PCTech Forums

PC SPECS:
MICROSOFT WINDOWS XP
INTEL{R}CELERON{R} M
processor 900MHz
630 MHz,0.99 GB of RAM
PHYSICAL ADRESS EXTENSION
sorry if there is something wrong about the specs part i am just worried about how the pc is turning out lately and i use this pc for my research and etc.. can anyone help me with this... what is the first ste???and btw I use Mcafee,Spybot SD,MalwareBytes and an unkown REMOVEit PRO(TRIAL)... and if someone replies to this post will there be a notice to my email ad or would i have to check in here daily??? ill just have to put my email add in here for safe measure.. im not worried that there would be spammers here anyway.......

plz contact me in case if the notification is to this website only... and sorry for the grammar btw..

____________________
edgondoy@yahoo.com




and just now btw i got this on-access scanner log (Mcafee)
12/3/2010 7:08:22 PM Would be blocked by Access Protection rule (rule is currently not enforced) ICS-0F2F811A446\Administrator C:\WINDOWS\explorer.exe C:\Documents and Settings\Administrator\Local Settings\Temp\~nsu.tmp\Au_.exe Common Standard Protection:Prevent common programs from running files from the Temp folder Action blocked : Execute
12/3/2010 7:09:39 PM Would be blocked by Access Protection rule (rule is currently not enforced) ICS-0F2F811A446\Administrator C:\WINDOWS\explorer.exe C:\Documents and Settings\Administrator\Local Settings\Temp\~nsu.tmp\Au_.exe Common Standard Protection:Prevent common programs from running files from the Temp folder Action blocked : Execute
12/3/2010 8:50:57 PM Would be blocked by Access Protection rule (rule is currently not enforced) ICS-0F2F811A446\Administrator C:\WINDOWS\Explorer.EXE C:\Documents and Settings\Administrator\Local Settings\Temp\is-9GSL7.tmp\mbam-setup-1.46.tmp Common Standard Protection:Prevent common programs from running files from the Temp folder Action blocked : Execute
12/3/2010 8:54:57 PM Would be blocked by Access Protection rule (rule is currently not enforced) ICS-0F2F811A446\Administrator C:\WINDOWS\Explorer.EXE C:\Documents and Settings\Administrator\Local Settings\Temp\is-9GSL7.tmp\mbam-setup-1.46.tmp Common Standard Protection:Prevent common programs from running files from the Temp folder Action blocked : Execute
12/3/2010 8:59:27 PM Would be blocked by Access Protection rule (rule is currently not enforced) ICS-0F2F811A446\Administrator C:\WINDOWS\Explorer.EXE C:\Documents and Settings\Administrator\Local Settings\Temp\is-SRJEB.tmp\spybotsd162.tmp Common Standard Protection:Prevent common programs from running files from the Temp folder Action blocked : Execute
12/3/2010 9:01:15 PM Would be blocked by Access Protection rule (rule is currently not enforced) ICS-0F2F811A446\Administrator C:\WINDOWS\Explorer.EXE C:\Documents and Settings\Administrator\Local Settings\Temp\is-MPPGK.tmp\spybotsd162.tmp Common Standard Protection:Prevent common programs from running files from the Temp folder Action blocked : Execute
12/3/2010 9:02:51 PM Would be blocked by Access Protection rule (rule is currently not enforced) ICS-0F2F811A446\Administrator C:\WINDOWS\Explorer.EXE C:\Documents and Settings\Administrator\Local Settings\Temp\is-417GL.tmp\mbam-setup.tmp Common Standard Protection:Prevent common programs from running files from the Temp folder Action blocked : Execute
12/3/2010 9:03:07 PM Would be blocked by Access Protection rule (rule is currently not enforced) ICS-0F2F811A446\Administrator C:\WINDOWS\Explorer.EXE C:\Documents and Settings\Administrator\Local Settings\Temp\is-417GL.tmp\mbam-setup.tmp Common Standard Protection:Prevent common programs from running files from the Temp folder Action blocked : Execute
12/3/2010 9:11:33 PM Would be blocked by Access Protection rule (rule is currently not enforced) ICS-0F2F811A446\Administrator C:\WINDOWS\Explorer.EXE C:\Documents and Settings\Administrator\Local Settings\Temp\is-417GL.tmp\mbam-setup.tmp Common Standard Protection:Prevent common programs from running files from the Temp folder Action blocked : Execute
12/3/2010 9:15:20 PM Would be blocked by Access Protection rule (rule is currently not enforced) ICS-0F2F811A446\Administrator C:\WINDOWS\Explorer.EXE C:\Documents and Settings\Administrator\Local Settings\Temp\is-TBL2I.tmp\advcheck165.tmp Common Standard Protection:Prevent common programs from running files from the Temp folder Action blocked : Execute
12/3/2010 9:15:21 PM Would be blocked by Access Protection rule (rule is currently not enforced) ICS-0F2F811A446\Administrator C:\WINDOWS\Explorer.EXE C:\Documents and Settings\Administrator\Local Settings\Temp\is-PIR1Q.tmp\teatimer166.tmp Common Standard Protection:Prevent common programs from running files from the Temp folder Action blocked : Execute
12/3/2010 11:39:21 PM Would be blocked by Access Protection rule (rule is currently not enforced) ICS-0F2F811A446\Administrator C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\ZO2ZSYCQ\IE8-WindowsXP-x86-ENU[1].exe Common Standard Protection:Prevent common programs from running files from the Temp folder Action blocked : Execute
12/4/2010 12:41:38 AM Would be blocked by Access Protection rule (rule is currently not enforced) ICS-0F2F811A446\Administrator C:\WINDOWS\Explorer.EXE C:\Documents and Settings\Administrator\Local Settings\Temp\7zS2.tmp\setup.exe Common Standard Protection:Prevent common programs from running files from the Temp folder Action blocked : Execute
12/4/2010 12:41:44 AM Would be blocked by Access Protection rule (rule is currently not enforced) ICS-0F2F811A446\Administrator C:\WINDOWS\Explorer.EXE C:\Documents and Settings\Administrator\Local Settings\Temp\7zS2.tmp\setup.exe Common Standard Protection:Prevent common programs from running files from the Temp folder Action blocked : Execute
12/4/2010 12:42:28 AM Would be blocked by Access Protection rule (rule is currently not enforced) ICS-0F2F811A446\Administrator C:\WINDOWS\Explorer.EXE C:\Documents and Settings\Administrator\Local Settings\Temp\7zS2.tmp\setup.exe Common Standard Protection:Prevent common programs from running files from the Temp folder Action blocked : Execute
12/4/2010 12:42:34 AM Would be blocked by Access Protection rule (rule is currently not enforced) ICS-0F2F811A446\Administrator C:\WINDOWS\Explorer.EXE C:\Documents and Settings\Administrator\Local Settings\Temp\7zS2.tmp\setup.exe Common Standard Protection:Prevent common programs from running files from the Temp folder Action blocked : Execute
12/4/2010 12:42:45 AM Would be blocked by Access Protection rule (rule is currently not enforced) ICS-0F2F811A446\Administrator C:\WINDOWS\Explorer.EXE C:\Documents and Settings\Administrator\Local Settings\Temp\7zS2.tmp\setup.exe Common Standard Protection:Prevent common programs from running files from the Temp folder Action blocked : Execute
12/4/2010 12:42:54 AM Would be blocked by Access Protection rule (rule is currently not enforced) ICS-0F2F811A446\Administrator C:\WINDOWS\Explorer.EXE C:\Documents and Settings\Administrator\Local Settings\Temp\7zS2.tmp\setup.exe Common Standard Protection:Prevent common programs from running files from the Temp folder Action blocked : Execute
12/4/2010 12:43:05 AM Would be blocked by Access Protection rule (rule is currently not enforced) ICS-0F2F811A446\Administrator C:\WINDOWS\Explorer.EXE C:\Documents and Settings\Administrator\Local Settings\Temp\7zS2.tmp\setup.exe Common Standard Protection:Prevent common programs from running files from the Temp folder Action blocked : Execute
12/21/2010 7:07:30 PM Would be blocked by Access Protection rule (rule is currently not enforced) ICS-0F2F811A446\Administrator C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Administrator\Local Settings\Temp\ICD1.tmp\ESETSmartInstaller.exe Common Standard Protection:Prevent common programs from running files from the Temp folder Action blocked : Execute
12/22/2010 3:56:12 PM Would be blocked by Access Protection rule (rule is currently not enforced) ICS-0F2F811A446\Administrator C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\Downloaded Program Files\CONFLICT.1\FP_AX_CAB_INSTALLER.exe Common Maximum Protection:Prevent launching of files from the Downloaded Program Files folder Action blocked : Execute
12/23/2010 5:35:32 PM Would be blocked by Access Protection rule (rule is currently not enforced) ICS-0F2F811A446\Administrator G:\Program\TuneUp\ProcessManager.exe G:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate
12/25/2010 10:15:43 PM Would be blocked by Access Protection rule (rule is currently not enforced) ICS-0F2F811A446\Administrator C:\WINDOWS\Explorer.EXE C:\Documents and Settings\Administrator\Local Settings\Temp\is-SFPP7.tmp\mbam-setup.tmp Common Standard Protection:Prevent common programs from running files from the Temp folder Action blocked : Execute
12/25/2010 10:15:48 PM Would be blocked by Access Protection rule (rule is currently not enforced) ICS-0F2F811A446\Administrator C:\WINDOWS\Explorer.EXE C:\Documents and Settings\Administrator\Local Settings\Temp\is-SFPP7.tmp\mbam-setup.tmp Common Standard Protection:Prevent common programs from running files from the Temp folder Action blocked : Execute
1/2/2011 4:46:52 PM Would be blocked by Access Protection rule (rule is currently not enforced) ICS-0F2F811A446\Administrator C:\WINDOWS\Explorer.EXE C:\Documents and Settings\Administrator\Local Settings\Temp\dw.log Common Standard Protection:Prevent common programs from running files from the Temp folder Action blocked : Execute
1/2/2011 4:49:25 PM Would be blocked by Access Protection rule (rule is currently not enforced) ICS-0F2F811A446\Administrator C:\WINDOWS\Explorer.EXE C:\WINDOWS\Temp\coinlog.log Common Standard Protection:Prevent common programs from running files from the Temp folder Action blocked : Execute
1/2/2011 4:49:36 PM Would be blocked by Access Protection rule (rule is currently not enforced) ICS-0F2F811A446\Administrator C:\WINDOWS\Explorer.EXE C:\WINDOWS\Temp\Perflib_Perfdata_148.dat Common Standard Protection:Prevent common programs from running files from the Temp folder Action blocked : Execute
1/2/2011 4:49:44 PM Would be blocked by Access Protection rule (rule is currently not enforced) ICS-0F2F811A446\Administrator C:\WINDOWS\Explorer.EXE C:\WINDOWS\Temp\WFV2.tmp Common Standard Protection:Prevent common programs from running files from the Temp folder Action blocked : Execute
1/2/2011 4:49:49 PM Would be blocked by Access Protection rule (rule is currently not enforced) ICS-0F2F811A446\Administrator C:\WINDOWS\Explorer.EXE C:\WINDOWS\Temp\WFV10.tmp Common Standard Protection:Prevent common programs from running files from the Temp folder Action blocked : Execute
1/2/2011 4:50:03 PM Would be blocked by Access Protection rule (rule is currently not enforced) ICS-0F2F811A446\Administrator C:\WINDOWS\Explorer.EXE C:\WINDOWS\Temp\WFV16.tmp Common Standard Protection:Prevent common programs from running files from the Temp folder Action blocked : Execute
1/2/2011 4:53:15 PM Would be blocked by Access Protection rule (rule is currently not enforced) ICS-0F2F811A446\Administrator G:\Program\TuneUp\ProcessManager.exe G:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe Common Standard Protection:Prevent termination of McAfee processes Action blocked : Terminate
1/3/2011 9:02:56 PM Would be blocked by Access Protection rule (rule is currently not enforced) ICS-0F2F811A446\Administrator C:\WINDOWS\Explorer.EXE C:\WINDOWS\Temp\Perflib_Perfdata_148.dat Common Standard Protection:Prevent common programs from running files from the Temp folder Action blocked : Execute
1/3/2011 9:03:05 PM Would be blocked by Access Protection rule (rule is currently not enforced) ICS-0F2F811A446\Administrator C:\WINDOWS\Explorer.EXE C:\WINDOWS\Temp\coinlog.log Common Standard Protection:Prevent common programs from running files from the Temp folder Action blocked : Execute
1/3/2011 9:03:14 PM Would be blocked by Access Protection rule (rule is currently not enforced) ICS-0F2F811A446\Administrator C:\WINDOWS\Explorer.EXE C:\WINDOWS\Temp\WFV2.tmp Common Standard Protection:Prevent common programs from running files from the Temp folder Action blocked : Execute
1/3/2011 9:03:23 PM Would be blocked by Access Protection rule (rule is currently not enforced) ICS-0F2F811A446\Administrator C:\WINDOWS\Explorer.EXE C:\WINDOWS\Temp\WFV10.tmp Common Standard Protection:Prevent common programs from running files from the Temp folder Action blocked : Execute
1/3/2011 9:03:27 PM Would be blocked by Access Protection rule (rule is currently not enforced) ICS-0F2F811A446\Administrator C:\WINDOWS\Explorer.EXE C:\WINDOWS\Temp\WFV16.tmp Common Standard Protection:Prevent common programs from running files from the Temp folder Action blocked : Execute
1/3/2011 9:03:31 PM Would be blocked by Access Protection rule (rule is currently not enforced) ICS-0F2F811A446\Administrator C:\WINDOWS\Explorer.EXE C:\WINDOWS\Temp\WFV17.tmp Common Standard Protection:Prevent common programs from running files from the Temp folder Action blocked : Execute
1/3/2011 9:03:36 PM Would be blocked by Access Protection rule (rule is currently not enforced) ICS-0F2F811A446\Administrator C:\WINDOWS\Explorer.EXE C:\WINDOWS\Temp\WFVA.tmp Common Standard Protection:Prevent common programs from running files from the Temp folder Action blocked : Execute
1/3/2011 9:03:39 PM Would be blocked by Access Protection rule (rule is currently not enforced) ICS-0F2F811A446\Administrator C:\WINDOWS\Explorer.EXE C:\WINDOWS\Temp\WFVB.tmp Common Standard Protection:Prevent common programs from running files from the Temp folder Action blocked : Execute
1/3/2011 9:03:43 PM Would be blocked by Access Protection rule (rule is currently not enforced) ICS-0F2F811A446\Administrator C:\WINDOWS\Explorer.EXE C:\WINDOWS\Temp\WFVC.tmp Common Standard Protection:Prevent common programs from running files from the Temp folder Action blocked : Execute
1/3/2011 9:04:27 PM Would be blocked by Access Protection rule (rule is currently not enforced) ICS-0F2F811A446\Administrator C:\WINDOWS\Explorer.EXE C:\WINDOWS\Temp\coinlog.log Common Standard Protection:Prevent common programs from running files from the Temp folder Action blocked : Execute
1/3/2011 9:04:36 PM Would be blocked by Access Protection rule (rule is currently not enforced) ICS-0F2F811A446\Administrator C:\WINDOWS\Explorer.EXE C:\WINDOWS\Temp\Perflib_Perfdata_148.dat Common Standard Protection:Prevent common programs from running files from the Temp folder Action blocked : Execute
1/3/2011 9:13:39 PM Would be blocked by Access Protection rule (rule is currently not enforced) ICS-0F2F811A446\Administrator C:\WINDOWS\Explorer.EXE C:\Documents and Settings\Administrator\Local Settings\Temp\901109.cvr Common Standard Protection:Prevent common programs from running files from the Temp folder Action blocked : Execute
1/3/2011 10:51:24 PM Would be blocked by Access Protection rule (rule is currently not enforced) ICS-0F2F811A446\Administrator C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\76WBIWSX\HousecallLauncher[1].exe Common Standard Protection:Prevent common programs from running files from the Temp folder Action blocked : Execute
1/3/2011 10:52:03 PM Would be blocked by Access Protection rule (rule is currently not enforced) ICS-0F2F811A446\Administrator C:\WINDOWS\Explorer.EXE C:\Documents and Settings\Administrator\Local Settings\Temp\7zS4.tmp\setup.exe Common Standard Protection:Prevent common programs from running files from the Temp folder Action blocked : Execute
1/3/2011 10:53:47 PM Would be blocked by Access Protection rule (rule is currently not enforced) ICS-0F2F811A446\Administrator C:\WINDOWS\Explorer.EXE C:\Documents and Settings\Administrator\Local Settings\Temp\7zS4.tmp\setup.exe Common Standard Protection:Prevent common programs from running files from the Temp folder Action blocked : Execute
1/3/2011 11:07:28 PM Would be blocked by Access Protection rule (rule is currently not enforced) ICS-0F2F811A446\Administrator C:\WINDOWS\Explorer.EXE C:\Documents and Settings\Administrator\Local Settings\Temp\HouseCall\housecall.bin Common Standard Protection:Prevent common programs from running files from the Temp folder Action blocked : Execute
1/3/2011 11:08:02 PM Would be blocked by Access Protection rule (rule is currently not enforced) ICS-0F2F811A446\Administrator C:\WINDOWS\Explorer.EXE C:\Documents and Settings\Administrator\Local Settings\Temp\HouseCall\housecall.bin Common Standard Protection:Prevent common programs from running files from the Temp folder Action blocked : Execute

i read the best software thread and tried to use housecall.. if you feel this is too early to post a log pls fell free to say it to me bcz ill definitely edit it as long as it fixes this freaking stressing issue....

edgondoy,

You defiantly have at least 2 infections that are trying to run with one set to replicate itself if removed.

Download to your desktop.
Double click on the icon to run it. Make sure all other windows are closed to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Under the Standard Registry box change it to All.
Check the boxes beside LOP Check and Purity Check.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.

OTL.txt

OTL logfile created on: 1/4/2011 6:48:39 PM - Run 1
OTL by OldTimer - Version 3.2.20.1 Folder = C:\Documents and Settings\Administrator\Desktop
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,015.00 Mb Total Physical Memory | 620.00 Mb Available Physical Memory | 61.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 89.00% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 3.72 Gb Total Space | 0.27 Gb Free Space | 7.26% Space Free | Partition Type: NTFS
Drive G: | 111.78 Gb Total Space | 89.76 Gb Free Space | 80.30% Space Free | Partition Type: NTFS

Computer Name: ICS-0F2F811A446 | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Administrator\Desktop\OTL.exe (OldTimer Tools)
PRC - G:\Program Files\bin\jqs.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - G:\Program Files\McAfee\VirusScan Enterprise\shstat.exe (McAfee, Inc.)
PRC - G:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe (McAfee, Inc.)
PRC - G:\Program Files\McAfee\Common Framework\Mctray.exe (McAfee, Inc.)
PRC - G:\Program Files\McAfee\Common Framework\naPrdMgr.exe (McAfee, Inc.)
PRC - G:\Program Files\McAfee\Common Framework\UdaterUI.exe (McAfee, Inc.)
PRC - G:\Program Files\McAfee\Common Framework\FrameworkService.exe (McAfee, Inc.)
PRC - G:\Program\Office2007\Office12\WINWORD.EXE (Microsoft Corporation)


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Administrator\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcr80.dll (Microsoft Corporation)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_473666fd\ATL80.dll (Microsoft Corporation)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll (Microsoft Corporation)
MOD - G:\Program\Office2007\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
MOD - G:\Program\Office2007\Office12\GrooveUtil.dll (Microsoft Corporation)
MOD - G:\Program\Office2007\Office12\GrooveNew.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\rsaenh.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (ServiceLayer) -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe File not found
SRV - (ose) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE File not found
SRV - (IDriverT) -- C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe File not found
SRV - (TuneUp.Defrag) -- C:\WINDOWS\system32\TuneUpDefragService.exe (TuneUp Software GmbH)
SRV - (JavaQuickStarterService) -- G:\Program Files\bin\jqs.exe (Sun Microsystems, Inc.)
SRV - (YahooAUService) -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
SRV - (UxTuneUp) -- C:\WINDOWS\system32\uxtuneup.dll (TuneUp Software GmbH)
SRV - (McShield) -- G:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe (McAfee, Inc.)
SRV - (McTaskManager) -- G:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe (McAfee, Inc.)
SRV - (McAfeeFramework) -- G:\Program Files\McAfee\Common Framework\FrameworkService.exe (McAfee, Inc.)
SRV - (Microsoft Office Groove Audit Service) -- G:\Program\Office2007\Office12\GrooveAuditService.exe (Microsoft Corporation)


========== Driver Services (SafeList) ==========

DRV - (mferkdk) -- G:\Program\AntiVirus\McAfee\mferkdk.sys File not found
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (AtcL002) -- C:\WINDOWS\system32\drivers\l251x86.sys (Atheros Communications, Inc.)
DRV - (SynTP) -- C:\WINDOWS\system32\drivers\SynTP.sys (Synaptics, Inc.)
DRV - (AsusACPI) -- C:\WINDOWS\system32\drivers\ASUSACPI.SYS (ASUSTeK Computer Inc.)
DRV - (HDAudBus) -- C:\WINDOWS\system32\drivers\hdaudbus.sys (Windows (R) Server 2003 DDK provider)
DRV - (AR5211) -- C:\WINDOWS\system32\drivers\ar5211.sys (Atheros Communications, Inc.)
DRV - (mfehidk) -- C:\WINDOWS\system32\drivers\mfehidk.sys (McAfee, Inc.)
DRV - (mfeavfk) -- C:\WINDOWS\system32\drivers\mfeavfk.sys (McAfee, Inc.)
DRV - (mfeapfk) -- C:\WINDOWS\system32\drivers\mfeapfk.sys (McAfee, Inc.)
DRV - (mfetdik) -- C:\WINDOWS\system32\drivers\mfetdik.sys (McAfee, Inc.)
DRV - (mfebopk) -- C:\WINDOWS\system32\drivers\mfebopk.sys (McAfee, Inc.)
DRV - (ialm) -- C:\WINDOWS\system32\drivers\igxpmp32.sys (Intel Corporation)


========== Standard Registry (All) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch = http://us.rd.yahoo.com/customize/ie/def ... earch.html
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/def ... .yahoo.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://ph.msn.com/iat/us_ph.aspx
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 84 88 60 C5 85 93 CB 01 [binary data]
IE - HKCU\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\WINDOWS\system32\ieframe.dll (Microsoft Corporation)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 192.168.45.1:3128

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "www.yahoo.com/"
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.5.7


FF - HKLM\software\mozilla\Firefox\extensions\\jqs@sun.com: G:\Program Files\lib\deploy\jqs\ff [2010/10/31 17:47:26 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.7\extensions\\Components: g:\Program Files\Mozilla Firefox\components [2010/12/04 01:16:07 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.7\extensions\\Plugins: g:\Program Files\Mozilla Firefox\plugins [2010/12/14 18:21:19 | 000,000,000 | ---D | M]

[2010/12/04 00:43:52 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Administrator\Application Data\Mozilla\Extensions
[2010/12/04 00:43:52 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Administrator\Application Data\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
[2010/12/04 00:43:52 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2l3t523o.default\extensions
[2010/10/31 17:47:26 | 000,000,000 | ---D | M] (Java Quick Starter) -- G:\PROGRAM FILES\LIB\DEPLOY\JQS\FF

O1 HOSTS File: ([2011/01/02 14:39:42 | 000,426,615 | R--- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 14694 more lines...
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - G:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - G:\Program\Office2007\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - G:\Program Files\McAfee\VirusScan Enterprise\ScriptCl.dll (McAfee, Inc.)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - G:\Program Files\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - G:\Program Files\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O2 - BHO: (no name) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\ShellBrowser: (&Address) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [McAfeeUpdaterUI] G:\Program Files\McAfee\Common Framework\UdaterUI.exe (McAfee, Inc.)
O4 - HKLM..\Run: [ShStatEXE] G:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE (McAfee, Inc.)
O4 - HKCU..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (Microsoft Corporation)
O4 - HKCU..\Run: [SpybotSD TeaTimer] g:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktopCleanupWizard = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableStatusMessages = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: VerboseStatus = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveTrack = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: ClearRecentDocsOnExit = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoStartBanner = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMConfigurePrograms = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMHelp = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: SetVisualStyle = C:\WINDOWS\Resources\Themes\Inspirat2\Inspirat2.msstyles (Microsoft)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - G:\Program\Office2007\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - G:\Program\Office2007\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - G:\Program\Office2007\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - G:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (Microsoft Corporation)
O9 - Extra Button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - G:\Program\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O9 - Extra 'Tools' menuitem : Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - G:\Program\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - C:\WINDOWS\system32\winrnr.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\system32\wshbth.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\WINDOWS\system32\rsvpsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\WINDOWS\system32\rsvpsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000020 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O15 - HKCU\..Trusted Domains: hotmail.com ([www] http in Trusted sites)
O15 - HKCU\..Trusted Domains: mcafeegsl.com ([www] https in Trusted sites)
O15 - HKCU\..Trusted Domains: msn.com ([www] http in Trusted sites)
O15 - HKCU\..Trusted Domains: tune-up.com ([www] http in Trusted sites)
O15 - HKCU\..Trusted Domains: yahoo.com ([us.mg2.mail] http in Trusted sites)
O15 - HKCU\..Trusted Domains: yahoo.com ([www] http in Trusted sites)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (Reg Error: Key error.)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/s ... wflash.cab (Shockwave Flash Object)
O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\gopher {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - G:\Program\Office2007\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll (Microsoft Corporation)
O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\WINDOWS\system32\inetcomm.dll (Microsoft Corporation)
O18 - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll (Microsoft Corporation)
O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found
O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\wia {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINDOWS\system32\wiascr.dll (Microsoft Corporation)
O18 - Protocol\Filter\deflate {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter\gzip {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/webviewhtml {733AC4CB-F1A4-11d0-B951-00A0C90312E1} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UIHost - (logonui.exe) - C:\WINDOWS\System32\logonui.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (rundll32 shell32) - C:\WINDOWS\System32\shell32.dll (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (Control_RunDLL "sysdm.cpl") - C:\WINDOWS\System32\sysdm.cpl (Microsoft Corporation)
O20 - Winlogon\Notify\crypt32chain: DllName - crypt32.dll - C:\WINDOWS\System32\crypt32.dll (Microsoft Corporation)
O20 - Winlogon\Notify\cryptnet: DllName - cryptnet.dll - C:\WINDOWS\System32\cryptnet.dll (Microsoft Corporation)
O20 - Winlogon\Notify\cscdll: DllName - cscdll.dll - C:\WINDOWS\System32\cscdll.dll (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)
O20 - Winlogon\Notify\ScCertProp: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\Schedule: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\sclgntfy: DllName - sclgntfy.dll - File not found
O20 - Winlogon\Notify\SensLogn: DllName - WlNotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\termsrv: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\wlballoon: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O21 - SSODL: CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)
O21 - SSODL: PostBootReminder - {7849596a-48ea-486e-8937-a2a3009f31a9} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)
O21 - SSODL: SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} - C:\WINDOWS\system32\stobject.dll (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\WINDOWS\system32\webcheck.dll (Microsoft Corporation)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\wpdshserviceobj.dll (Microsoft Corporation)
O22 - SharedTaskScheduler: {438755C2-A8BA-11D1-B96B-00A0C90312E1} - Browseui preloader - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)
O22 - SharedTaskScheduler: {8C7461EF-2B13-11d2-BE35-3078302C2030} - Component Categories cache daemon - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)
O24 - Desktop Components:0 (My Current Home Page) - About:Home
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - C:\WINDOWS\System32\shell32.dll (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - G:\Program\Office2007\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (msapsspc.dll) - C:\WINDOWS\System32\msapsspc.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (schannel.dll) - C:\WINDOWS\System32\schannel.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (digest.dll) - C:\WINDOWS\System32\digest.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (msnsspc.dll) - C:\WINDOWS\System32\msnsspc.dll (Microsoft Corporation)
O30 - LSA: Authentication Packages - (msv1_0) - C:\WINDOWS\System32\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (kerberos) - C:\WINDOWS\System32\kerberos.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (msv1_0) - C:\WINDOWS\System32\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (schannel) - C:\WINDOWS\System32\schannel.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (wdigest) - C:\WINDOWS\System32\wdigest.dll (Microsoft Corporation)
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/09/11 14:38:58 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2010/10/27 04:01:49 | 000,000,090 | ---- | M] () - G:\AUTORUN.INF -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk /r \??\G:) - File not found
O34 - HKLM BootExecute: (autocheck autochk /r \??\G:) - File not found
O34 - HKLM BootExecute: (autocheck autochk /r \??\G:) - File not found
O34 - HKLM BootExecute: (autocheck autochk /r \??\G:) - File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/01/04 18:25:01 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Administrator\Desktop\OTL.exe
[2011/01/04 00:01:49 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\Administrator\Recent
[2010/12/25 17:39:57 | 000,047,104 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mqdscli.dll
[2010/12/25 17:39:57 | 000,016,896 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mqise.dll
[2010/12/25 17:39:56 | 000,225,280 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mqoa.dll
[2010/12/25 17:39:56 | 000,048,640 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mqupgrd.dll
[2010/12/25 17:39:56 | 000,004,608 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mqsvc.exe
[2010/12/25 17:39:55 | 000,471,552 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mqutil.dll
[2010/12/25 17:39:55 | 000,095,744 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mqsec.dll
[2010/12/25 17:39:54 | 000,138,240 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mqad.dll
[2010/12/25 17:39:53 | 000,091,776 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mqac.sys
[2010/12/25 17:39:51 | 000,019,968 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mqbkup.exe
[2010/12/25 17:39:50 | 000,117,248 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mqtgsvc.exe
[2010/12/25 17:39:49 | 000,186,880 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mqtrig.dll
[2010/12/25 17:39:48 | 000,169,472 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msmqocm.dll
[2010/12/25 17:39:47 | 000,661,504 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mqqm.dll
[2010/12/25 17:39:47 | 000,517,120 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mqsnap.dll
[2010/12/25 17:39:46 | 000,177,152 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mqrt.dll
[2010/12/25 17:39:46 | 000,123,392 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mqrtdep.dll
[2010/12/25 17:37:15 | 000,177,664 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wintrust.dll
[2010/12/19 03:21:47 | 000,138,368 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\afd.sys
[2010/12/19 03:18:08 | 002,182,144 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\ntoskrnl.exe
[2010/12/19 03:18:08 | 002,059,392 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\ntkrnlpa.exe
[2010/12/19 03:10:11 | 000,225,664 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\tcpip6.sys
[2010/12/18 18:05:05 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\KB905474
[2010/12/18 11:57:53 | 000,000,000 | -H-D | C] -- C:\Program Files\Uninstall Information
[2010/12/16 20:10:07 | 000,000,000 | ---D | C] -- C:\Program Files\xerox
[2010/12/16 20:10:05 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\xircom
[2010/12/16 20:10:05 | 000,000,000 | ---D | C] -- C:\WINDOWS\srchasst
[2010/12/16 20:10:05 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\speechengines
[2010/12/16 20:10:05 | 000,000,000 | ---D | C] -- C:\Program Files\outlook express
[2010/12/16 20:10:05 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\mssoap
[2010/12/16 20:10:05 | 000,000,000 | ---D | C] -- C:\Program Files\movie maker
[2010/12/16 20:10:04 | 000,000,000 | ---D | C] -- C:\Program Files\netmeeting
[2010/12/16 20:10:04 | 000,000,000 | ---D | C] -- C:\Program Files\msn gaming zone
[2010/12/16 20:10:04 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\ime
[2010/12/16 20:10:02 | 000,000,000 | ---D | C] -- C:\Program Files\microsoft frontpage
[2010/12/15 19:59:27 | 000,140,288 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\sfc_os.dll
[2010/12/14 18:21:12 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Works
[2010/12/14 18:20:46 | 000,000,000 | ---D | C] -- C:\Program Files\MSBuild
[2010/12/14 18:20:45 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Visual Studio
[2010/12/14 18:20:36 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\DESIGNER
[2010/12/11 18:04:53 | 000,000,000 | ---D | C] -- C:\WINDOWS\ServicePackFiles
[2010/12/10 14:12:16 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Office
[2010/12/10 14:06:33 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\ODBC
[2010/12/10 13:56:52 | 000,202,496 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\rmcast.sys
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/01/04 18:47:51 | 000,000,162 | -H-- | M] () -- C:\Documents and Settings\Administrator\Desktop\~$wnload OTL to your desktop.docx
[2011/01/04 18:47:00 | 000,000,438 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{EF573F16-43C3-426D-83B3-8B8212819493}.job
[2011/01/04 18:27:55 | 000,011,503 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\Download OTL to your desktop.docx
[2011/01/04 18:26:26 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Administrator\Desktop\OTL.exe
[2011/01/04 18:12:22 | 000,002,367 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\Microsoft Office Word 2007.lnk
[2011/01/04 17:50:49 | 000,000,260 | ---- | M] () -- C:\WINDOWS\tasks\WGASetup.job
[2011/01/04 17:48:55 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011/01/03 22:51:59 | 000,000,036 | ---- | M] () -- C:\Documents and Settings\Administrator\Local Settings\Application Data\housecall.guid.cache
[2011/01/03 20:52:51 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011/01/02 21:11:40 | 000,000,397 | ---- | M] () -- C:\WINDOWS\wininit.ini
[2011/01/02 14:39:42 | 000,426,615 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2010/12/28 21:50:54 | 000,014,947 | ---- | M] () -- C:\Documents and Settings\Administrator\My Documents\public class LengthConverter.docx
[2010/12/24 17:24:25 | 000,000,350 | ---- | M] () -- C:\WINDOWS\tasks\1-Click Maintenance.job
[2010/12/21 21:18:17 | 000,113,451 | ---- | M] () -- C:\Documents and Settings\Administrator\My Documents\halfWalkthrough.docx
[2010/12/20 18:09:00 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/12/20 18:08:40 | 000,020,952 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010/12/19 11:39:55 | 000,312,566 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010/12/19 11:39:55 | 000,039,968 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010/12/18 11:57:20 | 000,000,079 | ---- | M] () -- C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf
[2010/12/14 19:46:30 | 000,000,904 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\ThreeNumbers.java
[2010/12/14 19:42:13 | 000,000,904 | ---- | M] () -- C:\Documents and Settings\Administrator\My Documents\ThreeNumbers.java
[2010/12/14 18:14:28 | 000,001,321 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\attachments_2010_12_14.zip
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/01/04 18:47:51 | 000,000,162 | -H-- | C] () -- C:\Documents and Settings\Administrator\Desktop\~$wnload OTL to your desktop.docx
[2011/01/04 18:27:52 | 000,011,503 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\Download OTL to your desktop.docx
[2011/01/03 22:51:59 | 000,000,036 | ---- | C] () -- C:\Documents and Settings\Administrator\Local Settings\Application Data\housecall.guid.cache
[2011/01/02 14:26:17 | 000,000,397 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2010/12/28 21:50:53 | 000,014,947 | ---- | C] () -- C:\Documents and Settings\Administrator\My Documents\public class LengthConverter.docx
[2010/12/21 21:18:14 | 000,113,451 | ---- | C] () -- C:\Documents and Settings\Administrator\My Documents\halfWalkthrough.docx
[2010/12/18 18:05:05 | 000,000,260 | ---- | C] () -- C:\WINDOWS\tasks\WGASetup.job
[2010/12/14 18:26:56 | 000,000,904 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\ThreeNumbers.java
[2010/12/14 18:25:13 | 000,000,904 | ---- | C] () -- C:\Documents and Settings\Administrator\My Documents\ThreeNumbers.java
[2010/12/14 18:14:27 | 000,001,321 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\attachments_2010_12_14.zip
[2010/12/04 17:33:10 | 000,000,280 | ---- | C] () -- C:\WINDOWS\System32\epoPGPsdk.dll.sig
[2008/09/12 08:29:11 | 000,017,331 | ---- | C] () -- C:\WINDOWS\Ascd_log.ini
[2008/09/12 08:24:46 | 000,016,793 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini
[2008/09/12 08:20:47 | 000,200,704 | R--- | C] () -- C:\WINDOWS\System32\igfxCoIn_v4704.dll
[2008/09/11 15:28:57 | 000,010,288 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[2008/09/11 07:08:47 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2007/08/17 17:07:40 | 000,000,032 | ---- | C] () -- C:\WINDOWS\asusacpi.ini
[2007/03/29 22:00:40 | 000,203,264 | R--- | C] () -- C:\WINDOWS\System32\CddbCdda.dll

========== LOP Check ==========

[2010/10/27 05:47:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\GetRightToGo
[2009/10/23 13:41:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\Nokia
[2009/10/23 14:35:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\PC Suite
[2008/09/12 09:14:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\TuneUp Software
[2010/04/26 02:30:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\Wildfire
[2009/10/23 13:29:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Installations
[2010/12/04 17:02:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MFAData
[2009/10/23 14:34:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PC Suite
[2008/09/12 09:14:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TuneUp Software
[2010/01/15 22:45:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\WinZip
[2010/12/24 17:24:25 | 000,000,350 | ---- | M] () -- C:\WINDOWS\Tasks\1-Click Maintenance.job
[2011/01/04 18:47:00 | 000,000,438 | -H-- | M] () -- C:\WINDOWS\Tasks\User_Feed_Synchronization-{EF573F16-43C3-426D-83B3-8B8212819493}.job
[2011/01/04 17:50:49 | 000,000,260 | ---- | M] () -- C:\WINDOWS\Tasks\WGASetup.job

========== Purity Check ==========



< End of report >

EXTRAS.txt

OTL Extras logfile created on: 1/4/2011 6:48:39 PM - Run 1
OTL by OldTimer - Version 3.2.20.1 Folder = C:\Documents and Settings\Administrator\Desktop
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,015.00 Mb Total Physical Memory | 620.00 Mb Available Physical Memory | 61.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 89.00% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 3.72 Gb Total Space | 0.27 Gb Free Space | 7.26% Space Free | Partition Type: NTFS
Drive G: | 111.78 Gb Total Space | 89.76 Gb Free Space | 80.30% Space Free | Partition Type: NTFS

Computer Name: ICS-0F2F811A446 | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.inf [@ = inffile] -- Reg Error: Key error. File not found
.ini [@ = inifile] -- notepad.exe %1
.txt [@ = txtfile] -- notepad.exe %1

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = htmlfile] -- Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [edit] -- Reg Error: Key error.
batfile [open] -- "%1" %*
batfile [print] -- Reg Error: Key error.
cmdfile [edit] -- Reg Error: Key error.
cmdfile [open] -- "%1" %*
cmdfile [print] -- Reg Error: Key error.
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- "G:\Program\Office2007\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "G:\Program\Office2007\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [open] -- Reg Error: Key error.
inffile [print] -- Reg Error: Key error.
inifile [open] -- notepad.exe %1
inifile [print] -- Reg Error: Key error.
jsfile [edit] -- Reg Error: Key error.
jsfile [print] -- Reg Error: Key error.
jsefile [edit] -- Reg Error: Key error.
jsefile [print] -- Reg Error: Key error.
piffile [open] -- "%1" %*
regfile [edit] -- Reg Error: Key error.
regfile [merge] -- Reg Error: Key error.
regfile [print] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
txtfile [open] -- notepad.exe %1
txtfile [print] -- Reg Error: Key error.
txtfile [printto] -- Reg Error: Key error.
vbefile [edit] -- Reg Error: Key error.
vbefile [print] -- Reg Error: Key error.
vbsfile [edit] -- Reg Error: Key error.
vbsfile [print] -- Reg Error: Key error.
wsffile [edit] -- Reg Error: Key error.
wsffile [print] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- G:\Program\OFFICE~1\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 1
"DisableNotifications" = 0

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)
"G:\Program\Messenger\YahooMessenger.exe" = G:\Program\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger -- (Yahoo! Inc.)
"G:\Program Files\McAfee\Common Framework\FrameworkService.exe" = G:\Program Files\McAfee\Common Framework\FrameworkService.exe:*:Enabled:McAfee Framework Service -- (McAfee, Inc.)
"G:\Program Files\Skype\Phone\Skype.exe" = G:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype -- (Skype Technologies S.A.)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{19F5658D-92E8-4A08-8657-D38ABB1574B2}" = Asus ACPI Driver
"{212748BB-0DA5-46DE-82A1-403736DC9F27}" = MSVC80_x86
"{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java(TM) 6 Update 22
"{3248F0A8-6813-11D6-A77B-00B0D0150040}" = J2SE Runtime Environment 5.0 Update 4
"{35C03C04-3F1F-42C2-A989-A757EE691F65}" = McAfee VirusScan Enterprise
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{5888428E-699C-4E71-BF71-94EE06B497DA}" = TuneUp Utilities 2008
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{90120000-0010-0409-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (English) 12
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007
"{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{C21D5524-A970-42FA-AC8A-59B8C7CDCA31}" = QuickTime
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.1
"{E9BC886E-0D8A-4EF5-B793-30DB776C6E2C}" = PC Connectivity Solution
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"ENTERPRISE" = Microsoft Office Enterprise 2007
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"ie8" = Windows Internet Explorer 8
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Mozilla Firefox (3.5.7)" = Mozilla Firefox (3.5.7)
"Nokia PC Suite" = Nokia PC Suite
"RemoveIT Pro v7 (Trial)" = RemoveIT Pro v7 (Trial)
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"WinRAR archiver" = WinRAR archiver
"Wudf01005" = Microsoft User-Mode Driver Framework Feature Pack 1.5
"Yahoo! Messenger" = Yahoo! Messenger

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 1/4/2011 12:54:24 AM | Computer Name = ICS-0F2F811A446 | Source = Userenv | ID = 1090
Description = Windows couldn't log the RSoP (Resultant Set of Policies) session
status. An attempt to connect to WMI failed. No more RSoP logging will be done for
this application of policy.

Error - 1/4/2011 12:54:28 AM | Computer Name = ICS-0F2F811A446 | Source = Userenv | ID = 1090
Description = Windows couldn't log the RSoP (Resultant Set of Policies) session
status. An attempt to connect to WMI failed. No more RSoP logging will be done for
this application of policy.

Error - 1/4/2011 12:59:50 AM | Computer Name = ICS-0F2F811A446 | Source = Userenv | ID = 1090
Description = Windows couldn't log the RSoP (Resultant Set of Policies) session
status. An attempt to connect to WMI failed. No more RSoP logging will be done for
this application of policy.

Error - 1/4/2011 12:59:50 AM | Computer Name = ICS-0F2F811A446 | Source = Userenv | ID = 1090
Description = Windows couldn't log the RSoP (Resultant Set of Policies) session
status. An attempt to connect to WMI failed. No more RSoP logging will be done for
this application of policy.

Error - 1/4/2011 1:40:17 AM | Computer Name = ICS-0F2F811A446 | Source = Userenv | ID = 1090
Description = Windows couldn't log the RSoP (Resultant Set of Policies) session
status. An attempt to connect to WMI failed. No more RSoP logging will be done for
this application of policy.

Error - 1/4/2011 1:40:24 AM | Computer Name = ICS-0F2F811A446 | Source = Userenv | ID = 1090
Description = Windows couldn't log the RSoP (Resultant Set of Policies) session
status. An attempt to connect to WMI failed. No more RSoP logging will be done for
this application of policy.

Error - 1/4/2011 3:24:30 AM | Computer Name = ICS-0F2F811A446 | Source = Userenv | ID = 1090
Description = Windows couldn't log the RSoP (Resultant Set of Policies) session
status. An attempt to connect to WMI failed. No more RSoP logging will be done for
this application of policy.

Error - 1/4/2011 3:25:24 AM | Computer Name = ICS-0F2F811A446 | Source = Userenv | ID = 1090
Description = Windows couldn't log the RSoP (Resultant Set of Policies) session
status. An attempt to connect to WMI failed. No more RSoP logging will be done for
this application of policy.

Error - 1/4/2011 9:50:15 PM | Computer Name = ICS-0F2F811A446 | Source = Userenv | ID = 1090
Description = Windows couldn't log the RSoP (Resultant Set of Policies) session
status. An attempt to connect to WMI failed. No more RSoP logging will be done for
this application of policy.

Error - 1/4/2011 9:50:27 PM | Computer Name = ICS-0F2F811A446 | Source = Userenv | ID = 1090
Description = Windows couldn't log the RSoP (Resultant Set of Policies) session
status. An attempt to connect to WMI failed. No more RSoP logging will be done for
this application of policy.

[ OSession Events ]
Error - 2/3/2010 2:12:47 PM | Computer Name = ICS-0F2F811A446 | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 35
seconds with 0 seconds of active time. This session ended with a crash.

[ System Events ]
Error - 1/2/2011 8:31:15 PM | Computer Name = ICS-0F2F811A446 | Source = Service Control Manager | ID = 7011
Description = Timeout (30000 milliseconds) waiting for a transaction response from
the Dnscache service.

Error - 1/2/2011 8:31:16 PM | Computer Name = ICS-0F2F811A446 | Source = Service Control Manager | ID = 7034
Description = The McAfee McShield service terminated unexpectedly. It has done
this 1 time(s).

Error - 1/2/2011 8:53:17 PM | Computer Name = ICS-0F2F811A446 | Source = Service Control Manager | ID = 7034
Description = The McAfee McShield service terminated unexpectedly. It has done
this 2 time(s).

Error - 1/2/2011 9:50:30 PM | Computer Name = ICS-0F2F811A446 | Source = Service Control Manager | ID = 7034
Description = The Yahoo! Updater service terminated unexpectedly. It has done this
1 time(s).

Error - 1/2/2011 9:58:17 PM | Computer Name = ICS-0F2F811A446 | Source = Service Control Manager | ID = 7034
Description = The Java Quick Starter service terminated unexpectedly. It has done
this 1 time(s).

Error - 1/4/2011 1:40:38 AM | Computer Name = ICS-0F2F811A446 | Source = Service Control Manager | ID = 7011
Description = Timeout (30000 milliseconds) waiting for a transaction response from
the AudioSrv service.

Error - 1/4/2011 1:42:23 AM | Computer Name = ICS-0F2F811A446 | Source = Dhcp | ID = 1002
Description = The IP address lease 192.168.0.3 for the Network Card with network
address 0015AF774EF9 has been denied by the DHCP server 192.168.0.1 (The DHCP Server
sent a DHCPNACK message).

Error - 1/4/2011 2:08:03 AM | Computer Name = ICS-0F2F811A446 | Source = Windows Update Agent | ID = 16
Description = Unable to Connect: Windows is unable to connect to the automatic updates
service and therefore cannot download and install updates according to the set
schedule. Windows will continue to try to establish a connection.

Error - 1/4/2011 2:21:34 AM | Computer Name = ICS-0F2F811A446 | Source = Dhcp | ID = 1001
Description = Your computer was not assigned an address from the network (by the
DHCP Server) for the Network Card with network address 0015AF774EF9. The following
error occurred: %%121. Your computer will continue to try and obtain an address on
its own from the network address (DHCP) server.

Error - 1/4/2011 10:42:13 PM | Computer Name = ICS-0F2F811A446 | Source = Service Control Manager | ID = 7034
Description = The McAfee McShield service terminated unexpectedly. It has done
this 1 time(s).


< End of report >

and btw i manually disabled mcaffee mcshield bcz it blocked otl from writing something during the otl scan.

edgondoy,

Please download to your desktop.

Double click combofix.exe and follow the prompts.

If combofix will not start or is ended before the "Blue window" please rename combofix.exe to cbf.exe and try again.

If cbf.exe will not start or is ended, you will have to run cbf.exe from safe mode.
Reboot in to Safe mode:
Restart Windows after you see the BIOS screen and before Windows starts to load.
Start tapping the F8 key. The Windows Advanced Options Menu appears.
Use the Arrow key to ensure that the Safe Mode option is selected.
Press Enter. The computer then begins to start in Safe mode.

Do not exit Combofix while it is running you my loose all your personal settings!
Important Note - Do not mouseclick combofix's window while it's running, that may cause it to stall.

When it's done running it will produce a log for you. Please post that log in your next reply.

sorry for the late reply was busy with some things
Here's the log

launched combofix a second time it installed the recovery console..ill post it now..
----------------------
ComboFix 11-01-06.03 - Administrator 01/07/2011 12:42:21.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1015.626 [GMT -8:00]
Running from: c:\documents and settings\Administrator\Desktop\cbf.exe
* Resident AV is active


WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\msconfig.exe
G:\Autorun.inf

.
((((((((((((((((((((((((( Files Created from 2010-12-07 to 2011-01-07 )))))))))))))))))))))))))))))))
.

2010-12-26 01:37 . 2009-12-24 07:05 177664 -c----w- c:\windows\system32\dllcache\wintrust.dll
2010-12-19 11:21 . 2008-06-20 10:44 138368 ----a-w- c:\windows\system32\drivers\afd.sys
2010-12-19 11:21 . 2008-06-20 10:44 138368 ----a-w- c:\windows\system32\dllcache\afd.sys
2010-12-19 11:20 . 2007-07-22 13:16 332928 ----a-w- c:\windows\system32\drivers\srv.sys
2010-12-19 11:18 . 2004-08-04 01:56 616960 ----a-w- c:\windows\system32\advapi32.dll
2010-12-19 11:18 . 2007-07-24 20:11 2059392 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-12-19 11:18 . 2007-07-22 13:15 2182144 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-12-19 11:18 . 2004-08-04 01:56 108032 ----a-w- c:\windows\system32\services.exe
2010-12-19 11:18 . 2004-08-04 01:56 708096 ----a-w- c:\windows\system32\ntdll.dll
2010-12-19 11:10 . 2007-07-24 20:09 360704 ----a-w- c:\windows\system32\drivers\tcpip.sys
2010-12-19 11:10 . 2007-07-22 13:16 225664 ----a-w- c:\windows\system32\drivers\tcpip6.sys
2010-12-19 02:05 . 2010-12-19 02:05 -------- dc----w- c:\windows\system32\KB905474
2010-12-17 04:10 . 2010-12-17 04:10 -------- d-----w- c:\windows\system32\wbem\snmp
2010-12-17 04:10 . 2010-12-17 04:10 -------- dc----w- c:\windows\system32\xircom
2010-12-17 04:10 . 2010-12-17 04:10 -------- dc----w- c:\windows\srchasst
2010-12-17 04:10 . 2010-12-17 04:10 -------- dc----w- c:\program files\microsoft frontpage
2010-12-16 06:32 . 2007-07-24 20:09 140288 -c--a-w- c:\windows\system32\sfc_os.dll
2010-12-16 03:59 . 2007-07-24 20:09 140288 -c--a-w- c:\windows\system32\dllcache\sfc_os.dll
2010-12-15 02:21 . 2010-12-15 02:21 -------- dc----w- c:\program files\Microsoft Works
2010-12-15 02:20 . 2010-12-15 02:20 -------- dc----w- c:\program files\MSBuild
2010-12-12 02:04 . 2010-12-12 02:04 -------- dc----w- c:\windows\ServicePackFiles
2010-12-10 22:16 . 2010-12-10 22:17 -------- dc----w- c:\documents and settings\Default User
2010-12-10 22:13 . 2007-07-22 13:14 454656 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-12-10 21:56 . 2007-07-22 13:16 202496 ----a-w- c:\windows\system32\drivers\rmcast.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-12-21 02:09 . 2010-10-25 02:44 38224 -c--a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-12-21 02:08 . 2010-10-25 02:44 20952 -c--a-w- c:\windows\system32\drivers\mbam.sys
2010-12-04 02:59 . 2010-12-04 02:48 5310 -c--a-w- c:\windows\BricoPackFoldersDelete.cmd
2010-12-04 02:59 . 2010-12-04 02:59 46273 -c--a-w- c:\windows\BricoPackUninst.cmd
2010-12-04 02:59 . 2007-07-24 20:09 218624 -c--a-w- c:\windows\system32\uxtheme.dll
2010-12-01 17:22 . 2010-12-01 17:22 306432 -c--a-w- c:\windows\system32\TuneUpDefragService.exe
2010-11-01 01:47 . 2010-11-01 01:48 73728 -c--a-w- c:\windows\system32\javacpl.cpl
2010-11-01 01:47 . 2010-11-01 01:48 472808 -c--a-w- c:\windows\system32\deployJava1.dll
.

------- Sigcheck -------

[-] 2004-08-03 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\system32\drivers\atapi.sys

[-] 2004-08-04 . 02000ABF34AF4C218C35D257024807D6 . 14336 . . [5.1.2600.2180] . . c:\windows\system32\drivers\asyncmac.sys


[-] 2004-08-03 . EBDEE8A2EE5393890A1ACEE971C4C246 . 24576 . . [5.1.2600.2180] . . c:\windows\system32\drivers\kbdclass.sys

[-] 2004-08-04 . 558635D3AF1C7546D26067D5D9B6959E . 182912 . . [5.1.2600.2180] . . c:\windows\system32\drivers\ndis.sys

[-] 2001-08-23 . 73C1E1F395918BC2C6DD67AF7591A3AD . 2944 . . [5.1.2600.0] . . c:\windows\system32\drivers\null.sys

[-] 2007-07-24 . A11391BE25035570AE4B8970920F2C74 . 360704 . . [5.1.2600.3002] . . c:\windows\system32\drivers\tcpip.sys

[-] 2004-08-04 . 84885F9B82F4D55C6146EBF6065D75D2 . 13312 . . [5.1.2600.2180] . . c:\windows\system32\lsass.exe

[-] 2004-08-04 . C6CE6EEC82F187615D1002BB3BB50ED4 . 108032 . . [5.1.2600.2180] . . c:\windows\system32\services.exe

[-] 2004-08-04 . 01C3346C241652F43AED8E2149881BFE . 502272 . . [5.1.2600.2180] . . c:\windows\system32\winlogon.exe

[-] 2004-08-04 . 87CA7CE6469577F059297B9D6556D66D . 110080 . . [5.1.2600.2180] . . c:\windows\system32\imm32.dll

[-] 2004-08-04 . 74D66B3DE265E8789153414E75175F26 . 22016 . . [5.1.2600.2180] . . c:\windows\system32\lpk.dll

[-] 2004-08-04 . 4E74AF063C3271FBEA20DD940CFD1184 . 245248 . . [5.1.2600.2180] . . c:\windows\system32\mswsock.dll

[-] 2004-08-04 . 1B5F6923ABB450692E9FE0672C897AED . 17408 . . [6.00.2900.2180] . . c:\windows\system32\powrprof.dll

[-] 2004-08-04 . 0F78E27F563F2AAF74B91A49E2ABF19A . 180224 . . [5.1.2600.2180] . . c:\windows\system32\scecli.dll

[-] 2004-08-04 . E8A12A12EA9088B4327D49EDCA3ADD3E . 5120 . . [5.1.2600.2180] . . c:\windows\system32\sfc.dll

[-] 2004-08-04 . 8F078AE4ED187AAABC0A305146DE6716 . 14336 . . [5.1.2600.2180] . . c:\windows\system32\svchost.exe

[-] 2004-08-04 . 39B1FFB03C2296323832ACBAE50D2AFF . 24576 . . [5.1.2600.2180] . . c:\windows\system32\userinit.exe

[-] 2004-08-04 . 2ED0B7F12A60F90092081C50FA0EC2B2 . 82944 . . [5.1.2600.2180] . . c:\windows\system32\ws2_32.dll

[-] 2004-08-04 . 9BEACB911CA61E5881102188AB7FB431 . 19968 . . [5.1.2600.2180] . . c:\windows\system32\ws2help.dll

[-] 2007-07-22 . 1D23EB782291CB7D3ADB33C26EE9583B . 975360 . . [6.00.2900.3111] . . c:\windows\explorer.exe

[-] 2004-08-04 . 2EB58F9DCD6AB320B46744A4EA48B2D2 . 406528 . . [1.0420.2600.2180] . . c:\windows\system32\usp10.dll


[-] 2004-08-04 . EEF46DAB68229A14DA3D8E73C99E2959 . 129536 . . [5.1.2600.2180] . . c:\windows\system32\xmlprov.dll

[-] 2004-08-04 . 82B24CB70E5944E6E34662205A2A5B78 . 55808 . . [5.1.2600.2180] . . c:\windows\system32\eventlog.dll

[-] 2004-08-04 . 30A609E00BD1D4FFC49D6B5A432BE7F2 . 1580544 . . [5.1.2600.2180] . . c:\windows\system32\sfcfiles.dll

[-] 2004-08-04 . 24232996A38C0B0CF151C2140AE29FC8 . 15360 . . [5.1.2600.2180] . . c:\windows\system32\ctfmon.exe


[-] 2004-08-04 . 92360854316611F6CC471612213C3D92 . 190976 . . [5.1.2600.2180] . . c:\windows\system32\schedsvc.dll

[-] 2001-08-23 . 9859C0F6936E723E4892D7141B1327D5 . 11648 . . [5.1.2600.0] . . c:\windows\system32\drivers\acpiec.sys

[-] 2004-08-04 . 4448006B6BC60E6C027932CFC38D6855 . 29056 . . [5.1.2600.2180] . . c:\windows\system32\drivers\ip6fw.sys

[-] 2007-07-22 13:18 . C51B4A5C05A5475708E3C81C7765B71D . 27136 . . [11.0.5721.5145] . . c:\windows\system32\mspmsnsv.dll

[-] 2004-08-04 . 55E148C01296696588EAFA425782C3E8 . 367616 . . [5.3.2600.2180] . . c:\windows\system32\dsound.dll

[-] 2004-08-04 . D67BDBBDA86CC9AEEBBAF3217C1717D8 . 1689088 . . [5.03.2600.2180] . . c:\windows\system32\d3d9.dll

[-] 2004-08-04 . 7ED462F353B3D915A418A689FA881F96 . 266240 . . [5.03.2600.2180] . . c:\windows\system32\ddraw.dll

[-] 2004-08-04 01:56 . B48D3193DD1474DCBCC32BF4779AC698 . 83456 . . [5.1.2600.2180] . . c:\windows\system32\olepro32.dll

[-] 2004-08-04 . 96492C721C6EA517E2BFD5381FEF55E3 . 39936 . . [5.1.2600.2180] . . c:\windows\system32\perfctrs.dll

[-] 2004-08-04 . D38408967BE738D0C1B47005BCE8CEEB . 18944 . . [5.1.2600.2180] . . c:\windows\system32\version.dll

c:\windows\System32\drivers\beep.sys ... is missing !!
c:\windows\System32\wscntfy.exe ... is missing !!
c:\windows\System32\regsvc.dll ... is missing !!
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="g:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-06 2260480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ShStatEXE"="g:\program files\McAfee\VirusScan Enterprise\SHSTAT.EXE" [2007-02-23 112216]
"McAfeeUpdaterUI"="g:\program files\McAfee\Common Framework\UdaterUI.exe" [2006-12-19 136768]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"ShowDeskFix"="shell32" [X]
"nltide_3"="advpack.dll" [2009-03-08 128512]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk /r \??\g:\0autocheck autochk /r \??\g:\0autocheck autochk /r \??\g:\0autocheck autochk /r \??\G:\0autocheck autochk *

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"RemoveIT Pro v7Ent"=c:\program files\InCode Solutions\RemoveIT Pro v7 Enterprise\removeit.exe
"ctfmon.exe"=c:\windows\system32\ctfmon.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"g:\\Program\\Messenger\\YahooMessenger.exe"=
"g:\\Program Files\\McAfee\\Common Framework\\FrameworkService.exe"=
"g:\\Program Files\\Skype\\Phone\\Skype.exe"=


NETSVCS REQUIRES REPAIRS - current entries shown
6to4
AppMgmt
AudioSrv
Browser
CryptSvc
DMServer
DHCP
EventSystem
FastUserSwitchingCompatibility
HidServ
Ias
Iprip
Irmon
LanmanServer
LanmanWorkstation
Netman
Nla
NWCWorkstation
Nwsapagent
Rasauto
Rasman
Remoteaccess
Schedule
Seclogon
SENS
Sharedaccess
SRService
Tapisrv
Themes
UxTuneUp
WZCSVC
Wmi
WmdmPmSp
winmgmt
xmlprov
BITS
wuauserv
ShellHWDetection
WmdmPmSN

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs


[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A509B1FF-37FF-4bFF-8CFF-4F3A747040FF}]
2009-03-08 12:32 128512 -c--a-w- c:\windows\system32\advpack.dll
.
Contents of the 'Scheduled Tasks' folder

2010-12-25 c:\windows\Tasks\1-Click Maintenance.job
- g:\program\TuneUp\OneClick.exe [2008-01-08 20:31]

2011-01-07 c:\windows\Tasks\User_Feed_Synchronization-{EF573F16-43C3-426D-83B3-8B8212819493}.job
- c:\windows\system32\msfeedssync.exe [2008-09-11 12:31]

2011-01-07 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2010-12-19 06:18]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/
uInternet Settings,ProxyServer = 192.168.45.1:3128
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/def ... .yahoo.com
Trusted Zone: hotmail.com\www
Trusted Zone: mcafeegsl.com\www
Trusted Zone: msn.com\www
Trusted Zone: tune-up.com\www
Trusted Zone: yahoo.com\us.mg2.mail
Trusted Zone: yahoo.com\www
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2l3t523o.default\
FF - prefs.js: browser.startup.homepage - http://www.yahoo.com/
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - g:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Quick Starter: jqs@sun.com - g:\program files\lib\deploy\jqs\ff
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.notify.interval - 600000
FF - user.js: content.switch.threshold - 1000000
FF - user.js: nglayout.initialpaint.delay - 600
.
- - - - ORPHANS REMOVED - - - -

Toolbar-Locked - (no file)



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-01-07 12:50
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-602162358-2025429265-1177238915-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,cf,11,38,fb,56,db,14,42,95,6c,ce,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,e8,30,c3,e3,18,f1,0c,4f,8f,ad,a3,\
"6256FFB019F8FDFBD36745B06F4540E9AEAF222A25"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,cf,11,38,fb,56,db,14,42,95,6c,ce,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
Completion time: 2011-01-07 12:56:46
ComboFix-quarantined-files.txt 2011-01-07 20:56

Pre-Run: 3,743,744 bytes free
Post-Run: 142,577,664 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe

- - End Of File - - 3FE0030E2BF3B21190751255DF55C5AA

I notice the big improvement in terms of speed..but still some freezes here and there maybe because im just impatient..and also how do you get rid of the black screen which prompts me to go to safe mode or not (my cousin might suspect i did something to her laptop...
----------
ComboFix 11-01-06.04 - Administrator 01/07/2011 15:36:44.2.1 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1015.560 [GMT -8:00]
Running from: c:\documents and settings\Administrator\Desktop\cbf.exe
.

((((((((((((((((((((((((( Files Created from 2010-12-07 to 2011-01-07 )))))))))))))))))))))))))))))))
.

2010-12-26 01:37 . 2009-12-24 07:05 177664 -c----w- c:\windows\system32\dllcache\wintrust.dll
2010-12-19 11:21 . 2008-06-20 10:44 138368 ----a-w- c:\windows\system32\drivers\afd.sys
2010-12-19 11:21 . 2008-06-20 10:44 138368 ----a-w- c:\windows\system32\dllcache\afd.sys
2010-12-19 11:20 . 2007-07-22 13:16 332928 ----a-w- c:\windows\system32\drivers\srv.sys
2010-12-19 11:18 . 2004-08-04 01:56 616960 ----a-w- c:\windows\system32\advapi32.dll
2010-12-19 11:18 . 2007-07-24 20:11 2059392 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-12-19 11:18 . 2007-07-22 13:15 2182144 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-12-19 11:18 . 2004-08-04 01:56 108032 ----a-w- c:\windows\system32\services.exe
2010-12-19 11:18 . 2004-08-04 01:56 708096 ----a-w- c:\windows\system32\ntdll.dll
2010-12-19 11:10 . 2007-07-24 20:09 360704 ----a-w- c:\windows\system32\drivers\tcpip.sys
2010-12-19 11:10 . 2007-07-22 13:16 225664 ----a-w- c:\windows\system32\drivers\tcpip6.sys
2010-12-19 02:05 . 2010-12-19 02:05 -------- dc----w- c:\windows\system32\KB905474
2010-12-17 04:10 . 2010-12-17 04:10 -------- d-----w- c:\windows\system32\wbem\snmp
2010-12-17 04:10 . 2010-12-17 04:10 -------- dc----w- c:\windows\system32\xircom
2010-12-17 04:10 . 2010-12-17 04:10 -------- dc----w- c:\windows\srchasst
2010-12-17 04:10 . 2010-12-17 04:10 -------- dc----w- c:\program files\microsoft frontpage
2010-12-16 06:32 . 2007-07-24 20:09 140288 -c--a-w- c:\windows\system32\sfc_os.dll
2010-12-16 03:59 . 2007-07-24 20:09 140288 -c--a-w- c:\windows\system32\dllcache\sfc_os.dll
2010-12-15 02:21 . 2010-12-15 02:21 -------- dc----w- c:\program files\Microsoft Works
2010-12-15 02:20 . 2010-12-15 02:20 -------- dc----w- c:\program files\MSBuild
2010-12-12 02:04 . 2010-12-12 02:04 -------- dc----w- c:\windows\ServicePackFiles
2010-12-10 22:16 . 2011-01-07 20:57 -------- dc----w- c:\documents and settings\Default User
2010-12-10 22:13 . 2007-07-22 13:14 454656 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-12-10 21:56 . 2007-07-22 13:16 202496 ----a-w- c:\windows\system32\drivers\rmcast.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-12-21 02:09 . 2010-10-25 02:44 38224 -c--a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-12-21 02:08 . 2010-10-25 02:44 20952 -c--a-w- c:\windows\system32\drivers\mbam.sys
2010-12-04 02:59 . 2010-12-04 02:48 5310 -c--a-w- c:\windows\BricoPackFoldersDelete.cmd
2010-12-04 02:59 . 2010-12-04 02:59 46273 -c--a-w- c:\windows\BricoPackUninst.cmd
2010-12-04 02:59 . 2007-07-24 20:09 218624 -c--a-w- c:\windows\system32\uxtheme.dll
2010-12-01 17:22 . 2010-12-01 17:22 306432 -c--a-w- c:\windows\system32\TuneUpDefragService.exe
2010-11-01 01:47 . 2010-11-01 01:48 73728 -c--a-w- c:\windows\system32\javacpl.cpl
2010-11-01 01:47 . 2010-11-01 01:48 472808 -c--a-w- c:\windows\system32\deployJava1.dll
.

------- Sigcheck -------

[-] 2004-08-03 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\system32\drivers\atapi.sys

[-] 2004-08-04 . 02000ABF34AF4C218C35D257024807D6 . 14336 . . [5.1.2600.2180] . . c:\windows\system32\drivers\asyncmac.sys


[-] 2004-08-03 . EBDEE8A2EE5393890A1ACEE971C4C246 . 24576 . . [5.1.2600.2180] . . c:\windows\system32\drivers\kbdclass.sys

[-] 2004-08-04 . 558635D3AF1C7546D26067D5D9B6959E . 182912 . . [5.1.2600.2180] . . c:\windows\system32\drivers\ndis.sys

[-] 2001-08-23 . 73C1E1F395918BC2C6DD67AF7591A3AD . 2944 . . [5.1.2600.0] . . c:\windows\system32\drivers\null.sys

[-] 2007-07-24 . A11391BE25035570AE4B8970920F2C74 . 360704 . . [5.1.2600.3002] . . c:\windows\system32\drivers\tcpip.sys

[-] 2004-08-04 . 84885F9B82F4D55C6146EBF6065D75D2 . 13312 . . [5.1.2600.2180] . . c:\windows\system32\lsass.exe

[-] 2004-08-04 . C6CE6EEC82F187615D1002BB3BB50ED4 . 108032 . . [5.1.2600.2180] . . c:\windows\system32\services.exe

[-] 2004-08-04 . 01C3346C241652F43AED8E2149881BFE . 502272 . . [5.1.2600.2180] . . c:\windows\system32\winlogon.exe

[-] 2004-08-04 . 87CA7CE6469577F059297B9D6556D66D . 110080 . . [5.1.2600.2180] . . c:\windows\system32\imm32.dll

[-] 2004-08-04 . 74D66B3DE265E8789153414E75175F26 . 22016 . . [5.1.2600.2180] . . c:\windows\system32\lpk.dll

[-] 2004-08-04 . 4E74AF063C3271FBEA20DD940CFD1184 . 245248 . . [5.1.2600.2180] . . c:\windows\system32\mswsock.dll

[-] 2004-08-04 . 1B5F6923ABB450692E9FE0672C897AED . 17408 . . [6.00.2900.2180] . . c:\windows\system32\powrprof.dll

[-] 2004-08-04 . 0F78E27F563F2AAF74B91A49E2ABF19A . 180224 . . [5.1.2600.2180] . . c:\windows\system32\scecli.dll

[-] 2004-08-04 . E8A12A12EA9088B4327D49EDCA3ADD3E . 5120 . . [5.1.2600.2180] . . c:\windows\system32\sfc.dll

[-] 2004-08-04 . 8F078AE4ED187AAABC0A305146DE6716 . 14336 . . [5.1.2600.2180] . . c:\windows\system32\svchost.exe

[-] 2004-08-04 . 39B1FFB03C2296323832ACBAE50D2AFF . 24576 . . [5.1.2600.2180] . . c:\windows\system32\userinit.exe

[-] 2004-08-04 . 2ED0B7F12A60F90092081C50FA0EC2B2 . 82944 . . [5.1.2600.2180] . . c:\windows\system32\ws2_32.dll

[-] 2004-08-04 . 9BEACB911CA61E5881102188AB7FB431 . 19968 . . [5.1.2600.2180] . . c:\windows\system32\ws2help.dll

[-] 2007-07-22 . 1D23EB782291CB7D3ADB33C26EE9583B . 975360 . . [6.00.2900.3111] . . c:\windows\explorer.exe

[-] 2004-08-04 . 2EB58F9DCD6AB320B46744A4EA48B2D2 . 406528 . . [1.0420.2600.2180] . . c:\windows\system32\usp10.dll


[-] 2004-08-04 . EEF46DAB68229A14DA3D8E73C99E2959 . 129536 . . [5.1.2600.2180] . . c:\windows\system32\xmlprov.dll

[-] 2004-08-04 . 82B24CB70E5944E6E34662205A2A5B78 . 55808 . . [5.1.2600.2180] . . c:\windows\system32\eventlog.dll

[-] 2004-08-04 . 30A609E00BD1D4FFC49D6B5A432BE7F2 . 1580544 . . [5.1.2600.2180] . . c:\windows\system32\sfcfiles.dll

[-] 2004-08-04 . 24232996A38C0B0CF151C2140AE29FC8 . 15360 . . [5.1.2600.2180] . . c:\windows\system32\ctfmon.exe


[-] 2004-08-04 . 92360854316611F6CC471612213C3D92 . 190976 . . [5.1.2600.2180] . . c:\windows\system32\schedsvc.dll

[-] 2001-08-23 . 9859C0F6936E723E4892D7141B1327D5 . 11648 . . [5.1.2600.0] . . c:\windows\system32\drivers\acpiec.sys

[-] 2004-08-04 . 4448006B6BC60E6C027932CFC38D6855 . 29056 . . [5.1.2600.2180] . . c:\windows\system32\drivers\ip6fw.sys

[-] 2007-07-22 13:18 . C51B4A5C05A5475708E3C81C7765B71D . 27136 . . [11.0.5721.5145] . . c:\windows\system32\mspmsnsv.dll

[-] 2004-08-04 . 55E148C01296696588EAFA425782C3E8 . 367616 . . [5.3.2600.2180] . . c:\windows\system32\dsound.dll

[-] 2004-08-04 . D67BDBBDA86CC9AEEBBAF3217C1717D8 . 1689088 . . [5.03.2600.2180] . . c:\windows\system32\d3d9.dll

[-] 2004-08-04 . 7ED462F353B3D915A418A689FA881F96 . 266240 . . [5.03.2600.2180] . . c:\windows\system32\ddraw.dll

[-] 2004-08-04 01:56 . B48D3193DD1474DCBCC32BF4779AC698 . 83456 . . [5.1.2600.2180] . . c:\windows\system32\olepro32.dll

[-] 2004-08-04 . 96492C721C6EA517E2BFD5381FEF55E3 . 39936 . . [5.1.2600.2180] . . c:\windows\system32\perfctrs.dll

[-] 2004-08-04 . D38408967BE738D0C1B47005BCE8CEEB . 18944 . . [5.1.2600.2180] . . c:\windows\system32\version.dll

c:\windows\System32\drivers\beep.sys ... is missing !!
c:\windows\System32\wscntfy.exe ... is missing !!
c:\windows\System32\regsvc.dll ... is missing !!
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="g:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-06 2260480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ShStatEXE"="g:\program files\McAfee\VirusScan Enterprise\SHSTAT.EXE" [2007-02-23 112216]
"McAfeeUpdaterUI"="g:\program files\McAfee\Common Framework\UdaterUI.exe" [2006-12-19 136768]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"ShowDeskFix"="shell32" [X]
"nltide_3"="advpack.dll" [2009-03-08 128512]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk /r \??\g:\0autocheck autochk /r \??\g:\0autocheck autochk /r \??\g:\0autocheck autochk /r \??\G:\0autocheck autochk *

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"RemoveIT Pro v7Ent"=c:\program files\InCode Solutions\RemoveIT Pro v7 Enterprise\removeit.exe
"ctfmon.exe"=c:\windows\system32\ctfmon.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"g:\\Program\\Messenger\\YahooMessenger.exe"=
"g:\\Program Files\\McAfee\\Common Framework\\FrameworkService.exe"=
"g:\\Program Files\\Skype\\Phone\\Skype.exe"=


NETSVCS REQUIRES REPAIRS - current entries shown
6to4
AppMgmt
AudioSrv
Browser
CryptSvc
DMServer
DHCP
EventSystem
FastUserSwitchingCompatibility
HidServ
Ias
Iprip
Irmon
LanmanServer
LanmanWorkstation
Netman
Nla
NWCWorkstation
Nwsapagent
Rasauto
Rasman
Remoteaccess
Schedule
Seclogon
SENS
Sharedaccess
SRService
Tapisrv
Themes
UxTuneUp
WZCSVC
Wmi
WmdmPmSp
winmgmt
xmlprov
BITS
wuauserv
ShellHWDetection
WmdmPmSN

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs


[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A509B1FF-37FF-4bFF-8CFF-4F3A747040FF}]
2009-03-08 12:32 128512 -c--a-w- c:\windows\system32\advpack.dll
.
Contents of the 'Scheduled Tasks' folder

2010-12-25 c:\windows\Tasks\1-Click Maintenance.job
- g:\program\TuneUp\OneClick.exe [2008-01-08 20:31]

2011-01-07 c:\windows\Tasks\User_Feed_Synchronization-{EF573F16-43C3-426D-83B3-8B8212819493}.job
- c:\windows\system32\msfeedssync.exe [2008-09-11 12:31]

2011-01-07 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2010-12-19 06:18]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/
uInternet Settings,ProxyServer = 192.168.45.1:3128
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/def ... .yahoo.com
Trusted Zone: hotmail.com\www
Trusted Zone: mcafeegsl.com\www
Trusted Zone: msn.com\www
Trusted Zone: tune-up.com\www
Trusted Zone: yahoo.com\us.mg2.mail
Trusted Zone: yahoo.com\www
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2l3t523o.default\
FF - prefs.js: browser.startup.homepage - www.yahoo.com/
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - g:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Quick Starter: jqs@sun.com - g:\program files\lib\deploy\jqs\ff
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.notify.interval - 600000
FF - user.js: content.switch.threshold - 1000000
FF - user.js: nglayout.initialpaint.delay - 600
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-01-07 15:43
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-602162358-2025429265-1177238915-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,cf,11,38,fb,56,db,14,42,95,6c,ce,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,e8,30,c3,e3,18,f1,0c,4f,8f,ad,a3,\
"6256FFB019F8FDFBD36745B06F4540E9AEAF222A25"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,cf,11,38,fb,56,db,14,42,95,6c,ce,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(2504)
c:\windows\system32\WININET.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll
c:\windows\system32\ntshrui.dll
c:\windows\system32\msi.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2011-01-07 15:51:57
ComboFix-quarantined-files.txt 2011-01-07 23:51
ComboFix2.txt 2011-01-07 20:56

Pre-Run: 132,354,048 bytes free
Post-Run: 201,322,496 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 8271085B56301CE11B92E8661F2975A8

Update and Scan with

* Start MalwareBytes AntiMalware (Vista users must Right click and choose RunAs Admin)
* Please DO NOT run MBAM in Safe Mode unless requested to, you MUST run it in normal Windows mode.
o Update Malwarebytes' Anti-Malware
o Select the Update tab
o Click Update
* When the update is complete, select the Scanner tab
* Select Perform quick scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad. please copy and paste the log into your next reply
o If you accidently close it, the log file is saved here and will be named like this:
o C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 5475

Windows 5.1.2600 Service Pack 2
Internet Explorer 8.0.6001.18702

1/7/2011 10:10:54 PM
mbam-log-2011-01-07 (22-10-54).txt

Scan type: Quick scan
Objects scanned: 117793
Time elapsed: 13 minute(s), 56 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

I forgot to tell you i dont have notepad installed in my laptop can you tell me where to safely download it?? i cant see the ALL FILES selection in ms word....

You can download the reg file from here:

Right click the above link and save link as.

got an error at first but at the seccond time it ran finely...
========================================
ComboFix 11-01-08.03 - Administrator 01/09/2011 12:12:04.6.1 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1015.706 [GMT -8:00]
Running from: c:\documents and settings\Administrator\Desktop\cbf.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\regedit.exe . . . is infected!!

.
((((((((((((((((((((((((( Files Created from 2010-12-09 to 2011-01-09 )))))))))))))))))))))))))))))))
.

2011-01-09 03:27 . 2011-01-09 03:27 -------- dc-h--w- c:\windows\PIF
2011-01-09 03:04 . 2004-08-04 01:56 221184 -c--a-w- c:\windows\system32\wmpns.dll
2011-01-08 22:30 . 2011-01-08 22:47 -------- dc----w- c:\windows\system32\CatRoot_bak
2011-01-08 21:59 . 2009-04-02 07:02 604160 -c----w- c:\windows\system32\dllcache\wmspdmod.dll
2011-01-08 21:59 . 2009-10-21 05:50 75776 -c----w- c:\windows\system32\dllcache\strmfilt.dll
2011-01-08 21:59 . 2009-10-21 05:50 25088 -c----w- c:\windows\system32\dllcache\httpapi.dll
2011-01-08 21:59 . 2009-10-20 14:41 265728 -c----w- c:\windows\system32\dllcache\http.sys
2011-01-08 21:59 . 2010-02-24 12:48 457216 -c----w- c:\windows\system32\dllcache\mrxsmb.sys
2011-01-08 21:58 . 2009-10-12 13:54 112128 -c----w- c:\windows\system32\dllcache\rastls.dll
2011-01-08 21:58 . 2009-10-12 13:54 69632 -c----w- c:\windows\system32\dllcache\raschap.dll
2011-01-08 21:58 . 2008-07-07 20:06 253952 -c----w- c:\windows\system32\dllcache\es.dll
2011-01-08 21:57 . 2009-12-14 07:35 33280 -c----w- c:\windows\system32\dllcache\csrsrv.dll
2011-01-08 21:57 . 2009-06-10 06:26 134144 -c----w- c:\windows\system32\dllcache\wkssvc.dll
2011-01-08 21:56 . 2009-10-15 16:56 81920 -c----w- c:\windows\system32\dllcache\fontsub.dll
2011-01-08 21:56 . 2009-10-15 16:56 119808 -c----w- c:\windows\system32\dllcache\t2embed.dll
2011-01-08 21:56 . 2009-06-09 14:53 53248 -c----w- c:\windows\system32\dllcache\tsgqec.dll
2011-01-08 21:56 . 2009-06-09 14:53 290816 -c----w- c:\windows\system32\dllcache\rhttpaa.dll
2011-01-08 21:55 . 2009-06-09 14:53 2067968 -c----w- c:\windows\system32\dllcache\mstscax.dll
2011-01-08 21:55 . 2009-06-09 09:12 677888 -c----w- c:\windows\system32\dllcache\mstsc.exe
2011-01-08 21:55 . 2009-06-09 14:53 136192 -c----w- c:\windows\system32\dllcache\aaclient.dll
2011-01-08 21:55 . 2009-08-26 08:16 247326 -c----w- c:\windows\system32\dllcache\strmdll.dll
2011-01-08 21:53 . 2009-06-21 22:04 153088 -c----w- c:\windows\system32\dllcache\triedit.dll
2011-01-08 21:53 . 2009-05-07 15:44 344064 -c----w- c:\windows\system32\dllcache\localspl.dll
2011-01-08 21:52 . 2008-06-18 13:03 938496 -c----w- c:\windows\system32\dllcache\WMNetmgr.dll
2011-01-08 21:52 . 2008-06-18 09:09 100864 -c----w- c:\windows\system32\dllcache\logagent.exe
2011-01-08 21:50 . 2008-06-12 13:47 91648 -c----w- c:\windows\system32\dllcache\mtxoci.dll
2011-01-08 21:50 . 2008-06-12 13:47 66560 -c----w- c:\windows\system32\dllcache\mtxclu.dll
2011-01-08 21:50 . 2008-06-12 13:47 161792 -c----w- c:\windows\system32\dllcache\msdtcuiu.dll
2011-01-08 21:50 . 2008-06-12 13:47 956928 -c----w- c:\windows\system32\dllcache\msdtctm.dll
2011-01-08 21:50 . 2008-06-12 13:47 58880 -c----w- c:\windows\system32\dllcache\msdtclog.dll
2011-01-08 21:50 . 2008-06-12 13:47 428032 -c----w- c:\windows\system32\dllcache\msdtcprx.dll
2011-01-08 21:50 . 2009-09-04 20:45 58880 -c----w- c:\windows\system32\dllcache\msasn1.dll
2011-01-08 21:49 . 2009-07-17 18:55 58880 -c----w- c:\windows\system32\dllcache\atl.dll
2011-01-08 21:48 . 2008-05-08 12:14 203008 -c----w- c:\windows\system32\dllcache\rmcast.sys
2011-01-08 21:47 . 2010-05-02 07:09 1859968 -c----w- c:\windows\system32\dllcache\win32k.sys
2011-01-08 21:44 . 2008-07-03 13:16 8454656 -c----w- c:\windows\system32\dllcache\shell32.dll
2011-01-08 21:44 . 2009-10-13 10:45 270336 -c----w- c:\windows\system32\dllcache\oakley.dll
2011-01-08 21:43 . 2010-02-11 11:08 226880 -c----w- c:\windows\system32\dllcache\tcpip6.sys
2011-01-08 21:43 . 2008-06-20 10:44 360960 -c----w- c:\windows\system32\dllcache\tcpip.sys
2011-01-08 21:43 . 2008-06-20 17:36 245248 -c----w- c:\windows\system32\dllcache\mswsock.dll
2011-01-08 21:43 . 2008-06-20 17:36 147968 -c----w- c:\windows\system32\dllcache\dnsapi.dll
2011-01-08 21:43 . 2010-02-12 04:36 100864 -c----w- c:\windows\system32\dllcache\6to4svc.dll
2011-01-08 21:42 . 2010-01-29 14:45 1315840 -c----w- c:\windows\system32\dllcache\msoe.dll
2011-01-08 21:42 . 2010-01-29 14:45 683520 -c----w- c:\windows\system32\dllcache\inetcomm.dll
2011-01-08 21:42 . 2009-04-15 15:26 583168 -c----w- c:\windows\system32\dllcache\rpcrt4.dll
2011-01-08 21:42 . 2010-04-06 12:52 2462720 -c----w- c:\windows\system32\dllcache\WMVCore.dll
2011-01-08 21:41 . 2010-02-05 18:14 1291776 -c----w- c:\windows\system32\dllcache\quartz.dll
2010-12-26 01:37 . 2009-12-24 07:05 177664 -c----w- c:\windows\system32\dllcache\wintrust.dll
2010-12-19 11:21 . 2008-06-20 10:44 138368 ----a-w- c:\windows\system32\drivers\afd.sys
2010-12-19 11:21 . 2008-06-20 10:44 138368 ----a-w- c:\windows\system32\dllcache\afd.sys
2010-12-19 11:20 . 2007-07-22 13:16 332928 ----a-w- c:\windows\system32\drivers\srv.sys
2010-12-19 11:18 . 2004-08-04 01:56 616960 ----a-w- c:\windows\system32\advapi32.dll
2010-12-19 11:18 . 2007-07-24 20:11 2059392 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-12-19 11:18 . 2007-07-22 13:15 2182144 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-12-19 11:18 . 2004-08-04 01:56 108032 ----a-w- c:\windows\system32\services.exe
2010-12-19 11:18 . 2004-08-04 01:56 708096 ----a-w- c:\windows\system32\ntdll.dll
2010-12-19 11:10 . 2010-02-11 11:08 226880 -c--a-w- c:\windows\system32\drivers\tcpip6.sys
2010-12-19 11:10 . 2008-06-20 10:44 360960 -c--a-w- c:\windows\system32\drivers\tcpip.sys
2010-12-19 02:05 . 2010-12-19 02:05 -------- dc----w- c:\windows\system32\KB905474
2010-12-17 04:10 . 2010-12-17 04:10 -------- d-----w- c:\windows\system32\wbem\snmp
2010-12-17 04:10 . 2010-12-17 04:10 -------- dc----w- c:\windows\system32\xircom
2010-12-17 04:10 . 2010-12-17 04:10 -------- dc----w- c:\windows\srchasst
2010-12-17 04:10 . 2010-12-17 04:10 -------- dc----w- c:\program files\microsoft frontpage
2010-12-16 06:32 . 2007-07-24 20:09 140288 -c--a-w- c:\windows\system32\sfc_os.dll
2010-12-16 03:59 . 2007-07-24 20:09 140288 -c--a-w- c:\windows\system32\dllcache\sfc_os.dll
2010-12-15 02:21 . 2010-12-15 02:21 -------- dc----w- c:\program files\Microsoft Works
2010-12-15 02:20 . 2010-12-15 02:20 -------- dc----w- c:\program files\MSBuild
2010-12-12 02:04 . 2010-12-12 02:04 -------- dc----w- c:\windows\ServicePackFiles
2010-12-10 22:16 . 2011-01-09 03:00 -------- dc----w- c:\documents and settings\Default User
2010-12-10 22:13 . 2010-02-24 12:48 457216 -c--a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-12-10 21:56 . 2008-05-08 12:14 203008 -c--a-w- c:\windows\system32\drivers\rmcast.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-12-21 02:09 . 2010-10-25 02:44 38224 -c--a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-12-21 02:08 . 2010-10-25 02:44 20952 -c--a-w- c:\windows\system32\drivers\mbam.sys
2010-12-04 02:59 . 2010-12-04 02:48 5310 -c--a-w- c:\windows\BricoPackFoldersDelete.cmd
2010-12-04 02:59 . 2010-12-04 02:59 46273 -c--a-w- c:\windows\BricoPackUninst.cmd
2010-12-04 02:59 . 2007-07-24 20:09 218624 -c--a-w- c:\windows\system32\uxtheme.dll
2010-12-01 17:22 . 2010-12-01 17:22 306432 -c--a-w- c:\windows\system32\TuneUpDefragService.exe
2010-11-01 01:47 . 2010-11-01 01:48 73728 -c--a-w- c:\windows\system32\javacpl.cpl
2010-11-01 01:47 . 2010-11-01 01:48 472808 -c--a-w- c:\windows\system32\deployJava1.dll
.

------- Sigcheck -------

[-] 2004-08-03 . CDFE4411A69C224BD1D11B2DA92DAC51 . 95360 . . [5.1.2600.2180] . . c:\windows\system32\drivers\atapi.sys

[-] 2004-08-04 . 02000ABF34AF4C218C35D257024807D6 . 14336 . . [5.1.2600.2180] . . c:\windows\system32\drivers\asyncmac.sys


[-] 2004-08-03 . EBDEE8A2EE5393890A1ACEE971C4C246 . 24576 . . [5.1.2600.2180] . . c:\windows\system32\drivers\kbdclass.sys

[-] 2004-08-04 . 558635D3AF1C7546D26067D5D9B6959E . 182912 . . [5.1.2600.2180] . . c:\windows\system32\drivers\ndis.sys

[-] 2001-08-23 . 73C1E1F395918BC2C6DD67AF7591A3AD . 2944 . . [5.1.2600.0] . . c:\windows\system32\drivers\null.sys

[-] 2004-08-04 . 84885F9B82F4D55C6146EBF6065D75D2 . 13312 . . [5.1.2600.2180] . . c:\windows\system32\lsass.exe

[-] 2004-08-04 . C6CE6EEC82F187615D1002BB3BB50ED4 . 108032 . . [5.1.2600.2180] . . c:\windows\system32\services.exe

[-] 2004-08-04 . 01C3346C241652F43AED8E2149881BFE . 502272 . . [5.1.2600.2180] . . c:\windows\system32\winlogon.exe

[-] 2004-08-04 . 87CA7CE6469577F059297B9D6556D66D . 110080 . . [5.1.2600.2180] . . c:\windows\system32\imm32.dll

[-] 2004-08-04 . 74D66B3DE265E8789153414E75175F26 . 22016 . . [5.1.2600.2180] . . c:\windows\system32\lpk.dll

[-] 2004-08-04 . 1B5F6923ABB450692E9FE0672C897AED . 17408 . . [6.00.2900.2180] . . c:\windows\system32\powrprof.dll

[-] 2004-08-04 . 0F78E27F563F2AAF74B91A49E2ABF19A . 180224 . . [5.1.2600.2180] . . c:\windows\system32\scecli.dll

[-] 2004-08-04 . E8A12A12EA9088B4327D49EDCA3ADD3E . 5120 . . [5.1.2600.2180] . . c:\windows\system32\sfc.dll

[-] 2004-08-04 . 8F078AE4ED187AAABC0A305146DE6716 . 14336 . . [5.1.2600.2180] . . c:\windows\system32\svchost.exe

[-] 2004-08-04 . 39B1FFB03C2296323832ACBAE50D2AFF . 24576 . . [5.1.2600.2180] . . c:\windows\system32\userinit.exe

[-] 2004-08-04 . 2ED0B7F12A60F90092081C50FA0EC2B2 . 82944 . . [5.1.2600.2180] . . c:\windows\system32\ws2_32.dll

[-] 2004-08-04 . 9BEACB911CA61E5881102188AB7FB431 . 19968 . . [5.1.2600.2180] . . c:\windows\system32\ws2help.dll

[-] 2007-07-22 . 1D23EB782291CB7D3ADB33C26EE9583B . 975360 . . [6.00.2900.3111] . . c:\windows\explorer.exe

[-] 2004-08-04 . 2EB58F9DCD6AB320B46744A4EA48B2D2 . 406528 . . [1.0420.2600.2180] . . c:\windows\system32\usp10.dll


[-] 2004-08-04 . EEF46DAB68229A14DA3D8E73C99E2959 . 129536 . . [5.1.2600.2180] . . c:\windows\system32\xmlprov.dll

[-] 2004-08-04 . 82B24CB70E5944E6E34662205A2A5B78 . 55808 . . [5.1.2600.2180] . . c:\windows\system32\eventlog.dll

[-] 2004-08-04 . 30A609E00BD1D4FFC49D6B5A432BE7F2 . 1580544 . . [5.1.2600.2180] . . c:\windows\system32\sfcfiles.dll

[-] 2004-08-04 . 24232996A38C0B0CF151C2140AE29FC8 . 15360 . . [5.1.2600.2180] . . c:\windows\system32\ctfmon.exe


[-] 2004-08-04 . 92360854316611F6CC471612213C3D92 . 190976 . . [5.1.2600.2180] . . c:\windows\system32\schedsvc.dll

[-] 2001-08-23 . 9859C0F6936E723E4892D7141B1327D5 . 11648 . . [5.1.2600.0] . . c:\windows\system32\drivers\acpiec.sys

[-] 2004-08-04 . 4448006B6BC60E6C027932CFC38D6855 . 29056 . . [5.1.2600.2180] . . c:\windows\system32\drivers\ip6fw.sys

[-] 2007-07-22 13:18 . C51B4A5C05A5475708E3C81C7765B71D . 27136 . . [11.0.5721.5145] . . c:\windows\system32\mspmsnsv.dll

[-] 2004-08-04 . 55E148C01296696588EAFA425782C3E8 . 367616 . . [5.3.2600.2180] . . c:\windows\system32\dsound.dll

[-] 2004-08-04 . D67BDBBDA86CC9AEEBBAF3217C1717D8 . 1689088 . . [5.03.2600.2180] . . c:\windows\system32\d3d9.dll

[-] 2004-08-04 . 7ED462F353B3D915A418A689FA881F96 . 266240 . . [5.03.2600.2180] . . c:\windows\system32\ddraw.dll

[-] 2004-08-04 01:56 . B48D3193DD1474DCBCC32BF4779AC698 . 83456 . . [5.1.2600.2180] . . c:\windows\system32\olepro32.dll

[-] 2004-08-04 . 96492C721C6EA517E2BFD5381FEF55E3 . 39936 . . [5.1.2600.2180] . . c:\windows\system32\perfctrs.dll

[-] 2004-08-04 . D38408967BE738D0C1B47005BCE8CEEB . 18944 . . [5.1.2600.2180] . . c:\windows\system32\version.dll

c:\windows\System32\drivers\beep.sys ... is missing !!
c:\windows\System32\wscntfy.exe ... is missing !!
c:\windows\System32\regsvc.dll ... is missing !!
.
((((((((((((((((((((((((((((( SnapShot_2011-01-09_02.53.14 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-01-09 19:24 . 2011-01-09 19:24 16384 c:\windows\Temp\Perflib_Perfdata_70.dat
+ 2007-07-22 13:16 . 2009-06-09 14:53 53248 c:\windows\system32\tsgqec.dll
+ 2004-08-04 01:56 . 2009-10-21 05:50 75776 c:\windows\system32\strmfilt.dll
- 2004-08-04 01:56 . 2004-08-04 01:56 75776 c:\windows\system32\strmfilt.dll
- 2004-08-04 01:56 . 2004-08-04 01:56 69632 c:\windows\system32\raschap.dll
+ 2004-08-04 01:56 . 2009-10-12 13:54 69632 c:\windows\system32\raschap.dll
- 2008-09-11 22:28 . 2007-07-22 13:15 91648 c:\windows\system32\mtxoci.dll
+ 2008-09-11 22:28 . 2008-06-12 13:47 91648 c:\windows\system32\mtxoci.dll
- 2007-07-22 13:15 . 2007-07-22 13:15 66560 c:\windows\system32\mtxclu.dll
+ 2007-07-22 13:15 . 2008-06-12 13:47 66560 c:\windows\system32\mtxclu.dll
- 2008-09-11 22:28 . 2007-07-22 13:15 58880 c:\windows\system32\msdtclog.dll
+ 2008-09-11 22:28 . 2008-06-12 13:47 58880 c:\windows\system32\msdtclog.dll
+ 2004-08-04 01:56 . 2009-09-04 20:45 58880 c:\windows\system32\msasn1.dll
+ 2004-08-04 01:56 . 2009-10-21 05:50 25088 c:\windows\system32\httpapi.dll
+ 2007-07-22 13:31 . 2009-10-15 16:56 81920 c:\windows\system32\fontsub.dll
+ 2004-08-04 01:56 . 2009-12-14 07:35 33280 c:\windows\system32\csrsrv.dll
- 2004-08-04 01:56 . 2004-08-04 01:56 58880 c:\windows\system32\atl.dll
+ 2004-08-04 01:56 . 2009-07-17 18:55 58880 c:\windows\system32\atl.dll
+ 2007-07-22 13:31 . 2009-04-15 09:24 351744 c:\windows\system32\xpsp3res.dll
+ 2007-07-22 13:19 . 2009-04-02 07:02 604160 c:\windows\system32\wmspdmod.dll
+ 2007-07-22 13:19 . 2009-07-14 07:43 286208 c:\windows\system32\wmpdxm.dll
+ 2007-07-22 13:19 . 2008-06-18 13:03 938496 c:\windows\system32\WMNetmgr.dll
+ 2007-07-22 13:17 . 2009-06-10 06:26 134144 c:\windows\system32\wkssvc.dll
+ 2004-08-04 01:56 . 2009-08-25 09:47 352256 c:\windows\system32\winhttp.dll
+ 2007-07-22 13:16 . 2010-03-10 06:15 420352 c:\windows\system32\vbscript.dll
- 2007-07-22 13:16 . 2009-03-08 12:33 420352 c:\windows\system32\vbscript.dll
+ 2007-07-22 13:16 . 2009-10-15 16:56 119808 c:\windows\system32\t2embed.dll
+ 2007-07-22 13:16 . 2009-08-26 08:16 247326 c:\windows\system32\strmdll.dll
- 2007-07-22 13:16 . 2007-07-22 13:16 474112 c:\windows\system32\shlwapi.dll
+ 2007-07-22 13:16 . 2009-12-08 08:59 474112 c:\windows\system32\shlwapi.dll
+ 2007-07-22 13:16 . 2009-04-15 15:26 583168 c:\windows\system32\rpcrt4.dll
+ 2007-07-22 13:16 . 2009-06-09 14:53 290816 c:\windows\system32\rhttpaa.dll
+ 2004-08-04 01:56 . 2009-10-12 13:54 112128 c:\windows\system32\rastls.dll
- 2004-08-04 01:56 . 2004-08-04 01:56 112128 c:\windows\system32\rastls.dll
- 2007-07-22 13:15 . 2007-07-22 13:15 270336 c:\windows\system32\oakley.dll
+ 2007-07-22 13:15 . 2009-10-13 10:45 270336 c:\windows\system32\oakley.dll
+ 2004-08-04 01:56 . 2008-06-20 17:36 245248 c:\windows\system32\mswsock.dll
- 2004-08-04 01:56 . 2004-08-04 01:56 245248 c:\windows\system32\mswsock.dll
+ 2008-09-11 22:28 . 2009-06-09 09:12 677888 c:\windows\system32\mstsc.exe
- 2008-09-11 22:28 . 2007-07-22 13:15 161792 c:\windows\system32\msdtcuiu.dll
+ 2008-09-11 22:28 . 2008-06-12 13:47 161792 c:\windows\system32\msdtcuiu.dll
- 2008-09-11 22:28 . 2007-07-22 13:15 956928 c:\windows\system32\msdtctm.dll
+ 2008-09-11 22:28 . 2008-06-12 13:47 956928 c:\windows\system32\msdtctm.dll
+ 2008-09-11 22:28 . 2008-06-12 13:47 428032 c:\windows\system32\msdtcprx.dll
- 2007-07-22 13:18 . 2007-07-22 13:18 100864 c:\windows\system32\logagent.exe
+ 2007-07-22 13:18 . 2008-06-18 09:09 100864 c:\windows\system32\logagent.exe
+ 2004-08-04 01:56 . 2009-05-07 15:44 344064 c:\windows\system32\localspl.dll
- 2008-09-11 15:06 . 2010-12-04 04:33 256656 c:\windows\system32\FNTCACHE.DAT
+ 2008-09-11 15:06 . 2011-01-09 03:15 256656 c:\windows\system32\FNTCACHE.DAT
+ 2007-07-22 13:13 . 2008-07-07 20:06 253952 c:\windows\system32\es.dll
+ 2007-07-22 13:14 . 2009-10-20 14:41 265728 c:\windows\system32\drivers\http.sys
+ 2007-07-22 13:13 . 2008-06-20 17:36 147968 c:\windows\system32\dnsapi.dll
+ 2009-07-14 07:43 . 2009-07-14 07:43 286208 c:\windows\system32\dllcache\wmpdxm.dll
+ 2009-01-08 02:20 . 2009-12-08 08:59 474112 c:\windows\system32\dllcache\shlwapi.dll
- 2009-01-08 02:20 . 2009-01-08 02:20 474112 c:\windows\system32\dllcache\shlwapi.dll
+ 2007-07-22 13:13 . 2009-06-09 14:53 136192 c:\windows\system32\aaclient.dll
+ 2007-07-22 13:13 . 2010-02-12 04:36 100864 c:\windows\system32\6to4svc.dll
+ 2011-01-08 21:59 . 2010-02-24 12:48 457216 c:\windows\Driver Cache\i386\mrxsmb.sys
+ 2011-01-08 21:59 . 2009-10-20 14:41 265728 c:\windows\Driver Cache\i386\http.sys
+ 2007-07-22 13:31 . 2008-07-03 13:16 8454656 c:\windows\system32\shell32.dll
+ 2008-09-11 22:28 . 2009-06-09 14:53 2067968 c:\windows\system32\mstscax.dll
+ 2007-07-22 13:19 . 2009-07-14 07:43 10841088 c:\windows\system32\wmp.dll
+ 2009-07-14 07:43 . 2009-07-14 07:43 10841088 c:\windows\system32\dllcache\wmp.dll
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="g:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-06 2260480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ShStatEXE"="g:\program files\McAfee\VirusScan Enterprise\SHSTAT.EXE" [2007-02-23 112216]
"McAfeeUpdaterUI"="g:\program files\McAfee\Common Framework\UdaterUI.exe" [2006-12-19 136768]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"ShowDeskFix"="shell32" [X]
"nltide_3"="advpack.dll" [2009-03-08 128512]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk /r \??\g:\0autocheck autochk /r \??\g:\0autocheck autochk /r \??\g:\0autocheck autochk /r \??\G:\0autocheck autochk *

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"RemoveIT Pro v7Ent"=c:\program files\InCode Solutions\RemoveIT Pro v7 Enterprise\removeit.exe
"ctfmon.exe"=c:\windows\system32\ctfmon.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"g:\\Program\\Messenger\\YahooMessenger.exe"=
"g:\\Program Files\\McAfee\\Common Framework\\FrameworkService.exe"=
"g:\\Program Files\\Skype\\Phone\\Skype.exe"=


NETSVCS REQUIRES REPAIRS - current entries shown
6to4
AppMgmt
AudioSrv
Browser
CryptSvc
DMServer
DHCP
EventSystem
FastUserSwitchingCompatibility
HidServ
Ias
Iprip
Irmon
LanmanServer
LanmanWorkstation
Netman
Nla
NWCWorkstation
Nwsapagent
Rasauto
Rasman
Remoteaccess
Schedule
Seclogon
SENS
Sharedaccess
SRService
Tapisrv
Themes
UxTuneUp
WZCSVC
Wmi
WmdmPmSp
winmgmt
xmlprov
BITS
wuauserv
ShellHWDetection
WmdmPmSN

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs


[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A509B1FF-37FF-4bFF-8CFF-4F3A747040FF}]
2009-03-08 12:32 128512 -c--a-w- c:\windows\system32\advpack.dll
.
Contents of the 'Scheduled Tasks' folder

2011-01-08 c:\windows\Tasks\1-Click Maintenance.job
- g:\program\TuneUp\OneClick.exe [2008-01-08 20:31]

2011-01-09 c:\windows\Tasks\User_Feed_Synchronization-{EF573F16-43C3-426D-83B3-8B8212819493}.job
- c:\windows\system32\msfeedssync.exe [2008-09-11 12:31]

2011-01-09 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2010-12-19 06:18]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/
uInternet Settings,ProxyServer = 192.168.45.1:3128
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/def ... .yahoo.com
Trusted Zone: hotmail.com\www
Trusted Zone: mcafeegsl.com\www
Trusted Zone: msn.com\www
Trusted Zone: tune-up.com\www
Trusted Zone: yahoo.com\us.mg2.mail
Trusted Zone: yahoo.com\www
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2l3t523o.default\
FF - prefs.js: browser.startup.homepage - www.yahoo.com/
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - g:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Quick Starter: jqs@sun.com - g:\program files\lib\deploy\jqs\ff
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.notify.interval - 600000
FF - user.js: content.switch.threshold - 1000000
FF - user.js: nglayout.initialpaint.delay - 600
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-01-09 12:17
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-602162358-2025429265-1177238915-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,cf,11,38,fb,56,db,14,42,95,6c,ce,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,e8,30,c3,e3,18,f1,0c,4f,8f,ad,a3,\
"6256FFB019F8FDFBD36745B06F4540E9AEAF222A25"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,cf,11,38,fb,56,db,14,42,95,6c,ce,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(3456)
c:\windows\system32\WININET.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll
c:\windows\system32\ntshrui.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2011-01-09 12:22:35
ComboFix-quarantined-files.txt 2011-01-09 20:22
ComboFix2.txt 2011-01-09 03:00
ComboFix3.txt 2011-01-08 07:24
ComboFix4.txt 2011-01-08 07:02
ComboFix5.txt 2011-01-09 20:09

Pre-Run: 80,850,944 bytes free
Post-Run: 146,866,176 bytes free

- - End Of File - - 55ED62BF68AA569C9F540D32F626DACF

edgondoy

Did you download and run both VArestorepolicies.inf and FixPolicies.exe?

Have you been running any other removal tools or programs?

I only ask because the following files are now missing:
c:\windows\System32\drivers\beep.sys ... is missing !!
c:\windows\System32\wscntfy.exe ... is missing !!
c:\windows\System32\regsvc.dll ... is missing !!

And
c:\windows\regedit.exe . . . is infected!!

yes i have downloaded and ran both... i regularly run both spybot s&d and malwarebytes daily and mcaffee automatically runs by itself..
----------------------------------------------------------------
just recently i research my computer and i found all the missing file in the Qoobox folder and i think its a part of combofix... it mustve happened when i ran combofix some few times.. is it not good to ran combofix without your consent? i apologize i panicked when it ran really slow some few days ago..i would be glad to post the logs if you like.

edgondoy,

If those files are in Qoobox folder than chances are they are in fact infected.

Please download and extract the following file. Then double click on it to merge it into the Registry.

Then run Combox fix again and post the new log