Welcome guest. Before posting on our computer help forum, you must register. Click here it's easy and free.

« previous next »
Pages: [1]   Go Down

Author Topic: Virus Causing Strange Behavior  (Read 8672 times)

0 Members and 1 Guest are viewing this topic.

rstoddard

    Topic Starter


    Beginner

    Virus Causing Strange Behavior
    « on: November 13, 2010, 01:46:10 PM »
    After quite a while, I seem to have a virus once again.

    Symptoms: 1. Very slow in opening browsers and programs. 2. Occasionally, some programs will not open at all, such as Excel and Word. 3. An error message is received when re-booting: "Runner Error" "Could not load the target dll (*C:\Program Files\Updates from HP\9972322\6.3.2.116-9972322\program\Back Web.dll", error code 126)

    Here is the SuperAntispyware Log:

    SUPERAntiSpyware Scan Log
    http://www.superantispyware.com

    Generated 11/13/2010 at 02:01 AM

    Application Version : 4.45.1000

    Core Rules Database Version : 4700
    Trace Rules Database Version: 2512

    Scan type       : Complete Scan
    Total Scan Time : 02:45:39

    Memory items scanned      : 523
    Memory threats detected   : 0
    Registry items scanned    : 8264
    Registry threats detected : 0
    File items scanned        : 151228
    File threats detected     : 32

    Adware.Tracking Cookie
       cdn4.specificclick.net [ C:\Documents and Settings\Justin2\Application Data\Macromedia\Flash Player\#SharedObjects\P5VCTAEJ ]
       secure-us.imrworldwide.com [ C:\Documents and Settings\Justin2\Application Data\Macromedia\Flash Player\#SharedObjects\P5VCTAEJ ]
       static.2mdn.net [ C:\Documents and Settings\Justin2\Application Data\Macromedia\Flash Player\#SharedObjects\P5VCTAEJ ]
       C:\Documents and Settings\Justin2\Cookies\[email protected][2].txt
       C:\Documents and Settings\Justin2\Cookies\justin2@adbrite[1].txt
       C:\Documents and Settings\Justin2\Cookies\[email protected][2].txt
       C:\Documents and Settings\Justin2\Cookies\[email protected][1].txt
       C:\Documents and Settings\Justin2\Cookies\justin2@adultadworld[1].txt
       C:\Documents and Settings\Justin2\Cookies\justin2@adultfriendfinder[1].txt
       C:\Documents and Settings\Justin2\Cookies\justin2@advertising[1].txt
       C:\Documents and Settings\Justin2\Cookies\[email protected][1].txt
       C:\Documents and Settings\Justin2\Cookies\justin2@atdmt[1].txt
       C:\Documents and Settings\Justin2\Cookies\[email protected][1].txt
       C:\Documents and Settings\Justin2\Cookies\justin2@clicksor[2].txt
       C:\Documents and Settings\Justin2\Cookies\justin2@collective-media[1].txt
       C:\Documents and Settings\Justin2\Cookies\justin2@doubleclick[1].txt
       C:\Documents and Settings\Justin2\Cookies\justin2@imrworldwide[2].txt
       C:\Documents and Settings\Justin2\Cookies\justin2@interclick[1].txt
       C:\Documents and Settings\Justin2\Cookies\justin2@invitemedia[1].txt
       C:\Documents and Settings\Justin2\Cookies\justin2@linksynergy[1].txt
       C:\Documents and Settings\Justin2\Cookies\justin2@media6degrees[1].txt
       C:\Documents and Settings\Justin2\Cookies\justin2@mediatraffic[1].txt
       C:\Documents and Settings\Justin2\Cookies\justin2@myroitracking[1].txt
       C:\Documents and Settings\Justin2\Cookies\justin2@questionmarket[1].txt
       C:\Documents and Settings\Justin2\Cookies\justin2@specificclick[2].txt
       C:\Documents and Settings\Justin2\Cookies\justin2@statcounter[1].txt
       C:\Documents and Settings\Justin2\Cookies\justin2@trafficengine[1].txt
       C:\Documents and Settings\Justin2\Cookies\justin2@ventivmedia[1].txt
       C:\Documents and Settings\Justin2\Cookies\justin2@visitracker[1].txt
       C:\Documents and Settings\Justin2\Cookies\justin2@xiti[1].txt
       C:\Documents and Settings\Justin2\Cookies\justin2@yadro[2].txt
       C:\Documents and Settings\Justin2\Cookies\justin2@zedo[2].txt

    Here is the Malwarebytes' log:
    Malwarebytes' Anti-Malware 1.46
    www.malwarebytes.org

    Database version: 5109

    Windows 5.1.2600 Service Pack 3
    Internet Explorer 7.0.5730.11

    11/13/2010 2:49:17 PM
    mbam-log-2010-11-13 (14-49-17).txt

    Scan type: Quick scan
    Objects scanned: 238126
    Time elapsed: 15 minute(s), 30 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 2
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 0

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    (No malicious items detected)

    Registry Values Infected:
    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\elpkotdk (Trojan.FakeAlert.Gen) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls\appsecdll (Trojan.Agent) -> Quarantined and deleted successfully.

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    (No malicious items detected)

    And, here is the HijackThis Log:

    Logfile of Trend Micro HijackThis v2.0.4
    Scan saved at 3:19:49 PM, on 11/13/2010
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.17091)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\WINDOWS\eHome\ehRecvr.exe
    C:\WINDOWS\eHome\ehSched.exe
    C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
    C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\Program Files\GhostSurf Platinum\ProtectorSvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\HighCriteria\TotalRecorder\TotRecSched.exe
    C:\WINDOWS\system32\MsPMSPSv.exe
    C:\WINDOWS\sm56hlpr.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\WINDOWS\system32\igfxpers.exe
    C:\HP\KBD\KBD.EXE
    C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
    C:\WINDOWS\system32\hkcmd.exe
    C:\WINDOWS\ehome\ehtray.exe
    C:\Program Files\eFax Messenger 4.2\J2GDllCmd.exe
    C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\Program Files\Canon\MyPrinter\BJMyPrt.exe
    C:\WINDOWS\system32\dllhost.exe
    C:\Program Files\Canon\Solution Menu EX\CNSEMAIN.EXE
    C:\WINDOWS\eHome\ehmsas.exe
    C:\PROGRA~1\Comcast\COMCAS~1\data\Xtras\mssysmgr.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
    C:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.exe
    C:\Program Files\CheckPoint\ZAForceField\ForceField.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\WINDOWS\ALCMTR.EXE
    C:\WINDOWS\ALCWZRD.EXE
    c:\windows\system\hpsysdrv.exe
    C:\WINDOWS\system32\igfxsrvc.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Trend Micro\sniper.exe\HiJackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q405&bd=pavilion&pf=desktop&parm1=seconduser
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.masslive.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q405&bd=pavilion&pf=desktop&parm1=seconduser
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    O2 - BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 8\SnagItBHO.dll
    O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll
    O2 - BHO: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexbho.dll
    O2 - BHO: ZoneAlarm Toolbar Registrar - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 8\SnagItIEAddin.dll
    O3 - Toolbar: ZoneAlarm Toolbar - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll
    O3 - Toolbar: Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll
    O4 - HKLM\..\Run: [TotalRecorderScheduler] "C:\Program Files\HighCriteria\TotalRecorder\TotRecSched.exe"
    O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
    O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
    O4 - HKLM\..\Run: [HPHUPD08] "c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe"
    O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
    O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPwuSchd2.exe"
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
    O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
    O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
    O4 - HKLM\..\Run: [eFax 4.2] "C:\Program Files\eFax Messenger 4.2\J2GDllCmd.exe" /R
    O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O4 - HKLM\..\Run: [GhostSurf Reminder] "C:\Program Files\GhostSurf Platinum\Privacy Control Center.exe" reminder
    O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
    O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
    O4 - HKLM\..\Run: [CanonSolutionMenuEx] C:\Program Files\Canon\Solution Menu EX\CNSEMAIN.EXE /logon
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
    O4 - HKCU\..\Run: [PhotoShow Deluxe Media Manager] C:\PROGRA~1\Comcast\COMCAS~1\data\Xtras\mssysmgr.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - Global Startup: GoBack.lnk = C:\Program Files\Roxio\GoBack\GBTray.exe
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O4 - Global Startup: Updates from HP.lnk = C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
    O9 - Extra button: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
    O9 - Extra 'Tools' menuitem: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O12 - Plugin for .htm: C:\Program Files\Netscape\Netscape Browser\PLUGINS\npTrident.dll
    O16 - DPF: {01012101-5E80-11D8-9E86-0007E96C65AE} (SupportSoft Script Runner Class) - http://www.comcastsupport.com/sdcxuser/asp/tgctlsr.cab
    O16 - DPF: {01118F00-3E00-11D2-8470-0060089874ED} (SupportSoft RemoteControl Class) - http://www.comcastsupport.com/sdccommon/download/ssrc.cab
    O16 - DPF: {01119400-3E00-11D2-8470-0060089874ED} (SupportSoft Listener Control) - http://www.comcastsupport.com/sdccommon/download/sprtctlln.cab
    O16 - DPF: {1663ed61-23eb-11d2-b92f-008048fdd814} (MeadCo ScriptX Advanced) - http://www.stonyfield.com/coupons/scriptX/smsx.cab
    O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1154979291375
    O16 - DPF: {6FE79ACA-A498-45E5-8BC4-1B9F380CE468} (Abx(gh) Control) - http://www.gamehouse.com/games/abxgh.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
    O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O16 - DPF: {D7208880-9B7A-43E1-AABB-8C888A5704F9} (NetCamPlayerWeb11gv2 Control) - http://192.168.1.115/NetCamPlayerWeb11gv2.cab
    O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} (get_atlcom Class) - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
    O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,2,0,5211/mcfscan.cab
    O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
    O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
    O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: Google Update Service (gupdate1c988bea66095e2) (gupdate1c988bea66095e2) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Canon Inkjet Printer/Scanner/Fax Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
    O23 - Service: ZoneAlarm ForceField IswSvc (IswSvc) - Check Point Software Technologies - C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: Protector - Tenebril Inc. - C:\Program Files\GhostSurf Platinum\ProtectorSvc.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

    --
    End of file - 12148 bytes

    Any help will be greatly appreciated. :)
    Logged

    Sneakyone

    • Malware Removal Specialist


      • Beginner

      Thanked: 5
      Re: Virus Causing Strange Behavior
      « Reply #1 on: November 13, 2010, 07:47:00 PM »
      Hi,

      Welcome to ComputerHope!

      Please download OTL  to your Desktop. (If you already have it downloaded, then just follow the instructions below).
      • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
      • Under the Custom Scan box paste this in
      %systemroot%\*. /mp /s
      %systemroot%\system32\*.dll /lockedfiles
      %systemroot%\system32\*.exe /lockedfiles
      %systemroot%\Tasks\*.job /lockedfiles
      %systemroot%\system32\drivers\*.sys /lockedfiles
      %systemroot%\System32\config\*.sav
      %systemroot%\system32\*.sys
      %systemroot%\system32\drivers\*.dll
      %systemroot%\system32\drivers\*.ini
      %systemroot%\system32\drivers\*.exe
      %SYSTEMDRIVE%\*.*
      %PROGRAMFILES%\*.
      %appdata%\*.*
      netsvcs
      msconfig
      safebootminimal
      safebootnetwork
      activex
      drivers32
      /md5start
      eventlog.dll
      scecli.dll
      netlogon.dll
      cngaudit.dll
      sceclt.dll
      ntelogon.dll
      logevent.dll
      iaStor.sys
      nvstor.sys
      atapi.sys
      IdeChnDr.sys
      viasraid.sys
      AGP440.sys
      vaxscsi.sys
      nvatabus.sys
      viamraid.sys
      nvata.sys
      nvgts.sys
      iastorv.sys
      ViPrt.sys
      eNetHook.dll
      ahcix86.sys
      KR10N.sys
      disk.sys
      nvstor32.sys
      ahcix86s.sys
      nvrd32.sys
      symmpi.sys
      adp3132.sys
      mv61xx.sys
      usbstor.sys
      /md5stop
      CREATERESTOREPOINT
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs

      • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
        • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
        • Please copy (Edit->Select All, Edit->Copy) and paste (Edit->Paste) the contents of these files, one at a time
      Note: in the event that OTL fails to run, please use alternate download links to try again:

      http://oldtimer.geekstogo.com/OTL.com
      http://oldtimer.geekstogo.com/OTL.scr
      Logged

      rstoddard

        Topic Starter


        Beginner

        Re: Virus Causing Strange Behavior
        « Reply #2 on: November 14, 2010, 08:09:21 PM »
        Hello. Thank you for replying to my post.

        Here is one of the logs:

        OTL logfile created on: 11/14/2010 9:20:27 PM - Run 1
        OTL by OldTimer - Version 3.2.17.3     Folder = C:\Documents and Settings\HP_Administrator\Desktop
        Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
        Internet Explorer (Version = 7.0.5730.11)
        Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
         
        1,015.00 Mb Total Physical Memory | 411.00 Mb Available Physical Memory | 40.00% Memory free
        2.00 Gb Paging File | 2.00 Gb Available in Paging File | 76.00% Paging File free
        Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]
         
        %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
        Drive C: | 178.30 Gb Total Space | 48.59 Gb Free Space | 27.25% Space Free | Partition Type: NTFS
        Drive D: | 8.00 Gb Total Space | 1.26 Gb Free Space | 15.69% Space Free | Partition Type: FAT32
         
        Computer Name: HUEY | User Name: HP_Administrator | Logged in as Administrator.
        Boot Mode: Normal | Scan Mode: Current user
        Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
         
        ========== Processes (SafeList) ==========
         
        PRC - [2010/11/14 21:18:50 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\HP_Administrator\Desktop\OTL.exe
        PRC - [2010/07/20 20:24:38 | 002,434,568 | ---- | M] (Check Point Software Technologies LTD) -- C:\WINDOWS\system32\ZoneLabs\vsmon.exe
        PRC - [2010/07/20 20:22:56 | 001,038,848 | ---- | M] (Check Point Software Technologies LTD) -- C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
        PRC - [2010/06/15 06:09:48 | 000,493,032 | ---- | M] (Check Point Software Technologies) -- C:\Program Files\CheckPoint\ZAForceField\ISWSVC.exe
        PRC - [2010/06/15 06:09:44 | 000,730,600 | ---- | M] (Check Point Software Technologies) -- C:\Program Files\CheckPoint\ZAForceField\ForceField.exe
        PRC - [2010/04/05 14:55:01 | 000,116,104 | ---- | M] () -- C:\Program Files\Canon\IJPLM\ijplmsvc.exe
        PRC - [2010/04/02 09:18:54 | 001,185,112 | ---- | M] (CANON INC.) -- C:\Program Files\Canon\Solution Menu EX\CNSEMAIN.EXE
        PRC - [2010/03/24 20:50:00 | 002,516,296 | ---- | M] (CANON INC.) -- C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
        PRC - [2009/09/10 21:53:28 | 000,198,160 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Common Files\Real\Update_OB\realsched.exe
        PRC - [2009/09/10 10:15:42 | 000,870,672 | ---- | M] (SonicWALL, Inc.) -- C:\Program Files\Zone Labs\ZoneAlarm\MailFrontier\mantispm.exe
        PRC - [2008/07/11 06:52:18 | 003,020,608 | ---- | M] (Tenebril Inc.) -- C:\Program Files\GhostSurf Platinum\ProtectorSvc.exe
        PRC - [2008/04/13 19:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
        PRC - [2007/03/09 11:09:58 | 000,063,712 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
        PRC - [2006/07/14 15:36:57 | 000,107,008 | ---- | M] (j2 Global Communications, Inc.) -- C:\Program Files\eFax Messenger 4.2\J2GDllCmd.exe
        PRC - [2006/05/15 17:24:33 | 000,100,032 | ---- | M] (Symantec Corporation) -- C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
        PRC - [2005/10/13 07:47:22 | 000,081,920 | ---- | M] (High Criteria inc.) -- C:\Program Files\HighCriteria\TotalRecorder\TotRecSched.exe
        PRC - [2005/05/09 18:16:15 | 000,192,512 | ---- | M] (Simple Star, Inc.) -- C:\Program Files\Comcast\Comcast PhotoShow 4\data\Xtras\mssysmgr.exe
        PRC - [2005/05/04 12:01:36 | 002,805,248 | ---- | M] (RealTek Semicoductor Corp.) -- C:\WINDOWS\ALCWZRD.EXE
        PRC - [2005/05/03 20:43:50 | 000,090,112 | ---- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\SOUNDMAN.EXE
        PRC - [2005/05/03 20:43:28 | 000,069,632 | ---- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\ALCMTR.EXE
        PRC - [2005/01/24 04:56:00 | 000,544,768 | ---- | M] (Motorola Inc.) -- C:\WINDOWS\sm56hlpr.exe
         
         
        ========== Modules (SafeList) ==========
         
        MOD - [2010/11/14 21:18:50 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\HP_Administrator\Desktop\OTL.exe
        MOD - [2010/08/23 11:12:02 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll
        MOD - [2010/06/15 06:09:52 | 000,640,488 | ---- | M] (Check Point Software Technologies) -- C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
        MOD - [2010/06/15 06:09:44 | 000,562,664 | ---- | M] (Check Point Software Technologies) -- C:\Program Files\CheckPoint\ZAForceField\AK\icsak.dll
        MOD - [2009/09/10 10:15:48 | 000,013,072 | ---- | M] () -- C:\Program Files\Zone Labs\ZoneAlarm\MailFrontier\MlfHook.dll
        MOD - [2008/07/25 10:17:20 | 000,635,904 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\msvcr80.dll
        MOD - [2008/07/25 10:17:20 | 000,558,080 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\msvcp80.dll
         
         
        ========== Win32 Services (SafeList) ==========
         
        SRV - File not found [Disabled | Stopped] -- C:\WINDOWS\System32\hidserv.dll -- (HidServ)
        SRV - [2010/07/20 20:24:38 | 002,434,568 | ---- | M] (Check Point Software Technologies LTD) [Auto | Running] -- C:\WINDOWS\System32\ZoneLabs\vsmon.exe -- (vsmon)
        SRV - [2010/06/15 06:09:48 | 000,493,032 | ---- | M] (Check Point Software Technologies) [Auto | Running] -- C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe -- (IswSvc)
        SRV - [2010/04/05 14:55:01 | 000,116,104 | ---- | M] () [Auto | Running] -- C:\Program Files\Canon\IJPLM\ijplmsvc.exe -- (IJPLMSVC)
        SRV - [2010/03/29 07:51:54 | 000,068,000 | ---- | M] (NOS Microsystems Ltd.) [On_Demand | Stopped] -- C:\Program Files\NOS\bin\getPlus_Helper.dll -- (getPlusHelper) getPlus(R)
        SRV - [2008/07/11 06:52:18 | 003,020,608 | ---- | M] (Tenebril Inc.) [Auto | Running] -- C:\Program Files\GhostSurf Platinum\ProtectorSvc.exe -- (Protector)
        SRV - [2006/05/15 17:24:33 | 002,086,592 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Program Files\Symantec\LiveUpdate\LuComServer_3_0.EXE -- (LiveUpdate)
        SRV - [2006/05/15 17:24:33 | 000,100,032 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe -- (Automatic LiveUpdate Scheduler)
        SRV - [2006/03/02 20:49:14 | 000,069,632 | ---- | M] (HP) [Unknown | Stopped] -- C:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12)
        SRV - [2005/04/05 11:17:22 | 000,206,552 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- c:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe -- (SNDSrvc)
         
         
        ========== Driver Services (SafeList) ==========
         
        DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\PavSRK.sys -- (PavSRK.sys)
        DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\nuvvid2.sys -- (nuvvid2)
        DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\nuvaud2.sys -- (nuvaud2)
        DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\COMFiltr.sys -- (ComFiltr)
        DRV - [2010/11/12 23:12:19 | 000,067,656 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)
        DRV - [2010/06/15 06:09:40 | 000,035,568 | ---- | M] (Check Point Software Technologies) [Kernel | On_Demand | Running] -- C:\Program Files\CheckPoint\ZAForceField\AK\icsak.sys -- (icsak)
        DRV - [2010/06/15 06:09:40 | 000,026,352 | ---- | M] (Check Point Software Technologies) [Kernel | Auto | Running] -- C:\Program Files\CheckPoint\ZAForceField\ISWKL.sys -- (ISWKL)
        DRV - [2010/06/09 18:16:12 | 000,528,128 | ---- | M] (Check Point Software Technologies LTD) [Kernel | System | Running] -- C:\WINDOWS\system32\vsdatant.sys -- (vsdatant)
        DRV - [2010/03/19 21:49:49 | 000,012,872 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS -- (SASDIFSV)
        DRV - [2010/03/19 21:49:49 | 000,012,872 | ---- | M] ( SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | On_Demand | Stopped] -- C:\Program Files\SUPERAntiSpyware\SASENUM.SYS -- (SASENUM)
        DRV - [2009/10/22 12:54:18 | 000,037,392 | ---- | M] (Kaspersky Lab) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\54633942.sys -- (54633942)
        DRV - [2009/10/12 17:15:30 | 000,317,072 | ---- | M] (Kaspersky Lab) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\klif.sys -- (TSP)
        DRV - [2009/10/12 17:15:30 | 000,317,072 | ---- | M] (Kaspersky Lab) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\klif.sys -- (KLIF)
        DRV - [2009/10/12 17:15:26 | 000,128,016 | ---- | M] (Kaspersky Lab) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\kl1.sys -- (kl1)
        DRV - [2009/09/25 16:59:42 | 000,128,016 | ---- | M] (Kaspersky Lab) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\54633941.sys -- (54633941)
        DRV - [2009/06/30 08:37:16 | 000,028,552 | ---- | M] (Panda Security, S.L.) [File_System | Boot | Running] -- C:\WINDOWS\system32\drivers\pavboot.sys -- (pavboot)
        DRV - [2008/04/13 13:45:12 | 000,060,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\USBAUDIO.sys -- (usbaudio) USB Audio Driver (WDM)
        DRV - [2008/04/13 11:36:05 | 000,144,384 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus)
        DRV - [2007/08/19 00:14:13 | 000,008,413 | ---- | M] (RealNetworks, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\System32\drivers\mcstrm.sys -- (MCSTRM)
        DRV - [2007/06/20 02:00:00 | 000,009,200 | ---- | M] (Sonic Solutions) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\cdralw2k.sys -- (Cdralw2k)
        DRV - [2007/06/20 02:00:00 | 000,009,072 | ---- | M] (Sonic Solutions) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\cdr4_xp.sys -- (Cdr4_xp)
        DRV - [2006/01/03 15:31:44 | 000,117,408 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\Symantec\SYMEVENT.SYS -- (SymEvent)
        DRV - [2005/12/12 16:27:00 | 000,019,072 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\PS2.sys -- (Ps2)
        DRV - [2005/06/08 18:22:20 | 003,160,576 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
        DRV - [2005/04/14 23:12:12 | 000,175,616 | ---- | M] (Promise Technology, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\ftsata2.sys -- (ftsata2)
        DRV - [2005/04/05 11:17:02 | 000,267,192 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\SYMTDI.SYS -- (SYMTDI)
        DRV - [2005/04/05 11:17:00 | 000,017,976 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\Drivers\SYMREDRV.SYS -- (SYMREDRV)
        DRV - [2005/04/05 11:16:58 | 000,036,984 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\Drivers\SYMIDS.SYS -- (SYMIDS)
        DRV - [2005/04/05 11:16:56 | 000,047,192 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\Drivers\SYMNDIS.SYS -- (SYMNDIS)
        DRV - [2005/04/05 11:16:54 | 000,173,208 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\Drivers\SYMFW.SYS -- (SYMFW)
        DRV - [2005/04/05 11:16:52 | 000,011,512 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\Drivers\SYMDNS.SYS -- (SYMDNS)
        DRV - [2005/03/10 16:23:17 | 000,009,856 | ---- | M] (Padus, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\pfc.sys -- (pfc)
        DRV - [2005/03/09 20:09:18 | 000,870,912 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\iaStor.sys -- (iaStor)
        DRV - [2005/03/04 13:10:26 | 000,074,496 | ---- | M] (Realtek Semiconductor Corporation                           ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtlnicxp.sys -- (RTL8023xp)
        DRV - [2005/01/25 08:56:00 | 000,923,863 | ---- | M] (Motorola Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\smserial.sys -- (smserial)
        DRV - [2005/01/08 02:07:16 | 000,145,920 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Hdaudio.sys -- (HdAudAddService)
        DRV - [2004/08/04 07:41:36 | 000,606,684 | ---- | M] (LT) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ltmdmnt.sys -- (ltmodem5)
        DRV - [2004/08/04 07:31:34 | 000,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\RTL8139.sys -- (rtl8139) Realtek RTL8139(A/B/C)
        DRV - [2003/11/05 17:45:12 | 000,017,408 | ---- | M] (Promise Technology, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\bb-run.sys -- (bb-run)
        DRV - [2003/05/22 00:20:36 | 000,259,072 | ---- | M] (Roxio) [File_System | System | Running] -- C:\WINDOWS\System32\drivers\Cdudf_xp.sys -- (cdudf_xp)
        DRV - [2003/05/22 00:20:36 | 000,213,120 | ---- | M] (Roxio) [File_System | System | Running] -- C:\WINDOWS\System32\drivers\UdfReadr_xp.sys -- (UdfReadr_xp)
        DRV - [2003/05/22 00:20:36 | 000,146,560 | ---- | M] (Roxio) [File_System | System | Running] -- C:\WINDOWS\System32\drivers\DVDVRRdr_xp.sys -- (DVDVRRdr_xp)
        DRV - [2003/05/22 00:20:36 | 000,118,409 | ---- | M] (Roxio) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\pwd_2K.sys -- (pwd_2k)
        DRV - [2003/05/22 00:20:36 | 000,022,713 | ---- | M] (Roxio) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\Mmc_2k.sys -- (mmc_2K)
        DRV - [2003/05/22 00:20:36 | 000,021,737 | ---- | M] (Roxio) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\Dvd_2k.sys -- (dvd_2K)
         
         
        ========== Standard Registry (SafeList) ==========
         
         
        ========== Internet Explorer ==========
         
        IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
         
        IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q405&bd=pavilion&pf=desktop&parm1=seconduser
        IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.masslive.com/
        IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
        IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
        IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = <local>
         
        ========== FireFox ==========
         
        FF - prefs.js..browser.startup.homepage: "http://www.comcast.net/|http://www.google.com/firefox?client=firefox-a&rls=org.mozilla:en-US:official"
        FF - prefs.js..extensions.enabledItems: {FFB96CC1-7EB3-449D-B827-DB661701C6BB}:1.5.152.10
        FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
        FF - prefs.js..network.proxy.http: "127.0.0.1"
        FF - prefs.js..network.proxy.http_port: 7212
        FF - prefs.js..network.proxy.type: 0
         
         
        FF - HKLM\software\mozilla\Firefox\Extensions\\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}: C:\Program Files\CheckPoint\ZAForceField\TrustChecker [2010/11/13 02:28:20 | 000,000,000 | ---D | M]
        FF - HKLM\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/11/07 20:14:39 | 000,000,000 | ---D | M]
        FF - HKLM\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/11/13 14:56:45 | 000,000,000 | ---D | M]
        FF - HKLM\software\mozilla\Netscape Browser 8.1.2.0\Extensions\\Components: C:\Program Files\Netscape\Netscape Browser\Components [2010/11/01 11:19:20 | 000,000,000 | ---D | M]
        FF - HKLM\software\mozilla\Netscape Browser 8.1.2.0\Extensions\\Plugins: C:\Program Files\Netscape\Netscape Browser\Plugins [2010/10/25 16:28:48 | 000,000,000 | ---D | M]
         
        [2009/10/17 22:44:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Extensions
        [2009/10/17 22:44:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Extensions\[email protected]
        [2010/11/14 06:41:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\2kb2uh0s.default\extensions
        [2008/12/21 06:25:28 | 000,000,000 | ---D | M] (Coupon Manager) -- C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\2kb2uh0s.default\extensions\{0C7E3F01-99E9-4095-9BDC-F84724960B57}
        [2010/06/23 21:57:37 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\2kb2uh0s.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
        [2010/06/23 21:57:35 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\2kb2uh0s.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}
        [2010/07/25 21:33:18 | 000,000,000 | ---D | M] (Adobe DLM (powered by getPlus(R))) -- C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\2kb2uh0s.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
        [2010/11/11 13:34:51 | 000,001,218 | ---- | M] () -- C:\Documents and Settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\2kb2uh0s.default\searchplugins\comcast.xml
        [2010/11/14 06:41:14 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
        [2010/11/13 14:56:49 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
        [2010/04/01 18:26:44 | 000,393,216 | ---- | M] (Invenda Corporation) -- C:\Program Files\Mozilla Firefox\plugins\NPcol400.dll
        [2009/11/19 16:16:28 | 000,091,552 | ---- | M] (Coupons, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npCouponPrinter.dll
        [2010/09/15 04:50:38 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
        [2009/11/19 16:16:29 | 000,091,552 | ---- | M] (Coupons, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npMozCouponPrinter.dll
         
        O1 HOSTS File: ([2010/02/07 16:42:52 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
        O1 - Hosts: 127.0.0.1       localhost
        O2 - BHO: (SnagIt Toolbar Loader) - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 8\SnagItBHO.dll (TechSmith Corporation)
        O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - c:\Program Files\Real\realplayer\rpbrowserrecordplugin.dll (RealPlayer)
        O2 - BHO: (Canon Easy-WebPrint EX BHO) - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
        O2 - BHO: (ZoneAlarm Toolbar Registrar) - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
        O3 - HKLM\..\Toolbar: (Canon Easy-WebPrint EX) - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
        O3 - HKLM\..\Toolbar: (SnagIt) - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 8\SnagItIEAddin.dll (TechSmith Corporation)
        O3 - HKLM\..\Toolbar: (ZoneAlarm Toolbar) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
        O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
        O3 - HKCU\..\Toolbar\WebBrowser: (Canon Easy-WebPrint EX) - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
        O3 - HKCU\..\Toolbar\WebBrowser: (ZoneAlarm Toolbar) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
        O4 - HKLM..\Run: [Adobe Photo Downloader] C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe (Adobe Systems Incorporated)
        O4 - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
        O4 - HKLM..\Run: [CanonSolutionMenuEx] C:\Program Files\Canon\Solution Menu EX\CNSEMAIN.EXE (CANON INC.)
        O4 - HKLM..\Run: [eFax 4.2] C:\Program Files\eFax Messenger 4.2\J2GDllCmd.exe (j2 Global Communications, Inc.)
        O4 - HKLM..\Run: [GhostSurf Reminder] C:\Program Files\GhostSurf Platinum\Privacy Control Center.exe (Tenebril Inc.)
        O4 - HKLM..\Run: [High Definition Audio Property Page Shortcut] C:\WINDOWS\System32\HdAShCut.exe (Windows (R) Server 2003 DDK provider)
        O4 - HKLM..\Run: [HPBootOp] C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe (Hewlett-Packard Company)
        O4 - HKLM..\Run: [HPHUPD08] c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe (Hewlett-Packard)
        O4 - HKLM..\Run: [KernelFaultCheck]  File not found
        O4 - HKLM..\Run: [SMSERIAL] C:\WINDOWS\sm56hlpr.exe (Motorola Inc.)
        O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
        O4 - HKLM..\Run: [TotalRecorderScheduler] C:\Program Files\HighCriteria\TotalRecorder\TotRecSched.exe (High Criteria inc.)
        O4 - HKLM..\Run: [ZoneAlarm Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe (Check Point Software Technologies LTD)
        O4 - HKCU..\Run: [PhotoShow Deluxe Media Manager] C:\Program Files\Comcast\Comcast PhotoShow 4\data\Xtras\mssysmgr.exe (Simple Star, Inc.)
        O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\GoBack.lnk = C:\Program Files\Roxio\GoBack\GBTray.exe (Roxio, Inc.)
        O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Updates from HP.lnk = C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe (Hewlett-Packard)
        O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
        O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
        O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
        O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
        O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
        O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft)
        O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme ()
        O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
        O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
        O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
        O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
        O9 - Extra Button: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm ()
        O9 - Extra 'Tools' menuitem : Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm ()
        O12 - Plugin for: .htm - C:\Program Files\Netscape\Netscape Browser\plugins\npTrident.dll (Netscape Communications Corp.)
        O16 - DPF: {01012101-5E80-11D8-9E86-0007E96C65AE} http://www.comcastsupport.com/sdcxuser/asp/tgctlsr.cab (SupportSoft Script Runner Class)
        O16 - DPF: {01118F00-3E00-11D2-8470-0060089874ED} http://www.comcastsupport.com/sdccommon/download/ssrc.cab (SupportSoft RemoteControl Class)
        O16 - DPF: {01119400-3E00-11D2-8470-0060089874ED} http://www.comcastsupport.com/sdccommon/download/sprtctlln.cab (SupportSoft Listener Control)
        O16 - DPF: {1663ed61-23eb-11d2-b92f-008048fdd814} http://www.stonyfield.com/coupons/scriptX/smsx.cab (MeadCo ScriptX)
        O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
        O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB (Reg Error: Key error.)
        O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} http://download.bitdefender.com/resources/scan8/oscan8.cab (BDSCANONLINE Control)
        O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1154979291375 (WUWebControl Class)
        O16 - DPF: {6FE79ACA-A498-45E5-8BC4-1B9F380CE468} http://www.gamehouse.com/games/abxgh.cab (Abx(gh) Control)
        O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
        O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} http://acs.pandasoftware.com/activescan/as5free/asinst.cab (ActiveScan Installer Class)
        O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
        O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
        O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} http://www.adobe.com/products/acrobat/nos/gp.cab (get_atlcom Class)
        O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
        O16 - DPF: {D7208880-9B7A-43E1-AABB-8C888A5704F9} http://192.168.1.115/NetCamPlayerWeb11gv2.cab (NetCamPlayerWeb11gv2 Control)
        O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (get_atlcom Class)
        O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} http://download.mcafee.com/molbin/iss-loc/mcfscan/2,2,0,5211/mcfscan.cab (McFreeScan Class)
        O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.15.1
        O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
        O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com)
        O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)
        O24 - Desktop WallPaper: C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
        O24 - Desktop BackupWallPaper: C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
        O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
        O32 - HKLM CDRom: AutoRun - 1
        O32 - AutoRun File - [2006/08/07 14:20:38 | 000,000,100 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
        O32 - AutoRun File - [2001/07/28 05:07:38 | 000,000,000 | -HS- | M] () - D:\AUTOEXEC.BAT -- [ FAT32 ]
        O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\WINDOWS\system32\pavipc.dll) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\WINDOWS\system32\SYSTOOLS.DLL) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\WINDOWS\system32\PavSHook.dll) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\WINDOWS\system32\drivers\pavdrv51.sys) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\WINDOWS\system32\drivers\netflt.sys) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\WINDOWS\system32\drivers\Teefer.sys) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\WINDOWS\system32\drivers\WG3N.sys) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\WINDOWS\system32\drivers\wpsdrvnt.sys) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\WINDOWS\system32\drivers\pcontNT.sys) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\WINDOWS\system32\drivers\netids.dll) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\WINDOWS\system32\drivers\CPoint.sys) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\WINDOWS\system32\FwsVpn.dll) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\WINDOWS\system32\TpUtil.dll) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\actualiz.avi) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\ADiagnst.dll) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\ADiagnst.ini) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\ADialer.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\ANALISIS.AVI) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\ApVxdWin.exe) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\ASMDAT.DLL) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Avcic.dll) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Avciman.exe) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\AVCIMAN.INI) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\AVENGDLL.DLL) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\AVENGINE.EXE) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\AVLITE.EXE) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\AvLite.ini) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\AVLITE.MLD) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\AVLtMain.exe) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\AVLTMAIN.MLD) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\AVTASK.EXE) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\BOOTDISK.IMG) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\BOProt.XML) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\borlndmm.dll) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\cc3250mt.dll) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\CHMCCFG.DLL) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\ComFltNt.dll) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\COMPRESS.AVI) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\CONEXION.AVI) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Countlst.cl) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\cpdll.dll) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Dealers.txt) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\ENVIO.AVI) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\EstadUpd.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\FindAppl.dll) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\FwAct.exe) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\FWACT.MLD) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\FWRLS.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\global.msg) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\ICL_CFG.DLL) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\ICL_MTR.DLL) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\icl_trf.dll) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\icons.dll) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\idiomas.dll) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\ImRepAle.Dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\ImRepAle.dll) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\InstKRE.ini) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Instlsp.dll) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\KRE.XML) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\KreCfgXM.dll) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\LangM5.dll) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\LIBXML2.DLL) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Licen_en.txt) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\LITEUPG.EXE) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\LTForms.dll) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\LTFORMS.MLD) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\LUpgConf.exe) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\msje8tp.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\NetVirus.xml) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\OSMerger.dll) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\OSshield.sig) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\panda.chp) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\pav.sig) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PAV2WSC.DLL) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavAMW.dll) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PAVCOMDL.DLL) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PAVCPROX.DLL) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PAVCRC.DLL) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PAVDLL.DLL) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\pavdr.exe) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Pavdrv.inf) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PAVEXCOM.DLL) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavFn.Dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavFnSvr.exe) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavFtp.dll) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\pavim.dll) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Pavkre.exe) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\pavlsp.dll) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavMiCli.dll) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavNntp.dll) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PAVOE.DLL) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavPop3.dll) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavProt.bin) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PAVPROT.EXE) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PAvScr.dll) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PAVSCRIP.EXE) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavSInet.dll) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavSMAPI.dll) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PAVSMCL.DLL) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavSmtp.dll) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PAVSRV51.EXE) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\pavtcmgr.dll) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Pavtftp.dll) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavTrc.dll) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavWeb.dll) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavWmail.dll) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PFDNNT.exe) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PFILE32.DLL) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PFSF.DLL) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\platc.dll) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\plats.dll) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PNDCTRLA.BPL) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Port16.dll) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Pprocs32.dll) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\prcvfile.dll) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PREG32.DLL) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\prevapi.dll) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\prevent.sig) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\prevsrv.exe) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\ProtExc.dll) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PROTINST.DLL) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PROXY.AVI) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PSAEng.Cfg) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PSAEng.dll) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PSAUI.dll) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PSAUI.mld) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PSCookie.dll) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PServ32.dll) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PsImSvc.exe) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PSInet.dll) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\pskalloc.dll) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\pskcmp.dll) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PSKHTML.dll) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\pskmcf.dll) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\pskmfs.dll) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\pskpack.dll) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PSKUTIL.dll) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\pskvfile.dll) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\pskvm.dll) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PSREPORT.DLL) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PSSCAN.DLL) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PSSYSCHK.DLL) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PsSysChk.xml) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\psVers.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PUtil32.dll) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PVer32.dll) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Qrv.krn) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\RECONSF.AVI) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\REPORTEX.DLL) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\RESHOME.DLL) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\RESLITE.DLL) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\RSDNAPI.DLL) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\RsReport.rpt) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\SAFED.DLL) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\SAFEDISK.EXE) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\SAFEDISK.MLD) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Scans.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\SDISK2.IMG) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\sentinel.cfg) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\sentrsc.dll) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\SHELLTIT.DLL) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\sporder.dll) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\sporder.exe) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\TCPVFILE.DLL) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Titanium.ini) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\TITCFG.DLL) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\TITSCAN.DLL) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\TITSCAN.MLD) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\titw.cfg) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\titwBK.cfg) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\TPConf.dll) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\UNINSTAL.DLL) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\UNINSTAL.INI) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\UPGTEST.EXE) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\USER.SVM) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\vcl50.bpl) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\vclx50.bpl) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\VerMan.dll) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\VERSION.TXT) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\WebExcl.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\WebProxy.exe) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\WebProxy.ini) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Welcome.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\WHISTLER.BPL) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\WizSOS.exe) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\WizSOS.mld) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\ZIUpdate.dll) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\ZIUPDATE.MLD) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\1001391694_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\10534247_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\1075359258_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\1081831864_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\1092434795_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\1122733537_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\1142642340_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\12224515_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\1245951201_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\1255514902_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\1286071020_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\1320380616_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\1346925813_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\1383231217_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\1544848317_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\1546243071_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\1572751645_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\1591461059_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\1644049401_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\167085580_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\1696950439_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\1817728914_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\1857665065_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\199630472_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\2054976669_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\2055572116_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\2283588243_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\2339528948_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\2341638980_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\2370437243_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\2470058123_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\252873349_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\2583033358_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\2638515956_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\267395131_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\2680449910_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\2739826237_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\2857187394_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\2941376458_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\2964147355_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\2982603958_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\2995471241_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\3014950654_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\3034094165_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\3042771132_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\3059352053_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\3077990757_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\3108173420_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\313800771_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\3152270391_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\3178084929_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\327639004_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\329594726_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\3412478009_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\3423676558_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\3447267006_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\3461387815_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\3489828055_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\3521209013_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\3528273804_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\3620835075_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\3638164187_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\3672456591_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\3765515499_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\3771744941_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\3772934217_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\3789642307_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\3831942230_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\3876198036_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\3932924787_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\397992096_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\4002827702_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\4013580911_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\4114096332_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\4229733669_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\4289512042_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\520436482_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\564275508_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Data\593188467_group.dat) -  File not found
        O34 - HKLM BootExecute: (PFDNNT C:\Program Files\Panda Software
        Logged

        Sneakyone

        • Malware Removal Specialist


          • Beginner

          Thanked: 5
          Re: Virus Causing Strange Behavior
          « Reply #3 on: November 15, 2010, 10:48:19 AM »
          Hi,

          Please download ComboFix from BleepingComputer.com

          Alternate link: GeeksToGo.com

          Alternate link: Forospyware.com

          Rename ComboFix.exe to commy.exe before you save it to your Desktop
          • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools A guide to do this can be found here
          • Click Start>Run then copy paste the following command into the Run box & click OK "%userprofile%\desktop\commy.exe" /stepdel
          • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
          • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console

          Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

          Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:


          • Click on Yes, to continue scanning for malware.
          • When finished, it shall produce a log for you.  Please include the contents of C:\ComboFix.txt in your next reply.
          Logged

          rstoddard

            Topic Starter


            Beginner

            Re: Virus Causing Strange Behavior
            « Reply #4 on: November 16, 2010, 09:31:43 PM »
            I have a stupid question ???, but I want to make sure that I'm doing this correctly. I can't seem to change the name of the ComboFix file until after I have saved it.

            Is that o.k.?
            Logged

            Sneakyone

            • Malware Removal Specialist


              • Beginner

              Thanked: 5
              Re: Virus Causing Strange Behavior
              « Reply #5 on: November 17, 2010, 09:48:41 PM »
              Hi,

              Don't worry about re-naming it. Just double-click on it.
              Logged

              rstoddard

                Topic Starter


                Beginner

                Re: Virus Causing Strange Behavior
                « Reply #6 on: November 20, 2010, 12:37:30 PM »
                O.K., here is the log:

                ComboFix 10-11-20.01 - HP_Administrator 11/20/2010  13:44:07.5.1 - x86
                Microsoft Windows XP Professional  5.1.2600.3.1252.1.1033.18.1015.533 [GMT -5:00]
                Running from: c:\documents and settings\HP_Administrator\Desktop\commy.exe.exe
                FW: ZoneAlarm Extreme Security Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
                .

                (((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
                .

                c:\documents and settings\HP_Administrator\GoToAssistDownloadHelper.exe
                c:\windows\system32\BSTIEPrintCtl1.dll

                ----- File Replicators -----

                c:\hp\bin\commands.exe
                d:\i386\Apps\APP01362\commands.exe
                d:\i386\Apps\APP02573\commands.exe
                d:\i386\Apps\APP03228\commands.exe
                d:\i386\Apps\APP04320\commands.exe
                d:\i386\Apps\APP05000\commands.exe
                d:\i386\Apps\APP05730\commands.exe
                d:\i386\Apps\APP05936\commands.exe
                d:\i386\Apps\APP06453\commands.exe
                d:\i386\Apps\APP08722\commands.exe
                d:\i386\Apps\APP10740\commands.exe
                d:\i386\Apps\APP12065\commands.exe
                d:\i386\Apps\APP12850\commands.exe
                d:\i386\Apps\APP12933\commands.exe
                d:\i386\Apps\APP13596\commands.exe
                d:\i386\Apps\APP16183\commands.exe
                d:\i386\Apps\APP16341\commands.exe
                d:\i386\Apps\APP18957\commands.exe
                d:\i386\Apps\APP21920\commands.exe
                d:\i386\Apps\APP24582\commands.exe
                d:\i386\Apps\APP26202\commands.exe
                d:\i386\Apps\APP27318\commands.exe
                d:\i386\Apps\APP28296\commands.exe
                d:\i386\Apps\APP32431\commands.exe
                d:\i386\Drv\APP01428\commands.exe
                d:\i386\Drv\APP06913\commands.exe
                d:\i386\Drv\APP08040\commands.exe
                d:\i386\Drv\APP09305\commands.exe
                d:\i386\Drv\APP12999\commands.exe
                d:\i386\Drv\APP14426\commands.exe
                d:\i386\Drv\APP14855\commands.exe
                d:\i386\Drv\APP20140\commands.exe
                d:\i386\Drv\APP25465\commands.exe
                d:\i386\Drv\APP26688\commands.exe
                d:\i386\Drv\APP27477\commands.exe
                d:\i386\Drv\APP28738\commands.exe
                .
                Infected copy of c:\windows\system32\imm32.dll was found and disinfected
                Restored copy from - c:\windows\ERDNT\cache\imm32.dll

                .
                (((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
                .

                -------\Legacy_PROTECTOR
                -------\Service_Protector


                (((((((((((((((((((((((((   Files Created from 2010-10-20 to 2010-11-20  )))))))))))))))))))))))))))))))
                .

                2010-11-13 20:07 . 2010-11-13 20:07   388096   ----a-r-   c:\documents and settings\HP_Administrator\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
                2010-11-13 19:56 . 2010-09-15 09:50   472808   ----a-w-   c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
                2010-11-13 19:56 . 2010-09-15 09:50   472808   ----a-w-   c:\windows\system32\deployJava1.dll
                2010-10-31 22:29 . 2010-10-31 22:29   --------   d--h--w-   c:\documents and settings\All Users\Application Data\CanonIJSolutionMenuEX
                2010-10-31 22:28 . 2010-10-31 22:28   --------   d--h--w-   c:\documents and settings\All Users\Application Data\CanonIJEPPEX2
                2010-10-31 22:28 . 2010-10-31 22:28   --------   d--h--w-   c:\documents and settings\All Users\Application Data\CanonEPP
                2010-10-31 22:28 . 2010-10-31 22:28   --------   d--h--w-   c:\documents and settings\All Users\Application Data\CanonIJMyPrinter
                2010-10-31 22:27 . 2010-11-05 09:46   --------   d-----w-   c:\documents and settings\All Users\Application Data\CanonIJPLM
                2010-10-31 22:24 . 2010-03-18 23:25   307200   ----a-w-   c:\windows\system32\CNC5200L.dll
                2010-10-31 22:24 . 2010-03-18 21:12   1335296   ----a-w-   c:\windows\system32\CNC5200C.dll
                2010-10-31 22:24 . 2010-03-18 21:12   114688   ----a-w-   c:\windows\system32\CNC5200I.dll
                2010-10-31 22:24 . 2010-03-18 21:11   106496   ----a-w-   c:\windows\system32\CNC5200U.dll
                2010-10-31 22:24 . 2008-08-25 22:02   15872   ----a-w-   c:\windows\system32\CNHMCA.dll
                2010-10-31 22:22 . 2010-10-31 22:22   --------   d-----w-   c:\documents and settings\All Users\Application Data\CanonIJMSetup
                2010-10-31 22:22 . 2010-10-31 22:22   --------   d-----w-   c:\documents and settings\HP_Administrator\Application Data\Canon Easy-WebPrint EX
                2010-10-31 22:10 . 2010-10-31 22:10   --------   d-----w-   c:\program files\Common Files\CANON
                2010-10-31 22:10 . 2010-10-31 22:10   --------   d-----w-   c:\documents and settings\All Users\Application Data\CanonIJWSpt
                2010-10-31 22:05 . 2010-10-31 22:05   --------   d--h--w-   c:\documents and settings\All Users\Application Data\CanonBJ
                2010-10-31 22:04 . 2010-04-07 09:00   73216   ----a-w-   c:\windows\system32\Spool\prtprocs\w32x86\CNMPPAE.DLL
                2010-10-31 22:04 . 2010-04-07 09:00   290816   ----a-w-   c:\windows\system32\CNMLMAE.DLL
                2010-10-31 22:04 . 2010-04-07 09:00   27648   ----a-w-   c:\windows\system32\Spool\prtprocs\w32x86\CNMPDAE.DLL
                2010-10-31 22:04 . 2010-10-31 22:04   --------   d--h--w-   c:\windows\system32\CanonIJ Uninstaller Information
                2010-10-31 22:04 . 2010-01-13 13:03   94208   ----a-w-   c:\windows\system32\CNC5200O.dll
                2010-10-31 22:04 . 2010-03-11 07:56   180224   ----a-w-   c:\windows\system32\CNMIUAE.DLL
                2010-10-31 22:03 . 2010-10-31 22:03   --------   d-----w-   c:\windows\system32\STRING
                2010-10-31 22:03 . 2010-02-05 09:37   34816   ----a-w-   c:\windows\system32\CNMNPUI.DLL
                2010-10-31 22:03 . 2010-02-05 09:37   340992   ----a-w-   c:\windows\system32\CNMNPPM.DLL
                2010-10-31 22:01 . 2010-10-31 22:22   --------   d-----w-   c:\program files\Canon

                .
                ((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
                .
                2010-10-10 03:11 . 2008-10-26 23:11   323584   ----a-w-   c:\windows\system32\AUDIOGENIE2.DLL
                2010-09-18 16:23 . 2004-08-10 19:00   974848   ----a-w-   c:\windows\system32\mfc42u.dll
                2010-09-18 06:53 . 2004-08-10 19:00   974848   ----a-w-   c:\windows\system32\mfc42.dll
                2010-09-18 06:53 . 2004-08-10 19:00   954368   ----a-w-   c:\windows\system32\mfc40.dll
                2010-09-18 06:53 . 2004-08-10 19:00   953856   ------w-   c:\windows\system32\mfc40u.dll
                2010-09-15 07:29 . 2007-05-05 11:45   73728   ----a-w-   c:\windows\system32\javacpl.cpl
                2010-09-09 13:38 . 2004-08-10 19:00   832512   ----a-w-   c:\windows\system32\wininet.dll
                2010-09-09 13:38 . 2004-08-10 19:00   1830912   ----a-w-   c:\windows\system32\inetcpl.cpl
                2010-09-09 13:38 . 2004-08-10 19:00   78336   ----a-w-   c:\windows\system32\ieencode.dll
                2010-09-09 13:38 . 2004-08-10 19:00   17408   ----a-w-   c:\windows\system32\corpol.dll
                2010-09-08 15:57 . 2004-08-10 19:00   389120   ----a-w-   c:\windows\system32\html.iec
                2010-09-01 11:51 . 2004-08-10 19:00   285824   ----a-w-   c:\windows\system32\atmfd.dll
                2010-08-31 13:42 . 2004-08-10 19:00   1852800   ----a-w-   c:\windows\system32\win32k.sys
                2010-08-27 08:02 . 2004-08-10 19:00   119808   ----a-w-   c:\windows\system32\t2embed.dll
                2010-08-27 05:57 . 2004-08-10 19:00   99840   ----a-w-   c:\windows\system32\srvsvc.dll
                2010-08-26 13:39 . 2004-08-10 19:00   357248   ----a-w-   c:\windows\system32\drivers\srv.sys
                2010-08-26 12:52 . 2009-04-15 04:56   5120   ----a-w-   c:\windows\system32\xpsp4res.dll
                2010-08-23 16:12 . 2004-08-10 19:00   617472   ------w-   c:\windows\system32\comctl32.dll
                .

                (((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
                .
                .
                *Note* empty entries & legit default entries are not shown
                REGEDIT4

                [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                "PhotoShow Deluxe Media Manager"="c:\progra~1\Comcast\COMCAS~1\data\Xtras\mssysmgr.exe" [2005-05-09 192512]
                "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

                [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                "TotalRecorderScheduler"="c:\program files\HighCriteria\TotalRecorder\TotRecSched.exe" [2005-10-13 81920]
                "SMSERIAL"="sm56hlpr.exe" [2005-01-24 544768]
                "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2005-09-28 98304]
                "Persistence"="c:\windows\system32\igfxpers.exe" [2005-06-08 114688]
                "KBD"="c:\hp\KBD\KBD.EXE" [2005-02-02 61440]
                "HPHUPD08"="c:\program files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe" [2005-06-02 49152]
                "HPBootOp"="c:\program files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2005-02-26 245760]
                "HP Software Update"="c:\program files\HP\HP Software Update\HPwuSchd2.exe" [2005-05-12 49152]
                "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2005-06-08 77824]
                "High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2005-01-08 61952]
                "ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]
                "eFax 4.2"="c:\program files\eFax Messenger 4.2\J2GDllCmd.exe" [2006-07-14 107008]
                "Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 63712]
                "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-09-11 198160]
                "GhostSurf Reminder"="c:\program files\GhostSurf Platinum\Privacy Control Center.exe" [2008-06-17 87504]
                "ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2010-07-21 1038848]
                "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
                "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
                "CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2010-03-25 2516296]
                "CanonSolutionMenuEx"="c:\program files\Canon\Solution Menu EX\CNSEMAIN.EXE" [2010-04-02 1185112]
                "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]

                c:\documents and settings\All Users\Start Menu\Programs\Startup\
                GoBack.lnk - c:\program files\Roxio\GoBack\GBTray.exe [2006-1-10 524288]
                HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-5-12 282624]
                Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
                Updates from HP.lnk - c:\program files\Updates from HP\9972322\Program\Updates from HP.exe [2005-9-27 36903]

                [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
                "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

                [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
                2009-09-03 19:21   548352   ----a-w-   c:\program files\SUPERAntiSpyware\SASWINLO.dll

                [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
                BootExecute   REG_MULTI_SZ      autocheck autochk *\0PFDNNT c:\windows\system32\pavipc.dll\0PFDNNT c:\windows\system32\SYSTOOLS.DLL\0PFDNNT c:\windows\system32\PavSHook.dll\0PFDNNT c:\windows\system32\drivers\pavdrv51.sys\0PFDNNT c:\windows\system32\drivers\netflt.sys\0PFDNNT c:\windows\system32\drivers\Teefer.sys\0PFDNNT c:\windows\system32\drivers\WG3N.sys\0PFDNNT c:\windows\system32\drivers\wpsdrvnt.sys\0PFDNNT c:\windows\system32\drivers\pcontNT.sys\0PFDNNT c:\windows\system32\drivers\netids.dll\0PFDNNT c:\windows\system32\drivers\CPoint.sys\0PFDNNT c:\windows\system32\FwsVpn.dll\0PFDNNT c:\windows\system32\TpUtil.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\actualiz.avi\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\ADiagnst.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\ADiagnst.ini\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\ADialer.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\ANALISIS.AVI\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\ApVxdWin.exe\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\ASMDAT.DLL\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Avcic.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Avciman.exe\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\AVCIMAN.INI\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\AVENGDLL.DLL\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\AVENGINE.EXE\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\AVLITE.EXE\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\AvLite.ini\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\AVLITE.MLD\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\AVLtMain.exe\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\AVLTMAIN.MLD\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\AVTASK.EXE\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\BOOTDISK.IMG\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\BOProt.XML\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\borlndmm.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\cc3250mt.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\CHMCCFG.DLL\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\ComFltNt.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\COMPRESS.AVI\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\CONEXION.AVI\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Countlst.cl\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\cpdll.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Dealers.txt\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\ENVIO.AVI\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\EstadUpd.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\FindAppl.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\FwAct.exe\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\FWACT.MLD\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\FWRLS.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\global.msg\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\ICL_CFG.DLL\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\ICL_MTR.DLL\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\icl_trf.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\icons.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\idiomas.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\ImRepAle.Dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\ImRepAle.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\InstKRE.ini\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Instlsp.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\KRE.XML\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\KreCfgXM.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\LangM5.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\LIBXML2.DLL\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Licen_en.txt\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\LITEUPG.EXE\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\LTForms.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\LTFORMS.MLD\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\LUpgConf.exe\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\msje8tp.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\NetVirus.xml\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\OSMerger.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\OSshield.sig\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\panda.chp\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\pav.sig\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\PAV2WSC.DLL\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\PavAMW.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\PAVCOMDL.DLL\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\PAVCPROX.DLL\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\PAVCRC.DLL\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\PAVDLL.DLL\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\pavdr.exe\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Pavdrv.inf\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\PAVEXCOM.DLL\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\PavFn.Dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\PavFnSvr.exe\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\PavFtp.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\pavim.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Pavkre.exe\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\pavlsp.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\PavMiCli.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\PavNntp.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\PAVOE.DLL\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\PavPop3.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\PavProt.bin\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\PAVPROT.EXE\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\PAvScr.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\PAVSCRIP.EXE\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\PavSInet.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\PavSMAPI.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\PAVSMCL.DLL\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\PavSmtp.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\PAVSRV51.EXE\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\pavtcmgr.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Pavtftp.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\PavTrc.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\PavWeb.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\PavWmail.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\PFDNNT.exe\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\PFILE32.DLL\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\PFSF.DLL\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\platc.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\plats.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\PNDCTRLA.BPL\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Port16.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Pprocs32.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\prcvfile.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\PREG32.DLL\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\prevapi.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\prevent.sig\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\prevsrv.exe\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\ProtExc.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\PROTINST.DLL\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\PROXY.AVI\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\PSAEng.Cfg\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\PSAEng.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\PSAUI.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\PSAUI.mld\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\PSCookie.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\PServ32.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\PsImSvc.exe\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\PSInet.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\pskalloc.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\pskcmp.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\PSKHTML.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\pskmcf.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\pskmfs.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\pskpack.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\PSKUTIL.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\pskvfile.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\pskvm.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\PSREPORT.DLL\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\PSSCAN.DLL\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\PSSYSCHK.DLL\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\PsSysChk.xml\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\psVers.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\PUtil32.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\PVer32.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Qrv.krn\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\RECONSF.AVI\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\REPORTEX.DLL\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\RESHOME.DLL\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\RESLITE.DLL\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\RSDNAPI.DLL\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\RsReport.rpt\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\SAFED.DLL\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\SAFEDISK.EXE\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\SAFEDISK.MLD\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Scans.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\SDISK2.IMG\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\sentinel.cfg\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\sentrsc.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\SHELLTIT.DLL\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\sporder.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\sporder.exe\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\TCPVFILE.DLL\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Titanium.ini\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\TITCFG.DLL\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\TITSCAN.DLL\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\TITSCAN.MLD\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\titw.cfg\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\titwBK.cfg\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\TPConf.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\UNINSTAL.DLL\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\UNINSTAL.INI\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\UPGTEST.EXE\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\USER.SVM\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\vcl50.bpl\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\vclx50.bpl\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\VerMan.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\VERSION.TXT\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\WebExcl.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\WebProxy.exe\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\WebProxy.ini\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Welcome.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\WHISTLER.BPL\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\WizSOS.exe\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\WizSOS.mld\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\ZIUpdate.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\ZIUPDATE.MLD\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\1001391694_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\10534247_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\1075359258_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\1081831864_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\1092434795_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\1122733537_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\1142642340_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\12224515_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\1245951201_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\1255514902_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\1286071020_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\1320380616_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\1346925813_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\1383231217_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\1544848317_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\1546243071_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\1572751645_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\1591461059_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\1644049401_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\167085580_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\1696950439_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\1817728914_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\1857665065_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\199630472_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\2054976669_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\2055572116_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\2283588243_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\2339528948_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\2341638980_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\2370437243_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\2470058123_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\252873349_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\2583033358_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\2638515956_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\267395131_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\2680449910_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\2739826237_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\2857187394_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\2941376458_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\2964147355_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\2982603958_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\2995471241_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\3014950654_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\3034094165_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\3042771132_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\3059352053_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\3077990757_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\3108173420_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\313800771_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\3152270391_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\3178084929_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\327639004_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\329594726_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\3412478009_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\3423676558_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\3447267006_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\3461387815_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\3489828055_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\3521209013_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\3528273804_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\3620835075_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\3638164187_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\3672456591_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\3765515499_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\3771744941_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\3772934217_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\3789642307_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\3831942230_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\3876198036_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\3932924787_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\397992096_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\4002827702_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\4013580911_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\4114096332_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\4229733669_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\4289512042_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\520436482_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\564275508_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\593188467_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\760359567_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\795220326_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\806635456_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\80812981_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\809254731_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\822313650_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\835374397_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\884323825_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\902749423_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\904808619_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\940126098_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\959325279_group.dat\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\External\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\0PFDNNT c:\windows\system32\PAV\0PFDNNT c:\windows\system32\pavipc.dll\0PFDNNT c:\windows\system32\SYSTOOLS.DLL\0PFDNNT c:\windows\system32\PavSHook.dll\0PFDNNT c:\windows\system32\TpUtil.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\ADiagnst.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\ApVxdWin.exe\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\ASMDAT.DLL\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Avcic.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\borlndmm.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\cc3250mt.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\ComFltNt.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\ICL_CFG.DLL\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\ICL_MTR.DLL\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\icl_trf.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\idiomas.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\LangM5.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\LTForms.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\PAV2WSC.DLL\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\PavAMW.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\PAVCOMDL.DLL\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\PAVCPROX.DLL\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\PAVDLL.DLL\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\PavFtp.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\pavim.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\pavlsp.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\PavMiCli.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\PavNntp.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\PavPop3.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\PAvScr.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\PavSInet.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\PavSmtp.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Pavtftp.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\PavTrc.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\PavWeb.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\PavWmail.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\platc.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\PNDCTRLA.BPL\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\PSAEng.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\PSAUI.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\pskalloc.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\pskcmp.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\PSKHTML.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\pskmcf.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\pskmfs.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\pskpack.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\PSKUTIL.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\pskvfile.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\pskvm.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\RSDNAPI.DLL\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\TCPVFILE.DLL\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\TITCFG.DLL\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\TPConf.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\vcl50.bpl\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\vclx50.bpl\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\WebProxy.exe\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\WHISTLER.BPL\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\ZIUpdate.dll\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\External\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\Data\0PFDNNT c:\program files\Panda Software\Panda Titanium Antivirus 2005\0SsiEfr.exe

                [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^SpyCatcher.lnk]
                path=c:\documents and settings\All Users\Start Menu\Programs\Startup\SpyCatcher.lnk
                backup=c:\windows\pss\SpyCatcher.lnkCommon Startup

                [HKLM\~\startupfolder\C:^Documents and Settings^HP_Administrator^Start Menu^Programs^Startup^LimeWire On Startup.lnk]
                path=c:\documents and settings\HP_Administrator\Start Menu\Programs\Startup\LimeWire On Startup.lnk
                backup=c:\windows\pss\LimeWire On Startup.lnkStartup

                [HKLM\~\startupfolder\C:^Documents and Settings^HP_Administrator^Start Menu^Programs^Startup^OpenOffice.org 3.0.lnk]
                path=c:\documents and settings\HP_Administrator\Start Menu\Programs\Startup\OpenOffice.org 3.0.lnk
                backup=c:\windows\pss\OpenOffice.org 3.0.lnkStartup

                [HKEY_LOCAL_MACHINE\software\microsoft\security center]
                "AntiVirusOverride"=dword:00000001
                "FirewallOverride"=dword:00000001

                [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
                "DisableMonitoring"=dword:00000001

                [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
                "EnableFirewall"= 0 (0x0)
                "DisableNotifications"= 1 (0x1)

                [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
                "%windir%\\system32\\sessmgr.exe"=
                "c:\\Program Files\\Updates from HP\\9972322\\Program\\Updates from HP.exe"=
                "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
                "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
                "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
                "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
                "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
                "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
                "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
                "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
                "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
                "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
                "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
                "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
                "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
                "c:\\WINDOWS\\system32\\java.exe"=
                "c:\\Program Files\\Soulseek\\slsk.exe"=
                "c:\\Program Files\\Messenger\\msmsgs.exe"=
                "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
                "c:\\Program Files\\Audiogalaxy Rhapsody\\rhapsody.exe"=
                "c:\\WINDOWS\\system32\\ZoneLabs\\vsmon.exe"=

                R0 54633942;54633942 Boot Guard Driver;c:\windows\system32\drivers\54633942.sys [5/4/2010 9:53 PM 37392]
                R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [5/9/2010 8:05 PM 28552]
                R1 54633941;54633941;c:\windows\system32\drivers\54633941.sys [5/4/2010 9:53 PM 128016]
                R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [1/5/2010 7:56 AM 12872]
                R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [1/5/2010 7:56 AM 67656]
                R2 ISWKL;ZoneAlarm ForceField ISWKL;c:\program files\CheckPoint\ZAForceField\ISWKL.sys [6/15/2010 6:09 AM 26352]
                R2 IswSvc;ZoneAlarm ForceField IswSvc;c:\program files\CheckPoint\ZAForceField\ISWSVC.exe [6/15/2010 6:09 AM 493032]
                R3 icsak;icsak;c:\program files\CheckPoint\ZAForceField\AK\icsak.sys [6/15/2010 6:09 AM 35568]
                S2 gupdate1c988bea66095e2;Google Update Service (gupdate1c988bea66095e2);c:\program files\Google\Update\GoogleUpdate.exe [2/6/2009 7:54 PM 133104]
                S3 ComFiltr;Panda Anti-Dialer;\??\c:\windows\system32\DRIVERS\COMFiltr.sys --> c:\windows\system32\DRIVERS\COMFiltr.sys [?]
                S3 PavSRK.sys;PavSRK.sys;\??\c:\windows\system32\PavSRK.sys --> c:\windows\system32\PavSRK.sys [?]
                S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [1/5/2010 7:56 AM 12872]

                [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
                getPlusHelper   REG_MULTI_SZ      getPlusHelper
                .
                Contents of the 'Scheduled Tasks' folder

                2010-11-20 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
                - c:\program files\Google\Update\GoogleUpdate.exe [2009-02-07 00:54]

                2010-11-20 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
                - c:\program files\Google\Update\GoogleUpdate.exe [2009-02-07 00:54]
                .
                .
                ------- Supplementary Scan -------
                .
                uStart Page = hxxp://www.masslive.com/
                uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q405&bd=pavilion&pf=desktop&parm1=seconduser
                mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q405&bd=pavilion&pf=desktop&parm1=seconduser
                uInternet Settings,ProxyOverride = <local>
                uInternet Settings,ProxyServer = <local>
                uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
                IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\Office10\EXCEL.EXE/3000
                DPF: {01118F00-3E00-11D2-8470-0060089874ED} - hxxp://www.comcastsupport.com/sdccommon/download/ssrc.cab
                DPF: {01119400-3E00-11D2-8470-0060089874ED} - hxxp://www.comcastsupport.com/sdccommon/download/sprtctlln.cab
                DPF: {6FE79ACA-A498-45E5-8BC4-1B9F380CE468} - hxxp://www.gamehouse.com/games/abxgh.cab
                DPF: {D7208880-9B7A-43E1-AABB-8C888A5704F9} - hxxp://192.168.1.115/NetCamPlayerWeb11gv2.cab
                FF - ProfilePath - c:\documents and settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\2kb2uh0s.default\
                FF - prefs.js: browser.startup.homepage - hxxp://www.comcast.net/|http://www.google.com/firefox?client=firefox-a&rls=org.mozilla:en-US:official
                FF - prefs.js: network.proxy.http - 127.0.0.1
                FF - prefs.js: network.proxy.http_port - 7212
                FF - prefs.js: network.proxy.type - 0
                FF - component: c:\program files\CheckPoint\ZAForceField\TrustChecker\components\MozillaExtensions.dll
                FF - component: c:\program files\CheckPoint\ZAForceField\TrustChecker\components\TrustCheckerMozillaPlugin.dll
                FF - plugin: c:\program files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL
                FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
                FF - plugin: c:\program files\Google\Update\1.2.183.39\npGoogleOneClick8.dll
                FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
                FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
                FF - plugin: c:\program files\Mozilla Firefox\plugins\NPcol400.dll
                FF - plugin: c:\program files\Mozilla Firefox\plugins\npCouponPrinter.dll
                FF - plugin: c:\program files\Mozilla Firefox\plugins\npMozCouponPrinter.dll
                FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\np32dsw.dll
                FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npaudio.dll
                FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npavi32.dll
                FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npbeatnk.dll
                FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npnul32.dll
                FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\nppl3260.dll
                FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npqtplugin.dll
                FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npqtplugin2.dll
                FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\nprfxins.dll
                FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\nprjplug.dll
                FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\nprpjplug.dll
                FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npswf32.dll
                FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

                ---- FIREFOX POLICIES ----
                FF - user.js: yahoo.homepage.dontask - true
                c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
                c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqz9s", true); // Traditional
                c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqs8s", true); // Simplified
                c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--j6w193g", true);
                c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
                c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4a87g", true);
                c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7c0a67fbc", true);
                c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7cvafr", true);
                c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kpry57d", true);  // Traditional
                c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kprw13d", true);  // Simplified
                c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
                .
                - - - - ORPHANS REMOVED - - - -

                WebBrowser-{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - (no file)
                AddRemove-HijackThis - c:\program files\Trend Micro\HijackThis\HijackThis.exe



                **************************************************************************
                scanning hidden processes ... 

                scanning hidden autostart entries ...

                scanning hidden files ... 

                scan completed successfully
                hidden files:

                **************************************************************************
                .
                --------------------- LOCKED REGISTRY KEYS ---------------------

                [HKEY_USERS\S-1-5-21-1331186452-1043149236-2221462763-1008\Software\Microsoft\SystemCertificates\AddressBook*]
                @Allowed: (Read) (RestrictedCode)
                @Allowed: (Read) (RestrictedCode)

                [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
                @Denied: (A 2) (Everyone)
                @="FlashBroker"
                "LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101"

                [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
                "Enabled"=dword:00000001

                [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
                @="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe"

                [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
                @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

                [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
                @Denied: (A 2) (Everyone)
                @="IFlashBroker4"

                [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
                @="{00020424-0000-0000-C000-000000000046}"

                [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
                @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
                "Version"="1.0"
                .
                --------------------- DLLs Loaded Under Running Processes ---------------------

                - - - - - - - > 'winlogon.exe'(656)
                c:\program files\SUPERAntiSpyware\SASWINLO.dll
                c:\windows\system32\WININET.dll
                c:\program files\CheckPoint\ZAForceField\AK\icsak.dll
                c:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll

                - - - - - - - > 'lsass.exe'(712)
                c:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
                c:\program files\CheckPoint\ZAForceField\AK\icsak.dll

                - - - - - - - > 'explorer.exe'(1940)
                c:\windows\system32\WININET.dll
                c:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
                c:\program files\CheckPoint\ZAForceField\AK\icsak.dll
                c:\windows\system32\ieframe.dll
                c:\windows\system32\WPDShServiceObj.dll
                c:\windows\system32\PortableDeviceTypes.dll
                c:\windows\system32\PortableDeviceApi.dll

                - - - - - - - > 'csrss.exe'(632)
                c:\program files\CheckPoint\ZAForceField\AK\akconsole.dll
                .
                ------------------------ Other Running Processes ------------------------
                .
                c:\program files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
                c:\windows\eHome\ehRecvr.exe
                c:\windows\eHome\ehSched.exe
                c:\program files\Canon\IJPLM\IJPLMSVC.EXE
                c:\program files\Java\jre6\bin\jqs.exe
                c:\program files\Common Files\LightScribe\LSSrvc.exe
                c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
                c:\windows\system32\MsPMSPSv.exe
                c:\windows\system32\dllhost.exe
                c:\windows\sm56hlpr.exe
                c:\windows\eHome\ehmsas.exe
                c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe
                c:\progra~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.exe
                .
                **************************************************************************
                .
                Completion time: 2010-11-20  14:30:54 - machine was rebooted
                ComboFix-quarantined-files.txt  2010-11-20 19:30

                Pre-Run: 51,349,204,992 bytes free
                Post-Run: 51,460,882,432 bytes free

                WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
                [boot loader]
                timeout=2
                default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
                [operating systems]
                c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
                UnsupportedDebug="do not select this" /debug
                multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect

                - - End Of File - - 8F026D0B12D8674F680D664E4909C537
                Logged

                Sneakyone

                • Malware Removal Specialist


                  • Beginner

                  Thanked: 5
                  Re: Virus Causing Strange Behavior
                  « Reply #7 on: November 28, 2010, 01:37:01 PM »
                  Hi,

                  Apologies for the delay.

                  Please download Malwarebytes Anti-Malware from Here.
                   

                  Double Click mbam-setup.exe to install the application.
                  • Make sure  a checkmark is placed next to Update Malwarebytes Anti-Malware  and Launch Malwarebytes Anti-Malware, then click Finish.
                  • If  an update is found, it will download and install the latest version.
                  • Once  the program has loaded, select "Perform Quick Scan", then click Scan.
                  • The  scan may take some time to finish,so please be patient.
                  • When  the scan is complete, click OK, then Show Results to view the results.
                  • Make  sure that everything is checked, and click Remove Selected.
                  • When  disinfection is completed, a log will open in Notepad and you may be  prompted to Restart.(See Extra Note)
                  • The log is automatically  saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
                  • Copy&Paste  the entire report in your next reply.
                  Extra Note:
                  If MBAM encounters a file that is difficult to  remove,you will be presented with 1 of 2 prompts,click OK to either and  let MBAM proceed with the disinfection process. If asked to restart the  computer, please do so immediatly.
                  Logged

                  rstoddard

                    Topic Starter


                    Beginner

                    Re: Virus Causing Strange Behavior
                    « Reply #8 on: December 02, 2010, 09:16:29 PM »
                    Hello.

                    Here is the log. It doesn't seem to have found anything, but the system is still running very slowly ???.

                    Malwarebytes' Anti-Malware 1.50
                    www.malwarebytes.org

                    Database version: 5235

                    Windows 5.1.2600 Service Pack 3
                    Internet Explorer 7.0.5730.11

                    12/2/2010 11:12:39 PM
                    mbam-log-2010-12-02 (23-12-39).txt

                    Scan type: Quick scan
                    Objects scanned: 243698
                    Time elapsed: 19 minute(s), 19 second(s)

                    Memory Processes Infected: 0
                    Memory Modules Infected: 0
                    Registry Keys Infected: 0
                    Registry Values Infected: 0
                    Registry Data Items Infected: 0
                    Folders Infected: 0
                    Files Infected: 0

                    Memory Processes Infected:
                    (No malicious items detected)

                    Memory Modules Infected:
                    (No malicious items detected)

                    Registry Keys Infected:
                    (No malicious items detected)

                    Registry Values Infected:
                    (No malicious items detected)

                    Registry Data Items Infected:
                    (No malicious items detected)

                    Folders Infected:
                    (No malicious items detected)

                    Files Infected:
                    (No malicious items detected)
                    Logged
                    Pages: [1]   Go Up
                    « previous next »