hijack this log file

Printable View

September 4th, 2010, 12:01 AM
malmzakk

hijack this log file

Can someone please check this log file for me

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 11:28:50 PM, on 9/3/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast5\avastUI.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: LimeWire Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O4 - HKLM\..\Run: [avast5] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/res...scbase8942.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {A1426AC5-8CE5-4A00-B71E-011D35709AC6} - http://advnt01.com/dialer/int_ver34.CAB
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O24 - Desktop Component 0: (no name) - http://www.popeyefreshfoods.com/images/leaf_main.jpg

--
End of file - 5948 bytes
September 4th, 2010, 02:44 AM
Train

HJT is not what it once was, so follow the instructions at
http://discussions.virtualdr.com/sho...d.php?t=167915
And POST the logs in this thread.
September 4th, 2010, 03:31 PM
malmzakk

Starting step 2 now....Malwarebytes log here

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4544

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

9/4/2010 3:27:00 PM
mbam-log-2010-09-04 (15-27-00).txt

Scan type: Quick scan
Objects scanned: 131375
Time elapsed: 21 minute(s), 54 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)
September 4th, 2010, 03:44 PM
malmzakk

Starting step 3 now....this is GMER log

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit quick scan 2010-09-04 15:42:57
Windows 5.1.2600 Service Pack 3
Running: 5usnnonf.exe; Driver: C:\DOCUME~1\user\LOCALS~1\Temp\kgtoraog.sys

---- System - GMER 1.0.15 ----

Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwCreateProcessEx [0xF0EADB9C]
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwCreateSection [0xF0EAD9C0]
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwLoadDriver [0xF0EADAFA]
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) NtCreateSection
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ObInsertObject
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ObMakeTemporaryObject

---- Devices - GMER 1.0.15 ----

Device \FileSystem\Ntfs \Ntfs aswSP.SYS (avast! self protection module/ALWIL Software)

AttachedDevice \FileSystem\Ntfs \Ntfs aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\Ip aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Tcpip \Device\RawIp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

---- EOF - GMER 1.0.15 ----
September 4th, 2010, 03:45 PM
Broni

What are computer's issues?
September 4th, 2010, 04:04 PM
malmzakk

At any givin time my computer seems to slow down almost lock up for up to an hour or a half..it's been doing this for the last month...Yes I have system restore on....but I've always had that running.When it starts to lock up I take myself off the net and it goes back to normal....when I go back on the net it starts locking up again ( pages won't load or they start to load then lock up )....it's as if it resumes what it was doing.Never did any of this before..this is why I think I have something??.By the way,thanx for your help.
September 4th, 2010, 04:04 PM
malmzakk

Service:

==== System Restore Points ===================

RP617: 8/3/2010 2:40:16 PM - System Checkpoint
RP618: 8/3/2010 6:00:14 PM - Software Distribution Service 3.0
RP619: 8/5/2010 1:03:08 PM - Installed Windows XP KB2229593.
RP620: 8/5/2010 1:11:45 PM - Installed Windows XP KB980195.
RP621: 8/6/2010 11:03:59 PM - System Checkpoint
RP622: 8/7/2010 11:08:14 AM - Installed Windows XP KB2229593.
RP623: 8/7/2010 11:48:33 PM - Installed Windows XP KB2229593.
RP624: 8/9/2010 9:01:25 PM - System Checkpoint
RP625: 8/11/2010 11:50:37 AM - Software Distribution Service 3.0
RP626: 8/12/2010 5:52:59 PM - System Checkpoint
RP627: 8/13/2010 5:54:38 PM - System Checkpoint
RP628: 8/17/2010 8:15:49 PM - System Checkpoint
RP629: 8/19/2010 9:09:58 PM - System Checkpoint
RP630: 8/20/2010 1:34:10 PM - Installed Java(TM) 6 Update 21
RP631: 8/21/2010 3:26:15 PM - System Checkpoint
RP632: 8/24/2010 9:51:50 PM - Restore Operation
RP633: 8/27/2010 3:22:17 PM - System Checkpoint
RP634: 8/29/2010 10:05:12 AM - System Checkpoint
RP635: 8/30/2010 12:59:53 PM - System Checkpoint
RP636: 8/31/2010 3:43:53 PM - System Checkpoint
RP637: 9/3/2010 11:27:26 PM - Installed HiJackThis
RP638: 9/4/2010 12:28:12 AM - Removed Ask Toolbar.
RP639: 9/4/2010 12:30:03 AM - Software Distribution Service 3.0

==== Installed Programs ======================

Acrobat.com
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Photoshop 7.0
Adobe Reader 9.3.4
Advanced SystemCare 3
ATI - Software Uninstall Utility
ATI Catalyst Control Center
ATI Control Panel
ATI Display Driver
ATI HydraVision
Auslogics Disk Defrag
AutoUpdate
avast! Free Antivirus
AVS Audio Editor version 4.2
AVS Update Manager 1.0
AVS4YOU Software Navigator 1.3
CCleaner
Command & Conquer Renegade
Command & Conquer Tiberian Sun
D-Link PCI Fast Ethernet Adapter
DivX
DivX Player
EPSON Printer Software
Guitar Pro 5.0
HighMAT Extension to Microsoft Windows XP CD Writing Wizard
HiJackThis
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
Hotfix for Windows XP (KB976098-v2)
Hotfix for Windows XP (KB979306)
Hotfix for Windows XP (KB981793)
J2SE Runtime Environment 5.0 Update 7
Japanese Fonts Support For Adobe Reader 9
Java 2 Runtime Environment, SE v1.4.1_02
Java Auto Updater
Java Web Start
Java(TM) 6 Update 21
Jetcast 3.0.2
jlGui 3.0
LimeWire 5.4.8
Malwarebytes' Anti-Malware
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB979906)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Application Error Reporting
Microsoft Base Smart Card Cryptographic Service Provider Package
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office XP Professional with FrontPage
Microsoft Silverlight
Microsoft User-Mode Driver Framework Feature Pack 1.0 (Beta2)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
Nero OEM
Octoshape add-in for Adobe Flash Player
PowerDVD
ratDVD 0.78.1444
Security Update for CAPICOM (KB931906)
Security Update for Windows Internet Explorer 8 (KB2183461)
Security Update for Windows Internet Explorer 8 (KB969897)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB972260)
Security Update for Windows Internet Explorer 8 (KB974455)
Security Update for Windows Internet Explorer 8 (KB976325)
Security Update for Windows Internet Explorer 8 (KB978207)
Security Update for Windows Internet Explorer 8 (KB981332)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player 10 (KB911565)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 10 (KB936782)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB2079403)
Security Update for Windows XP (KB2115168)
Security Update for Windows XP (KB2160329)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB2286198)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB938464-v2)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950759)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953838)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956390)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958215)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960714)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB963027)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969897)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977165-v2)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB980436)
Security Update for Windows XP (KB981852)
Security Update for Windows XP (KB981997)
Security Update for Windows XP (KB982214)
Security Update for Windows XP (KB982665)
Speeditup Free 4.01
Spybot - Search & Destroy
Spybot - Search & Destroy 1.4
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows Internet Explorer 8 (KB971930)
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows Internet Explorer 8 (KB976749)
Update for Windows Internet Explorer 8 (KB980182)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
VC80CRTRedist - 8.0.50727.4053
Veetle TV 0.9.17
VideoLAN VLC media player 0.8.5
WebFldrs XP
Westwood Shared Internet Components
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage v1.3.0254.0
Windows Genuine Advantage Validation Tool (KB892130)
Windows Internet Explorer 8
Windows Live OneCare safety scanner
Windows Media Connect
Windows Media Format SDK Hotfix - KB891122
Windows XP Service Pack 3
WinRAR archiver

==== Event Viewer Messages From Past Week ========

9/4/2010 12:28:23 AM, error: Service Control Manager [7023] - The Application Management service terminated with the following error: The specified module could not be found.
9/2/2010 12:46:20 AM, error: Dhcp [1001] - Your computer was not assigned an address from the network (by the DHCP Server) for the Network Card with network address 0050BAE93337. The following error occurred: The semaphore timeout period has expired. . Your computer will continue to try and obtain an address on its own from the network address (DHCP) server.
9/1/2010 11:48:08 PM, error: atapi [9] - The device, \Device\Ide\IdePort1, did not respond within the timeout period.

==== End Of File ===========================
September 4th, 2010, 04:05 PM
malmzakk

DDS (Ver_10-03-17.01) - NTFSx86
Run by user at 15:46:39.46 on Sat 09/04/2010
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.384.47 [GMT -4:00]

AV: avast! Antivirus *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast5\avastUI.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
svchost.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Documents and Settings\user\Desktop\5usnnonf.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\user\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/webhp
uSearch Page = about:blank
uSearch Bar = about:blank
mSearch Bar = about:blank
uSearchURL,(Default) = about:blank
mSearchAssistant = about:blank
mCustomizeSearch = about:blank
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File
TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [avast5] "c:\program files\alwil software\avast5\avastUI.exe" /nogui
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
DPF: {31435657-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab
DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} - hxxp://dl.tvunetworks.com/TVUAx.cab
DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase8942.cab
DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - hxxp://download.divx.com/player/DivXBrowserPlugin.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {A1426AC5-8CE5-4A00-B71E-011D35709AC6} - hxxp://advnt01.com/dialer/int_ver34.CAB
DPF: {CAFEEFAC-0015-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: NameServer = 208.67.220.220,208.67.222.222
Notify: AtiExtEvent - Ati2evxx.dll
Hosts: 127.0.0.1 www.spywareinfo.com

============= SERVICES / DRIVERS ===============

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2010-2-26 165456]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2010-2-26 17744]
R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast5\AvastSvc.exe [2010-2-26 40384]
R3 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast5\AvastSvc.exe [2010-2-26 40384]
R3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast5\AvastSvc.exe [2010-2-26 40384]

=============== Created Last 30 ================

2010-09-04 03:27:30 0 d-----w- c:\program files\Trend Micro

==================== Find3M ====================

2010-07-17 09:00:04 423656 ----a-w- c:\windows\system32\deployJava1.dll
2010-06-30 12:31:35 149504 ----a-w- c:\windows\system32\schannel.dll
2010-06-28 20:57:33 38848 ----a-w- c:\windows\avastSS.scr
2010-06-24 12:22:03 916480 ----a-w- c:\windows\system32\wininet.dll
2010-06-23 13:44:04 1851904 ----a-w- c:\windows\system32\win32k.sys
2010-06-17 14:03:00 80384 ----a-w- c:\windows\system32\iccvid.dll
2010-06-14 07:41:45 1172480 ----a-w- c:\windows\system32\msxml3.dll
2010-06-12 00:56:52 724992 ----a-w- c:\windows\iun6002.exe
2006-07-15 20:12:26 5949316 ----a-w- c:\program files\Red Hot Chilli Peppers- Tell Me Baby.mp3
2006-06-22 04:24:36 4225744 ----a-w- c:\program files\Limewire Lime Wire Pro 4.12.3.exe

============= FINISH: 15:48:00.65 ===============
September 4th, 2010, 04:27 PM
Broni
We'll check...

Download MBRCheck to your desktop

Double click MBRCheck.exe to run (Vista and Windows 7 users, right click and select Run as Administrator).
It will show a black screen with some data on it.
Enter N to exit.
A report called MBRcheckxxxx.txt will be on your desktop
Open this report and post its content in your next reply.

===============================================================

Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
1. Please, never rename Combofix unless instructed.
2. Close any open browsers.
3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  - Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  - Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
  NOTE1. If Combofix asks you to install Recovery Console, please allow it.
  NOTE 2. If Combofix asks you to update the program, always do so.
  - Close any open browsers.
  - WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
  - Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
  - If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
4. Double click on combofix.exe & follow the prompts.
5. When finished, it will produce a report for you.
6. Please post the "C:\ComboFix.txt"
**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

Make sure, you re-enable your security programs, when you're done with Combofix.

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
September 4th, 2010, 05:28 PM
malmzakk

When it starts slowing down I do a Ctrl Alt Delete and the System Idle Process is between 85 and 100%...if that's any help

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows XP Home Edition
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x0000001d

Kernel Drivers (total 118):
0x804D7000 \WINDOWS\system32\ntoskrnl.exe
0x806EE000 \WINDOWS\system32\hal.dll
0xF7B68000 \WINDOWS\system32\KDCOM.DLL
0xF7A78000 \WINDOWS\system32\BOOTVID.dll
0xF7619000 ACPI.sys
0xF7B6A000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
0xF7608000 pci.sys
0xF7668000 isapnp.sys
0xF7B6C000 viaide.sys
0xF78E8000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
0xF7678000 MountMgr.sys
0xF75E9000 ftdisk.sys
0xF78F0000 PartMgr.sys
0xF7688000 VolSnap.sys
0xF75D1000 atapi.sys
0xF7698000 disk.sys
0xF76A8000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
0xF75B1000 fltmgr.sys
0xF759F000 sr.sys
0xF78F8000 PxHelp20.sys
0xF7588000 KSecDD.sys
0xF74FB000 Ntfs.sys
0xF74CE000 NDIS.sys
0xF76B8000 viaagp.sys
0xF74B4000 Mup.sys
0xF7848000 \SystemRoot\system32\DRIVERS\p3.sys
0xF7305000 \SystemRoot\system32\DRIVERS\ati2mtag.sys
0xF72F1000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
0xF7930000 \SystemRoot\system32\DRIVERS\fdc.sys
0xF72DD000 \SystemRoot\system32\DRIVERS\parport.sys
0xF7858000 \SystemRoot\system32\DRIVERS\serial.sys
0xF7B50000 \SystemRoot\system32\DRIVERS\serenum.sys
0xF7868000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0xF7938000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0xF7940000 \SystemRoot\system32\DRIVERS\mouclass.sys
0xF7878000 \SystemRoot\system32\DRIVERS\imapi.sys
0xF7888000 \SystemRoot\system32\DRIVERS\cdrom.sys
0xF7898000 \SystemRoot\system32\DRIVERS\redbook.sys
0xF72BA000 \SystemRoot\system32\DRIVERS\ks.sys
0xF7948000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0xF7296000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0xF71B8000 \SystemRoot\system32\DRIVERS\HCF_MSFT.sys
0xF7950000 \SystemRoot\System32\Drivers\Modem.SYS
0xF78A8000 \SystemRoot\system32\DRIVERS\dlkfet5b.sys
0xF7172000 \SystemRoot\system32\drivers\emu10k1m.sys
0xF714E000 \SystemRoot\system32\drivers\portcls.sys
0xF78B8000 \SystemRoot\system32\drivers\drmk.sys
0xF78C8000 \SystemRoot\system32\drivers\sfmanm.sys
0xF7B8A000 \SystemRoot\system32\drivers\ctlfacem.sys
0xF7D9A000 \SystemRoot\system32\DRIVERS\ctljystk.sys
0xF7B5C000 \SystemRoot\system32\DRIVERS\gameenum.sys
0xF7D9B000 \SystemRoot\system32\DRIVERS\audstub.sys
0xF78D8000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0xF7B60000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0xF711A000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0xF7708000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0xF7718000 \SystemRoot\system32\DRIVERS\raspptp.sys
0xF7960000 \SystemRoot\system32\DRIVERS\TDI.SYS
0xF7069000 \SystemRoot\system32\DRIVERS\psched.sys
0xF7728000 \SystemRoot\system32\DRIVERS\msgpc.sys
0xF7968000 \SystemRoot\system32\DRIVERS\ptilink.sys
0xF7970000 \SystemRoot\system32\DRIVERS\raspti.sys
0xF7738000 \SystemRoot\system32\DRIVERS\termdd.sys
0xF7B8C000 \SystemRoot\system32\DRIVERS\swenum.sys
0xF700B000 \SystemRoot\system32\DRIVERS\update.sys
0xF7490000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0xF7778000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xF79C0000 \SystemRoot\system32\DRIVERS\flpydisk.sys
0xF6F25000 \SystemRoot\system32\DRIVERS\usbhub.sys
0xF7BBA000 \SystemRoot\system32\DRIVERS\USBD.SYS
0xF7BE4000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xF7CB4000 \SystemRoot\System32\Drivers\Null.SYS
0xF7BE6000 \SystemRoot\System32\Drivers\Beep.SYS
0xF7A40000 \SystemRoot\System32\drivers\vga.sys
0xF7BE8000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xF7BEA000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xF7A48000 \SystemRoot\System32\Drivers\Msfs.SYS
0xF7A50000 \SystemRoot\System32\Drivers\Npfs.SYS
0xF7B4C000 \SystemRoot\system32\DRIVERS\rasacd.sys
0xF1B68000 \SystemRoot\system32\DRIVERS\ipsec.sys
0xF1B0F000 \SystemRoot\system32\DRIVERS\tcpip.sys
0xF6ED5000 \SystemRoot\System32\Drivers\aswTdi.SYS
0xF1AE7000 \SystemRoot\system32\DRIVERS\netbt.sys
0xF12C8000 \SystemRoot\System32\drivers\afd.sys
0xF6EC5000 \SystemRoot\system32\DRIVERS\netbios.sys
0xF129D000 \SystemRoot\system32\DRIVERS\rdbss.sys
0xF1205000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xF6EB5000 \SystemRoot\System32\Drivers\Fips.SYS
0xF11DF000 \SystemRoot\system32\DRIVERS\ipnat.sys
0xF6EA5000 \SystemRoot\system32\DRIVERS\wanarp.sys
0xF0E98000 \SystemRoot\System32\Drivers\aswSP.SYS
0xF7998000 \SystemRoot\System32\Drivers\Aavmker4.SYS
0xF70CA000 \SystemRoot\System32\Drivers\Cdfs.SYS
0xBF800000 \SystemRoot\System32\win32k.sys
0xF7B0C000 \SystemRoot\System32\drivers\Dxapi.sys
0xF79F8000 \SystemRoot\System32\watchdog.sys
0xBF000000 \SystemRoot\System32\drivers\dxg.sys
0xF7C85000 \SystemRoot\System32\drivers\dxgthk.sys
0xBF012000 \SystemRoot\System32\ati2dvag.dll
0xBF054000 \SystemRoot\System32\ati2cqag.dll
0xBF08E000 \SystemRoot\System32\atikvmag.dll
0xBF0C4000 \SystemRoot\System32\ati3duag.dll
0xBF32B000 \SystemRoot\System32\ativvaxx.dll
0xBFFA0000 \SystemRoot\System32\ATMFD.DLL
0xF7B00000 \SystemRoot\System32\Drivers\aswFsBlk.SYS
0xEE0AF000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0xEDFF0000 \SystemRoot\System32\Drivers\aswMon2.SYS
0xEDC93000 \SystemRoot\system32\drivers\wdmaud.sys
0xEDF48000 \SystemRoot\system32\drivers\sysaudio.sys
0xF7B78000 \SystemRoot\System32\Drivers\ParVdm.SYS
0xEDD28000 \??\C:\WINDOWS\system32\Drivers\SbcpHid.sys
0xEDD18000 \SystemRoot\system32\DRIVERS\secdrv.sys
0xEDA2E000 \SystemRoot\system32\DRIVERS\srv.sys
0xED80D000 \SystemRoot\System32\Drivers\HTTP.sys
0xF7920000 \SystemRoot\System32\Drivers\aswRdr.SYS
0xED393000 \??\C:\DOCUME~1\user\LOCALS~1\Temp\kgtoraog.sys
0xED368000 \SystemRoot\system32\drivers\kmixer.sys
0x7C900000 \WINDOWS\system32\ntdll.dll

Processes (total 32):
0 System Idle Process
4 System
September 4th, 2010, 05:44 PM
Broni

Quote:

System Idle Process is between 85 and 100%

System Idle Process is CPU NOT used, so your numbers are fine.

MBRCheck log is incomplete.
Please, repost.
September 4th, 2010, 06:07 PM
malmzakk

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows XP Home Edition
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x0000001d

Kernel Drivers (total 118):
0x804D7000 \WINDOWS\system32\ntoskrnl.exe
0x806EE000 \WINDOWS\system32\hal.dll
0xF7B68000 \WINDOWS\system32\KDCOM.DLL
0xF7A78000 \WINDOWS\system32\BOOTVID.dll
0xF7619000 ACPI.sys
0xF7B6A000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
0xF7608000 pci.sys
0xF7668000 isapnp.sys
0xF7B6C000 viaide.sys
0xF78E8000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
0xF7678000 MountMgr.sys
0xF75E9000 ftdisk.sys
0xF78F0000 PartMgr.sys
0xF7688000 VolSnap.sys
0xF75D1000 atapi.sys
0xF7698000 disk.sys
0xF76A8000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
0xF75B1000 fltmgr.sys
0xF759F000 sr.sys
0xF78F8000 PxHelp20.sys
0xF7588000 KSecDD.sys
0xF74FB000 Ntfs.sys
0xF74CE000 NDIS.sys
0xF76B8000 viaagp.sys
0xF74B4000 Mup.sys
0xF7848000 \SystemRoot\system32\DRIVERS\p3.sys
0xF7305000 \SystemRoot\system32\DRIVERS\ati2mtag.sys
0xF72F1000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
0xF7930000 \SystemRoot\system32\DRIVERS\fdc.sys
0xF72DD000 \SystemRoot\system32\DRIVERS\parport.sys
0xF7858000 \SystemRoot\system32\DRIVERS\serial.sys
0xF7B50000 \SystemRoot\system32\DRIVERS\serenum.sys
0xF7868000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0xF7938000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0xF7940000 \SystemRoot\system32\DRIVERS\mouclass.sys
0xF7878000 \SystemRoot\system32\DRIVERS\imapi.sys
0xF7888000 \SystemRoot\system32\DRIVERS\cdrom.sys
0xF7898000 \SystemRoot\system32\DRIVERS\redbook.sys
0xF72BA000 \SystemRoot\system32\DRIVERS\ks.sys
0xF7948000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0xF7296000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0xF71B8000 \SystemRoot\system32\DRIVERS\HCF_MSFT.sys
0xF7950000 \SystemRoot\System32\Drivers\Modem.SYS
0xF78A8000 \SystemRoot\system32\DRIVERS\dlkfet5b.sys
0xF7172000 \SystemRoot\system32\drivers\emu10k1m.sys
0xF714E000 \SystemRoot\system32\drivers\portcls.sys
0xF78B8000 \SystemRoot\system32\drivers\drmk.sys
0xF78C8000 \SystemRoot\system32\drivers\sfmanm.sys
0xF7B8A000 \SystemRoot\system32\drivers\ctlfacem.sys
0xF7D9A000 \SystemRoot\system32\DRIVERS\ctljystk.sys
0xF7B5C000 \SystemRoot\system32\DRIVERS\gameenum.sys
0xF7D9B000 \SystemRoot\system32\DRIVERS\audstub.sys
0xF78D8000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0xF7B60000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0xF711A000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0xF7708000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0xF7718000 \SystemRoot\system32\DRIVERS\raspptp.sys
0xF7960000 \SystemRoot\system32\DRIVERS\TDI.SYS
0xF7069000 \SystemRoot\system32\DRIVERS\psched.sys
0xF7728000 \SystemRoot\system32\DRIVERS\msgpc.sys
0xF7968000 \SystemRoot\system32\DRIVERS\ptilink.sys
0xF7970000 \SystemRoot\system32\DRIVERS\raspti.sys
0xF7738000 \SystemRoot\system32\DRIVERS\termdd.sys
0xF7B8C000 \SystemRoot\system32\DRIVERS\swenum.sys
0xF700B000 \SystemRoot\system32\DRIVERS\update.sys
0xF7490000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0xF7778000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xF79C0000 \SystemRoot\system32\DRIVERS\flpydisk.sys
0xF6F25000 \SystemRoot\system32\DRIVERS\usbhub.sys
0xF7BBA000 \SystemRoot\system32\DRIVERS\USBD.SYS
0xF7BE4000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xF7CB4000 \SystemRoot\System32\Drivers\Null.SYS
0xF7BE6000 \SystemRoot\System32\Drivers\Beep.SYS
0xF7A40000 \SystemRoot\System32\drivers\vga.sys
0xF7BE8000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xF7BEA000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xF7A48000 \SystemRoot\System32\Drivers\Msfs.SYS
0xF7A50000 \SystemRoot\System32\Drivers\Npfs.SYS
0xF7B4C000 \SystemRoot\system32\DRIVERS\rasacd.sys
0xF1B68000 \SystemRoot\system32\DRIVERS\ipsec.sys
0xF1B0F000 \SystemRoot\system32\DRIVERS\tcpip.sys
0xF6ED5000 \SystemRoot\System32\Drivers\aswTdi.SYS
0xF1AE7000 \SystemRoot\system32\DRIVERS\netbt.sys
0xF12C8000 \SystemRoot\System32\drivers\afd.sys
0xF6EC5000 \SystemRoot\system32\DRIVERS\netbios.sys
0xF129D000 \SystemRoot\system32\DRIVERS\rdbss.sys
0xF1205000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xF6EB5000 \SystemRoot\System32\Drivers\Fips.SYS
0xF11DF000 \SystemRoot\system32\DRIVERS\ipnat.sys
0xF6EA5000 \SystemRoot\system32\DRIVERS\wanarp.sys
0xF0E98000 \SystemRoot\System32\Drivers\aswSP.SYS
0xF7998000 \SystemRoot\System32\Drivers\Aavmker4.SYS
0xF70CA000 \SystemRoot\System32\Drivers\Cdfs.SYS
0xBF800000 \SystemRoot\System32\win32k.sys
0xF7B0C000 \SystemRoot\System32\drivers\Dxapi.sys
0xF79F8000 \SystemRoot\System32\watchdog.sys
0xBF000000 \SystemRoot\System32\drivers\dxg.sys
0xF7C85000 \SystemRoot\System32\drivers\dxgthk.sys
0xBF012000 \SystemRoot\System32\ati2dvag.dll
0xBF054000 \SystemRoot\System32\ati2cqag.dll
0xBF08E000 \SystemRoot\System32\atikvmag.dll
0xBF0C4000 \SystemRoot\System32\ati3duag.dll
0xBF32B000 \SystemRoot\System32\ativvaxx.dll
0xBFFA0000 \SystemRoot\System32\ATMFD.DLL
0xF7B00000 \SystemRoot\System32\Drivers\aswFsBlk.SYS
0xEE0AF000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0xEDFF0000 \SystemRoot\System32\Drivers\aswMon2.SYS
0xEDC93000 \SystemRoot\system32\drivers\wdmaud.sys
0xEDF48000 \SystemRoot\system32\drivers\sysaudio.sys
0xF7B78000 \SystemRoot\System32\Drivers\ParVdm.SYS
0xEDD28000 \??\C:\WINDOWS\system32\Drivers\SbcpHid.sys
0xEDD18000 \SystemRoot\system32\DRIVERS\secdrv.sys
0xEDA2E000 \SystemRoot\system32\DRIVERS\srv.sys
0xED80D000 \SystemRoot\System32\Drivers\HTTP.sys
0xF7920000 \SystemRoot\System32\Drivers\aswRdr.SYS
0xED393000 \??\C:\DOCUME~1\user\LOCALS~1\Temp\kgtoraog.sys
0xED368000 \SystemRoot\system32\drivers\kmixer.sys
0x7C900000 \WINDOWS\system32\ntdll.dll

Processes (total 29):
0 System Idle Process
4 System
540 C:\WINDOWS\system32\smss.exe
588 csrss.exe
624 C:\WINDOWS\system32\winlogon.exe
680 C:\WINDOWS\system32\services.exe
692 C:\WINDOWS\system32\lsass.exe
848 C:\WINDOWS\system32\ati2evxx.exe
864 C:\WINDOWS\system32\svchost.exe
940 svchost.exe
1036 C:\WINDOWS\system32\svchost.exe
1368 C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
1520 C:\WINDOWS\system32\ati2evxx.exe
1596 C:\WINDOWS\explorer.exe
1748 C:\Program Files\Alwil Software\Avast5\AvastUI.exe
1772 C:\Program Files\Common Files\Java\Java Update\jusched.exe
1780 C:\WINDOWS\system32\ctfmon.exe
216 C:\WINDOWS\system32\spoolsv.exe
444 C:\WINDOWS\system32\devldr32.exe
1320 C:\WINDOWS\system32\cisvc.exe
736 C:\Program Files\Java\jre6\bin\jqs.exe
1500 wdfmgr.exe
564 svchost.exe
1172 alg.exe
3544 C:\WINDOWS\system32\svchost.exe
3728 C:\WINDOWS\system32\cidaemon.exe
2700 C:\Program Files\Internet Explorer\iexplore.exe
2908 C:\Program Files\Internet Explorer\iexplore.exe
2028 C:\Documents and Settings\user\Desktop\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)

PhysicalDrive0 Model Number: Maxtor6L080L0, Rev: BAJ41G20

Size Device Name MBR Status
--------------------------------------------
76 GB \\.\PhysicalDrive0 Windows XP MBR code detected
SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A

Done!
September 4th, 2010, 06:33 PM
Broni

OK. Looks good :)

Combofix, please.
September 4th, 2010, 08:33 PM
malmzakk

ComboFix 10-09-04.03 - user 09/04/2010 20:06:33.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.384.179 [GMT -4:00]
Running from: c:\documents and settings\user\Desktop\ComboFix.exe
AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Common Files\ozqf
c:\program files\Common Files\ozqf\ozqfd\class-barrel
c:\program files\Common Files\ozqf\ozqfd\vocabulary
c:\program files\Common Files\ozqf\ozqfh
c:\windows\Downloaded Program Files\popcaploader.inf
c:\windows\msvrc20.dll

.
((((((((((((((((((((((((( Files Created from 2010-08-05 to 2010-09-05 )))))))))))))))))))))))))))))))
.

2010-09-04 03:27 . 2010-09-04 03:27 388096 ----a-r- c:\documents and settings\user\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-09-04 03:27 . 2010-09-04 03:27 -------- d-----w- c:\program files\Trend Micro
2010-08-17 03:03 . 2010-08-17 03:03 61440 ----a-w- c:\documents and settings\user\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-50ca2b7b-n\decora-sse.dll
2010-08-17 03:03 . 2010-08-17 03:03 12800 ----a-w- c:\documents and settings\user\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-50ca2b7b-n\decora-d3d.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-04 13:32 . 2008-12-23 03:15 -------- d-----w- c:\program files\Microsoft Silverlight
2010-08-20 17:35 . 2005-12-23 20:38 -------- d-----w- c:\program files\Java
2010-08-11 17:55 . 2005-12-24 19:14 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-08-08 02:44 . 2010-01-03 03:33 -------- d-----w- c:\program files\Veetle
2010-08-04 02:18 . 2010-08-04 02:18 -------- d-----w- c:\documents and settings\user\Application Data\Auslogics
2010-08-04 02:18 . 2010-08-04 02:18 -------- d-----w- c:\program files\Auslogics
2010-07-17 09:00 . 2010-04-20 00:12 423656 ----a-w- c:\windows\system32\deployJava1.dll
2010-06-30 12:31 . 2004-08-04 12:00 149504 ----a-w- c:\windows\system32\schannel.dll
2010-06-28 20:57 . 2010-07-10 22:15 38848 ----a-w- c:\windows\avastSS.scr
2010-06-28 20:57 . 2010-02-26 22:54 165032 ----a-w- c:\windows\system32\aswBoot.exe
2010-06-28 20:37 . 2010-02-26 22:54 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-06-28 20:37 . 2010-02-26 22:54 165456 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-06-28 20:33 . 2010-02-26 22:54 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-06-28 20:32 . 2010-02-26 22:54 100176 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2010-06-28 20:32 . 2010-02-26 22:54 94544 ----a-w- c:\windows\system32\drivers\aswmon.sys
2010-06-28 20:32 . 2010-02-26 22:54 17744 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-06-28 20:32 . 2010-02-26 22:54 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2010-06-24 12:22 . 2004-08-04 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2010-06-23 13:44 . 2004-08-04 12:00 1851904 ----a-w- c:\windows\system32\win32k.sys
2010-06-21 15:27 . 2004-08-04 12:00 354304 ----a-w- c:\windows\system32\drivers\srv.sys
2010-06-17 14:03 . 2004-08-04 12:00 80384 ----a-w- c:\windows\system32\iccvid.dll
2010-06-14 14:31 . 2005-12-23 16:38 744448 ----a-w- c:\windows\pchealth\helpctr\binaries\helpsvc.exe
2010-06-14 07:41 . 2004-08-04 12:00 1172480 ----a-w- c:\windows\system32\msxml3.dll
2010-06-12 00:56 . 2010-06-12 00:57 724992 ----a-w- c:\windows\iun6002.exe
2010-06-08 03:04 . 2010-06-08 03:04 12800 ----a-w- c:\documents and settings\user\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-346b2461-n\decora-d3d.dll
2010-06-08 03:04 . 2010-06-08 03:04 61440 ----a-w- c:\documents and settings\user\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-346b2461-n\decora-sse.dll
2006-07-15 20:12 . 2006-12-01 00:06 5949316 ----a-w- c:\program files\Red Hot Chilli Peppers- Tell Me Baby.mp3
2006-06-22 04:24 . 2006-12-01 00:06 4225744 ----a-w- c:\program files\Limewire Lime Wire Pro 4.12.3.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast5"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2010-06-28 2837864]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2006-3-15 113664]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Symantec NetDriver Monitor

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC]
2005-08-12 19:43 45056 ----a-w- c:\program files\ATI Technologies\ATI.ACE\CLI.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIModeChange]
2005-12-12 03:35 26112 ----a-w- c:\windows\system32\Ati2mdxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
2003-06-05 17:35 335872 ----a-w- c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 00:12 1695232 ----a-w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 14:50 155648 ----a-w- c:\windows\system32\NeroCheck.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Media Player\\wmplayer.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1723:TCP"= 1723:TCP:@xpsp2res.dll,-22015
"1701:UDP"= 1701:UDP:@xpsp2res.dll,-22016
"500:UDP"= 500:UDP:@xpsp2res.dll,-22017

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2/26/2010 6:54 PM 165456]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2/26/2010 6:54 PM 17744]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - KGTORAOG
*Deregistered* - kgtoraog
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/webhp
mSearch Bar = about:blank
uSearchURL,(Default) = about:blank
.
- - - - ORPHANS REMOVED - - - -

Toolbar-SITEguard - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-09-04 20:19
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(624)
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2010-09-04 20:28:08
ComboFix-quarantined-files.txt 2010-09-05 00:28

Pre-Run: 51,636,473,856 bytes free
Post-Run: 51,679,461,376 bytes free

- - End Of File - - AD9B3204E4FCA1733A042EC9073B4702
September 4th, 2010, 08:36 PM
Broni

Please, re-run Combofix and this time allow recovery console installation (as my instructions say).
Post new log.
September 4th, 2010, 09:28 PM
malmzakk

ComboFix 10-09-04.04 - user 09/04/2010 21:02:55.2.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.384.120 [GMT -4:00]
Running from: c:\documents and settings\user\Desktop\ComboFix.exe
AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((( Files Created from 2010-08-05 to 2010-09-05 )))))))))))))))))))))))))))))))
.

2010-09-04 03:27 . 2010-09-04 03:27 388096 ----a-r- c:\documents and settings\user\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-09-04 03:27 . 2010-09-04 03:27 -------- d-----w- c:\program files\Trend Micro
2010-08-17 03:03 . 2010-08-17 03:03 61440 ----a-w- c:\documents and settings\user\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-50ca2b7b-n\decora-sse.dll
2010-08-17 03:03 . 2010-08-17 03:03 12800 ----a-w- c:\documents and settings\user\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-50ca2b7b-n\decora-d3d.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-04 13:32 . 2008-12-23 03:15 -------- d-----w- c:\program files\Microsoft Silverlight
2010-08-20 17:35 . 2005-12-23 20:38 -------- d-----w- c:\program files\Java
2010-08-11 17:55 . 2005-12-24 19:14 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-08-08 02:44 . 2010-01-03 03:33 -------- d-----w- c:\program files\Veetle
2010-08-04 02:18 . 2010-08-04 02:18 -------- d-----w- c:\documents and settings\user\Application Data\Auslogics
2010-08-04 02:18 . 2010-08-04 02:18 -------- d-----w- c:\program files\Auslogics
2010-07-17 09:00 . 2010-04-20 00:12 423656 ----a-w- c:\windows\system32\deployJava1.dll
2010-06-30 12:31 . 2004-08-04 12:00 149504 ----a-w- c:\windows\system32\schannel.dll
2010-06-28 20:57 . 2010-07-10 22:15 38848 ----a-w- c:\windows\avastSS.scr
2010-06-28 20:57 . 2010-02-26 22:54 165032 ----a-w- c:\windows\system32\aswBoot.exe
2010-06-28 20:37 . 2010-02-26 22:54 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-06-28 20:37 . 2010-02-26 22:54 165456 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-06-28 20:33 . 2010-02-26 22:54 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-06-28 20:32 . 2010-02-26 22:54 100176 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2010-06-28 20:32 . 2010-02-26 22:54 94544 ----a-w- c:\windows\system32\drivers\aswmon.sys
2010-06-28 20:32 . 2010-02-26 22:54 17744 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-06-28 20:32 . 2010-02-26 22:54 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2010-06-24 12:22 . 2004-08-04 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2010-06-23 13:44 . 2004-08-04 12:00 1851904 ----a-w- c:\windows\system32\win32k.sys
2010-06-21 15:27 . 2004-08-04 12:00 354304 ----a-w- c:\windows\system32\drivers\srv.sys
2010-06-17 14:03 . 2004-08-04 12:00 80384 ----a-w- c:\windows\system32\iccvid.dll
2010-06-14 14:31 . 2005-12-23 16:38 744448 ----a-w- c:\windows\pchealth\helpctr\binaries\helpsvc.exe
2010-06-14 07:41 . 2004-08-04 12:00 1172480 ----a-w- c:\windows\system32\msxml3.dll
2010-06-12 00:56 . 2010-06-12 00:57 724992 ----a-w- c:\windows\iun6002.exe
2010-06-08 03:04 . 2010-06-08 03:04 12800 ----a-w- c:\documents and settings\user\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-346b2461-n\decora-d3d.dll
2010-06-08 03:04 . 2010-06-08 03:04 61440 ----a-w- c:\documents and settings\user\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-346b2461-n\decora-sse.dll
2006-07-15 20:12 . 2006-12-01 00:06 5949316 ----a-w- c:\program files\Red Hot Chilli Peppers- Tell Me Baby.mp3
2006-06-22 04:24 . 2006-12-01 00:06 4225744 ----a-w- c:\program files\Limewire Lime Wire Pro 4.12.3.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast5"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2010-06-28 2837864]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2006-3-15 113664]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC]
2005-08-12 19:43 45056 ----a-w- c:\program files\ATI Technologies\ATI.ACE\CLI.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIModeChange]
2005-12-12 03:35 26112 ----a-w- c:\windows\system32\Ati2mdxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
2003-06-05 17:35 335872 ----a-w- c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 00:12 1695232 ----a-w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 14:50 155648 ----a-w- c:\windows\system32\NeroCheck.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Media Player\\wmplayer.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1723:TCP"= 1723:TCP:@xpsp2res.dll,-22015
"1701:UDP"= 1701:UDP:@xpsp2res.dll,-22016
"500:UDP"= 500:UDP:@xpsp2res.dll,-22017

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2/26/2010 6:54 PM 165456]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2/26/2010 6:54 PM 17744]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - KGTORAOG
*Deregistered* - kgtoraog
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/webhp
mSearch Bar = about:blank
uSearchURL,(Default) = about:blank
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-09-04 21:13
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(624)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(508)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
Completion time: 2010-09-04 21:21:37
ComboFix-quarantined-files.txt 2010-09-05 01:21
ComboFix2.txt 2010-09-05 00:28

Pre-Run: 51,715,813,376 bytes free
Post-Run: 51,703,611,392 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

- - End Of File - - B674C055B9DF04D67F000F50FCC08438
September 4th, 2010, 09:31 PM
Broni
Good :)

How is computer doing?

Download OTL to your Desktop.
- Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
- Under the Custom Scan box paste this in:
netsvcs
drivers32 /all
%SYSTEMDRIVE%\*.*
%systemroot%\system32\Spool\prtprocs\w32x86\*.dll
%systemroot%\system32\*.wt
%systemroot%\system32\*.ruy
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\system32\spool\prtprocs\w32x86\*.tmp
%systemroot%\*. /mp /s
/md5start
/md5stop
CREATERESTOREPOINT
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\user32.dll /md5
%systemroot%\system32\ws2_32.dll /md5
%systemroot%\system32\ws2help.dll /md5
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
- Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
- When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
- Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.
September 4th, 2010, 09:53 PM
malmzakk

OTL logfile created on: 9/4/2010 9:35:50 PM - Run 1
OTL by OldTimer - Version 3.2.11.0 Folder = C:\Documents and Settings\user\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

384.00 Mb Total Physical Memory | 55.00 Mb Available Physical Memory | 14.00% Memory free
923.00 Mb Paging File | 657.00 Mb Available in Paging File | 71.00% Paging File free
Paging file location(s): C:\pagefile.sys 576 1152 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 76.32 Gb Total Space | 48.18 Gb Free Space | 63.13% Space Free | Partition Type: NTFS
Drive D: | 697.74 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: USER-9612E78606
Current User Name: user
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Standard
Quick Scan

========== Processes (SafeList) ==========

PRC - [2010/09/04 21:34:43 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\user\Desktop\OTL.exe
PRC - [2010/06/28 16:57:18 | 002,837,864 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastUI.exe
PRC - [2010/06/28 16:57:15 | 000,040,384 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
PRC - [2008/04/13 20:12:28 | 000,060,416 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Outlook Express\msimn.exe
PRC - [2008/04/13 20:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2001/08/17 18:36:42 | 000,024,064 | ---- | M] (Creative Technology Ltd.) -- C:\WINDOWS\system32\devldr32.exe

========== Modules (SafeList) ==========

MOD - [2010/09/04 21:34:43 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\user\Desktop\OTL.exe
MOD - [2002/09/11 17:37:18 | 000,106,547 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\SunnComm Shared\msscript.OCX

========== Win32 Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] -- C:\WINDOWS\System32\hidserv.dll -- (HidServ)
SRV - File not found [On_Demand | Stopped] -- C:\WINDOWS\System32\appmgmts.dll -- (AppMgmt)
SRV - [2010/06/28 16:57:15 | 000,040,384 | ---- | M] (AVAST Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Web Scanner)
SRV - [2010/06/28 16:57:15 | 000,040,384 | ---- | M] (AVAST Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Mail Scanner)
SRV - [2010/06/28 16:57:15 | 000,040,384 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus)
SRV - [2005/10/06 19:12:30 | 000,855,552 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Media Connect 2\wmccds.exe -- (WMConnectCDS)

========== Driver Services (SafeList) ==========

DRV - [2010/06/28 16:37:52 | 000,046,672 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2010/06/28 16:37:30 | 000,165,456 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2010/06/28 16:33:13 | 000,023,376 | ---- | M] (ALWIL Software) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\aswRdr.sys -- (aswRdr)
DRV - [2010/06/28 16:32:45 | 000,100,176 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswmon2.sys -- (aswMon2)
DRV - [2010/06/28 16:32:33 | 000,017,744 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2010/06/28 16:32:16 | 000,028,880 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aavmker4.sys -- (Aavmker4)
DRV - [2008/04/13 14:45:29 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\gameenum.sys -- (gameenum)
DRV - [2007/05/16 11:20:32 | 000,043,008 | ---- | M] (D-Link ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\dlkfet5b.sys -- (FETNDISB)
DRV - [2005/12/11 23:40:43 | 001,414,656 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2002/05/16 10:39:06 | 000,038,176 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\SbcpHid.sys -- (SbcpHid)
DRV - [2001/08/17 09:28:02 | 000,907,456 | ---- | M] (Conexant) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HCF_MSFT.sys -- (HCF_MSFT)
DRV - [2001/08/17 08:19:34 | 000,036,480 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\sfmanm.sys -- (sfman) Creative SoundFont Manager Driver (WDM)
DRV - [2001/08/17 08:19:28 | 000,006,912 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ctlfacem.sys -- (emu10k1) Creative Interface Manager Driver (WDM)
DRV - [2001/08/17 08:19:26 | 000,283,904 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\emu10k1m.sys -- (emu10k) Creative SB Live! (WDM)
DRV - [2001/08/17 08:19:20 | 000,003,712 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ctljystk.sys -- (ctljystk)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/webhp
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

[2010/02/26 20:20:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Application Data\Mozilla\Extensions
[2010/02/26 20:20:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Application Data\Mozilla\Extensions\[email protected]

O1 HOSTS File: ([2010/09/04 20:19:30 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\avastUI.exe (AVAST Software)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\control panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} http://download.microsoft.com/downlo...8f/wvc1dmo.cab (Reg Error: Value error.)
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} http://dl.tvunetworks.com/TVUAx.cab (CTVUAxCtrl Object)
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} http://cdn.scan.onecare.live.com/res...scbase8942.cab (Windows Live Safety Center Base Module)
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} http://download.divx.com/player/DivXBrowserPlugin.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get.../ultrashim.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0015-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jin...ndows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 24.226.1.93 24.226.10.193 24.226.10.194 24.226.1.94
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop Components:0 () - http://www.popeyefreshfoods.com/images/leaf_main.jpg
O24 - Desktop Components:1 (My Current Home Page) - About:Home
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005/12/23 12:43:15 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2001/04/26 19:57:00 | 000,020,790 | R--- | M] () - D:\autorun.apm -- [ CDFS ]
O32 - AutoRun File - [2000/09/05 05:00:00 | 000,532,480 | R--- | M] (Indigo Rose Corporation) - D:\autorun.exe -- [ CDFS ]
O32 - AutoRun File - [1999/04/20 15:56:28 | 000,010,134 | R--- | M] () - D:\autorun.ico -- [ CDFS ]
O32 - AutoRun File - [1999/06/07 22:03:30 | 000,000,133 | R--- | M] () - D:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - C:\WINDOWS\System32\appmgmts.dll File not found
NetSvcs: HidServ - C:\WINDOWS\System32\hidserv.dll File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: Wmi - C:\WINDOWS\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found

Drivers32: aux - C:\WINDOWS\System32\ctwdm32.dll (Creative Technology Ltd.)
Drivers32: midi - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midimapper - C:\WINDOWS\System32\midimap.dll (Microsoft Corporation)
Drivers32: mixer - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.imaadpcm - C:\WINDOWS\System32\imaadp32.acm (Microsoft Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.msadpcm - C:\WINDOWS\System32\msadp32.acm (Microsoft Corporation)
Drivers32: msacm.msaudio1 - C:\WINDOWS\System32\msaud32.acm (Microsoft Corporation)
Drivers32: msacm.msg711 - C:\WINDOWS\System32\msg711.acm (Microsoft Corporation)
Drivers32: msacm.msg723 - C:\WINDOWS\System32\msg723.acm (Microsoft Corporation)
Drivers32: msacm.msgsm610 - C:\WINDOWS\System32\msgsm32.acm (Microsoft Corporation)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)
Drivers32: vidc.I420 - C:\WINDOWS\System32\msh263.drv (Microsoft Corporation)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: vidc.iyuv - C:\WINDOWS\System32\iyuv_32.dll (Microsoft Corporation)
Drivers32: vidc.M261 - C:\WINDOWS\System32\msh261.drv (Microsoft Corporation)
Drivers32: vidc.M263 - C:\WINDOWS\System32\msh263.drv (Microsoft Corporation)
Drivers32: VIDC.MP42 - C:\WINDOWS\System32\mpg4c32.dll (Microsoft Corporation)
Drivers32: VIDC.MPG4 - C:\WINDOWS\System32\mpg4c32.dll (Microsoft Corporation)
Drivers32: vidc.mrle - C:\WINDOWS\System32\msrle32.dll (Microsoft Corporation)
Drivers32: vidc.msvc - C:\WINDOWS\System32\msvidc32.dll (Microsoft Corporation)
Drivers32: vidc.uyvy - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation)
Drivers32: vidc.yuy2 - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation)
Drivers32: vidc.yv12 - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)
Drivers32: vidc.yvu9 - C:\WINDOWS\System32\tsbyuv.dll (Microsoft Corporation)
Drivers32: vidc.yvyu - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation)
Drivers32: wave - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wavemapper - C:\WINDOWS\System32\msacm32.drv (Microsoft Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (16902109354000384)
September 4th, 2010, 09:56 PM
malmzakk

REATERESTOREPOINT
Restore point Set: OTL Restore Point (16902109354000384)

========== Files/Folders - Created Within 90 Days ==========

File not found -- C:\Documents and Settings\user\Desktop\CANMIH3J.
File not found -- C:\Documents and Settings\user\Desktop\CA30CNDX.
[2010/09/04 21:34:40 | 000,574,976 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\user\Desktop\OTL.exe
[2010/09/04 20:59:51 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2010/09/04 20:01:13 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2010/09/04 20:01:13 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2010/09/04 20:01:13 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2010/09/04 20:01:13 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2010/09/04 20:00:52 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2010/09/04 19:57:13 | 000,000,000 | ---D | C] -- C:\Qoobox
[2010/09/04 00:45:00 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\user\Recent
[2010/09/03 23:27:30 | 000,000,000 | ---D | C] -- C:\Program Files\Trend Micro
[2010/08/21 16:27:25 | 000,000,000 | ---D | C] -- C:\Documents and Settings\user\Desktop\6 new tunes
[2010/08/08 14:34:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\user\Desktop\new tunes
[2010/08/03 22:18:18 | 000,000,000 | ---D | C] -- C:\Documents and Settings\user\Application Data\Auslogics
[2010/08/03 22:18:03 | 000,000,000 | ---D | C] -- C:\Program Files\Auslogics
[2010/07/22 00:59:43 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\user\IECompatCache
[2010/07/10 18:15:34 | 000,038,848 | ---- | C] (ALWIL Software) -- C:\WINDOWS\avastSS.scr
[2010/06/11 20:57:19 | 000,724,992 | ---- | C] (Indigo Rose Corporation) -- C:\WINDOWS\iun6002.exe
[2010/06/11 20:57:15 | 000,000,000 | ---D | C] -- C:\Program Files\SpeedItUpFree
[2006/11/30 20:06:51 | 004,225,744 | ---- | C] (Lime Wire LLC) -- C:\Program Files\Limewire Lime Wire Pro 4.12.3.exe
[5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 90 Days ==========

File not found -- C:\Documents and Settings\user\Desktop\CANMIH3J.
File not found -- C:\Documents and Settings\user\Desktop\CA30CNDX.
[2010/09/04 21:34:43 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\user\Desktop\OTL.exe
[2010/09/04 21:21:39 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010/09/04 21:13:46 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini
[2010/09/04 21:00:02 | 000,000,327 | RHS- | M] () -- C:\boot.ini
[2010/09/04 20:54:29 | 003,836,753 | R--- | M] () -- C:\Documents and Settings\user\Desktop\ComboFix.exe
[2010/09/04 20:19:30 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2010/09/04 17:21:01 | 000,080,384 | ---- | M] () -- C:\Documents and Settings\user\Desktop\MBRCheck.exe
[2010/09/04 15:46:23 | 000,525,824 | ---- | M] () -- C:\Documents and Settings\user\Desktop\dds.scr
[2010/09/04 15:39:43 | 000,293,376 | ---- | M] () -- C:\Documents and Settings\user\Desktop\5usnnonf.exe
[2010/09/04 15:35:53 | 000,013,744 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/09/04 15:34:28 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/09/04 15:34:20 | 402,231,296 | -HS- | M] () -- C:\hiberfil.sys
[2010/09/04 15:32:38 | 008,388,608 | ---- | M] () -- C:\Documents and Settings\user\ntuser.dat
[2010/09/04 15:32:38 | 000,000,178 | -HS- | M] () -- C:\Documents and Settings\user\ntuser.ini
[2010/09/04 15:32:17 | 006,933,310 | -H-- | M] () -- C:\Documents and Settings\user\Local Settings\Application Data\IconCache.db
[2010/09/04 12:13:17 | 000,000,306 | ---- | M] () -- C:\Documents and Settings\user\Application Data\Microsoft\Internet Explorer\Quick Launch\Intellicast - Current Radar in United States.url
[2010/09/04 10:08:14 | 000,000,480 | ---- | M] () -- C:\Documents and Settings\user\Application Data\Microsoft\Internet Explorer\Quick Launch\All matching items for sale..url
[2010/09/04 10:03:22 | 000,000,242 | ---- | M] () -- C:\Documents and Settings\user\Application Data\Microsoft\Internet Explorer\Quick Launch\Hamilton, Ontario - Weather Forecast - The Weather Network.url
[2010/09/04 03:33:13 | 000,000,392 | ---- | M] () -- C:\Documents and Settings\user\Desktop\#-w-355594608-38.url
[2010/09/04 01:03:05 | 000,000,250 | ---- | M] () -- C:\Documents and Settings\user\Application Data\Microsoft\Internet Explorer\Quick Launch\Google.url
[2010/09/04 00:48:17 | 000,000,260 | ---- | M] () -- C:\Documents and Settings\user\Desktop\Virtual Dr Forums.url
[2010/09/03 23:27:46 | 000,002,451 | ---- | M] () -- C:\Documents and Settings\user\Desktop\HiJackThis.lnk
[2010/09/03 23:25:49 | 001,402,880 | ---- | M] () -- C:\Documents and Settings\user\Desktop\HiJackThis.msi
[2010/09/03 16:25:25 | 000,000,572 | ---- | M] () -- C:\Documents and Settings\user\Desktop\Genuine Original 35mm Floyd Rose Tremolo Sustain Block - eBay (item 280465058796 end time Sep-11-10 142657 PDT).url
[2010/09/02 19:19:55 | 000,000,174 | ---- | M] () -- C:\Documents and Settings\user\Application Data\Microsoft\Internet Explorer\Quick Launch\Home Page HTZ FM.url
[2010/09/01 18:21:27 | 000,000,220 | ---- | M] () -- C:\Documents and Settings\user\Application Data\Microsoft\Internet Explorer\Quick Launch\Kijiji Hamilton Classifieds Free Classified Ads for Hamilton.url
[2010/08/31 19:51:32 | 000,000,154 | ---- | M] () -- C:\Documents and Settings\user\Desktop\Dovytv.net - Free Live tv - Free online tv - Free online movies - Watch online movies - Watch Online tv.url
[2010/08/29 22:43:09 | 000,000,610 | ---- | M] () -- C:\Documents and Settings\user\Desktop\#-w-350605744-3.url
[2010/08/27 13:07:02 | 000,000,416 | ---- | M] () -- C:\Documents and Settings\user\Application Data\Microsoft\Internet Explorer\Quick Launch\Perform a Reverse Phone Number Lookup on WhitePages.ca.url
[2010/08/26 18:58:54 | 000,000,189 | ---- | M] () -- C:\Documents and Settings\user\Application Data\Microsoft\Internet Explorer\Quick Launch\YouTube - rockhead007's YouTube.url
[2010/08/25 13:09:59 | 000,000,404 | ---- | M] () -- C:\Documents and Settings\user\Application Data\Microsoft\Internet Explorer\Quick Launch\seymour duncan distortion, Musical Instruments, New items on eBay.com.url
[2010/08/24 03:06:25 | 000,000,554 | ---- | M] () -- C:\Documents and Settings\user\Desktop\TV-H on Justin.tv.url
[2010/08/23 22:17:01 | 000,041,221 | ---- | M] () -- C:\Documents and Settings\user\Desktop\00000%20t%20front%20horz2.jpg
[2010/08/23 10:54:48 | 000,001,729 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk
[2010/08/23 00:05:05 | 000,000,224 | ---- | M] () -- C:\Documents and Settings\user\Desktop\PW Rambunctious Charvel Model 6.url
[2010/08/22 02:23:19 | 000,000,374 | ---- | M] () -- C:\Documents and Settings\user\Desktop\hogans heroes on Justin.tv#-w-333649232#-w-333649232#-w-333649232.url
[2010/08/22 00:52:23 | 000,000,293 | ---- | M] () -- C:\Documents and Settings\user\Desktop\YouTube - By the Way - Theory of a Deadman (CMasonRock).url
[2010/08/18 21:36:16 | 000,000,204 | ---- | M] () -- C:\Documents and Settings\user\Application Data\Microsoft\Internet Explorer\Quick Launch\Guitar Wood FAQ - Wood Types & Tones.url
[2010/08/17 03:43:42 | 000,059,645 | ---- | M] () -- C:\Documents and Settings\user\Desktop\its_so_easy.gp3
[2010/08/14 01:31:49 | 000,000,463 | ---- | M] () -- C:\Documents and Settings\user\Application Data\Microsoft\Internet Explorer\Quick Launch\Sign In.url
[2010/08/13 13:07:38 | 000,000,314 | ---- | M] () -- C:\Documents and Settings\user\Application Data\Microsoft\Internet Explorer\Quick Launch\All matching items for sale. (2).url
[2010/08/12 18:49:45 | 000,000,506 | ---- | M] () -- C:\Documents and Settings\user\Desktop\HEMBRY hand carved Green Demons Flying V Deathbuckers - eBay (item 300452591842 end time Aug-10-10 180055 PDT).url
[2010/08/11 13:26:51 | 000,118,152 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010/08/11 13:00:05 | 000,501,780 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2010/08/11 13:00:05 | 000,441,502 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010/08/11 13:00:05 | 000,071,312 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010/08/11 01:40:29 | 000,000,534 | ---- | M] () -- C:\Documents and Settings\user\Desktop\DELUXE BLACK DIECAST GUITAR MACHINEHEADS white pearloid - eBay (item 190428797585 end time Sep-07-10 110905 PDT).url
[2010/08/07 14:25:04 | 033,050,742 | ---- | M] () -- C:\Documents and Settings\user\My Documents\Image.nrg
[2010/08/05 13:11:53 | 000,002,036 | ---- | M] () -- C:\Documents and Settings\user\Desktop\Download Confirmation (2).url
[2010/08/04 13:23:40 | 000,000,116 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2010/08/03 22:26:40 | 000,000,815 | ---- | M] () -- C:\Documents and Settings\user\Application Data\Microsoft\Internet Explorer\Quick Launch\Auslogics Disk Defrag.lnk
[2010/08/03 14:32:57 | 000,002,639 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
[2010/07/25 01:33:50 | 000,000,190 | ---- | M] () -- C:\Documents and Settings\user\Desktop\http--www.guitarprinting.com-index.html.url
[2010/07/24 22:35:25 | 000,000,176 | ---- | M] () -- C:\Documents and Settings\user\Desktop\Welcome to UglyDog.ca.url
[2010/07/02 18:40:46 | 000,001,598 | ---- | M] () -- C:\Documents and Settings\user\Application Data\Microsoft\Internet Explorer\Quick Launch\LimeWire 5.4.8.lnk
[2010/06/28 16:57:33 | 000,038,848 | ---- | M] (ALWIL Software) -- C:\WINDOWS\avastSS.scr
[2010/06/28 16:57:12 | 000,165,032 | ---- | M] (AVAST Software) -- C:\WINDOWS\System32\aswBoot.exe
[2010/06/28 16:37:52 | 000,046,672 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys
[2010/06/28 16:37:30 | 000,165,456 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswSP.sys
[2010/06/28 16:33:13 | 000,023,376 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys
[2010/06/28 16:32:45 | 000,100,176 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswmon2.sys
[2010/06/28 16:32:42 | 000,094,544 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswmon.sys
[2010/06/28 16:32:33 | 000,017,744 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2010/06/28 16:32:16 | 000,028,880 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aavmker4.sys
[2010/06/22 00:47:21 | 000,001,604 | ---- | M] () -- C:\Documents and Settings\user\Application Data\Microsoft\Internet Explorer\Quick Launch\SpeedItup Free.lnk
[2010/06/11 20:56:52 | 000,724,992 | ---- | M] (Indigo Rose Corporation) -- C:\WINDOWS\iun6002.exe
[2010/06/10 13:54:50 | 000,000,211 | ---- | M] () -- C:\Documents and Settings\user\Application Data\Microsoft\Internet Explorer\Quick Launch\KNAC.COM - The Loudest Dot Com on the Planet!.url
[5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/09/04 21:00:02 | 000,000,211 | ---- | C] () -- C:\Boot.bak
[2010/09/04 20:59:56 | 000,260,272 | RHS- | C] () -- C:\cmldr
[2010/09/04 20:01:13 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2010/09/04 20:01:13 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2010/09/04 20:01:13 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2010/09/04 20:01:13 | 000,077,312 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2010/09/04 20:01:13 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2010/09/04 19:55:59 | 003,836,753 | R--- | C] () -- C:\Documents and Settings\user\Desktop\ComboFix.exe
[2010/09/04 17:21:01 | 000,080,384 | ---- | C] () -- C:\Documents and Settings\user\Desktop\MBRCheck.exe
[2010/09/04 15:46:21 | 000,525,824 | ---- | C] () -- C:\Documents and Settings\user\Desktop\dds.scr
[2010/09/04 15:39:41 | 000,293,376 | ---- | C] () -- C:\Documents and Settings\user\Desktop\5usnnonf.exe
[2010/09/04 03:33:12 | 000,000,392 | ---- | C] () -- C:\Documents and Settings\user\Desktop\#-w-355594608-38.url
[2010/09/03 23:42:48 | 000,000,260 | ---- | C] () -- C:\Documents and Settings\user\Desktop\Virtual Dr Forums.url
[2010/09/03 23:27:32 | 000,002,451 | ---- | C] () -- C:\Documents and Settings\user\Desktop\HiJackThis.lnk
[2010/09/03 23:25:46 | 001,402,880 | ---- | C] () -- C:\Documents and Settings\user\Desktop\HiJackThis.msi
[2010/09/02 12:07:37 | 000,000,572 | ---- | C] () -- C:\Documents and Settings\user\Desktop\Genuine Original 35mm Floyd Rose Tremolo Sustain Block - eBay (item 280465058796 end time Sep-11-10 142657 PDT).url
[2010/08/31 19:51:32 | 000,000,154 | ---- | C] () -- C:\Documents and Settings\user\Desktop\Dovytv.net - Free Live tv - Free online tv - Free online movies - Watch online movies - Watch Online tv.url
[2010/08/29 22:43:09 | 000,000,610 | ---- | C] () -- C:\Documents and Settings\user\Desktop\#-w-350605744-3.url
[2010/08/24 03:06:25 | 000,000,554 | ---- | C] () -- C:\Documents and Settings\user\Desktop\TV-H on Justin.tv.url
[2010/08/23 22:17:27 | 000,041,221 | ---- | C] () -- C:\Documents and Settings\user\Desktop\00000%20t%20front%20horz2.jpg
[2010/08/23 10:54:45 | 000,001,729 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk
[2010/08/23 00:05:05 | 000,000,224 | ---- | C] () -- C:\Documents and Settings\user\Desktop\PW Rambunctious Charvel Model 6.url
[2010/08/22 02:23:18 | 000,000,374 | ---- | C] () -- C:\Documents and Settings\user\Desktop\hogans heroes on Justin.tv#-w-333649232#-w-333649232#-w-333649232.url
[2010/08/22 00:52:22 | 000,000,293 | ---- | C] () -- C:\Documents and Settings\user\Desktop\YouTube - By the Way - Theory of a Deadman (CMasonRock).url
[2010/08/17 03:43:40 | 000,059,645 | ---- | C] () -- C:\Documents and Settings\user\Desktop\its_so_easy.gp3
[2010/08/11 01:40:29 | 000,000,534 | ---- | C] () -- C:\Documents and Settings\user\Desktop\DELUXE BLACK DIECAST GUITAR MACHINEHEADS white pearloid - eBay (item 190428797585 end time Sep-07-10 110905 PDT).url
[2010/08/10 20:36:00 | 000,000,506 | ---- | C] () -- C:\Documents and Settings\user\Desktop\HEMBRY hand carved Green Demons Flying V Deathbuckers - eBay (item 300452591842 end time Aug-10-10 180055 PDT).url
[2010/08/05 13:11:52 | 000,002,036 | ---- | C] () -- C:\Documents and Settings\user\Desktop\Download Confirmation (2).url
[2010/08/03 22:26:40 | 000,000,815 | ---- | C] () -- C:\Documents and Settings\user\Application Data\Microsoft\Internet Explorer\Quick Launch\Auslogics Disk Defrag.lnk
[2010/07/30 20:42:02 | 008,388,608 | ---- | C] () -- C:\Documents and Settings\user\ntuser.dat
[2010/07/25 01:33:50 | 000,000,190 | ---- | C] () -- C:\Documents and Settings\user\Desktop\http--www.guitarprinting.com-index.html.url
[2010/07/24 22:35:25 | 000,000,176 | ---- | C] () -- C:\Documents and Settings\user\Desktop\Welcome to UglyDog.ca.url
[2010/07/19 12:21:25 | 000,000,306 | ---- | C] () -- C:\Documents and Settings\user\Application Data\Microsoft\Internet Explorer\Quick Launch\Intellicast - Current Radar in United States.url
[2010/07/02 18:40:46 | 000,001,598 | ---- | C] () -- C:\Documents and Settings\user\Application Data\Microsoft\Internet Explorer\Quick Launch\LimeWire 5.4.8.lnk
[2010/06/22 00:47:21 | 000,001,604 | ---- | C] () -- C:\Documents and Settings\user\Application Data\Microsoft\Internet Explorer\Quick Launch\SpeedItup Free.lnk
[2009/05/04 15:03:00 | 000,059,904 | ---- | C] () -- C:\WINDOWS\System32\zlib1.dll
[2009/05/04 14:53:28 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\libcurl.dll
[2009/03/18 01:16:44 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2008/12/11 21:56:21 | 000,162,304 | ---- | C] () -- C:\WINDOWS\System32\ztvunrar36.dll
[2008/12/11 21:56:21 | 000,153,088 | ---- | C] () -- C:\WINDOWS\System32\unrar3.dll
[2008/12/11 21:56:21 | 000,077,312 | ---- | C] () -- C:\WINDOWS\System32\ztvunace26.dll
[2008/12/11 21:56:21 | 000,075,264 | ---- | C] () -- C:\WINDOWS\System32\unacev2.dll
[2008/09/21 18:05:30 | 000,000,146 | ---- | C] () -- C:\WINDOWS\System32\MRT.INI
[2007/05/17 14:58:10 | 000,143,360 | ---- | C] () -- C:\WINDOWS\System32\libexpatw.dll
[2006/11/30 20:06:52 | 005,949,316 | ---- | C] () -- C:\Program Files\Red Hot Chilli Peppers- Tell Me Baby.mp3
[2006/11/17 22:56:16 | 000,374,272 | ---- | C] () -- C:\WINDOWS\System32\mss32.dll
[2006/10/27 08:26:56 | 000,069,632 | ---- | C] () -- C:\WINDOWS\System32\vuins32.dll
[2006/05/18 12:03:47 | 000,001,759 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2006/02/04 11:22:53 | 000,051,712 | ---- | C] () -- C:\Documents and Settings\user\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2006/01/06 16:08:59 | 000,001,365 | ---- | C] () -- C:\WINDOWS\stock.INI
[2006/01/06 12:34:58 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2005/12/26 18:38:17 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2005/12/24 13:21:27 | 000,000,127 | ---- | C] () -- C:\Documents and Settings\user\Local Settings\Application Data\fusioncache.dat
[2002/05/16 10:39:06 | 000,038,176 | ---- | C] () -- C:\WINDOWS\System32\drivers\SbcpHid.sys

========== LOP Check ==========

[2010/02/26 18:53:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Alwil Software
[2008/08/28 12:52:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\n7-89-o9-3r-4t-r9
[2009/07/02 01:12:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PC Drivers HeadQuarters
[2007/12/12 00:07:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PopCap
[2008/12/11 21:56:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Simply Super Software
[2009/03/06 00:15:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SpinTop Games
[2007/10/13 21:53:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\STOPzilla!
[2009/03/03 00:35:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2006/04/09 22:06:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Application Data\.BitTornado
[2005/12/26 23:12:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Application Data\.bittorrent
[2010/08/03 22:18:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Application Data\Auslogics
[2008/10/06 19:17:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2007/12/16 21:20:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Application Data\Eyeblaster
[2008/09/03 19:03:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Application Data\GameHouse
[2010/05/22 11:23:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Application Data\GetRightToGo
[2009/10/25 11:17:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Application Data\IObit
[2008/12/11 21:56:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Application Data\Simply Super Software
[2009/07/12 21:33:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Application Data\Thinstall
[2008/11/29 13:18:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Application Data\True Sword
September 4th, 2010, 09:57 PM
malmzakk

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2005/12/23 12:43:15 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT
[2005/12/23 18:17:38 | 000,000,211 | ---- | M] () -- C:\Boot.bak
[2010/09/04 21:00:02 | 000,000,327 | RHS- | M] () -- C:\boot.ini
[2004/08/03 23:00:00 | 000,260,272 | RHS- | M] () -- C:\cmldr
[2010/09/04 21:21:39 | 000,009,399 | ---- | M] () -- C:\ComboFix.txt
[2005/12/23 12:43:15 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
[2006/03/04 15:25:58 | 000,000,047 | ---- | M] () -- C:\direct.txt
[2010/09/04 15:34:20 | 402,231,296 | -HS- | M] () -- C:\hiberfil.sys
[2005/12/23 12:43:15 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2008/11/29 13:31:25 | 000,000,000 | ---- | M] () -- C:\log1.txt
[2008/11/29 13:31:25 | 000,000,000 | ---- | M] () -- C:\log2.txt
[2005/12/23 12:43:15 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2004/08/04 08:00:00 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
[2008/09/21 21:34:54 | 000,250,048 | RHS- | M] () -- C:\ntldr
[2010/09/04 15:34:09 | 603,979,776 | -HS- | M] () -- C:\pagefile.sys
[2006/02/10 22:50:44 | 000,000,000 | ---- | M] () -- C:\palsound.txt
[2008/08/18 09:34:28 | 000,000,008 | ---- | M] () -- C:\RPT23432
[2005/10/31 11:56:00 | 000,700,416 | ---- | M] (LimeWire) -- C:\StubInstaller.exe

< %systemroot%\system32\Spool\prtprocs\w32x86\*.dll >
[2008/07/06 08:06:10 | 000,089,088 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll

< %systemroot%\system32\*.wt >

< %systemroot%\system32\*.ruy >

< %systemroot%\Fonts\*.com >

< %systemroot%\Fonts\*.dll >

< %systemroot%\system32\spool\prtprocs\w32x86\*.tmp >

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[2009/03/08 04:31:44 | 000,348,160 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\dxtmsft.dll
[2009/03/08 04:31:38 | 000,216,064 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\dxtrans.dll
[2010/06/24 08:21:58 | 000,184,320 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\iepeers.dll
[5 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2005/12/23 07:16:56 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
[2005/12/23 07:16:56 | 000,634,880 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
[2005/12/23 07:16:56 | 000,868,352 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav

< %systemroot%\system32\user32.dll /md5 >
[2008/04/13 20:12:08 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=B26B135FF1B9F60C9388B4A7D16F600B -- C:\WINDOWS\system32\user32.dll
[5 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\system32\ws2_32.dll /md5 >
[2008/04/13 20:12:10 | 000,082,432 | ---- | M] (Microsoft Corporation) MD5=2CCC474EB85CEAA3E1FA1726580A3E5A -- C:\WINDOWS\system32\ws2_32.dll
[5 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\system32\ws2help.dll /md5 >
[2008/04/13 20:12:10 | 000,019,968 | ---- | M] (Microsoft Corporation) MD5=9789E95E1D88EEB4B922BF3EA7779C28 -- C:\WINDOWS\system32\ws2help.dll
[5 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-09-04 04:33:28

========== Alternate Data Streams ==========

@Alternate Data Stream - 219 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D31BE97C
@Alternate Data Stream - 116 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D1B5B4F1
< End of report >
September 4th, 2010, 09:57 PM
malmzakk

OTL Extras logfile created on: 9/4/2010 9:35:50 PM - Run 1
OTL by OldTimer - Version 3.2.11.0 Folder = C:\Documents and Settings\user\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

384.00 Mb Total Physical Memory | 55.00 Mb Available Physical Memory | 14.00% Memory free
923.00 Mb Paging File | 657.00 Mb Available in Paging File | 71.00% Paging File free
Paging file location(s): C:\pagefile.sys 576 1152 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 76.32 Gb Total Space | 48.18 Gb Free Space | 63.13% Space Free | Partition Type: NTFS
Drive D: | 697.74 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: USER-9612E78606
Current User Name: user
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Standard
Quick Scan

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office10\msohtmed.exe" %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"1723:TCP" = 1723:TCP:*:Enabled:@xpsp2res.dll,-22015
"1701:UDP" = 1701:UDP:*:Enabled:@xpsp2res.dll,-22016
"500:UDP" = 500:UDP:*:Enabled:@xpsp2res.dll,-22017

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
"1723:TCP" = 1723:TCP:*:Enabled:@xpsp2res.dll,-22015
"1701:UDP" = 1701:UDP:*:Enabled:@xpsp2res.dll,-22016
"500:UDP" = 500:UDP:*:Enabled:@xpsp2res.dll,-22017

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\LimeWire\LimeWire.exe" = C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire -- (Lime Wire, LLC)
"C:\Program Files\Windows Media Player\wmplayer.exe" = C:\Program Files\Windows Media Player\wmplayer.exe:*:Enabled:Windows Media Player -- (Microsoft Corporation)
"C:\Program Files\Java\jre6\bin\java.exe" = C:\Program Files\Java\jre6\bin\java.exe:*:Enabled:Java(TM) Platform SE binary -- (Sun Microsystems, Inc.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0BEDBD4E-2D34-47B5-9973-57E62B29307C}" = ATI Control Panel
"{0DFB3DE8-65B9-44FF-AA0A-3BECC5A2BFD1}" = Adobe Flash Player 10 Plugin
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java(TM) 6 Update 21
"{3248F0A8-6813-11D6-A77B-00B0D0150070}" = J2SE Runtime Environment 5.0 Update 7
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3EA9D975-BFDC-4E8E-B88B-0446FBC8CA66}" = ATI HydraVision
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{63569CE9-FA00-469C-AF5C-E5D4D93ACF91}" = Windows Genuine Advantage v1.3.0254.0
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{6877BB34-2631-46DA-AD62-3DE601E8D7BE}" = ATI Catalyst Control Center
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{90280409-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional with FrontPage
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{AC76BA86-7AD7-1033-7B44-A93000000001}" = Adobe Reader 9.3.4
"{AC76BA86-7AD7-5760-0000-900000000003}" = Japanese Fonts Support For Adobe Reader 9
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{DF6A13C0-77DF-41FE-BD05-6D5201EB0CE7}_is1" = Auslogics Disk Defrag
"{EFCE5837-FC21-11D6-9D24-00010240CE95}" = Java 2 Runtime Environment, SE v1.4.1_02
"{F8131A35-47FD-27AD-116D-0E79AF5DE5EE}" = Acrobat.com
"{FCE65C4E-B0E8-4FBD-AD16-EDCBE6CD591F}" = HighMAT Extension to Microsoft Windows XP CD Writing Wizard
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Photoshop 7.0" = Adobe Photoshop 7.0
"Advanced SystemCare 3_is1" = Advanced SystemCare 3
"All ATI Software" = ATI - Software Uninstall Utility
"ATI Display Driver" = ATI Display Driver
"avast5" = avast! Free Antivirus
"AVS Audio Editor_is1" = AVS Audio Editor version 4.2
"AVS Update Manager_is1" = AVS Update Manager 1.0
"AVS4YOU Software Navigator_is1" = AVS4YOU Software Navigator 1.3
"CCleaner" = CCleaner
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"EPSON Printer and Utilities" = EPSON Printer Software
"Guitar Pro 5_is1" = Guitar Pro 5.0
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie8" = Windows Internet Explorer 8
"Java Web Start" = Java Web Start
"Jetcast" = Jetcast 3.0.2
"LimeWire" = LimeWire 5.4.8
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Nero - Burning Rom!UninstallKey" = Nero OEM
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"ratDVD" = ratDVD 0.78.1444
"Renegade" = Command & Conquer Renegade
"SpeedItupFree4.01" = Speeditup Free 4.01
"Spybot - Search & Destroy_is1" = Spybot - Search & Destroy 1.4
"Tiberian Sun" = Command & Conquer Tiberian Sun
"Veetle TV" = Veetle TV 0.9.17
"VLC media player" = VideoLAN VLC media player 0.8.5
"VN_VUIns_Rhine_D-Link" = D-Link PCI Fast Ethernet Adapter
"Windows Live OneCare safety scanner" = Windows Live OneCare safety scanner
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinRAR archiver" = WinRAR archiver
"WMCSetup" = Windows Media Connect
"WOLAPI" = Westwood Shared Internet Components
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0 (Beta2)

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"jlGui 3.0" = jlGui 3.0
"Octoshape add-in for Adobe Flash Player" = Octoshape add-in for Adobe Flash Player

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 5/21/2010 9:02:11 PM | Computer Name = USER-9612E78606 | Source = Application Error | ID = 1000
Description = Faulting application msimn.exe, version 6.0.2900.5512, faulting module
unknown, version 0.0.0.0, fault address 0xc7fff8c4.

Error - 6/13/2010 3:57:52 PM | Computer Name = USER-9612E78606 | Source = Application Error | ID = 1000
Description = Faulting application speeditup.exe, version 4.90.0.1, faulting module
, version 5.1.2600.5781, fault address 0x00012afb.

Error - 6/20/2010 9:16:51 PM | Computer Name = USER-9612E78606 | Source = Application Error | ID = 1000
Description = Faulting application wmplayer.exe, version 10.0.0.3802, faulting module
unknown, version 0.0.0.0, fault address 0x036545c4.

Error - 7/1/2010 5:28:27 PM | Computer Name = USER-9612E78606 | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 8.0.6001.18702, faulting
module wininet.dll, version 8.0.6001.18923, fault address 0x00016ad1.

Error - 8/7/2010 11:28:29 AM | Computer Name = USER-9612E78606 | Source = Application Error | ID = 1000
Description = Faulting application limewire.exe, version 1.0.0.3, faulting module
torrent-wrapper.dll, version 0.0.0.0, fault address 0x000f0a17.

Error - 8/7/2010 11:28:09 PM | Computer Name = USER-9612E78606 | Source = .NET Runtime | ID = 1023
Description = .NET Runtime version 2.0.50727.3603 - Fatal Execution Engine Error
(7A09795E) (80131506)

Error - 8/8/2010 12:47:36 PM | Computer Name = USER-9612E78606 | Source = Application Error | ID = 1000
Description = Faulting application limewire.exe, version 1.0.0.3, faulting module
torrent-wrapper.dll, version 0.0.0.0, fault address 0x000f0a17.

Error - 8/19/2010 12:52:37 AM | Computer Name = USER-9612E78606 | Source = Application Error | ID = 1000
Description = Faulting application limewire.exe, version 1.0.0.3, faulting module
torrent-wrapper.dll, version 0.0.0.0, fault address 0x000f0a17.

Error - 9/1/2010 7:41:52 PM | Computer Name = USER-9612E78606 | Source = Application Error | ID = 1000
Description = Faulting application avsaudioeditor.exe, version 4.2.1.107, faulting
module ole32.dll, version 5.1.2600.5512, fault address 0x0002dca0.

Error - 9/1/2010 7:47:26 PM | Computer Name = USER-9612E78606 | Source = Application Error | ID = 1000
Description = Faulting application drwtsn32.exe, version 5.1.2600.0, faulting module
dbghelp.dll, version 5.1.2600.5512, fault address 0x0001295d.

[ System Events ]
Error - 9/4/2010 3:16:45 PM | Computer Name = USER-9612E78606 | Source = atapi | ID = 262153
Description = The device, \Device\Ide\IdePort1, did not respond within the timeout
period.

Error - 9/4/2010 3:26:27 PM | Computer Name = USER-9612E78606 | Source = atapi | ID = 262153
Description = The device, \Device\Ide\IdePort1, did not respond within the timeout
period.

Error - 9/4/2010 7:20:38 PM | Computer Name = USER-9612E78606 | Source = atapi | ID = 262153
Description = The device, \Device\Ide\IdePort1, did not respond within the timeout
period.

Error - 9/4/2010 7:40:20 PM | Computer Name = USER-9612E78606 | Source = atapi | ID = 262153
Description = The device, \Device\Ide\IdePort1, did not respond within the timeout
period.

Error - 9/4/2010 7:54:13 PM | Computer Name = USER-9612E78606 | Source = atapi | ID = 262153
Description = The device, \Device\Ide\IdePort1, did not respond within the timeout
period.

Error - 9/4/2010 8:02:15 PM | Computer Name = USER-9612E78606 | Source = atapi | ID = 262153
Description = The device, \Device\Ide\IdePort1, did not respond within the timeout
period.

Error - 9/4/2010 8:35:25 PM | Computer Name = USER-9612E78606 | Source = atapi | ID = 262153
Description = The device, \Device\Ide\IdePort1, did not respond within the timeout
period.

Error - 9/4/2010 8:51:17 PM | Computer Name = USER-9612E78606 | Source = atapi | ID = 262153
Description = The device, \Device\Ide\IdePort1, did not respond within the timeout
period.

Error - 9/4/2010 9:19:22 PM | Computer Name = USER-9612E78606 | Source = atapi | ID = 262153
Description = The device, \Device\Ide\IdePort1, did not respond within the timeout
period.

Error - 9/4/2010 9:40:25 PM | Computer Name = USER-9612E78606 | Source = atapi | ID = 262153
Description = The device, \Device\Ide\IdePort1, did not respond within the timeout
period.

< End of report >
September 4th, 2010, 10:02 PM
malmzakk

in answer to your question

computer seems to be fine.....see what happens in the morning.....thank you in advance for all your help. Malmzakk
September 5th, 2010, 12:44 AM
Broni
You have very little of RAM:

Quote:

384.00 Mb Total Physical Memory

With XP, you'd like to have at least 512MB of RAM (1GB ideally).

======================================================

Run OTL
- Under the Custom Scans/Fixes box at the bottom, paste in the following
  
  Code:
  
  :OTL O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found. O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\control panel present O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery present O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\restrictions present O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\control panel present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 1 O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} http://download.divx.com/player/DivXBrowserPlugin.cab (Reg Error: Key error.) O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get.../ultrashim.cab (Reg Error: Value error.) O16 - DPF: {CAFEEFAC-0015-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jin...ndows-i586.cab (Reg Error: Key error.) O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) [5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] File not found -- C:\Documents and Settings\user\Desktop\CANMIH3J. File not found -- C:\Documents and Settings\user\Desktop\CA30CNDX. [2007/10/13 21:53:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\STOPzilla! @Alternate Data Stream - 219 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D31BE97C @Alternate Data Stream - 116 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D1B5B4F1 :Services :Reg :Files :Commands [purity] [emptytemp] [emptyflash] [Reboot]
- Then click the Run Fix button at the top
- Let the program run unhindered, reboot the PC when it is done
- You will get a log that shows the results of the fix. Please post it.
=====================================================

Last scans...

Download Security Check from HERE, and save it to your Desktop.

* Double-click SecurityCheck.exe
* Follow the onscreen instructions inside of the black box.
* A Notepad document should open automatically called checkup.txt; please post the contents of that document.

=======================================================

Download Temp File Cleaner (TFC)
Double click on TFC.exe to run the program.
Click on Start button to begin cleaning process.
TFC will close all running programs, and it may ask you to restart computer.

========================================================

Disable your antivirus program.
Go to Kaspersky website and perform an online antivirus scan.
- Disable your active antivirus program.
- Read through the requirements and privacy statement and click on Accept button.
- It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
- When the downloads have finished, click on Settings.
- Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
  - Spyware, Adware, Dialers, and other potentially dangerous programs
  - Archives
  - Mail databases
- Click on My Computer under Scan.
- Once the scan is complete, it will display the results. Click on View Scan Report.
- You will see a list of infected items there. Click on Save Report As....
- Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button. Then post it here.
September 5th, 2010, 08:15 PM
malmzakk

Yeah I know I have very little ram,Bought it way back in 2001....but only really use it for music and the odd program...has served me well till now.I booted up this morning and couldn't do anything with it for 40 minutes.It's as if something is updating but I'm only running Avast and if it updates it only takes a min or so.And I don't think anything else would update for 40 min would it??
September 5th, 2010, 08:18 PM
Broni

You may have some other issues (hardware?), but before I send you to another forum, I have to make sure, your computer is 100% clean.
So, go on....
September 5th, 2010, 08:46 PM
malmzakk

All processes killed
========== OTL ==========
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\control panel\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Infodelivery\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\restrictions\ deleted successfully.
Registry key HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\control panel\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoResolveSearch deleted successfully.
Starting removal of ActiveX control {67DABFBF-D0AB-41FA-9C46-CC0F21721616}
C:\WINDOWS\Downloaded Program Files\DivXPlugin.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{67DABFBF-D0AB-41FA-9C46-CC0F21721616}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{67DABFBF-D0AB-41FA-9C46-CC0F21721616}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{67DABFBF-D0AB-41FA-9C46-CC0F21721616}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{67DABFBF-D0AB-41FA-9C46-CC0F21721616}\ not found.
Starting removal of ActiveX control {8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
C:\WINDOWS\Downloaded Program Files\erma.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0015-0000-0007-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBA}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0007-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
C:\WINDOWS\Downloaded Program Files\gp.inf not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
C:\WINDOWS\System32\CONFIG.TMP deleted successfully.
C:\WINDOWS\System32\SET10.tmp deleted successfully.
C:\WINDOWS\System32\SET26.tmp deleted successfully.
C:\WINDOWS\System32\SET88.tmp deleted successfully.
C:\WINDOWS\System32\SET94.tmp deleted successfully.
C:\WINDOWS\002828_.tmp deleted successfully.
C:\WINDOWS\msdownld.tmp folder deleted successfully.
C:\WINDOWS\SET3.tmp deleted successfully.
C:\WINDOWS\SET4.tmp deleted successfully.
C:\WINDOWS\SET8.tmp deleted successfully.
C:\Documents and Settings\All Users\Application Data\STOPzilla!\Quarantine folder moved successfully.
C:\Documents and Settings\All Users\Application Data\STOPzilla! folder moved successfully.
ADS C:\Documents and Settings\All Users\Application Data\TEMP:D31BE97C deleted successfully.
ADS C:\Documents and Settings\All Users\Application Data\TEMP:D1B5B4F1 deleted successfully.
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 169415 bytes
->Flash cache emptied: 41620 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes

User: user
->Temp folder emptied: 84654 bytes
->Temporary Internet Files folder emptied: 134302768 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 113802 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 664 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 12707318 bytes

Total Files Cleaned = 141.00 mb

[EMPTYFLASH]

User: All Users

User: Default User
->Flash cache emptied: 0 bytes

User: LocalService

User: NetworkService

User: user
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb

OTL by OldTimer - Version 3.2.11.0 log created on 09052010_201725

Files\Folders moved on Reboot...
File\Folder C:\Documents and Settings\user\Local Settings\Temp\~DFF29E.tmp not found!
File\Folder C:\Documents and Settings\user\Local Settings\Temp\~DFF2CD.tmp not found!
File\Folder C:\Documents and Settings\user\Local Settings\Temp\~DFF3A0.tmp not found!
File\Folder C:\Documents and Settings\user\Local Settings\Temp\~DFF3C9.tmp not found!
File\Folder C:\Documents and Settings\user\Local Settings\Temp\~DFF50D.tmp not found!
File\Folder C:\Documents and Settings\user\Local Settings\Temp\~DFF51F.tmp not found!
C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\HPRZA4NA\iepngfix[1].htc moved successfully.
C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\HPRZA4NA\showthread[5].htm moved successfully.
C:\Documents and Settings\user\Local Settings\Temporary Internet Files\AntiPhishing\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat moved successfully.
File move failed. C:\WINDOWS\temp\_avast5_\Webshlock.txt scheduled to be moved on reboot.

Registry entries deleted on Reboot...
September 5th, 2010, 08:50 PM
malmzakk

avast won't let me load Security Check ....says there are viruses in the program that will harm my computer.
September 5th, 2010, 09:19 PM
Broni

Disable Avast and download the file.
September 5th, 2010, 09:46 PM
malmzakk

running Kaspersky now
September 5th, 2010, 09:49 PM
Broni

You still owe me Security Check log :)
September 5th, 2010, 09:53 PM
malmzakk

I thought you would say that...lol
September 5th, 2010, 09:55 PM
Broni

I don't forget....LOL
September 6th, 2010, 12:22 AM
malmzakk

the Kapersky takes a long time to run ....I will run it later...I need my pc for awhile....but I did run it for a bit and it found 4 Eexploit.Java.Byteverify....
September 6th, 2010, 12:24 AM
Broni

I'll be around tomorrow morning...
September 6th, 2010, 08:05 PM
malmzakk

Hi Broni

My friend and I were talking an she asked me what was installed on my machine since this started happening and I told her Adobe and this speed up thing a ma bobber.So we turned off Adobe updater and got rid of the thing a ma bobber and knock on wood it booted up this morning and a this afternoon with no problems.So if you can keep the thread going for a bit I will get back to you in a few days and give you an update.Until then I really appreciate your help and patience in this matter....talk soon.This site rocks!!

Malmzakk
September 6th, 2010, 08:24 PM
Broni

Not a problem :)
September 15th, 2010, 02:44 PM
malmzakk

Hi Broni

Since we did what we did my outlook express won't check mail when I open it and when I want to send it goes into my outbox first and sits there till I tell it to send?...what happen?...lol.Other than that all is good.

thamx,Malm
September 15th, 2010, 08:12 PM
Broni

I'd like to see SecurityCheck and Kaspersky's logs first.