rootkit Unhooker has detected a parasite inside itself!
    It is recommended to remove parasite, okay?"




    OTL by OldTimer
    • Download OTL to your desktop.
    • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
    • When the window appears, underneath Output at the top change it to Minimal Output.
    • Click the "Scan All Users" checkbox.
    • Check the boxes beside LOP Check and Purity Check.
    • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
      • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt.
        Note:These logs can be located in the OTL. folder on you C:\ drive if they fail to open automatically.
      • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them both in.
    Microsoft MVP Consumer Security 2007-2008-2009-2010-2011-2012-2013-2014

    ERROR MESSAGE 386
    No KeyBoard Detected
    Press F1 To Continue

    Just a reminder that threads will be closed if no reply in 3 days.
  3. 2011-04-09, 01:40 #3
    whistler
    whistler is offline
    Member
    Join Date
    Apr 2009
    Posts
    57

    Default

    Here you go.

    Thank you for your help. It is very much appreciated!

    Bob


    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


    RkU Version: 3.8.388.590, Type LE (SR2)
    ==============================================
    OS Name: Windows XP
    Version 5.1.2600 (Service Pack 3)
    Number of processors #2
    ==============================================
    >Drivers
    ==============================================
    0xB8DC4000 C:\WINDOWS\system32\DRIVERS\igxpmp32.sys 5857280 bytes (Intel Corporation, Intel Graphics Miniport Driver)
    0xA7E63000 C:\WINDOWS\system32\drivers\RtkHDAud.sys 4894720 bytes (Realtek Semiconductor Corp., Realtek(r) High Definition Audio Function Driver)
    0xBF1E7000 C:\WINDOWS\System32\igxpdx32.DLL 2699264 bytes (Intel Corporation, DirectDraw(R) Driver for Intel(R) Graphics Technology)
    0x804D7000 C:\WINDOWS\system32\ntkrnlpa.exe 2154496 bytes (Microsoft Corporation, NT Kernel & System)
    0x804D7000 PnpManager 2154496 bytes
    0x804D7000 RAW 2154496 bytes
    0x804D7000 WMIxWDM 2154496 bytes
    0xBF800000 Win32k 1855488 bytes
    0xBF800000 C:\WINDOWS\System32\win32k.sys 1855488 bytes (Microsoft Corporation, Multi-User Win32 Driver)
    0xBF04F000 C:\WINDOWS\System32\igxpdv32.DLL 1671168 bytes (Intel Corporation, Component GHAL Driver)
    0xB8BF0000 C:\WINDOWS\system32\DRIVERS\HSF_DP.sys 1044480 bytes (Conexant Systems, Inc., HSF_DP driver)
    0xB9EB4000 PCI_PNP2276 995328 bytes
    0xB9EB4000 sptd 995328 bytes
    0xB9EB4000 spuo.sys 995328 bytes
    0xB8B49000 C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys 684032 bytes (Conexant Systems, Inc., HSF_CNXT driver)
    0xB9D0A000 Ntfs.sys 577536 bytes (Microsoft Corporation, NT File System Driver)
    0xA6D58000 C:\WINDOWS\system32\DRIVERS\mrxsmb.sys 458752 bytes (Microsoft Corporation, Windows NT SMB Minirdr)
    0xB8A41000 C:\WINDOWS\system32\DRIVERS\update.sys 385024 bytes (Microsoft Corporation, Update Driver)
    0xA7D58000 C:\WINDOWS\system32\DRIVERS\tcpip.sys 364544 bytes (Microsoft Corporation, TCP/IP Protocol Driver)
    0xA554B000 C:\WINDOWS\system32\DRIVERS\srv.sys 360448 bytes (Microsoft Corporation, Server driver)
    0xBF47A000 C:\WINDOWS\System32\ATMFD.DLL 290816 bytes (Adobe Systems Incorporated, Windows NT OpenType/Type 1 Font Driver)
    0xB8D6F000 C:\WINDOWS\system32\DRIVERS\e1e5132.sys 266240 bytes (Intel Corporation, Intel(R) PRO/1000 Adapter NDIS 5.2 deserialized driver)
    0xA4C72000 C:\WINDOWS\System32\Drivers\HTTP.sys 266240 bytes (Microsoft Corporation, HTTP Protocol Stack)
    0xA7CF8000 C:\WINDOWS\System32\Drivers\avgtdix.sys 237568 bytes (AVG Technologies CZ, s.r.o., AVG Network connection watcher)
    0xB8AF7000 C:\WINDOWS\System32\Drivers\aas6jqe6.SYS 233472 bytes (Microsoft Corporation, IDE/ATAPI Port Driver)
    0xA6C4F000 C:\WINDOWS\System32\Drivers\avgldx86.sys 212992 bytes (AVG Technologies CZ, s.r.o., AVG AVI Loader Driver)
    0xB8CEF000 C:\WINDOWS\system32\DRIVERS\HSFHWBS2.sys 212992 bytes (Conexant Systems, Inc., HSF_HWB2 WDM driver)
    0xB8A9F000 C:\WINDOWS\system32\DRIVERS\rdpdr.sys 196608 bytes (Microsoft Corporation, Microsoft RDP Device redirector)
    0xB9E6E000 ACPI.sys 188416 bytes (Microsoft Corporation, ACPI Driver for NT)
    0xA5693000 C:\WINDOWS\system32\DRIVERS\mrxdav.sys 184320 bytes (Microsoft Corporation, Windows NT WebDav Minirdr)
    0xB9CDD000 NDIS.sys 184320 bytes (Microsoft Corporation, NDIS 5.1 wrapper driver)
    0xBF024000 C:\WINDOWS\System32\igxpgd32.dll 176128 bytes (Intel Corporation, Intel Graphics 2D Driver)
    0xA3AFB000 C:\WINDOWS\system32\drivers\kmixer.sys 176128 bytes (Microsoft Corporation, Kernel Mode Audio Mixer)
    0xA6DE2000 C:\WINDOWS\system32\DRIVERS\rdbss.sys 176128 bytes (Microsoft Corporation, Redirected Drive Buffering SubSystem Driver)
    0xB93A1000 C:\WINDOWS\system32\drivers\TotRec7.sys 172032 bytes (High Criteria inc., Total Recorder WDM audio driver)
    0xB8D23000 C:\WINDOWS\system32\DRIVERS\HDAudBus.sys 163840 bytes (Windows (R) Server 2003 DDK provider, High Definition Audio Bus Driver v1.0a)
    0xA6E2F000 C:\WINDOWS\system32\DRIVERS\netbt.sys 163840 bytes (Microsoft Corporation, MBT Transport driver)
    0xB9E18000 dmio.sys 155648 bytes (Microsoft Corp., Veritas Software, NT Disk Manager I/O Driver)
    0xA7D32000 C:\WINDOWS\system32\DRIVERS\ipnat.sys 155648 bytes (Microsoft Corporation, IP Network Address Translator)
    0xB937D000 C:\WINDOWS\system32\drivers\portcls.sys 147456 bytes (Microsoft Corporation, Port Class (Class Driver for Port/Miniport Devices))
    0xB8D4B000 C:\WINDOWS\system32\DRIVERS\USBPORT.SYS 147456 bytes (Microsoft Corporation, USB 1.1 & 2.0 Port Driver)
    0xB935A000 C:\WINDOWS\system32\drivers\ks.sys 143360 bytes (Microsoft Corporation, Kernel CSA Library)
    0xA6E0D000 C:\WINDOWS\System32\drivers\afd.sys 139264 bytes (Microsoft Corporation, Ancillary Function Driver for WinSock)
    0x806E5000 ACPI_HAL 134400 bytes
    0x806E5000 C:\WINDOWS\system32\hal.dll 134400 bytes (Microsoft Corporation, Hardware Abstraction Layer DLL)
    0xB9DE0000 fltmgr.sys 131072 bytes (Microsoft Corporation, Microsoft Filesystem Filter Manager)
    0xB9D97000 symsnap.sys 131072 bytes (StorageCraft, StorageCraft Volume Snap-Shot)
    0xB9E3E000 ftdisk.sys 126976 bytes (Microsoft Corporation, FT Disk Driver)
    0xB9CC3000 Mup.sys 106496 bytes (Microsoft Corporation, Multiple UNC Provider driver)
    0xB8B30000 C:\WINDOWS\System32\Drivers\AnyDVD.sys 102400 bytes (SlySoft, Inc., AnyDVD Filter Driver)
    0xB9E00000 atapi.sys 98304 bytes (Microsoft Corporation, IDE/ATAPI Port Driver)
    0xA5AEB000 C:\WINDOWS\System32\Drivers\dump_atapi.sys 98304 bytes
    0xB9E9C000 C:\WINDOWS\System32\Drivers\SCSIPORT.SYS 98304 bytes (Microsoft Corporation, SCSI Port Driver)
    0xB9DB7000 C:\WINDOWS\System32\Drivers\ksecdd.sys 94208 bytes (Microsoft Corporation, Kernel Security Support Provider Interface)
    0xB8AE0000 C:\WINDOWS\system32\DRIVERS\ndiswan.sys 94208 bytes (Microsoft Corporation, MS PPP Framing Driver (Strong Encryption))
    0xA5806000 C:\WINDOWS\system32\drivers\wdmaud.sys 86016 bytes (Microsoft Corporation, MMSYSTEM Wave/Midi API mapper)
    0xB8DB0000 C:\WINDOWS\system32\DRIVERS\VIDEOPRT.SYS 81920 bytes (Microsoft Corporation, Video Port Driver)
    0xA7DB1000 C:\WINDOWS\system32\DRIVERS\ipsec.sys 77824 bytes (Microsoft Corporation, IPSec Driver)
    0xBF000000 C:\WINDOWS\System32\drivers\dxg.sys 73728 bytes (Microsoft Corporation, DirectX Graphics Driver)
    0xBF012000 C:\WINDOWS\System32\igxprd32.dll 73728 bytes (Intel Corporation, Intel Graphics 2D Rotation Driver)
    0xB9DCE000 sr.sys 73728 bytes (Microsoft Corporation, System Restore Filesystem Filter Driver)
    0xB9E5D000 pci.sys 69632 bytes (Microsoft Corporation, NT Plug and Play PCI Enumerator)
    0xB8ACF000 C:\WINDOWS\system32\DRIVERS\psched.sys 69632 bytes (Microsoft Corporation, MS QoS Packet Scheduler)
    0xA6CF3000 C:\WINDOWS\System32\Drivers\Cdfs.SYS 65536 bytes (Microsoft Corporation, CD-ROM File System Driver)
    0xB93CB000 C:\WINDOWS\system32\DRIVERS\cdrom.sys 65536 bytes (Microsoft Corporation, SCSI CD-ROM Driver)
    0xB93FB000 C:\WINDOWS\system32\drivers\drmk.sys 61440 bytes (Microsoft Corporation, Microsoft Kernel DRM Descrambler Filter)
    0xBA2C8000 C:\WINDOWS\system32\DRIVERS\redbook.sys 61440 bytes (Microsoft Corporation, Redbook Audio Filter Driver)
    0xBA218000 C:\WINDOWS\system32\drivers\sysaudio.sys 61440 bytes (Microsoft Corporation, System Audio WDM Filter)
    0xBA1F8000 C:\WINDOWS\system32\DRIVERS\usbhub.sys 61440 bytes (Microsoft Corporation, Default Hub Driver for USB)
    0xBA0E8000 C:\WINDOWS\system32\DRIVERS\CLASSPNP.SYS 53248 bytes (Microsoft Corporation, SCSI Class System Dll)
    0xBA2D8000 C:\WINDOWS\system32\DRIVERS\rasl2tp.sys 53248 bytes (Microsoft Corporation, RAS L2TP mini-port/call-manager driver)
    0xBA0C8000 VolSnap.sys 53248 bytes (Microsoft Corporation, Volume Shadow Copy Driver)
    0xBA2F8000 C:\WINDOWS\system32\DRIVERS\raspptp.sys 49152 bytes (Microsoft Corporation, Peer-to-Peer Tunneling Protocol)
    0xBA268000 C:\WINDOWS\System32\Drivers\Fips.SYS 45056 bytes (Microsoft Corporation, FIPS Crypto Driver)
    0xB93DB000 C:\WINDOWS\system32\DRIVERS\imapi.sys 45056 bytes (Microsoft Corporation, IMAPI Kernel Driver)
    0xBA0B8000 MountMgr.sys 45056 bytes (Microsoft Corporation, Mount Manager)
    0xBA2E8000 C:\WINDOWS\system32\DRIVERS\raspppoe.sys 45056 bytes (Microsoft Corporation, RAS PPPoE mini-port/call-manager driver)
    0xBA298000 C:\WINDOWS\System32\Drivers\ElbyCDIO.sys 40960 bytes (Elaborate Bytes AG, ElbyCD Windows NT/2000/XP I/O driver)
    0xBA0A8000 isapnp.sys 40960 bytes (Microsoft Corporation, PNP ISA Bus Driver)
    0xA5B13000 C:\WINDOWS\system32\drivers\LMIRfsDriver.sys 40960 bytes (LogMeIn, Inc., LogMeIn Rfs Drivemap Driver)
    0xBA138000 C:\WINDOWS\System32\Drivers\NDProxy.SYS 40960 bytes (Microsoft Corporation, NDIS Proxy)
    0xBA108000 PxHelp20.sys 40960 bytes (Sonic Solutions, Px Engine Device Driver for Windows 2000/XP)
    0xBA318000 C:\WINDOWS\system32\DRIVERS\termdd.sys 40960 bytes (Microsoft Corporation, Terminal Server Driver)
    0xBA0D8000 disk.sys 36864 bytes (Microsoft Corporation, PnP Disk Driver)
    0xBA0F8000 FSPFltd.sys 36864 bytes (FSPro Labs, FSPro File System Filter)
    0xB945B000 C:\WINDOWS\system32\DRIVERS\HIDCLASS.SYS 36864 bytes (Microsoft Corporation, Hid Class Library)
    0xB93EB000 C:\WINDOWS\system32\DRIVERS\intelppm.sys 36864 bytes (Microsoft Corporation, Processor Device Driver)
    0xBA308000 C:\WINDOWS\system32\DRIVERS\msgpc.sys 36864 bytes (Microsoft Corporation, MS General Packet Classifier)
    0xBA258000 C:\WINDOWS\system32\DRIVERS\netbios.sys 36864 bytes (Microsoft Corporation, NetBIOS interface driver)
    0xA3D7C000 C:\WINDOWS\System32\Drivers\Normandy.SYS 36864 bytes (RKU Driver)
    0xBA238000 C:\WINDOWS\system32\DRIVERS\wanarp.sys 36864 bytes (Microsoft Corporation, MS Remote Access and Routing ARP Driver)
    0xBA338000 cercsr6.sys 32768 bytes (Adaptec, Inc., DELL CERC SATA1.5/6ch Miniport Driver)
    0xBA438000 C:\WINDOWS\System32\Drivers\Modem.SYS 32768 bytes (Microsoft Corporation, Modem Device Driver)
    0xBA418000 C:\WINDOWS\System32\Drivers\Npfs.SYS 32768 bytes (Microsoft Corporation, NPFS Driver)
    0xBA470000 C:\WINDOWS\system32\DRIVERS\usbccgp.sys 32768 bytes (Microsoft Corporation, USB Common Class Generic Parent Driver)
    0xBA430000 C:\WINDOWS\system32\DRIVERS\usbehci.sys 32768 bytes (Microsoft Corporation, EHCI eUSB Miniport Driver)
    0xBA420000 C:\WINDOWS\system32\DRIVERS\v2imount.sys 32768 bytes (Symantec Corporation, V2iMount.sys - Image Mounting Device Driver)
    0xBA450000 C:\WINDOWS\System32\Drivers\ElbyCDFL.sys 28672 bytes (SlySoft, Inc., ElbyCDIO Filter Driver)
    0xBA440000 C:\WINDOWS\system32\DRIVERS\fdc.sys 28672 bytes (Microsoft Corporation, Floppy Disk Controller Driver)
    0xBA458000 C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys 28672 bytes (GEAR Software Inc., CD/DVD Class Filter Driver)
    0xBA400000 C:\WINDOWS\system32\DRIVERS\HIDPARSE.SYS 28672 bytes (Microsoft Corporation, Hid Parsing Library)
    0xBA328000 C:\WINDOWS\system32\DRIVERS\PCIIDEX.SYS 28672 bytes (Microsoft Corporation, PCI IDE Bus Driver Extension)
    0xBA478000 C:\WINDOWS\system32\DRIVERS\usbprint.sys 28672 bytes (Microsoft Corporation, USB Printer driver)
    0xBA468000 C:\WINDOWS\System32\Drivers\avgmfx86.sys 24576 bytes (AVG Technologies CZ, s.r.o., AVG Resident Shield Minifilter Driver)
    0xBA390000 C:\WINDOWS\system32\DRIVERS\kbdclass.sys 24576 bytes (Microsoft Corporation, Keyboard Class Driver)
    0xBA398000 C:\WINDOWS\system32\DRIVERS\mouclass.sys 24576 bytes (Microsoft Corporation, Mouse Class Driver)
    0xBA448000 C:\WINDOWS\system32\drivers\pfc.sys 24576 bytes (Padus, Inc., Padus(R) ASPI Shell)
    0xBA428000 C:\WINDOWS\system32\DRIVERS\usbuhci.sys 24576 bytes (Microsoft Corporation, UHCI USB Miniport Driver)
    0xBA408000 C:\WINDOWS\System32\drivers\vga.sys 24576 bytes (Microsoft Corporation, VGA/Super VGA Video Driver)
    0xBA410000 C:\WINDOWS\System32\Drivers\Msfs.SYS 20480 bytes (Microsoft Corporation, Mailslot driver)
    0xBA330000 PartMgr.sys 20480 bytes (Microsoft Corporation, Partition Manager)
    0xBA380000 C:\WINDOWS\system32\DRIVERS\ptilink.sys 20480 bytes (Parallel Technologies, Inc., Parallel Technologies DirectParallel IO Library)
    0xBA388000 C:\WINDOWS\system32\DRIVERS\raspti.sys 20480 bytes (Microsoft Corporation, PTI DirectParallel(R) mini-port/call-manager driver)
    0xBA350000 C:\WINDOWS\system32\DRIVERS\TDI.SYS 20480 bytes (Microsoft Corporation, TDI Wrapper)
    0xA6ACA000 C:\WINDOWS\System32\watchdog.sys 20480 bytes (Microsoft Corporation, Watchdog Driver)
    0xA7E57000 C:\WINDOWS\system32\DRIVERS\kbdhid.sys 16384 bytes (Microsoft Corporation, HID Mouse Filter Driver)
    0xB9C93000 C:\WINDOWS\system32\drivers\MODEMCSA.sys 16384 bytes (Microsoft Corporation, Unimodem CSA Filter)
    0xBA580000 C:\WINDOWS\system32\DRIVERS\mssmbios.sys 16384 bytes (Microsoft Corporation, System Management BIOS Driver)
    0xA5AAB000 C:\WINDOWS\system32\DRIVERS\ndisuio.sys 16384 bytes (Microsoft Corporation, NDIS User mode I/O Driver)
    0xA887D000 C:\WINDOWS\system32\DRIVERS\usbscan.sys 16384 bytes (Microsoft Corporation, USB Scanner Driver)
    0xBA4B8000 C:\WINDOWS\system32\BOOTVID.dll 12288 bytes (Microsoft Corporation, VGA Boot Driver)
    0xA6E6F000 C:\WINDOWS\System32\drivers\Dxapi.sys 12288 bytes (Microsoft Corporation, DirectX API Driver)
    0xA8885000 C:\WINDOWS\system32\DRIVERS\hidusb.sys 12288 bytes (Microsoft Corporation, USB Miniport Driver for Input Devices)
    0xA5437000 C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys 12288 bytes (Conexant, Diagnostic Interface DRIVER)
    0xA7E5F000 C:\WINDOWS\system32\DRIVERS\mouhid.sys 12288 bytes (Microsoft Corporation, HID Mouse Filter Driver)
    0xBA560000 C:\WINDOWS\system32\DRIVERS\ndistapi.sys 12288 bytes (Microsoft Corporation, NDIS 3.0 connection wrapper driver)
    0xB8A25000 C:\WINDOWS\system32\DRIVERS\rasacd.sys 12288 bytes (Microsoft Corporation, RAS Automatic Connection Driver)
    0xBA61C000 C:\WINDOWS\System32\Drivers\Beep.SYS 8192 bytes (Microsoft Corporation, BEEP Driver)
    0xBA5AC000 dmload.sys 8192 bytes (Microsoft Corp., Veritas Software., NT Disk Manager Startup Driver)
    0xBA646000 C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS 8192 bytes
    0xBA61A000 C:\WINDOWS\System32\Drivers\Fs_Rec.SYS 8192 bytes (Microsoft Corporation, File System Recognizer Driver)
    0xBA5A8000 C:\WINDOWS\system32\KDCOM.DLL 8192 bytes (Microsoft Corporation, Kernel Debugger HW Extension DLL)
    0xBA61E000 C:\WINDOWS\System32\Drivers\mnmdd.SYS 8192 bytes (Microsoft Corporation, Frame buffer simulator)
    0xBA5D6000 C:\Program Files\LogMeIn\x86\RaInfo.sys 8192 bytes (LogMeIn, Inc., RemotelyAnywhere Kernel Information Provider)
    0xBA620000 C:\WINDOWS\System32\DRIVERS\RDPCDD.sys 8192 bytes (Microsoft Corporation, RDP Miniport)
    0xBA5F6000 C:\WINDOWS\system32\DRIVERS\swenum.sys 8192 bytes (Microsoft Corporation, Plug and Play Software Device Enumerator)
    0xBA614000 C:\WINDOWS\system32\DRIVERS\USBD.SYS 8192 bytes (Microsoft Corporation, Universal Serial Bus Driver)
    0xBA5AA000 C:\WINDOWS\System32\Drivers\WMILIB.SYS 8192 bytes (Microsoft Corporation, WMILIB WMI support library Dll)
    0xBA789000 C:\WINDOWS\system32\DRIVERS\audstub.sys 4096 bytes (Microsoft Corporation, AudStub Driver)
    0xBA7CD000 C:\WINDOWS\System32\drivers\dxgthk.sys 4096 bytes (Microsoft Corporation, DirectX Graphics Driver Thunk)
    0xBA788000 C:\WINDOWS\system32\DRIVERS\lmimirr.sys 4096 bytes (LogMeIn, Inc., LogMeIn Mirror Miniport Driver)
    0xBA692000 C:\WINDOWS\System32\Drivers\Null.SYS 4096 bytes (Microsoft Corporation, NULL Driver)
    0xBA670000 pciide.sys 4096 bytes (Microsoft Corporation, Generic PCI IDE Bus Driver)
    0x8AA911F8 unknown_irp_handler 3592 bytes
    0x8AA931F8 unknown_irp_handler 3592 bytes
    0x8AB051F8 unknown_irp_handler 3592 bytes
    0x8A3BB1F8 unknown_irp_handler 3592 bytes
    0x8A49E500 unknown_irp_handler 2816 bytes
    0x8A4DF500 unknown_irp_handler 2816 bytes
    0x8A392500 unknown_irp_handler 2816 bytes
    0x89ADE500 unknown_irp_handler 2816 bytes
    0x89AD6500 unknown_irp_handler 2816 bytes
    0x8A2E3500 unknown_irp_handler 2816 bytes
    ==============================================
    >Stealth
    ==============================================
    WARNING: File locked for read access [C:\WINDOWS\system32\drivers\sptd.sys]


    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


    OTL logfile created on: 4/8/2011 6:27:40 PM - Run 1
    OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Bob\Desktop
    Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
    Internet Explorer (Version = 8.0.6001.18702)
    Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

    2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 58.00% Memory free
    4.00 Gb Paging File | 3.00 Gb Available in Paging File | 81.00% Paging File free
    Paging file location(s): c:\pagefile.sys 2046 4092 [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
    Drive C: | 298.04 Gb Total Space | 41.84 Gb Free Space | 14.04% Space Free | Partition Type: NTFS

    Computer Name: INSPIRON | User Name: Bob | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: All users
    Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

    ========== Processes (SafeList) ==========

    PRC - C:\Documents and Settings\Bob\Desktop\OTL.exe (OldTimer Tools)
    PRC - C:\Documents and Settings\Bob\Application Data\ynafzasdaxazdvquptrju3hcert2xtb2\csrss.exe ()
    PRC - C:\Program Files\My Lockbox\mylbx.exe (FSPro Labs)
    PRC - C:\Program Files\LogMeIn\x86\ramaint.exe (LogMeIn, Inc.)
    PRC - C:\Program Files\LogMeIn\x86\LMIGuardianSvc.exe (LogMeIn, Inc.)
    PRC - C:\Program Files\LogMeIn\x86\LogMeIn.exe (LogMeIn, Inc.)
    PRC - C:\Program Files\AVG\AVG9\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
    PRC - C:\Program Files\AVG\AVG9\avgnsx.exe (AVG Technologies CZ, s.r.o.)
    PRC - C:\Program Files\AVG\AVG9\avgrsx.exe (AVG Technologies CZ, s.r.o.)
    PRC - C:\Program Files\AVG\AVG9\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
    PRC - C:\Program Files\AVG\AVG9\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
    PRC - C:\Program Files\OpenDNS Updater\OpenDNSUpdater.exe ()
    PRC - C:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
    PRC - C:\Program Files\LogMeIn\x86\LogMeInSystray.exe (LogMeIn, Inc.)
    PRC - C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe (IObit)
    PRC - C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe (SlySoft, Inc.)
    PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
    PRC - C:\Program Files\Norton Ghost\Agent\VProSvc.exe (Symantec Corporation)
    PRC - C:\Program Files\Norton Ghost\Agent\VProTray.exe (Symantec Corporation)
    PRC - C:\Program Files\Norton Ghost\Shared\Drivers\SymSnapService.exe (Symantec)
    PRC - C:\WINDOWS\system32\spool\drivers\w32x86\3\E_FATIACA.EXE (SEIKO EPSON CORPORATION)
    PRC - C:\Program Files\Adobe\Adobe Acrobat 6.0\Distillr\acrotray.exe (Adobe Systems Inc.)
    PRC - C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe (Adobe Sytems)
    PRC - C:\Program Files\Microsoft Office\Office\OSA.EXE ()


    ========== Modules (SafeList) ==========

    MOD - C:\Documents and Settings\Bob\Desktop\OTL.exe (OldTimer Tools)
    MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)


    ========== Win32 Services (SafeList) ==========

    SRV - (stllssvr) -- File not found
    SRV - (Lavasoft Ad-Aware Service) -- File not found
    SRV - (HidServ) -- File not found
    SRV - (LMIMaint) -- C:\Program Files\LogMeIn\x86\RaMaint.exe (LogMeIn, Inc.)
    SRV - (LMIGuardianSvc) -- C:\Program Files\LogMeIn\x86\LMIGuardianSvc.exe (LogMeIn, Inc.)
    SRV - (LogMeIn) -- C:\Program Files\LogMeIn\x86\LogMeIn.exe (LogMeIn, Inc.)
    SRV - (avg9wd) -- C:\Program Files\AVG\AVG9\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
    SRV - (Norton Ghost) -- C:\Program Files\Norton Ghost\Agent\VProSvc.exe (Symantec Corporation)
    SRV - (SymSnapService) -- C:\Program Files\Norton Ghost\Shared\Drivers\SymSnapService.exe (Symantec)
    SRV - (IDriverT) -- C:\Program Files\Roxio\Roxio MyDVD DE\InstallShield\Driver\1050\Intel 32\IDriverT.exe (Macrovision Corporation)
    SRV - (AdobeVersionCue) -- C:\Program Files\Adobe\Adobe Version Cue\service\VersionCue.exe (Adobe Sytems)


    ========== Driver Services (SafeList) ==========

    DRV - (LMIRfsClientNP) -- C:\WINDOWS\System32\LMIRfsClientNP.dll (LogMeIn, Inc.)
    DRV - (AnyDVD) -- C:\WINDOWS\system32\drivers\AnyDVD.sys (SlySoft, Inc.)
    DRV - (FSProFilter) -- C:\WINDOWS\System32\Drivers\FSPFltd.sys (FSPro Labs)
    DRV - (AvgTdiX) -- C:\WINDOWS\System32\Drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
    DRV - (AvgLdx86) -- C:\WINDOWS\System32\Drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
    DRV - (AvgMfx86) -- C:\WINDOWS\System32\Drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
    DRV - (sptd) -- C:\WINDOWS\System32\Drivers\sptd.sys ()
    DRV - (LMIRfsDriver) -- C:\WINDOWS\system32\drivers\LMIRfsDriver.sys (LogMeIn, Inc.)
    DRV - (LMIInfo) -- C:\Program Files\LogMeIn\x86\rainfo.sys (LogMeIn, Inc.)
    DRV - (TotRec7) -- C:\WINDOWS\system32\drivers\TotRec7.sys (High Criteria inc.)
    DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
    DRV - (WimFltr) -- C:\WINDOWS\system32\drivers\WimFltr.sys (Microsoft Corporation)
    DRV - (v2imount) -- C:\WINDOWS\system32\drivers\v2imount.sys (Symantec Corporation)
    DRV - (VProEventMonitor) -- C:\WINDOWS\system32\drivers\vproeventmonitor.sys (Symantec Corporation)
    DRV - (symsnap) -- C:\WINDOWS\system32\DRIVERS\symsnap.sys (StorageCraft)
    DRV - (ElbyCDFL) -- C:\WINDOWS\system32\drivers\ElbyCDFL.sys (SlySoft, Inc.)
    DRV - (vncdrv) -- C:\WINDOWS\system32\drivers\vncdrv.sys (RDV Soft)
    DRV - (HSFHWBS2) -- C:\WINDOWS\system32\drivers\HSFHWBS2.sys (Conexant Systems, Inc.)
    DRV - (winachsf) -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys (Conexant Systems, Inc.)
    DRV - (HSF_DP) -- C:\WINDOWS\system32\drivers\HSF_DP.sys (Conexant Systems, Inc.)
    DRV - (pfc) -- C:\WINDOWS\system32\drivers\pfc.sys (Padus, Inc.)
    DRV - (sonypvs1) -- C:\WINDOWS\system32\drivers\sonypvs1.sys (Sony Corporation)


    ========== Standard Registry (SafeList) ==========


    ========== Internet Explorer ==========



    IE - HKU\.DEFAULT\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - Reg Error: Key error. File not found
    IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    IE - HKU\S-1-5-18\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - Reg Error: Key error. File not found
    IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0


    IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    IE - HKU\S-1-5-21-602162358-1972579041-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://twitter.com/
    IE - HKU\S-1-5-21-602162358-1972579041-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    ========== FireFox ==========

    FF - prefs.js..browser.startup.homepage: "http://www.google.com/"
    FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:9.0.0.872
    FF - prefs.js..extensions.enabledItems: DTToolbar@toolbarnet.com:1.1.3.0244
    FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
    FF - prefs.js..extensions.enabledItems: LogMeInClient@logmein.com:1.0.0.652
    FF - prefs.js..extensions.enabledItems: twitternotifier@naan.net:1.9.7.4
    FF - prefs.js..extensions.enabledItems: {37E4D8EA-8BDA-4831-8EA1-89053939A250}:3.0.0.2
    FF - prefs.js..extensions.enabledItems: anttoolbar@ant.com:2.3.0
    FF - prefs.js..extensions.enabledItems: {888d99e7-e8b5-46a3-851e-1ec45da1e644}:4.0.2


    FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG9\Firefox [2010/11/24 10:33:11 | 000,000,000 | ---D | M]
    FF - HKLM\software\mozilla\Mozilla Firefox 3.6.16\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/03/24 08:11:49 | 000,000,000 | ---D | M]
    FF - HKLM\software\mozilla\Mozilla Firefox 3.6.16\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/03/23 17:56:56 | 000,000,000 | ---D | M]

    [2009/01/30 08:44:18 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Bob\Application Data\Mozilla\Extensions
    [2009/01/30 08:44:18 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Bob\Application Data\Mozilla\Extensions\mozswing@mozswing.org
    [2011/04/08 09:38:51 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Bob\Application Data\Mozilla\Firefox\Profiles\vw9a9lod.default\extensions
    [2010/04/27 13:30:03 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Bob\Application Data\Mozilla\Firefox\Profiles\vw9a9lod.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}(2)
    [2011/02/04 10:48:10 | 000,000,000 | ---D | M] (PDF Download) -- C:\Documents and Settings\Bob\Application Data\Mozilla\Firefox\Profiles\vw9a9lod.default\extensions\{37E4D8EA-8BDA-4831-8EA1-89053939A250}
    [2011/02/17 11:41:19 | 000,000,000 | ---D | M] (ReloadEvery) -- C:\Documents and Settings\Bob\Application Data\Mozilla\Firefox\Profiles\vw9a9lod.default\extensions\{888d99e7-e8b5-46a3-851e-1ec45da1e644}
    [2010/04/27 13:30:04 | 000,000,000 | ---D | M] (ReloadEvery) -- C:\Documents and Settings\Bob\Application Data\Mozilla\Firefox\Profiles\vw9a9lod.default\extensions\{888d99e7-e8b5-46a3-851e-1ec45da1e644}(2)
    [2011/02/17 11:31:26 | 000,000,000 | ---D | M] (ReloadEvery) -- C:\Documents and Settings\Bob\Application Data\Mozilla\Firefox\Profiles\vw9a9lod.default\extensions\{888d99e7-e8b5-46a3-851e-1ec45da1e644}(3)
    [2011/02/17 11:31:25 | 000,000,000 | ---D | M] (Ant Video Downloader) -- C:\Documents and Settings\Bob\Application Data\Mozilla\Firefox\Profiles\vw9a9lod.default\extensions\anttoolbar@ant(2).com
    [2011/03/10 06:51:28 | 000,000,000 | ---D | M] (Ant Video Downloader) -- C:\Documents and Settings\Bob\Application Data\Mozilla\Firefox\Profiles\vw9a9lod.default\extensions\anttoolbar@ant.com
    [2011/02/04 10:48:20 | 000,000,000 | ---D | M] ("DAEMON Tools Toolbar") -- C:\Documents and Settings\Bob\Application Data\Mozilla\Firefox\Profiles\vw9a9lod.default\extensions\DTToolbar@toolbarnet.com
    [2011/03/24 08:12:00 | 000,000,000 | ---D | M] (LogMeIn, Inc. Remote Access Plugin) -- C:\Documents and Settings\Bob\Application Data\Mozilla\Firefox\Profiles\vw9a9lod.default\extensions\LogMeInClient@logmein.com
    [2011/04/06 14:34:21 | 000,000,000 | ---D | M] (Echofon) -- C:\Documents and Settings\Bob\Application Data\Mozilla\Firefox\Profiles\vw9a9lod.default\extensions\twitternotifier@naan.net
    [2011/04/07 09:21:12 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
    [2010/11/24 10:33:11 | 000,000,000 | ---D | M] (AVG Safe Search) -- C:\PROGRAM FILES\AVG\AVG9\FIREFOX
    [2009/10/30 15:20:41 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
    [2009/09/01 21:57:26 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION
    [2009/08/20 18:58:10 | 000,027,976 | ---- | M] (WebEx Communications, Inc) -- C:\Program Files\Mozilla Firefox\plugins\atgpcdec.dll
    [2009/08/20 18:58:10 | 000,126,360 | ---- | M] (WebEx Communications, Inc) -- C:\Program Files\Mozilla Firefox\plugins\atgpcext.dll
    [2009/08/20 18:58:13 | 000,098,712 | ---- | M] (WebEx Communications, Inc) -- C:\Program Files\Mozilla Firefox\plugins\ieatgpc.dll
    [2009/08/20 18:58:08 | 000,060,824 | ---- | M] (WebEx Communications, Inc) -- C:\Program Files\Mozilla Firefox\plugins\npatgpc.dll

    O1 HOSTS File: ([2011/02/17 07:57:14 | 000,000,171 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
    O1 - Hosts: 127.0.0.1 localhost
    O1 - Hosts: 255.255.255.255 hcurltest5
    O1 - Hosts: 255.255.255.255 vnsjs1.1stworks.com
    O1 - Hosts: 74.208.77.54 hcurltest1
    O1 - Hosts: 74.208.223.76 hcurltest2
    O1 - Hosts: 255.255.255.255 hcurltest4
    O2 - BHO: (HelperObject Class) - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 7\SnagItBHO.dll (TechSmith Corporation)
    O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
    O2 - BHO: (Skype add-on (mastermind)) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
    O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.)
    O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
    O2 - BHO: (AcroIEToolbarHelper Class) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll ()
    O2 - BHO: (EpsonToolBandKicker Class) - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\epson\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)
    O3 - HKLM\..\Toolbar: (no name) - - No CLSID value found.
    O3 - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll ()
    O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll ()
    O3 - HKLM\..\Toolbar: (SnagIt) - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 7\SnagItIEAddin.dll (TechSmith Corporation)
    O3 - HKLM\..\Toolbar: (EPSON Web-To-Page) - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\epson\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)
    O3 - HKU\S-1-5-21-602162358-1972579041-839522115-1003\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll ()
    O3 - HKU\S-1-5-21-602162358-1972579041-839522115-1003\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll ()
    O3 - HKU\S-1-5-21-602162358-1972579041-839522115-1003\..\Toolbar\WebBrowser: (EPSON Web-To-Page) - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\epson\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)
    O4 - HKLM..\Run: [AdobeVersionCue] C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe (Adobe Sytems)
    O4 - HKLM..\Run: [Ad-Watch] File not found
    O4 - HKLM..\Run: [CloneCDTray] C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe (SlySoft, Inc.)
    O4 - HKLM..\Run: [EPSON Stylus CX3800 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACA.EXE (SEIKO EPSON CORPORATION)
    O4 - HKLM..\Run: [flockbox] File not found
    O4 - HKLM..\Run: [LogMeIn GUI] C:\Program Files\LogMeIn\x86\LogMeInSystray.exe (LogMeIn, Inc.)
    O4 - HKLM..\Run: [mylbx] C:\Program Files\My Lockbox\mylbx.exe (FSPro Labs)
    O4 - HKLM..\Run: [Norton Ghost 14.0] C:\Program Files\Norton Ghost\Agent\VProTray.exe (Symantec Corporation)
    O4 - HKLM..\Run: [QuickTime Task] File not found
    O4 - HKU\S-1-5-21-602162358-1972579041-839522115-1003..\Run: [{4533E3CB-D173-E078-2580-7393950B71E5}] C:\Documents and Settings\Bob\Application Data\Azawoq\ahtix.exe ()
    O4 - HKU\S-1-5-21-602162358-1972579041-839522115-1003..\Run: [Advanced SystemCare 3] C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe (IObit)
    O4 - HKU\S-1-5-21-602162358-1972579041-839522115-1003..\Run: [AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVDtray.exe (SlySoft, Inc.)
    O4 - HKU\S-1-5-21-602162358-1972579041-839522115-1003..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
    O4 - HKU\S-1-5-21-602162358-1972579041-839522115-1003..\Run: [OpenDNS Updater] C:\Program Files\OpenDNS Updater\OpenDNSUpdater.exe ()
    O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Acrobat Assistant.lnk = C:\Program Files\Adobe\Adobe Acrobat 6.0\Distillr\acrotray.exe (Adobe Systems Inc.)
    O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
    O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Omega Research Task Scheduler.lnk = C:\Program Files\Omega Research\Program\orschd.exe (Omega Research, Inc)
    O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\PalTalk.lnk = File not found
    O4 - Startup: C:\Documents and Settings\Bob\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE ()
    O4 - Startup: C:\Documents and Settings\Bob\Start Menu\Programs\Startup\Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE ()
    O4 - Startup: C:\Documents and Settings\Bob\Start Menu\Programs\Startup\Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE ()
    O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
    O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
    O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
    O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
    O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
    O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
    O7 - HKU\S-1-5-21-602162358-1972579041-839522115-1003\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-21-602162358-1972579041-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
    O7 - HKU\S-1-5-21-602162358-1972579041-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
    O7 - HKU\S-1-5-21-602162358-1972579041-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
    O7 - HKU\S-1-5-21-602162358-1972579041-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
    O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
    O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
    O9 - Extra Button: PDFill PDF Editor - {FB858B22-55E2-413f-87F5-30ADC5552151} - C:\Program Files\PlotSoft\PDFill\DownloadPDF.exe (PlotSoft LLC)
    O16 - DPF: {254AA86E-5655-4518-AA87-185D7CC41801} https://secure.logmeinrescue.com/Tec...cueControl.cab (LogMeIn Rescue Technician Console)
    O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} http://download.microsoft.com/downlo...22/wmv9VCM.CAB (Reg Error: Key error.)
    O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos...ineScanner.cab (Reg Error: Key error.)
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_17)
    O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get.../ultrashim.cab (Reg Error: Key error.)
    O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_17)
    O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_17)
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/ge...sh/swflash.cab (Shockwave Flash Object)
    O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
    O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} https://secure.logmein.com/activex/ractrl.cab?lmi=100 (Performance Viewer Activex Control)
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 208.67.222.222 192.168.254.254
    O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)
    O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - File not found
    O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
    O20 - HKLM Winlogon: Shell - ("C:\Documents and Settings\Bob\Application Data\ynafzasdaxazdvquptrju3hcert2xtb2\csrss.exe") - C:\Documents and Settings\Bob\Application Data\ynafzasdaxazdvquptrju3hcert2xtb2\csrss.exe ()
    O20 - Winlogon\Notify\avgrsstarter: DllName - avgrsstx.dll - C:\WINDOWS\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
    O20 - Winlogon\Notify\LMIinit: DllName - LMIinit.dll - C:\WINDOWS\System32\LMIinit.dll (LogMeIn, Inc.)
    O24 - Desktop WallPaper: C:\WINDOWS\Greenstone.bmp
    O24 - Desktop BackupWallPaper: C:\WINDOWS\Greenstone.bmp
    O32 - HKLM CDRom: AutoRun - 1
    O32 - AutoRun File - [2010/07/09 16:04:45 | 000,000,000 | ---D | M] - C:\Auto Repair -- [ NTFS ]
    O32 - AutoRun File - [2008/01/12 22:22:11 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
    O34 - HKLM BootExecute: (autocheck autochk *) - File not found
    O34 - HKLM BootExecute: (lsdelete) - File not found
    O35 - HKLM\..comfile [open] -- "%1" %*
    O35 - HKLM\..exefile [open] -- "%1" %*
    O37 - HKLM\...com [@ = ComFile] -- "%1" %*
    O37 - HKLM\...exe [@ = exefile] -- "%1" %*

    ========== Files/Folders - Created Within 30 Days ==========

    [2011/04/08 18:24:29 | 000,580,608 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Bob\Desktop\OTL.exe
    [2011/04/06 14:43:01 | 000,000,000 | ---D | C] -- C:\wkepB
    [2011/04/06 14:37:26 | 000,000,000 | ---D | C] -- C:\My Lockbox
    [2011/04/06 14:37:02 | 000,041,912 | ---- | C] (FSPro Labs) -- C:\WINDOWS\System32\drivers\FSPFltd.sys
    [2011/04/06 12:33:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Bob\Application Data\Qupim
    [2011/04/06 12:33:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Bob\Application Data\Azawoq
    [2011/04/06 08:29:32 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Bob\Application Data\ynafzasdaxazdvquptrju3hcert2xtb2
    [2011/04/04 12:32:54 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Bob\Recent
    [2011/03/30 08:15:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\iMg28604kIaGl28604
    [2011/03/17 06:19:01 | 000,121,864 | ---- | C] (Citrix Online, a division of Citrix Systems, Inc.) -- C:\Documents and Settings\Bob\Desktop\g2m_download.exe
    [2011/03/16 16:21:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Bob\Local Settings\Application Data\CliSecure
    [2011/03/16 16:20:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\SecureTeam
    [2011/03/16 11:31:27 | 000,000,000 | ---D | C] -- C:\Program Files\SecureTeam
    [2011/03/14 10:01:47 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\All Users\Application Data\Common Files
    [2009/10/03 11:43:23 | 000,258,048 | ---- | C] ( ) -- C:\WINDOWS\SetACL.exe

    ========== Files - Modified Within 30 Days ==========

    [2011/04/08 18:24:25 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Bob\Desktop\OTL.exe
    [2011/04/08 18:20:05 | 000,000,691 | -H-- | M] () -- C:\Documents and Settings\Bob\Application Data\mainhst.zgh
    [2011/04/08 18:20:03 | 000,000,548 | ---- | M] () -- C:\WINDOWS\zipgenius.xml
    [2011/04/08 18:19:13 | 000,124,980 | ---- | M] () -- C:\Documents and Settings\Bob\Desktop\RKUnhookerLE.zip
    [2011/04/08 18:11:58 | 000,037,444 | ---- | M] () -- C:\_trendtrader_FP.shtml
    [2011/04/08 17:38:47 | 000,001,033 | ---- | M] () -- C:\WINDOWS\nsreg.dat
    [2011/04/08 14:51:14 | 000,000,418 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{1FF685FF-AF79-4E0B-A492-555956BF9C7C}.job
    [2011/04/08 09:43:20 | 000,489,991 | ---- | M] () -- C:\WINDOWS\Bob8.xlb
    [2011/04/08 09:37:08 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
    [2011/04/08 09:36:43 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
    [2011/04/08 08:02:37 | 000,151,552 | ---- | M] () -- C:\Documents and Settings\Bob\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    [2011/04/08 07:38:48 | 002,123,487 | ---- | M] () -- C:\Documents and Settings\Bob\Desktop\my_trading_plan.pdf
    [2011/04/06 14:37:03 | 000,000,727 | ---- | M] () -- C:\Documents and Settings\Bob\Desktop\My Lockbox.lnk
    [2011/04/06 14:36:29 | 002,507,414 | ---- | M] () -- C:\Documents and Settings\Bob\Desktop\mylockbox_setup.zip
    [2011/04/05 19:06:00 | 000,000,472 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
    [2011/04/05 15:52:19 | 000,000,083 | -HS- | M] () -- C:\Documents and Settings\All Users\Application Data\.zreglib
    [2011/04/04 16:29:52 | 000,000,074 | ---- | M] () -- C:\Documents and Settings\Bob\Desktop\DEP Issues - Safer-Networking Forums.URL
    [2011/04/04 16:15:25 | 000,000,079 | ---- | M] () -- C:\Documents and Settings\Bob\Application Data\Microsoft\Internet Explorer\Quick Launch\Show desktop.scf
    [2011/04/04 15:53:35 | 000,625,664 | ---- | M] () -- C:\Documents and Settings\Bob\Desktop\dds.scr
    [2011/04/04 15:32:29 | 2136,166,400 | ---- | M] () -- C:\WINDOWS\MEMORY.DMP
    [2011/04/04 08:27:25 | 000,000,136 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\~19914548r
    [2011/04/04 08:27:25 | 000,000,112 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\~19914548
    [2011/04/04 08:27:14 | 000,000,336 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\19914548
    [2011/04/03 22:05:49 | 000,004,096 | -HS- | M] () -- C:\VSNAP.IDX
    [2011/04/03 22:05:26 | 000,000,380 | ---- | M] () -- C:\WINDOWS\tasks\SmartDefrag.job
    [2011/04/03 17:34:04 | 074,203,739 | ---- | M] () -- C:\WINDOWS\System32\drivers\Avg\incavi.avm
    [2011/04/02 08:17:27 | 000,002,345 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\NinjaTrader 7.lnk
    [2011/03/31 08:46:14 | 000,000,101 | -H-- | M] () -- C:\Documents and Settings\Bob\Desktop\jtEconNews Reader 2.0.0.5 - NinjaTrader Support Forum.URL
    [2011/03/28 17:45:10 | 000,001,707 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\FileZilla Client.lnk
    [2011/03/19 16:13:14 | 000,000,045 | -H-- | M] () -- C:\Documents and Settings\Bob\Desktop\Transon Audio.URL
    [2011/03/17 06:18:54 | 000,121,864 | ---- | M] (Citrix Online, a division of Citrix Systems, Inc.) -- C:\Documents and Settings\Bob\Desktop\g2m_download.exe
    [2011/03/16 16:31:36 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
    [2011/03/16 16:27:06 | 011,796,480 | ---- | M] () -- C:\Documents and Settings\Bob\ntuser.bak
    [2011/03/16 11:31:29 | 000,000,689 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\CliSecure.lnk
    [2011/03/15 18:21:03 | 000,035,348 | ---- | M] () -- C:\WINDOWS\Bob.acl
    [2011/03/13 07:49:28 | 000,585,216 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
    [2011/03/13 07:49:28 | 000,121,622 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
    [2011/03/12 09:48:07 | 000,000,763 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\VLC media player.lnk
    [2011/03/11 07:32:11 | 000,000,058 | -H-- | M] () -- C:\Documents and Settings\Bob\Desktop\Khan Academy Math Tutorials.URL

    ========== Files Created - No Company Name ==========

    [2011/04/08 18:19:21 | 000,124,980 | ---- | C] () -- C:\Documents and Settings\Bob\Desktop\RKUnhookerLE.zip
    [2011/04/08 07:38:16 | 002,123,487 | ---- | C] () -- C:\Documents and Settings\Bob\Desktop\my_trading_plan.pdf
    [2011/04/06 14:36:30 | 002,507,414 | ---- | C] () -- C:\Documents and Settings\Bob\Desktop\mylockbox_setup.zip
    [2011/04/04 16:29:52 | 000,000,074 | ---- | C] () -- C:\Documents and Settings\Bob\Desktop\DEP Issues - Safer-Networking Forums.URL
    [2011/04/04 15:53:40 | 000,625,664 | ---- | C] () -- C:\Documents and Settings\Bob\Desktop\dds.scr
    [2011/04/04 08:27:25 | 000,000,136 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\~19914548r
    [2011/04/04 08:27:25 | 000,000,112 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\~19914548
    [2011/04/04 08:27:14 | 000,000,336 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\19914548
    [2011/03/31 08:46:14 | 000,000,101 | -H-- | C] () -- C:\Documents and Settings\Bob\Desktop\jtEconNews Reader 2.0.0.5 - NinjaTrader Support Forum.URL
    [2011/03/19 16:13:14 | 000,000,045 | -H-- | C] () -- C:\Documents and Settings\Bob\Desktop\Transon Audio.URL
    [2011/03/16 11:31:29 | 000,000,689 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\CliSecure.lnk
    [2011/03/12 09:48:07 | 000,000,763 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\VLC media player.lnk
    [2011/03/11 07:32:11 | 000,000,058 | -H-- | C] () -- C:\Documents and Settings\Bob\Desktop\Khan Academy Math Tutorials.URL
    [2011/03/07 07:33:12 | 000,000,691 | -H-- | C] () -- C:\Documents and Settings\Bob\Application Data\mainhst.zgh
    [2011/01/21 12:44:39 | 000,000,107 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\Microsoft.SqlServer.Compact.351.32.bc
    [2011/01/05 21:28:10 | 000,086,016 | ---- | C] () -- C:\WINDOWS\System32\NtDirect.dll
    [2010/11/17 10:38:00 | 000,000,014 | ---- | C] () -- C:\WINDOWS\System32\poin2.ini
    [2010/10/13 09:27:27 | 000,000,073 | ---- | C] () -- C:\WINDOWS\EurekaLog.ini
    [2010/02/04 07:34:34 | 000,000,210 | ---- | C] () -- C:\WINDOWS\System32\sr2spec.ini
    [2009/10/09 08:19:52 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
    [2009/10/03 11:43:23 | 008,410,624 | ---- | C] () -- C:\Program Files\HTML Guardian 7.msi
    [2009/08/29 10:02:18 | 000,000,552 | ---- | C] () -- C:\WINDOWS\System32\d3d8caps.dat
    [2009/08/23 10:44:01 | 000,000,600 | -H-- | C] () -- C:\Documents and Settings\Bob\Local Settings\Application Data\PUTTY.RND
    [2009/07/20 21:06:32 | 000,003,654 | ---- | C] () -- C:\WINDOWS\System32\drivers\Sonyhcp.dll
    [2009/06/05 12:00:09 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat
    [2009/03/31 10:10:30 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
    [2009/03/26 08:30:06 | 000,000,043 | ---- | C] () -- C:\WINDOWS\WALLSTRT.INI
    [2008/05/26 21:59:42 | 000,018,904 | ---- | C] () -- C:\WINDOWS\System32\structuredqueryschematrivial.bin
    [2008/05/26 21:59:40 | 000,106,605 | ---- | C] () -- C:\WINDOWS\System32\structuredqueryschema.bin
    [2008/05/24 04:55:00 | 003,614,208 | ---- | C] () -- C:\WINDOWS\System32\libavcodec.dll
    [2008/05/24 04:55:00 | 000,819,200 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
    [2008/05/24 04:55:00 | 000,741,376 | ---- | C] () -- C:\WINDOWS\System32\audxlib.dll
    [2008/05/24 04:55:00 | 000,692,224 | ---- | C] () -- C:\WINDOWS\System32\ff_x264.dll
    [2008/05/24 04:55:00 | 000,455,680 | ---- | C] () -- C:\WINDOWS\System32\libmplayer.dll
    [2008/05/24 04:55:00 | 000,211,968 | ---- | C] () -- C:\WINDOWS\System32\ff_libfaad2.dll
    [2008/05/24 04:55:00 | 000,204,800 | ---- | C] () -- C:\WINDOWS\System32\TomsMoComp_ff.dll
    [2008/05/24 04:55:00 | 000,204,800 | ---- | C] () -- C:\WINDOWS\System32\ff_kernelDeint.dll
    [2008/05/24 04:55:00 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\ff_libdts.dll
    [2008/05/24 04:55:00 | 000,143,360 | ---- | C] () -- C:\WINDOWS\System32\ff_theora.dll
    [2008/05/24 04:55:00 | 000,115,200 | ---- | C] () -- C:\WINDOWS\System32\ff_tremor.dll
    [2008/05/24 04:55:00 | 000,114,688 | ---- | C] () -- C:\WINDOWS\System32\libmpeg2_ff.dll
    [2008/05/24 04:55:00 | 000,114,688 | ---- | C] () -- C:\WINDOWS\System32\ff_realaac.dll
    [2008/05/24 04:55:00 | 000,113,152 | ---- | C] () -- C:\WINDOWS\System32\ff_samplerate.dll
    [2008/05/24 04:55:00 | 000,099,840 | ---- | C] () -- C:\WINDOWS\System32\ff_libmad.dll
    [2008/05/24 04:55:00 | 000,040,448 | ---- | C] () -- C:\WINDOWS\System32\ff_liba52.dll
    [2008/05/24 04:55:00 | 000,038,400 | ---- | C] () -- C:\WINDOWS\System32\ff_unrar.dll
    [2008/05/24 04:55:00 | 000,023,552 | ---- | C] () -- C:\WINDOWS\System32\ff_wmv9.dll
    [2008/05/24 04:55:00 | 000,007,680 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
    [2008/05/22 10:18:18 | 000,000,035 | ---- | C] () -- C:\WINDOWS\SETUP32.INI
    [2008/05/15 11:20:57 | 000,000,594 | ---- | C] () -- C:\WINDOWS\dev.ini
    [2008/03/29 10:42:22 | 000,245,248 | ---- | C] () -- C:\WINDOWS\System32\dxr.dll
    [2008/03/29 10:42:20 | 000,159,744 | ---- | C] () -- C:\WINDOWS\System32\mmfinfo.dll
    [2008/03/29 10:42:14 | 000,102,400 | ---- | C] () -- C:\WINDOWS\System32\avss.dll
    [2008/03/29 10:42:08 | 000,148,992 | ---- | C] () -- C:\WINDOWS\System32\mkx.dll
    [2008/03/29 10:42:04 | 000,141,312 | ---- | C] () -- C:\WINDOWS\System32\mp4.dll
    [2008/03/29 10:42:04 | 000,108,032 | ---- | C] () -- C:\WINDOWS\System32\avi.dll
    [2008/03/29 10:42:02 | 000,335,872 | ---- | C] () -- C:\WINDOWS\System32\gdsmux.exe
    [2008/03/29 10:42:02 | 000,120,832 | ---- | C] () -- C:\WINDOWS\System32\ogm.dll
    [2008/03/29 10:42:00 | 000,163,840 | ---- | C] () -- C:\WINDOWS\System32\ts.dll
    [2008/03/29 10:42:00 | 000,103,424 | ---- | C] () -- C:\WINDOWS\System32\dsmux.exe
    [2008/03/29 10:41:54 | 000,135,168 | ---- | C] () -- C:\WINDOWS\System32\mkv2vfr.exe
    [2008/03/29 10:41:54 | 000,097,280 | ---- | C] () -- C:\WINDOWS\System32\avs.dll
    [2008/03/29 10:41:52 | 000,079,360 | ---- | C] () -- C:\WINDOWS\System32\mkzlib.dll
    [2008/03/29 10:41:52 | 000,023,552 | ---- | C] () -- C:\WINDOWS\System32\mkunicode.dll
    [2008/03/21 15:30:08 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
    [2008/03/19 21:57:40 | 000,000,037 | ---- | C] () -- C:\WINDOWS\Server.INI
    [2008/03/19 21:57:19 | 000,004,528 | ---- | C] () -- C:\WINDOWS\System32\SETBROWS.EXE
    [2008/03/19 21:57:18 | 000,040,448 | ---- | C] () -- C:\WINDOWS\System32\REGOBJ.DLL
    [2008/02/17 10:44:27 | 000,000,027 | ---- | C] () -- C:\WINDOWS\efaxpump.ini
    [2008/02/17 10:40:58 | 000,003,214 | ---- | C] () -- C:\WINDOWS\winfax.ini
    [2008/02/17 10:18:05 | 000,000,966 | ---- | C] () -- C:\WINDOWS\wininit.ini
    [2008/02/12 10:24:11 | 000,000,028 | ---- | C] () -- C:\WINDOWS\HotComm.INI
    [2008/01/24 09:23:45 | 000,016,384 | ---- | C] () -- C:\WINDOWS\System32\FileOps.exe
    [2008/01/19 10:18:52 | 000,001,315 | -H-- | C] () -- C:\Documents and Settings\Bob\Application Data\SAS7_000.DAT
    [2008/01/14 10:55:30 | 000,001,292 | -H-- | C] () -- C:\Documents and Settings\Bob\Local Settings\Application Data\FASTWiz.html
    [2008/01/14 10:21:34 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\igfxCoIn_v4906.dll
    [2008/01/14 09:59:32 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\ChCfg.exe
    [2008/01/13 18:52:11 | 000,000,000 | ---- | C] () -- C:\WINDOWS\netscape.INI
    [2008/01/13 18:51:46 | 000,001,033 | ---- | C] () -- C:\WINDOWS\nsreg.dat
    [2008/01/13 14:05:16 | 000,060,565 | ---- | C] () -- C:\WINDOWS\System32\EPPICPrinterDB.dat
    [2008/01/13 14:05:16 | 000,029,114 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern1.dat
    [2008/01/13 14:05:16 | 000,021,021 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern3.dat
    [2008/01/13 14:05:16 | 000,015,670 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern5.dat
    [2008/01/13 14:05:16 | 000,013,280 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern2.dat
    [2008/01/13 14:05:16 | 000,010,673 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern4.dat
    [2008/01/13 14:05:16 | 000,004,943 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern6.dat
    [2008/01/13 14:05:16 | 000,001,140 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_PT.dat
    [2008/01/13 14:05:16 | 000,001,140 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_BP.dat
    [2008/01/13 14:05:16 | 000,001,137 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_ES.dat
    [2008/01/13 14:05:16 | 000,001,130 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_FR.dat
    [2008/01/13 14:05:16 | 000,001,130 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_CF.dat
    [2008/01/13 14:05:16 | 000,001,104 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_EN.dat
    [2008/01/13 14:05:16 | 000,000,097 | ---- | C] () -- C:\WINDOWS\System32\PICSDK.ini
    [2008/01/13 14:02:05 | 000,000,044 | ---- | C] () -- C:\WINDOWS\EPCX3800.ini
    [2008/01/13 13:58:29 | 000,000,032 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\ezsid.dat
    [2008/01/13 13:41:40 | 000,151,552 | ---- | C] () -- C:\Documents and Settings\Bob\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    [2008/01/13 13:21:42 | 000,000,083 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\.zreglib
    [2008/01/13 11:54:24 | 000,001,507 | ---- | C] () -- C:\WINDOWS\ODBC.INI
    [2008/01/13 11:54:24 | 000,000,022 | ---- | C] () -- C:\WINDOWS\exchng.ini
    [2008/01/12 23:34:33 | 000,204,800 | ---- | C] () -- C:\WINDOWS\System32\igfxCoIn_v4820.dll
    [2008/01/12 22:23:49 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
    [2008/01/12 22:20:02 | 000,024,660 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
    [2008/01/12 15:03:03 | 000,004,346 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
    [2008/01/12 15:02:11 | 000,199,896 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
    [2008/01/12 14:57:00 | 000,000,006 | ---- | C] () -- C:\WINDOWS\System32\rasmon.bin
    [2008/01/12 14:57:00 | 000,000,004 | -H-- | C] () -- C:\WINDOWS\System32\ddefact.bin
    [2007/10/13 04:30:20 | 000,000,137 | ---- | C] () -- C:\WINDOWS\System32\Registration.ini
    [2007/09/27 10:51:02 | 000,020,698 | ---- | C] () -- C:\WINDOWS\System32\idxcntrs.ini
    [2007/09/27 10:48:48 | 000,030,628 | ---- | C] () -- C:\WINDOWS\System32\gsrvctr.ini
    [2007/09/27 10:48:28 | 000,031,698 | ---- | C] () -- C:\WINDOWS\System32\gthrctr.ini
    [2007/08/09 13:08:04 | 000,462,848 | ---- | C] () -- C:\WINDOWS\System32\ractrlkeyhook.dll
    [2007/06/28 13:54:10 | 000,180,224 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
    [2007/06/07 17:10:50 | 000,020,480 | ---- | C] () -- C:\WINDOWS\System32\ac3config.exe
    [2005/03/21 18:48:05 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
    [2005/03/21 18:48:05 | 000,004,627 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
    [2004/08/04 05:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
    [2004/08/04 05:00:00 | 000,585,216 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
    [2004/08/04 05:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
    [2004/08/04 05:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
    [2004/08/04 05:00:00 | 000,121,622 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
    [2004/08/04 05:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
    [2004/08/04 05:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
    [2004/08/04 05:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
    [2004/08/04 05:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
    [2004/08/04 05:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
    [1996/11/17 01:00:00 | 000,047,104 | ---- | C] () -- C:\WINDOWS\System32\WRKGADM.EXE
    [1996/11/17 01:00:00 | 000,022,016 | ---- | C] () -- C:\WINDOWS\System32\ODBCSTF.DLL
    [1996/11/17 01:00:00 | 000,022,016 | ---- | C] () -- C:\WINDOWS\System32\DOCOBJ.DLL

    ========== LOP Check ==========

    [2008/10/23 09:27:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\Windows Desktop Search
    [2011/02/17 07:57:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\1stWorks
    [2009/10/03 08:29:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Altova
    [2008/10/23 10:06:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Applications
    [2009/11/29 12:24:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\avg9
    [2008/05/22 10:17:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Broderbund
    [2008/08/02 15:39:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Citrix
    [2011/03/14 10:01:47 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\Common Files
    [2009/10/30 15:45:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\DAEMON Tools Lite
    [2008/01/13 13:24:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Elaborate Bytes
    [2011/02/17 11:31:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\gBoBiJi06511
    [2011/02/04 17:06:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\gMdObFk10900
    [2008/11/02 18:19:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Hagel Technologies
    [2011/03/30 08:33:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\iMg28604kIaGl28604
    [2009/06/11 07:05:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Innovative Solutions
    [2010/04/25 11:21:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Insight Software
    [2010/04/25 11:21:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Insight Software Solutions
    [2011/03/08 09:02:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\kFnPiEf24500
    [2011/02/15 07:34:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Kwik POP SONAR
    [2011/04/08 05:50:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\LogMeIn
    [2011/01/27 09:53:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\pEbGeCd06504
    [2010/08/01 11:14:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PlotSoft
    [2009/07/08 22:18:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SKL
    [2008/01/13 13:24:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SlySoft
    [2008/05/15 11:52:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Smith Micro
    [2008/11/19 08:09:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TechSmith
    [2008/07/13 17:37:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
    [2009/06/21 08:15:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint
    [2009/01/20 20:02:42 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800}
    [2008/05/16 10:49:20 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\{9F615C06-DE6D-4CBA-8F80-AAB55D3E63DA}
    [2010/07/03 07:47:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bob\Application Data\ActiveState
    [2011/04/06 12:33:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bob\Application Data\Azawoq
    [2009/05/02 19:14:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bob\Application Data\DAEMON Tools Lite
    [2009/02/09 09:15:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bob\Application Data\EPSON
    [2011/04/07 07:37:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bob\Application Data\FileZilla
    [2009/04/28 16:39:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bob\Application Data\GetRightToGo
    [2011/02/06 17:41:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bob\Application Data\HandBrake
    [2008/03/21 20:01:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bob\Application Data\ImgBurn
    [2009/02/20 08:32:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bob\Application Data\IObit
    [2008/01/13 14:10:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bob\Application Data\Leadertech
    [2008/03/03 11:00:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bob\Application Data\LogMeIn Rescue
    [2010/07/15 06:56:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bob\Application Data\OpenDNS Updater
    [2008/11/14 07:30:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bob\Application Data\Paltalk
    [2011/04/07 06:01:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bob\Application Data\Qupim
    [2008/03/15 18:45:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bob\Application Data\SlySoft
    [2009/05/10 16:27:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bob\Application Data\TotalRecorder
    [2009/02/09 09:15:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bob\Application Data\uTorrent
    [2009/03/02 16:31:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bob\Application Data\WebEx
    [2010/03/30 07:10:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bob\Application Data\Windows Desktop Search
    [2008/10/24 09:51:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bob\Application Data\Windows Search
    [2011/04/06 08:29:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bob\Application Data\ynafzasdaxazdvquptrju3hcert2xtb2
    [2011/03/07 07:34:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bob\Application Data\ZipGenius
    [2011/04/05 19:06:00 | 000,000,472 | ---- | M] () -- C:\WINDOWS\Tasks\Ad-Aware Update (Weekly).job
    [2011/04/03 22:05:26 | 000,000,380 | ---- | M] () -- C:\WINDOWS\Tasks\SmartDefrag.job
    [2011/04/08 14:51:14 | 000,000,418 | -H-- | M] () -- C:\WINDOWS\Tasks\User_Feed_Synchronization-{1FF685FF-AF79-4E0B-A492-555956BF9C7C}.job

    ========== Purity Check ==========



    ========== Alternate Data Streams ==========

    @Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:1CA73D29

    < End of report >
  4. 2011-04-09, 01:41 #4
    whistler
    whistler is offline
    Member
    Join Date
    Apr 2009
    Posts
    57

    Default

    OTL Extras logfile created on: 4/8/2011 6:27:40 PM - Run 1
    OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Bob\Desktop
    Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
    Internet Explorer (Version = 8.0.6001.18702)
    Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

    2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 58.00% Memory free
    4.00 Gb Paging File | 3.00 Gb Available in Paging File | 81.00% Paging File free
    Paging file location(s): c:\pagefile.sys 2046 4092 [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
    Drive C: | 298.04 Gb Total Space | 41.84 Gb Free Space | 14.04% Space Free | Partition Type: NTFS

    Computer Name: INSPIRON | User Name: Bob | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: All users
    Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

    ========== Extra Registry (SafeList) ==========


    ========== File Associations ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
    .cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
    .url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l

    [HKEY_USERS\S-1-5-21-602162358-1972579041-839522115-1003\SOFTWARE\Classes\<extension>]
    .html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

    ========== Shell Spawning ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
    batfile [open] -- "%1" %*
    cmdfile [open] -- "%1" %*
    comfile [open] -- "%1" %*
    cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
    exefile [open] -- "%1" %*
    htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office\Winword.exe" /n ()
    InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
    piffile [open] -- "%1" %*
    regfile [merge] -- Reg Error: Key error.
    scrfile [config] -- "%1"
    scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
    scrfile [open] -- "%1" /S
    txtfile [edit] -- Reg Error: Key error.
    Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
    Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
    Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
    Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
    Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
    Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
    Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

    ========== Security Center Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
    "FirstRunDisabled" = 1
    "AntiVirusDisableNotify" = 0
    "FirewallDisableNotify" = 0
    "AntiVirusOverride" = 0
    "FirewallOverride" = 0
    "UpdatesDisableNotify" = 0

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

    ========== System Restore Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
    "DisableSR" = 0

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
    "Start" = 0

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
    "Start" = 2

    ========== Firewall Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
    "139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
    "445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
    "137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
    "138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
    "1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
    "2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
    "EnableFirewall" = 1
    "DoNotAllowExceptions" = 0

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
    "1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
    "2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
    "139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
    "445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
    "137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
    "138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
    "2799:UDP" = 2799:UDP:*:Enabled:Altova License Metering Port (UDP)
    "2799:TCP" = 2799:TCP:*:Enabled:Altova License Metering Port (TCP)

    ========== Authorized Applications List ==========

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
    "C:\Program Files\WS_FTP\WS_FTP95.exe" = C:\Program Files\WS_FTP\WS_FTP95.exe:*:Enabled:WS_FTP 95 -- (Ipswitch, Inc. 81 Hartwell Ave. Lexington, MA)
    "C:\WINDOWS\system32\dpvsetup.exe" = C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test -- (Microsoft Corporation)
    "C:\Program Files\1stWORKS\hotCommCL\BIN\HotComm.exe" = C:\Program Files\1stWORKS\hotCommCL\BIN\HotComm.exe:*:Enabled:hotComm CL Client -- (1stWorks Corporation)
    "C:\Program Files\NinjaTrader 6\bin\NinjaTrader.exe" = C:\Program Files\NinjaTrader 6\bin\NinjaTrader.exe:*:Enabled:NinjaTrader application
    "C:\Program Files\Mozilla Firefox\firefox.exe" = C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox -- (Mozilla Corporation)
    "C:\Program Files\Skype\Plugin Manager\skypePM.exe" = C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager
    "C:\Program Files\Java\jre6\bin\java.exe" = C:\Program Files\Java\jre6\bin\java.exe:*:Enabled:Java(TM) Platform SE binary -- (Sun Microsystems, Inc.)
    "C:\Program Files\AVG\AVG9\avgupd.exe" = C:\Program Files\AVG\AVG9\avgupd.exe:*:Enabled:avgupd.exe -- (AVG Technologies CZ, s.r.o.)
    "C:\Program Files\AVG\AVG9\avgnsx.exe" = C:\Program Files\AVG\AVG9\avgnsx.exe:*:Enabled:avgnsx.exe -- (AVG Technologies CZ, s.r.o.)
    "C:\Program Files\NinjaTrader 6.5\bin\NinjaTrader.exe" = C:\Program Files\NinjaTrader 6.5\bin\NinjaTrader.exe:*:Enabled:NinjaTrader application
    "C:\Program Files\LimeWire\LimeWire.exe" = C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire
    "C:\Program Files\NinjaTrader 7\bin\NinjaTrader.exe" = C:\Program Files\NinjaTrader 7\bin\NinjaTrader.exe:*:Enabled:NinjaTrader application -- (NinjaTrader LLC, http://www.ninjatrader.com)
    "C:\Program Files\VideoLAN\VLC\vlc.exe" = C:\Program Files\VideoLAN\VLC\vlc.exe:*:Enabled:VLC media player -- ()
    "C:\DOCUME~1\Bob\LOCALS~1\Temp\ex132np1.exe" = C:\DOCUME~1\Bob\LOCALS~1\Temp\ex132np1.exe:*:Enabled:ldrsoft
    "C:\WINDOWS\explorer.exe" = C:\WINDOWS\explorer.exe:*:Enabled:ldrsoft -- (Microsoft Corporation)
    "C:\Documents and Settings\Bob\Application Data\ynafzasdaxazdvquptrju3hcert2xtb2\csrss.exe" = C:\Documents and Settings\Bob\Application Data\ynafzasdaxazdvquptrju3hcert2xtb2\csrss.exe:*:Enabled:ldrsoft -- ()


    ========== HKEY_LOCAL_MACHINE Uninstall List ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
    "{121634B0-2F4B-11D3-ADA3-00C04F52DD52}" = Windows Installer Clean Up
    "{1B4AA674-F5CA-4BB5-831A-CD37B4021959}" = ImageMixer for Sony
    "{216AB108-2AE1-4130-B3D5-20B2C4C80F8F}" = QuickTime
    "{26A24AE4-039D-4CA4-87B4-2F83216015FF}" = Java(TM) 6 Update 17
    "{3420C6C3-2A57-434E-97EB-513FE3038157}" = HTML Guardian 7
    "{34A86A48-1225-419B-94B2-3A0548786ECD}" = ActiveState Komodo Edit 5.2.4
    "{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
    "{35E1EC43-D4FC-4E4A-AAB3-20DDA27E8BB0}" = Sonic Activation Module
    "{42929F0F-CE14-47AF-9FC7-FF297A603021}" = Dell Resource CD
    "{4360BB46-507E-4361-8DCB-4FF9BDC9907B}" = SnagIt 7
    "{4475560E-9418-4908-A158-472D873AE139}" = LogMeIn
    "{4F04D584-09FC-4CB4-88D1-7D176C0031DB}" = Imagination Image Map Editor
    "{541DEAC0-5F3D-45E6-B7CB-94ECF3B96748}" = Skype web features
    "{553255F3-78FD-40F1-A6F8-6882140265FE}" = Apple Application Support
    "{5905F42D-3F5F-4916-ADA6-94A3646AEE76}" = Dell Driver Reset Tool
    "{5C29CB8B-AC1E-4114-8D68-9CD080140D4A}" = Sony USB Driver
    "{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
    "{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
    "{777CA40C-0206-4EF6-A0FC-618BF06BF8D0}" = Intel(R) PRO Network Connections 12.1.12.0
    "{7F14F68C-17FA-4F88-B3FD-7F449C1EBF32}" = EPSON Web-To-Page
    "{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
    "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
    "{97C82B44-D408-4F14-9252-47FC1636D23E}_is1" = IZArc 4.0 beta 1
    "{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
    "{A589DA26-51BD-475D-8C32-E19E34145842}" = Camtasia Studio 6
    "{AC76BA86-1033-0000-7760-000000000001}" = Adobe Acrobat 6.0.1 Professional
    "{AC76BA86-7AD7-1033-7B44-A94000000001}" = Adobe Reader 9.4.2
    "{B0255743-165B-4BD5-8DA8-37DFB9930014}" = Norton Ghost
    "{B194272D-1F92-46DF-99EB-8D5CE91CB4EC}" = Adobe AIR
    "{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
    "{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
    "{C9583F63-78C9-46B8-8A31-38010645234F}" = NinjaTrader 7
    "{CA567AD5-33A4-403D-86D1-EE2D38251951}_is1" = VDownloader 1.0
    "{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
    "{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.1
    "{D1399216-81B2-457C-A0F7-73B9A2EF6902}" = PDFill PDF Editor with FREE Writer and FREE Tools
    "{D52ECEBC-9B20-41A5-81C4-A62DE2367419}" = Adobe Creative Suite
    "{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}" = Ad-Aware
    "{EC3B598C-1151-4191-B5B4-A9072ADE6259}_is1" = ZipGenius 6.3
    "{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
    "ActiveTouchMeetingClient" = WebEx
    "Ad-Aware" = Ad-Aware
    "Adobe AIR" = Adobe AIR
    "Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
    "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
    "Adobe SVG Viewer" = Adobe SVG Viewer 3.0
    "AnyDVD" = AnyDVD
    "AVG9Uninstall" = AVG Free 9.0
    "CloneCD" = CloneCD
    "CloneDVD2" = CloneDVD2
    "CNXT_MODEM_PCI_VEN_14F1&DEV_2F20&SUBSYS_200F14F1" = Conexant D850 56K V.9x DFVc Modem
    "DAEMON Tools Toolbar" = DAEMON Tools Toolbar
    "DECCHECK" = Microsoft Windows XP Video Decoder Checkup Utility
    "DMX5_is1" = DriverMax 5
    "DriverAgent.exe" = DriverAgent by eSupport.com
    "EPSON Printer and Utilities" = EPSON Printer Software
    "EPSON Scanner" = EPSON Scan
    "EVEREST Home Edition_is1" = EVEREST Home Edition v2.20
    "Example2" = Stickynotes
    "FileZilla Client" = FileZilla Client 3.4.0
    "FlashPile.com Video Decompiler_is1" = FlashPile.com Video Decompiler 1.0.0.7
    "GIF Animator" = Microsoft GIF Animator
    "HDMI" = Intel(R) Graphics Media Accelerator Driver
    "hotComm® CL" = hotComm® CL
    "ie8" = Windows Internet Explorer 8
    "ImgBurn" = ImgBurn
    "Macro Express 3" = Macro Express 3
    "Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
    "Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
    "Mozilla Firefox (3.6.16)" = Mozilla Firefox (3.6.16)
    "MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
    "My Lockbox_is1" = My Lockbox 2.4.17
    "Office8.0" = Microsoft Office 97, Professional Edition
    "OpenDNS Updater" = OpenDNS Updater 2.2.1
    "Prism" = Prism Video Converter
    "Revo Uninstaller" = Revo Uninstaller 1.83
    "Silent Package Run-Time Sample" = EPSON CX 3800 Guide
    "Smart Defrag_is1" = Smart Defrag
    "TotalRecorder" = Total Recorder 7.1
    "VideoPad" = VideoPad Video Editor
    "VLC media player" = VLC media player 1.1.7
    "WebSite eXtractor" = WebSite eXtractor
    "Windows Media Format Runtime" = Windows Media Format 11 runtime
    "Windows Media Player" = Windows Media Player 11
    "Windows XP Service Pack" = Windows XP Service Pack 3
    "WMFDist11" = Windows Media Format 11 runtime
    "wmp11" = Windows Media Player 11
    "Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
    "Xvid_is1" = Xvid 1.2.2 final uninstall

    ========== HKEY_USERS Uninstall List ==========

    [HKEY_USERS\S-1-5-21-602162358-1972579041-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
    "GoToMeeting" = GoToMeeting 4.5.0.457
    "Pixie" = Pixie 3.1 (remove only)
    "Rockwell Trading Plan Generator V0.91" = Rockwell Trading Plan Generator V0.91

    ========== Last 10 Event Log Errors ==========

    [ Application Events ]
    Error - 4/6/2011 3:38:29 PM | Computer Name = INSPIRON | Source = Application Error | ID = 1000
    Description = Faulting application mylbx.exe, version 2.4.17.307, faulting module
    mylbx.exe, version 2.4.17.307, fault address 0x002d448a.

    Error - 4/6/2011 3:38:33 PM | Computer Name = INSPIRON | Source = Application Error | ID = 1000
    Description = Faulting application mylbx.exe, version 2.4.17.307, faulting module
    mylbx.exe, version 2.4.17.307, fault address 0x002d448a.

    Error - 4/6/2011 3:38:42 PM | Computer Name = INSPIRON | Source = Application Error | ID = 1000
    Description = Faulting application mylbx.exe, version 2.4.17.307, faulting module
    mylbx.exe, version 2.4.17.307, fault address 0x002d448a.

    Error - 4/6/2011 7:12:09 PM | Computer Name = INSPIRON | Source = Application Error | ID = 1000
    Description = Faulting application explorer.exe, version 6.0.2900.5512, faulting
    module unknown, version 0.0.0.0, fault address 0x00000000.

    Error - 4/6/2011 7:13:15 PM | Computer Name = INSPIRON | Source = Application Error | ID = 1000
    Description = Faulting application explorer.exe, version 6.0.2900.5512, faulting
    module unknown, version 0.0.0.0, fault address 0x00000000.

    Error - 4/7/2011 8:51:42 AM | Computer Name = INSPIRON | Source = Application Error | ID = 1000
    Description = Faulting application explorer.exe, version 6.0.2900.5512, faulting
    module unknown, version 0.0.0.0, fault address 0x00000000.

    Error - 4/7/2011 8:52:26 AM | Computer Name = INSPIRON | Source = Application Error | ID = 1000
    Description = Faulting application explorer.exe, version 6.0.2900.5512, faulting
    module unknown, version 0.0.0.0, fault address 0x00000000.

    Error - 4/7/2011 8:52:59 AM | Computer Name = INSPIRON | Source = Application Error | ID = 1000
    Description = Faulting application explorer.exe, version 6.0.2900.5512, faulting
    module unknown, version 0.0.0.0, fault address 0x00000000.

    Error - 4/7/2011 8:53:43 AM | Computer Name = INSPIRON | Source = Application Error | ID = 1000
    Description = Faulting application explorer.exe, version 6.0.2900.5512, faulting
    module unknown, version 0.0.0.0, fault address 0x00000000.

    Error - 4/7/2011 8:54:35 AM | Computer Name = INSPIRON | Source = Application Error | ID = 1000
    Description = Faulting application explorer.exe, version 6.0.2900.5512, faulting
    module unknown, version 0.0.0.0, fault address 0x00000000.

    [ Application Events ]
    Error - 4/6/2011 3:38:29 PM | Computer Name = INSPIRON | Source = Application Error | ID = 1000
    Description = Faulting application mylbx.exe, version 2.4.17.307, faulting module
    mylbx.exe, version 2.4.17.307, fault address 0x002d448a.

    Error - 4/6/2011 3:38:33 PM | Computer Name = INSPIRON | Source = Application Error | ID = 1000
    Description = Faulting application mylbx.exe, version 2.4.17.307, faulting module
    mylbx.exe, version 2.4.17.307, fault address 0x002d448a.

    Error - 4/6/2011 3:38:42 PM | Computer Name = INSPIRON | Source = Application Error | ID = 1000
    Description = Faulting application mylbx.exe, version 2.4.17.307, faulting module
    mylbx.exe, version 2.4.17.307, fault address 0x002d448a.

    Error - 4/6/2011 7:12:09 PM | Computer Name = INSPIRON | Source = Application Error | ID = 1000
    Description = Faulting application explorer.exe, version 6.0.2900.5512, faulting
    module unknown, version 0.0.0.0, fault address 0x00000000.

    Error - 4/6/2011 7:13:15 PM | Computer Name = INSPIRON | Source = Application Error | ID = 1000
    Description = Faulting application explorer.exe, version 6.0.2900.5512, faulting
    module unknown, version 0.0.0.0, fault address 0x00000000.

    Error - 4/7/2011 8:51:42 AM | Computer Name = INSPIRON | Source = Application Error | ID = 1000
    Description = Faulting application explorer.exe, version 6.0.2900.5512, faulting
    module unknown, version 0.0.0.0, fault address 0x00000000.

    Error - 4/7/2011 8:52:26 AM | Computer Name = INSPIRON | Source = Application Error | ID = 1000
    Description = Faulting application explorer.exe, version 6.0.2900.5512, faulting
    module unknown, version 0.0.0.0, fault address 0x00000000.

    Error - 4/7/2011 8:52:59 AM | Computer Name = INSPIRON | Source = Application Error | ID = 1000
    Description = Faulting application explorer.exe, version 6.0.2900.5512, faulting
    module unknown, version 0.0.0.0, fault address 0x00000000.

    Error - 4/7/2011 8:53:43 AM | Computer Name = INSPIRON | Source = Application Error | ID = 1000
    Description = Faulting application explorer.exe, version 6.0.2900.5512, faulting
    module unknown, version 0.0.0.0, fault address 0x00000000.

    Error - 4/7/2011 8:54:35 AM | Computer Name = INSPIRON | Source = Application Error | ID = 1000
    Description = Faulting application explorer.exe, version 6.0.2900.5512, faulting
    module unknown, version 0.0.0.0, fault address 0x00000000.

    [ System Events ]
    Error - 4/6/2011 3:47:02 PM | Computer Name = INSPIRON | Source = Service Control Manager | ID = 7000
    Description = The Lavasoft Ad-Aware Service service failed to start due to the following
    error: %%3

    Error - 4/6/2011 3:47:03 PM | Computer Name = INSPIRON | Source = Service Control Manager | ID = 7026
    Description = The following boot-start or system-start driver(s) failed to load:
    AVG Anti-Rootkit AvgArCln Lbd

    Error - 4/6/2011 7:17:35 PM | Computer Name = INSPIRON | Source = Service Control Manager | ID = 7000
    Description = The Lavasoft Ad-Aware Service service failed to start due to the following
    error: %%3

    Error - 4/6/2011 7:17:37 PM | Computer Name = INSPIRON | Source = Service Control Manager | ID = 7026
    Description = The following boot-start or system-start driver(s) failed to load:
    AVG Anti-Rootkit AvgArCln Lbd

    Error - 4/7/2011 6:58:19 AM | Computer Name = INSPIRON | Source = Service Control Manager | ID = 7000
    Description = The Lavasoft Ad-Aware Service service failed to start due to the following
    error: %%3

    Error - 4/7/2011 6:58:20 AM | Computer Name = INSPIRON | Source = Service Control Manager | ID = 7026
    Description = The following boot-start or system-start driver(s) failed to load:
    AVG Anti-Rootkit AvgArCln Lbd

    Error - 4/8/2011 6:50:51 AM | Computer Name = INSPIRON | Source = Service Control Manager | ID = 7000
    Description = The Lavasoft Ad-Aware Service service failed to start due to the following
    error: %%3

    Error - 4/8/2011 6:50:53 AM | Computer Name = INSPIRON | Source = Service Control Manager | ID = 7026
    Description = The following boot-start or system-start driver(s) failed to load:
    AVG Anti-Rootkit AvgArCln Lbd

    Error - 4/8/2011 10:37:03 AM | Computer Name = INSPIRON | Source = Service Control Manager | ID = 7000
    Description = The Lavasoft Ad-Aware Service service failed to start due to the following
    error: %%3

    Error - 4/8/2011 10:37:08 AM | Computer Name = INSPIRON | Source = Service Control Manager | ID = 7026
    Description = The following boot-start or system-start driver(s) failed to load:
    AVG Anti-Rootkit AvgArCln Lbd


    < End of report >
  5. 2011-04-09, 02:54 #5
    ken545
    ken545 is offline
    Emeritus-Security Expert
    Join Date
    Nov 2005
    Location
    Florida's SpaceCoast
    Posts
    15,208

    Default

    Hi,

    Let me ask you a few things

    Advanced SystemCare 3 <--Have you run the registry cleaner with this program prior to the problems your having ?


    Have you altered your hosts file and added these ?
    255.255.255.255 hcurltest5
    255.255.255.255 vnsjs1.1stworks.com
    74.208.77.54 hcurltest1
    82.165.161.232 hcurltest2



    You have a couple of things starting up that look kinda of odd, lets check them before we disable them. The file is legit but not in the folder its in so I may be a virus but I always like to check first before we remove them

    You need to enable windows to show all files and folders, instructions Here

    Go to VirusTotal and submit these files for analysis, just use the BROWSE feature and then Send File , you will get a report back, post the report into this thread for me to see. If the site says this file has already been checked, have them check it again

    C:\Documents and Settings\Bob\Application Data\Azawoq\ahtix.exe
    C:\Documents and Settings\Bob\Application Data\ynafzasdaxazdvquptrju3hcert2xtb2\csrss.exe


    If the site is busy you can try this one
    http://virusscan.jotti.org/en



    Then see if you can run Malwarebytes in Safemode, if your successful in running it , make sure to remove all it finds and post the log please

    To Enter Safemode
    • Go to Start> Shut off your Computer> Restart
    • As the computer starts to boot-up, Tap the F8 KEY somewhat rapidly,
      this will bring up a menu.
    • Use the Up and Down Arrow Keys to scroll up to Safemode with Networking
    • Then press the Enter Key on your Keyboard

    Tutorial if you need it How to boot into Safemode
    Microsoft MVP Consumer Security 2007-2008-2009-2010-2011-2012-2013-2014

    ERROR MESSAGE 386
    No KeyBoard Detected
    Press F1 To Continue

    Just a reminder that threads will be closed if no reply in 3 days.
  6. 2011-04-09, 20:47 #6
    whistler
    whistler is offline
    Member
    Join Date
    Apr 2009
    Posts
    57

    Default

    I have not run Advanced SystemCare3 in quite some time, probably over a year.

    Regarding your question about altering the hosts file. I had to look this up to see what it is. I 'm still not sure what it does, but I have NOT knowingly altered it myself. The only thing that might be related is that I use OpenDNS set up through my router. I don't think this would have altered the hosts file, but I'm not sure. To answer your question, I think we can change it back to the default if you think that might help clear up the problem.

    I started in Safe Mode with Networking. Malwarebytes would still not update. I ran it without updating. When I came back a half an hour later the Malwarebytes window was gone and another window called "MS Removal Tool" had appeared, which I highly suspect is a virus.

    I rebooted in Safe Mode only, and was finally successful (log file below). Malwarebytes removed about a dozen files.

    I ran the ahtix.exe & csrss.exe files on both VirusTotal and Jotti:

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    VIUSTOTAL

    File name: ahtix.exe
    Submission date: 2011-04-09 14:13:43 (UTC)
    Current status: queued (#2) queued (#2) analysing finished
    Result: 3/ 42 (7.1%)

    Antivirus Version Last update Result
    AhnLab-V3 2011.04.09.00 2011.04.08 -
    AntiVir 7.11.6.19 2011.04.08 -
    Antiy-AVL 2.0.3.7 2011.04.09 -
    Avast 4.8.1351.0 2011.04.09 -
    Avast5 5.0.677.0 2011.04.09 -
    AVG 10.0.0.1190 2011.04.09 PSW.Generic8.BKLG
    BitDefender 7.2 2011.04.09 -
    CAT-QuickHeal 11.00 2011.04.09 -
    ClamAV 0.97.0.0 2011.04.09 -
    Commtouch 5.2.11.5 2011.04.06 -
    Comodo 8279 2011.04.09 -
    DrWeb 5.0.2.03300 2011.04.09 -
    Emsisoft 5.1.0.5 2011.04.09 -
    eSafe 7.0.17.0 2011.04.07 -
    eTrust-Vet 36.1.8261 2011.04.08 -
    F-Prot 4.6.2.117 2011.04.09 -
    F-Secure 9.0.16440.0 2011.04.09 -
    Fortinet 4.2.254.0 2011.04.09 -
    GData 22 2011.04.09 -
    Ikarus T3.1.1.103.0 2011.04.09 -
    Jiangmin 13.0.900 2011.04.09 -
    K7AntiVirus 9.96.4347 2011.04.09 -
    Kaspersky 7.0.0.125 2011.04.09 Trojan-Spy.Win32.Zbot.biap
    McAfee 5.400.0.1158 2011.04.09 -
    McAfee-GW-Edition 2010.1C 2011.04.09 -
    Microsoft 1.6702 2011.04.09 -
    NOD32 6028 2011.04.09 -
    Norman 6.07.07 2011.04.09 -
    Panda 10.0.3.5 2011.04.09 -
    PCTools 7.0.3.5 2011.04.07 -
    Prevx 3.0 2011.04.09 -
    Rising 23.52.05.05 2011.04.09 -
    Sophos 4.64.0 2011.04.09 -
    SUPERAntiSpyware 4.40.0.1006 2011.04.07 -
    Symantec 20101.3.2.89 2011.04.09 -
    TheHacker 6.7.0.1.170 2011.04.09 -
    TrendMicro 9.200.0.1012 2011.04.09 -
    TrendMicro-HouseCall 9.200.0.1012 2011.04.09 -
    VBA32 3.12.14.3 2011.04.08 -
    VIPRE 8967 2011.04.09 FraudTool.Win32.AVSoft (v)
    ViRobot 2011.4.9.4402 2011.04.09 -
    VirusBuster 13.6.295.0 2011.04.08 -
    MD5: 38878a69dfe58651bb3a3afde7dbc417
    SHA1: 2b59bf6046313c7ebd5c2c8bcccc7fd7cb720ed0
    SHA256: 61266f0f0682fd3939a4987c7c0da2caebde3c1584cf76e52abf105bf7474097
    File size: 131072 bytes
    Scan date: 2011-04-09 14:13:43 (UTC)

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


    VIUSTOTAL


    File name: csrss.exe
    Submission date: 2011-04-09 14:40:34 (UTC)
    Current status: queued queued analysing finished
    Result: 9/ 40 (22.5%)

    Antivirus Version Last Update Result
    AhnLab-V3 2011.04.10.00 2011.04.09 -
    AntiVir 7.11.6.19 2011.04.08 -
    Antiy-AVL 2.0.3.7 2011.04.09 -
    Avast 4.8.1351.0 2011.04.09 Win32:Downloader-GLP
    Avast5 5.0.677.0 2011.04.09 Win32:Downloader-GLP
    AVG 10.0.0.1190 2011.04.09 Generic21.COWX
    BitDefender 7.2 2011.04.09 Gen:Variant.Kazy.18357
    CAT-QuickHeal 11.00 2011.04.09 -
    ClamAV 0.97.0.0 2011.04.09 -
    Commtouch 5.2.11.5 2011.04.06 -
    Comodo 8279 2011.04.09 -
    DrWeb 5.0.2.03300 2011.04.09 -
    eSafe 7.0.17.0 2011.04.07 -
    eTrust-Vet 36.1.8261 2011.04.08 -
    F-Prot 4.6.2.117 2011.04.09 -
    F-Secure 9.0.16440.0 2011.04.09 -
    Fortinet 4.2.254.0 2011.04.09 -
    GData 22 2011.04.09 Gen:Variant.Kazy.18357
    Ikarus T3.1.1.103.0 2011.04.09 Trojan.Win32.Oficla
    Jiangmin 13.0.900 2011.04.09 -
    K7AntiVirus 9.96.4347 2011.04.09 -
    McAfee 5.400.0.1158 2011.04.09 -
    McAfee-GW-Edition 2010.1C 2011.04.09 -
    Microsoft 1.6702 2011.04.09 Trojan:Win32/Oficla.T
    NOD32 6028 2011.04.09 -
    Norman 6.07.07 2011.04.09 -
    Panda 10.0.3.5 2011.04.09 -
    PCTools 7.0.3.5 2011.04.07 -
    Prevx 3.0 2011.04.09 -
    Rising 23.52.05.05 2011.04.09 Suspicious
    Sophos 4.64.0 2011.04.09 -
    SUPERAntiSpyware 4.40.0.1006 2011.04.07 -
    Symantec 20101.3.2.89 2011.04.09 -
    TheHacker 6.7.0.1.170 2011.04.09 -
    TrendMicro 9.200.0.1012 2011.04.09 -
    TrendMicro-HouseCall 9.200.0.1012 2011.04.09 -
    VBA32 3.12.14.3 2011.04.08 -
    VIPRE 8967 2011.04.09 FraudTool.Win32.AVSoft (v)
    ViRobot 2011.4.9.4402 2011.04.09 -
    VirusBuster 13.6.295.0 2011.04.08 -



    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    JOTTI


    Filename: csrss.exe
    Status:
    Scan finished. 7 out of 20 scanners reported malware.
    Scan taken on: Sat 9 Apr 2011 16:47:49 (CET) Permalink

    Additional info
    File size: 45568 bytes
    Filetype: PE32 executable for MS Windows (GUI) Intel 80386 32-bit
    MD5: 127d7925e5be60f2afe63c1ffcb7897a
    SHA1: cfa59e07f48b73397a23456364e7b668144c6bb6
    Packer (Kaspersky): UPX
    Packer (Drweb): UPX




    Scanners
    [ArcaVir]
    2011-04-09 Found nothing
    [F-Secure Anti-Virus]
    2011-04-09 Gen:Variant.Kazy.18357
    [Avast! antivirus]
    2011-04-09 Win32:Downloader-GLP
    [G DATA]
    2011-04-09 Gen:Variant.Kazy.18357
    [Grisoft AVG Anti-Virus]
    2011-04-09 Generic21.COWX
    [Ikarus]
    2011-04-09 Trojan.Win32.Oficla
    [Avira AntiVir]
    2011-04-08 Found nothing
    [Kaspersky Anti-Virus]
    2011-04-09 Found nothing
    [Softwin BitDefender]
    2011-04-09 Gen:Variant.Kazy.18357
    [ESET NOD32]
    2011-04-09 Found nothing
    [ClamAV]
    2011-04-09 Found nothing
    [Panda Antivirus]
    2011-04-09 Found nothing
    [CPsecure]
    2011-04-09 Found nothing
    [Quick Heal]
    2011-04-08 Found nothing
    [Dr.Web]
    2011-04-09 Found nothing
    [Sophos]
    2011-04-09 Found nothing
    [Emsisoft Anti-Malware]
    2011-04-09 Trojan.Win32.Oficla!IK
    [VirusBlokAda VBA32]
    2011-04-08 Found nothing
    [Frisk F-Prot Antivirus]
    2011-04-09 Found nothing
    [VirusBuster]
    2011-04-08 Found nothing


    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    JOTTI

    Jotti's malware scan
    Filename: ahtix.exe
    Status:
    Scan finished. 2 out of 20 scanners reported malware.
    Scan taken on: Sat 9 Apr 2011 17:02:11 (CET) Permalink

    Additional info
    File size: 131072 bytes
    Filetype: PE32 executable for MS Windows (GUI) Intel 80386 32-bit
    MD5: 38878a69dfe58651bb3a3afde7dbc417
    SHA1: 2b59bf6046313c7ebd5c2c8bcccc7fd7cb720ed0
    Packer (Drweb): UPX
    Packer (Kaspersky): UPX




    Scanners
    [ArcaVir]
    2011-04-09 Found nothing
    [F-Secure Anti-Virus]
    2011-04-09 Found nothing
    [Avast! antivirus]
    2011-04-09 Found nothing
    [G DATA]
    2011-04-09 Found nothing
    [Grisoft AVG Anti-Virus]
    2011-04-09 PSW.Generic8.BKLG
    [Ikarus]
    2011-04-09 Found nothing
    [Avira AntiVir]
    2011-04-08 Found nothing
    [Kaspersky Anti-Virus]
    2011-04-09 Trojan-Spy.Win32.Zbot.biap
    [Softwin BitDefender]
    2011-04-09 Found nothing
    [ESET NOD32]
    2011-04-09 Found nothing
    [ClamAV]
    2011-04-09 Found nothing
    [Panda Antivirus]
    2011-04-09 Found nothing
    [CPsecure]
    2011-04-09 Found nothing
    [Quick Heal]
    2011-04-08 Found nothing
    [Dr.Web]
    2011-04-09 Found nothing
    [Sophos]
    2011-04-09 Found nothing
    [Emsisoft Anti-Malware]
    2011-04-09 Found nothing
    [VirusBlokAda VBA32]
    2011-04-08 Found nothing
    [Frisk F-Prot Antivirus]
    2011-04-09 Found nothing
    [VirusBuster]
    2011-04-08 Found nothing


    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    MALWAREBYTES


    RkU Version: 3.8.388.590, Type LE (SR2)
    ==============================================
    OS Name: Windows XP
    Version 5.1.2600 (Service Pack 3)
    Number of processors #2
    ==============================================
    >Drivers
    ==============================================
    0xB8DC4000 C:\WINDOWS\system32\DRIVERS\igxpmp32.sys 5857280 bytes (Intel Corporation, Intel Graphics Miniport Driver)
    0xA7E63000 C:\WINDOWS\system32\drivers\RtkHDAud.sys 4894720 bytes (Realtek Semiconductor Corp., Realtek(r) High Definition Audio Function Driver)
    0xBF1E7000 C:\WINDOWS\System32\igxpdx32.DLL 2699264 bytes (Intel Corporation, DirectDraw(R) Driver for Intel(R) Graphics Technology)
    0x804D7000 C:\WINDOWS\system32\ntkrnlpa.exe 2154496 bytes (Microsoft Corporation, NT Kernel & System)
    0x804D7000 PnpManager 2154496 bytes
    0x804D7000 RAW 2154496 bytes
    0x804D7000 WMIxWDM 2154496 bytes
    0xBF800000 Win32k 1855488 bytes
    0xBF800000 C:\WINDOWS\System32\win32k.sys 1855488 bytes (Microsoft Corporation, Multi-User Win32 Driver)
    0xBF04F000 C:\WINDOWS\System32\igxpdv32.DLL 1671168 bytes (Intel Corporation, Component GHAL Driver)
    0xB8BF0000 C:\WINDOWS\system32\DRIVERS\HSF_DP.sys 1044480 bytes (Conexant Systems, Inc., HSF_DP driver)
    0xB9EB4000 PCI_PNP2276 995328 bytes
    0xB9EB4000 sptd 995328 bytes
    0xB9EB4000 spuo.sys 995328 bytes
    0xB8B49000 C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys 684032 bytes (Conexant Systems, Inc., HSF_CNXT driver)
    0xB9D0A000 Ntfs.sys 577536 bytes (Microsoft Corporation, NT File System Driver)
    0xA6D58000 C:\WINDOWS\system32\DRIVERS\mrxsmb.sys 458752 bytes (Microsoft Corporation, Windows NT SMB Minirdr)
    0xB8A41000 C:\WINDOWS\system32\DRIVERS\update.sys 385024 bytes (Microsoft Corporation, Update Driver)
    0xA7D58000 C:\WINDOWS\system32\DRIVERS\tcpip.sys 364544 bytes (Microsoft Corporation, TCP/IP Protocol Driver)
    0xA554B000 C:\WINDOWS\system32\DRIVERS\srv.sys 360448 bytes (Microsoft Corporation, Server driver)
    0xBF47A000 C:\WINDOWS\System32\ATMFD.DLL 290816 bytes (Adobe Systems Incorporated, Windows NT OpenType/Type 1 Font Driver)
    0xB8D6F000 C:\WINDOWS\system32\DRIVERS\e1e5132.sys 266240 bytes (Intel Corporation, Intel(R) PRO/1000 Adapter NDIS 5.2 deserialized driver)
    0xA4C72000 C:\WINDOWS\System32\Drivers\HTTP.sys 266240 bytes (Microsoft Corporation, HTTP Protocol Stack)
    0xA7CF8000 C:\WINDOWS\System32\Drivers\avgtdix.sys 237568 bytes (AVG Technologies CZ, s.r.o., AVG Network connection watcher)
    0xB8AF7000 C:\WINDOWS\System32\Drivers\aas6jqe6.SYS 233472 bytes (Microsoft Corporation, IDE/ATAPI Port Driver)
    0xA6C4F000 C:\WINDOWS\System32\Drivers\avgldx86.sys 212992 bytes (AVG Technologies CZ, s.r.o., AVG AVI Loader Driver)
    0xB8CEF000 C:\WINDOWS\system32\DRIVERS\HSFHWBS2.sys 212992 bytes (Conexant Systems, Inc., HSF_HWB2 WDM driver)
    0xB8A9F000 C:\WINDOWS\system32\DRIVERS\rdpdr.sys 196608 bytes (Microsoft Corporation, Microsoft RDP Device redirector)
    0xB9E6E000 ACPI.sys 188416 bytes (Microsoft Corporation, ACPI Driver for NT)
    0xA5693000 C:\WINDOWS\system32\DRIVERS\mrxdav.sys 184320 bytes (Microsoft Corporation, Windows NT WebDav Minirdr)
    0xB9CDD000 NDIS.sys 184320 bytes (Microsoft Corporation, NDIS 5.1 wrapper driver)
    0xBF024000 C:\WINDOWS\System32\igxpgd32.dll 176128 bytes (Intel Corporation, Intel Graphics 2D Driver)
    0xA3AFB000 C:\WINDOWS\system32\drivers\kmixer.sys 176128 bytes (Microsoft Corporation, Kernel Mode Audio Mixer)
    0xA6DE2000 C:\WINDOWS\system32\DRIVERS\rdbss.sys 176128 bytes (Microsoft Corporation, Redirected Drive Buffering SubSystem Driver)
    0xB93A1000 C:\WINDOWS\system32\drivers\TotRec7.sys 172032 bytes (High Criteria inc., Total Recorder WDM audio driver)
    0xB8D23000 C:\WINDOWS\system32\DRIVERS\HDAudBus.sys 163840 bytes (Windows (R) Server 2003 DDK provider, High Definition Audio Bus Driver v1.0a)
    0xA6E2F000 C:\WINDOWS\system32\DRIVERS\netbt.sys 163840 bytes (Microsoft Corporation, MBT Transport driver)
    0xB9E18000 dmio.sys 155648 bytes (Microsoft Corp., Veritas Software, NT Disk Manager I/O Driver)
    0xA7D32000 C:\WINDOWS\system32\DRIVERS\ipnat.sys 155648 bytes (Microsoft Corporation, IP Network Address Translator)
    0xB937D000 C:\WINDOWS\system32\drivers\portcls.sys 147456 bytes (Microsoft Corporation, Port Class (Class Driver for Port/Miniport Devices))
    0xB8D4B000 C:\WINDOWS\system32\DRIVERS\USBPORT.SYS 147456 bytes (Microsoft Corporation, USB 1.1 & 2.0 Port Driver)
    0xB935A000 C:\WINDOWS\system32\drivers\ks.sys 143360 bytes (Microsoft Corporation, Kernel CSA Library)
    0xA6E0D000 C:\WINDOWS\System32\drivers\afd.sys 139264 bytes (Microsoft Corporation, Ancillary Function Driver for WinSock)
    0x806E5000 ACPI_HAL 134400 bytes
    0x806E5000 C:\WINDOWS\system32\hal.dll 134400 bytes (Microsoft Corporation, Hardware Abstraction Layer DLL)
    0xB9DE0000 fltmgr.sys 131072 bytes (Microsoft Corporation, Microsoft Filesystem Filter Manager)
    0xB9D97000 symsnap.sys 131072 bytes (StorageCraft, StorageCraft Volume Snap-Shot)
    0xB9E3E000 ftdisk.sys 126976 bytes (Microsoft Corporation, FT Disk Driver)
    0xB9CC3000 Mup.sys 106496 bytes (Microsoft Corporation, Multiple UNC Provider driver)
    0xB8B30000 C:\WINDOWS\System32\Drivers\AnyDVD.sys 102400 bytes (SlySoft, Inc., AnyDVD Filter Driver)
    0xB9E00000 atapi.sys 98304 bytes (Microsoft Corporation, IDE/ATAPI Port Driver)
    0xA5AEB000 C:\WINDOWS\System32\Drivers\dump_atapi.sys 98304 bytes
    0xB9E9C000 C:\WINDOWS\System32\Drivers\SCSIPORT.SYS 98304 bytes (Microsoft Corporation, SCSI Port Driver)
    0xB9DB7000 C:\WINDOWS\System32\Drivers\ksecdd.sys 94208 bytes (Microsoft Corporation, Kernel Security Support Provider Interface)
    0xB8AE0000 C:\WINDOWS\system32\DRIVERS\ndiswan.sys 94208 bytes (Microsoft Corporation, MS PPP Framing Driver (Strong Encryption))
    0xA5806000 C:\WINDOWS\system32\drivers\wdmaud.sys 86016 bytes (Microsoft Corporation, MMSYSTEM Wave/Midi API mapper)
    0xB8DB0000 C:\WINDOWS\system32\DRIVERS\VIDEOPRT.SYS 81920 bytes (Microsoft Corporation, Video Port Driver)
    0xA7DB1000 C:\WINDOWS\system32\DRIVERS\ipsec.sys 77824 bytes (Microsoft Corporation, IPSec Driver)
    0xBF000000 C:\WINDOWS\System32\drivers\dxg.sys 73728 bytes (Microsoft Corporation, DirectX Graphics Driver)
    0xBF012000 C:\WINDOWS\System32\igxprd32.dll 73728 bytes (Intel Corporation, Intel Graphics 2D Rotation Driver)
    0xB9DCE000 sr.sys 73728 bytes (Microsoft Corporation, System Restore Filesystem Filter Driver)
    0xB9E5D000 pci.sys 69632 bytes (Microsoft Corporation, NT Plug and Play PCI Enumerator)
    0xB8ACF000 C:\WINDOWS\system32\DRIVERS\psched.sys 69632 bytes (Microsoft Corporation, MS QoS Packet Scheduler)
    0xA6CF3000 C:\WINDOWS\System32\Drivers\Cdfs.SYS 65536 bytes (Microsoft Corporation, CD-ROM File System Driver)
    0xB93CB000 C:\WINDOWS\system32\DRIVERS\cdrom.sys 65536 bytes (Microsoft Corporation, SCSI CD-ROM Driver)
    0xB93FB000 C:\WINDOWS\system32\drivers\drmk.sys 61440 bytes (Microsoft Corporation, Microsoft Kernel DRM Descrambler Filter)
    0xBA2C8000 C:\WINDOWS\system32\DRIVERS\redbook.sys 61440 bytes (Microsoft Corporation, Redbook Audio Filter Driver)
    0xBA218000 C:\WINDOWS\system32\drivers\sysaudio.sys 61440 bytes (Microsoft Corporation, System Audio WDM Filter)
    0xBA1F8000 C:\WINDOWS\system32\DRIVERS\usbhub.sys 61440 bytes (Microsoft Corporation, Default Hub Driver for USB)
    0xBA0E8000 C:\WINDOWS\system32\DRIVERS\CLASSPNP.SYS 53248 bytes (Microsoft Corporation, SCSI Class System Dll)
    0xBA2D8000 C:\WINDOWS\system32\DRIVERS\rasl2tp.sys 53248 bytes (Microsoft Corporation, RAS L2TP mini-port/call-manager driver)
    0xBA0C8000 VolSnap.sys 53248 bytes (Microsoft Corporation, Volume Shadow Copy Driver)
    0xBA2F8000 C:\WINDOWS\system32\DRIVERS\raspptp.sys 49152 bytes (Microsoft Corporation, Peer-to-Peer Tunneling Protocol)
    0xBA268000 C:\WINDOWS\System32\Drivers\Fips.SYS 45056 bytes (Microsoft Corporation, FIPS Crypto Driver)
    0xB93DB000 C:\WINDOWS\system32\DRIVERS\imapi.sys 45056 bytes (Microsoft Corporation, IMAPI Kernel Driver)
    0xBA0B8000 MountMgr.sys 45056 bytes (Microsoft Corporation, Mount Manager)
    0xBA2E8000 C:\WINDOWS\system32\DRIVERS\raspppoe.sys 45056 bytes (Microsoft Corporation, RAS PPPoE mini-port/call-manager driver)
    0xBA298000 C:\WINDOWS\System32\Drivers\ElbyCDIO.sys 40960 bytes (Elaborate Bytes AG, ElbyCD Windows NT/2000/XP I/O driver)
    0xBA0A8000 isapnp.sys 40960 bytes (Microsoft Corporation, PNP ISA Bus Driver)
    0xA5B13000 C:\WINDOWS\system32\drivers\LMIRfsDriver.sys 40960 bytes (LogMeIn, Inc., LogMeIn Rfs Drivemap Driver)
    0xBA138000 C:\WINDOWS\System32\Drivers\NDProxy.SYS 40960 bytes (Microsoft Corporation, NDIS Proxy)
    0xBA108000 PxHelp20.sys 40960 bytes (Sonic Solutions, Px Engine Device Driver for Windows 2000/XP)
    0xBA318000 C:\WINDOWS\system32\DRIVERS\termdd.sys 40960 bytes (Microsoft Corporation, Terminal Server Driver)
    0xBA0D8000 disk.sys 36864 bytes (Microsoft Corporation, PnP Disk Driver)
    0xBA0F8000 FSPFltd.sys 36864 bytes (FSPro Labs, FSPro File System Filter)
    0xB945B000 C:\WINDOWS\system32\DRIVERS\HIDCLASS.SYS 36864 bytes (Microsoft Corporation, Hid Class Library)
    0xB93EB000 C:\WINDOWS\system32\DRIVERS\intelppm.sys 36864 bytes (Microsoft Corporation, Processor Device Driver)
    0xBA308000 C:\WINDOWS\system32\DRIVERS\msgpc.sys 36864 bytes (Microsoft Corporation, MS General Packet Classifier)
    0xBA258000 C:\WINDOWS\system32\DRIVERS\netbios.sys 36864 bytes (Microsoft Corporation, NetBIOS interface driver)
    0xA3D7C000 C:\WINDOWS\System32\Drivers\Normandy.SYS 36864 bytes (RKU Driver)
    0xBA238000 C:\WINDOWS\system32\DRIVERS\wanarp.sys 36864 bytes (Microsoft Corporation, MS Remote Access and Routing ARP Driver)
    0xBA338000 cercsr6.sys 32768 bytes (Adaptec, Inc., DELL CERC SATA1.5/6ch Miniport Driver)
    0xBA438000 C:\WINDOWS\System32\Drivers\Modem.SYS 32768 bytes (Microsoft Corporation, Modem Device Driver)
    0xBA418000 C:\WINDOWS\System32\Drivers\Npfs.SYS 32768 bytes (Microsoft Corporation, NPFS Driver)
    0xBA470000 C:\WINDOWS\system32\DRIVERS\usbccgp.sys 32768 bytes (Microsoft Corporation, USB Common Class Generic Parent Driver)
    0xBA430000 C:\WINDOWS\system32\DRIVERS\usbehci.sys 32768 bytes (Microsoft Corporation, EHCI eUSB Miniport Driver)
    0xBA420000 C:\WINDOWS\system32\DRIVERS\v2imount.sys 32768 bytes (Symantec Corporation, V2iMount.sys - Image Mounting Device Driver)
    0xBA450000 C:\WINDOWS\System32\Drivers\ElbyCDFL.sys 28672 bytes (SlySoft, Inc., ElbyCDIO Filter Driver)
    0xBA440000 C:\WINDOWS\system32\DRIVERS\fdc.sys 28672 bytes (Microsoft Corporation, Floppy Disk Controller Driver)
    0xBA458000 C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys 28672 bytes (GEAR Software Inc., CD/DVD Class Filter Driver)
    0xBA400000 C:\WINDOWS\system32\DRIVERS\HIDPARSE.SYS 28672 bytes (Microsoft Corporation, Hid Parsing Library)
    0xBA328000 C:\WINDOWS\system32\DRIVERS\PCIIDEX.SYS 28672 bytes (Microsoft Corporation, PCI IDE Bus Driver Extension)
    0xBA478000 C:\WINDOWS\system32\DRIVERS\usbprint.sys 28672 bytes (Microsoft Corporation, USB Printer driver)
    0xBA468000 C:\WINDOWS\System32\Drivers\avgmfx86.sys 24576 bytes (AVG Technologies CZ, s.r.o., AVG Resident Shield Minifilter Driver)
    0xBA390000 C:\WINDOWS\system32\DRIVERS\kbdclass.sys 24576 bytes (Microsoft Corporation, Keyboard Class Driver)
    0xBA398000 C:\WINDOWS\system32\DRIVERS\mouclass.sys 24576 bytes (Microsoft Corporation, Mouse Class Driver)
    0xBA448000 C:\WINDOWS\system32\drivers\pfc.sys 24576 bytes (Padus, Inc., Padus(R) ASPI Shell)
    0xBA428000 C:\WINDOWS\system32\DRIVERS\usbuhci.sys 24576 bytes (Microsoft Corporation, UHCI USB Miniport Driver)
    0xBA408000 C:\WINDOWS\System32\drivers\vga.sys 24576 bytes (Microsoft Corporation, VGA/Super VGA Video Driver)
    0xBA410000 C:\WINDOWS\System32\Drivers\Msfs.SYS 20480 bytes (Microsoft Corporation, Mailslot driver)
    0xBA330000 PartMgr.sys 20480 bytes (Microsoft Corporation, Partition Manager)
    0xBA380000 C:\WINDOWS\system32\DRIVERS\ptilink.sys 20480 bytes (Parallel Technologies, Inc., Parallel Technologies DirectParallel IO Library)
    0xBA388000 C:\WINDOWS\system32\DRIVERS\raspti.sys 20480 bytes (Microsoft Corporation, PTI DirectParallel(R) mini-port/call-manager driver)
    0xBA350000 C:\WINDOWS\system32\DRIVERS\TDI.SYS 20480 bytes (Microsoft Corporation, TDI Wrapper)
    0xA6ACA000 C:\WINDOWS\System32\watchdog.sys 20480 bytes (Microsoft Corporation, Watchdog Driver)
    0xA7E57000 C:\WINDOWS\system32\DRIVERS\kbdhid.sys 16384 bytes (Microsoft Corporation, HID Mouse Filter Driver)
    0xB9C93000 C:\WINDOWS\system32\drivers\MODEMCSA.sys 16384 bytes (Microsoft Corporation, Unimodem CSA Filter)
    0xBA580000 C:\WINDOWS\system32\DRIVERS\mssmbios.sys 16384 bytes (Microsoft Corporation, System Management BIOS Driver)
    0xA5AAB000 C:\WINDOWS\system32\DRIVERS\ndisuio.sys 16384 bytes (Microsoft Corporation, NDIS User mode I/O Driver)
    0xA887D000 C:\WINDOWS\system32\DRIVERS\usbscan.sys 16384 bytes (Microsoft Corporation, USB Scanner Driver)
    0xBA4B8000 C:\WINDOWS\system32\BOOTVID.dll 12288 bytes (Microsoft Corporation, VGA Boot Driver)
    0xA6E6F000 C:\WINDOWS\System32\drivers\Dxapi.sys 12288 bytes (Microsoft Corporation, DirectX API Driver)
    0xA8885000 C:\WINDOWS\system32\DRIVERS\hidusb.sys 12288 bytes (Microsoft Corporation, USB Miniport Driver for Input Devices)
    0xA5437000 C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys 12288 bytes (Conexant, Diagnostic Interface DRIVER)
    0xA7E5F000 C:\WINDOWS\system32\DRIVERS\mouhid.sys 12288 bytes (Microsoft Corporation, HID Mouse Filter Driver)
    0xBA560000 C:\WINDOWS\system32\DRIVERS\ndistapi.sys 12288 bytes (Microsoft Corporation, NDIS 3.0 connection wrapper driver)
    0xB8A25000 C:\WINDOWS\system32\DRIVERS\rasacd.sys 12288 bytes (Microsoft Corporation, RAS Automatic Connection Driver)
    0xBA61C000 C:\WINDOWS\System32\Drivers\Beep.SYS 8192 bytes (Microsoft Corporation, BEEP Driver)
    0xBA5AC000 dmload.sys 8192 bytes (Microsoft Corp., Veritas Software., NT Disk Manager Startup Driver)
    0xBA646000 C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS 8192 bytes
    0xBA61A000 C:\WINDOWS\System32\Drivers\Fs_Rec.SYS 8192 bytes (Microsoft Corporation, File System Recognizer Driver)
    0xBA5A8000 C:\WINDOWS\system32\KDCOM.DLL 8192 bytes (Microsoft Corporation, Kernel Debugger HW Extension DLL)
    0xBA61E000 C:\WINDOWS\System32\Drivers\mnmdd.SYS 8192 bytes (Microsoft Corporation, Frame buffer simulator)
    0xBA5D6000 C:\Program Files\LogMeIn\x86\RaInfo.sys 8192 bytes (LogMeIn, Inc., RemotelyAnywhere Kernel Information Provider)
    0xBA620000 C:\WINDOWS\System32\DRIVERS\RDPCDD.sys 8192 bytes (Microsoft Corporation, RDP Miniport)
    0xBA5F6000 C:\WINDOWS\system32\DRIVERS\swenum.sys 8192 bytes (Microsoft Corporation, Plug and Play Software Device Enumerator)
    0xBA614000 C:\WINDOWS\system32\DRIVERS\USBD.SYS 8192 bytes (Microsoft Corporation, Universal Serial Bus Driver)
    0xBA5AA000 C:\WINDOWS\System32\Drivers\WMILIB.SYS 8192 bytes (Microsoft Corporation, WMILIB WMI support library Dll)
    0xBA789000 C:\WINDOWS\system32\DRIVERS\audstub.sys 4096 bytes (Microsoft Corporation, AudStub Driver)
    0xBA7CD000 C:\WINDOWS\System32\drivers\dxgthk.sys 4096 bytes (Microsoft Corporation, DirectX Graphics Driver Thunk)
    0xBA788000 C:\WINDOWS\system32\DRIVERS\lmimirr.sys 4096 bytes (LogMeIn, Inc., LogMeIn Mirror Miniport Driver)
    0xBA692000 C:\WINDOWS\System32\Drivers\Null.SYS 4096 bytes (Microsoft Corporation, NULL Driver)
    0xBA670000 pciide.sys 4096 bytes (Microsoft Corporation, Generic PCI IDE Bus Driver)
    0x8AA911F8 unknown_irp_handler 3592 bytes
    0x8AA931F8 unknown_irp_handler 3592 bytes
    0x8AB051F8 unknown_irp_handler 3592 bytes
    0x8A3BB1F8 unknown_irp_handler 3592 bytes
    0x8A49E500 unknown_irp_handler 2816 bytes
    0x8A4DF500 unknown_irp_handler 2816 bytes
    0x8A392500 unknown_irp_handler 2816 bytes
    0x89ADE500 unknown_irp_handler 2816 bytes
    0x89AD6500 unknown_irp_handler 2816 bytes
    0x8A2E3500 unknown_irp_handler 2816 bytes
    ==============================================
    >Stealth
    ==============================================
    WARNING: File locked for read access [C:\WINDOWS\system32\drivers\sptd.sys]
  7. 2011-04-09, 20:50 #7
    whistler
    whistler is offline
    Member
    Join Date
    Apr 2009
    Posts
    57

    Default

    I just realized that I posted the wrong text for the Malwarebytes log. Sorry about that.

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    Malwarebytes' Anti-Malware 1.50.1.1100
    www.malwarebytes.org

    Database version: 6319

    Windows 5.1.2600 Service Pack 3 (Safe Mode)
    Internet Explorer 8.0.6001.18702

    4/9/2011 1:33:47 PM
    mbam-log-2011-04-09 (13-33-32).txt

    Scan type: Full scan (C:\|)
    Objects scanned: 359629
    Time elapsed: 1 hour(s), 54 minute(s), 38 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 3
    Registry Data Items Infected: 1
    Folders Infected: 0
    Files Infected: 5

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    (No malicious items detected)

    Registry Values Infected:
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\bBe14005kFaLe14005 (Rogue.MSRemovalTool) -> Value: bBe14005kFaLe14005 -> No action taken.
    HKEY_CURRENT_USER\Software\Microsoft\setiasworld (Malware.Trace) -> Value: setiasworld -> No action taken.
    HKEY_CURRENT_USER\Software\Microsoft\bk (Malware.Trace) -> Value: bk -> No action taken.

    Registry Data Items Infected:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell (Hijack.Shell) -> Bad: (explorer.exe "C:\Documents and Settings\Bob\Application Data\ynafzasdaxazdvquptrju3hcert2xtb2\csrss.exe") Good: (Explorer.exe) -> No action taken.

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    c:\documents and settings\all users\application data\bbe14005kfale14005\bbe14005kfale14005.exe (Rogue.MSRemovalTool) -> No action taken.
    c:\documents and settings\all users\documents\19792079 (Spyware.Passwords.XGen) -> No action taken.
    c:\system volume information\_restore{6068b9d1-1234-4dda-9f1c-9b42eecf3e57}\RP382\A0067618.exe (Rogue.FakeHDD) -> No action taken.
    c:\system volume information\_restore{6068b9d1-1234-4dda-9f1c-9b42eecf3e57}\RP382\A0067620.exe (Trojan.FakeAlert) -> No action taken.
    c:\documents and settings\Bob\local settings\temp\0.18290702116823843.exe (Trojan.Dropper) -> No action taken.
  8. 2011-04-09, 21:34 #8
    ken545
    ken545 is offline
    Emeritus-Security Expert
    Join Date
    Nov 2005
    Location
    Florida's SpaceCoast
    Posts
    15,208

    Default

    Hi,

    Please read through the instructions that are posted prior to the fix, the instructions for Malwarebytes clearly states
    Be sure that everything is checked, and click Remove Selected .

    You had it set for TAKE NO ACTION which didn't accomplish much, you need to run it again and make sure all that garbage is removed. Then post the new log


    Then do this

    Download ComboFix from one of these locations:

    Link 1
    Link 2


    * IMPORTANT !!! Save ComboFix.exe to your Desktop


    • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
    • See this Link for programs that need to be disabled and instruction on how to disable them.
    • Remember to re-enable them when we're done.

    • Double click on ComboFix.exe & follow the prompts.

    • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

    • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.


    **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.




    Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

    Click on Yes, to continue scanning for malware.

    When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

    *If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.
    Microsoft MVP Consumer Security 2007-2008-2009-2010-2011-2012-2013-2014

    ERROR MESSAGE 386
    No KeyBoard Detected
    Press F1 To Continue

    Just a reminder that threads will be closed if no reply in 3 days.
  9. 2011-04-10, 00:15 #9
    whistler
    whistler is offline
    Member
    Join Date
    Apr 2009
    Posts
    57

    Default

    I was able to figure out how to do a manual update of the Malwarebytes file by transferring it from another computer. I then ran Malwarebytes again in quick scan mode (log below), and rebooted upon request for further removal.

    I have everything turned off in AVG 9.0, but Combo-Fix tells me that it is still running. I attempted to remove it via Add/Remove Programs, but I received an "Access is Denied" error message referring to a registry key. I attempted to remove it a second time in Safe Mode, and received the same error message. I have seen this "Access is Denied" error message several times before with both the Malwarebytes update and with Filezilla. I tired to shut down the AVG processes via the Windows Task Manager, but they wouldn't shut down.

    Do you have any ideas as to what I can try next to shut down AVG so that I can get Comb-Fix to run?

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    Malwarebytes' Anti-Malware 1.50.1.1100
    www.malwarebytes.org

    Database version: 6320

    Windows 5.1.2600 Service Pack 3
    Internet Explorer 8.0.6001.18702

    4/9/2011 4:23:40 PM
    mbam-log-2011-04-09 (16-23-40).txt

    Scan type: Quick scan
    Objects scanned: 193551
    Time elapsed: 11 minute(s), 13 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 1
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 1

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    (No malicious items detected)

    Registry Values Infected:
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{4533E3CB-D173-E078-2580-7393950B71E5} (Trojan.ZbotR.Gen) -> Value: {4533E3CB-D173-E078-2580-7393950B71E5} -> Quarantined and deleted successfully.

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    c:\documents and settings\Bob\application data\Azawoq\ahtix.exe (Trojan.ZbotR.Gen) -> Quarantined and deleted successfully.
  10. 2011-04-10, 03:12 #10
    ken545
    ken545 is offline
    Emeritus-Security Expert
    Join Date
    Nov 2005
    Location
    Florida's SpaceCoast
    Posts
    15,208

    Default

    Try running Combofix in Safemode
    Microsoft MVP Consumer Security 2007-2008-2009-2010-2011-2012-2013-2014

    ERROR MESSAGE 386
    No KeyBoard Detected
    Press F1 To Continue

    Just a reminder that threads will be closed if no reply in 3 days.
« Previous Thread | Next Thread »

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

Forum Rules