# No desktop-icons( security system and programs not working)



## seemacima (Jul 16, 2011)

Hello,My desktop and program files just dissappered.I tried to fix it by ready in forums by unhiding it and then attempted to use the malware program and found soem infected files. now the icons program fiels are back but my Mcafee total protection system is not working it jusy brings a blank screen when i open also I am unable to print any doc. seems my progam are still not working properly.It was written soem where to first do a clean boot for this howwver i am unable to do that also. Please help I spend 6 hrs yesterday for this


----------



## seemacima (Jul 16, 2011)

I am now trying to re do the whole process again running malware again..I count do clean boot before that though.Attempted to DL the file for guided help but when i tried to DL and click user agrrement it wnt let me do it.Pleae help...


----------



## seemacima (Jul 16, 2011)

this is the long after malware deleted infected filesMalwarebytes' Anti-Malware 1.51.1.1800www.malwarebytes.orgDatabase version: 7153Windows 5.1.2600 Service Pack 3Internet Explorer 8.0.6001.187027/15/2011 6:23:01 PMmbam-log-2011-07-15 (18-23-01).txtScan type: Full scan (A:\|C:\|D:\|E:\|)Objects scanned: 139650Time elapsed: 2 hour(s), 3 minute(s), 0 second(s)Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 10Registry Values Infected: 0Registry Data Items Infected: 0Folders Infected: 0Files Infected: 1Memory Processes InfectedNo malicious items detected)Memory Modules InfectedNo malicious items detected)Registry Keys Infected:HKEY_CLASSES_ROOT\CLSID\{147A976F-EEE1-4377-8EA7-4716E4CDD239} (Adware.MyWebSearch) -> Quarantined and deleted successfully.HKEY_CLASSES_ROOT\CLSID\{2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} (Adware.Minibug) -> Quarantined and deleted successfully.HKEY_CLASSES_ROOT\TypeLib\{3C2D2A1E-031F-4397-9614-87C932A848E0} (Adware.Minibug) -> Quarantined and deleted successfully.HKEY_CLASSES_ROOT\Interface\{04A38F6B-006F-4247-BA4C-02A139D5531C} (Adware.Minibug) -> Quarantined and deleted successfully.HKEY_CLASSES_ROOT\MiniBugTransporter.MiniBugTransporterX.1 (Adware.Minibug) -> Quarantined and deleted successfully.HKEY_CLASSES_ROOT\MiniBugTransporter.MiniBugTransporterX (Adware.Minibug) -> Quarantined and deleted successfully.HKEY_CLASSES_ROOT\CLSID\{A4730EBE-43A6-443e-9776-36915D323AD3} (Adware.MyWebSearch) -> Quarantined and deleted successfully.HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} (Adware.MyWebSearch) -> Quarantined and deleted successfully.HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} (Adware.MyWebSearch) -> Quarantined and deleted successfully.HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467e-B8D4-7786EDA79AE0} (Trojan.Vundo) -> Quarantined and deleted successfully.Registry Values InfectedNo malicious items detected)Registry Data Items InfectedNo malicious items detected)Folders InfectedNo malicious items detected)Files Infected:c:\documents and settings\all users\application data\fbnaoyjjdpw.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.


----------



## seemacima (Jul 16, 2011)

now basically my virus scan Mcafee not working and seems several others are also not wotrking..i tried to do system restore afetr deletdd files but when i try to do it system restore screen is white..same thing happens when i try to open my Mcafee security/./ in addition to all that sytem is very slow and freezes....I have seval doc. that i really cant loose..I have virus system and also OL nbacking system still it happend dnt understand why....All i know is yesterday a fake warning came and i was keep X in it out and then i turn of system and next time when i open all my icos were gone.I tried to do what was written in this post....http://forums.techguy.org/virus-other-malware-removal/1006341-no-desktop-2.html


----------



## seemacima (Jul 16, 2011)

I gave up I tried all what was said in other post.now my security McAfee doesn't work and now system restore also dnt work and system is slow.

I hope someone can help me thus is my first time here .


----------



## seemacima (Jul 16, 2011)

Bumping the thread.not sure about rules new to forum.not sure what else to do.


----------



## seemacima (Jul 16, 2011)

seems like i was supposed to post this log....Logfile of Trend Micro HijackThis v2.0.4Scan saved at 3:01:23 PM, on 7/17/2011Platform: Windows XP SP3 (WinNT 5.01.2600)MSIE: Internet Explorer v8.00 (8.00.6001.18702)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exeC:\Program Files\Bonjour\mDNSResponder.exeC:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exeC:\Program Files\Java\jre6\bin\jqs.exeC:\Program Files\Maxtor\Maxtor Backup\MaxBackServiceInt.exeC:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exeC:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exeC:\WINDOWS\system32\mfevtps.exeC:\Program Files\McAfee Online Backup\MOBKbackup.exeC:\Program Files\McAfee\MPF\MPFSrv.exeC:\Program Files\McAfee\MSK\MskSrver.exeC:\Program Files\Maxtor\OneTouch\Utils\SyncServices.exeC:\WINDOWS\System32\nvsvc32.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXEC:\WINDOWS\system32\PSIService.exeC:\Program Files\Common Files\Protexis\License Service\PsiService_2.exeC:\Program Files\Microsoft\BingBar\SeaPort.EXEC:\WINDOWS\System32\svchost.exeC:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXEC:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exeC:\Program Files\Common Files\McAfee\SystemCore\mfefire.exeC:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exeC:\PROGRA~1\VIRTUA~1\CitiVAN.exeC:\Program Files\QuickTime\QTTask.exeC:\Program Files\Common Files\Corel\Standby\Standby.exeC:\Program Files\Common Files\Java\Java Update\jusched.exeC:\Program Files\iTunes\iTunesHelper.exeC:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exeC:\Program Files\Messenger\msmsgs.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exeC:\WINDOWS\system32\OBroker.exeC:\Program Files\McAfee Online Backup\MOBKstat.exeC:\ScanPanel\ScnPanel.exeC:\WINDOWS\system32\rundll32.exeC:\PROGRA~1\McAfee\MSM\McSmtFwk.exeC:\Program Files\iPod\bin\iPodService.exeC:\WINDOWS\system32\restore\rstrui.exeC:\PROGRA~1\COMMON~1\McAfee\MSC\McUICnt.exeC:\WINDOWS\system32\restore\rstrui.exeC:\WINDOWS\system32\restore\rstrui.exeC:\WINDOWS\system32\restore\rstrui.exec:\PROGRA~1\mcafee.com\agent\mcagent.exeC:\Program Files\Common Files\Java\Java Update\jucheck.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Common Files\McAfee\SystemCore\mcshield.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Documents and Settings\prakash1\Desktop\receipe\HijackThis.exeC:\WINDOWS\system32\wuauclt.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/?fr=fp-yie8R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.htmlR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.htmlR0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.comR1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://mail.google.com/mail/R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Yahoo!R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 210.212.123.10:8080R3 - URLSearchHook: UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dllR3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn7\yt.dllO2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn7\yt.dllO2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dllO2 - BHO: Virtual Account Numbers Helper - {17424104-1444-4810-85D7-B4DA413C5A9A} - C:\Program Files\Virtual Account Numbers\CitiVANHelper.dllO2 - BHO: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\progra~1\mcafee\msk\mskapbho.dll (file missing)O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20110520185530.dll (file missing)O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dllO2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dllO2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dllO2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dllO2 - BHO: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "C:\Program Files\Microsoft\BingBar\BingExt.dll" (file missing)O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dllO2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dllO2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dllO2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn7\YTSingleInstance.dllO3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn7\yt.dllO3 - Toolbar: TurboTax ItsDeductible - {35CE0AE2-3411-4BB8-A16A-BEE30B282A26} - C:\Program Files\Intuit\IDO\IDOToolbar.dllO3 - Toolbar: Virtual Account Numbers - {7A21A046-B886-4A62-9D69-EF2059B0A27B} - C:\Program Files\Virtual Account Numbers\CitiVANToolbar.dllO3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dllO3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dllO3 - Toolbar: Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files\Microsoft\BingBar\BingExt.dll" (file missing)O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dllO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [Citi Virtual Account Numbers] C:\PROGRA~1\VIRTUA~1\CitiVAN.exe /lang=en_RG /dontopenmycardsO4 - HKLM\..\Run: [mcui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkeyO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottimeO4 - HKLM\..\Run: [Microsoft Default Manager] "C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resumeO4 - HKLM\..\Run: [Corel File Shell Monitor] C:\Program Files\Corel\Corel PaintShop Photo Pro\X3\PSPClassic\CorelIOMonitor.exeO4 - HKLM\..\Run: [Standby] "C:\Program Files\Common Files\Corel\Standby\Standby.exe" -STARTO4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exeO4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttrayO4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /backgroundO4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"O4 - HKCU\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe"O4 - HKCU\..\Run: [Corel Photo Downloader] "C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" -startupO4 - HKUS\S-1-5-18\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit (User 'SYSTEM')O4 - HKUS\.DEFAULT\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit (User 'Default user')O4 - Global Startup: McAfee Online Backup Status.lnk = C:\Program Files\McAfee Online Backup\MOBKstat.exeO4 - Global Startup: ScanPanel.lnk = C:\ScanPanel\ScnPanel.exeO8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.htmlO9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dllO9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dllO9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLLO9 - Extra button: TurboTax ItsDeductible - {A26ABCF0-1C8F-46e7-A67C-0489DC21B9CC} - C:\Program Files\Intuit\IDO\IDOToolbar.dllO9 - Extra 'Tools' menuitem: TurboTax ItsDeductible - {A26ABCF0-1C8F-46e7-A67C-0489DC21B9CC} - C:\Program Files\Intuit\IDO\IDOToolbar.dllO9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO16 - DPF: Garmin Internet Explorer Plug-In - https://my.garmin.com/mygarmin/m/GarminAxControl.CABO16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,84/mcinsctl.cabO16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.winkflash.com/photo/loaders/ImageUploader4.cabO16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - http://gfx1.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cabO18 - Protocol: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dllO18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dllO22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dllO22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dllO23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exeO23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exeO23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exeO23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exeO23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exeO23 - Service: Intuit Update Service (IntuitUpdateService) - Intuit Inc. - C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exeO23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exeO23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exeO23 - Service: MaxBackServiceInt - Unknown owner - C:\Program Files\Maxtor\Maxtor Backup\MaxBackServiceInt.exeO23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exeO23 - Service: McAfee SiteAdvisor Service - McAfee, Inc. - C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exeO23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exeO23 - Service: McAfee VirusScan Announcer (McNaiAnn) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exeO23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exeO23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\mcods.exeO23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exeO23 - Service: McShield - McAfee, Inc. - C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exeO23 - Service: McAfee Firewall Core Service (mfefire) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exeO23 - Service: McAfee Validation Trust Protection Service (mfevtp) - McAfee, Inc. - C:\WINDOWS\system32\mfevtps.exeO23 - Service: McAfee Online Backup (MOBKbackup) - McAfee, Inc. - C:\Program Files\McAfee Online Backup\MOBKbackup.exeO23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exeO23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exeO23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exeO23 - Service: MaxSyncService (NTService1) - - C:\Program Files\Maxtor\OneTouch\Utils\SyncServices.exeO23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exeO23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exeO23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXEO23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exeO23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exeO23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Unknown owner - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe (file missing)O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exeO23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exeO23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe--End of file - 15888 bytes


----------



## seemacima (Jul 16, 2011)

this is the dds logDDS (Ver_2011-07-14.01) - NTFS_x86 Internet Explorer: 8.0.6001.18702Run by prakash1 at 15:10:53 on 2011-07-17Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1023.468 [GMT -7:00].AV: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}FW: McAfee Firewall *Enabled* .============== Running Processes ================.C:\WINDOWS\system32\spoolsv.exeC:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exeC:\Program Files\Bonjour\mDNSResponder.exeC:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exeC:\Program Files\Java\jre6\bin\jqs.exeC:\Program Files\Maxtor\Maxtor Backup\MaxBackServiceInt.exeC:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exeC:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exeC:\WINDOWS\system32\mfevtps.exeC:\Program Files\McAfee Online Backup\MOBKbackup.exeC:\Program Files\McAfee\MPF\MPFSrv.exeC:\Program Files\McAfee\MSK\MskSrver.exeC:\Program Files\Maxtor\OneTouch\Utils\SyncServices.exeC:\WINDOWS\System32\nvsvc32.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXEC:\WINDOWS\system32\PSIService.exeC:\Program Files\Common Files\Protexis\License Service\PsiService_2.exeC:\Program Files\Microsoft\BingBar\SeaPort.EXEC:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXEC:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exeC:\Program Files\Common Files\McAfee\SystemCore\mfefire.exeC:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exeC:\PROGRA~1\VIRTUA~1\CitiVAN.exeC:\Program Files\QuickTime\QTTask.exeC:\Program Files\Common Files\Corel\Standby\Standby.exeC:\Program Files\Common Files\Java\Java Update\jusched.exeC:\Program Files\iTunes\iTunesHelper.exeC:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exeC:\Program Files\Messenger\msmsgs.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exeC:\WINDOWS\system32\OBroker.exeC:\Program Files\McAfee Online Backup\MOBKstat.exeC:\ScanPanel\ScnPanel.exeC:\WINDOWS\system32\rundll32.exeC:\WINDOWS\System32\alg.exeC:\PROGRA~1\McAfee\MSM\McSmtFwk.exeC:\Program Files\iPod\bin\iPodService.exeC:\WINDOWS\system32\restore\rstrui.exeC:\PROGRA~1\COMMON~1\McAfee\MSC\McUICnt.exeC:\WINDOWS\system32\restore\rstrui.exeC:\WINDOWS\system32\restore\rstrui.exeC:\WINDOWS\system32\restore\rstrui.exec:\PROGRA~1\mcafee.com\agent\mcagent.exeC:\Program Files\Common Files\Java\Java Update\jucheck.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Common Files\McAfee\SystemCore\mcshield.exeC:\Program Files\Internet Explorer\iexplore.exeC:\WINDOWS\system32\wbem\wmiprvse.exeC:\WINDOWS\System32\svchost.exe -k netsvcsC:\WINDOWS\System32\svchost.exe -k NetworkServiceC:\WINDOWS\System32\svchost.exe -k LocalServiceC:\WINDOWS\System32\svchost.exe -k LocalServiceC:\WINDOWS\System32\svchost.exe -k imgsvc.============== Pseudo HJT Report ===============.uStart Page = hxxp://www.google.com/webhp?sourceid=navclient&ie=UTF-8uWindow Title = Windows Internet Explorer provided by Yahoo!uSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.htmluSearch Page = hxxp://www.google.comuDefault_Page_URL = hxxp://www.yahoo.com/?fr=fp-yie8uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.htmluInternet Connection Wizard,ShellNext = hxxp://mail.google.com/mail/uProxyServer = 210.212.123.10:8080uProxyOverride = ;*.localuSearchAssistant = hxxp://www.google.com/ieuSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.commSearchAssistant = hxxp://www.google.com/ieuURLSearchHooks: UrlSearchHook Class: {00000000-6E41-4FD3-8538-502F5495E5FC} - c:\program files\ask.com\GenericAskToolbar.dlluURLSearchHooks: Yahoo! Toolbar: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - c:\program files\yahoo!\companion\installs\cpn7\yt.dllBHO: &Yahoo! Toolbar Helper: {02478D38-C3F9-4EFB-9B51-7695ECA05670} - c:\program files\yahoo!\companion\installs\cpn7\yt.dllBHO: Adobe PDF Reader Link Helper: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dllBHO: Virtual Account Numbers Helper: {17424104-1444-4810-85D7-B4DA413C5A9A} - c:\program files\virtual account numbers\CitiVANHelper.dllBHO: McAfee Phishing Filter: {27B4851A-3207-45A2-B947-BE8AFE6163AB} - BHO: scriptproxy: {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dllBHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\google toolbar\GoogleToolbar_32.dllBHO: Google Toolbar Notifier BHO: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - c:\program files\google\googletoolbarnotifier\5.7.6406.1642\swg.dllBHO: McAfee SiteAdvisor BHO: {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\program files\mcafee\siteadvisor\McIEPlg.dllBHO: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - BHO: Ask Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - c:\program files\ask.com\GenericAskToolbar.dllBHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre6\bin\jp2ssv.dllBHO: JQSIEStartDetectorImpl Class: {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dllBHO: SingleInstance Class: {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - c:\program files\yahoo!\companion\installs\cpn7\YTSingleInstance.dllTB: Google Toolbar: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\program files\google\google toolbar\GoogleToolbar_32.dllTB: Yahoo! Toolbar: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - c:\program files\yahoo!\companion\installs\cpn7\yt.dllTB: Ask Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - c:\program files\ask.com\GenericAskToolbar.dllTB: Yahoo! Toolbar: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - c:\program files\yahoo!\companion\installs\cpn7\yt.dllTB: TurboTax ItsDeductible: {35CE0AE2-3411-4BB8-A16A-BEE30B282A26} - c:\program files\intuit\ido\IDOToolbar.dllTB: Virtual Account Numbers: {7A21A046-B886-4A62-9D69-EF2059B0A27B} - c:\program files\virtual account numbers\CitiVANToolbar.dllTB: McAfee SiteAdvisor Toolbar: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\program files\mcafee\siteadvisor\McIEPlg.dllTB: Ask Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - c:\program files\ask.com\GenericAskToolbar.dllTB: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} - TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\google toolbar\GoogleToolbar_32.dllEB: {32683183-48a0-441b-a342-7c2a440a9478} - EB: {4528BBE0-4E08-11D5-AD55-00010333D0AD} - uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /backgrounduRun: [ctfmon.exe] c:\windows\system32\ctfmon.exeuRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"uRun: [TomTomHOME.exe] "c:\program files\tomtom home 2\TomTomHOMERunner.exe"uRun: [Corel Photo Downloader] "c:\program files\common files\corel\corel photodownloader\Corel Photo Downloader.exe" -startupmRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartupmRun: [Citi Virtual Account Numbers] c:\progra~1\virtua~1\CitiVAN.exe /lang=en_RG /dontopenmycardsmRun: [mcui_exe] "c:\program files\mcafee.com\agent\mcagent.exe" /runkeymRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottimemRun: [Microsoft Default Manager] "c:\program files\microsoft\search enhancement pack\default manager\DefMgr.exe" -resumemRun: [Corel File Shell Monitor] c:\program files\corel\corel paintshop photo pro\x3\pspclassic\CorelIOMonitor.exemRun: [Standby] "c:\program files\common files\corel\standby\Standby.exe" -STARTmRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\AppleSyncNotifier.exemRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttraydRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NVMCTRAY.DLL,NvTaskbarInitStartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\mcafee~1.lnk - c:\program files\mcafee online backup\MOBKstat.exeStartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\scanpa~1.lnk - c:\scanpanel\ScnPanel.exeuPolicies-Explorer: NoDriveTypeAutoRun = dword:0mPolicies-Windows\System: Allow-LogonScript-NetbiosDisabled = dword:1mPolicies-Explorer: NoDriveTypeAutoRun = dword:145IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.htmlIE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office12\ONBttnIE.dllIE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}IE: {A26ABCF0-1C8F-46e7-A67C-0489DC21B9CC} - {35CE0AE2-3411-4BB8-A16A-BEE30B282A26}IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exeIE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exeTrusted Zone: ameritrade.comTrusted Zone: tdameritrade.comTrusted Zone: turbotax.comDPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cabDPF: Garmin Internet Explorer Plug-In - hxxps://my.garmin.com/mygarmin/m/GarminAxControl.CABDPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cabDPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - hxxp://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,84/mcinsctl.cabDPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} - hxxp://www.winkflash.com/photo/loaders/ImageUploader4.cabDPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cabDPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cabDPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cabDPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cabDPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/swflash.cabDPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} - hxxp://gfx1.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cabTCP: NameServer = 192.168.0.1 205.171.3.25TCP: Interfaces\{13B2B0BE-60F1-4D01-B1B6-5C17FFDBB0AA} : DHCPNameServer = 192.168.0.1 205.171.3.25Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\program files\mcafee\siteadvisor\McIEPlg.dllHandler: ipp - Handler: msdaipp - Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\program files\mcafee\siteadvisor\McIEPlg.dllSSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dllLSA: Notification Packages = :\windows\system32\srrmASetup: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "c:\program files\outlook express\setup50.exe" /APP:OE /CALLER:WINNT /user /installmASetup: {7790769C-0471-11d2-AF11-00C04FA35D02} - "c:\program files\outlook express\setup50.exe" /APP:WAB /CALLER:WINNT /user /installmASetup: {A509B1FF-37FF-4bFF-8CFF-4F3A747040FF} - c:\windows\system32\rundll32.exe c:\windows\system32\advpack.dll,launchinfsectionex c:\program files\internet explorer\clrtour.inf,DefaultInstall.ResetTour,,12IFEO: Your Image File Name Here without a path - ntsd -d.============= SERVICES / DRIVERS ===============.R0 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2009-3-25 459728]R1 mfetdi2k;McAfee Inc. mfetdi2k;c:\windows\system32\drivers\mfetdi2k.sys [2010-12-16 89368]R1 MOBKFilter;MOBKFilter;c:\windows\system32\drivers\MOBK.sys [2010-12-16 54776]R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2011-7-16 366640]R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\common files\mcafee\mcsvchost\McSvHost.exe [2010-12-16 214904]R2 McNaiAnn;McAfee VirusScan Announcer;c:\program files\common files\mcafee\mcsvchost\McSvHost.exe [2010-12-16 214904]R2 McProxy;McAfee Proxy Service;c:\program files\common files\mcafee\mcsvchost\McSvHost.exe [2010-12-16 214904]R2 McShield;McShield;c:\program files\common files\mcafee\systemcore\mcshield.exe [2010-12-16 165000]R2 mfefire;McAfee Firewall Core Service;c:\program files\common files\mcafee\systemcore\mfefire.exe [2010-12-16 159832]R2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [2010-12-16 148520]R2 MOBKbackup;McAfee Online Backup;c:\program files\mcafee online backup\MOBKbackup.exe [2010-4-13 229688]R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-7-16 22712]R3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2010-12-15 179248]R3 mfebopk;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2010-12-15 59288]R3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [2010-12-16 337912]R3 mfendiskmp;mfendiskmp;c:\windows\system32\drivers\mfendisk.sys [2010-12-16 83688]S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-1-31 135664]S3 BBSvc;Bing Bar Update Service;c:\program files\microsoft\bingbar\BBSvc.EXE [2011-2-28 183560]S3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [2010-12-16 57432]S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-1-31 135664]S3 mfendisk;McAfee Core NDIS Intermediate Filter;c:\windows\system32\drivers\mfendisk.sys [2010-12-16 83688]S3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [2010-12-16 85984]S3 mferkdk;McAfee Inc. mferkdk;c:\windows\system32\drivers\mferkdk.sys [2006-7-31 34248]S3 mfesmfk;McAfee Inc. mfesmfk;c:\windows\system32\drivers\mfesmfk.sys [2006-7-31 40552].=============== Created Last 30 ================.2011-07-16 18:27:52 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys2011-07-16 18:27:38 22712 ----a-w- c:\windows\system32\drivers\mbam.sys2011-07-16 18:27:36 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware2011-07-15 23:18:19 -------- d-----w- c:\documents and settings\prakash1\application data\Malwarebytes2011-07-15 23:17:52 -------- d-----w- c:\documents and settings\all users\application data\Malwarebytes2011-07-15 21:28:22 -------- d-----w- c:\windows\system32\wbem\repository\FS2011-07-15 21:28:22 -------- d-----w- c:\windows\system32\wbem\Repository2011-07-11 23:12:23 -------- d-----w- c:\program files\iPod2011-07-11 23:11:27 -------- d-----w- c:\program files\iTunes2011-07-09 19:14:25 18120 ----a-w- c:\windows\system32\drivers\Artec48.sys2011-07-09 19:14:08 7168 ------w- c:\windows\system32\48UMicro.dll2011-07-09 19:14:08 45056 ------w- c:\windows\Getkey.dll2011-07-09 19:14:08 167936 ------w- c:\windows\Ausba4.dll2011-07-09 19:14:08 167936 ------w- c:\windows\A4.dll2011-07-09 19:14:05 45056 ----a-w- c:\windows\system32\Remove48U.exe2011-07-04 00:18:50 -------- d-----w- c:\program files\WM Converter2011-07-03 23:47:45 -------- d-----w- c:\documents and settings\prakash1\local settings\application data\WMTools Downloaded Files2011-06-24 03:41:19 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl.==================== Find3M ====================.2011-07-11 02:57:17 848 --sha-w- c:\documents and settings\all users\application data\KGyGaAvL.sys2011-06-02 14:02:05 1858944 ----a-w- c:\windows\system32\win32k.sys2011-05-02 15:31:52 692736 ----a-w- c:\windows\system32\inetcomm.dll2011-04-29 17:25:27 151552 ----a-w- c:\windows\system32\schannel.dll2011-04-29 16:19:43 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys2011-04-26 11:07:50 33280 ----a-w- c:\windows\system32\csrsrv.dll2011-04-26 11:07:50 293376 ----a-w- c:\windows\system32\winsrv.dll2011-04-25 16:11:12 916480 ----a-w- c:\windows\system32\wininet.dll2011-04-25 16:11:11 43520 ----a-w- c:\windows\system32\licmgr10.dll2011-04-25 16:11:11 1469440 ----a-w- c:\windows\system32\inetcpl.cpl2011-04-25 12:01:22 385024 ----a-w- c:\windows\system32\html.iec2011-04-21 13:37:43 105472 ----a-w- c:\windows\system32\drivers\mup.sys2005-07-15 20:15:26 416 -c--a-w- c:\program files\layout.bin2000-05-16 22:37:14 46080 -c--a-w- c:\program files\Setup.exe.============= FINISH: 15:14:32.79 ===============


----------



## seemacima (Jul 16, 2011)

I am for some reason not able to to add the attach log as atatchment its not giving me option....sry....DDS (Ver_2011-07-14.01).Microsoft Windows XP Home EditionBoot Device: \Device\HarddiskVolume1Install Date: 1/10/2005 10:42:25 PMSystem Uptime: 7/17/2011 2:23:27 PM (1 hours ago).Motherboard: Dell Computer Corp. | | 0J0592Processor: Intel(R) Pentium(R) 4 CPU 2.53GHz | Microprocessor | 2524/533mhz.==== Disk Partitions =========================.A: is RemovableC: is FIXED (NTFS) - 56 GiB total, 24.123 GiB free.D: is CDROM ()E: is CDROM ().==== Disabled Device Manager Items =============.==== System Restore Points ===================.RP1076: 4/16/2011 8:53:33 AM - System CheckpointRP1077: 4/18/2011 7:17:22 PM - System CheckpointRP1078: 4/19/2011 7:44:35 PM - System CheckpointRP1079: 4/21/2011 7:00:44 PM - Software Distribution Service 3.0RP1080: 4/22/2011 7:25:23 PM - System CheckpointRP1081: 4/25/2011 3:32:00 PM - System CheckpointRP1082: 4/26/2011 3:47:11 PM - System CheckpointRP1083: 4/26/2011 7:00:39 PM - Software Distribution Service 3.0RP1084: 4/29/2011 5:51:49 PM - System CheckpointRP1085: 4/30/2011 6:43:06 PM - System CheckpointRP1086: 5/1/2011 10:07:31 PM - System CheckpointRP1087: 5/11/2011 12:11:44 AM - Software Distribution Service 3.0RP1088: 5/16/2011 5:57:52 PM - System CheckpointRP1089: 5/17/2011 8:57:59 PM - System CheckpointRP1090: 5/22/2011 7:43:25 PM - System CheckpointRP1091: 5/24/2011 5:03:03 PM - System CheckpointRP1092: 5/27/2011 4:55:11 PM - System CheckpointRP1093: 5/29/2011 10:02:40 PM - System CheckpointRP1094: 5/31/2011 9:39:20 AM - System CheckpointRP1095: 6/1/2011 10:35:48 AM - System CheckpointRP1096: 6/2/2011 1:15:25 PM - System CheckpointRP1097: 6/3/2011 8:06:28 PM - System CheckpointRP1098: 6/11/2011 9:26:43 PM - System CheckpointRP1099: 6/14/2011 7:01:20 PM - Software Distribution Service 3.0RP1100: 6/22/2011 7:07:52 PM - System CheckpointRP1101: 6/30/2011 1:38:48 PM - Software Distribution Service 3.0RP1102: 7/5/2011 12:54:52 PM - Configured Microsoft Office Home and Student 2007RP1103: 7/5/2011 5:48:05 PM - Configured Microsoft Office Home and Student 2007RP1104: 7/6/2011 6:26:08 PM - System CheckpointRP1105: 7/7/2011 6:31:44 PM - System CheckpointRP1106: 7/9/2011 12:36:53 PM - Unsigned driver installRP1107: 7/12/2011 6:12:28 PM - System CheckpointRP1108: 7/12/2011 7:00:53 PM - Software Distribution Service 3.0RP1109: 7/13/2011 7:04:06 PM - System CheckpointRP1110: 7/15/2011 1:48:25 PM - Restore OperationRP1111: 7/15/2011 2:23:46 PM - Restore OperationRP1112: 7/16/2011 11:00:10 AM - Configured Microsoft Office Home and Student 2007.==== Installed Programs ======================.Adobe Flash Player 10 ActiveXAdobe Reader 8.1.4AnswerWorks 4.0 Runtime - EnglishAnswerWorks 5.0 English RuntimeApple Application SupportApple Mobile Device SupportApple Software UpdateArcSoft Software SuiteAsk ToolbarAudacity 1.2.6Bing BarBonjourConexant SmartHSFi V92 56K DF PCI ModemContentHDContentsCopyTrans Suite Remove OnlyCorel Painter Photo Essentials 4Corel PaintShop Photo Pro X3Critical Update for Windows Media Player 11 (KB959772)Dell Picture Studio - Dell Image ExpertDell ResourceCDDeviceIODream Doll Designere+ 48UEarthLink MDACGdiplusUpgradeGoogle Toolbar for Internet ExplorerGoogle Update HelperHotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)Hotfix for Windows Internet Explorer 7 (KB947864)Hotfix for Windows Media Format 11 SDK (KB929399)Hotfix for Windows Media Player 11 (KB939683)Hotfix for Windows XP (KB2158563)Hotfix for Windows XP (KB2443685)Hotfix for Windows XP (KB952287)Hotfix for Windows XP (KB954550-v5)Hotfix for Windows XP (KB961118)Hotfix for Windows XP (KB970653-v3)Hotfix for Windows XP (KB976098-v2)Hotfix for Windows XP (KB979306)Hotfix for Windows XP (KB981793)HP Software UpdateHP UpdateICAImageMixer VCD2Intel(R) PRO Ethernet Adapter and SoftwareInternet Explorer Q903235IPM_PSP_ProItsDeductible Online ToolbariTunesJasc Animation Shop 3Java Auto UpdaterJava(TM) 6 Update 24Linksys EasyLink Advisor 1.5 (1044)Macromedia Shockwave PlayerMalwarebytes' Anti-Malware version 1.51.1.1800Maxtor BackupMaxtor EncryptionMaxtor OneTouch IIIMcAfee Online BackupMcAfee ShredderMcAfee Total ProtectionMicrosoft .NET Framework 1.1Microsoft .NET Framework 1.1 Security Update (KB2416447)Microsoft .NET Framework 1.1 Security Update (KB979906)Microsoft .NET Framework 2.0 Service Pack 2Microsoft .NET Framework 3.0 Service Pack 2Microsoft .NET Framework 3.5 SP1Microsoft Compression Client Pack 1.0 for Windows XPMicrosoft Default ManagerMicrosoft Internationalized Domain Names Mitigation APIsMicrosoft National Language Support Downlevel APIsMicrosoft Office 2007 Service Pack 2 (SP2)Microsoft Office Excel MUI (English) 2007Microsoft Office File Validation Add-InMicrosoft Office Home and Student 2007Microsoft Office OneNote MUI (English) 2007Microsoft Office PowerPoint MUI (English) 2007Microsoft Office Proof (English) 2007Microsoft Office Proof (French) 2007Microsoft Office Proof (Spanish) 2007Microsoft Office Proofing (English) 2007Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)Microsoft Office Shared MUI (English) 2007Microsoft Office Shared Setup Metadata MUI (English) 2007Microsoft Office Word MUI (English) 2007Microsoft SilverlightMicrosoft Software Update for Web Folders (English) 12Microsoft User-Mode Driver Framework Feature Pack 1.0Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053Microsoft Visual C++ 2005 RedistributableMicrosoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161Microsoft Word 97MLEMobileMe Control PanelMSSoapMSXML 4.0 SP2 (KB927978)MSXML 4.0 SP2 (KB936181)MSXML 4.0 SP2 (KB954430)MSXML 4.0 SP2 (KB973688)Multimedia Algebra 1Nero SuiteNetwork ViewerNVIDIA Display DriverOpenMG AAC Add-on Module 1.0.00OpenMG Secure Module 4.6.01PCFriendlyPDF Manual NW-E000 SeriesPowerDVDPSPH10ProPSPPContentPSPPRO_DCRAWPureHDQFolderQuickTimeSafariSecurity Update for 2007 Microsoft Office System (KB2288621)Security Update for 2007 Microsoft Office System (KB2288931)Security Update for 2007 Microsoft Office System (KB2345043)Security Update for 2007 Microsoft Office System (KB2509488)Security Update for 2007 Microsoft Office System (KB969559)Security Update for 2007 Microsoft Office System (KB976321)Security Update for CAPICOM (KB931906)Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)Security Update for Microsoft Office 2007 System (KB2541012)Security Update for Microsoft Office Excel 2007 (KB2541007)Security Update for Microsoft Office InfoPath 2007 (KB979441)Security Update for Microsoft Office PowerPoint 2007 (KB2535818)Security Update for Microsoft Office PowerPoint Viewer 2007 (KB2464623)Security Update for Microsoft Office system 2007 (972581)Security Update for Microsoft Office system 2007 (KB974234)Security Update for Microsoft Office Visio Viewer 2007 (KB973709)Security Update for Microsoft Office Word 2007 (KB2344993)Security Update for Windows Internet Explorer 7 (KB928090)Security Update for Windows Internet Explorer 7 (KB929969)Security Update for Windows Internet Explorer 7 (KB931768)Security Update for Windows Internet Explorer 7 (KB933566)Security Update for Windows Internet Explorer 7 (KB937143)Security Update for Windows Internet Explorer 7 (KB938127)Security Update for Windows Internet Explorer 7 (KB939653)Security Update for Windows Internet Explorer 7 (KB942615)Security Update for Windows Internet Explorer 7 (KB944533)Security Update for Windows Internet Explorer 7 (KB950759)Security Update for Windows Internet Explorer 7 (KB953838)Security Update for Windows Internet Explorer 7 (KB956390)Security Update for Windows Internet Explorer 7 (KB958215)Security Update for Windows Internet Explorer 7 (KB960714)Security Update for Windows Internet Explorer 7 (KB961260)Security Update for Windows Internet Explorer 7 (KB963027)Security Update for Windows Internet Explorer 8 (KB2183461)Security Update for Windows Internet Explorer 8 (KB2360131)Security Update for Windows Internet Explorer 8 (KB2416400)Security Update for Windows Internet Explorer 8 (KB2482017)Security Update for Windows Internet Explorer 8 (KB2497640)Security Update for Windows Internet Explorer 8 (KB2510531)Security Update for Windows Internet Explorer 8 (KB2530548)Security Update for Windows Internet Explorer 8 (KB2544521)Security Update for Windows Internet Explorer 8 (KB969897)Security Update for Windows Internet Explorer 8 (KB971961)Security Update for Windows Internet Explorer 8 (KB972260)Security Update for Windows Internet Explorer 8 (KB974455)Security Update for Windows Internet Explorer 8 (KB976325)Security Update for Windows Internet Explorer 8 (KB978207)Security Update for Windows Internet Explorer 8 (KB981332)Security Update for Windows Internet Explorer 8 (KB982381)Security Update for Windows Media Encoder (KB2447961)Security Update for Windows Media Player (KB2378111)Security Update for Windows Media Player (KB911564)Security Update for Windows Media Player (KB952069)Security Update for Windows Media Player (KB954155)Security Update for Windows Media Player (KB968816)Security Update for Windows Media Player (KB973540)Security Update for Windows Media Player (KB975558)Security Update for Windows Media Player (KB978695)Security Update for Windows Media Player 11 (KB936782)Security Update for Windows Media Player 11 (KB954154)Security Update for Windows Media Player 6.4 (KB925398)Security Update for Windows Media Player 9 (KB911565)Security Update for Windows Media Player 9 (KB917734)Security Update for Windows XP (KB2079403)Security Update for Windows XP (KB2115168)Security Update for Windows XP (KB2121546)Security Update for Windows XP (KB2160329)Security Update for Windows XP (KB2229593)Security Update for Windows XP (KB2259922)Security Update for Windows XP (KB2279986)Security Update for Windows XP (KB2286198)Security Update for Windows XP (KB2296011)Security Update for Windows XP (KB2296199)Security Update for Windows XP (KB2347290)Security Update for Windows XP (KB2360937)Security Update for Windows XP (KB2387149)Security Update for Windows XP (KB2393802)Security Update for Windows XP (KB2412687)Security Update for Windows XP (KB2419632)Security Update for Windows XP (KB2423089)Security Update for Windows XP (KB2436673)Security Update for Windows XP (KB2440591)Security Update for Windows XP (KB2443105)Security Update for Windows XP (KB2476490)Security Update for Windows XP (KB2476687)Security Update for Windows XP (KB2478960)Security Update for Windows XP (KB2478971)Security Update for Windows XP (KB2479628)Security Update for Windows XP (KB2479943)Security Update for Windows XP (KB2481109)Security Update for Windows XP (KB2483185)Security Update for Windows XP (KB2485376)Security Update for Windows XP (KB2485663)Security Update for Windows XP (KB2503658)Security Update for Windows XP (KB2503665)Security Update for Windows XP (KB2506212)Security Update for Windows XP (KB2506223)Security Update for Windows XP (KB2507618)Security Update for Windows XP (KB2508272)Security Update for Windows XP (KB2508429)Security Update for Windows XP (KB2509553)Security Update for Windows XP (KB2511455)Security Update for Windows XP (KB2524375)Security Update for Windows XP (KB2535512)Security Update for Windows XP (KB2536276)Security Update for Windows XP (KB2544893)Security Update for Windows XP (KB923561)Security Update for Windows XP (KB923689)Security Update for Windows XP (KB938464)Security Update for Windows XP (KB941569)Security Update for Windows XP (KB946648)Security Update for Windows XP (KB950760)Security Update for Windows XP (KB950762)Security Update for Windows XP (KB950974)Security Update for Windows XP (KB951066)Security Update for Windows XP (KB951376-v2)Security Update for Windows XP (KB951698)Security Update for Windows XP (KB951748)Security Update for Windows XP (KB952004)Security Update for Windows XP (KB952954)Security Update for Windows XP (KB953839)Security Update for Windows XP (KB954211)Security Update for Windows XP (KB954459)Security Update for Windows XP (KB954600)Security Update for Windows XP (KB955069)Security Update for Windows XP (KB956391)Security Update for Windows XP (KB956572)Security Update for Windows XP (KB956744)Security Update for Windows XP (KB956802)Security Update for Windows XP (KB956803)Security Update for Windows XP (KB956841)Security Update for Windows XP (KB956844)Security Update for Windows XP (KB957095)Security Update for Windows XP (KB957097)Security Update for Windows XP (KB958644)Security Update for Windows XP (KB958687)Security Update for Windows XP (KB958690)Security Update for Windows XP (KB958869)Security Update for Windows XP (KB959426)Security Update for Windows XP (KB960225)Security Update for Windows XP (KB960715)Security Update for Windows XP (KB960803)Security Update for Windows XP (KB960859)Security Update for Windows XP (KB961371)Security Update for Windows XP (KB961373)Security Update for Windows XP (KB961501)Security Update for Windows XP (KB968537)Security Update for Windows XP (KB969059)Security Update for Windows XP (KB969898)Security Update for Windows XP (KB969947)Security Update for Windows XP (KB970238)Security Update for Windows XP (KB970430)Security Update for Windows XP (KB971468)Security Update for Windows XP (KB971486)Security Update for Windows XP (KB971557)Security Update for Windows XP (KB971633)Security Update for Windows XP (KB971657)Security Update for Windows XP (KB972270)Security Update for Windows XP (KB973346)Security Update for Windows XP (KB973354)Security Update for Windows XP (KB973507)Security Update for Windows XP (KB973525)Security Update for Windows XP (KB973869)Security Update for Windows XP (KB973904)Security Update for Windows XP (KB974112)Security Update for Windows XP (KB974318)Security Update for Windows XP (KB974392)Security Update for Windows XP (KB974571)Security Update for Windows XP (KB975025)Security Update for Windows XP (KB975467)Security Update for Windows XP (KB975560)Security Update for Windows XP (KB975561)Security Update for Windows XP (KB975562)Security Update for Windows XP (KB975713)Security Update for Windows XP (KB977165-v2)Security Update for Windows XP (KB977816)Security Update for Windows XP (KB977914)Security Update for Windows XP (KB978037)Security Update for Windows XP (KB978251)Security Update for Windows XP (KB978262)Security Update for Windows XP (KB978338)Security Update for Windows XP (KB978542)Security Update for Windows XP (KB978601)Security Update for Windows XP (KB978706)Security Update for Windows XP (KB979309)Security Update for Windows XP (KB979482)Security Update for Windows XP (KB979559)Security Update for Windows XP (KB979683)Security Update for Windows XP (KB979687)Security Update for Windows XP (KB980195)Security Update for Windows XP (KB980218)Security Update for Windows XP (KB980232)Security Update for Windows XP (KB980436)Security Update for Windows XP (KB981322)Security Update for Windows XP (KB981852)Security Update for Windows XP (KB981957)Security Update for Windows XP (KB981997)Security Update for Windows XP (KB982132)Security Update for Windows XP (KB982214)Security Update for Windows XP (KB982665)Security Update for Windows XP (KB982802)SereneScreen AquariumSerif 3DPlus 2.0SetupShareSonicStage 4.2Sony USB DriverSoundMAXTurboTax 2008TurboTax 2008 waziperTurboTax 2008 WinPerFedFormsetTurboTax 2008 WinPerProgramHelpTurboTax 2008 WinPerReleaseEngineTurboTax 2008 WinPerTaxSupportTurboTax 2008 WinPerUserEducationTurboTax 2008 wrapperTurboTax 2009TurboTax 2009 waziperTurboTax 2009 WinPerFedFormsetTurboTax 2009 WinPerReleaseEngineTurboTax 2009 WinPerTaxSupportTurboTax 2009 wrapperTurboTax Deluxe 2007TurboTax ItsDeductible 2004TurboTax ItsDeductible 2005Update for 2007 Microsoft Office System (KB967642)Update for Microsoft .NET Framework 3.5 SP1 (KB963707)Update for Microsoft Office 2007 System (KB2539530)Update for Microsoft Office OneNote 2007 (KB980729)Update for Windows Internet Explorer 8 (KB968220)Update for Windows Internet Explorer 8 (KB976662)Update for Windows Internet Explorer 8 (KB976749)Update for Windows Internet Explorer 8 (KB980182)Update for Windows XP (KB2141007)Update for Windows XP (KB2345886)Update for Windows XP (KB2467659)Update for Windows XP (KB2541763)Update for Windows XP (KB951072-v2)Update for Windows XP (KB951978)Update for Windows XP (KB955759)Update for Windows XP (KB955839)Update for Windows XP (KB967715)Update for Windows XP (KB968389)Update for Windows XP (KB971029)Update for Windows XP (KB971737)Update for Windows XP (KB973687)Update for Windows XP (KB973815)VIOVirtual Account NumbersWebFldrs XPWexTech AnswerWorksWindows Genuine Advantage Notifications (KB905474)Windows Genuine Advantage v1.3.0254.0Windows Genuine Advantage Validation Tool (KB892130)Windows Internet Explorer 7Windows Internet Explorer 8Windows Live ID Sign-in AssistantWindows Media Encoder 9 SeriesWindows Media Format 11 runtimeWindows Media Player 11Windows XP Hotfix - KB888162Windows XP Service Pack 3WinZip 15.0WinZip Self-ExtractorWM Converter 2.0Yahoo! Anti-SpyYahoo! Install ManagerYahoo! Internet MailYahoo! Software UpdateYahoo! Toolbar.==== Event Viewer Messages From Past Week ========.7/17/2011 2:30:33 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the stisvc service.7/17/2011 2:22:33 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}7/17/2011 2:17:05 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Fips intelppm MOBKFilter OMCI7/16/2011 1:57:04 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service McNaiAnn with arguments "" in order to run the server: {DC7EF8E1-824F-4110-AB43-1604DA9B4F40}7/16/2011 1:56:04 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD Fips intelppm IPSec mfehidk mfetdi2k MOBKFilter MPFP MRxSmb NetBIOS NetBT OMCI RasAcd Rdbss Tcpip WS2IFSL7/16/2011 1:56:04 PM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD Networking Support Environment service which failed to start because of the following error: A device attached to the system is not functioning.7/16/2011 1:56:04 PM, error: Service Control Manager [7001] - The McShield service depends on the McAfee Validation Trust Protection Service service which failed to start because of the following error: The dependency service or group failed to start.7/16/2011 1:56:04 PM, error: Service Control Manager [7001] - The McAfee Validation Trust Protection Service service depends on the McAfee Inc. mfehidk service which failed to start because of the following error: A device attached to the system is not functioning.7/16/2011 1:56:04 PM, error: Service Control Manager [7001] - The McAfee Proxy Service service depends on the McAfee Firewall Core Service service which failed to start because of the following error: The dependency service or group failed to start.7/16/2011 1:56:04 PM, error: Service Control Manager [7001] - The McAfee Network Agent service depends on the McAfee Firewall Core Service service which failed to start because of the following error: The dependency service or group failed to start.7/16/2011 1:56:04 PM, error: Service Control Manager [7001] - The McAfee Firewall Core Service service depends on the McAfee Validation Trust Protection Service service which failed to start because of the following error: The dependency service or group failed to start.7/16/2011 1:56:04 PM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning.7/16/2011 1:56:04 PM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.7/16/2011 1:56:04 PM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning.7/16/2011 1:56:04 PM, error: Service Control Manager [7001] - The Bonjour Service service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.7/16/2011 1:56:04 PM, error: Service Control Manager [7001] - The Apple Mobile Device service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.7/16/2011 1:55:49 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}7/16/2011 1:55:24 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}7/16/2011 1:39:48 PM, error: Service Control Manager [7031] - The McShield service terminated unexpectedly. It has done this 3 time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service.7/16/2011 1:37:11 PM, error: Service Control Manager [7031] - The McShield service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service.7/16/2011 1:34:39 PM, error: Service Control Manager [7031] - The McShield service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service.7/15/2011 6:31:20 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the McNaiAnn service.7/15/2011 6:30:50 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the mcmscsvc service.7/15/2011 6:30:17 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: IntelIde7/15/2011 2:54:02 PM, error: Service Control Manager [7022] - The McShield service hung on starting.7/15/2011 2:12:55 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the McAfee SiteAdvisor Service service.7/15/2011 2:05:16 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the McAfee Scanner service to connect.7/15/2011 2:05:16 PM, error: Service Control Manager [7000] - The McAfee Scanner service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.7/15/2011 2:05:16 PM, error: DCOM [10005] - DCOM got error "%1053" attempting to start the service MCODS with arguments "" in order to run the server: {C98F04D7-CD30-4BB0-B7D7-8DD7448520F2}7/15/2011 1:43:01 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the iPod Service service to connect.7/15/2011 1:43:01 PM, error: Service Control Manager [7000] - The iPod Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.7/15/2011 1:43:00 PM, error: DCOM [10005] - DCOM got error "%1053" attempting to start the service iPod Service with arguments "" in order to run the server: {063D34A4-BF84-4B8D-B699-E8CA06504DDE}7/12/2011 7:35:12 PM, error: Print [19] - Sharing printer failed + 1722, Printer Send To OneNote 2007 share name Send To OneNote 2007.7/12/2011 11:12:13 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the NVSvc service..==== End Of File ===========================


----------



## seemacima (Jul 16, 2011)

thank you in advance for all the assistence...will wait now what to do next...


----------



## Satchfan (Jan 12, 2009)

Hello *seemacima *and welcome to the *TSG *forum.

My name is *Satchfan* and I would be glad to help you with your computer problem. *Please read the following guidelines which will help to make cleaning your machine easier:*

please follow all instructions in the order posted
please continue to review my answers until I tell you your machine appears to be clear. *Absence of symptoms does not mean that everything is clear*
all logs/reports, etc. must be posted in *Notepad*. Please ensure that *Word Wrap is unchecked*. In Notepad click *Format*, uncheck *Word Wrap* if it is checked
if you don't understand something, please don't hesitate to ask for clarification before proceeding
the fixes are specific to your problem and should only be used for *this* issue on *this* machine. 
please reply within 3 days. If you do not reply within this period I will post a reminder but *topics with no reply in 4 days will be closed!*
IMPORTANT:

Please *do not* install/uninstall any programs unless asked to. 
Please *do not* run any scans other than those requested

===================================================




> I tried to do what was written in this post....http://forums.techguy.org/virus-othe...desktop-2.html


If you followed those instructions you will probably not be able to recover what is missing. You should NEVER follow instructions intended for individual users.

That said, lets see what we *can* recover.

Please note what is written above about *Word Wrap* as your other logs were pretty unreadable due to the fact that it was checked. Thanks

===================================================

*Download and run OTL*

download *OTL* to your desktop.
double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
when the window appears, underneath *Output* at the top change it to *Minimal Output*.
check the boxes beside *LOP Check* and *Purity Check*.
under Custom Scan paste this in
*netsvcs*
*drivers32*
*%SYSTEMDRIVE%\*.**
*%systemroot%\Fonts\*.com*
*%systemroot%\Fonts\*.dll*
*%systemroot%\Fonts\*.ini*
*%systemroot%\Fonts\*.ini2*
*%systemroot%\Fonts\*.exe*
*%systemroot%\system32\spool\prtprocs\w32x86\*.**
*%systemroot%\REPAIR\*.bak1*
*%systemroot%\REPAIR\*.ini*
*%systemroot%\system32\*.jpg*
*%systemroot%\*.jpg*
*%systemroot%\*.png*
*%systemroot%\*.scr*
*%systemroot%\*._sy*
*%APPDATA%\Adobe\Update\*.**
*%ALLUSERSPROFILE%\Favorites\*.**
*%APPDATA%\Microsoft\*.**
*%PROGRAMFILES%\*.**
*%APPDATA%\Update\*.**
*%systemroot%\*. /mp /s*
*CREATERESTOREPOINT*
*%systemroot%\System32\config\*.sav*
*%PROGRAMFILES%\bak. /s*
*%systemroot%\system32\bak. /s*
*%ALLUSERSPROFILE%\Start Menu\*.lnk /x*
*%systemroot%\system32\config\systemprofile\*.dat /x*
*%systemroot%\*.config*
*%systemroot%\system32\*.db*
*%PROGRAMFILES%\Internet Explorer\*.dat*
*%APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x*
*%USERPROFILE%\Desktop\*.exe*
*%PROGRAMFILES%\Common Files\*.**
*%systemroot%\*.src*
*%systemroot%\install\*.**
*%systemroot%\system32\DLL\*.**
*%systemroot%\system32\HelpFiles\*.**
*%systemroot%\system32\rundll\*.**
*%systemroot%\winn32\*.**
*%systemroot%\Java\*.**
*%systemroot%\system32\test\*.**
*%systemroot%\system32\Rundll32\*.**
*%systemroot%\AppPatch\Custom\*.**
*HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU*
*HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs*​
click the *Run Scan* button. Do not change any settings unless otherwise told to do so. The scan wont take long.
when the scan completes, it will open two notepad windows. *OTL.Txt* and *Extras.Txt*. These are saved in the same location as OTL.
please copy *(Edit->Select All, Edit->Copy)* the contents of these files, one at a time, and post it with your next reply. 
You may need two posts to fit them both in.

===================================================

*Run aswMBR*

Download aswMBR.exe ( 511KB ) to your desktop.

double click the *aswMBR.exe* to run it 
click the "Scan" button to start the scan 
on completion of the scan click save log, save it to your desktop and post in your next reply ​
===================================================​

Please download *SystemLook* from *here* and save it to your Desktop*.*

double-click *SystemLook.exe* to run it.
copy the content of the following codebox into the main textfield:


```
[B]:dir [/B]
[B]%Temp%\smtmp /s[/B]
```

click the Look button to start the scan.
when finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
*Note:* The log can also be found on your Desktop entitled *SystemLook.txt*

Let me know if there are any changes

Logs to include in next post:

*OTL.txt*
*Extras.txt*
*aswMBR.txt*
*SystemLook.txt*

Thanks

Satchfan


----------



## seemacima (Jul 16, 2011)

Thank you satchfan....I will not try to do other people solutions on myself.
2 questións

Do i have to make malware programa and McAfee inactive as it was written some where
And how to make them inactive.


And after i DL these application and have the logs do i need to delete them from desktop rightaway as i read somewhere


Thank you so much for all your help and guidence.


----------



## Satchfan (Jan 12, 2009)

> Do i have to make malware programa and McAfee inactive


 Please do not ask about other forums and their recommendations. Ignore anything you have seen as your situation is individual , as were the ones you have seen.

Also, many of these forums have advice given by untrained advisors who could do more damage than good.

At present you do not have to disable anything, nor should you delete/run anything unless requested. If and when you need to do something, I'll give instructions.

Please proceed with the previous instructions.

Thanks

Satchfan


----------



## seemacima (Jul 16, 2011)

thank you i will start doing as you have instructed right now...


----------



## seemacima (Jul 16, 2011)

here is the OTL.Txt file( i unchecked the word wrap)OTL logfile created on: 7/18/2011 1:37:34 PM - Run 1OTL by OldTimer - Version 3.2.26.1 Folder = C:\Documents and Settings\prakash1\DesktopWindows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstationInternet Explorer (Version = 8.0.6001.18702)Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy 1023.00 Mb Total Physical Memory | 446.62 Mb Available Physical Memory | 43.66% Memory free1.65 Gb Paging File | 1.05 Gb Available in Paging File | 63.48% Paging File freePaging file location(s): C:\pagefile.sys 768 1536 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program FilesDrive C: | 55.87 Gb Total Space | 24.15 Gb Free Space | 43.23% Space Free | Partition Type: NTFSDrive F: | 7.44 Gb Total Space | 4.98 Gb Free Space | 66.98% Space Free | Partition Type: FAT32 Computer Name: FAMILY | User Name: prakash1 | Logged in as Administrator.Boot Mode: Normal | Scan Mode: Current userCompany Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Documents and Settings\prakash1\Desktop\OTL.exe (OldTimer Tools)PRC - c:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)PRC - C:\WINDOWS\system32\mfevtps.exe (McAfee, Inc.)PRC - C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe (McAfee, Inc.)PRC - C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe (McAfee, Inc.)PRC - C:\Program Files\Microsoft\BingBar\SeaPort.EXE (Microsoft Corporation)PRC - C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)PRC - C:\Program Files\Common Files\Java\Java Update\jucheck.exe (Sun Microsystems, Inc.)PRC - C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe (Corel, Inc.)PRC - C:\Program Files\McAfee Online Backup\MOBKstat.exe (McAfee, Inc.)PRC - C:\Program Files\McAfee Online Backup\MOBKbackup.exe (McAfee, Inc.)PRC - C:\Program Files\Common Files\Corel\Standby\Standby.exe (Corel)PRC - C:\Program Files\McAfee\MPF\MpfSrv.exe (McAfee, Inc.)PRC - C:\Program Files\McAfee\MSK\msksrver.exe (McAfee, Inc.)PRC - C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe (Intuit Inc.)PRC - C:\Program Files\Virtual Account Numbers\CitiVAN.exe (Orbiscom Ltd. All rights reserved.)PRC - C:\WINDOWS\system32\OBroker.exe (Orbiscom Ltd.)PRC - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)PRC - C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe (Protexis Inc.)PRC - C:\WINDOWS\system32\PSIService.exe ()PRC - C:\Program Files\Maxtor\Maxtor Backup\MaxBackServiceInt.exe ()PRC - C:\Program Files\Maxtor\OneTouch\Utils\SyncServices.exe ( )PRC - C:\ScanPanel\ScnPanel.exe () ========== Modules (SafeList) ========== MOD - C:\Documents and Settings\prakash1\Desktop\OTL.exe (OldTimer Tools)MOD - c:\Program Files\McAfee\SiteAdvisor\sahook.dll (McAfee, Inc.)MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation) ========== Win32 Services (SafeList) ========== SRV - (RoxLiveShare9) -- File not foundSRV - (HidServ) -- File not foundSRV - (AppMgmt) -- File not foundSRV - (MBAMService) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)SRV - (McODS) -- C:\Program Files\McAfee\VirusScan\mcods.exe (McAfee, Inc.)SRV - (mfevtp) -- C:\WINDOWS\system32\mfevtps.exe (McAfee, Inc.)SRV - (mfefire) -- C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe (McAfee, Inc.)SRV - (McShield) -- C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe ()SRV - (BBSvc) -- C:\Program Files\Microsoft\BingBar\BBSvc.EXE (Microsoft Corporation.)SRV - (SeaPort) -- C:\Program Files\Microsoft\BingBar\SeaPort.EXE (Microsoft Corporation)SRV - (McProxy) -- C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)SRV - (McNASvc) -- C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)SRV - (McNaiAnn) -- C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)SRV - (mcmscsvc) -- C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)SRV - (McAfee SiteAdvisor Service) -- C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)SRV - (MOBKbackup) -- C:\Program Files\McAfee Online Backup\MOBKbackup.exe (McAfee, Inc.)SRV - (MpfService) -- C:\Program Files\McAfee\MPF\MPFSrv.exe (McAfee, Inc.)SRV - (MSK80Service) -- C:\Program Files\McAfee\MSK\MskSrver.exe (McAfee, Inc.)SRV - (IntuitUpdateService) -- C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe (Intuit Inc.)SRV - (YahooAUService) -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)SRV - (SerialKeys) -- C:\WINDOWS\system32\skeys.exe (Microsoft Corporation)SRV - (PSI_SVC_2) -- C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe (Protexis Inc.)SRV - (ProtexisLicensing) -- C:\WINDOWS\system32\PSIService.exe ()SRV - (SSScsiSV) -- C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe (Sony Corporation)SRV - (MSCSPTISRV) -- C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe (Sony Corporation)SRV - (PACSPTISVR) -- C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe (Sony Corporation)SRV - (SPTISRV) -- C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe (Sony Corporation)SRV - (MaxBackServiceInt) -- C:\Program Files\Maxtor\Maxtor Backup\MaxBackServiceInt.exe ()SRV - (NTService1) -- C:\Program Files\Maxtor\OneTouch\Utils\SyncServices.exe ( ) ========== Driver Services (SafeList) ========== DRV - (MBAMProtector) -- C:\WINDOWS\system32\drivers\mbam.sys (Malwarebytes Corporation)DRV - (mfehidk) -- C:\WINDOWS\system32\drivers\mfehidk.sys (McAfee, Inc.)DRV - (mfefirek) -- C:\WINDOWS\system32\drivers\mfefirek.sys (McAfee, Inc.)DRV - (mfeavfk) -- C:\WINDOWS\system32\drivers\mfeavfk.sys (McAfee, Inc.)DRV - (mfeapfk) -- C:\WINDOWS\system32\drivers\mfeapfk.sys (McAfee, Inc.)DRV - (mfetdi2k) -- C:\WINDOWS\system32\drivers\mfetdi2k.sys (McAfee, Inc.)DRV - (mferkdet) -- C:\WINDOWS\system32\drivers\mferkdet.sys (McAfee, Inc.)DRV - (mfendiskmp) -- C:\WINDOWS\system32\drivers\mfendisk.sys (McAfee, Inc.)DRV - (mfendisk) -- C:\WINDOWS\system32\drivers\mfendisk.sys (McAfee, Inc.)DRV - (mfebopk) -- C:\WINDOWS\system32\drivers\mfebopk.sys (McAfee, Inc.)DRV - (cfwids) -- C:\WINDOWS\system32\drivers\cfwids.sys (McAfee, Inc.)DRV - (MPFP) -- C:\WINDOWS\system32\drivers\Mpfp.sys (McAfee, Inc.)DRV - (MOBKFilter) -- C:\WINDOWS\system32\drivers\MOBK.sys (Mozy, Inc.)DRV - (mfesmfk) -- C:\WINDOWS\system32\drivers\mfesmfk.sys (McAfee, Inc.)DRV - (mferkdk) -- C:\WINDOWS\system32\drivers\mferkdk.sys (McAfee, Inc.)DRV - (GoProto) -- C:\WINDOWS\system32\drivers\goprot51.sys (Gteko Ltd.)DRV - (Cdralw2k) -- C:\WINDOWS\System32\drivers\cdralw2k.sys (Sonic Solutions)DRV - (Cdr4_xp) -- C:\WINDOWS\System32\drivers\cdr4_xp.sys (Sonic Solutions)DRV - (MXOPSWD) -- C:\WINDOWS\system32\drivers\mxopswd.sys (Maxtor Corp.)DRV - (SDDMI2) -- C:\WINDOWS\system32\DDMI2.sys (Gteko Ltd.)DRV - (cdrbsdrv) -- C:\WINDOWS\System32\drivers\CDRBSDRV.SYS (B.H.A Corporation)DRV - (pfc) -- C:\WINDOWS\system32\drivers\pfc.sys (Padus, Inc.)DRV - (PhilCam8116) Logitech QuickCam Pro 3000(PID_08B0) -- C:\WINDOWS\system32\drivers\CamDrL21.sys (Logitech Inc.)DRV - (sonypvs1) -- C:\WINDOWS\system32\drivers\sonypvs1.sys (Sony Corporation)DRV - (HSFHWBS2) -- C:\WINDOWS\system32\drivers\HSFHWBS2.sys (Conexant Systems)DRV - (HSF_DP) -- C:\WINDOWS\system32\drivers\HSF_DP.sys (Conexant Systems)DRV - (winachsf) -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys (Conexant Systems)DRV - (OMCI) -- C:\WINDOWS\SYSTEM32\DRIVERS\OMCI.SYS (Dell Computer Corporation)DRV - (wandrv) -- C:\WINDOWS\system32\drivers\wandrv.sys (America Online, Inc.) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.htmlIE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch = http://us.rd.yahoo.com/customize/ie/defaults/cs/msgr8/*http://www.yahoo.com/ext/search/search.htmlIE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ieIE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/?fr=fp-yie8IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.htmlIE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.comIE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = GoogleIE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/webhp?sourceid=navclient&ie=UTF-8IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ieIE - HKCU\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn7\yt.dll (Yahoo! Inc.)IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = ;*.localIE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 210.212.123.10:8080 ========== FireFox ========== FF - prefs.js..extensions.enabledItems: [email protected]:1.7FF - prefs.js..extensions.enabledItems: [email protected]:1.0.2 FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not foundFF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation)FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.57\npGoogleUpdate3.dll (Google Inc.)FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.57\npGoogleUpdate3.dll (Google Inc.)FF - HKLM\Software\MozillaPlugins\[email protected]/YahooActiveXPluginBridge;version=1.0.0.1: C:\PROGRA~1\Yahoo!\Common\npyaxmpb.dll (Yahoo! Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files\Virtual Account Numbers [2009/12/10 00:32:21 | 000,000,000 | ---D | M]FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{B7082FAA-CB62-4872-9106-E42DD88EDE45}: C:\Program Files\McAfee\SiteAdvisor [2011/05/24 18:16:26 | 000,000,000 | ---D | M] [2009/12/17 22:52:25 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\prakash1\Application Data\Mozilla\Extensions[2009/12/17 22:52:25 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\prakash1\Application Data\Mozilla\Extensions\[email protected] not found (No name found) -- C:\PROGRAM FILES\TOMTOM HOME 2\XUL\EXTENSIONS\[email protected] O1 HOSTS File: ([2002/09/03 09:34:19 | 000,000,734 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hostsO1 - Hosts: 127.0.0.1 localhostO2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn7\yt.dll (Yahoo! Inc.)O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)O2 - BHO: (Virtual Account Numbers Helper) - {17424104-1444-4810-85D7-B4DA413C5A9A} - C:\Program Files\Virtual Account Numbers\CitiVANHelper.dll (Orbiscom Ltd. All rights reserved.)O2 - BHO: (McAfee Phishing Filter) - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - File not foundO2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - File not foundO2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll (Google Inc.)O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn7\YTSingleInstance.dll (Yahoo! Inc)O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)O3 - HKLM\..\Toolbar: (TurboTax ItsDeductible) - {35CE0AE2-3411-4BB8-A16A-BEE30B282A26} - C:\Program Files\Intuit\IDO\IDOToolbar.dll ()O3 - HKLM\..\Toolbar: (Virtual Account Numbers) - {7A21A046-B886-4A62-9D69-EF2059B0A27B} - C:\Program Files\Virtual Account Numbers\CitiVANToolbar.dll (Orbiscom Ltd. All rights reserved.)O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn7\yt.dll (Yahoo! Inc.)O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)O3 - HKCU\..\Toolbar\WebBrowser: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn7\yt.dll (Yahoo! Inc.)O4 - HKLM..\Run: [Citi Virtual Account Numbers] C:\Program Files\Virtual Account Numbers\CitiVAN.exe (Orbiscom Ltd. All rights reserved.)O4 - HKLM..\Run: [Corel File Shell Monitor] File not foundO4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)O4 - HKLM..\Run: [mcui_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)O4 - HKLM..\Run: [Standby] C:\Program Files\Common Files\Corel\Standby\Standby.exe (Corel)O4 - HKCU..\Run: [Corel Photo Downloader] C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe (Corel, Inc.)O4 - HKCU..\Run: [TomTomHOME.exe] File not foundO4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Online Backup Status.lnk = C:\Program Files\McAfee Online Backup\MOBKstat.exe (McAfee, Inc.)O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ScanPanel.lnk = C:\ScanPanel\ScnPanel.exe ()O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 0O9 - Extra Button: TurboTax ItsDeductible - {A26ABCF0-1C8F-46e7-A67C-0489DC21B9CC} - C:\Program Files\Intuit\IDO\IDOToolbar.dll ()O9 - Extra 'Tools' menuitem : TurboTax ItsDeductible - {A26ABCF0-1C8F-46e7-A67C-0489DC21B9CC} - Reg Error: Value error. File not foundO10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)O15 - HKCU\..Trusted Domains: ([]msn in My Computer)O15 - HKCU\..Trusted Domains: ameritrade.com ([]https in Trusted sites)O15 - HKCU\..Trusted Domains: intuit.com ([ttlc] https in Trusted sites)O15 - HKCU\..Trusted Domains: tdameritrade.com ([]https in Trusted sites)O15 - HKCU\..Trusted Domains: turbotax.com ([]https in Trusted sites)O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,84/mcinsctl.cab (Reg Error: Key error.)O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} http://www.winkflash.com/photo/loaders/ImageUploader4.cab (Image Uploader Control)O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab (Shockwave Flash Object)O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} http://gfx1.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab (Windows Live Hotmail Photo Upload Tool)O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.)O16 - DPF: Garmin Internet Explorer Plug-In https://my.garmin.com/mygarmin/m/GarminAxControl.CAB (Reg Error: Key error.)O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1 205.171.3.25O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)O24 - Desktop WallPaper: C:\Documents and Settings\prakash1\Local Settings\Application Data\Microsoft\Wallpaper1.bmpO24 - Desktop BackupWallPaper: C:\Documents and Settings\prakash1\Local Settings\Application Data\Microsoft\Wallpaper1.bmpO32 - HKLM CDRom: AutoRun - 1O32 - AutoRun File - [2006/08/05 20:13:31 | 000,000,050 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]O33 - MountPoints2\{5ae9c4c4-eb90-11de-a110-0007e97bdd08}\Shell\AutoRun\command - "" = F:\InstallTomTomHOME.exeO34 - HKLM BootExecute: (autocheck autochk *) - File not foundO35 - HKLM\..comfile [open] -- "%1" %*O35 - HKLM\..exefile [open] -- "%1" %*O37 - HKLM\...com [@ = comfile] -- "%1" %*O37 - HKLM\...exe [@ = exefile] -- "%1" %* NetSvcs: 6to4 - File not foundNetSvcs: AppMgmt - File not foundNetSvcs: HidServ - File not foundNetSvcs: Ias - File not foundNetSvcs: Iprip - File not foundNetSvcs: Irmon - File not foundNetSvcs: NWCWorkstation - File not foundNetSvcs: Nwsapagent - File not foundNetSvcs: WmdmPmSp - File not foundNetSvcs: uploadmgr - File not found Drivers32: msacm.dvacm - C:\Program Files\Common Files\Ulead Systems\VIO\DVACM.acm (Corel TW Corp.)Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)Drivers32: msacm.MPEGacm - C:\Program Files\Common Files\Ulead Systems\MPEG\MPEGACM.acm (Ulead Systems, Inc.)Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)Drivers32: msacm.ulmp3acm - C:\Program Files\Common Files\Ulead Systems\MPEG\ulmp3acm.acm (Ulead systems)Drivers32: MSVideo - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()Drivers32: vidc.tscc - C:\WINDOWS\System32\tsccvid.dll (TechSmith Corporation)Drivers32: VIDC.WMV3 - C:\WINDOWS\System32\wmv9vcm.dll (Microsoft Corporation) CREATERESTOREPOINTRestore point Set: OTL Restore Point ========== Files/Folders - Created Within 30 Days ========== [2011/07/18 13:34:03 | 000,579,584 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\prakash1\Desktop\OTL.exe[2011/07/18 13:17:12 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\McAfee[2011/07/16 11:27:52 | 000,041,272 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys[2011/07/16 11:27:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware[2011/07/16 11:27:38 | 000,022,712 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys[2011/07/16 11:27:36 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware[2011/07/16 11:26:42 | 009,466,208 | ---- | C] (Malwarebytes Corporation ) -- C:\Documents and Settings\prakash1\My Documents\mbam-setup-1.51.1.1800.exe[2011/07/15 16:18:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\prakash1\Application Data\Malwarebytes[2011/07/15 16:17:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes[2011/07/15 13:50:18 | 000,000,000 | R--D | C] -- C:\Documents and Settings\prakash1\Recent[2011/07/11 16:22:39 | 000,000,000 | ---D | C] -- C:\Program Files\Apple Software Update[2011/07/11 16:15:40 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\iTunes[2011/07/11 16:12:23 | 000,000,000 | ---D | C] -- C:\Program Files\iPod[2011/07/11 16:11:27 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes[2011/07/09 12:14:25 | 000,018,120 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\Artec48.sys[2011/07/09 12:14:25 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\e+ 48U[2011/07/09 12:14:08 | 000,007,168 | ---- | C] (ULTIMA ELECTRONICS CORP.) -- C:\WINDOWS\System32\48UMicro.dll[2011/07/09 12:14:05 | 000,045,056 | ---- | C] (ULTIMA ELECTRONICS CORP.) -- C:\WINDOWS\System32\Remove48U.exe[2011/07/03 17:19:07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\prakash1\Start Menu\Programs\WM Converter 2.0[2011/07/03 17:18:50 | 000,000,000 | ---D | C] -- C:\Program Files\WM Converter[2011/07/03 16:47:45 | 000,000,000 | ---D | C] -- C:\Documents and Settings\prakash1\Local Settings\Application Data\WMTools Downloaded Files[2011/06/23 20:41:19 | 000,404,640 | ---- | C] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl[2000/05/16 15:37:14 | 000,046,080 | ---- | C] (InstallShield Software Corporation) -- C:\Program Files\Setup.exe[9 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ][6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ][3 C:\Documents and Settings\prakash1\My Documents\*.tmp files -> C:\Documents and Settings\prakash1\My Documents\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2011/07/18 14:01:03 | 000,000,240 | ---- | M] () -- C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job[2011/07/18 13:52:01 | 000,000,886 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job[2011/07/18 13:42:01 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job[2011/07/18 13:42:00 | 000,001,247 | ---- | M] () -- C:\WINDOWS\ScnPanel.ini[2011/07/18 13:34:15 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\prakash1\Desktop\OTL.exe[2011/07/18 13:30:20 | 000,002,515 | ---- | M] () -- C:\Documents and Settings\prakash1\Desktop\Microsoft Office Word 2007.lnk[2011/07/18 13:22:24 | 000,000,428 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{0B8D5D45-4DE7-4CF4-B38A-8AE2A9D2EC6A}.job[2011/07/18 13:22:10 | 000,019,445 | ---- | M] () -- C:\WINDOWS\System32\Config.MPF[2011/07/18 13:16:56 | 000,000,882 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job[2011/07/18 13:16:33 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat[2011/07/18 13:16:26 | 1072,766,976 | -HS- | M] () -- C:\hiberfil.sys[2011/07/17 14:17:02 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl[2011/07/16 13:24:09 | 000,256,656 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT[2011/07/16 11:26:59 | 009,466,208 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\prakash1\My Documents\mbam-setup-1.51.1.1800.exe[2011/07/15 16:10:10 | 001,008,041 | ---- | M] () -- C:\Documents and Settings\prakash1\My Documents\iExplore.exe[2011/07/15 16:07:37 | 000,001,134 | ---- | M] () -- C:\Documents and Settings\prakash1\My Documents\FixNCR.reg[2011/07/15 15:08:06 | 000,684,297 | ---- | M] () -- C:\Documents and Settings\prakash1\My Documents\unhide.exe[2011/07/15 01:06:20 | 000,000,346 | ---- | M] () -- C:\WINDOWS\tasks\McDefragTask.job[2011/07/14 16:13:02 | 000,045,436 | ---- | M] () -- C:\WINDOWS\MOBK.blk[2011/07/14 16:13:01 | 000,002,004 | ---- | M] () -- C:\WINDOWS\MOBK.flt[2011/07/13 16:19:51 | 000,039,577 | ---- | M] () -- C:\Documents and Settings\prakash1\My Documents\Smile.gif[2011/07/12 19:06:05 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK[2011/07/11 17:41:44 | 000,009,741 | ---- | M] () -- C:\Documents and Settings\prakash1\My Documents\Animation11.gif[2011/07/11 16:15:42 | 000,001,542 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\iTunes.lnk[2011/07/10 20:16:30 | 000,586,596 | ---- | M] () -- C:\Documents and Settings\prakash1\Desktop\Image1.jpg[2011/07/10 19:57:17 | 000,000,848 | -HS- | M] () -- C:\Documents and Settings\All Users\Application Data\KGyGaAvL.sys[2011/07/09 12:47:30 | 000,030,720 | ---- | M] () -- C:\WINDOWS\6816White12.dat[2011/07/09 12:47:30 | 000,000,032 | ---- | M] () -- C:\WINDOWS\6816Error.dat[2011/07/09 12:47:25 | 000,030,720 | ---- | M] () -- C:\WINDOWS\6816Dark12.dat[2011/07/09 12:47:21 | 000,000,006 | ---- | M] () -- C:\WINDOWS\6816Exposure.dat[2011/07/09 12:47:21 | 000,000,003 | ---- | M] () -- C:\WINDOWS\6816Offset.dat[2011/07/09 12:47:21 | 000,000,003 | ---- | M] () -- C:\WINDOWS\6816Gain.dat[2011/07/09 12:14:28 | 000,001,355 | ---- | M] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ScanPanel.lnk[2011/07/09 12:10:35 | 000,948,144 | ---- | M] () -- C:\Documents and Settings\prakash1\My Documents\setup_123132.exe[2011/07/06 19:52:42 | 000,041,272 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys[2011/07/06 19:52:42 | 000,022,712 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys[2011/07/05 13:03:09 | 000,015,872 | ---- | M] () -- C:\Documents and Settings\prakash1\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini[2011/07/05 13:03:00 | 000,000,202 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini[2011/07/03 17:31:21 | 068,628,881 | ---- | M] () -- C:\Documents and Settings\prakash1\My Documents\VTS_01_1.VOB.asf[2011/07/03 17:17:38 | 000,287,008 | ---- | M] () -- C:\Documents and Settings\prakash1\My Documents\SoftonicDownloader_for_wm-converter.exe[2011/07/03 17:08:49 | 000,025,182 | ---- | M] () -- C:\Documents and Settings\prakash1\My Documents\VIDEO-TS.avi[2011/07/03 16:58:48 | 004,087,940 | ---- | M] () -- C:\Documents and Settings\prakash1\My Documents\Animation1.gif[2011/06/30 13:45:20 | 000,000,104 | ---- | M] () -- C:\Documents and Settings\prakash1\Desktop\Shortcut to Internet Explorer.lnk[2011/06/23 20:41:20 | 000,404,640 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl[2011/06/19 12:02:56 | 005,448,081 | ---- | M] () -- C:\Documents and Settings\prakash1\My Documents\DSCN1247.JPG[2011/06/19 12:02:52 | 005,297,901 | ---- | M] () -- C:\Documents and Settings\prakash1\My Documents\DSCN1246.JPG[2011/06/19 12:02:46 | 004,951,032 | ---- | M] () -- C:\Documents and Settings\prakash1\My Documents\DSCN1245.JPG[2011/06/19 12:01:30 | 005,451,584 | ---- | M] () -- C:\Documents and Settings\prakash1\My Documents\DSCN1244.JPG[2011/06/19 12:01:22 | 005,335,572 | ---- | M] () -- C:\Documents and Settings\prakash1\My Documents\DSCN1243.JPG[2011/06/19 12:01:06 | 005,233,372 | ---- | M] () -- C:\Documents and Settings\prakash1\My Documents\DSCN1242.JPG[2011/06/19 12:00:48 | 005,066,604 | ---- | M] () -- C:\Documents and Settings\prakash1\My Documents\DSCN1241.JPG[2011/06/19 12:00:20 | 004,544,722 | ---- | M] () -- C:\Documents and Settings\prakash1\My Documents\DSCN1240.JPG[2011/06/19 11:00:52 | 005,045,051 | ---- | M] () -- C:\Documents and Settings\prakash1\My Documents\DSCN1239.JPG[2011/06/19 11:00:30 | 005,256,567 | ---- | M] () -- C:\Documents and Settings\prakash1\My Documents\DSCN1238.JPG[2011/06/19 10:58:54 | 005,073,889 | ---- | M] () -- C:\Documents and Settings\prakash1\My Documents\DSCN1237.JPG[2011/06/19 10:52:20 | 004,948,068 | ---- | M] () -- C:\Documents and Settings\prakash1\My Documents\DSCN1236.JPG[2011/06/19 10:52:12 | 004,975,431 | ---- | M] () -- C:\Documents and Settings\prakash1\My Documents\DSCN1235.JPG[9 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ][6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ][3 C:\Documents and Settings\prakash1\My Documents\*.tmp files -> C:\Documents and Settings\prakash1\My Documents\*.tmp -> ] ========== Files Created - No Company Name ========== [2011/07/17 14:24:47 | 1072,766,976 | -HS- | C] () -- C:\hiberfil.sys[2011/07/15 16:08:55 | 001,008,041 | ---- | C] () -- C:\Documents and Settings\prakash1\My Documents\iExplore.exe[2011/07/15 16:07:24 | 000,001,134 | ---- | C] () -- C:\Documents and Settings\prakash1\My Documents\FixNCR.reg[2011/07/15 15:30:46 | 000,002,393 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\TurboTax 2009.lnk[2011/07/15 15:30:46 | 000,002,393 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\TurboTax 2008.lnk[2011/07/15 15:30:46 | 000,001,809 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Maxtor OneTouch  Manager.lnk[2011/07/15 15:30:46 | 000,001,618 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Citi Virtual Account Numbers.lnk[2011/07/15 15:30:46 | 000,001,542 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\iTunes.lnk[2011/07/15 15:30:45 | 000,001,729 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader 8.lnk[2011/07/15 15:30:42 | 000,001,355 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ScanPanel.lnk[2011/07/15 15:30:41 | 000,000,780 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Online Backup Status.lnk[2011/07/15 15:30:14 | 000,001,467 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Yahoo! Mail.lnk[2011/07/15 15:30:14 | 000,001,077 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Windows Live ID.lnk[2011/07/15 15:30:14 | 000,000,829 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Windows Messenger.lnk[2011/07/15 15:30:13 | 000,001,854 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Safari.lnk[2011/07/15 15:30:13 | 000,001,846 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\MSN Explorer.lnk[2011/07/15 15:30:13 | 000,001,077 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Default Manager.lnk[2011/07/15 15:30:13 | 000,000,748 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Word.lnk[2011/07/15 15:30:12 | 000,002,347 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Adobe Reader 8.lnk[2011/07/15 15:30:12 | 000,001,830 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Apple Software Update.lnk[2011/07/15 15:30:12 | 000,001,052 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Corel Painter Photo Essentials 4.lnk[2011/07/15 15:30:12 | 000,000,636 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Audacity.lnk[2011/07/15 15:08:03 | 000,684,297 | ---- | C] () -- C:\Documents and Settings\prakash1\My Documents\unhide.exe[2011/07/13 16:19:51 | 000,039,577 | ---- | C] () -- C:\Documents and Settings\prakash1\My Documents\Smile.gif[2011/07/11 17:41:44 | 000,009,741 | ---- | C] () -- C:\Documents and Settings\prakash1\My Documents\Animation11.gif[2011/07/11 16:22:52 | 000,000,284 | ---- | C] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job[2011/07/10 20:16:29 | 000,586,596 | ---- | C] () -- C:\Documents and Settings\prakash1\Desktop\Image1.jpg[2011/07/09 12:14:27 | 000,011,479 | ---- | C] () -- C:\WINDOWS\Dusb4ar.ini[2011/07/09 12:14:27 | 000,002,651 | ---- | C] () -- C:\WINDOWS\Ausba4.ini[2011/07/09 12:14:27 | 000,001,247 | ---- | C] () -- C:\WINDOWS\ScnPanel.ini[2011/07/09 12:14:25 | 000,008,192 | ---- | C] () -- C:\WINDOWS\System32\drivers\Artec48.usb[2011/07/09 12:14:08 | 000,167,936 | ---- | C] () -- C:\WINDOWS\Ausba4.dll[2011/07/09 12:14:08 | 000,167,936 | ---- | C] () -- C:\WINDOWS\A4.dll[2011/07/09 12:14:08 | 000,045,056 | ---- | C] () -- C:\WINDOWS\Getkey.dll[2011/07/09 12:14:04 | 000,001,607 | ---- | C] () -- C:\WINDOWS\ePlus48U142.ini[2011/07/09 12:10:31 | 000,948,144 | ---- | C] () -- C:\Documents and Settings\prakash1\My Documents\setup_123132.exe[2011/07/03 22:23:53 | 000,002,515 | ---- | C] () -- C:\Documents and Settings\prakash1\Desktop\Microsoft Office Word 2007.lnk[2011/07/03 17:20:07 | 068,628,881 | ---- | C] () -- C:\Documents and Settings\prakash1\My Documents\VTS_01_1.VOB.asf[2011/07/03 17:17:20 | 000,287,008 | ---- | C] () -- C:\Documents and Settings\prakash1\My Documents\SoftonicDownloader_for_wm-converter.exe[2011/07/03 17:08:48 | 000,025,182 | ---- | C] () -- C:\Documents and Settings\prakash1\My Documents\VIDEO-TS.avi[2011/07/03 16:58:47 | 004,087,940 | ---- | C] () -- C:\Documents and Settings\prakash1\My Documents\Animation1.gif[2011/06/30 13:45:20 | 000,000,104 | ---- | C] () -- C:\Documents and Settings\prakash1\Desktop\Shortcut to Internet Explorer.lnk[2011/06/23 22:38:48 | 005,233,372 | ---- | C] () -- C:\Documents and Settings\prakash1\My Documents\DSCN1242.JPG[2011/06/23 22:38:47 | 005,448,081 | ---- | C] () -- C:\Documents and Settings\prakash1\My Documents\DSCN1247.JPG[2011/06/23 22:38:38 | 004,951,032 | ---- | C] () -- C:\Documents and Settings\prakash1\My Documents\DSCN1245.JPG[2011/06/23 22:38:37 | 005,451,584 | ---- | C] () -- C:\Documents and Settings\prakash1\My Documents\DSCN1244.JPG[2011/06/23 22:38:36 | 005,335,572 | ---- | C] () -- C:\Documents and Settings\prakash1\My Documents\DSCN1243.JPG[2011/06/21 23:40:03 | 016,493,946 | ---- | C] () -- C:\Documents and Settings\prakash1\My Documents\DSCN3558.MOV[2011/06/21 23:39:22 | 001,123,762 | ---- | C] () -- C:\Documents and Settings\prakash1\My Documents\DSCN3591.MOV[2011/06/21 22:52:18 | 005,066,604 | ---- | C] () -- C:\Documents and Settings\prakash1\My Documents\DSCN1241.JPG[2011/06/21 22:52:17 | 004,544,722 | ---- | C] () -- C:\Documents and Settings\prakash1\My Documents\DSCN1240.JPG[2011/06/21 22:52:12 | 005,256,567 | ---- | C] () -- C:\Documents and Settings\prakash1\My Documents\DSCN1238.JPG[2011/06/21 22:52:12 | 005,045,051 | ---- | C] () -- C:\Documents and Settings\prakash1\My Documents\DSCN1239.JPG[2011/06/21 22:52:11 | 005,073,889 | ---- | C] () -- C:\Documents and Settings\prakash1\My Documents\DSCN1237.JPG[2011/06/21 22:52:10 | 004,948,068 | ---- | C] () -- C:\Documents and Settings\prakash1\My Documents\DSCN1236.JPG[2011/06/21 22:52:03 | 004,975,431 | ---- | C] () -- C:\Documents and Settings\prakash1\My Documents\DSCN1235.JPG[2011/06/21 22:48:37 | 005,297,901 | ---- | C] () -- C:\Documents and Settings\prakash1\My Documents\DSCN1246.JPG[2011/04/05 20:02:18 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat[2011/01/21 19:59:15 | 000,001,718 | ---- | C] () -- C:\WINDOWS\ePlus48U122.ini[2011/01/21 17:47:36 | 000,000,848 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\KGyGaAvL.sys[2010/05/19 20:49:50 | 000,065,536 | ---- | C] () -- C:\WINDOWS\IFinst27.exe[2010/01/12 23:18:27 | 000,000,256 | ---- | C] () -- C:\WINDOWS\System32\pool.bin[2007/12/12 13:45:34 | 000,015,872 | ---- | C] () -- C:\Documents and Settings\prakash1\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini[2007/05/15 22:25:46 | 000,000,131 | ---- | C] () -- C:\Documents and Settings\prakash1\Local Settings\Application Data\fusioncache.dat[2007/04/14 16:53:46 | 000,000,032 | ---- | C] () -- C:\WINDOWS\basefx.INI[2007/03/20 14:56:19 | 000,005,018 | -HS- | C] () -- C:\WINDOWS\System32\KGyGaAvL.sys[2007/03/20 14:56:19 | 000,000,168 | RHS- | C] () -- C:\WINDOWS\System32\08801E1EA7.sys[2007/02/05 21:25:16 | 000,000,560 | ---- | C] () -- C:\Documents and Settings\prakash1\Application Data\ViewerApp.dat[2006/12/25 22:23:21 | 000,000,031 | ---- | C] () -- C:\WINDOWS\QUICKEN.INI[2006/12/15 19:38:29 | 000,520,192 | ---- | C] () -- C:\WINDOWS\System32\CddbPlaylist2Sony.dll[2006/11/12 22:15:37 | 000,061,678 | ---- | C] () -- C:\Documents and Settings\prakash1\Application Data\PFP100JPR.{PB[2006/11/12 22:15:37 | 000,012,358 | ---- | C] () -- C:\Documents and Settings\prakash1\Application Data\PFP100JCM.{PB[2006/11/02 20:40:12 | 000,174,656 | ---- | C] () -- C:\WINDOWS\System32\PSIService.exe[2006/09/04 19:49:19 | 000,000,201 | ---- | C] () -- C:\WINDOWS\nsreg.dat[2006/08/05 20:11:07 | 000,003,654 | ---- | C] () -- C:\WINDOWS\System32\drivers\Sonyhcp.dll[2006/07/08 07:43:11 | 000,000,206 | ---- | C] () -- C:\WINDOWS\HPGdiPlus.ini[2006/01/10 22:30:26 | 000,000,002 | ---- | C] () -- C:\WINDOWS\msoffice.ini[2005/12/14 21:03:41 | 000,000,044 | ---- | C] () -- C:\WINDOWS\liveup.ini[2005/10/07 10:51:35 | 000,000,000 | ---- | C] () -- C:\WINDOWS\Webspace.INI[2005/08/29 02:08:23 | 000,000,021 | ---- | C] () -- C:\WINDOWS\CS_SETUP.ini[2005/08/07 22:07:30 | 000,000,000 | ---- | C] () -- C:\WINDOWS\iPlayer.INI[2005/08/07 22:01:29 | 000,000,202 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini[2005/07/24 21:57:05 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin[2005/07/24 21:47:23 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat[2005/07/24 18:43:24 | 000,000,031 | ---- | C] () -- C:\WINDOWS\AUTHMGR.INI[2005/07/15 13:15:26 | 020,678,531 | ---- | C] () -- C:\Program Files\data2.cab[2005/07/15 13:15:26 | 000,000,416 | ---- | C] () -- C:\Program Files\layout.bin[2005/07/15 13:15:16 | 000,802,143 | ---- | C] () -- C:\Program Files\data1.cab[2005/07/15 13:15:16 | 000,106,457 | ---- | C] () -- C:\Program Files\data1.hdr[2005/07/15 13:14:52 | 000,148,141 | ---- | C] () -- C:\Program Files\setup.inx[2005/07/15 13:14:52 | 000,000,156 | ---- | C] () -- C:\Program Files\Setup.ini[2005/07/06 08:47:18 | 000,000,073 | ---- | C] () -- C:\WINDOWS\PUZZLES.INI[2005/06/17 19:00:46 | 000,000,247 | ---- | C] () -- C:\WINDOWS\SIERRA.INI[2005/06/17 19:00:45 | 000,000,086 | ---- | C] () -- C:\WINDOWS\ka.ini[2005/06/11 16:14:22 | 000,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI[2005/06/02 12:31:00 | 000,040,448 | ---- | C] () -- C:\WINDOWS\Teletub.exe[2005/06/02 12:31:00 | 000,000,509 | ---- | C] () -- C:\WINDOWS\Teletub.bin[2005/06/02 12:31:00 | 000,000,018 | ---- | C] () -- C:\WINDOWS\gfact.ini[2005/06/02 12:28:51 | 000,000,513 | ---- | C] () -- C:\WINDOWS\FISHTANK.bin[2005/06/02 12:28:51 | 000,000,019 | ---- | C] () -- C:\WINDOWS\cnc.ini[2005/06/02 12:28:50 | 000,015,264 | ---- | C] () -- C:\WINDOWS\FISHTANK.exe[2005/05/26 14:18:40 | 000,032,768 | ---- | C] () -- C:\WINDOWS\System32\instlsp.exe[2005/03/04 21:30:44 | 000,030,720 | ---- | C] () -- C:\WINDOWS\6816White12.dat[2005/03/04 21:30:44 | 000,000,032 | ---- | C] () -- C:\WINDOWS\6816Error.dat[2005/03/04 21:30:40 | 000,030,720 | ---- | C] () -- C:\WINDOWS\6816Dark12.dat[2005/03/04 21:30:36 | 000,000,006 | ---- | C] () -- C:\WINDOWS\6816Exposure.dat[2005/03/04 21:30:36 | 000,000,003 | ---- | C] () -- C:\WINDOWS\6816Offset.dat[2005/03/04 21:30:36 | 000,000,003 | ---- | C] () -- C:\WINDOWS\6816Gain.dat[2005/02/07 20:10:32 | 000,339,456 | ---- | C] () -- C:\WINDOWS\System32\Tx32.dll[2005/01/25 08:53:35 | 000,006,550 | ---- | C] () -- C:\WINDOWS\jautoexp.dat[2005/01/14 17:28:26 | 000,017,563 | ---- | C] () -- C:\WINDOWS\cdplayer.ini[2005/01/11 19:30:39 | 000,011,653 | R--- | C] () -- C:\WINDOWS\System32\lvcoinst.ini[2005/01/10 22:42:31 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat[2005/01/10 22:37:49 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat[2005/01/10 17:26:14 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI[2005/01/10 17:25:12 | 000,256,656 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT[2003/12/05 15:26:56 | 000,346,602 | ---- | C] () -- C:\Program Files\ikernel.ex_[2003/10/06 12:16:00 | 000,027,136 | ---- | C] () -- C:\WINDOWS\System32\nvcod.dll[2002/09/03 10:17:03 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin[2002/09/03 10:16:59 | 000,004,594 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat[2002/09/03 09:52:01 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat[2002/09/03 09:52:00 | 000,506,918 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat[2002/09/03 09:51:58 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat[2002/09/03 09:51:54 | 000,091,466 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat[2002/09/03 09:49:33 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat[2002/09/03 09:41:59 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat[2002/09/03 09:41:43 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin[2002/09/03 09:32:10 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat[1998/10/11 00:07:38 | 000,088,576 | ---- | C] () -- C:\WINDOWS\System32\Iticheck.dll[1997/08/19 00:00:00 | 000,022,016 | ---- | C] () -- C:\WINDOWS\System32\DOCOBJ.DLL[1997/08/19 00:00:00 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\HLINKPRX.DLL ========== LOP Check ========== [2007/05/18 08:56:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Icon Constructor 3[2006/12/25 21:29:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Maxtor[2010/12/31 11:18:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PC Drivers HeadQuarters[2009/12/17 22:55:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TomTom[2011/03/25 19:50:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Ulead Systems[2010/12/18 13:54:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\WindSolutions[2010/12/18 19:21:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\WinZip[2010/12/18 10:23:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}[2005/02/27 20:32:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{9F2E1130-016E-4D98-BF17-AA8307E75FA2}[2010/12/17 21:34:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\prakash1\Application Data\Blitware[2009/01/29 22:50:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\prakash1\Application Data\GARMIN[2007/03/10 17:36:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\prakash1\Application Data\Jasc[2008/02/18 21:20:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\prakash1\Application Data\Leadertech[2010/02/08 21:49:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\prakash1\Application Data\MSNInstaller[2009/12/17 22:52:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\prakash1\Application Data\TomTom[2011/01/21 09:54:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\prakash1\Application Data\Ulead Systems[2010/12/18 13:54:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\prakash1\Application Data\WindSolutions[2011/07/15 01:06:20 | 000,000,346 | ---- | M] () -- C:\WINDOWS\Tasks\McDefragTask.job[2011/01/01 01:02:00 | 000,000,338 | ---- | M] () -- C:\WINDOWS\Tasks\McQcTask.job[2011/07/18 14:01:03 | 000,000,240 | ---- | M] () -- C:\WINDOWS\Tasks\Scheduled Update for Ask Toolbar.job[2011/07/18 13:22:24 | 000,000,428 | -H-- | M] () -- C:\WINDOWS\Tasks\User_Feed_Synchronization-{0B8D5D45-4DE7-4CF4-B38A-8AE2A9D2EC6A}.job ========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\*.* >[2006/08/05 20:13:31 | 000,000,050 | ---- | M] () -- C:\AUTOEXEC.BAT[2009/09/08 12:23:03 | 000,000,211 | RHS- | M] () -- C:\boot.ini[2005/01/10 22:40:31 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS[2007/05/09 22:11:24 | 000,009,586 | ---- | M] () -- C:\devicetable.log[2010/12/21 23:40:19 | 000,000,182 | ---- | M] () -- C:\drwtsn32.log[2007/01/26 21:28:33 | 000,004,413 | ---- | M] () -- C:\ffastun.ffa[2007/01/26 21:28:33 | 000,630,784 | ---- | M] () -- C:\ffastun.ffl[2007/01/26 21:28:33 | 000,671,744 | ---- | M] () -- C:\ffastun.ffo[2007/01/26 21:28:33 | 000,655,360 | ---- | M] () -- C:\ffastun0.ffx[2011/07/18 13:16:26 | 1072,766,976 | -HS- | M] () -- C:\hiberfil.sys[2005/01/10 22:40:31 | 000,000,000 | RHS- | M] () -- C:\IO.SYS[2006/01/03 08:51:46 | 000,000,387 | ---- | M] () -- C:\IPH.PH[2005/01/10 22:40:31 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS[2005/07/26 04:11:45 | 000,047,564 | ---- | M] () -- C:\ntdetect.com[2008/08/03 12:21:47 | 000,250,048 | ---- | M] () -- C:\ntldr[2011/07/18 13:16:04 | 805,306,368 | -HS- | M] () -- C:\pagefile.sys[2011/07/16 11:24:13 | 000,000,393 | ---- | M] () -- C:\rkill.log[2006/01/03 08:51:21 | 000,000,288 | ---- | M] () -- C:\T4Metrics.log[2006/12/14 14:52:11 | 000,000,146 | ---- | M] () -- C:\YServer.txt < %systemroot%\Fonts\*.com >[2006/04/18 15:39:28 | 000,026,040 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont[2006/06/29 14:53:56 | 000,026,489 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont[2006/04/18 15:39:28 | 000,029,779 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSerif.CompositeFont[2006/06/29 14:58:52 | 000,030,808 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont < %systemroot%\Fonts\*.dll > < %systemroot%\Fonts\*.ini >[2005/01/10 22:40:06 | 000,000,067 | -HS- | M] () -- C:\WINDOWS\Fonts\desktop.ini < %systemroot%\Fonts\*.ini2 > < %systemroot%\Fonts\*.exe > < %systemroot%\system32\spool\prtprocs\w32x86\*.* >[2008/07/06 05:06:10 | 000,089,088 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll[2006/10/26 19:56:12 | 000,033,104 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\msonpppr.dll[2008/07/06 03:50:03 | 000,597,504 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe < %systemroot%\REPAIR\*.bak1 > < %systemroot%\REPAIR\*.ini > < %systemroot%\system32\*.jpg > < %systemroot%\*.jpg > < %systemroot%\*.png > < %systemroot%\*.scr >[2005/06/02 12:28:51 | 000,148,650 | ---- | M] (Europress Software) -- C:\WINDOWS\FISHTANK.scr[2005/06/02 12:31:07 | 000,271,872 | ---- | M] (Europress Software) -- C:\WINDOWS\Teletub.scr[6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] < %systemroot%\*._sy > < %APPDATA%\Adobe\Update\*.* > < %ALLUSERSPROFILE%\Favorites\*.* >[2004/05/18 15:26:04 | 000,000,208 | ---- | M] () -- C:\Documents and Settings\All Users\Favorites\Yahoo! Mail.url[2004/05/18 15:13:06 | 000,000,207 | ---- | M] () -- C:\Documents and Settings\All Users\Favorites\Yahoo!.url < %APPDATA%\Microsoft\*.* > < %PROGRAMFILES%\*.* >[2005/07/15 13:15:16 | 000,802,143 | ---- | M] () -- C:\Program Files\data1.cab[2005/07/15 13:15:16 | 000,106,457 | ---- | M] () -- C:\Program Files\data1.hdr[2005/07/15 13:15:26 | 020,678,531 | ---- | M] () -- C:\Program Files\data2.cab[2003/12/05 15:26:56 | 000,346,602 | ---- | M] () -- C:\Program Files\ikernel.ex_[2005/07/15 13:15:26 | 000,000,416 | ---- | M] () -- C:\Program Files\layout.bin[2000/05/16 15:37:14 | 000,046,080 | ---- | M] (InstallShield Software Corporation) -- C:\Program Files\Setup.exe[2005/07/15 13:14:52 | 000,000,156 | ---- | M] () -- C:\Program Files\Setup.ini[2005/07/15 13:14:52 | 000,148,141 | ---- | M] () -- C:\Program Files\setup.inx < %APPDATA%\Update\*.* > < %systemroot%\*. /mp /s > < %systemroot%\System32\config\*.sav >[2005/01/10 17:24:32 | 000,094,208 | ---- | M] () -- C:\WINDOWS\System32\config\default.sav[2005/01/10 17:24:32 | 000,602,112 | ---- | M] () -- C:\WINDOWS\System32\config\software.sav[2005/01/10 17:24:32 | 000,393,216 | ---- | M] () -- C:\WINDOWS\System32\config\system.sav < %PROGRAMFILES%\bak. /s > < %systemroot%\system32\bak. /s > < %ALLUSERSPROFILE%\Start Menu\*.lnk /x >[2008/08/03 12:45:15 | 000,000,272 | -HS- | M] () -- C:\Documents and Settings\All Users\Start Menu\desktop.ini < %systemroot%\system32\config\systemprofile\*.dat /x > < %systemroot%\*.config > < %systemroot%\system32\*.db > < %PROGRAMFILES%\Internet Explorer\*.dat > < %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >[2006/10/27 21:37:17 | 000,000,119 | -HS- | M] () -- C:\Documents and Settings\prakash1\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini[2006/10/27 21:37:12 | 000,000,079 | ---- | M] () -- C:\Documents and Settings\prakash1\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf < %USERPROFILE%\Desktop\*.exe >[2011/01/21 21:14:08 | 029,417,648 | ---- | M] (Artec) -- C:\Documents and Settings\prakash1\Desktop\Full.exe[2011/07/18 13:34:15 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\prakash1\Desktop\OTL.exe[2011/01/20 18:32:00 | 003,299,391 | ---- | M] (Artec) -- C:\Documents and Settings\prakash1\Desktop\V1.4.2.exe < %PROGRAMFILES%\Common Files\*.* > < %systemroot%\*.src > < %systemroot%\install\*.* > < %systemroot%\system32\DLL\*.* > < %systemroot%\system32\HelpFiles\*.* > < %systemroot%\system32\rundll\*.* > < %systemroot%\winn32\*.* > < %systemroot%\Java\*.* > < %systemroot%\system32\test\*.* > < %systemroot%\system32\Rundll32\*.* > < %systemroot%\AppPatch\Custom\*.* > < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU > < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs > < >< End of report >


----------



## seemacima (Jul 16, 2011)

here is the extras.text fileOTL Extras logfile created on: 7/18/2011 1:37:34 PM - Run 1OTL by OldTimer - Version 3.2.26.1 Folder = C:\Documents and Settings\prakash1\DesktopWindows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstationInternet Explorer (Version = 8.0.6001.18702)Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy 1023.00 Mb Total Physical Memory | 446.62 Mb Available Physical Memory | 43.66% Memory free1.65 Gb Paging File | 1.05 Gb Available in Paging File | 63.48% Paging File freePaging file location(s): C:\pagefile.sys 768 1536 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program FilesDrive C: | 55.87 Gb Total Space | 24.15 Gb Free Space | 43.23% Space Free | Partition Type: NTFSDrive F: | 7.44 Gb Total Space | 4.98 Gb Free Space | 66.98% Space Free | Partition Type: FAT32 Computer Name: FAMILY | User Name: prakash1 | Logged in as Administrator.Boot Mode: Normal | Scan Mode: Current userCompany Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Extra Registry (SafeList) ========== ========== File Associations ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\].cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%* ========== Shell Spawning ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]batfile [open] -- "%1" %*cmdfile [open] -- "%1" %*comfile [open] -- "%1" %*cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*exefile [open] -- "%1" %*piffile [open] -- "%1" %*regfile [merge] -- Reg Error: Key error.scrfile [config] -- "%1"scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %lscrfile [open] -- "%1" /Stxtfile [edit] -- Reg Error: Key error.Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1Directory [Browse with Corel PaintShop Photo Pro X3] -- "C:\Program Files\Corel\Corel PaintShop Photo Pro\X3\PSPClassic\Corel Paint Shop Pro Photo.exe" "%L" (Corel, Inc.)Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) ========== Security Center Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]"AntiVirusDisableNotify" = 1"FirewallDisableNotify" = 1"UpdatesDisableNotify" = 0"AntiVirusOverride" = 0"FirewallOverride" = 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]"DisableMonitoring" = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]"DisableMonitoring" = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall] ========== System Restore Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]"DisableSR" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]"Start" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]"Start" = 2 ========== Firewall Settings ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]"139:TCP" = 139:TCP:*:Enabledxpsp2res.dll,-22004"445:TCP" = 445:TCP:*:Enabledxpsp2res.dll,-22005"137:UDP" = 137:UDP:*:Enabledxpsp2res.dll,-22001"138:UDP" = 138:UDP:*:Enabledxpsp2res.dll,-22002 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]"EnableFirewall" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]"1900:UDP" = 1900:UDP:LocalSubNetisabledxpsp2res.dll,-22007"2869:TCP" = 2869:TCP:LocalSubNetisabledxpsp2res.dll,-22008"139:TCP" = 139:TCP:LocalSubNet:Enabledxpsp2res.dll,-22004"445:TCP" = 445:TCP:LocalSubNet:Enabledxpsp2res.dll,-22005"137:UDP" = 137:UDP:LocalSubNet:Enabledxpsp2res.dll,-22001"138:UDP" = 138:UDP:LocalSubNet:Enabledxpsp2res.dll,-22002 ========== Authorized Applications List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]"C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" = C:\Program Files\EarthLink TotalAccess\TaskPanl.exe:*:Enabled:TaskPanl"C:\Program Files\Yahoo!\Messenger\YPager.exe" = C:\Program Files\Yahoo!\Messenger\YPager.exe:*:Enabled:Yahoo! Messenger"C:\Program Files\Hewlett-Packard\HP Software Update\HPWUCli.exe" = C:\Program Files\Hewlett-Packard\HP Software Update\HPWUCli.exe:*:Enabled:HP Software Update Client -- (Hewlett-Packard)"C:\Program Files\Real\RealOne Player\realplay.exe" = C:\Program Files\Real\RealOne Player\realplay.exe:*isabled:RealOne Player"C:\Program Files\Yahoo!\Messenger\YServer.exe" = C:\Program Files\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server"C:\Program Files\Google\Google Talk\googletalk.exe" = C:\Program Files\Google\Google Talk\googletalk.exe:*:Enabled:Google Talk"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" = C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"C:\Program Files\TurboTax\Deluxe 2006\32bit\ttax.exe" = C:\Program Files\TurboTax\Deluxe 2006\32bit\ttax.exe:LocalSubNet:Enabled:TurboTax"C:\Program Files\TurboTax\Deluxe 2006\32bit\updatemgr.exe" = C:\Program Files\TurboTax\Deluxe 2006\32bit\updatemgr.exe:LocalSubNet:Enabled:TurboTax Update Manager"C:\Program Files\TurboTax\Deluxe 2007\32bit\ttax.exe" = C:\Program Files\TurboTax\Deluxe 2007\32bit\ttax.exe:LocalSubNet:Enabled:TurboTax -- (Intuit, Inc.)"C:\Program Files\TurboTax\Deluxe 2007\32bit\updatemgr.exe" = C:\Program Files\TurboTax\Deluxe 2007\32bit\updatemgr.exe:LocalSubNet:Enabled:TurboTax Update Manager -- (Intuit, Inc.)"C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe" = C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe:LocalSubNetisabled:Intuit Update Shared Downloads Server -- (Intuit Inc.)"C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe" = C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe:*:Enabled:McAfee Network Agent"C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe" = C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe:*:Enabled:McAfee Shared Service Host -- (McAfee, Inc.) ========== HKEY_LOCAL_MACHINE Uninstall List ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]"_{707EB912-C597-49D8-9460-46CC9AB03EBE}" = Corel Painter Photo Essentials 4"_{D1AEB5DB-04FA-489D-94EF-8600898B93EE}" = Corel PaintShop Photo Pro X3"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148"{0840B4D6-7DD1-4187-8523-E6FC0007EFB7}" = Windows Live ID Sign-in Assistant"{0B8FF60F-C012-4459-AADF-A3AD4E3757DE}" = Dell Picture Studio - Dell Image Expert"{15EE79F4-4ED1-4267-9B0F-351009325D7D}" = HP Software Update"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer"{23BE930B-6AC4-4D0D-B5C3-03062A2BF2A3}" = OpenMG AAC Add-on Module 1.0.00"{26A24AE4-039D-4CA4-87B4-2F83216024FF}" = Java(TM) 6 Update 24"{27C467F8-F8EF-4f68-BD72-D63632B2096C}" = McAfee Online Backup"{29521505-F489-4822-ADFA-32C6DEE4F114}" = TurboTax 2008 WinPerUserEducation"{2E7595EC-4FB1-4E29-93D4-9083C8A9B107}" = TurboTax ItsDeductible 2005"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP"{353FE16B-30FE-469A-BF55-B978F4218003}" = iTunes"{35D5A740-EAA2-012B-AD08-000000000000}" = TurboTax 2009 waziper"{3881DB80-EAA2-012B-ADAE-000000000000}" = TurboTax 2009 WinPerFedFormset"{38975F50-EAA2-012B-ADB4-000000000000}" = TurboTax 2009 WinPerReleaseEngine"{38A34630-EAA2-012B-ADB6-000000000000}" = TurboTax 2009 WinPerTaxSupport"{3C5A81D0-EAA2-012B-AE9F-000000000000}" = TurboTax 2009 wrapper"{3D79DB6E-73DA-46C9-B8FA-DAE52108246F}" = OpenMG Secure Module 4.6.01"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater"{5421155F-B033-49DB-9B33-8F80F233D4D5}" = GdiplusUpgrade"{54DD126C-E5F5-404C-B4B7-66DF7FD4F2FF}" = MSSoap"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime"{58FCA730-74A6-49C0-95A7-696D78E689A3}" = e+ 48U"{5C29CB8B-AC1E-4114-8D68-9CD080140D4A}" = Sony USB Driver"{5F0C7588-DC73-4465-8BAB-21813C1EC047}" = PDF Manual NW-E000 Series"{60EEB642-E9E0-45A2-A676-B9D8FE17C4A9}" = Maxtor OneTouch III"{61BEA823-ECAF-49F1-8378-A59B3B8AD247}" = Microsoft Default Manager"{625BD732-ACDF-4552-BF22-98EBB413B6F3}" = McAfee Shredder"{63569CE9-FA00-469C-AF5C-E5D4D93ACF91}" = Windows Genuine Advantage v1.3.0254.0"{6774F0CF-C7DD-4CB4-BCB2-11C3E08BBA03}" = McAfee Shredder"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD"{6C1E7AA1-44E9-446D-AAB2-0DE6D9EFEAB1}" = Safari"{7059BDA7-E1DB-442C-B7A1-6144596720A4}" = HP Update"{707EB912-C597-49D8-9460-46CC9AB03EBE}" = Corel Painter Photo Essentials 4"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable"{7570F1CA-016D-46AC-B586-CD74645EFB52}" = TurboTax 2008 WinPerFedFormset"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053"{779DECD7-E072-4B56-9B6B-BEB5973EEEB5}" = MobileMe Control Panel"{77F8A71E-3515-4832-B8B2-2F1EDBD2E0F1}" = Bing Bar"{7B93EA76-1F0C-4777-8223-E16BFF045203}" = ItsDeductible Online Toolbar"{7C4196CA-CA41-4F34-9C08-7724E7705D52}" = Jasc Animation Shop 3"{7DD9A065-2C86-4A9F-A5FF-796EC1B99DCA}" = AnswerWorks 4.0 Runtime - English"{7E4CB404-F1E4-4E81-A1CB-2CBB310481D1}" = MLE"{853A4763-6643-4604-8D64-28BDD8925F4C}" = Apple Application Support"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar"{8777AC6D-89F9-4793-8266-DE406F343E89}" = QFolder"{88214092-836F-4E22-A5AC-569AC9EE6A0F}" = TurboTax 2008 WinPerReleaseEngine"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight"{90120000-0010-0409-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (English) 12"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007"{90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007"{90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007"{90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007"{90120000-001F-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007"{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007"{90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007"{90120000-0115-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161"{9C3F9580-F5CF-4288-894E-9FF0EB24A21C}" = Maxtor Backup"{9C411DC9-B8B8-45F3-B688-073BF4B59094}" = Virtual Account Numbers"{A0EB195B-5876-48E6-879D-33D4B2102610}" = SonicStage 4.2"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2"{A36638C0-D8B9-11D3-9801-00A0CC555167}" = Serif 3DPlus 2.0"{A4DB0F6C-851E-44E3-82EF-40D1C215A5FD}" = Maxtor Encryption"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper"{AC76BA86-7AD7-1033-7B44-A81300000003}" = Adobe Reader 8.1.4"{B1DB1AD8-C07E-4052-81A1-D2930232BA70}" = TurboTax 2008 wrapper"{B23726CF-68BF-41A6-A4EB-72F12F87FE05}" = TurboTax 2008 WinPerTaxSupport"{B82919F6-31AA-43B3-B566-5DE35D69069A}" = TurboTax ItsDeductible 2004"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2"{C2E4B5BD-32DB-4817-A060-341AB17C3F90}" = Bonjour"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update"{CACAEB5F-174D-4C7C-AC56-A33289A807CA}" = Apple Mobile Device Support"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1"{CD95F661-A5C4-44F5-A6AA-ECDD91C240C0}" = WinZip 15.0"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1"{CFF4500E-C5D6-695D-A027-B3D4DDED2CC3}" = McAfee Online Backup"{D1612A3D-0DCC-4055-BB6A-0036F31158A0}" = Setup"{D1AEB5DB-04FA-489D-94EF-8600898B93EE}" = ICA"{D3BCC13A-E4F2-45EE-846F-D143CEDDDBCB}" = DeviceIO"{D78653C3-A8FF-415F-92E6-D774E634FF2D}" = Dell ResourceCD"{D7D99A66-493F-468B-BCE1-6F88612B89D5}" = Contents"{D875FFEE-2FCE-4774-902A-749198C00A68}" = PureHD"{D8C02397-E0EF-4891-820E-1547DCC6701B}" = ContentHD"{D94ABC2B-5CA9-48B2-9266-15AB78384D3C}" = Share"{D9C4FA35-7C6B-4C9E-863B-58C4D7472F41}" = VIO"{DA4A2F61-1E26-4D51-94BB-36D77678BDAD}" = PSPH10Pro"{DA4BF4BE-3CDC-43B5-BBDA-DDDA73103111}" = Corel PaintShop Photo Pro X3"{DBCC73BA-C69A-4BF5-B4BF-F07501EE7039}" = AnswerWorks 5.0 English Runtime"{DCD941B6-F2E7-4FAF-B102-F7D4DE5FF99A}" = IPM_PSP_Pro"{DCF1928A-FC01-48E7-A7E6-4651D42EF6A1}" = PSPPRO_DCRAW"{DD763351-DE1C-4EA7-986D-A6EC8AF76434}" = TurboTax 2008 waziper"{DE700910-58F7-4D2E-B7E6-3BA2DA1B6806}" = Virtual Account Numbers"{DF8B9311-ADE7-4EDE-B121-326CAA3D225D}" = PSPPContent"{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}" = Windows Media Encoder 9 Series"{E6D9BC25-0DBC-4368-8E4A-7DEE80661CD9}" = TurboTax 2008 WinPerProgramHelp"{EA2BEBD6-87B9-41E5-95AC-7E4C165A9475}" = WexTech AnswerWorks"{EE7C3A14-1D20-49F6-B903-491561076F0F}" = ArcSoft Software Suite"{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX"{F8C6BABF-0837-4EA0-AD6C-8E5A392A7538}" = ImageMixer VCD2"{F91E1833-2D7C-4725-B98A-C779FEC41946}" = EarthLink MDAC"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX"Audacity_is1" = Audacity 1.2.6"CNXT_MODEM_PCI_VEN_14F1&DEV_2702" = Conexant SmartHSFi V92 56K DF PCI Modem"Dream_Doll_Designer" = Dream Doll Designer"EasyLinkAdvisor" = Linksys EasyLink Advisor 1.5 (1044)"HOMESTUDENTR" = Microsoft Office Home and Student 2007"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs"ie7" = Windows Internet Explorer 7"ie8" = Windows Internet Explorer 8"InstallShield_{23BE930B-6AC4-4D0D-B5C3-03062A2BF2A3}" = OpenMG AAC Add-on Module 1.0.00"InstallShield_{3D79DB6E-73DA-46C9-B8FA-DAE52108246F}" = OpenMG Secure Module 4.6.01"InstallShield_{60EEB642-E9E0-45A2-A676-B9D8FE17C4A9}" = Maxtor OneTouch III"InstallShield_{9C3F9580-F5CF-4288-894E-9FF0EB24A21C}" = Maxtor Backup"InstallShield_{A4DB0F6C-851E-44E3-82EF-40D1C215A5FD}" = Maxtor Encryption"Macromedia Shockwave Player" = Macromedia Shockwave Player"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware version 1.51.1.1800"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1"MSC" = McAfee Total Protection"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP"Multimedia Algebra 1" = Multimedia Algebra 1"NeroMultiInstaller!UninstallKey" = Nero Suite"Network Viewer" = Network Viewer"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs"NVIDIA Display Driver" = NVIDIA Display Driver"PCFriendly" = PCFriendly"PROSet" = Intel(R) PRO Ethernet Adapter and Software"Q903235" = Internet Explorer Q903235"SereneScreen Aquarium_is1" = SereneScreen Aquarium"TurboTax 2008" = TurboTax 2008"TurboTax 2009" = TurboTax 2009"TurboTax Deluxe 2007" = TurboTax Deluxe 2007"Windows Media Encoder 9" = Windows Media Encoder 9 Series"Windows Media Format Runtime" = Windows Media Format 11 runtime"Windows Media Player" = Windows Media Player 11"Windows XP Service Pack" = Windows XP Service Pack 3"WinZip Self-Extractor" = WinZip Self-Extractor"WM Converter 2.0" = WM Converter 2.0"WMFDist11" = Windows Media Format 11 runtime"wmp11" = Windows Media Player 11"Word8.0" = Microsoft Word 97"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0"Yahoo! Anti-Spy" = Yahoo! Anti-Spy"Yahoo! Companion" = Yahoo! Toolbar"Yahoo! Internet Mail" = Yahoo! Internet Mail"Yahoo! Software Update" = Yahoo! Software Update"YInstHelper" = Yahoo! Install Manager ========== HKEY_CURRENT_USER Uninstall List ========== [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]"CopyTrans Suite" = CopyTrans Suite Remove Only ========== Last 10 Event Log Errors ========== [ Application Events ]Error - 7/16/2011 4:57:24 PM | Computer Name = FAMILY | Source = crypt32 | ID = 131080Description = Failed auto update retrieval of third-party root list sequence number from: with error: This network connection does not exist. Error - 7/16/2011 4:57:24 PM | Computer Name = FAMILY | Source = crypt32 | ID = 131080Description = Failed auto update retrieval of third-party root list sequence number from: with error: This network connection does not exist. Error - 7/16/2011 4:57:24 PM | Computer Name = FAMILY | Source = crypt32 | ID = 131080Description = Failed auto update retrieval of third-party root list sequence number from: with error: This network connection does not exist. Error - 7/16/2011 4:57:24 PM | Computer Name = FAMILY | Source = crypt32 | ID = 131080Description = Failed auto update retrieval of third-party root list sequence number from: with error: This network connection does not exist. Error - 7/16/2011 4:57:25 PM | Computer Name = FAMILY | Source = crypt32 | ID = 131080Description = Failed auto update retrieval of third-party root list sequence number from: with error: This network connection does not exist. Error - 7/16/2011 4:57:25 PM | Computer Name = FAMILY | Source = crypt32 | ID = 131080Description = Failed auto update retrieval of third-party root list sequence number from: with error: This network connection does not exist. Error - 7/16/2011 5:14:44 PM | Computer Name = FAMILY | Source = McLogEvent | ID = 5051Description = A thread in process C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe took longer than 90000 ms to complete a request. The process will be terminated.Thread id : 3336 (0xd08) Thread address : 0x7C90E514 Thread message : Build VSCORE.14.4.0.333 / 5400.1158 Object being scanned = \Device\HarddiskVolume1\Program Files\Common Files\McAfee\SystemCore\mfeapfa.dll by C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe 4(0)(0) 4(0)(0) 7200(0)(0) 7595(0)(0) 7005(0)(0) 7004(0)(0) 5006(0)(0) 5004(0)(0) Error - 7/16/2011 5:17:42 PM | Computer Name = FAMILY | Source = McLogEvent | ID = 5051Description = A thread in process C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe took longer than 90000 ms to complete a request. The process will be terminated.Thread id : 3792 (0xed0) Thread address : 0x7C90E514 Thread message : Build VSCORE.14.4.0.333 / 5400.1158 Object being scanned = \Device\HarddiskVolume1\Program Files\Common Files\McAfee\SystemCore\mfebopa.dll by C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe 4(0)(0) 4(0)(0) 7200(0)(0) 7595(0)(0) 7005(0)(0) 7004(0)(0) 5006(0)(0) 5004(0)(0) Error - 7/17/2011 5:39:16 PM | Computer Name = FAMILY | Source = McLogEvent | ID = 5051Description = A thread in process C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe took longer than 90000 ms to complete a request. The process will be terminated.Thread id : 3756 (0xeac) Thread address : 0x7C90E514 Thread message : Build VSCORE.14.4.0.333 / 5400.1158 Object being scanned = \Device\HarddiskVolume1\Program Files\Common Files\McAfee\SystemCore\mfeapfa.dll by C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe 4(0)(0) 4(0)(0) 7200(0)(0) 7595(0)(0) 7005(0)(0) 7004(0)(0) 5006(0)(0) 5004(0)(0) Error - 7/18/2011 4:25:15 PM | Computer Name = FAMILY | Source = Application Hang | ID = 1002Description = Hanging application mcagent.exe, version 11.0.554.0, hang module hungapp, version 0.0.0.0, hang address 0x00000000. [ System Events ]Error - 7/17/2011 5:39:17 PM | Computer Name = FAMILY | Source = Service Control Manager | ID = 7031Description = The McShield service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service. Error - 7/17/2011 5:41:04 PM | Computer Name = FAMILY | Source = DCOM | ID = 10010Description = The server {209500FC-6B45-4693-8871-6296C4843751} did not register with DCOM within the required timeout. Error - 7/17/2011 5:41:53 PM | Computer Name = FAMILY | Source = DCOM | ID = 10010Description = The server {209500FC-6B45-4693-8871-6296C4843751} did not register with DCOM within the required timeout. Error - 7/17/2011 5:50:09 PM | Computer Name = FAMILY | Source = DCOM | ID = 10010Description = The server {209500FC-6B45-4693-8871-6296C4843751} did not register with DCOM within the required timeout. Error - 7/17/2011 5:55:59 PM | Computer Name = FAMILY | Source = DCOM | ID = 10010Description = The server {209500FC-6B45-4693-8871-6296C4843751} did not register with DCOM within the required timeout. Error - 7/17/2011 6:43:15 PM | Computer Name = FAMILY | Source = DCOM | ID = 10010Description = The server {209500FC-6B45-4693-8871-6296C4843751} did not register with DCOM within the required timeout. Error - 7/18/2011 4:19:56 PM | Computer Name = FAMILY | Source = DCOM | ID = 10010Description = The server {E0EC0F2B-773D-4DD7-BE6C-7D85D6AA6269} did not register with DCOM within the required timeout. Error - 7/18/2011 4:28:51 PM | Computer Name = FAMILY | Source = DCOM | ID = 10010Description = The server {209500FC-6B45-4693-8871-6296C4843751} did not register with DCOM within the required timeout. Error - 7/18/2011 4:29:23 PM | Computer Name = FAMILY | Source = DCOM | ID = 10010Description = The server {209500FC-6B45-4693-8871-6296C4843751} did not register with DCOM within the required timeout. Error - 7/18/2011 4:29:57 PM | Computer Name = FAMILY | Source = DCOM | ID = 10010Description = The server {209500FC-6B45-4693-8871-6296C4843751} did not register with DCOM within the required timeout. < End of report >


----------



## seemacima (Jul 16, 2011)

here is the aswMBR.exe logaswMBR version 0.9.7.777 Copyright(c) 2011 AVAST SoftwareRun date: 2011-07-18 14:28:12-----------------------------14:28:12.484 OS Version: Windows 5.1.2600 Service Pack 314:28:12.484 Number of processors: 1 586 0x20714:28:12.484 ComputerName: FAMILY UserName: 14:28:14.656 Initialize success14:30:23.921 AVAST engine defs: 1107180014:32:50.562 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-314:32:50.562 Disk 0 Vendor: IC35L060AVV207-0 V22OA66A Size: 57220MB BusType: 314:32:50.593 Disk 0 MBR read successfully14:32:50.593 Disk 0 MBR scan14:32:50.718 Disk 0 MBR:Alureon-I [Rtk]14:32:50.718 Disk 0 [email protected] code has been found14:32:50.718 Disk 0 MBR [TDL4] **ROOTKIT**14:32:50.796 Disk 0 scanning C:\WINDOWS\system32\drivers14:33:24.718 Service scanning14:33:30.484 Disk 0 trace - called modules:14:33:30.484 ntoskrnl.exe CLASSPNP.SYS disk.sys atapi.sys hal.dll pciide.sys 14:33:30.484 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x86fdcab8]14:33:30.484 3 CLASSPNP.SYS[f78affd7] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x86fcbd98]14:33:32.031 AVAST engine scan C:\WINDOWS14:34:06.218 AVAST engine scan C:\WINDOWS\system3214:40:22.593 AVAST engine scan C:\WINDOWS\system32\drivers14:40:53.875 AVAST engine scan C:\Documents and Settings\prakash114:52:04.953 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\prakash1\Desktop\MBR.dat"14:52:04.968 The log file has been saved successfully to "C:\Documents and Settings\prakash1\Desktop\aswMBR.txt"aswMBR version 0.9.7.777 Copyright(c) 2011 AVAST SoftwareRun date: 2011-07-18 14:28:12-----------------------------14:28:12.484 OS Version: Windows 5.1.2600 Service Pack 314:28:12.484 Number of processors: 1 586 0x20714:28:12.484 ComputerName: FAMILY UserName: 14:28:14.656 Initialize success14:30:23.921 AVAST engine defs: 1107180014:32:50.562 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-314:32:50.562 Disk 0 Vendor: IC35L060AVV207-0 V22OA66A Size: 57220MB BusType: 314:32:50.593 Disk 0 MBR read successfully14:32:50.593 Disk 0 MBR scan14:32:50.718 Disk 0 MBR:Alureon-I [Rtk]14:32:50.718 Disk 0 [email protected] code has been found14:32:50.718 Disk 0 MBR [TDL4] **ROOTKIT**14:32:50.796 Disk 0 scanning C:\WINDOWS\system32\drivers14:33:24.718 Service scanning14:33:30.484 Disk 0 trace - called modules:14:33:30.484 ntoskrnl.exe CLASSPNP.SYS disk.sys atapi.sys hal.dll pciide.sys 14:33:30.484 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x86fdcab8]14:33:30.484 3 CLASSPNP.SYS[f78affd7] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x86fcbd98]14:33:32.031 AVAST engine scan C:\WINDOWS14:34:06.218 AVAST engine scan C:\WINDOWS\system3214:40:22.593 AVAST engine scan C:\WINDOWS\system32\drivers14:40:53.875 AVAST engine scan C:\Documents and Settings\prakash114:52:04.953 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\prakash1\Desktop\MBR.dat"14:52:04.968 The log file has been saved successfully to "C:\Documents and Settings\prakash1\Desktop\aswMBR.txt"14:53:10.593 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\prakash1\Desktop\MBR.dat"14:53:10.687 The log file has been saved successfully to "C:\Documents and Settings\prakash1\Desktop\aswMBR.txt"


----------



## seemacima (Jul 16, 2011)

Hello Satchfan I am unable to run SystemLook its saying--its not a valid win32 application


----------



## seemacima (Jul 16, 2011)

ok..so i have posted the following logsOTL.txtExtras.txtaswMBR.txtcouldnt do system check as when i tried to run it says its not a valid won32 application..I also uncheck the wrodwrap in notepad...Will wait for your next instruction..Thanks for all your help...Seema


----------



## Satchfan (Jan 12, 2009)

Hi *seemacima*

Unfortunately Word Wrap was unchecked too late. Please make sure Word Wrap is unchecked before opening the logs.

As you can see, there are no ends of lines and this means that it would take me a very long time to read the logs.

===================================================

*Run aswMBR*

re-Run aswMBR
click *Scan*
on completion of the scan click the *Fix* button










Save the log as before and post in your next reply

===================================================

*Download and run ComboFix*

Download ComboFix from the following location:

*Link*

** IMPORTANT !!! Save ComboFix.exe to your Desktop*

*Disable your AntiVirus and AntiSpyware applications,* usually via a right click on the System Tray icon. They may otherwise interfere with our tools
See this *Link* for programs that need to be disabled and instruction on how to disable them.
*Remember to re-enable them when we're done.*
Double click on *ComboFix.exe* & follow the prompts.
As part of it's process, ComboFix will check to see if the *Microsoft Windows Recovery Console *is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware. 
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
***Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue its malware removal procedures.*









Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:









Click on *Yes* to continue scanning for malware.
*Note: Do not mouse-click combofix's window while it is running. That may cause it to stall.*

When finished, it will produce a log. Please include the *ComboFix.txt* in your next reply. It can be found at *C:\ComboFix.txt*

===================================================

Also, please delete the version of SystemLook you previously downloaded then download *SystemLook* from one of the links below and save it to your Desktop.

*Download Mirror #1*

*Download Mirror #2*

double-click *SystemLook.exe* to run it.
copy the content of the following codebox into the main textfield:


```
[FONT=Arial][COLOR=purple][COLOR=purple][FONT=Arial][B]:dir[/B][/FONT][/COLOR]
[COLOR=purple][FONT=Arial][B]%Temp%\smtmp /s[/B][/FONT][/COLOR]

[/COLOR][/FONT]
```

click the *Look* button to start the scan.
when finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
*Note:* The log can also be found on your Desktop entitled *SystemLook.txt*

===================================================

Logs to include:

*aswMBR.txt*
*ComboFix.txt*
*SystemLook.txt*

Let me know if there are any changes

Thanks

Satchfan


----------



## seemacima (Jul 16, 2011)

I am sry satchfan.....about logs.
when the scans are done they are open themselves in notepad.so should I open the new notepad and the open the logs saved on desktop to copy to the new one and paste.I am sry for my ignorance


----------



## seemacima (Jul 16, 2011)

ok it seems like when i pressed for aswMBR scan it also did the fixed itself...here are the logs...for aswMBR aswMBR version 0.9.7.777 Copyright(c) 2011 AVAST SoftwareRun date: 2011-07-19 14:56:49-----------------------------14:56:49.703 OS Version: Windows 5.1.2600 Service Pack 314:56:49.703 Number of processors: 1 586 0x20714:56:49.703 ComputerName: FAMILY UserName: 14:56:54.140 Initialize success14:57:34.531 AVAST engine defs: 1107180014:58:00.125 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-314:58:00.125 Disk 0 Vendor: IC35L060AVV207-0 V22OA66A Size: 57220MB BusType: 314:58:00.218 Disk 0 MBR read successfully14:58:00.218 Disk 0 MBR scan14:58:00.781 Disk 0 MBR:Alureon-I [Rtk]14:58:00.781 Disk 0 [email protected] code has been found14:58:00.781 Disk 0 MBR [TDL4] **ROOTKIT**14:58:01.109 Disk 0 scanning C:\WINDOWS\system32\drivers15:00:19.343 Service scanning15:00:25.031 Disk 0 trace - called modules:15:00:25.109 ntoskrnl.exe CLASSPNP.SYS disk.sys atapi.sys hal.dll pciide.sys 15:00:25.109 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x86fdcab8]15:00:25.125 3 CLASSPNP.SYS[f78affd7] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x86fcbd98]15:00:31.171 AVAST engine scan C:\WINDOWS15:01:52.843 AVAST engine scan C:\WINDOWS\system3215:18:23.546 AVAST engine scan C:\WINDOWS\system32\drivers15:19:03.703 AVAST engine scan C:\Documents and Settings\prakash115:55:01.187 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\prakash1\Desktop\MBR.dat"15:55:01.312 The log file has been saved successfully to "C:\Documents and Settings\prakash1\Desktop\aswMBR.txt"


----------



## seemacima (Jul 16, 2011)

Ok i have tried what ever i could but it seems like these logs are not pasting the way it should be..I even tried to open the note pad before and then open..not sure if my note pad is currupt or if there something in forum posting options that i am doing wrong i feel like an idiot...secondly when i pressed for scan for aswMBR it prseed for fix by itself at same time...


----------



## seemacima (Jul 16, 2011)

My next problem....when i tried to run combofix it asked me to disable mcafee however i am unable to right click on sytem tray to diaable it as its just not doing it...meaning its not doing anything with right click and also if i try to open it only gray screen comes. I thought may be its not active but combofix had a warning that mcafee is still running and running combofix can damage the sytem so in short i stopped the combofix running...Now what next...


----------



## seemacima (Jul 16, 2011)

this is sytem look log however this log is without the comofix scanSystemLook 04.09.10 by jpshortstuffLog created at 17:07 on 19/07/2011 by prakash1Administrator - Elevation successful========== dir ==========C:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp - Parameters: "/s"---Files---None found.C:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1	d------	[07:45 15/07/2011]desktop.ini	--ahsc- 272 bytes	[00:25 11/01/2005]	[19:45 03/08/2008]New Office Document.lnk	--a--c- 1610 bytes	[03:50 20/02/2006]	[03:50 20/02/2006]Open Office Document.lnk	--a--c- 1610 bytes	[03:50 20/02/2006]	[03:50 20/02/2006]Set Program Access and Defaults.lnk	--a--c- 1563 bytes	[05:40 11/01/2005]	[19:45 03/08/2008]Software Manager.lnk	--a---- 1978 bytes	[06:05 13/01/2010]	[06:05 13/01/2010]Windows Catalog.lnk	--a--c- 398 bytes	[05:40 11/01/2005]	[05:40 11/01/2005]Windows Update.lnk	--a--c- 1507 bytes	[05:40 11/01/2005]	[08:01 01/01/2011]WinZip Self-Extractor.lnk	--a--c- 695 bytes	[22:43 19/03/2007]	[22:43 19/03/2007]WinZip.lnk	--a---- 1732 bytes	[02:21 19/12/2010]	[02:21 19/12/2010]C:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs	d------	[07:45 15/07/2011]Adobe Reader 8.lnk	--a--c- 2347 bytes	[05:06 10/11/2008]	[06:56 12/04/2009]Apple Software Update.lnk	--a---- 1830 bytes	[23:22 11/07/2011]	[23:22 11/07/2011]Audacity.lnk	--a--c- 636 bytes	[20:34 28/02/2007]	[20:34 28/02/2007]Corel Painter Photo Essentials 4.lnk	--a---- 1052 bytes	[06:04 21/01/2011]	[06:04 21/01/2011]desktop.ini	--ahsc- 62 bytes	[00:25 11/01/2005]	[00:25 11/01/2005]Microsoft Default Manager.lnk	--a---- 1077 bytes	[18:20 31/12/2010]	[18:20 31/12/2010]Microsoft Word.lnk	--a--c- 748 bytes	[03:50 20/02/2006]	[03:50 20/02/2006]MSN Explorer.lnk	--a--c- 1846 bytes	[05:37 11/01/2005]	[04:20 15/01/2005]Safari.lnk	--a---- 1854 bytes	[23:28 07/02/2011]	[23:13 25/04/2011]Windows Live ID.lnk	--a---- 1077 bytes	[18:18 31/12/2010]	[18:18 31/12/2010]Windows Messenger.lnk	--a--c- 829 bytes	[05:37 11/01/2005]	[02:14 01/03/2005]Yahoo! Mail.lnk	--a--c- 1467 bytes	[15:49 15/01/2005]	[18:02 26/06/2005]C:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Accessories	d------	[07:45 15/07/2011]Calculator.lnk	--a--c- 1498 bytes	[05:37 11/01/2005]	[22:32 14/01/2007]desktop.ini	--ahsc- 320 bytes	[05:37 11/01/2005]	[21:02 22/01/2011]Paint.lnk	--a--c- 1515 bytes	[05:37 11/01/2005]	[08:01 01/01/2011]Remote Desktop Connection.lnk	--a--c- 1585 bytes	[19:44 03/08/2008]	[08:01 01/01/2011]Scanner and Camera Wizard.lnk	--a--c- 710 bytes	[02:30 12/01/2005]	[21:02 22/01/2011]Windows Movie Maker.lnk	--a--c- 790 bytes	[05:39 11/01/2005]	[05:39 11/01/2005]WordPad.lnk	--a--c- 879 bytes	[05:37 11/01/2005]	[05:37 11/01/2005]C:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Accessories\Accessibility	d------	[07:45 15/07/2011]Accessibility Wizard.lnk	--a--c- 1520 bytes	[05:37 11/01/2005]	[08:01 01/01/2011]desktop.ini	--ahsc- 90 bytes	[05:37 11/01/2005]	[05:37 11/01/2005]C:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Accessories\Communications	d------	[07:45 15/07/2011]desktop.ini	--ahsc- 516 bytes	[05:35 11/01/2005]	[19:53 03/08/2008]HyperTerminal.lnk	--a--c- 786 bytes	[05:37 11/01/2005]	[05:37 11/01/2005]Network Connections.lnk	--a--c- 1757 bytes	[05:35 11/01/2005]	[08:01 01/01/2011]Network Setup Wizard.lnk	--a--c- 1640 bytes	[05:39 11/01/2005]	[08:01 01/01/2011]New Connection Wizard.lnk	--a--c- 1646 bytes	[05:35 11/01/2005]	[08:01 01/01/2011]Wireless Network Setup Wizard.lnk	--a--c- 1656 bytes	[11:24 26/07/2005]	[08:01 01/01/2011]C:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Accessories\Entertainment	d------	[07:46 15/07/2011]desktop.ini	--ahsc- 146 bytes	[05:37 11/01/2005]	[05:37 11/01/2005]Sound Recorder.lnk	--a--c- 1528 bytes	[05:37 11/01/2005]	[08:01 01/01/2011]Volume Control.lnk	--a--c- 1528 bytes	[05:37 11/01/2005]	[22:32 14/01/2007]C:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Accessories\System Tools	d------	[07:46 15/07/2011]Character Map.lnk	--a--c- 1521 bytes	[05:37 11/01/2005]	[22:32 14/01/2007]desktop.ini	--ahsc- 703 bytes	[05:37 11/01/2005]	[11:24 26/07/2005]Disk Cleanup.lnk	--a--c- 1532 bytes	[05:39 11/01/2005]	[08:01 01/01/2011]Disk Defragmenter.lnk	--a--c- 1572 bytes	[05:39 11/01/2005]	[08:01 01/01/2011]Files and Settings Transfer Wizard.lnk	--a--c- 1591 bytes	[05:40 11/01/2005]	[08:01 01/01/2011]Scheduled Tasks.lnk	--a--c- 1753 bytes	[05:39 11/01/2005]	[08:01 01/01/2011]System Information.lnk	--a--c- 1070 bytes	[05:39 11/01/2005]	[05:39 11/01/2005]System Restore.lnk	--a--c- 1616 bytes	[05:39 11/01/2005]	[08:01 01/01/2011]C:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Administrative Tools	d------	[07:46 15/07/2011]Component Services.lnk	--a--c- 1582 bytes	[05:37 11/01/2005]	[05:37 11/01/2005]Computer Management.lnk	--a--c- 1602 bytes	[05:40 11/01/2005]	[07:39 18/01/2006]Data Sources (ODBC).lnk	--a--c- 1596 bytes	[05:40 11/01/2005]	[08:01 01/01/2011]desktop.ini	--ahsc- 476 bytes	[05:37 11/01/2005]	[05:40 11/01/2005]Event Viewer.lnk	--a--c- 1592 bytes	[05:40 11/01/2005]	[07:39 18/01/2006]Microsoft .NET Framework 1.1 Configuration.lnk	--a--c- 1107 bytes	[05:06 06/09/2006]	[05:06 06/09/2006]Microsoft .NET Framework 1.1 Wizards.lnk	--a--c- 1158 bytes	[05:06 06/09/2006]	[05:06 06/09/2006]Performance.lnk	--a--c- 1591 bytes	[05:40 11/01/2005]	[22:32 14/01/2007]Services.lnk	--a--c- 1602 bytes	[05:40 11/01/2005]	[22:32 14/01/2007]C:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\ArcSoft Software Suite	d------	[07:46 15/07/2011]Panorama Maker 3.lnk	--a--c- 1769 bytes	[09:08 29/08/2005]	[09:08 29/08/2005]VideoImpression 2.lnk	--a--c- 1776 bytes	[09:23 29/08/2005]	[09:23 29/08/2005]Web Services.lnk	--a--c- 1718 bytes	[09:08 29/08/2005]	[09:08 29/08/2005]C:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Citi	d------	[07:46 15/07/2011]Uninstall Virtual Account Numbers.lnk	--a---- 1940 bytes	[07:32 10/12/2009]	[07:32 10/12/2009]Virtual Account Numbers.lnk	--a--c- 1630 bytes	[07:32 10/12/2009]	[07:32 10/12/2009]C:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Corel PaintShop Photo Pro X3	d------	[07:46 15/07/2011]Corel PaintShop Photo Pro X3.lnk	--a---- 1045 bytes	[05:07 21/01/2011]	[05:07 21/01/2011]Corel PaintShop Photo Project Creator.lnk	--a---- 899 bytes	[16:00 21/01/2011]	[16:00 21/01/2011]Corel Photo Downloader.lnk	--a---- 960 bytes	[05:07 21/01/2011]	[05:07 21/01/2011]C:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\CyberLink PowerDVD	d------	[07:46 15/07/2011]PowerDVD.lnk	--a--c- 1696 bytes	[05:08 08/08/2005]	[05:08 08/08/2005]C:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Decoz	d------	[07:46 15/07/2011]Decoz Numerology.lnk	--a---- 284 bytes	[23:30 17/12/2010]	[23:37 17/12/2010]Read Me.lnk	--a---- 326 bytes	[23:30 17/12/2010]	[23:37 17/12/2010]Remove Decoz Numerology.lnk	--a---- 306 bytes	[23:30 17/12/2010]	[23:37 17/12/2010]C:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Dell Picture Studio	d------	[07:46 15/07/2011]Dell.Shutterfly.com - Online Print Service.lnk	--a--c- 2601 bytes	[02:18 12/01/2005]	[04:58 25/12/2005]C:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Dell Picture Studio\Dell Image Expert - Standard	d------	[07:46 15/07/2011]Dell Image Expert - Standard Edition.lnk	--a--c- 2387 bytes	[02:18 12/01/2005]	[04:58 11/05/2007]Dell Image Expert User's Guide.lnk	--a--c- 1876 bytes	[02:18 12/01/2005]	[02:18 12/01/2005]Uninstall Dell Image Expert .lnk	--a--c- 1515 bytes	[02:18 12/01/2005]	[02:18 12/01/2005]C:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Discourse	d------	[07:46 15/07/2011]Discourse.lnk	--a--c- 783 bytes	[02:43 29/06/2005]	[02:43 29/06/2005]C:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\e+ 48U	d------	[07:46 15/07/2011]e+ 48U Help.lnk	--a---- 511 bytes	[19:14 09/07/2011]	[19:14 09/07/2011]e+ 48U.lnk	--a---- 507 bytes	[19:14 09/07/2011]	[19:14 09/07/2011]ScanPanel Help.lnk	--a---- 1355 bytes	[19:14 09/07/2011]	[19:14 09/07/2011]ScanPanel.lnk	--a---- 1355 bytes	[19:14 09/07/2011]	[19:14 09/07/2011]Uninstall e+ 48U.lnk	--a---- 1627 bytes	[19:14 09/07/2011]	[19:14 09/07/2011]C:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Games	d------	[07:46 15/07/2011]desktop.ini	--ahsc- 798 bytes	[05:37 11/01/2005]	[11:56 26/07/2005]Freecell.lnk	--a--c- 1522 bytes	[05:37 11/01/2005]	[22:32 14/01/2007]Hearts.lnk	--a--c- 1520 bytes	[05:37 11/01/2005]	[08:01 01/01/2011]Internet Backgammon.lnk	--a--c- 913 bytes	[05:37 11/01/2005]	[11:56 26/07/2005]Internet Checkers.lnk	--a--c- 913 bytes	[05:37 11/01/2005]	[11:56 26/07/2005]Internet Hearts.lnk	--a--c- 913 bytes	[05:37 11/01/2005]	[11:56 26/07/2005]Internet Reversi.lnk	--a--c- 913 bytes	[05:37 11/01/2005]	[11:56 26/07/2005]Internet Spades.lnk	--a--c- 913 bytes	[05:37 11/01/2005]	[11:56 26/07/2005]Minesweeper.lnk	--a--c- 1515 bytes	[05:37 11/01/2005]	[22:32 14/01/2007]Pinball.lnk	--a--c- 885 bytes	[05:37 11/01/2005]	[05:37 11/01/2005]Solitaire.lnk	--a--c- 1491 bytes	[05:37 11/01/2005]	[22:32 14/01/2007]Spider Solitaire.lnk	--a--c- 1502 bytes	[05:37 11/01/2005]	[08:01 01/01/2011]C:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\HP	d------	[07:46 15/07/2011]HP Update.lnk	--a--c- 1925 bytes	[16:04 31/08/2008]	[16:04 31/08/2008]C:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\iTunes	d------	[07:46 15/07/2011]About iTunes.lnk	--a---- 1814 bytes	[23:15 11/07/2011]	[23:15 11/07/2011]iTunes.lnk	--a---- 1554 bytes	[23:15 11/07/2011]	[23:15 11/07/2011]C:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Jasc Software	d------	[07:46 15/07/2011]Jasc Animation Shop 3.lnk	--a--c- 2429 bytes	[17:37 11/12/2007]	[22:34 13/07/2011]Uninstall Animation Shop 3.lnk	--a--c- 787 bytes	[17:37 11/12/2007]	[17:37 11/12/2007]C:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Knowledge Adventure	d------	[07:46 15/07/2011]C:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Knowledge Adventure\JumpStart	d------	[07:46 15/07/2011]C:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Linksys EasyLink Advisor	d------	[07:46 15/07/2011]Linksys EasyLink Advisor.lnk	--a--c- 1762 bytes	[00:39 03/04/2007]	[00:39 03/04/2007]C:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Maxtor	d------	[07:46 15/07/2011]C:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Maxtor\OneTouch	d------	[07:46 15/07/2011]Maxtor OneTouch  Manager.lnk	--a--c- 1827 bytes	[04:22 26/12/2006]	[04:22 26/12/2006]C:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Maxtor\OneTouch Status	d------	[07:46 15/07/2011]OneTouch Status Icon.lnk	--a--c- 1780 bytes	[04:26 26/12/2006]	[04:26 26/12/2006]C:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\McAfee	d------	[07:46 15/07/2011]McAfee Total Protection.lnk	--a---- 1607 bytes	[05:53 15/07/2011]	[05:53 15/07/2011]C:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\McAfee Online Backup	d------	[07:46 15/07/2011]desktop.ini	--ahs-- 459 bytes	[02:26 17/12/2010]	[02:26 17/12/2010]McAfee Online Backup Configuration.lnk	--a---- 780 bytes	[18:31 19/12/2010]	[02:25 17/12/2010]McAfee Online Backup Status.lnk	--a---- 780 bytes	[18:31 19/12/2010]	[02:25 17/12/2010]Online Help.url	--a---- 108 bytes	[02:26 17/12/2010]	[02:26 17/12/2010]C:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Microsoft Office	d------	[07:46 15/07/2011]Microsoft Office Excel 2007.lnk	--a---- 2561 bytes	[04:39 30/12/2009]	[04:39 30/12/2009]Microsoft Office OneNote 2007.lnk	--a---- 2525 bytes	[04:39 30/12/2009]	[04:39 30/12/2009]Microsoft Office PowerPoint 2007.lnk	--a---- 2495 bytes	[04:39 30/12/2009]	[00:40 26/02/2011]Microsoft Office Word 2007.lnk	--a---- 2527 bytes	[04:39 30/12/2009]	[05:24 04/07/2011]C:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Microsoft Office\Microsoft Office Tools	d------	[07:46 15/07/2011]Digital Certificate for VBA Projects.lnk	--a---- 2553 bytes	[04:39 30/12/2009]	[04:39 30/12/2009]Microsoft Clip Organizer.lnk	--a---- 2533 bytes	[04:39 30/12/2009]	[04:39 30/12/2009]Microsoft Office 2007 Language Settings.lnk	--a---- 2433 bytes	[04:39 30/12/2009]	[04:39 30/12/2009]Microsoft Office Diagnostics.lnk	--a---- 2531 bytes	[04:39 30/12/2009]	[04:39 30/12/2009]Microsoft Office Picture Manager.lnk	--a---- 2511 bytes	[04:39 30/12/2009]	[04:39 30/12/2009]C:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Microsoft Silverlight	d------	[07:46 15/07/2011]Microsoft Silverlight.lnk	--a---- 1986 bytes	[03:33 25/12/2010]	[02:28 15/06/2011]C:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Nero	d------	[07:46 15/07/2011]Nero StartSmart.lnk	--a--c- 1251 bytes	[04:58 08/08/2005]	[04:58 08/08/2005]C:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Nero\Nero Media Player	d------	[07:46 15/07/2011]Nero Media Player.lnk	--a--c- 1126 bytes	[04:58 08/08/2005]	[04:58 08/08/2005]C:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Nero\Nero OEM	d------	[07:46 15/07/2011]Nero BackItUp.lnk	--a--c- 1093 bytes	[04:58 08/08/2005]	[04:58 08/08/2005]Nero Cover Designer.lnk	--a--c- 959 bytes	[04:58 08/08/2005]	[04:58 08/08/2005]Nero Express.lnk	--a--c- 1822 bytes	[04:58 08/08/2005]	[04:58 08/08/2005]C:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Nero\Nero Toolkit	d------	[07:46 15/07/2011]Nero CD-DVD Speed.lnk	--a--c- 991 bytes	[04:58 08/08/2005]	[04:58 08/08/2005]Nero DriveSpeed.lnk	--a--c- 1042 bytes	[04:58 08/08/2005]	[04:58 08/08/2005]Nero InfoTool.lnk	--a--c- 934 bytes	[04:58 08/08/2005]	[04:58 08/08/2005]C:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Nero\NeroVision Express 2	d------	[07:46 15/07/2011]Nero Cover Designer.lnk	--a--c- 959 bytes	[04:54 08/08/2005]	[04:54 08/08/2005]Nero Recode.lnk	--a--c- 1491 bytes	[04:54 08/08/2005]	[04:54 08/08/2005]Nero ShowTime.lnk	--a--c- 979 bytes	[04:54 08/08/2005]	[04:54 08/08/2005]NeroVision Express.lnk	--a--c- 1228 bytes	[04:54 08/08/2005]	[04:54 08/08/2005]C:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Nero\User's Guides	d------	[07:46 15/07/2011]Nero BackItUp [English Manual].lnk	--a--c- 813 bytes	[04:58 08/08/2005]	[04:58 08/08/2005]Nero Cover Designer [English Manual].lnk	--a--c- 850 bytes	[04:54 08/08/2005]	[04:58 08/08/2005]Nero Express [English Manual].lnk	--a--c- 757 bytes	[04:58 08/08/2005]	[04:58 08/08/2005]Nero Recode [English Manual].lnk	--a--c- 789 bytes	[04:54 08/08/2005]	[04:54 08/08/2005]Nero ShowTime [English Manual].lnk	--a--c- 813 bytes	[04:54 08/08/2005]	[04:54 08/08/2005]NeroVision Express [English Manual].lnk	--a--c- 833 bytes	[04:54 08/08/2005]	[04:54 08/08/2005]C:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\PCFriendly	d------	[07:46 15/07/2011]PCFriendly DVD.lnk	--a--c- 652 bytes	[08:10 02/09/2009]	[08:10 02/09/2009]System Info.lnk	--a--c- 652 bytes	[08:10 02/09/2009]	[08:10 02/09/2009]C:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\PIXELA	d------	[07:46 15/07/2011]C:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\PIXELA\ImageMixer VCD2	d------	[07:46 15/07/2011]ImageMixer VCD2.lnk	--a--c- 1691 bytes	[03:13 06/08/2006]	[03:13 06/08/2006]C:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\QuickTime	d------	[07:46 15/07/2011]About QuickTime.lnk	--a---- 1802 bytes	[17:18 18/12/2010]	[17:18 18/12/2010]PictureViewer.lnk	--a---- 1812 bytes	[17:18 18/12/2010]	[17:18 18/12/2010]QuickTime Player.lnk	--a---- 1802 bytes	[17:18 18/12/2010]	[17:18 18/12/2010]Uninstall QuickTime.lnk	--a---- 1639 bytes	[17:18 18/12/2010]	[17:18 18/12/2010]C:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\SereneScreen	d------	[07:46 15/07/2011]C:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\SereneScreen\Aquarium	d------	[07:46 15/07/2011]Aquarium.lnk	--a--c- 656 bytes	[16:53 02/06/2005]	[16:53 02/06/2005]Prolific Publishing on the Web.lnk	--a--c- 799 bytes	[16:53 02/06/2005]	[16:53 02/06/2005]Read Me.lnk	--a--c- 747 bytes	[16:53 02/06/2005]	[16:53 02/06/2005]SereneScreen Aquarium on the Web.lnk	--a--c- 573 bytes	[16:53 02/06/2005]	[16:53 02/06/2005]Uninstall SereneScreen Aquarium.lnk	--a--c- 759 bytes	[16:53 02/06/2005]	[16:53 02/06/2005]C:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\SonicStage	d------	[07:46 15/07/2011]NW-E000 Series Operation Guide.lnk	--a--c- 1869 bytes	[02:40 16/12/2006]	[02:40 16/12/2006]Product Support -Personal Audio-.url	--a--c- 123 bytes	[02:40 16/12/2006]	[06:21 16/12/2006]SonicStage Backup Tool.lnk	--a--c- 1423 bytes	[06:19 16/12/2006]	[06:19 16/12/2006]SonicStage File Conversion Tool.lnk	--a--c- 1423 bytes	[06:19 16/12/2006]	[06:19 16/12/2006]SonicStage Help.lnk	--a--c- 846 bytes	[06:19 16/12/2006]	[06:19 16/12/2006]SonicStage Readme.lnk	--a--c- 527 bytes	[06:19 16/12/2006]	[06:19 16/12/2006]SonicStage.lnk	--a--c- 1429 bytes	[06:19 16/12/2006]	[06:19 16/12/2006]C:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Startup	d------	[07:46 15/07/2011]desktop.ini	--ahsc- 193 bytes	[00:25 11/01/2005]	[02:26 17/12/2010]McAfee Online Backup Status.lnk	--a---- 780 bytes	[18:31 19/12/2010]	[02:25 17/12/2010]ScanPanel.lnk	--a---- 1355 bytes	[19:14 09/07/2011]	[19:14 09/07/2011]C:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\TurboTax 2008	d------	[07:46 15/07/2011]TurboTax 2008.lnk	--a--c- 1880 bytes	[04:44 27/02/2009]	[04:44 27/02/2009]C:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\TurboTax 2009	d------	[07:46 15/07/2011]TurboTax 2009.lnk	--a---- 1880 bytes	[04:40 17/02/2010]	[04:40 17/02/2010]C:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\TurboTax Deluxe 2007	d------	[07:46 15/07/2011]TurboTax Deluxe 2007.lnk	--a--c- 1778 bytes	[02:19 17/03/2008]	[02:19 17/03/2008]TurboTax Update.lnk	--a--c- 1817 bytes	[02:19 17/03/2008]	[02:19 17/03/2008]Uninstall.lnk	--a--c- 1831 bytes	[02:19 17/03/2008]	[02:19 17/03/2008]C:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Windows Media	d------	[07:46 15/07/2011]Windows Media Encoder.lnk	--a---- 1835 bytes	[16:50 21/01/2011]	[16:50 21/01/2011]C:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Windows Media\Utilities	d------	[07:46 15/07/2011]Windows Media Encoding Script.lnk	--a---- 945 bytes	[16:50 21/01/2011]	[16:50 21/01/2011]Windows Media File Editor.lnk	--a---- 864 bytes	[16:50 21/01/2011]	[16:50 21/01/2011]Windows Media Profile Editor.lnk	--a---- 868 bytes	[16:50 21/01/2011]	[16:50 21/01/2011]Windows Media Stream Editor.lnk	--a---- 881 bytes	[16:50 21/01/2011]	[16:50 21/01/2011]C:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\WinZip	d------	[07:46 15/07/2011]WinZip 15.0.lnk	--a---- 1744 bytes	[02:21 19/12/2010]	[02:21 19/12/2010]C:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\WinZip Self-Extractor	d------	[07:46 15/07/2011]Online Manual.lnk	--a--c- 735 bytes	[22:43 19/03/2007]	[22:43 19/03/2007]ReadMe.txt.lnk	--a--c- 717 bytes	[22:43 19/03/2007]	[22:43 19/03/2007]Uninstall WinZip Self-Extractor.lnk	--a--c- 1649 bytes	[22:43 19/03/2007]	[22:43 19/03/2007]WinZip Self-Extractor.lnk	--a--c- 751 bytes	[22:43 19/03/2007]	[22:43 19/03/2007]C:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\2	d------	[07:46 15/07/2011]C:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\4	d------	[07:46 15/07/2011]Adobe Reader 8.lnk	--a---- 1729 bytes	[05:06 10/11/2008]	[06:56 12/04/2009]Citi Virtual Account Numbers.lnk	--a---- 1618 bytes	[07:32 10/12/2009]	[07:32 10/12/2009]iTunes.lnk	--a---- 1542 bytes	[23:15 11/07/2011]	[23:15 11/07/2011]Maxtor OneTouch  Manager.lnk	--a---- 1809 bytes	[04:22 26/12/2006]	[04:22 26/12/2006]TurboTax 2008.lnk	--a---- 2393 bytes	[04:44 27/02/2009]	[19:52 15/03/2010]TurboTax 2009.lnk	--a---- 2393 bytes	[04:40 17/02/2010]	[04:30 06/04/2010]-= EOF =-


----------



## seemacima (Jul 16, 2011)

Hello i have posted the asmMBR log and system check but the system check is withiout the combofix scan.When i tried to disable McAfee it was not right clicking to let me do it on system tray.and combogix has warning If i will scan it can my system damage do i stopped it.what should i do now.
Also i did everything for notepad and it still continues to loop it.
I am really frustrated right now.
I thank you for your time and patience.


----------



## Satchfan (Jan 12, 2009)

seemacima



> when the scans are done they are open themselves in notepad.so should I open the new notepad and the open the logs saved on desktop to copy to the new one and paste.I am sry for my ignorance


It is not your ignorance: I too have formatting problems at times and don't know why.

We will find a solution to this, (and your computer problems), but please bear with me while I ask a colleage if they have an answer to this Word Wrap situation

Thanks

Satchfan


----------



## seemacima (Jul 16, 2011)

Thank you thank you....will wait....


----------



## Satchfan (Jan 12, 2009)

Hello seemacima

I am still unable to read your logs properly but with the help of a colleague have been able to partially read a couple and noticed a couple of things that we can deal with while Im waiting for a solution.

===================================================

The *ASK* toolbar comes bundled with many third-party applications, is considered as Spyware and comes with vulnerabilities. 

See the following links and decide yourself whether or not you want to keep it.:

http://secunia.com/advisories/product/15810/
http://www.benedelman.org/spyware/ask-toolbars/

===================================================

You have at least one infection that needs to be dealt with.

*Re-run aswMBR*

Click *Scan* 

On completion of the scan click the *Fix* button











Save the log as before and post in your next reply

Thanks

Satchfan


----------



## seemacima (Jul 16, 2011)

thanks will try doing it now...i think its all getting worse..now its not even letting me open yahoo/hotmail email sites...


----------



## seemacima (Jul 16, 2011)

i dnt see ask tool bar anywherei only use google tool bar is there any where i can see it to remove it...


----------



## seemacima (Jul 16, 2011)

also i think i wrote earlier when i run aswMBR and double click to open the scan icon ..the fix icon is disabled or like its already on..


----------



## Satchfan (Jan 12, 2009)

Don't worry about the Ask toolbar, it's not important now.

Please run the aswMBR fix


----------



## seemacima (Jul 16, 2011)

ok...but what about the fix button...i mean i can scan but the fix button is already pressed and it was able...


----------



## Satchfan (Jan 12, 2009)

Is the *FixMBR* button available? If so, press that and send the scan report


----------



## seemacima (Jul 16, 2011)

meaning fixMBR icon is able but just "Fix" is disabled..i tried to DL this program again but still the same..I am scanning aswMBR right now..however it doenst look like i will be able to click fix as it didnt worked the last time...


----------



## seemacima (Jul 16, 2011)

Satchfan said:


> Is the *FixMBR* button available? If so, press that and send the scan report


Ohh ok will do that thank you


----------



## seemacima (Jul 16, 2011)

whrn i try to press fix MBR its giving a warningsaying if i will do that it could damage m,y partition tables and cause my partition to bcome inacesable


----------



## seemacima (Jul 16, 2011)

and says it write standard window MBR codes...what should I do
Please let me know if i should press the FIXmbr or not..as its giving the warning...


----------



## Satchfan (Jan 12, 2009)

Please just run the *aswMBR* scan again and send the log without "fixing" anything.

============================================

Also, *DO NOT* run any programs unless I tell you, *especially temporary file cleaners* or you will lose many of your files/programs.

I can see that some of your programs are still hidden but because the logs are Word Wrapped it is difficult to see exactly.

============================================

I would suggest that after running the scan and posting the result, you switch off your computer for now as I won't reply again for a while.

It is past midnight here in the UK and I have an early start so please be patient until I get back to you.

Thanks

Satchfan


----------



## seemacima (Jul 16, 2011)

ok will do that...thank you so much...I was wandering where you are from...I am in arizona...so time diff. is a lot...thanks that could talk to you right now...will post logs as soon as I am done...wont install anything....thanks again...!


----------



## seemacima (Jul 16, 2011)

here is the log for aswMBRaswMBR version 0.9.7.777 Copyright(c) 2011 AVAST SoftwareRun date: 2011-07-20 15:56:17-----------------------------15:56:17.187 OS Version: Windows 5.1.2600 Service Pack 315:56:17.187 Number of processors: 1 586 0x20715:56:17.187 ComputerName: FAMILY UserName: 15:56:25.468 Initialize success15:56:38.953 AVAST engine defs: 1107200116:03:06.015 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-316:03:06.031 Disk 0 Vendor: IC35L060AVV207-0 V22OA66A Size: 57220MB BusType: 316:03:06.031 Disk 0 MBR read successfully16:03:06.031 Disk 0 MBR scan16:03:06.140 Disk 0 MBR:Alureon-I [Rtk]16:03:06.140 Disk 0 [email protected] code has been found16:03:06.140 Disk 0 MBR [TDL4] **ROOTKIT**16:03:06.218 Disk 0 scanning C:\WINDOWS\system32\drivers16:03:43.640 Service scanning16:03:47.265 Disk 0 trace - called modules:16:03:47.343 ntoskrnl.exe CLASSPNP.SYS disk.sys atapi.sys hal.dll pciide.sys 16:03:47.343 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8738dab8]16:03:47.359 3 CLASSPNP.SYS[f772ffd7] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x873dfd98]16:03:48.500 AVAST engine scan C:\WINDOWS16:04:28.593 AVAST engine scan C:\WINDOWS\system3216:10:31.593 AVAST engine scan C:\WINDOWS\system32\drivers16:11:08.484 AVAST engine scan C:\Documents and Settings\prakash116:27:15.921 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\prakash1\Desktop\MBR.dat"16:27:15.953 The log file has been saved successfully to "C:\Documents and Settings\prakash1\Desktop\aswMBR.txt"16:27:40.281 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\prakash1\Desktop\receipes\MBR.dat"16:27:40.312 The log file has been saved successfully to "C:\Documents and Settings\prakash1\Desktop\receipes\aswMBR.txt"16:28:04.171 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\prakash1\Desktop\receipes\MBR.dat"16:28:04.187 The log file has been saved successfully to "C:\Documents and Settings\prakash1\Desktop\receipes\aswMBR.txt"


----------



## seemacima (Jul 16, 2011)

ok..will turn off the system now and will wait for your reply...thank you..


----------



## Satchfan (Jan 12, 2009)

Seemacima

Please download TDSSKiller.zip 

extract it to your desktop
double click *TDSSKiller.exe*
press *Start Scan*
only if *Malicious* objects are found then ensure *Cure* is selected

then click *Continue* > *Reboot now*

copy and paste the log in your next reply
_A copy of the log will be saved automatically to the root of the drive (typically C:\)_ called *TDSSKiller_**** _(*** denotes version & date) _
Satchfan


----------



## seemacima (Jul 16, 2011)

ok i ran tdskiller and there was a infection...i cured it and this is the log....2011/07/21 14:45:24.0312 3004	TDSS rootkit removing tool 2.5.11.0 Jul 11 2011 16:56:562011/07/21 14:45:26.0312 3004	================================================================================2011/07/21 14:45:26.0359 3004	SystemInfo:2011/07/21 14:45:26.0359 3004	2011/07/21 14:45:26.0359 3004	OS Version: 5.1.2600 ServicePack: 3.02011/07/21 14:45:26.0359 3004	Product type: Workstation2011/07/21 14:45:26.0359 3004	ComputerName: FAMILY2011/07/21 14:45:26.0359 3004	UserName: prakash12011/07/21 14:45:26.0359 3004	Windows directory: C:\WINDOWS2011/07/21 14:45:26.0359 3004	System windows directory: C:\WINDOWS2011/07/21 14:45:26.0359 3004	Processor architecture: Intel x862011/07/21 14:45:26.0359 3004	Number of processors: 12011/07/21 14:45:26.0359 3004	Page size: 0x10002011/07/21 14:45:26.0359 3004	Boot type: Normal boot2011/07/21 14:45:26.0359 3004	================================================================================2011/07/21 14:45:32.0906 3004	Initialize success2011/07/21 14:45:43.0359 1080	================================================================================2011/07/21 14:45:43.0359 1080	Scan started2011/07/21 14:45:43.0359 1080	Mode: Manual; 2011/07/21 14:45:43.0359 1080	================================================================================2011/07/21 14:45:47.0968 1080	ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys2011/07/21 14:45:48.0453 1080	ACPIEC  (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys2011/07/21 14:45:49.0156 1080	aeaudio (11c04b17ed2abbb4833694bcd644ac90) C:\WINDOWS\system32\drivers\aeaudio.sys2011/07/21 14:45:49.0671 1080	aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys2011/07/21 14:45:50.0187 1080	AFD (355556d9e580915118cd7ef736653a89) C:\WINDOWS\System32\drivers\afd.sys2011/07/21 14:45:50.0671 1080	agp440 (08fd04aa961bdc77fb983f328334e3d7) C:\WINDOWS\system32\DRIVERS\agp440.sys2011/07/21 14:45:53.0937 1080	AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys2011/07/21 14:45:54.0406 1080	atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys2011/07/21 14:45:55.0140 1080	Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys2011/07/21 14:45:55.0625 1080	audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys2011/07/21 14:45:56.0109 1080	Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys2011/07/21 14:45:56.0578 1080	cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys2011/07/21 14:45:56.0968 1080	CCDECODE (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys2011/07/21 14:45:57.0640 1080	Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys2011/07/21 14:45:58.0125 1080	Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys2011/07/21 14:45:58.0593 1080	Cdr4_xp (837eef65af62d4e8a37c41d3879f7274) C:\WINDOWS\system32\drivers\Cdr4_xp.sys2011/07/21 14:45:59.0015 1080	Cdralw2k (579da2f9f5401f55dae2cf8779d61dfc) C:\WINDOWS\system32\drivers\Cdralw2k.sys2011/07/21 14:45:59.0453 1080	cdrbsdrv (351735695e9ead93de6af85d8beb1ca8) C:\WINDOWS\system32\drivers\cdrbsdrv.sys2011/07/21 14:46:00.0171 1080	Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys2011/07/21 14:46:00.0703 1080	cfwids (ecaf4a51580244fef1aa32cb984f13bf) C:\WINDOWS\system32\drivers\cfwids.sys2011/07/21 14:46:02.0812 1080	Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys2011/07/21 14:46:03.0687 1080	dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys2011/07/21 14:46:04.0500 1080	dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys2011/07/21 14:46:04.0906 1080	dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys2011/07/21 14:46:05.0359 1080	DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys2011/07/21 14:46:05.0921 1080	dot4 (3e4b043f8bc6be1d4820cc6c9c500306) C:\WINDOWS\system32\DRIVERS\Dot4.sys2011/07/21 14:46:06.0359 1080	Dot4Print (77ce63a8a34ae23d9fe4c7896d1debe7) C:\WINDOWS\system32\DRIVERS\Dot4Prt.sys2011/07/21 14:46:06.0812 1080	dot4usb (6ec3af6bb5b30e488a0c559921f012e1) C:\WINDOWS\system32\DRIVERS\dot4usb.sys2011/07/21 14:46:07.0500 1080	drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys2011/07/21 14:46:07.0953 1080	E100B (fe9cb643a034285031502d3369e5a869) C:\WINDOWS\system32\DRIVERS\e100b325.sys2011/07/21 14:46:08.0609 1080	Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys2011/07/21 14:46:09.0093 1080	Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys2011/07/21 14:46:09.0546 1080	Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys2011/07/21 14:46:09.0984 1080	Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys2011/07/21 14:46:10.0453 1080	FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys2011/07/21 14:46:10.0859 1080	Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys2011/07/21 14:46:11.0265 1080	Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys2011/07/21 14:46:11.0796 1080	GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys2011/07/21 14:46:12.0218 1080	GoProto (acc8d7fc0da793450f5f257d9ce4ff75) C:\WINDOWS\system32\DRIVERS\goprot51.sys2011/07/21 14:46:12.0687 1080	Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys2011/07/21 14:46:13.0140 1080	grmnusb (d956358054e99e6ffac69cd87e893a89) C:\WINDOWS\system32\drivers\grmnusb.sys2011/07/21 14:46:13.0546 1080	hidusb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys2011/07/21 14:46:14.0250 1080	HPZid412 (287a63bd8509bd78e7978823b38afa81) C:\WINDOWS\system32\DRIVERS\HPZid412.sys2011/07/21 14:46:14.0687 1080	HPZipr12 (0b4fda2657c3e0315eaa57f9c6d4fd1f) C:\WINDOWS\system32\DRIVERS\HPZipr12.sys2011/07/21 14:46:15.0093 1080	HPZius12 (29559db25258b60510a60c4e470fce32) C:\WINDOWS\system32\DRIVERS\HPZius12.sys2011/07/21 14:46:15.0546 1080	HSFHWBS2 (96fae6dc24574b1cb08dcf9d984a5be4) C:\WINDOWS\system32\DRIVERS\HSFHWBS2.sys2011/07/21 14:46:16.0250 1080	HSF_DP (2efa8dd8b0270a3a7202ce5f4da465b1) C:\WINDOWS\system32\DRIVERS\HSF_DP.sys2011/07/21 14:46:17.0062 1080	HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys2011/07/21 14:46:18.0109 1080	i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys2011/07/21 14:46:18.0609 1080	Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys2011/07/21 14:46:19.0328 1080	IntelIde (b5466a9250342a7aa0cd1fba13420678) C:\WINDOWS\system32\DRIVERS\intelide.sys2011/07/21 14:46:19.0812 1080	intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys2011/07/21 14:46:20.0250 1080	ip6fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys2011/07/21 14:46:20.0703 1080	IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys2011/07/21 14:46:21.0125 1080	IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys2011/07/21 14:46:21.0578 1080	IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys2011/07/21 14:46:22.0078 1080	IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys2011/07/21 14:46:22.0500 1080	IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys2011/07/21 14:46:22.0937 1080	isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys2011/07/21 14:46:23.0437 1080	Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys2011/07/21 14:46:23.0937 1080	kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys2011/07/21 14:46:24.0421 1080	KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys2011/07/21 14:46:25.0218 1080	MBAMProtector (eca00eed9ab95489007b0ef84c7149de) C:\WINDOWS\system32\drivers\mbam.sys2011/07/21 14:46:25.0734 1080	mdmxsdk (aeb54ef22cb7c7e3f405f69f048d696c) C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys2011/07/21 14:46:26.0187 1080	mfeapfk (688b626fca708ee9eb161cad1f7363a9) C:\WINDOWS\system32\drivers\mfeapfk.sys2011/07/21 14:46:26.0671 1080	mfeavfk (693a8d924b640223974e0a88f2baf0f4) C:\WINDOWS\system32\drivers\mfeavfk.sys2011/07/21 14:46:27.0328 1080	mfebopk (52c40d19873528bd15823c969d3ad227) C:\WINDOWS\system32\drivers\mfebopk.sys2011/07/21 14:46:27.0953 1080	mfefirek (e37b98d49df546f4059483d49e349a53) C:\WINDOWS\system32\drivers\mfefirek.sys2011/07/21 14:46:28.0718 1080	mfehidk (44184f32392fa2e94d08d056ce750d56) C:\WINDOWS\system32\drivers\mfehidk.sys2011/07/21 14:46:29.0328 1080	mfendisk (8c434d77c7a8cd97f8f4c2b0be19d541) C:\WINDOWS\system32\DRIVERS\mfendisk.sys2011/07/21 14:46:29.0421 1080	mfendiskmp (8c434d77c7a8cd97f8f4c2b0be19d541) C:\WINDOWS\system32\DRIVERS\mfendisk.sys2011/07/21 14:46:29.0875 1080	mferkdet (5f5313bfd1e73233885a26ab77488f6f) C:\WINDOWS\system32\drivers\mferkdet.sys2011/07/21 14:46:30.0375 1080	mferkdk (41fe2f288e05a6c8ab85dd56770ffbad) C:\WINDOWS\system32\drivers\mferkdk.sys2011/07/21 14:46:30.0828 1080	mfesmfk (096b52ea918aa909ba5903d79e129005) C:\WINDOWS\system32\drivers\mfesmfk.sys2011/07/21 14:46:31.0281 1080	mfetdi2k (8d1a44e1f46bcf4acfe9c701edd340e3) C:\WINDOWS\system32\drivers\mfetdi2k.sys2011/07/21 14:46:31.0765 1080	mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys2011/07/21 14:46:32.0218 1080	MOBKFilter (e896775837a8bce436348df460522394) C:\WINDOWS\system32\DRIVERS\MOBK.sys2011/07/21 14:46:32.0656 1080	Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys2011/07/21 14:46:33.0093 1080	Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys2011/07/21 14:46:33.0734 1080	mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys2011/07/21 14:46:34.0281 1080	MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys2011/07/21 14:46:34.0765 1080	MPFP (bc2a92cff784555ed622f861cb34f2e6) C:\WINDOWS\system32\Drivers\Mpfp.sys2011/07/21 14:46:35.0562 1080	MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys2011/07/21 14:46:36.0140 1080	MRxSmb (0dc719e9b15e902346e87e9dcd5751fa) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys2011/07/21 14:46:36.0765 1080	Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys2011/07/21 14:46:37.0187 1080	MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys2011/07/21 14:46:37.0609 1080	MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys2011/07/21 14:46:38.0046 1080	MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys2011/07/21 14:46:38.0765 1080	mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys2011/07/21 14:46:39.0375 1080	MSTEE (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys2011/07/21 14:46:40.0015 1080	Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys2011/07/21 14:46:40.0609 1080	MXOPSWD (c29f284ff7ab4ed38ce419a9424e52a2) C:\WINDOWS\system32\DRIVERS\mxopswd.sys2011/07/21 14:46:41.0234 1080	NABTSFEC (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys2011/07/21 14:46:41.0890 1080	NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys2011/07/21 14:46:42.0359 1080	NdisIP (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys2011/07/21 14:46:42.0859 1080	NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys2011/07/21 14:46:43.0406 1080	Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys2011/07/21 14:46:43.0953 1080	NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys2011/07/21 14:46:44.0578 1080	NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys2011/07/21 14:46:45.0140 1080	NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys2011/07/21 14:46:45.0781 1080	NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys2011/07/21 14:46:46.0500 1080	Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys2011/07/21 14:46:47.0343 1080	Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys2011/07/21 14:46:48.0265 1080	Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys2011/07/21 14:46:49.0312 1080	nv (71dbdc08df86b80511e72953fa1ad6b0) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys2011/07/21 14:46:50.0484 1080	NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys2011/07/21 14:46:51.0109 1080	NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys2011/07/21 14:46:51.0625 1080	OMCI (cec7e2c6c1fa00c7ab2f5434f848ae51) C:\WINDOWS\SYSTEM32\DRIVERS\OMCI.SYS2011/07/21 14:46:52.0218 1080	Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\DRIVERS\parport.sys2011/07/21 14:46:52.0703 1080	PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys2011/07/21 14:46:53.0125 1080	ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys2011/07/21 14:46:53.0765 1080	PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys2011/07/21 14:46:54.0656 1080	PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys2011/07/21 14:46:55.0234 1080	Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys2011/07/21 14:46:57.0890 1080	pfc (444f122e68db44c0589227781f3c8b3f) C:\WINDOWS\system32\drivers\pfc.sys2011/07/21 14:46:58.0328 1080	PhilCam8116 (a2b74f7dc4407be6a20808d00aeca9df) C:\WINDOWS\system32\DRIVERS\CamDrL21.sys2011/07/21 14:46:58.0906 1080	PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys2011/07/21 14:46:59.0343 1080	Processor (a32bebaf723557681bfc6bd93e98bd26) C:\WINDOWS\system32\DRIVERS\processr.sys2011/07/21 14:46:59.0859 1080	PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys2011/07/21 14:47:00.0250 1080	Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys2011/07/21 14:47:00.0703 1080	PxHelp20 (d86b4a68565e444d76457f14172c875a) C:\WINDOWS\system32\Drivers\PxHelp20.sys2011/07/21 14:47:02.0546 1080	RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys2011/07/21 14:47:03.0015 1080	Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys2011/07/21 14:47:03.0468 1080	RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys2011/07/21 14:47:04.0125 1080	Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys2011/07/21 14:47:04.0625 1080	Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys2011/07/21 14:47:05.0015 1080	RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys2011/07/21 14:47:05.0484 1080	RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys2011/07/21 14:47:05.0984 1080	redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys2011/07/21 14:47:06.0718 1080	RimVSerPort (d9b34325ee5df78b8f28a3de9f577c7d) C:\WINDOWS\system32\DRIVERS\RimSerial.sys2011/07/21 14:47:07.0125 1080	ROOTMODEM (d8b0b4ade32574b2d9c5cc34dc0dbbe7) C:\WINDOWS\system32\Drivers\RootMdm.sys2011/07/21 14:47:07.0546 1080	SDDMI2 (8edd7b9e4a4b4c16e2dab9188caa861b) C:\WINDOWS\system32\DDMI2.sys2011/07/21 14:47:08.0015 1080	Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys2011/07/21 14:47:08.0453 1080	serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys2011/07/21 14:47:08.0921 1080	Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\DRIVERS\serial.sys2011/07/21 14:47:09.0406 1080	Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys2011/07/21 14:47:10.0156 1080	SLIP (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys2011/07/21 14:47:10.0687 1080	smwdm (70b8dd8707dbf6142530c106365df67d) C:\WINDOWS\system32\drivers\smwdm.sys2011/07/21 14:47:11.0250 1080	sonypvs1 (dfadfc2c86662f40759bf02add27d569) C:\WINDOWS\system32\DRIVERS\sonypvs1.sys2011/07/21 14:47:12.0031 1080	splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys2011/07/21 14:47:12.0437 1080	sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys2011/07/21 14:47:12.0953 1080	Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys2011/07/21 14:47:13.0468 1080	streamip (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys2011/07/21 14:47:13.0953 1080	swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys2011/07/21 14:47:14.0390 1080	swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys2011/07/21 14:47:16.0046 1080	sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys2011/07/21 14:47:16.0593 1080	Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys2011/07/21 14:47:17.0156 1080	TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys2011/07/21 14:47:17.0562 1080	TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys2011/07/21 14:47:18.0000 1080	TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys2011/07/21 14:47:18.0796 1080	Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys2011/07/21 14:47:19.0671 1080	Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys2011/07/21 14:47:20.0218 1080	USBAAPL (d4fb6ecc60a428564ba8768b0e23c0fc) C:\WINDOWS\system32\Drivers\usbaapl.sys2011/07/21 14:47:20.0671 1080	usbaudio (e919708db44ed8543a7c017953148330) C:\WINDOWS\system32\drivers\usbaudio.sys2011/07/21 14:47:21.0156 1080	usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys2011/07/21 14:47:21.0593 1080	usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys2011/07/21 14:47:22.0078 1080	usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys2011/07/21 14:47:22.0500 1080	usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys2011/07/21 14:47:22.0937 1080	usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys2011/07/21 14:47:23.0343 1080	USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS2011/07/21 14:47:23.0765 1080	usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys2011/07/21 14:47:24.0234 1080	VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys2011/07/21 14:47:25.0031 1080	VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys2011/07/21 14:47:25.0500 1080	Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys2011/07/21 14:47:25.0953 1080	wandrv (30211add92098d4b5cfadbf3da01e69b) C:\WINDOWS\system32\DRIVERS\wandrv.sys2011/07/21 14:47:26.0718 1080	wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys2011/07/21 14:47:27.0265 1080	winachsf (b3133dc158e59e80f5498484b0c2d558) C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys2011/07/21 14:47:27.0921 1080	WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys2011/07/21 14:47:28.0328 1080	WSTCODEC (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS2011/07/21 14:47:28.0796 1080	WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys2011/07/21 14:47:29.0296 1080	WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys2011/07/21 14:47:29.0406 1080	MBR (0x1B8) (6f9a1d528242bc09104b85e0becf5554) \Device\Harddisk0\DR02011/07/21 14:47:29.0406 1080	\Device\Harddisk0\DR0 - detected Rootkit.Boot.SST.a (0)2011/07/21 14:47:29.0421 1080	MBR (0x1B8) (65e858a8a0293be11a920b0bc99d695e) \Device\Harddisk1\DR22011/07/21 14:47:29.0484 1080	Boot (0x1200) (55a136aae07104dcdd9e9929f4b871e0) \Device\Harddisk0\DR0\Partition02011/07/21 14:47:29.0500 1080	Boot (0x1200) (179d333357c067fa70f7dbb8ff5f4239) \Device\Harddisk1\DR2\Partition02011/07/21 14:47:29.0515 1080	================================================================================2011/07/21 14:47:29.0515 1080	Scan finished2011/07/21 14:47:29.0515 1080	================================================================================2011/07/21 14:47:29.0546 2776	Detected object count: 12011/07/21 14:47:29.0546 2776	Actual detected object count: 12011/07/21 14:49:43.0281 2776	\Device\Harddisk0\DR0 (Rootkit.Boot.SST.a) - will be cured after reboot2011/07/21 14:49:43.0281 2776	\Device\Harddisk0\DR0 - ok2011/07/21 14:49:43.0281 2776	Rootkit.Boot.SST.a(\Device\Harddisk0\DR0) - User select action: Cure 2011/07/21 14:49:54.0062 3272	Deinitialize success


----------



## seemacima (Jul 16, 2011)

any solution about word wrap...becasue its all jumbled up...this way it might take a very long time


----------



## seemacima (Jul 16, 2011)

also when i see notepad on my system it looks fine but when i paste it on forum its all bad...is it setting on forum may be???
i also see that none of the formatting tags/icosn on post setting are wroking for me...i have feelng its due to something related to that.I might try to post the log from diffrent system and see if that will work...


----------



## seemacima (Jul 16, 2011)

also the infection was---rootkit,boot.sst.aphysicaldrivename:\device\hard disc0\DRO


----------



## Satchfan (Jan 12, 2009)

Seemacima

Dont worry about the Word Wrap for now as I have no answers to that problem.

You do have some work to do now though.

Please follow these instructions slowly and carefully.

*Backup the Registry*

_Modifying the *Registry* can create unforeseen problems, so it always wise to create a backup before doing so._

please go *here* and download *ERUNT*.
*ERUNT*_ (Emergency Recovery Utility NT) is a free program that allows you to keep a complete backup of your registry and restore it when needed._
double-click on *erunt-setup.exe* to Install *ERUNT*by following the prompts.
use the default install settings but say *No* to the portion that asks you to add *ERUNT* to the *Start-Up folder*. 
start *ERUNT*either by double clicking on the desktop icon or choosing to start the program at the end of the setup process. 
choose a location for the backup. *Note:*_ the default location is _*C:\WINDOWS\ERDNT*_ which is acceptable._
make sure that *at least the first two check boxes* are selected.
click on *OK*
then click on *YES* to create the folder.

*Note: *If it is necessary to restore the registry, open the backup folder and start *ERDNT.exe*
*Next*

Please navigate to the following folder in *bold* (do not open it): 

c:\documents and settings\jeff barbour\local settings\Temp\*smtmp*


*right* click on the folder it, select *copy*, then paste it onto your desktop. 
once the copy of the folder is on your desktop, *right* click on it, select *Send to* and then *Compressed (zipped) **folder*. 
When you have a zipped copy of that folder on your desktop, do the following:

*Run OTL*


double click on the icon to run it.
copy/paste *ALL* the following text written *inside the code box* into the *Custom Scans/Fixes* box located at the bottom of OTL

```
:OTL
 
:Files
xcopy %Temp%\smtmp\1 "%AllUsersProfile%\Start Menu" /H /I /S /Y /C
xcopy %Temp%\smtmp\2 "%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch" /H /I /S /Y /C
xcopy %Temp%\smtmp\3 "%AppData%\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar" /H /I /S /Y /C
xcopy %Temp%\smtmp\4 "%AllUsersProfile%\Desktop" /H /I /S /Y /C
```

then click the *Run Fix* button at the top
let the program run unhindered, reboot when it is done
a log will be created after the run has completed. 
Please post the OTL log in your next reply and let me know of the missing items are still missing. 

Satchfan


----------



## seemacima (Jul 16, 2011)

Satchfan said:


> Seemacima
> 
> Dont worry about the Word Wrap for now as I have no answers to that problem.
> 
> ...


ok...will do them first question...the steps that you have mentioned are to back up the registery..right...and second when do i need to restore the registery...


----------



## seemacima (Jul 16, 2011)

what i meant is step 1 is to back up registery..then in the note you mentioned If it is necessary to restore the registry, open the backup folder and start ERDNT.exe so when and how will i know its necessery....?? ..i just wnat to be very clear what i need to do before i do it...


----------



## seemacima (Jul 16, 2011)

and honestly speaking i am still confused what is missing..i know my mcafee is not workimng fine and system is very slow and i cnat access soem sites properly..is that what i need to see after all these are done ..right ?


----------



## seemacima (Jul 16, 2011)

ok i double click it and its asking me to install it toprogramfile/erunt then give option for erunt shortcut to place in start menu folder ..its not giving any option for adding to start up folder or click no...its just asking me if i wnat to add it to a diffrenet folder......should i go forward with that?
..will wait for your answer before i install it to back up...


----------



## seemacima (Jul 16, 2011)

never mind i got it...thanks..


----------



## seemacima (Jul 16, 2011)

i did the back up but i am not able to find this folder yet....c:\documents and settings\jeff barbour\local settings\Temp\smtmp


----------



## seemacima (Jul 16, 2011)

i have tried to open all the folders under local settings sub folder but ujable to locate smtmp folder yet....
meaning i went to c:/documents and settings and then went under each users local settings but couldnt locate this file---smtmp..is there any otehr way i can locate that???..I guess until i find it i cant go further


----------



## seemacima (Jul 16, 2011)

i finally able to find this file in one of the user seems like the folder local settings is hidden and i had to get it through by doing run program will do the scan hope thats the right one...wish me good luck..


----------



## seemacima (Jul 16, 2011)

ok now i am running into probelm as when i try to zip it it says that settings\praksh1\desktop\smtmp\1\programs\maxtor\onetouch\onetouch\maxtoronetouch TM\manager.ink' contains characters that cnat be compressed into folder.....I have no idea what is maxtor touch...but now i am stuck as i cant compress the folder smtmp which is on my desktop....Now what??


----------



## seemacima (Jul 16, 2011)

i went ahead and deletd this program maxton as its not used then i am able to compress it... here is the log...Error: Unable to interpret < > in the current context!========== OTL ==================== FILES ==========< xcopy %Temp%\smtmp\1 "%AllUsersProfile%\Start Menu" /H /I /S /Y /C >C:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\desktop.iniC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\New Office Document.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Open Office Document.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Set Program Access and Defaults.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Software Manager.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Windows Catalog.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Windows Update.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\WinZip Self-Extractor.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\WinZip.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Adobe Reader 8.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Apple Software Update.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Audacity.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Corel Painter Photo Essentials 4.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\desktop.iniC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Microsoft Default Manager.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Microsoft Word.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\MSN Explorer.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Safari.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Windows Live ID.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Windows Messenger.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Yahoo! Mail.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Accessories\Calculator.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Accessories\desktop.iniC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Accessories\Paint.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Accessories\Remote Desktop Connection.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Accessories\Scanner and Camera Wizard.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Accessories\Windows Movie Maker.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Accessories\WordPad.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Accessories\Accessibility\Accessibility Wizard.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Accessories\Accessibility\desktop.iniC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Accessories\Communications\desktop.iniC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Accessories\Communications\HyperTerminal.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Accessories\Communications\Network Connections.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Accessories\Communications\Network Setup Wizard.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Accessories\Communications\New Connection Wizard.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Accessories\Communications\Wireless Network Setup Wizard.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Accessories\Entertainment\desktop.iniC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Accessories\Entertainment\Sound Recorder.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Accessories\Entertainment\Volume Control.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Accessories\System Tools\Character Map.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Accessories\System Tools\desktop.iniC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Accessories\System Tools\Disk Cleanup.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Accessories\System Tools\Disk Defragmenter.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Accessories\System Tools\Files and Settings Transfer Wizard.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Accessories\System Tools\Scheduled Tasks.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Accessories\System Tools\System Information.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Accessories\System Tools\System Restore.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Administrative Tools\Component Services.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Administrative Tools\Computer Management.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Administrative Tools\Data Sources (ODBC).lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Administrative Tools\desktop.iniC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Administrative Tools\Event Viewer.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Administrative Tools\Microsoft .NET Framework 1.1 Configuration.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Administrative Tools\Microsoft .NET Framework 1.1 Wizards.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Administrative Tools\Performance.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Administrative Tools\Services.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\ArcSoft Software Suite\Panorama Maker 3.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\ArcSoft Software Suite\VideoImpression 2.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\ArcSoft Software Suite\Web Services.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Citi\Uninstall Virtual Account Numbers.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Citi\Virtual Account Numbers.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Corel PaintShop Photo Pro X3\Corel PaintShop Photo Pro X3.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Corel PaintShop Photo Pro X3\Corel PaintShop Photo Project Creator.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Corel PaintShop Photo Pro X3\Corel Photo Downloader.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\CyberLink PowerDVD\PowerDVD.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Decoz\Decoz Numerology.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Decoz\Read Me.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Decoz\Remove Decoz Numerology.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Dell Picture Studio\Dell.Shutterfly.com - Online Print Service.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Dell Picture Studio\Dell Image Expert - Standard\Dell Image Expert - Standard Edition.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Dell Picture Studio\Dell Image Expert - Standard\Dell Image Expert User's Guide.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Dell Picture Studio\Dell Image Expert - Standard\Uninstall Dell Image Expert .lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Discourse\Discourse.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\e+ 48U\e+ 48U Help.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\e+ 48U\e+ 48U.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\e+ 48U\ScanPanel Help.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\e+ 48U\ScanPanel.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\e+ 48U\Uninstall e+ 48U.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Games\desktop.iniC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Games\Freecell.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Games\Hearts.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Games\Internet Backgammon.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Games\Internet Checkers.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Games\Internet Hearts.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Games\Internet Reversi.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Games\Internet Spades.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Games\Minesweeper.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Games\Pinball.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Games\Solitaire.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Games\Spider Solitaire.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\HP\HP Update.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\iTunes\About iTunes.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\iTunes\iTunes.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Jasc Software\Jasc Animation Shop 3.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Jasc Software\Uninstall Animation Shop 3.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Linksys EasyLink Advisor\Linksys EasyLink Advisor.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Maxtor\OneTouch\Maxtor OneTouch T Manager.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Maxtor\OneTouch Status\OneTouch Status Icon.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\McAfee\McAfee Total Protection.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\McAfee Online Backup\desktop.iniC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\McAfee Online Backup\McAfee Online Backup Configuration.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\McAfee Online Backup\McAfee Online Backup Status.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\McAfee Online Backup\Online Help.urlC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Microsoft Office\Microsoft Office Excel 2007.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Microsoft Office\Microsoft Office OneNote 2007.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Microsoft Office\Microsoft Office PowerPoint 2007.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Microsoft Office\Microsoft Office Word 2007.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Microsoft Office\Microsoft Office Tools\Digital Certificate for VBA Projects.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Microsoft Office\Microsoft Office Tools\Microsoft Clip Organizer.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Microsoft Office\Microsoft Office Tools\Microsoft Office 2007 Language Settings.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Microsoft Office\Microsoft Office Tools\Microsoft Office Diagnostics.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Microsoft Office\Microsoft Office Tools\Microsoft Office Picture Manager.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Microsoft Silverlight\Microsoft Silverlight.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Nero\Nero StartSmart.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Nero\Nero Media Player\Nero Media Player.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Nero\Nero OEM\Nero BackItUp.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Nero\Nero OEM\Nero Cover Designer.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Nero\Nero OEM\Nero Express.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Nero\Nero Toolkit\Nero CD-DVD Speed.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Nero\Nero Toolkit\Nero DriveSpeed.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Nero\Nero Toolkit\Nero InfoTool.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Nero\NeroVision Express 2\Nero Cover Designer.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Nero\NeroVision Express 2\Nero Recode.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Nero\NeroVision Express 2\Nero ShowTime.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Nero\NeroVision Express 2\NeroVision Express.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Nero\User's Guides\Nero BackItUp [English Manual].lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Nero\User's Guides\Nero Cover Designer [English Manual].lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Nero\User's Guides\Nero Express [English Manual].lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Nero\User's Guides\Nero Recode [English Manual].lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Nero\User's Guides\Nero ShowTime [English Manual].lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Nero\User's Guides\NeroVision Express [English Manual].lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\PCFriendly\PCFriendly DVD.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\PCFriendly\System Info.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\PIXELA\ImageMixer VCD2\ImageMixer VCD2.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\QuickTime\About QuickTime.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\QuickTime\PictureViewer.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\QuickTime\QuickTime Player.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\QuickTime\Uninstall QuickTime.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\SereneScreen\Aquarium\Aquarium.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\SereneScreen\Aquarium\Prolific Publishing on the Web.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\SereneScreen\Aquarium\Read Me.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\SereneScreen\Aquarium\SereneScreen Aquarium on the Web.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\SereneScreen\Aquarium\Uninstall SereneScreen Aquarium.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\SonicStage\NW-E000 Series Operation Guide.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\SonicStage\Product Support -Personal Audio-.urlC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\SonicStage\SonicStage Backup Tool.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\SonicStage\SonicStage File Conversion Tool.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\SonicStage\SonicStage Help.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\SonicStage\SonicStage Readme.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\SonicStage\SonicStage.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Startup\desktop.iniC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Startup\McAfee Online Backup Status.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Startup\ScanPanel.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\TurboTax 2008\TurboTax 2008.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\TurboTax 2009\TurboTax 2009.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\TurboTax Deluxe 2007\TurboTax Deluxe 2007.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\TurboTax Deluxe 2007\TurboTax Update.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\TurboTax Deluxe 2007\Uninstall.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Windows Media\Windows Media Encoder.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Windows Media\Utilities\Windows Media Encoding Script.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Windows Media\Utilities\Windows Media File Editor.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Windows Media\Utilities\Windows Media Profile Editor.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\Windows Media\Utilities\Windows Media Stream Editor.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\WinZip\WinZip 15.0.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\WinZip Self-Extractor\Online Manual.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\WinZip Self-Extractor\ReadMe.txt.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\WinZip Self-Extractor\Uninstall WinZip Self-Extractor.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\1\Programs\WinZip Self-Extractor\WinZip Self-Extractor.lnk168 File(s) copiedC:\Documents and Settings\prakash1\Desktop\receipes\cmd.bat deleted successfully.C:\Documents and Settings\prakash1\Desktop\receipes\cmd.txt deleted successfully.< xcopy %Temp%\smtmp\2 "%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch" /H /I /S /Y /C >0 File(s) copiedC:\Documents and Settings\prakash1\Desktop\receipes\cmd.bat deleted successfully.C:\Documents and Settings\prakash1\Desktop\receipes\cmd.txt deleted successfully.< xcopy %Temp%\smtmp\3 "%AppData%\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar" /H /I /S /Y /C >0 File(s) copiedC:\Documents and Settings\prakash1\Desktop\receipes\cmd.bat deleted successfully.C:\Documents and Settings\prakash1\Desktop\receipes\cmd.txt deleted successfully.< xcopy %Temp%\smtmp\4 "%AllUsersProfile%\Desktop" /H /I /S /Y /C >C:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\4\Adobe Reader 8.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\4\Citi Virtual Account Numbers.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\4\iTunes.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\4\Maxtor OneTouch T Manager.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\4\TurboTax 2008.lnkC:\DOCUME~1\prakash1\LOCALS~1\Temp\smtmp\4\TurboTax 2009.lnk6 File(s) copiedC:\Documents and Settings\prakash1\Desktop\receipes\cmd.bat deleted successfully.C:\Documents and Settings\prakash1\Desktop\receipes\cmd.txt deleted successfully. OTL by OldTimer - Version 3.2.26.1 log created on 07212011_174640


----------



## seemacima (Jul 16, 2011)

i dnt think there is any diff..i still see white screen when i open mcafee and still cant access hotmail and yahoo site


----------



## Satchfan (Jan 12, 2009)

Have you rebooted because the files appear to have been restored?


----------



## seemacima (Jul 16, 2011)

Yes after the runfix it saved the log and after that i rebooted....


----------



## seemacima (Jul 16, 2011)

will wait for next instruction now..I tried to post logs from clean system but that also seem to do same thing..so i give up...


----------



## seemacima (Jul 16, 2011)

Please let me know If there is anything else can be done....will need to see.in by this weekend.....thanks for all your help...


----------



## Satchfan (Jan 12, 2009)

Seemacima

You are doing nothing wrong

The newer variants of the infection you have move your shortcuts and start nenu items and store them in numbered folders under %Temp%\smtmp.

The program we ran at the beginning usually restores them but sometimes they can be very difficult to restore.

One thing is that your missing items are still there and we will restore them.

Please bear with me. I'll get back to you as soon as possible

Thanks

satchfan


----------



## seemacima (Jul 16, 2011)

Ok...thank you for reassurence.....will wait for further instructions...


----------



## Satchfan (Jan 12, 2009)

Seemacima

I think that the long-handed way is going to be the best solution as copying the files back using a program seemed to do no good.

You need to locate the temporary folders that contain your files and copy/paste them back into the correct location.

The temporary files are located at:

*C:\DOCUMENTS and SETTINGS\prakash1\LOCALSETTINGS\Temp\smtmp\1\*
*C:\DOCUMENTS and SETTINGS\prakash1\LOCALSETTINGS\Temp\smtmp\2\*
*C:\DOCUMENTS and SETTINGS\prakash1\LOCALSETTINGS\Temp\smtmp\4\*

To find and transfer these, do the following:

*Make all files and folders VISIBLE:*

click *Start, Setting, Control Panel*. 
double-click on *Folder Options*. 
select the *View *tab. 
under the Hidden files and folders heading select *Show hidden files and folders.* 
uncheck the *Hide protected operating system files (recommended) *option. 
click *Yes *to confirm. 
click *OK*.

*Navigate to each of the folders in red, using Windows Explorer (Windows key+E) and transfer them:*

*smtmp\1\*

C:\DOCUMENTS and SETTINGS\prakash1\LOCALSETTINGS\Temp\smtmp\*1\*

Highlight everything in the folder, right-click and choose *Copy*

Post the contents in C:\Documents and Settings\All Users\*Start Menu* by right-clicking on the Start Menu folder, right-click and choose *Paste*.

Repeat the above for:

*smtmp\2\*

C:\Documents and Settings\prakash1\LocalSettings\Temp\smtmp\*2* (if there are any; there may not be)

transfer to:

C:\Documents and Settings\prakash1\Application Data\Microsoft\Internet Explorer\*Quick Launch*

*smtmp\4\*

C:\Documents and Settings\prakash1\LocalSettings\Temp\smtmp\*4\*

transfer to:

C:\Documents and Settings\All Users\*Desktop*

Let me know how that goes and if you have any problems

Satchfan


----------



## seemacima (Jul 16, 2011)

i was initially having soem confution in locating and copying but i think i am able to do it...now should i restart the system...and change the folder/control panal options back to it was before looking...


----------



## seemacima (Jul 16, 2011)

honestly speaking i dnt see any difference in the problems i have...the problems /symptoms i have
1.Mcafee total protection is not working when i open it its blank white screen

2. when i try to sign into hotmail/yahoo it comes a blank screen totally white

3.I dnt have any restore window points any more like i had before and when i try to open restore it comes as a totally white screen.

4. When i try to log in to site to do a OL streaming course i cant log in seems like soem java script log in problem comes..not sure..and thats what i am experincing and it hasnt changed.....


----------



## Satchfan (Jan 12, 2009)

Please follow the instructions I gave you. 

When you have completed them, you can then tell me if you see any changes or have any problems.


----------



## seemacima (Jul 16, 2011)

Yes i did...i did transfered all the folder contents from sm to the respective folders as you had instructed ....i dnt see any visible change as far as i can see.....


----------



## seemacima (Jul 16, 2011)

I just turned the system on again ..and as soon as the start menu came i saw black C:\\ prompt screens several of them...and they dissapered on their own...Now when i go to google email site is hard to open them also and it comes like there is a problem with security certificate of the site..also.. when i log into picasda web to upload any photo i cnat it gives a java problem...I have done as you have instructed me.....not be trying to impatient... its driving me crazy ...hope we will have solution otherwise i am in trouble


----------



## Satchfan (Jan 12, 2009)

*Download and run ComboFix*

Download ComboFix from the following location:

*Link*

** IMPORTANT !!! Save ComboFix.exe to your Desktop*


Double click on *ComboFix.exe* & follow the prompts.
As part of it's process, ComboFix will check to see if the *Microsoft Windows Recovery Console *is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware. 

Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
***Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue its malware removal procedures.*








Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:








Click on *Yes,* to continue scanning for malware.
*Note: Do not mouse-click combofix's window while it is running. That may cause it to stall.*

When finished, it will produce a log. Please include the *ComboFix.txt* in your next reply. It can be found at *C:\ComboFix.txt*

Satchfan


----------



## seemacima (Jul 16, 2011)

One question....When you had asked me to do last time we were unable to finish it as combofix ask to disable McAfee and i was unable to di it as it was not letting.me disable it. And When i trief to do the scan it warned that combofix and disturb the partitions....

What should i do for that ....


----------



## Satchfan (Jan 12, 2009)

Disable McAfee, allow ComboFix to install the Recovery Console and proceed.

It will not affect your partitions.

Remember not to mouse-click while ComboFix is running. It should only take about 10 minutes unless it finds something that requires it to run longer.


----------



## seemacima (Jul 16, 2011)

Thanks for answering I will have to uninstall mcafee then completely as I am unable to disable mcafee from system tray it wnt right click nor it will open meaning a blank white screen comes.
Unfortunately I can only do this tomorrow as I wnt be home for most part so wanted all my conditions cleared.
So seems like only way is to uninstall mcafee before running combofix


----------



## seemacima (Jul 16, 2011)

I mean confutions cleared....trying typing from small screen


----------



## Satchfan (Jan 12, 2009)

I'm having a great deal of trouble reading your logs so have just noticed a couple of things:

*O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ScanPanel.lnk = C:\ScanPanel\ScnPanel.exe () - *

What does it do and is it required?

===============================================

*IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 210.212.123.10:8080 - *

Do you use a proxy server?

===============================================

Did you place these in the Trusted Zone?:

*O15 - HKCU\..Trusted Domains: ameritrade.com ([]https in Trusted sites)

*
*O15 - HKCU\..Trusted Domains: turbotax.com ([]https in Trusted sites)

*


----------



## seemacima (Jul 16, 2011)

I am not sure about first question. No as far as i know we dnt have proxy server...i would think terbo tax and ameritrade we use these sites so Its posible my husband have placed them in trusted sites.


----------



## seemacima (Jul 16, 2011)

Oh Yes i think scan panal is for e+40 scanner we have...so Yes we use that. I wish i can post logs clearly....really sry...


----------



## Satchfan (Jan 12, 2009)

Seemacima

Please don't mark this topic as "Solved" until I have given you the "All clear". Thanks

If you are not running ComboFix today, let's fix this proxy with OTL.

*Run OTL*


d*ouble click on the icon to run it.*
copy/paste *ALL* the following text written *inside the code box* into the *Custom Scans/Fixes* box located at the bottom of OTL


```
[FONT=Arial][FONT=Arial]:Services[/FONT]
 
[FONT=Arial]:OTL[/FONT]
[FONT=Arial]IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 210.212.123.10:8080[/FONT]
 
[FONT=Arial]:Files[/FONT]
[FONT=Arial]ipconfig /flushdns /c[/FONT]
 
[FONT=Arial]:Commands[/FONT]
[FONT=Arial][resethosts][/FONT]
[FONT=Arial][Reboot][/FONT]

[/FONT]
```

then click the *Run Fix* button at the top
let the program run unhindered, reboot when it is done
then post a new OTL log (*don't check* the boxes beside LOP Check or Purity this time)
You can sen this log with the ComboFix log if you do not send it now

Satchfan


----------



## seemacima (Jul 16, 2011)

Ok will do that...i will try it today If possible...thank you...


----------



## seemacima (Jul 16, 2011)

I am having a lot of problem...first was unable todisable McAfee then was unable to uninstall and no w combofix is running since last 30 min .i dnt know why di long Its just Still running i made sure i am not moving mouse...


----------



## seemacima (Jul 16, 2011)

i reran the combofix again and it seemed to work this time..howver i was unable to find the log at C:\\combofix.text...but it i think i was able to find it the log .I forgot to fix the proxy though ..will do that tomorrow...


----------



## seemacima (Jul 16, 2011)

here is the log

ComboFix 11-07-25.03 - prakash1 07/25/2011 17:22:03.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1023.676 [GMT -7:00]
Running from: C:\Documents and Settings\prakash1\Desktop\ComboFix.exe
AV: McAfee Anti-Virus and Anti-Spyware *Enabled/Outdated* {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\Program Files\1
C:\Program Files\1\McAfee Shared Components\Centralv3\CentENU.dll
C:\Program Files\1\McAfee Shared Components\Centralv3\Central.dll
C:\Program Files\1\McAfee Shared Components\dtune.386
C:\Program Files\1\McAfee Shared Components\Shredder 5\DMDLL32.dll
C:\Program Files\1\McAfee Shared Components\Shredder 5\mcshping.dll
C:\Program Files\1\McAfee Shared Components\Shredder 5\shred32.exe
C:\Program Files\1\McAfee Shared Components\Shredder 5\shredder.dll
C:\Program Files\1\McAfee Shared Components\Shredder 5\ShredEnu.dll
C:\Program Files\1\McAfee Shared Components\Shredder 5\ShrEnu.chm
C:\Program Files\1\MPF\MpfSrv.exe
C:\Program Files\1\MQC\1033\mcpLD.inf
C:\Program Files\1\MQC\1033\mcqchelp.inf
C:\Program Files\1\MQC\1033\mcqcres.inf
C:\Program Files\1\MQC\1033\QcLog.xml
C:\Program Files\1\MQC\1033\QcRes.dll
C:\Program Files\1\MQC\1033\Readme.htm
C:\Program Files\1\MQC\McpAdmin.exe
C:\Program Files\1\MQC\McpIns.dll
C:\Program Files\1\MQC\mcpins.inf
C:\Program Files\1\MQC\mcpLI.inf
C:\Program Files\1\MQC\McpSched.dll
C:\Program Files\1\MQC\mcqc.inf
C:\Program Files\1\MQC\MRU.bak
C:\Program Files\1\MQC\MRU.ini
C:\Program Files\1\MQC\qcconf.bak
C:\Program Files\1\MQC\qcconf.dat
C:\Program Files\1\MQC\QcConsol.exe
C:\Program Files\1\MQC\QCLite.dll
C:\Program Files\1\MQC\QCMISP.dll
C:\Program Files\1\MSHR\1033\mcshrhelp.inf
C:\Program Files\1\MSHR\1033\mcshrres.inf
C:\Program Files\1\MSHR\1033\Readme.htm
C:\Program Files\1\MSHR\1033\ShrRes.dll
C:\Program Files\1\MSHR\mcshr.inf
C:\Program Files\1\MSHR\ShrCL.exe
C:\Program Files\1\MSHR\ShrCore.dll
C:\Program Files\1\MSHR\Shredder.ini
C:\Program Files\1\MSHR\ShrMISP.dll
C:\Program Files\Setup.exe

((((((((((((((((((((((((( Files Created from 2011-06-26 to 2011-07-26 )))))))))))))))))))))))))))))))

2011-07-23 17:32:05 . 2011-07-23 20:40:13 -------- d-----w- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2011-07-23 17:32:05 . 2011-07-23 17:42:13 -------- d-----w- C:\Program Files\Spybot - Search & Destroy
2011-07-22 00:46:40 . 2011-07-22 00:46:40 -------- d-----w- C:\_OTL
2011-07-21 17:59:27 . 2011-07-21 17:59:28 -------- d-----w- C:\Documents and Settings\prakash1\Local Settings\Application Data\WinZip
2011-07-19 00:32:20 . 2011-07-19 00:32:20 -------- d-----w- C:\Google
2011-07-16 20:54:58 . 2011-07-22 22:00:44 -------- d-----w- C:\Documents and Settings\Administrator
2011-07-15 23:18:19 . 2011-07-15 23:18:19 -------- d-----w- C:\Documents and Settings\prakash1\Application Data\Malwarebytes
2011-07-15 23:17:52 . 2011-07-15 23:17:52 -------- d-----w- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2011-07-15 21:28:22 . 2011-07-15 21:28:22 -------- d-----w- C:\WINDOWS\system32\wbem\Repository
2011-07-11 23:22:39 . 2011-07-11 23:22:44 -------- d-----w- C:\Program Files\Apple Software Update
2011-07-11 23:12:23 . 2011-07-11 23:12:23 -------- d-----w- C:\Program Files\iPod
2011-07-11 23:11:27 . 2011-07-11 23:15:32 -------- d-----w- C:\Program Files\iTunes
2011-07-09 19:14:25 . 2001-06-08 00:56:38 18120 ----a-w- C:\WINDOWS\system32\drivers\Artec48.sys
2011-07-09 19:14:08 . 2002-01-18 17:31:12 167936 ------w- C:\WINDOWS\Ausba4.dll
2011-07-09 19:14:08 . 2002-01-12 00:54:06 167936 ------w- C:\WINDOWS\A4.dll
2011-07-09 19:14:08 . 2002-01-06 18:57:46 7168 ------w- C:\WINDOWS\system32\48UMicro.dll
2011-07-09 19:14:08 . 2001-10-19 01:01:16 45056 ------w- C:\WINDOWS\Getkey.dll
2011-07-09 19:14:05 . 2001-07-11 01:01:44 45056 ----a-w- C:\WINDOWS\system32\Remove48U.exe
2011-07-04 00:18:50 . 2011-07-04 00:19:15 -------- d-----w- C:\Program Files\WM Converter
2011-07-03 23:47:45 . 2011-07-05 20:11:29 -------- d-----w- C:\Documents and Settings\prakash1\Local Settings\Application Data\WMTools Downloaded Files
.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
2011-07-24 04:16:58 . 2011-01-22 00:47:36 848 --sha-w- C:\Documents and Settings\All Users\Application Data\KGyGaAvL.sys
2011-07-23 17:26:37 . 2011-06-24 03:41:19 404640 ----a-w- C:\WINDOWS\system32\FlashPlayerCPLApp.cpl
2011-06-02 14:02:05 . 2005-07-25 04:56:03 1858944 ----a-w- C:\WINDOWS\system32\win32k.sys
2011-05-02 15:31:52 . 2005-07-25 04:56:56 692736 ----a-w- C:\WINDOWS\system32\inetcomm.dll
2011-04-29 17:25:27 . 2005-07-25 04:56:04 151552 ----a-w- C:\WINDOWS\system32\schannel.dll
2011-04-29 16:19:43 . 2005-07-25 04:56:00 456320 ----a-w- C:\WINDOWS\system32\drivers\mrxsmb.sys
2005-07-15 20:15:26 . 2005-07-15 20:15:26 416 -c--a-w- C:\Program Files\layout.bin

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown 
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-05 01:02:12 68856]
"Corel Photo Downloader"="C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" [2010-06-27 09:02:00 526992]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2003-10-06 19:16:00 5058560]
"Citi Virtual Account Numbers"="C:\PROGRA~1\VIRTUA~1\CitiVAN.exe" [2009-07-10 23:53:52 372736]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2010-11-30 00:38:18 421888]
"Microsoft Default Manager"="C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2009-07-17 18:12:14 288080]
"Standby"="C:\Program Files\Common Files\Corel\Standby\Standby.exe" [2010-03-19 20:23:46 105632]
"AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-04-20 19:48:18 58656]
"SunJavaUpdateSched"="C:\Program Files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 21:49:28 249064]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2011-06-08 00:51:12 421160]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"NvMediaCenter"="C:\WINDOWS\System32\NVMCTRAY.DLL" [2003-10-06 19:16:00 49152]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
McAfee Online Backup Status.lnk - C:\Program Files\McAfee Online Backup\MOBKstat.exe [N/A]
ScanPanel.lnk - C:\ScanPanel\ScnPanel.exe [2011-7-9 1744896]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Find Fast.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Find Fast.lnk
backup=C:\WINDOWS\pss\Microsoft Find Fast.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Office Startup.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Office Startup.lnk
backup=C:\WINDOWS\pss\Office Startup.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Picture Package Menu.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Picture Package Menu.lnk
backup=C:\WINDOWS\pss\Picture Package Menu.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Picture Package VCD Maker.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Picture Package VCD Maker.lnk
backup=C:\WINDOWS\pss\Picture Package VCD Maker.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UserFaultCheck]
C:\WINDOWS\system32\dumprep 0 -u [X]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-10-15 08:04:34 39792 -c--a-w- C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2007-05-08 23:24:20 54840 -c--a-w- C:\Program Files\Hewlett-Packard\HP Software Update\hpwuSchd2.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility]
2003-12-04 12:44:34 176128 -c--a-w- C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 16:50:42 155648 -c--a-w- C:\WINDOWS\system32\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2003-10-06 19:16:00 5058560 -c--a-w- C:\WINDOWS\system32\nvcpl.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2003-10-06 19:16:00 741376 -c--a-w- C:\WINDOWS\system32\nwiz.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SsAAD.exe]
2006-11-02 20:43:10 472632 -c--a-w- C:\PROGRA~1\Sony\SONICS~1\SSAAD.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2007-07-05 01:02:12 68856 -c--a-w- C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Hewlett-Packard\\HP Software Update\\HPWUCli.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
S2 gupdate;Google Update Service (gupdate);C:\Program Files\Google\Update\GoogleUpdate.exe [1/31/2010 1:19:48 PM 135664]
S3 BBSvc;Bing Bar Update Service;C:\Program Files\Microsoft\BingBar\BBSvc.EXE [2/28/2011 6:44:14 PM 183560]
S3 gupdatem;Google Update Service (gupdatem);C:\Program Files\Google\Update\GoogleUpdate.exe [1/31/2010 1:19:48 PM 135664]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A509B1FF-37FF-4bFF-8CFF-4F3A747040FF}]
2009-03-08 11:32:48 128512 ----a-w- C:\WINDOWS\system32\advpack.dll
Contents of the 'Scheduled Tasks' folder
2011-07-18 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-02 00:57:16 . 2011-06-02 00:57:16]
2011-07-26 C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
- C:\Program Files\Google\Update\GoogleUpdate.exe [2010-01-31 20:19:48 . 2010-01-31 20:19:29]
2011-07-26 C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
- C:\Program Files\Google\Update\GoogleUpdate.exe [2010-01-31 20:19:48 . 2010-01-31 20:19:29]
2011-07-25 C:\WINDOWS\Tasks\User_Feed_Synchronization-{0B8D5D45-4DE7-4CF4-B38A-8AE2A9D2EC6A}.job
- C:\WINDOWS\system32\msfeedssync.exe [2006-10-17 19:58:32 . 2009-03-08 11:31:54]

------- Supplementary Scan -------
uStart Page = hxxp://www.google.com/webhp?sourceid=navclient&ie=UTF-8
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
uInternet Connection Wizard,ShellNext = hxxp://mail.google.com/mail/
uInternet Settings,ProxyOverride = <local>;*.local
uInternet Settings,ProxyServer = 210.212.123.10:8080
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
IE: E&xport to Microsoft Excel - C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html
Trusted Zone: ameritrade.com
Trusted Zone: intuit.com\ttlc
Trusted Zone: tdameritrade.com
Trusted Zone: turbotax.com
TCP: DhcpNameServer = 192.168.0.1 205.171.3.25
DPF: DirectAnimation Java Classes - file://C:\WINDOWS\Java\classes\dajava.cab
DPF: Garmin Internet Explorer Plug-In - hxxps://my.garmin.com/mygarmin/m/GarminAxControl.CAB
DPF: Microsoft XML Parser for Java - file://C:\WINDOWS\Java\classes\xmldso.cab
- - - - ORPHANS REMOVED - - - -
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
HKCU-Run-TomTomHOME.exe - C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe
HKLM-Run-Corel File Shell Monitor - C:\Program Files\Corel\Corel PaintShop Photo Pro\X3\PSPClassic\CorelIOMonitor.exe
MSConfigStartUp-AdaptecDirectCD - C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
MSConfigStartUp-Adobe Photo Downloader - C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
MSConfigStartUp-CitiVAN - C:\Program Files\Citi Virtual Account Numbers\CitiVAN.exe
MSConfigStartUp-MaxtorOneTouch - C:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe
MSConfigStartUp-Messenger (Yahoo!) - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
MSConfigStartUp-mxomssmenu - C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe
MSConfigStartUp-TkBellExe - C:\Program Files\Common Files\Real\Update_OB\realsched.exe
MSConfigStartUp-{0228e555-4f9c-4e35-a3ec-b109a192b4c2} - C:\Program Files\Google\Gmail Notifier\gnotify.exe
AddRemove-_{707EB912-C597-49D8-9460-46CC9AB03EBE} - C:\Program Files\Corel\Corel Painter Photo Essentials 4\MSILauncher {707EB912-C597-49D8-9460-46CC9AB03EBE}


----------



## seemacima (Jul 16, 2011)

Please let me know if this is the correct log and also it seems like after this i am able to post logs in right way..


----------



## seemacima (Jul 16, 2011)

Will wait for your next instruction..


----------



## Satchfan (Jan 12, 2009)

Please run the OTL fix as previously requested.

*Next*

Re-run ComboFix buy doing the following:

Click the Windows *'Start'* button > Select *'Run'* - then copy/paste the following bolded text into the run box & click *OK*

*"%userprofile%\desktop\combofix.exe" /killall*

Please tell me if you can connect to the Internet OK and what problems remain

Satchfan


----------



## seemacima (Jul 16, 2011)

I ran OTL like you instructed but i cant find the logs.last time it was on desktop only.i ran combofix after that will post logs.


----------



## seemacima (Jul 16, 2011)

this is the combofix log

ComboFix 11-07-26.03 - prakash1 07/26/2011 14:55:07.2.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1023.705 [GMT -7:00]
Running from: c:\documents and settings\prakash1\desktop\combofix.exe
Command switches used :: /killall
AV: McAfee Anti-Virus and Anti-Spyware *Disabled/Updated* {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Firewall *Enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\prakash1\My Documents\~WRL0001.tmp
c:\documents and settings\prakash1\My Documents\~WRL0002.tmp
c:\documents and settings\prakash1\My Documents\~WRL0003.tmp
.
---- Previous Run -------
.
c:\program files\1\McAfee Shared Components\Centralv3\CentENU.dll
c:\program files\1\McAfee Shared Components\Centralv3\Central.dll
c:\program files\1\McAfee Shared Components\dtune.386
c:\program files\1\McAfee Shared Components\Shredder 5\DMDLL32.dll
c:\program files\1\McAfee Shared Components\Shredder 5\mcshping.dll
c:\program files\1\McAfee Shared Components\Shredder 5\shred32.exe
c:\program files\1\McAfee Shared Components\Shredder 5\shredder.dll
c:\program files\1\McAfee Shared Components\Shredder 5\ShredEnu.dll
c:\program files\1\McAfee Shared Components\Shredder 5\ShrEnu.chm
c:\program files\1\MPF\MpfSrv.exe
c:\program files\1\MQC\1033\mcpLD.inf
c:\program files\1\MQC\1033\mcqchelp.inf
c:\program files\1\MQC\1033\mcqcres.inf
c:\program files\1\MQC\1033\QcLog.xml
c:\program files\1\MQC\1033\QcRes.dll
c:\program files\1\MQC\1033\Readme.htm
c:\program files\1\MQC\McpAdmin.exe
c:\program files\1\MQC\McpIns.dll
c:\program files\1\MQC\mcpins.inf
c:\program files\1\MQC\mcpLI.inf
c:\program files\1\MQC\McpSched.dll
c:\program files\1\MQC\mcqc.inf
c:\program files\1\MQC\MRU.bak
c:\program files\1\MQC\MRU.ini
c:\program files\1\MQC\qcconf.bak
c:\program files\1\MQC\qcconf.dat
c:\program files\1\MQC\QcConsol.exe
c:\program files\1\MQC\QCLite.dll
c:\program files\1\MQC\QCMISP.dll
c:\program files\1\MSHR\1033\mcshrhelp.inf
c:\program files\1\MSHR\1033\mcshrres.inf
c:\program files\1\MSHR\1033\Readme.htm
c:\program files\1\MSHR\1033\ShrRes.dll
c:\program files\1\MSHR\mcshr.inf
c:\program files\1\MSHR\ShrCL.exe
c:\program files\1\MSHR\ShrCore.dll
c:\program files\1\MSHR\Shredder.ini
c:\program files\1\MSHR\ShrMISP.dll
c:\program files\Setup.exe
.
.
((((((((((((((((((((((((( Files Created from 2011-06-26 to 2011-07-26 )))))))))))))))))))))))))))))))
.
.
2011-07-26 01:28 . 2011-07-26 01:28 -------- d-----w- c:\documents and settings\prakash1\Local Settings\Application Data\McAfee Anti-Theft
2011-07-26 01:26 . 2011-03-13 18:20 9344 ----a-w- c:\windows\system32\drivers\mfeclnk.sys
2011-07-26 01:25 . 2011-03-13 18:20 85984 ----a-w- c:\windows\system32\drivers\mferkdet.sys
2011-07-26 01:25 . 2011-03-13 18:20 83688 ----a-w- c:\windows\system32\drivers\mfendisk.sys
2011-07-26 01:25 . 2011-03-13 18:20 337912 ----a-w- c:\windows\system32\drivers\mfefirek.sys
2011-07-26 01:25 . 2011-03-13 18:20 59288 ----a-w- c:\windows\system32\drivers\mfebopk.sys
2011-07-26 01:25 . 2011-03-13 18:20 57432 ----a-w- c:\windows\system32\drivers\cfwids.sys
2011-07-26 01:25 . 2011-03-13 18:20 179248 ----a-w- c:\windows\system32\drivers\mfeavfk.sys
2011-07-26 01:24 . 2011-07-26 20:55 -------- d-----w- c:\program files\McAfee
2011-07-26 01:04 . 2011-03-13 18:45 148520 ----a-w- c:\windows\system32\mfevtps.exe
2011-07-23 17:32 . 2011-07-23 20:40 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2011-07-23 17:32 . 2011-07-23 17:42 -------- d-----w- c:\program files\Spybot - Search & Destroy
2011-07-22 00:46 . 2011-07-22 00:46 -------- d-----w- C:\_OTL
2011-07-21 17:59 . 2011-07-21 17:59 -------- d-----w- c:\documents and settings\prakash1\Local Settings\Application Data\WinZip
2011-07-19 00:32 . 2011-07-19 00:32 -------- d-----w- C:\Google
2011-07-16 20:54 . 2011-07-22 22:00 -------- d-----w- c:\documents and settings\Administrator
2011-07-15 23:18 . 2011-07-15 23:18 -------- d-----w- c:\documents and settings\prakash1\Application Data\Malwarebytes
2011-07-15 23:17 . 2011-07-15 23:17 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2011-07-15 21:28 . 2011-07-15 21:28 -------- d-----w- c:\windows\system32\wbem\Repository
2011-07-11 23:22 . 2011-07-11 23:22 -------- d-----w- c:\program files\Apple Software Update
2011-07-11 23:12 . 2011-07-11 23:12 -------- d-----w- c:\program files\iPod
2011-07-11 23:11 . 2011-07-11 23:15 -------- d-----w- c:\program files\iTunes
2011-07-09 19:14 . 2001-06-08 00:56 18120 ----a-w- c:\windows\system32\drivers\Artec48.sys
2011-07-09 19:14 . 2002-01-18 17:31 167936 ------w- c:\windows\Ausba4.dll
2011-07-09 19:14 . 2002-01-12 00:54 167936 ------w- c:\windows\A4.dll
2011-07-09 19:14 . 2002-01-06 18:57 7168 ------w- c:\windows\system32\48UMicro.dll
2011-07-09 19:14 . 2001-10-19 01:01 45056 ------w- c:\windows\Getkey.dll
2011-07-09 19:14 . 2001-07-11 01:01 45056 ----a-w- c:\windows\system32\Remove48U.exe
2011-07-04 00:18 . 2011-07-04 00:19 -------- d-----w- c:\program files\WM Converter
2011-07-03 23:47 . 2011-07-05 20:11 -------- d-----w- c:\documents and settings\prakash1\Local Settings\Application Data\WMTools Downloaded Files
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-24 04:16 . 2011-01-22 00:47 848 --sha-w- c:\documents and settings\All Users\Application Data\KGyGaAvL.sys
2011-07-23 17:26 . 2011-06-24 03:41 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-06-02 14:02 . 2005-07-25 04:56 1858944 ----a-w- c:\windows\system32\win32k.sys
2011-05-02 15:31 . 2005-07-25 04:56 692736 ----a-w- c:\windows\system32\inetcomm.dll
2011-04-29 17:25 . 2005-07-25 04:56 151552 ----a-w- c:\windows\system32\schannel.dll
2011-04-29 16:19 . 2005-07-25 04:56 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2005-07-15 20:15 . 2005-07-15 20:15 416 -c--a-w- c:\program files\layout.bin
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-05 68856]
"TomTomHOME.exe"="c:\program files\TomTom HOME 2\TomTomHOMERunner.exe" [BU]
"Corel Photo Downloader"="c:\program files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" [2010-06-27 526992]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2003-10-06 5058560]
"Citi Virtual Account Numbers"="c:\progra~1\VIRTUA~1\CitiVAN.exe" [2009-07-10 372736]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-30 421888]
"Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2009-07-17 288080]
"Corel File Shell Monitor"="c:\program files\Corel\Corel PaintShop Photo Pro\X3\PSPClassic\CorelIOMonitor.exe" [BU]
"Standby"="c:\program files\Common Files\Corel\Standby\Standby.exe" [2010-03-19 105632]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-04-20 58656]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-06-08 421160]
"mcui_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2011-06-23 1306728]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"NvMediaCenter"="c:\windows\System32\NVMCTRAY.DLL" [2003-10-06 49152]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
ScanPanel.lnk - c:\scanpanel\ScnPanel.exe [2011-7-9 1744896]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Find Fast.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Find Fast.lnk
backup=c:\windows\pss\Microsoft Find Fast.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Office Startup.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Office Startup.lnk
backup=c:\windows\pss\Office Startup.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Picture Package Menu.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Picture Package Menu.lnk
backup=c:\windows\pss\Picture Package Menu.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Picture Package VCD Maker.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Picture Package VCD Maker.lnk
backup=c:\windows\pss\Picture Package VCD Maker.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UserFaultCheck]
c:\windows\system32\dumprep 0 -u [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdaptecDirectCD]
c:\program files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe [BU]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
c:\program files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe [BU]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-10-15 08:04 39792 -c--a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CitiVAN]
c:\program files\Citi Virtual Account Numbers\CitiVAN.exe [BU]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2007-05-08 23:24 54840 -c--a-w- c:\program files\Hewlett-Packard\HP Software Update\hpwuSchd2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility]
2003-12-04 12:44 176128 -c--a-w- c:\windows\system32\spool\drivers\w32x86\3\hpztsb09.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MaxtorOneTouch]
c:\program files\Maxtor\OneTouch\utils\Onetouch.exe [BU]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)]
c:\program files\Yahoo!\Messenger\YahooMessenger.exe [BU]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mxomssmenu]
c:\program files\Maxtor\OneTouch Status\maxmenumgr.exe [BU]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 16:50 155648 -c--a-w- c:\windows\system32\NeroCheck.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2003-10-06 19:16 5058560 -c--a-w- c:\windows\system32\nvcpl.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2003-10-06 19:16 741376 -c--a-w- c:\windows\system32\nwiz.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SsAAD.exe]
2006-11-02 20:43 472632 -c--a-w- c:\progra~1\Sony\SONICS~1\SSAAD.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2007-07-05 01:02 68856 -c--a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
c:\program files\Common Files\Real\Update_OB\realsched.exe [BU]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\{0228e555-4f9c-4e35-a3ec-b109a192b4c2}]
c:\program files\Google\Gmail Notifier\gnotify.exe [BU]
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Hewlett-Packard\\HP Software Update\\HPWUCli.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Common Files\\McAfee\\McSvcHost\\McSvHost.exe"=
.
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;"c:\program files\Common Files\Mcafee\McSvcHost\McSvHost.exe" /McCoreSvc [7/25/2011 6:25 PM 214904]
R2 McNaiAnn;McAfee VirusScan Announcer;"c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe" /McCoreSvc [7/25/2011 6:25 PM 214904]
R2 mfefire;McAfee Firewall Core Service;c:\program files\Common Files\McAfee\SystemCore\mfefire.exe [7/25/2011 6:26 PM 159832]
R2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [7/25/2011 6:04 PM 148520]
R3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [7/25/2011 6:25 PM 337912]
R3 mfendiskmp;mfendiskmp;c:\windows\system32\drivers\mfendisk.sys [7/25/2011 6:25 PM 83688]
S1 mfetdi2k;McAfee Inc. mfetdi2k;c:\windows\system32\drivers\mfetdi2k.sys --> c:\windows\system32\drivers\mfetdi2k.sys [?]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [1/31/2010 1:19 PM 135664]
S3 BBSvc;Bing Bar Update Service;c:\program files\Microsoft\BingBar\BBSvc.EXE [2/28/2011 6:44 PM 183560]
S3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [7/25/2011 6:25 PM 57432]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [1/31/2010 1:19 PM 135664]
S3 mfendisk;McAfee Core NDIS Intermediate Filter;c:\windows\system32\drivers\mfendisk.sys [7/25/2011 6:25 PM 83688]
S3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [7/25/2011 6:25 PM 85984]
.
--- Other Services/Drivers In Memory ---
.
*Deregistered* - mfeavfk01
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A509B1FF-37FF-4bFF-8CFF-4F3A747040FF}]
2009-03-08 11:32 128512 ----a-w- c:\windows\system32\advpack.dll
.
Contents of the 'Scheduled Tasks' folder
.
2011-07-18 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-02 00:57]
.
2011-07-26 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-31 20:19]
.
2011-07-26 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-31 20:19]
.
2011-07-26 c:\windows\Tasks\User_Feed_Synchronization-{0B8D5D45-4DE7-4CF4-B38A-8AE2A9D2EC6A}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 11:31]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/webhp?sourceid=navclient&ie=UTF-8
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
uInternet Connection Wizard,ShellNext = hxxp://mail.google.com/mail/
uInternet Settings,ProxyOverride = *.local;<local>
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html
Trusted Zone: ameritrade.com
Trusted Zone: intuit.com\ttlc
Trusted Zone: tdameritrade.com
Trusted Zone: turbotax.com
TCP: DhcpNameServer = 192.168.0.1 205.171.3.25
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Garmin Internet Explorer Plug-In - hxxps://my.garmin.com/mygarmin/m/GarminAxControl.CAB
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
.
- - - - ORPHANS REMOVED - - - -
.
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-07-26 15:50
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ... 
.
scanning hidden autostart entries ... 
.
scanning hidden files ... 
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'explorer.exe'(1940)
c:\windows\system32\WININET.dll
c:\progra~1\mcafee\sitead~1\saHook.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
c:\windows\System32\nvsvc32.exe
c:\windows\System32\spool\DRIVERS\W32X86\3\HPZIPM12.EXE
c:\windows\system32\PSIService.exe
c:\program files\Common Files\Protexis\License Service\PsiService_2.exe
c:\program files\Microsoft\BingBar\SeaPort.EXE
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe
c:\program files\Common Files\McAfee\SystemCore\mcshield.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\OBroker.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2011-07-26 16:08:43 - machine was rebooted
ComboFix-quarantined-files.txt 2011-07-26 23:08
.
Pre-Run: 30,550,568,960 bytes free
Post-Run: 30,874,865,664 bytes free
.
- - End Of File - - DEB54000B6E486A624711C7B00C5A93F


----------



## seemacima (Jul 16, 2011)

i found this log stuck some where in c drive...i think thats the log for OTL

========== SERVICES/DRIVERS ==========
========== OTL ==========
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully!
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Documents and Settings\prakash1\Desktop\cmd.bat deleted successfully.
C:\Documents and Settings\prakash1\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

OTL by OldTimer - Version 3.2.26.1 log created on 07262011_142031


----------



## seemacima (Jul 16, 2011)

Please let me know what to do next..I am able to connect to internet ok and and able to go to secure sites also


----------



## Satchfan (Jan 12, 2009)

Can you tell me what problems remain

Thanks

Satchfan


----------



## seemacima (Jul 16, 2011)

I think the only thing is i feel it still seem to be a Littlle slow When Browsing and screen freezes some.


----------



## seemacima (Jul 16, 2011)

I dnt see any visible problem.i do need to see though If the restore ponte are Back or not.


----------



## Satchfan (Jan 12, 2009)

The restore point will be dealt with when we tidy up the tools we've used.

First, let's do a final scan

*Run ESET Online Scan*

Hold down Control and click on the following link to open ESET OnlineScan in a new window.

*ESET OnlineScan*

click the *Eset online Scanner* button.
*For alternate browsers only*: (Microsoft Internet Explorer users can skip these steps)
click on *esetinstaller.exe* to download the ESET Smart Installer. Save it to your desktop.
double click on the Eset installer icon on your desktop​
check *Yes, I accept the Terms of Use*
click the *Start* button.
accept any security warnings from your browser.
check *Scan archives*
push the *Start* button.
ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
when the scan completes, push *List of found threats*
push *Export to Text file* and save the file to your desktop using a unique name, such as *ESETScan*. Include the contents of this report in your next reply.
*Note *- when ESET doesn't find any threats, no report will be created.
push the *back* button.
push *Finish*
If a log has been produced post it in your next reply.

Satchfan


----------



## seemacima (Jul 16, 2011)

Ok thanks will do that.i will be able to this tomorrow only Its almost midnight here right now.thank you for your time and all the help.


----------



## Satchfan (Jan 12, 2009)

:up:


----------



## seemacima (Jul 16, 2011)

Hello I am running this OL scan its almost 4 hrs and 90% complete and as of now it has found 1 infected file. so according to your instruction I need to save that threat text file. Initially when i was started to do scan there were 2 options one to scan and another to remove threats but i checked only the scan one according to your instruction.. hope that was right..will post it as soon as its done.


----------



## seemacima (Jul 16, 2011)

not happy ....the scan was 95 % done and ran for 5 hrs and suddenly screen got froze and windows closed so lost all the scan now i will have redo the whole thing..i now have to do this tomorrow..my another day got lost


----------



## seemacima (Jul 16, 2011)

Will try to do it tomorrow now and will post results, i know there was atleast one threat was there...if there is anything else i need to do please let me know other wise will wait till after the whole scan is done and will post the logs.Also let me know do i have to press the scan or do i have to press the remove the threat button also.


----------



## Satchfan (Jan 12, 2009)

Seemacima

It could be the sqame McAfee issue that is causing the long scan. It might be an idea to temporarily uninstall it if you can't disable it and then try Eset again.




> do i have to press the scan or do i have to press the remove the threat button also


 Just the "Scan" button.

All infected files are automatically moved into quarantine. When they are there, they no longer represent a threat to your computer because they are isolated from all parts of the operating system. 

Some scans come back with "false positives" and may quarantine some files that are "good". Being in quarantine gives you the choice either to restore the files or delete them.

We're nearly there now 

Satchfan


----------



## seemacima (Jul 16, 2011)

Oh ok I hope I can disable mcafee this time....I already uninstall once it's a pain.thanks for reassurance that it's almost done will try after I come from work today.


----------



## Satchfan (Jan 12, 2009)

:up:


----------



## seemacima (Jul 16, 2011)

ok..finally scan is done in 4 hrs this time...

and here is the log

C:\Documents and Settings\prakash1\My Documents\setup_123132.exe Win32/Toolbar.Zugo application


----------



## seemacima (Jul 16, 2011)

will wait for next step now


----------



## Satchfan (Jan 12, 2009)

It looks like all is OK now but I'd like you to do one more scan before we tidy up.

*Run Malwarebytes Anti-Malware*

I noticed that you had MBAM on your system: if you no longer have it, you can download it from *here*: 

start Malwarebytes-Anti-Malware and update it, (Update tab}
once it is updated, click on Scanner tab, select *Perform quick scan*, then click *Scan*.
when the scan is complete, click *OK*, then *Show Results* to view the results.
be sure that everything is checked, and click *Remove Selected*.
when removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below) 
the log is automatically saved and can be viewed by clicking the *Logs* tab in MBAM. 
copy and paste the contents of that report in your next reply and exit MBAM. 
*NOTE*: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

Thanks

Satchfan


----------



## seemacima (Jul 16, 2011)

Ok will do that after I come from work. Thanks.


----------



## Satchfan (Jan 12, 2009)

Please also run this either before or after Malwarebytes.

*Run Security Check*

Download *Security Check* by screen317 from *here* or *here*.

save it to your Desktop
double click SecurityCheck.exe and follow the onscreen instructions inside of the black box
a Notepad document should open automatically called *checkup.txt*; please post the contents of that document.
Satchfan


----------



## seemacima (Jul 16, 2011)

Ok will do thanks


----------



## seemacima (Jul 16, 2011)

OK i am done with both scans
this is for Malware scan

Malwarebytes' Anti-Malware 1.51.1.1800
www.malwarebytes.org
Database version: 7322
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702
7/29/2011 1:14:03 PM
mbam-log-2011-07-29 (13-14-02).txt
Scan type: Quick scan
Objects scanned: 317961
Time elapsed: 50 minute(s), 58 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)


----------



## seemacima (Jul 16, 2011)

and this is for system check

Results of screen317's Security Check version 0.99.18 
Windows XP Service Pack 3 
Internet Explorer 8 
*`````````````````````````````` 
Antivirus/Firewall Check:* 
Windows Firewall Enabled! 
ESET Online Scanner v3 
McAfee Total Protection 
McAfee Online Backup 
McAfee Shredder 
McAfee Online Backup 
*``````````````````````````````` 
Anti-malware/Other Utilities Check:* 
Malwarebytes' Anti-Malware 
Java(TM) 6 Update 24 
*Out of date Java installed!* 
Adobe Flash Player 
*```````````````````````````````` 
Process Check: 
objlist.exe by Laurent* 
McAfee Online Backup MOBKbackup.exe 
McAfee Online Backup MOBKstat.exe 
*``````````End of Log````````````*


----------



## seemacima (Jul 16, 2011)

Now will wait for next step...


----------



## Satchfan (Jan 12, 2009)

Hi seemacima

Well done, your computer appears to be clean.

Now that youre free from malware, as long as your computer seems to be running well, please follow these simple steps to tidy up you computer and decrease the likelihood of getting infected again:

*Uninstall Combofix*

Follow these steps to uninstall Combofix

click *START* then *RUN*
now type *Combofix /uninstall *in the runbox and click *OK*. 
Note the space between the *X* and the */*, it needs to be there.











please follow the prompts to uninstall Combofix.
once it's finished uninstalling itself you will receive a message saying Combofix was uninstalled successfully.
===================================================

*Uninstall OTL*

double-click *OTL.exe*
click the *CleanUp!* button. 
select *Yes* when the *Begin cleanup Process?* prompt appears. 
if you are prompted to reboot during the cleanup, select *Yes*. 
the tool will delete itself once it finishes, if not delete it by yourself. 
*NOTE*: If you receive a warning from your firewall or other security programs regarding OTL attempting to contact the internet, please allow it to do so.

===================================================

*Firewall*

You're using the Windows Firewall which is not adequate protection. The main reason you should use a third-party firewall over the Windows XP Firewall is because Windows Firewall only stops *incoming* signals from accessing your computer. However, it will not stop *Outgoing* signals (possibly ones that could intrude your privacy) from sending information to the Internet or to other networks. That means if malware happens to compromise your PC again, it will be able to SEND OUT out your credit card data and any other personal information.

I suggest you install a more robust third party firewall that filters both incoming *and* outgoing traffic.

Download and install one of the following freeware firewalls from below:

*Sygate Personal Firewall Free Edition*:
*Zone Alarm Free*:
*Comodo Personal Firewall*:

*NOTE*only install one firewall. Having more than one could cause many programs to stop working altogether. Also, the firewalls may get in each others' way and cause some security holes that would not be there with just one firewall.

When you have done that:

Disable Windows firewall:

click on *Start, Settings *and then *Control Panel*
click on the *Security Center *icon.
click on the *Windows Firewall *icon
click *Off (not recommended)* and then click *OK*.
You should take the time to read *Understanding and Using Firewalls*

===================================================

*Update installed programs*











*Your Java is out of date.* Older versions have vulnerabilities that malware can use to infect your system. *Please follow these steps to remove older version Java components and update.*

download the latest version of *Java Runtime Environment (JRE) 26* and save it to your desktop
scroll down to where it says *JDK 6 Update 26 (JDK or JRE)*
[*]Click the *Download JRE* button to the right

select the *Windows* platform from the dropdown menu
read the License Agreement and then check the box that says: "_I agree to the Java SE Runtime Environment 6u26 with JavaFX 1 License Agreement_". Click on *Continue.* The page will refresh
click on the link to download *Windows Offline Installation* and save the file to your desktop
close any programs you may have running - especially your web browser
go to *Start > Control Panel*, double-click on *Add or Remove Programs* and remove all older versions of Java
check (_highlight_) any item with Java Runtime Environment (JRE or J2SE or Java(TM) 6) in the name
click the *Remove* or *Change/Remove* button
repeat as many times as necessary to remove each Java versions
reboot your computer once all Java components are removed
then from your desktop double-click on *jre-6u26-windows-i586.exe* to install the newest version
after the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
on the General tab, under Temporary Internet Files, click the *Settings* button
next, click on the *Delete Files* button
there are two options in the window to clear the cache - *Leave BOTH Checked*
*Applications and Applets*
*Trace and Log Files*​
click OK on Delete Temporary Files Window
*Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.*
click OK to leave the Temporary Files Window
click OK to leave the Java Control Panel.
===================================================

*Its important to keep programs up to date so that malware doesn't exploit any old security flaws.*

*FileHippo Update Checker* is an extremely helpful program that will tell you which of your programs need to be updated. 

===================================================

*Update and run Malwarebytes*. This really is an excellent program that you should update and run on a regular basis, probably weekly.

===================================================

*I also recommend that you read the following:*

*How to prevent malware* by miekiemoes

Finally, if your computer has no more problems and you are happy to close this, please click on mark Solved at the top of the page.

Safe computing

Satchfan


----------



## seemacima (Jul 16, 2011)

Ok let me do all of these and see if i have any questions....Thank you so much for all your time and support..thanks for your patience..


----------



## seemacima (Jul 16, 2011)

I have done first 2 steps would like to read about firewall more before doing that one.will update java and will read other related stuffi might not be able to all these this weekend.is it ok to keep this thread open atleast till monday i might have some question.


----------



## seemacima (Jul 16, 2011)

Its taking forever to reboot system after OTL clean up


----------



## Satchfan (Jan 12, 2009)

> might not be able to all these this weekend.is it ok to keep this thread open atleast till monday i might have some question.


No problem, we'll be here.

OTL cleanup shouldn't cause a problem. As I said, we'll be here if there is one.


----------



## seemacima (Jul 16, 2011)

Thank you so much...for all your help have a great weekend.


----------



## Satchfan (Jan 12, 2009)

You have a good weekend also

You've put in a lot of hard work and need a little break so relax and get in touch after the weekend if necessary 

Regards

Satchfan


----------



## seemacima (Jul 16, 2011)

Thanks


----------



## seemacima (Jul 16, 2011)

I updated java..how ever i am having some problems i am unable to update itunes its not updating and when i tried to uninstall the older version it says--
unable to find iTunes.msi and also says the feature you are trying to use is on a network resource that is unavailable.


----------



## Satchfan (Jan 12, 2009)

Hi seemacina

I dont have a solution for your iTunes problem Im afraid.

You could try solving the *msi installer* issue by downloading the MS Installer Cleanup utility from *here*:

More information about iTunes *here*:

If the problem remains start a topic at our *Software* forum *here *

Im sure someone there will be able to help.

Satchfan


----------



## seemacima (Jul 16, 2011)

Hello Satchfan
Thanks 
I had that file still it was not doing it neither I was unable to uninstall iTunes to update. I then removed iTunes by this ----"http://www.softpedia.com/get/Security/Secure-cleaning/Windows-Installer-CleanUp-Utility.html. After this I wad able to reinstall iTunes and now it's working. I will scan again witj malware after this.will try to read about firewall etc tomorrow. Thanks again for all the help will let you if I have any more questions.


----------



## Satchfan (Jan 12, 2009)

:up:


----------



## seemacima (Jul 16, 2011)

still reading about firewall...before i change the setting..will let you know if all goes well and then can mark as solved..thank you.


----------



## Satchfan (Jan 12, 2009)

OK seemacima, you're welcome.

If I hear no more, good luck and safe computing

Nina


----------



## seemacima (Jul 16, 2011)

Hello
Still reading but i still have one more question When i start the system it still seem to take a lot of time for dedktop items to load and today it also seem to freez for some time.i think the system has slowed down some.is there anything else can be done?


----------



## Satchfan (Jan 12, 2009)

Seemacima

The following link gives suggestions and directions to help speed up your computer:

http://www.siamkia.com/info-tech-tips/automate-system-maintenance-in-window-xp.html

=========================================

It could be that you have too many programs that take up resources on startup.

Try stopping them all from starting when you boot up  it wont affect your programs starting normally as and when you need them.

Make sure you are logged in as administrator. 

Click *Start, Run* type in *msconfig* and then press *Enter*. Click on the Start up tab and uncheck everything except your anti virus and firewall. Click *OK*and reboot. When you come back to the desktop, check the box *Do not show this message again* and click *OK*

Satchfan


----------



## seemacima (Jul 16, 2011)

Ok i am doing this right now..I just realized we didnt talked about system restore..initially when i was having problems the system restore screen was white, now i checked its coming however the system restore was off. which i just turned it on.. how ever there are no restore points though. How to go about it....Should we have to start from scratch?
Thanks bunch for help...


----------



## Satchfan (Jan 12, 2009)

There should have been a restore point set when ComboFix was uninstalled. Did you follow all the instuctions to remove the tools we used?

===================================================

Well do it manually.

*Create a Restore Point*

click *Start Menu, Run*
copy and paste the following:
*%SystemRoot%\System32\restore\rstrui.exe *

press *OK*
choose *Create a Restore Point* then click *Next*. Name it (something you'll remember) and click *Create*
when the confirmation screen shows that the restore point has been created, click *Close*.
Remove old restore points

go to *Start, Programs, Accessories, System tools, Disk Cleanup*
when the Disc Cleanup dialog box appears, click *OK*
when it finishes running, a box with tabs will appear, select the _More options_ tab 
on this tab you will find a section for System Restore 
if you press the *Clean Up* button for that section, Windows will delete all restore points except for the most recent one.
Let me know if that worked

Satchfan


----------



## seemacima (Jul 16, 2011)

Hello Satchfan

yes i did follow them , but yesterday when opend that option...the option for restore points was unchecked..so i checked it, i just checked the wizard again today i saw the restore point for yesterday ( the date i checked it)...so there is only 1 for yesterday.
Should i still do all these steps??
Please let me know and i will do accordingly.
Thanks
Seema


----------



## Satchfan (Jan 12, 2009)

No, it appears that you did the trick. 

Iwould say that we are now done and you can mark this "Solved"

Regards

Satchfan


----------



## seemacima (Jul 16, 2011)

Thank you Satchfan....Thanks for all the help .I was really stressed for the first few days .
Hope i wnt have to do it again 
Thanks
Seema


----------



## Satchfan (Jan 12, 2009)

You are welcome and did a good job yourself.

I also hope you don't have to do it again but you know where we are if necessary

Satchfan


----------



## seemacima (Jul 16, 2011)

Hello Satchfan..guess i am here again...

I just noticed that i am unbale to access one my program. its
Carol Paint shop Photo pro X3..
I dnt see it in program files or anywhere else but i see its in control panel under add/remove program...how ever i dnt know how to open it from there or from any where else..
I tried to find the software of this program but at this time i am unable to locate it ....since it seems like its still in system didnt knew we can recover it..

Thanks again for help..


----------



## seemacima (Jul 16, 2011)

oh..i was able to unhide it..its working now...


----------

