GeekPolice
Welcome to GeekPolice.net!

From "wow" to "whoa" - we're teaching practical technology and helping others with tech support. Join our family here!

You are viewing the forum as a "Guest" which doesn't give you member privileges to ask questions or post comments.

Take 30 seconds to register or log in below and unlock the limitations of this website to discover new computer knowledge!

Sytem very slow Unable to identify Problem Might be virus

View previous topic View next topic Go down

Sytem very slow Unable to identify Problem Might be virus

Post by invisible016 on Sun Oct 17, 2010 3:01 pm

Hi Team,

My system is very slow and even the files in c drive have changed names to some junk values.I dont know the reason and even my system has become very slow.When i start the system it takes a lot of time.Even the applications which used to work fine earlier r not working the way they used to.Need help.And one more thing all my data is stored in this system and i dont have a back up.so i dont want to loose the data.Please help.

Here are the otl logs I might have to split it in two parts.

Thanks.

OTL logfile created on: 10/17/2010 8:50:33 AM - Run 4
OTL by OldTimer - Version 3.2.15.2 Folder = C:\Users\farida\Desktop
Windows Vista Home Basic Edition (Version = 6.0.6000) - Type = NTWorkstation[/b]
Internet Explorer (Version = 7.0.6000.17037)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 53.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 69.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 99.21 Gb Total Space | 4.61 Gb Free Space | 4.65% Space Free | Partition Type: NTFS
Drive D: | 10.00 Gb Total Space | 5.13 Gb Free Space | 51.26% Space Free | Partition Type: NTFS

Computer Name: FARIDA-PC | User Name: farida | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2010/10/17 08:44:57 | 000,574,464 | ---- | M] (OldTimer Tools) -- C:\Users\farida\Desktop\OTL(2).com
PRC - [2010/06/02 15:11:32 | 000,172,032 | ---- | M] (Sophos Plc) -- C:\Program Files\Sophos\AutoUpdate\ALsvc.exe
PRC - [2010/06/02 15:08:46 | 000,794,624 | ---- | M] (Sophos Plc) -- C:\Program Files\Sophos\Remote Management System\RouterNT.exe
PRC - [2010/06/02 15:08:31 | 000,266,240 | ---- | M] (Sophos Plc) -- C:\Program Files\Sophos\Remote Management System\ManagementAgentNT.exe
PRC - [2010/05/21 06:27:04 | 000,173,352 | ---- | M] (TeamViewer GmbH) -- C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe
PRC - [2010/02/17 10:53:18 | 000,558,456 | ---- | M] (Symantec Corporation) -- C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
PRC - [2010/02/10 00:38:09 | 000,245,760 | ---- | M] (Sophos Plc) -- C:\Program Files\Sophos\AutoUpdate\ALMon.exe
PRC - [2010/01/18 11:15:19 | 003,168,216 | ---- | M] (PC Tools) -- C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe
PRC - [2009/12/18 21:51:23 | 000,098,304 | ---- | M] (Sophos Plc) -- C:\Program Files\Sophos\Sophos Anti-Virus\SavService.exe
PRC - [2009/12/18 21:51:00 | 000,080,936 | ---- | M] (Sophos Plc) -- C:\Program Files\Sophos\Sophos Anti-Virus\SAVAdminService.exe
PRC - [2009/12/05 09:35:14 | 001,282,248 | ---- | M] (Tall Emu) -- C:\Program Files\Tall Emu\Online Armor\oacat.exe
PRC - [2009/11/09 13:20:14 | 000,818,432 | ---- | M] (PC Tools) -- C:\Program Files\PC Tools Firewall Plus\FWService.exe
PRC - [2009/05/01 01:48:52 | 000,198,160 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Common Files\Real\Update_OB\realsched.exe
PRC - [2009/04/03 14:23:58 | 003,558,648 | ---- | M] (Veoh Networks) -- C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe
PRC - [2008/11/09 15:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
PRC - [2008/10/29 01:20:29 | 002,923,520 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2008/10/15 20:13:58 | 000,439,632 | ---- | M] (RealVNC Ltd.) -- C:\Program Files\RealVNC\VNC4\winvnc4.exe
PRC - [2008/09/26 20:14:06 | 003,660,848 | ---- | M] (Veoh Networks) -- C:\Program Files\Veoh Networks\Veoh\VeohClient.exe
PRC - [2007/11/28 21:51:10 | 000,583,048 | ---- | M] (Symantec Corporation) -- C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
PRC - [2007/10/10 20:41:53 | 000,013,824 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\inetsrv\inetinfo.exe
PRC - [2007/08/03 14:51:18 | 001,422,632 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
PRC - [2007/08/03 14:51:06 | 000,202,024 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe
PRC - [2007/07/16 13:58:02 | 001,524,512 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
PRC - [2007/06/27 05:17:02 | 000,405,504 | ---- | M] (SigmaTel, Inc.) -- C:\Program Files\Sigmatel\C-Major Audio\WDM\sttray.exe
PRC - [2007/06/27 05:17:00 | 000,094,208 | ---- | M] (SigmaTel, Inc.) -- C:\Windows\System32\stacsv.exe
PRC - [2007/05/25 11:38:46 | 000,112,176 | ---- | M] (SingleClick Systems) -- C:\Program Files\Dell Network Assistant\hnm_svc.exe
PRC - [2007/05/11 01:57:30 | 000,040,960 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Program Files\DellTPad\hidfind.exe
PRC - [2007/05/11 01:57:24 | 000,050,736 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Program Files\DellTPad\ApMsgFwd.exe
PRC - [2007/05/11 01:57:24 | 000,040,960 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Program Files\DellTPad\ApntEx.exe
PRC - [2007/04/27 08:34:18 | 001,123,872 | ---- | M] (Dell Inc) -- C:\Program Files\Dell\QuickSet\quickset.exe
PRC - [2007/04/16 16:10:26 | 000,184,320 | ---- | M] (CyberLink Corp.) -- C:\Program Files\Dell\MediaDirect\PCMService.exe
PRC - [2007/03/15 12:09:36 | 000,460,784 | ---- | M] (Gteko Ltd.) -- C:\Program Files\DellSupport\DSAgnt.exe
PRC - [2007/01/01 16:22:02 | 003,739,648 | ---- | M] (Google) -- C:\Users\farida\AppData\Roaming\Google\Google Talk\googletalk.exe
PRC - [2006/11/03 18:02:14 | 000,050,688 | ---- | M] (Avanquest Software ) -- C:\Program Files\Digital Line Detect\DLG.exe
PRC - [2006/11/02 04:45:53 | 001,137,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wercon.exe


========== Modules (SafeList) ==========

MOD - [2010/10/17 08:44:57 | 000,574,464 | ---- | M] (OldTimer Tools) -- C:\Users\farida\Desktop\OTL(2).com
MOD - [2010/04/15 12:08:16 | 000,195,072 | ---- | M] (Sophos Plc) -- C:\Program Files\Sophos\Sophos Anti-Virus\sophos_detoured.dll
MOD - [2007/06/29 04:22:36 | 000,102,400 | ---- | M] (Intel Corporation) -- C:\Windows\System32\hccutils.dll
MOD - [2007/04/27 08:34:24 | 000,103,968 | ---- | M] () -- C:\Program Files\Dell\QuickSet\dadkeyb.dll
MOD - [2006/11/02 04:44:49 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msscript.ocx
MOD - [2006/11/02 04:38:57 | 001,648,128 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6000.16386_none_5d07289e07e1d100\comctl32.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [Auto | Stopped] -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe -- (LiveUpdate Notice Ex)
SRV - [2010/06/02 15:11:32 | 000,172,032 | ---- | M] (Sophos Plc) [Auto | Running] -- C:\Program Files\Sophos\AutoUpdate\ALsvc.exe -- (Sophos AutoUpdate Service)
SRV - [2010/06/02 15:08:46 | 000,794,624 | ---- | M] (Sophos Plc) [Auto | Running] -- C:\Program Files\Sophos\Remote Management System\RouterNT.exe -- (Sophos Message Router)
SRV - [2010/06/02 15:08:31 | 000,266,240 | ---- | M] (Sophos Plc) [Auto | Running] -- C:\Program Files\Sophos\Remote Management System\ManagementAgentNT.exe -- (Sophos Agent)
SRV - [2010/05/21 06:27:04 | 000,173,352 | ---- | M] (TeamViewer GmbH) [Auto | Running] -- C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe -- (TeamViewer5)
SRV - [2010/02/17 10:53:18 | 003,093,880 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Program Files\Symantec\LiveUpdate\LuComServer_3_3.EXE -- (LiveUpdate)
SRV - [2010/02/17 10:53:18 | 000,558,456 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe -- (Automatic LiveUpdate Scheduler)
SRV - [2009/12/18 21:51:23 | 000,098,304 | ---- | M] (Sophos Plc) [Unknown | Running] -- C:\Program Files\Sophos\Sophos Anti-Virus\SavService.exe -- (SAVService)
SRV - [2009/12/18 21:51:00 | 000,080,936 | ---- | M] (Sophos Plc) [Unknown | Running] -- C:\Program Files\Sophos\Sophos Anti-Virus\SAVAdminService.exe -- (SAVAdminService)
SRV - [2009/12/05 09:35:14 | 003,431,112 | ---- | M] (Tall Emu) [On_Demand | Stopped] -- C:\Program Files\Tall Emu\Online Armor\oasrv.exe -- (SvcOnlineArmor)
SRV - [2009/12/05 09:35:14 | 001,282,248 | ---- | M] (Tall Emu) [Auto | Running] -- C:\Program Files\Tall Emu\Online Armor\OAcat.exe -- (OAcat)
SRV - [2009/11/09 13:20:14 | 000,818,432 | ---- | M] (PC Tools) [Auto | Running] -- C:\Program Files\PC Tools Firewall Plus\FWService.exe -- (PCToolsFirewallPlus)
SRV - [2008/11/09 15:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) [Auto | Running] -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService)
SRV - [2008/10/15 20:13:58 | 000,439,632 | ---- | M] (RealVNC Ltd.) [Auto | Running] -- C:\Program Files\RealVNC\VNC4\WinVNC4.exe -- (WinVNC4)
SRV - [2007/11/28 21:51:10 | 000,583,048 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe -- (LiveUpdate Notice Service)
SRV - [2007/11/07 08:58:18 | 003,004,416 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- c:\Program Files\Microsoft Visual Studio 9.0\Common7\IDE\Remote Debugger\x86\msvsmon.exe -- (msvsmon90)
SRV - [2007/10/31 18:20:27 | 000,265,912 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007/10/10 20:41:53 | 000,013,824 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\inetsrv\inetinfo.exe -- (IISADMIN)
SRV - [2007/07/16 13:58:02 | 001,524,512 | ---- | M] (Cisco Systems, Inc.) [Auto | Running] -- C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe -- (CVPND)
SRV - [2007/06/27 05:17:00 | 000,094,208 | ---- | M] (SigmaTel, Inc.) [Auto | Running] -- C:\Windows\System32\stacsv.exe -- (STacSV)
SRV - [2007/05/25 11:38:46 | 000,112,176 | ---- | M] (SingleClick Systems) [Auto | Running] -- C:\Program Files\Dell Network Assistant\hnm_svc.exe -- (hnmsvc)
SRV - [2007/03/19 12:44:44 | 000,070,656 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\DellSupport\brkrsvc.exe -- (DSBrokerService)
SRV - [2006/11/02 07:35:03 | 000,322,560 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\System32\inetsrv\iisw3adm.dll -- (WAS)
SRV - [2006/11/02 07:35:03 | 000,322,560 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\inetsrv\iisw3adm.dll -- (W3SVC)
SRV - [2006/02/02 00:55:36 | 000,057,616 | ---- | M] (Oracle Corporation) [On_Demand | Stopped] -- C:\XEClient\BIN\omtsreco.exe -- (OracleMTSRecoveryService)
SRV - [2002/04/26 22:34:38 | 000,242,328 | ---- | M] () [On_Demand | Stopped] -- C:\oracle\ora92\bin\ONRSD.EXE -- (OracleOraHome92ClientCache)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\commy\catchme.sys -- (catchme)
DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\blbdrive.sys -- (blbdrive)
DRV - [2010/06/02 15:10:17 | 000,093,688 | ---- | M] (Sophos Plc) [File_System | System | Running] -- C:\Windows\System32\drivers\savonaccess.sys -- (SAVOnAccess)
DRV - [2010/01/18 11:15:37 | 000,115,216 | ---- | M] (PC Tools) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\pctplfw.sys -- (pctplfw)
DRV - [2010/01/18 11:15:36 | 000,058,816 | ---- | M] (PC Tools) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\pctNdis.sys -- (pctNDIS)
DRV - [2010/01/18 11:15:35 | 000,070,664 | ---- | M] (PC Tools) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\pctNdis-PacketFilter.sys -- (PCTFW-PacketFilter)
DRV - [2010/01/18 11:15:35 | 000,032,680 | ---- | M] (PC Tools) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\pctNdis-DNS.sys -- (PCTFW-DNS)
DRV - [2010/01/18 11:15:34 | 000,233,136 | ---- | M] (PC Tools) [Kernel | System | Running] -- C:\Windows\System32\drivers\pctgntdi.sys -- (pctgntdi)
DRV - [2009/12/18 21:51:23 | 000,020,288 | ---- | M] (Sophos Plc) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\SophosBootDriver.sys -- (SophosBootDriver)
DRV - [2009/12/05 09:28:06 | 000,024,656 | ---- | M] (Tall Emu) [Kernel | System | Running] -- C:\Windows\System32\drivers\OAmon.sys -- (OAmon)
DRV - [2009/12/05 09:27:52 | 000,223,312 | ---- | M] (Tall Emu) [File_System | System | Running] -- C:\Windows\System32\drivers\OADriver.sys -- (OADevice)
DRV - [2009/11/23 15:54:20 | 000,088,040 | ---- | M] (PC Tools) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\PCTAppEvent.sys -- (PCTAppEvent)
DRV - [2009/07/15 01:44:15 | 000,229,224 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\VMM.sys -- (vmm)
DRV - [2009/02/14 23:30:36 | 000,025,280 | ---- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\hamachi.sys -- (hamachi)
DRV - [2008/12/17 13:56:24 | 000,081,360 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\VBoxNetFlt.sys -- (VBoxNetFlt)
DRV - [2008/12/17 13:56:24 | 000,041,680 | ---- | M] (Sun Microsystems, Inc.) [Kernel | System | Running] -- C:\Windows\System32\drivers\VBoxUSBMon.sys -- (VBoxUSBMon)
DRV - [2008/12/17 13:56:20 | 000,100,368 | ---- | M] () [Kernel | System | Running] -- C:\Windows\System32\drivers\VBoxDrv.sys -- (VBoxDrv)
DRV - [2008/02/05 04:50:44 | 000,059,960 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\VMNetSrv.sys -- (VPCNetS2)
DRV - [2007/10/31 18:25:08 | 000,020,152 | ---- | M] (VIA Technologies, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\viaide.sys -- (viaide)
DRV - [2007/10/31 18:25:08 | 000,019,128 | ---- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\cmdide.sys -- (cmdide)
DRV - [2007/10/31 18:25:08 | 000,017,592 | ---- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\aliide.sys -- (aliide)
DRV - [2007/08/29 00:55:06 | 000,007,424 | ---- | M] (EyePower Games Pte. Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\OEM02Vfx.sys -- (OEM02Vfx)
DRV - [2007/08/29 00:54:56 | 000,235,520 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\OEM02Dev.sys -- (OEM02Dev)
DRV - [2007/07/16 13:57:12 | 000,306,299 | ---- | M] (Cisco Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\CVPNDRVA.sys -- (CVPNDRVA)
DRV - [2007/06/29 04:22:38 | 001,675,776 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\igdkmd32.sys -- (igfx)
DRV - [2007/06/27 05:17:04 | 000,326,656 | ---- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\stwrt.sys -- (STHDA)
DRV - [2007/05/11 02:00:48 | 000,179,712 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\b57nd60x.sys -- (b57nd60x)
DRV - [2007/05/11 01:57:22 | 000,157,184 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Apfiltr.sys -- (ApfiltrService)
DRV - [2007/04/29 01:43:22 | 000,277,784 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\drivers\iastor.sys -- (iaStor)
DRV - [2007/04/29 01:34:36 | 000,037,376 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rixdptsk.sys -- (rismxdp)
DRV - [2007/04/29 01:34:34 | 000,043,520 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimsptsk.sys -- (rimsptsk)
DRV - [2007/04/29 01:34:34 | 000,032,256 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimmptsk.sys -- (rimmptsk)
DRV - [2007/04/29 00:24:30 | 000,008,192 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\XAudio.sys -- (XAudio)
DRV - [2007/04/29 00:24:28 | 000,986,624 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HSX_DPV.sys -- (HSF_DPV)
DRV - [2007/04/29 00:24:28 | 000,659,968 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HSX_CNXT.sys -- (winachsf)
DRV - [2007/04/29 00:24:28 | 000,206,848 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HSXHWAZL.sys -- (HSXHWAZL)
DRV - [2007/03/21 14:33:46 | 000,534,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\BCMWL6.SYS -- (BCM43XX)
DRV - [2007/02/25 12:10:48 | 000,005,376 | --S- | M] (Gteko Ltd.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\dsunidrv.sys -- (dsunidrv)
DRV - [2007/01/31 15:45:06 | 000,127,376 | ---- | M] (Deterministic Networks, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\dne2000.sys -- (DNE)
DRV - [2007/01/18 17:28:02 | 000,005,275 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\CVirtA.sys -- (CVirtA)
DRV - [2006/12/18 19:01:20 | 000,012,672 | ---- | M] (SingleClick Systems) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\packet.sys -- (Packet)
DRV - [2006/11/02 04:51:45 | 000,900,712 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql2300.sys -- (ql2300)
DRV - [2006/11/02 04:51:38 | 000,420,968 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adp94xx.sys -- (adp94xx)
DRV - [2006/11/02 04:51:34 | 000,316,520 | ---- | M] (Emulex) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\elxstor.sys -- (elxstor)
DRV - [2006/11/02 04:51:32 | 000,297,576 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpahci.sys -- (adpahci)
DRV - [2006/11/02 04:51:25 | 000,235,112 | ---- | M] (ULi Electronics Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\uliahci.sys -- (uliahci)
DRV - [2006/11/02 04:51:25 | 000,232,040 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\drivers\iastorv.sys -- (iaStorV)
DRV - [2006/11/02 04:51:00 | 000,147,048 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu320.sys -- (adpu320)
DRV - [2006/11/02 04:50:45 | 000,115,816 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata2.sys -- (ulsata2)
DRV - [2006/11/02 04:50:41 | 000,112,232 | ---- | M] (VIA Technologies Inc.,Ltd) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\vsmraid.sys -- (vsmraid)
DRV - [2006/11/02 04:50:35 | 000,106,088 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql40xx.sys -- (ql40xx)
DRV - [2006/11/02 04:50:35 | 000,098,408 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata.sys -- (UlSata)
DRV - [2006/11/02 04:50:35 | 000,098,408 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu160m.sys -- (adpu160m)
DRV - [2006/11/02 04:50:24 | 000,088,680 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvraid.sys -- (nvraid)
DRV - [2006/11/02 04:50:19 | 000,045,160 | ---- | M] (IBM Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nfrd960.sys -- (nfrd960)
DRV - [2006/11/02 04:50:17 | 000,041,576 | ---- | M] (Intel Corp./ICP vortex GmbH) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iirsp.sys -- (iirsp)
DRV - [2006/11/02 04:50:16 | 000,071,784 | ---- | M] (Silicon Integrated Systems) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sisraid4.sys -- (SiSRaid4)
DRV - [2006/11/02 04:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvstor.sys -- (nvstor)
DRV - [2006/11/02 04:50:11 | 000,071,272 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\djsvs.sys -- (aic78xx)
DRV - [2006/11/02 04:50:10 | 000,067,688 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arcsas.sys -- (arcsas)
DRV - [2006/11/02 04:50:10 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_scsi.sys -- (LSI_SCSI)
DRV - [2006/11/02 04:50:10 | 000,038,504 | ---- | M] (Silicon Integrated Systems Corp.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sisraid2.sys -- (SiSRaid2)
DRV - [2006/11/02 04:50:10 | 000,037,480 | ---- | M] (Hewlett-Packard Company) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\hpcisss.sys -- (HpCISSs)
DRV - [2006/11/02 04:50:09 | 000,067,688 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arc.sys -- (arc)
DRV - [2006/11/02 04:50:09 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteraid.sys -- (iteraid)
DRV - [2006/11/02 04:50:07 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteatapi.sys -- (iteatapi)
DRV - [2006/11/02 04:50:05 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_sas.sys -- (LSI_SAS)
DRV - [2006/11/02 04:50:05 | 000,035,944 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\symc8xx.sys -- (Symc8xx)
DRV - [2006/11/02 04:50:04 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_fc.sys -- (LSI_FC)
DRV - [2006/11/02 04:50:03 | 000,034,920 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_u3.sys -- (Sym_u3)
DRV - [2006/11/02 04:49:59 | 000,033,384 | ---- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\mraid35x.sys -- (Mraid35x)
DRV - [2006/11/02 04:49:56 | 000,031,848 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_hi.sys -- (Sym_hi)
DRV - [2006/11/02 04:49:53 | 000,028,776 | ---- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\megasas.sys -- (megasas)
DRV - [2006/11/02 03:55:04 | 000,071,552 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\USBAUDIO.sys -- (usbaudio) USB Audio Driver (WDM)
DRV - [2006/11/02 03:25:24 | 000,071,808 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserid.sys -- (Brserid) Brother MFC Serial Port Interface Driver (WDM)
DRV - [2006/11/02 03:24:47 | 000,011,904 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brusbser.sys -- (BrUsbSer)
DRV - [2006/11/02 03:24:46 | 000,005,248 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltup.sys -- (BrFiltUp)
DRV - [2006/11/02 03:24:45 | 000,013,568 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltlo.sys -- (BrFiltLo)
DRV - [2006/11/02 03:24:44 | 000,062,336 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserwdm.sys -- (BrSerWdm)
DRV - [2006/11/02 03:24:44 | 000,012,160 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brusbmdm.sys -- (BrUsbMdm)
DRV - [2006/11/02 02:36:50 | 000,020,608 | ---- | M] (N-trig Innovative Technologies) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ntrigdigi.sys -- (ntrigdigi)
DRV - [2006/11/02 02:36:43 | 002,028,032 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\atikmdag.sys -- (R300)
DRV - [2006/11/02 02:30:55 | 000,200,704 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\e1e6032.sys -- (e1express) Intel(R)
DRV - [2006/11/02 02:30:54 | 000,117,760 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\E1G60I32.sys -- (E1G60) Intel(R)
DRV - [2006/10/05 17:07:28 | 000,004,736 | ---- | M] (Gteko Ltd.) [Kernel | On_Demand | Running] -- C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys -- (DSproct)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = [You must be registered and logged in to see this link.]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch = [You must be registered and logged in to see this link.]

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll (Yahoo! Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" =

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Yahoo"
FF - prefs.js..browser.search.defaulturl: "http://search.yahoo.com/search?fr=ffsp1&p="
FF - prefs.js..browser.search.selectedEngine: "Yahoo"
FF - prefs.js..browser.startup.homepage: "http://www.google.com/"
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.0
FF - prefs.js..extensions.enabledItems: [You must be registered and logged in to see this link.]:1.3
FF - prefs.js..extensions.enabledItems: [You must be registered and logged in to see this link.]:1.4
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:1.6.5.200812101546
FF - prefs.js..extensions.enabledItems: {D1CDB335-D513-4B06-A8CF-BE91FAFBB947}:1.9.1
FF - prefs.js..keyword.URL: "http://search.yahoo.com/search?fr=ffds1&p="


FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Program Files\Real\RealPlayer\browserrecord [2009/05/01 01:49:41 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{D1CDB335-D513-4B06-A8CF-BE91FAFBB947}: C:\Users\farida\AppData\Local\{D1CDB335-D513-4B06-A8CF-BE91FAFBB947} [2010/06/20 01:39:09 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.19\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/03/31 08:01:38 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.19\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/04/15 15:30:48 | 000,000,000 | ---D | M]

[2008/12/20 00:08:38 | 000,000,000 | ---D | M] -- C:\Users\farida\AppData\Roaming\Mozilla\Extensions
[2010/10/17 07:24:39 | 000,000,000 | ---D | M] -- C:\Users\farida\AppData\Roaming\Mozilla\Firefox\Profiles\hotdei75.default\extensions
[2010/06/14 14:04:47 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\farida\AppData\Roaming\Mozilla\Firefox\Profiles\hotdei75.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2009/02/20 21:37:13 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Users\farida\AppData\Roaming\Mozilla\Firefox\Profiles\hotdei75.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2010/10/17 07:54:32 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2010/01/26 23:01:13 | 000,000,000 | ---D | M] (Internal security) -- C:\Program Files\Mozilla Firefox\extensions\{8CE11043-9A15-4207-A565-0C94C42D590D}
[2005/01/19 04:17:02 | 000,053,355 | ---- | M] (Oracle Corporation) -- C:\Program Files\Mozilla Firefox\plugins\NPJinit13121.dll

O1 HOSTS File: ([2009/12/18 09:23:12 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll (Yahoo! Inc.)
O2 - BHO: (Yahooo Search Protection) - {25BC7718-0BFA-40EA-B381-4B2D9732D686} - C:\Program Files\Yahoo!\Search Protection\ysp.dll (Yahoo! Inc.)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Sophos Web Content Scanner) - {39EA7695-B3F2-4C44-A4BC-297ADA8FD235} - C:\Program Files\Sophos\Sophos Anti-Virus\SophosBHO.dll (Sophos Plc)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll File not found
O2 - BHO: (Yahoo! IE Services Button) - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll (Yahoo! Inc.)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\Program Files\Java\jre1.6.0\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll (Dell Inc.)
O3 - HKLM\..\Toolbar: (Veoh Web Player Video Finder) - {0FBB9689-D3D7-4f7a-A2E2-585B10099BFC} - C:\Program Files\Veoh Networks\VeohWebPlayer\VeohIEToolbar.dll (Veoh Networks Inc)
O3 - HKLM\..\Toolbar: (Veoh Video Compass) - {52836EB0-631A-47B1-94A6-61F9D9112DAE} - C:\Program Files\Veoh Networks\Veoh Video Compass\SearchRecsPlugin.dll (Veoh Networks)
O3 - HKLM\..\Toolbar: (Veoh Browser Plug-in) - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll (Veoh Networks Inc)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [00PCTFW] C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe (PC Tools)
O4 - HKLM..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [DELL Webcam Manager] C:\Program Files\Dell\Dell Webcam Manager\DellWMgr.exe (Creative Technology Ltd.)
O4 - HKLM..\Run: [ECenter] C:\DELL\E-Center\EULALauncher.exe ( )
O4 - HKLM..\Run: [Ironufeworit] C:\Users\farida\AppData\Local\adonubesidacibi.DLL File not found
O4 - HKLM..\Run: [NBKeyScan] C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe (Nero AG)
O4 - HKLM..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [PCMService] C:\Program Files\Dell\MediaDirect\PCMService.exe (CyberLink Corp.)
O4 - HKLM..\Run: [SigmatelSysTrayApp] C:\Program Files\Sigmatel\C-Major Audio\WDM\sttray.exe (SigmaTel, Inc.)
O4 - HKLM..\Run: [Symantec PIF AlertEng] C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe (Symantec Corporation)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [agknkwfk] C:\Users\farida\AppData\Local\tpwcnh\fychsftav.exe File not found
O4 - HKCU..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe (Nero AG)
O4 - HKCU..\Run: [cdloader] C:\Users\farida\AppData\Roaming\mjusbsp\cdloader2.exe (magicJack L.P.)
O4 - HKCU..\Run: [DellSupport] C:\Program Files\DellSupport\DSAgnt.exe (Gteko Ltd.)
O4 - HKCU..\Run: [gcmbwquf] C:\Users\farida\AppData\Local\hlmwnddnu\bngllxrtssd.exe File not found
O4 - HKCU..\Run: [googletalk] C:\Users\farida\AppData\Roaming\Google\Google Talk\googletalk.exe (Google)
O4 - HKCU..\Run: [Imoxet] C:\Users\farida\AppData\Local\qmldola0.DLL File not found
O4 - HKCU..\Run: [Messenger (Yahoo!)] C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O4 - HKCU..\Run: [Search Protection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe File not found
O4 - HKCU..\Run: [Veoh] C:\Program Files\Veoh Networks\Veoh\VeohClient.exe (Veoh Networks)
O4 - HKCU..\Run: [VeohPlugin] C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe (Veoh Networks)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: EnableShellExecuteHooks = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - Reg Error: Key error. File not found
O9 - Extra Button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll (Yahoo! Inc.)
O9 - Extra 'Tools' menuitem : Yahoo! Search Protection - {BBF74FB9-ABCD-4678-880A-2511DAABB5E1} - C:\Program Files\Yahoo!\Search Protection\ysp.dll (Yahoo! Inc.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 209.18.47.61 209.18.47.62
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - AppInit_DLLs: (C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL) - C:\Program Files\Sophos\Sophos Anti-Virus\sophos_detoured.dll (Sophos Plc)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\Windows\System32\igfxdev.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Users\farida\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: C:\Users\farida\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O28 - HKLM ShellExecuteHooks: {4F07DA45-8170-4859-9B5F-037EF2970034} - C:\Program Files\Tall Emu\Online Armor\oaevent.dll (Tall Emu)
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 16:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - File not found
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: Wmi - C:\Windows\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found


SafeBootMin: AppMgmt - C:\Windows\System32\appmgmts.dll File not found
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: NTDS - File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SAVService - C:\Program Files\Sophos\Sophos Anti-Virus\SavService.exe (Sophos Plc)
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

SafeBootNet: AppMgmt - C:\Windows\System32\appmgmts.dll File not found
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS - File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SAVService - C:\Program Files\Sophos\Sophos Anti-Virus\SavService.exe (Sophos Plc)
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

ActiveX: {0291E591-EA41-4c82-8106-3DC6CE7F7664} - Reg Error: Value error.
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} -
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} - Reg Error: Value error.
ActiveX: {347B0667-C7ED-429B-BDE3-CC8D3BACAA31} - Reg Error: Value error.
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} -
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.7
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {A17E30C4-A9BA-11D4-8673-60DB54C10000} - Reg Error: Value error.
ActiveX: {AA218328-0EA8-4D70-8972-E987A9190FF4} - Reg Error: Value error.
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Macromedia Shockwave Flash
ActiveX: {DAA94A2A-2A8D-4D3B-9DB8-56FBECED082D} - Microsoft .NET Framework 1.1 Security Update (KB953297)
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - Reg Error: Value error.
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP

Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\Windows\System32\DivX.dll (DivX, Inc.)
Drivers32: vidc.yv12 - C:\Windows\System32\DivX.dll (DivX, Inc.)
CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2010/10/17 08:49:12 | 000,574,464 | ---- | C] (OldTimer Tools) -- C:\Users\farida\Desktop\OTL(2).com
[2010/10/17 08:37:21 | 000,000,000 | ---D | C] -- C:\Users\farida\Desktop\Java Ra Oct 17
[2010/10/17 08:30:17 | 000,000,000 | ---D | C] -- C:\Windows\hsperfdata_farida
[2010/10/17 07:57:42 | 000,000,000 | ---D | C] -- C:\glassfishv3
[2010/10/17 07:52:11 | 000,000,000 | ---D | C] -- C:\Users\farida\Desktop\OLder
[2010/10/15 18:45:01 | 000,000,000 | ---D | C] -- C:\e2074d693ba3e813cd9748
[2010/10/15 03:07:47 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2010/10/15 03:02:43 | 000,000,000 | ---D | C] -- C:\3cc322070b9d3e2031a657a19f
[2010/10/14 20:01:53 | 000,000,000 | ---D | C] -- C:\d51c4b9e22c2eb1279d539ac0b0e
[2010/10/08 08:19:10 | 000,000,000 | ---D | C] -- C:\5d1d4f22b6c772de7b23c50980f1
[2010/10/07 03:10:48 | 000,000,000 | ---D | C] -- C:\b1e08111a9af0bf642a5
[2010/10/05 21:43:54 | 000,000,000 | ---D | C] -- C:\f2f34a06cd70843d3169d1
[2010/10/02 07:14:19 | 000,000,000 | ---D | C] -- C:\804cfc12cd3132041c
[2010/09/30 19:56:32 | 000,000,000 | ---D | C] -- C:\f91aa9f05d0b9d92e51c
[2010/09/29 20:00:45 | 000,000,000 | ---D | C] -- C:\a85dee1f1c87ffe0d3
[2010/09/26 18:04:22 | 000,000,000 | ---D | C] -- C:\49c84d20ce82bc9d29fc
[2010/09/24 20:13:33 | 000,000,000 | ---D | C] -- C:\c2fac20448449051e3e237
[2010/09/21 22:44:41 | 000,000,000 | ---D | C] -- C:\youn
[2010/09/21 03:03:47 | 000,000,000 | ---D | C] -- C:\f57f25bb473a2b2328a4bdde6cb7
[2010/09/19 13:10:12 | 000,000,000 | ---D | C] -- C:\a22f24adf768f691ab0543
[2010/09/18 12:50:57 | 000,000,000 | ---D | C] -- C:\b66c0882655b40c27988d3d63bbd96
[1 C:\Users\farida\Desktop\*.tmp files -> C:\Users\farida\Desktop\*.tmp -> ]
========== Files - Modified Within 30 Days ==========

[2010/10/17 09:00:10 | 000,003,584 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010/10/17 09:00:10 | 000,003,584 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010/10/17 08:44:57 | 000,574,464 | ---- | M] (OldTimer Tools) -- C:\Users\farida\Desktop\OTL(2).com
[2010/10/17 08:41:00 | 000,000,886 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2010/10/17 08:40:02 | 000,000,912 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-965788493-1340469518-1114669241-1000UA.job
[2010/10/17 08:31:08 | 000,000,096 | ---- | M] () -- C:\Users\farida\.asadminpass
[2010/10/17 07:45:16 | 141,274,120 | ---- | M] () -- C:\Users\farida\Desktop\java_ee_sdk-6u1-jdk-windows.exe
[2010/10/17 07:03:17 | 000,002,565 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\VPN Client.lnk
[2010/10/17 07:03:12 | 000,002,485 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\QuickSet.lnk
[2010/10/17 07:00:42 | 000,000,882 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2010/10/17 06:59:44 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010/10/17 00:40:04 | 000,000,860 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-965788493-1340469518-1114669241-1000Core.job
[2010/10/17 00:33:08 | 000,000,418 | ---- | M] () -- C:\Windows\tasks\ParetoLogic Update Version2.job
[2010/10/16 23:00:01 | 000,000,530 | ---- | M] () -- C:\Windows\tasks\Daily.job
[2010/10/16 23:00:01 | 000,000,530 | ---- | M] () -- C:\Windows\tasks\Daily [0].job
[2010/10/16 18:00:02 | 000,000,444 | ---- | M] () -- C:\Windows\tasks\ParetoLogic Registration.job
[2010/10/13 01:56:11 | 000,046,592 | ---- | M] () -- C:\Users\farida\Documents\October 2010ADILHI.doc
[2010/10/12 22:46:09 | 000,031,232 | ---- | M] () -- C:\Users\farida\Documents\October 2010 Mansoor health insurance.doc
[2010/10/09 08:50:24 | 000,000,069 | ---- | M] () -- C:\Windows\NeroDigital.ini
[2010/10/08 19:37:14 | 248,282,269 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2010/10/06 20:07:51 | 000,259,584 | ---- | M] () -- C:\Users\farida\Documents\citioct2010second.doc
[2010/10/03 07:46:35 | 000,710,026 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2010/10/03 07:46:35 | 000,135,390 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2010/10/02 22:13:31 | 000,021,504 | ---- | M] () -- C:\Users\farida\Desktop\karthik settlement.xls
[2010/09/28 20:45:11 | 000,015,295 | ---- | M] () -- C:\ProgramData\LUUnInstall.LiveUpdate
[2010/09/26 03:44:00 | 000,000,382 | ---- | M] () -- C:\Windows\tasks\DriverCure.job
[2010/09/23 07:45:06 | 000,001,973 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2010/09/21 22:53:30 | 000,207,360 | ---- | M] () -- C:\Users\farida\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/09/19 22:09:40 | 000,026,112 | ---- | M] () -- C:\Users\farida\Desktop\Aug9Bill.xls
[1 C:\Users\farida\Desktop\*.tmp files -> C:\Users\farida\Desktop\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/10/17 08:31:08 | 000,000,096 | ---- | C] () -- C:\Users\farida\.asadminpass
[2010/10/17 07:55:34 | 141,274,120 | ---- | C] () -- C:\Users\farida\Desktop\java_ee_sdk-6u1-jdk-windows.exe
[2010/10/13 01:56:06 | 000,046,592 | ---- | C] () -- C:\Users\farida\Documents\October 2010ADILHI.doc
[2010/10/12 22:46:03 | 000,031,232 | ---- | C] () -- C:\Users\farida\Documents\October 2010 Mansoor health insurance.doc
[2010/10/06 20:07:48 | 000,259,584 | ---- | C] () -- C:\Users\farida\Documents\citioct2010second.doc
[2010/10/02 08:58:27 | 000,021,504 | ---- | C] () -- C:\Users\farida\Desktop\karthik settlement.xls
[2010/09/26 18:05:30 | 122,064,224 | ---- | C] () -- C:\Users\farida\Desktop\SEP_Setup_32bit_11.0.6.exe
[2010/06/10 23:43:56 | 000,000,172 | ---- | C] () -- C:\Windows\ODBC.INI
[2010/05/12 07:03:35 | 000,000,176 | ---- | C] () -- C:\Windows\System32\MRT.INI
[2009/09/24 16:06:35 | 000,116,224 | ---- | C] () -- C:\Windows\System32\pdfmonnt.dll
[2009/09/24 16:06:33 | 000,000,164 | ---- | C] () -- C:\Windows\System32\psconv.ini
[2009/08/03 15:07:42 | 000,403,816 | ---- | C] () -- C:\Windows\System32\OGACheckControl.dll
[2009/03/08 15:04:54 | 000,036,962 | ---- | C] () -- C:\Windows\System32\ActPanel.dll
[2009/02/15 01:04:42 | 000,000,600 | ---- | C] () -- C:\Users\farida\AppData\Local\PUTTY.RND
[2009/01/17 15:41:31 | 000,100,368 | ---- | C] () -- C:\Windows\System32\drivers\VBoxDrv.sys
[2008/11/18 21:53:00 | 000,000,094 | ---- | C] () -- C:\Users\farida\AppData\Local\fusioncache.dat
[2008/11/18 21:47:49 | 000,006,324 | ---- | C] () -- C:\Users\farida\AppData\Local\d3d9caps.dat
[2008/11/06 11:37:32 | 003,596,288 | ---- | C] () -- C:\Windows\System32\qt-dx331.dll
[2008/11/06 11:33:02 | 000,012,288 | ---- | C] () -- C:\Windows\System32\DivXWMPExtType.dll
[2008/03/04 21:52:34 | 000,286,720 | ---- | C] () -- C:\Windows\System32\libcurl.dll
[2008/02/08 01:09:11 | 000,000,069 | ---- | C] () -- C:\Windows\NeroDigital.ini
[2008/01/05 23:53:52 | 000,015,295 | ---- | C] () -- C:\ProgramData\LUUnInstall.LiveUpdate
[2007/11/25 04:01:45 | 000,207,360 | ---- | C] () -- C:\Users\farida\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007/10/31 18:25:37 | 000,910,304 | ---- | C] () -- C:\Windows\System32\igmedkrn.dll
[2007/10/31 18:25:37 | 000,249,856 | ---- | C] () -- C:\Windows\System32\igfxTMM.dll
[2007/10/31 18:25:37 | 000,204,800 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1272.dll
[2007/10/31 18:25:31 | 000,016,480 | ---- | C] () -- C:\Windows\System32\rixdicon.dll
[2007/10/31 12:39:54 | 000,059,904 | ---- | C] () -- C:\Windows\System32\zlib1.dll
[2007/10/31 10:40:23 | 000,065,536 | ---- | C] () -- C:\Windows\System32\bcmwlrmt.dll
[2007/07/16 13:58:10 | 000,197,408 | ---- | C] () -- C:\Windows\System32\vpnapi.dll
[2007/05/17 15:58:10 | 000,143,360 | ---- | C] () -- C:\Windows\System32\libexpatw.dll
[2006/11/02 05:25:44 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll
[2006/11/02 02:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini

========== Custom Scans ==========
< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[2007/03/21 14:33:40 | 000,065,536 | ---- | M] () Unable to obtain MD5 -- C:\Windows\System32\bcmwlrmt.dll
[2006/11/02 04:47:18 | 000,228,968 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\rsaenh.dll
[2007/10/31 18:24:31 | 000,223,232 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\SLC.dll

< %systemroot%\system32\*.exe /lockedfiles >
[2007/03/21 14:33:44 | 001,548,288 | ---- | M] (Dell Inc.) Unable to obtain MD5 -- C:\Windows\System32\WLTRAY.EXE

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2006/11/02 05:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
[2006/11/02 05:34:05 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV
[2006/11/02 05:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV
[2006/11/02 05:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV
[2006/11/02 05:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV

< %systemroot%\system32\*.sys >
[2006/11/02 02:09:42 | 000,009,029 | ---- | M] () -- C:\Windows\System32\ANSI.SYS
[2008/02/12 23:09:22 | 000,224,824 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\clfs.sys
[2006/11/02 02:09:45 | 000,027,097 | ---- | M] () -- C:\Windows\System32\country.sys
[2006/11/02 02:09:41 | 000,004,768 | ---- | M] () -- C:\Windows\System32\HIMEM.SYS
[2006/11/02 02:09:44 | 000,042,809 | ---- | M] () -- C:\Windows\System32\KEY01.SYS
[2006/11/02 02:09:44 | 000,042,537 | ---- | M] () -- C:\Windows\System32\KEYBOARD.SYS
[2006/11/02 02:09:29 | 000,027,866 | ---- | M] () -- C:\Windows\System32\NTDOS.SYS
[2006/11/02 02:09:35 | 000,029,146 | ---- | M] () -- C:\Windows\System32\NTDOS404.SYS
[2006/11/02 02:09:38 | 000,029,370 | ---- | M] () -- C:\Windows\System32\NTDOS411.SYS
[2006/11/02 02:09:40 | 000,029,274 | ---- | M] () -- C:\Windows\System32\NTDOS412.SYS
[2006/11/02 02:09:31 | 000,029,146 | ---- | M] () -- C:\Windows\System32\NTDOS804.SYS
[2006/11/02 02:09:20 | 000,033,952 | ---- | M] () -- C:\Windows\System32\NTIO.SYS
[2006/11/02 02:09:23 | 000,034,672 | ---- | M] () -- C:\Windows\System32\NTIO404.SYS
[2006/11/02 02:09:24 | 000,035,776 | ---- | M] () -- C:\Windows\System32\NTIO411.SYS
[2006/11/02 02:09:26 | 000,035,536 | ---- | M] () -- C:\Windows\System32\NTIO412.SYS
[2006/11/02 02:09:22 | 000,034,672 | ---- | M] () -- C:\Windows\System32\NTIO804.SYS
[2009/08/14 09:01:34 | 002,031,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys

< %systemroot%\system32\drivers\*.dll >

< %systemroot%\system32\drivers\*.ini >

< %systemroot%\system32\drivers\*.exe >
[2007/04/29 00:24:30 | 000,386,560 | ---- | M] (Conexant Systems, Inc.) -- C:\Windows\System32\drivers\XAudio.exe

< %SYSTEMDRIVE%\*.* >
[2006/09/18 16:43:36 | 000,000,024 | ---- | M] () -- C:\autoexec.bat
[2006/11/02 04:53:57 | 000,438,840 | RHS- | M] () -- C:\bootmgr
[2006/11/10 16:59:07 | 000,008,192 | R-S- | M] () -- C:\BOOTSECT.BAK
[2009/12/10 11:25:44 | 000,036,396 | ---- | M] () -- C:\caavsetupLog.txt
[2009/12/11 06:12:11 | 000,067,632 | ---- | M] () -- C:\caisslog.txt
[2010/06/19 14:33:30 | 000,000,000 | ---- | M] () -- C:\cd
[2009/12/18 09:32:58 | 000,017,371 | ---- | M] () -- C:\ComboFix.txt
[2009/12/18 00:19:52 | 000,011,943 | ---- | M] () -- C:\ComboFixo.txt
[2006/09/18 16:43:37 | 000,000,010 | ---- | M] () -- C:\config.sys
[2007/10/31 18:25:44 | 000,004,603 | RH-- | M] () -- C:\dell.sdr
[2010/10/17 08:39:23 | 000,003,719 | ---- | M] () -- C:\JavaRa.log
[2008/10/20 23:02:02 | 000,000,928 | ---- | M] () -- C:\net_save.dna
[2010/10/17 06:59:34 | 2451,120,128 | -HS- | M] () -- C:\pagefile.sys
[2008/05/04 16:35:37 | 000,000,146 | ---- | M] () -- C:\YServer.txt

< %PROGRAMFILES%\*. >
[2009/09/24 16:06:34 | 000,000,000 | ---D | M] -- C:\Program Files\8848Soft
[2009/12/18 22:10:50 | 000,000,000 | ---D | M] -- C:\Program Files\Adobe
[2008/12/03 04:42:14 | 000,000,000 | ---D | M] -- C:\Program Files\AVG
[2007/10/31 10:43:28 | 000,000,000 | ---D | M] -- C:\Program Files\Broadcom
[2010/06/10 23:42:18 | 000,000,000 | ---D | M] -- C:\Program Files\Business Objects
[2009/12/10 11:21:01 | 000,000,000 | ---D | M] -- C:\Program Files\CA
[2008/05/09 16:41:46 | 000,000,000 | ---D | M] -- C:\Program Files\Canon
[2010/05/18 03:29:09 | 000,000,000 | ---D | M] -- C:\Program Files\CDisplayEx
[2010/06/10 22:56:16 | 000,000,000 | ---D | M] -- C:\Program Files\CE Remote Tools
[2007/11/14 22:31:02 | 000,000,000 | ---D | M] -- C:\Program Files\Cisco Systems
[2010/02/27 00:10:53 | 000,000,000 | ---D | M] -- C:\Program Files\Common Files
[2007/10/31 10:30:35 | 000,000,000 | ---D | M] -- C:\Program Files\CONEXANT
[2007/10/31 10:39:40 | 000,000,000 | ---D | M] -- C:\Program Files\Creative
[2007/10/31 10:38:58 | 000,000,000 | ---D | M] -- C:\Program Files\Creative Live! Cam
[2007/10/31 10:49:47 | 000,000,000 | ---D | M] -- C:\Program Files\CyberLink
[2007/10/31 10:57:49 | 000,000,000 | ---D | M] -- C:\Program Files\Dell
[2007/10/31 10:52:33 | 000,000,000 | ---D | M] -- C:\Program Files\Dell DataSafe Online
[2007/10/31 10:54:35 | 000,000,000 | ---D | M] -- C:\Program Files\Dell Network Assistant
[2007/10/31 10:51:23 | 000,000,000 | ---D | M] -- C:\Program Files\DellSupport
[2007/10/31 18:25:26 | 000,000,000 | ---D | M] -- C:\Program Files\DellTPad
[2007/10/31 10:41:38 | 000,000,000 | ---D | M] -- C:\Program Files\Digital Line Detect
[2009/12/31 01:01:31 | 000,000,000 | ---D | M] -- C:\Program Files\DivX
[2009/03/24 15:52:20 | 000,000,000 | ---D | M] -- C:\Program Files\epson
[2009/12/06 08:39:49 | 000,000,000 | ---D | M] -- C:\Program Files\Google
[2010/06/10 23:01:38 | 000,000,000 | ---D | M] -- C:\Program Files\HTML Help Workshop
[2009/03/08 15:04:54 | 000,000,000 | -H-D | M] -- C:\Program Files\InstallShield Installation Information
[2010/03/31 05:14:18 | 000,000,000 | ---D | M] -- C:\Program Files\Internet Explorer
[2010/08/07 08:57:26 | 000,000,000 | ---D | M] -- C:\Program Files\Java
[2007/11/07 20:56:18 | 000,000,000 | ---D | M] -- C:\Program Files\MagicISO
[2007/11/07 21:04:59 | 000,000,000 | ---D | M] -- C:\Program Files\Mathsoft
[2010/06/10 23:32:47 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Device Emulator
[2006/11/02 07:35:51 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Games
[2007/11/07 14:47:20 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Office
[2007/12/18 05:18:20 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft SDKs
[2010/10/05 21:30:31 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Silverlight
[2010/06/17 22:21:28 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft SQL Server
[2010/06/10 23:29:03 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft SQL Server Compact Edition
[2010/06/10 23:29:04 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Synchronization Services
[2009/03/08 15:18:34 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Virtual PC
[2007/11/07 14:47:18 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Visual Studio
[2009/02/15 00:16:38 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Visual Studio .NET
[2007/11/07 14:45:19 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Visual Studio 8
[2010/06/10 23:42:18 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Visual Studio 9.0
[2010/06/10 22:53:35 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Web Designer Tools
[2009/10/18 01:46:05 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft Works
[2010/06/10 23:36:31 | 000,000,000 | ---D | M] -- C:\Program Files\Microsoft.NET
[2007/10/31 10:40:46 | 000,000,000 | ---D | M] -- C:\Program Files\Modem Diagnostic Tool
[2010/03/11 08:18:41 | 000,000,000 | ---D | M] -- C:\Program Files\Movie Maker
[2010/10/17 08:32:22 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox
[2010/06/10 23:00:47 | 000,000,000 | ---D | M] -- C:\Program Files\MSBuild
[2006/11/02 07:35:51 | 000,000,000 | ---D | M] -- C:\Program Files\MSN
[2007/11/07 13:50:53 | 000,000,000 | ---D | M] -- C:\Program Files\MSXML 4.0
[2007/11/07 20:42:01 | 000,000,000 | ---D | M] -- C:\Program Files\Nero
[2007/10/31 10:41:12 | 000,000,000 | ---D | M] -- C:\Program Files\NetWaiting
[2010/06/22 13:38:10 | 000,000,000 | ---D | M] -- C:\Program Files\Notepad++
[2009/03/08 15:04:54 | 000,000,000 | ---D | M] -- C:\Program Files\Oracle
[2010/02/21 18:43:59 | 000,000,000 | ---D | M] -- C:\Program Files\ParetoLogic
[2010/10/10 07:00:00 | 000,000,000 | ---D | M] -- C:\Program Files\PC Tools Firewall Plus
[2009/11/15 04:42:35 | 000,000,000 | ---D | M] -- C:\Program Files\Picasa2
[2009/09/24 16:06:31 | 000,000,000 | ---D | M] -- C:\Program Files\psconvert
[2008/06/22 13:28:27 | 000,000,000 | ---D | M] -- C:\Program Files\QuickTime
[2008/01/06 23:42:31 | 000,000,000 | ---D | M] -- C:\Program Files\Real
[2009/02/07 20:19:29 | 000,000,000 | ---D | M] -- C:\Program Files\RealVNC
[2006/11/02 07:35:51 | 000,000,000 | ---D | M] -- C:\Program Files\Reference Assemblies
[2007/10/31 10:30:20 | 000,000,000 | ---D | M] -- C:\Program Files\Sigmatel
[2008/11/18 21:54:12 | 000,000,000 | ---D | M] -- C:\Program Files\SiteAdvisor
[2010/02/27 00:10:53 | 000,000,000 | R--D | M] -- C:\Program Files\Skype
[2008/02/08 01:09:05 | 000,000,000 | ---D | M] -- C:\Program Files\SopCast
[2010/02/10 00:22:05 | 000,000,000 | ---D | M] -- C:\Program Files\Sophos
[2009/02/15 21:15:10 | 000,000,000 | ---D | M] -- C:\Program Files\SQLTools 1.5
[2009/01/17 15:41:19 | 000,000,000 | ---D | M] -- C:\Program Files\Sun
[2008/01/07 11:39:00 | 000,000,000 | ---D | M] -- C:\Program Files\SuperNZB
[2008/10/20 23:01:24 | 000,000,000 | ---D | M] -- C:\Program Files\support.com
[2010/09/28 20:45:15 | 000,000,000 | ---D | M] -- C:\Program Files\Symantec
[2009/12/20 09:12:14 | 000,000,000 | ---D | M] -- C:\Program Files\Tall Emu
[2010/06/11 00:49:03 | 000,000,000 | ---D | M] -- C:\Program Files\TeamViewer
[2009/08/26 00:06:34 | 000,000,000 | ---D | M] -- C:\Program Files\The Noble Qur'an V3.0
[2009/12/12 23:05:17 | 000,000,000 | ---D | M] -- C:\Program Files\Trend Micro
[2006/11/02 07:58:18 | 000,000,000 | -H-D | M] -- C:\Program Files\Uninstall Information
[2009/04/20 22:28:45 | 000,000,000 | ---D | M] -- C:\Program Files\Veoh Networks
[2008/01/04 02:41:49 | 000,000,000 | ---D | M] -- C:\Program Files\VideoLAN
[2007/11/07 14:03:30 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Calendar
[2006/11/02 07:40:00 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Collaboration
[2007/10/31 18:20:35 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Defender
[2010/04/16 07:46:19 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Mail
[2009/10/27 22:10:40 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Media Player
[2010/06/10 23:32:13 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Mobile 5.0 SDK R2
[2006/11/02 07:35:51 | 000,000,000 | ---D | M] -- C:\Program Files\Windows NT
[2006/11/02 07:40:00 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Photo Gallery
[2008/01/09 04:42:01 | 000,000,000 | ---D | M] -- C:\Program Files\Windows Sidebar
[2008/01/06 01:01:25 | 000,000,000 | ---D | M] -- C:\Program Files\WinRAR
[2009/11/02 04:17:57 | 000,000,000 | ---D | M] -- C:\Program Files\wkdhgo
[2008/06/22 13:28:26 | 000,000,000 | ---D | M] -- C:\Program Files\Xilisoft
[2009/05/30 09:40:15 | 000,000,000 | ---D | M] -- C:\Program Files\Yahoo!

< %appdata%\*.* >

invisible016
Intermediate
Intermediate

Status :
Online
Offline

Posts : 61
Joined : 2009-11-02
OS : vista

View user profile

Back to top Go down

Re: Sytem very slow Unable to identify Problem Might be virus

Post by invisible016 on Sun Oct 17, 2010 3:03 pm

Hi Here is the second part

< %appdata%\*.* >


< MD5 for: AGP440.SYS >
[2008/01/19 02:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\SoftwareDistribution\Download\b1d48c0a5500e900499764daaa6a0385\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys
[2007/10/31 18:17:12 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=8B10CE1C1F9F1D47E4DEB1A547A00CD4 -- C:\Windows\ERDNT\cache\AGP440.sys
[2007/10/31 18:17:12 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=8B10CE1C1F9F1D47E4DEB1A547A00CD4 -- C:\Windows\System32\drivers\AGP440.sys
[2007/10/31 18:17:12 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=8B10CE1C1F9F1D47E4DEB1A547A00CD4 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_8ed06b47\AGP440.sys
[2007/10/31 18:17:12 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=8B10CE1C1F9F1D47E4DEB1A547A00CD4 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6000.16400_none_b82caac9c18a4e3b\AGP440.sys
[2007/10/31 18:17:12 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=BF34B4A0E0B64440C5389AA6B902F4AD -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6000.20496_none_b85af81edaeb8461\AGP440.sys
[2006/11/02 04:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys

< MD5 for: ATAPI.SYS >
[2008/01/19 02:41:30 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\SoftwareDistribution\Download\b1d48c0a5500e900499764daaa6a0385\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
[2007/10/31 18:17:55 | 000,021,688 | ---- | M] (Microsoft Corporation) MD5=3E39E69F31F95D056703212E94320899 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_e6b2949c\atapi.sys
[2007/10/31 18:17:55 | 000,021,688 | ---- | M] (Microsoft Corporation) MD5=3E39E69F31F95D056703212E94320899 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20544_none_dbb443eb3d9db847\atapi.sys
[2006/11/02 04:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
[2007/10/31 18:17:48 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=5653737BAD8C6C10136451C195C19881 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20485_none_db8a029f3dbd443b\atapi.sys
[2007/10/31 18:25:08 | 000,021,688 | ---- | M] (Microsoft Corporation) MD5=61CA2C1E145809813C28752298CF9843 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_5da5d093\atapi.sys
[2007/10/31 18:25:08 | 000,021,688 | ---- | M] (Microsoft Corporation) MD5=61CA2C1E145809813C28752298CF9843 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20580_none_db8503133dc1c2af\atapi.sys
[2007/10/31 18:25:08 | 000,021,688 | ---- | M] (Microsoft Corporation) MD5=7EB55F6BEFB392BD312CD0CD5263305D -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_6c3af7d3\atapi.sys
[2007/10/31 18:25:08 | 000,021,688 | ---- | M] (Microsoft Corporation) MD5=7EB55F6BEFB392BD312CD0CD5263305D -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16470_none_db063634249c06f4\atapi.sys
[2007/10/31 18:17:40 | 000,021,688 | ---- | M] (Microsoft Corporation) MD5=9E7E85EC61D1C9C3171CC08427108863 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_5a9555b4\atapi.sys
[2007/10/31 18:17:40 | 000,021,688 | ---- | M] (Microsoft Corporation) MD5=9E7E85EC61D1C9C3171CC08427108863 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20509_none_dbe4850d3d78c736\atapi.sys
[2007/10/31 18:17:48 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=A779CA2C76DA4FCB595E692C05E8E4EB -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_82339ef2\atapi.sys
[2007/10/31 18:17:48 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=A779CA2C76DA4FCB595E692C05E8E4EB -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16391_none_daf194c024ab5b06\atapi.sys
[2008/02/12 23:07:12 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_7de13c21\atapi.sys
[2008/02/12 23:07:12 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\atapi.sys
[2008/02/12 23:07:12 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=E03E8C99D15D0381E02743C36AFC7C6F -- C:\Windows\ERDNT\cache\atapi.sys
[2008/02/12 23:07:12 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=E03E8C99D15D0381E02743C36AFC7C6F -- C:\Windows\System32\drivers\atapi.sys
[2008/02/12 23:07:12 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=E03E8C99D15D0381E02743C36AFC7C6F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_64dfd8ea\atapi.sys
[2008/02/12 23:07:12 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=E03E8C99D15D0381E02743C36AFC7C6F -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\atapi.sys

< MD5 for: CNGAUDIT.DLL >
[2006/11/02 04:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\ERDNT\cache\cngaudit.dll
[2006/11/02 04:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll
[2006/11/02 04:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll

< MD5 for: DISK.SYS >
[2008/01/19 02:42:20 | 000,055,352 | ---- | M] (Microsoft Corporation) MD5=64109E623ABD6955C8FB110B592E68B7 -- C:\Windows\SoftwareDistribution\Download\b1d48c0a5500e900499764daaa6a0385\x86_disk.inf_31bf3856ad364e35_6.0.6001.18000_none_f9c681e4742c835a\disk.sys
[2006/11/02 04:49:51 | 000,052,840 | ---- | M] (Microsoft Corporation) MD5=841AF4C4D41D3E3B2F244E976B0F7963 -- C:\Windows\System32\drivers\disk.sys
[2006/11/02 04:49:51 | 000,052,840 | ---- | M] (Microsoft Corporation) MD5=841AF4C4D41D3E3B2F244E976B0F7963 -- C:\Windows\System32\DriverStore\FileRepository\disk.inf_e0b0b355\disk.sys

< MD5 for: EVENTLOG.DLL >
[2008/01/10 12:43:00 | 000,028,791 | ---- | M] () MD5=01CE8D74F220AC757728906DADA2E0C7 -- C:\Users\farida\Desktop\desktop folder\perl\ActivePerl-5.10.0.1002-MSWin32-x86-283697\perl\lib\auto\Win32\EventLog\EventLog.dll

< MD5 for: IASTOR.SYS >
[2007/04/29 01:43:22 | 000,277,784 | ---- | M] (Intel Corporation) MD5=FD7F9D74C2B35DBDA400804A3F5ED5D8 -- C:\Drivers\storage\R154200\iastor.sys
[2007/04/29 01:43:22 | 000,277,784 | ---- | M] (Intel Corporation) MD5=FD7F9D74C2B35DBDA400804A3F5ED5D8 -- C:\Windows\System32\drivers\iaStor.sys
[2007/04/29 01:43:22 | 000,277,784 | ---- | M] (Intel Corporation) MD5=FD7F9D74C2B35DBDA400804A3F5ED5D8 -- C:\Windows\System32\DriverStore\FileRepository\iaahci.inf_1cb29a96\iaStor.sys
[2007/04/29 01:43:22 | 000,277,784 | ---- | M] (Intel Corporation) MD5=FD7F9D74C2B35DBDA400804A3F5ED5D8 -- C:\Windows\System32\DriverStore\FileRepository\iastor.inf_8f0cb06b\iaStor.sys

< MD5 for: IASTORV.SYS >
[2008/01/19 02:42:51 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\SoftwareDistribution\Download\b1d48c0a5500e900499764daaa6a0385\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys
[2006/11/02 04:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\drivers\iaStorV.sys
[2006/11/02 04:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys

< MD5 for: LOGEVENT.DLL >
[2006/11/02 04:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\logevent.dll

< MD5 for: NETLOGON.DLL >
[2006/11/02 04:46:11 | 000,559,616 | ---- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -- C:\Windows\ERDNT\cache\netlogon.dll
[2006/11/02 04:46:11 | 000,559,616 | ---- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -- C:\Windows\System32\netlogon.dll
[2006/11/02 04:46:11 | 000,559,616 | ---- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6000.16386_none_fb80f5473b0ed783\netlogon.dll
[2008/01/19 02:35:36 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\SoftwareDistribution\Download\b1d48c0a5500e900499764daaa6a0385\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll

< MD5 for: NVSTOR.SYS >
[2006/11/02 04:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\drivers\nvstor.sys
[2006/11/02 04:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys
[2008/01/19 02:42:09 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\SoftwareDistribution\Download\b1d48c0a5500e900499764daaa6a0385\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys

< MD5 for: SCECLI.DLL >
[2008/01/19 02:36:19 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\SoftwareDistribution\Download\b1d48c0a5500e900499764daaa6a0385\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll
[2006/11/02 04:46:12 | 000,176,640 | ---- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 -- C:\Windows\ERDNT\cache\scecli.dll
[2006/11/02 04:46:12 | 000,176,640 | ---- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 -- C:\Windows\System32\scecli.dll
[2006/11/02 04:46:12 | 000,176,640 | ---- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6000.16386_none_35d7205fdc305e3e\scecli.dll

< MD5 for: USBSTOR.SYS >
[2007/10/31 18:22:51 | 000,055,296 | ---- | M] (Microsoft Corporation) MD5=7887CE56934E7F104E98C975F47353C5 -- C:\Windows\System32\drivers\USBSTOR.SYS
[2007/10/31 18:22:51 | 000,055,296 | ---- | M] (Microsoft Corporation) MD5=7887CE56934E7F104E98C975F47353C5 -- C:\Windows\System32\DriverStore\FileRepository\usbstor.inf_8416e98e\USBSTOR.SYS
[2007/10/31 18:22:51 | 000,055,296 | ---- | M] (Microsoft Corporation) MD5=7887CE56934E7F104E98C975F47353C5 -- C:\Windows\winsxs\x86_usbstor.inf_31bf3856ad364e35_6.0.6000.16478_none_465c5f209ade1e53\USBSTOR.SYS
[2007/10/31 18:22:51 | 000,055,296 | ---- | M] (Microsoft Corporation) MD5=7DA1833F2B2500C755AB6C81C5ABFC88 -- C:\Windows\winsxs\x86_usbstor.inf_31bf3856ad364e35_6.0.6000.20588_none_46db2bffb403da0e\USBSTOR.SYS
[2008/01/19 00:53:22 | 000,055,296 | ---- | M] (Microsoft Corporation) MD5=87BA6B83C5D19B69160968D07D6E2982 -- C:\Windows\SoftwareDistribution\Download\b1d48c0a5500e900499764daaa6a0385\x86_usbstor.inf_31bf3856ad364e35_6.0.6001.18000_none_48864eb697d31b43\USBSTOR.SYS
[2006/11/02 03:55:05 | 000,054,784 | ---- | M] (Microsoft Corporation) MD5=FDBAABF07244C60B0F4E0A6E71A107C6 -- C:\Windows\System32\DriverStore\FileRepository\usbstor.inf_bb2778a0\USBSTOR.SYS

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-10-17 12:23:17

========== Alternate Data Streams ==========

@Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:62E2D794
@Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:C31F31E6
@Alternate Data Stream - 100 bytes -> C:\ProgramData\TEMP:0F8F5844

< End of report >

invisible016
Intermediate
Intermediate

Status :
Online
Offline

Posts : 61
Joined : 2009-11-02
OS : vista

View user profile

Back to top Go down

Re: Sytem very slow Unable to identify Problem Might be virus

Post by Belahzur on Sun Oct 17, 2010 10:59 pm

Hello.

1. If you are using Firefox, make sure that your download settings are as follows:

* Tools->Options->Main tab
* Set to "Always ask me where to Save the files".

2. During the download, rename Combofix to svchost as follows:





3. It is important you rename Combofix during the download, but not after.
4. Please do not rename Combofix to other names, but only to the one indicated.
5. Close any open browsers.
6. We need to disable your local AV (Anti-virus) before running Combofix.

  • See [You must be registered and logged in to see this link.] for how to disable your AV.
  • Double click on svchost.exe.
  • Follow the prompts. NOTE:
  • Allow combofix to run
  • Post C:\combofix.txt back here.

    Note:
    Do not mouse click combofix's window whilst it's running. That may cause it to stall.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Status :
Online
Offline

Posts : 34916
Joined : 2008-08-03
Gender : Male
OS : XP SP3 Media Centre

View user profile

Back to top Go down

Re: Sytem very slow Unable to identify Problem Might be virus

Post by invisible016 on Mon Oct 18, 2010 3:18 am

Hi Here is the Combofix.txt file.

ComboFix 10-10-17.02 - farida 10/17/2010 21:18:38.3.2 - x86
Microsoft® Windows Vista™ Home Basic 6.0.6000.0.1252.1.1033.18.2038.1098 [GMT -5:00]
Running from: c:\users\farida\Desktop\ComboFix.exe
AV: Sophos Anti-Virus *On-access scanning disabled* (Updated) {3F13C776-3CBE-4DE9-8BF6-09E5183CA2BD}
FW: PC Tools Firewall Plus *enabled* {ABBD5028-5A95-4B6D-996E-98D64AE88D52}
SP: Sophos Anti-Virus *disabled* (Updated) {A8CA403D-C4B1-4BBA-9FA7-B73C144CBC5C}
SP: Windows Defender *disabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Mozilla Firefox\extensions\{8CE11043-9A15-4207-A565-0C94C42D590D}
c:\program files\Mozilla Firefox\extensions\{8CE11043-9A15-4207-A565-0C94C42D590D}\chrome.manifest
c:\program files\Mozilla Firefox\extensions\{8CE11043-9A15-4207-A565-0C94C42D590D}\chrome\content\timer.xul
c:\program files\Mozilla Firefox\extensions\{8CE11043-9A15-4207-A565-0C94C42D590D}\install.rdf
c:\users\farida\AppData\Roaming\SystemProc
c:\users\farida\qualnet-4.0.1-evaluation-installer.exe

.
((((((((((((((((((((((((( Files Created from 2010-09-18 to 2010-10-18 )))))))))))))))))))))))))))))))
.

2010-10-18 02:44 . 2010-10-18 02:44 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Local\temp
2010-10-18 02:44 . 2010-10-18 02:44 -------- d-----w- c:\users\Public\AppData\Local\temp
2010-10-18 02:44 . 2010-10-18 02:44 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-10-18 02:12 . 2010-10-18 02:13 -------- d-----w- C:\32788R22FWJFW
2010-10-17 13:30 . 2010-10-17 13:31 -------- d-----w- c:\windows\hsperfdata_farida
2010-10-17 12:57 . 2010-10-17 13:29 -------- d-----w- C:\glassfishv3
2010-10-15 23:45 . 2010-10-15 23:45 -------- d-----w- C:\e2074d693ba3e813cd9748
2010-10-15 08:02 . 2010-10-15 08:02 -------- d-----w- C:\3cc322070b9d3e2031a657a19f
2010-10-15 01:01 . 2010-10-15 01:01 -------- d-----w- C:\d51c4b9e22c2eb1279d539ac0b0e
2010-10-08 13:19 . 2010-10-08 13:19 -------- d-----w- C:\5d1d4f22b6c772de7b23c50980f1
2010-10-07 08:10 . 2010-10-07 08:10 -------- d-----w- C:\b1e08111a9af0bf642a5
2010-10-06 02:43 . 2010-10-06 02:43 -------- d-----w- C:\f2f34a06cd70843d3169d1
2010-10-02 12:14 . 2010-10-02 12:14 -------- d-----w- C:\804cfc12cd3132041c
2010-10-01 00:56 . 2010-10-01 00:57 -------- d-----w- C:\f91aa9f05d0b9d92e51c
2010-09-30 01:00 . 2010-09-30 01:00 -------- d-----w- C:\a85dee1f1c87ffe0d3
2010-09-26 23:04 . 2010-09-26 23:04 -------- d-----w- C:\49c84d20ce82bc9d29fc
2010-09-25 01:13 . 2010-09-25 01:13 -------- d-----w- C:\c2fac20448449051e3e237
2010-09-22 03:44 . 2010-09-22 03:52 -------- d-----w- C:\youn
2010-09-21 08:03 . 2010-09-21 08:04 -------- d-----w- C:\f57f25bb473a2b2328a4bdde6cb7
2010-09-19 18:10 . 2010-09-19 18:10 -------- d-----w- C:\a22f24adf768f691ab0543
2010-09-18 17:50 . 2010-09-18 17:51 -------- d-----w- C:\b66c0882655b40c27988d3d63bbd96

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellSupport"="c:\program files\DellSupport\DSAgnt.exe" [2007-03-15 460784]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Nero\Lib\NMBgMonitor.exe" [2007-08-03 202024]
"Veoh"="c:\program files\Veoh Networks\Veoh\VeohClient.exe" [2008-09-27 3660848]
"VeohPlugin"="c:\program files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe" [2009-04-03 3558648]
"googletalk"="c:\users\farida\AppData\Roaming\Google\Google Talk\googletalk.exe" [2007-01-01 3739648]
"Google Update"="c:\users\farida\AppData\Local\Google\Update\GoogleUpdate.exe" [2009-04-08 133104]
"Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2009-05-27 4351216]
"cdloader"="c:\users\farida\AppData\Roaming\mjusbsp\cdloader2.exe" [2010-02-26 50520]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2007-10-31 1006264]
"ECenter"="c:\dell\E-Center\EULALauncher.exe" [2007-05-25 17920]
"Apoint"="c:\program files\DellTPad\Apoint.exe" [2007-05-11 159744]
"SigmatelSysTrayApp"="c:\program files\SigmaTel\C-Major Audio\WDM\sttray.exe" [2007-06-27 405504]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-06-29 138008]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-06-29 154392]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-06-29 133912]
"DELL Webcam Manager"="c:\program files\Dell\Dell Webcam Manager\DellWMgr.exe" [2007-07-27 118784]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2007-03-21 1548288]
"PCMService"="c:\program files\Dell\MediaDirect\PCMService.exe" [2007-04-16 184320]
"NeroFilterCheck"="c:\program files\Common Files\Nero\Lib\NeroCheck.exe" [2007-03-01 153136]
"NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-08-08 1828136]
"Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-11-29 583048]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-05-01 198160]
"00PCTFW"="c:\program files\PC Tools Firewall Plus\FirewallGUI.exe" [2010-01-18 3168216]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
AutoUpdate Monitor.lnk - c:\program files\Sophos\AutoUpdate\ALMon.exe [2010-2-10 245760]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"EnableShellExecuteHooks"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{4F07DA45-8170-4859-9B5F-037EF2970034}"= "c:\progra~1\TALLEM~1\ONLINE~1\oaevent.dll" [2009-12-05 923336]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Sophos\SOPHOS~1\sophos_detoured.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SAVService]
@="service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SophosAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2009-08-22 133104]
R3 PCTFW-DNS;PCTools Firewall - DNS driver;c:\windows\system32\drivers\pctNdis-DNS.sys [2010-01-18 32680]
R3 SvcOnlineArmor;Online Armor;c:\program files\Tall Emu\Online Armor\oasrv.exe [2009-12-05 3431112]
R4 SophosBootDriver;SophosBootDriver;c:\windows\system32\DRIVERS\SophosBootDriver.sys [2009-12-19 20288]
S1 OADevice;OADriver;c:\windows\system32\drivers\OADriver.sys [2009-12-05 223312]
S1 OAmon;OAmon;c:\windows\system32\drivers\OAmon.sys [2009-12-05 24656]
S1 pctgntdi;pctgntdi;c:\windows\System32\drivers\pctgntdi.sys [2010-01-18 233136]
S1 SAVOnAccess;SAVOnAccess;c:\windows\system32\DRIVERS\savonaccess.sys [2010-06-02 93688]
S1 VBoxDrv;VirtualBox Service;c:\windows\system32\DRIVERS\VBoxDrv.sys [2008-12-17 100368]
S1 VBoxUSBMon;VirtualBox USB Monitor Driver;c:\windows\system32\DRIVERS\VBoxUSBMon.sys [2008-12-17 41680]
S2 OAcat;Online Armor Helper Service;c:\program files\Tall Emu\Online Armor\OAcat.exe [2009-12-05 1282248]
S2 PCTAppEvent;PCTAppEvent Driver;c:\windows\system32\drivers\PCTAppEvent.sys [2009-11-23 88040]
S2 SAVAdminService;Sophos Anti-Virus status reporter;c:\program files\Sophos\Sophos Anti-Virus\SAVAdminService.exe [2009-12-19 80936]
S2 SAVService;Sophos Anti-Virus;c:\program files\Sophos\Sophos Anti-Virus\SavService.exe [2009-12-19 98304]
S2 TeamViewer5;TeamViewer 5;c:\program files\TeamViewer\Version5\TeamViewer_Service.exe [2010-05-21 173352]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\b57nd60x.sys [2007-05-11 179712]
S3 PCTFW-PacketFilter;PCTools Firewall - Packet filter driver;c:\windows\system32\drivers\pctNdis-PacketFilter.sys [2010-01-18 70664]
S3 pctNDIS;PC Tools Driver;c:\windows\system32\DRIVERS\pctNdis.sys [2010-01-18 58816]
S3 pctplfw;pctplfw;c:\windows\System32\drivers\pctplfw.sys [2010-01-18 115216]
S3 VBoxNetFlt;VBoxNetFlt Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys [2008-12-17 81360]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
.
Contents of the 'Scheduled Tasks' folder

2010-10-17 c:\windows\Tasks\Daily [0].job
- c:\program files\Sophos\Sophos Anti-Virus\BackgroundScanClient.exe [2009-12-19 02:55]

2010-10-17 c:\windows\Tasks\Daily.job
- c:\program files\Sophos\Sophos Anti-Virus\BackgroundScanClient.exe [2009-12-19 02:55]

2010-09-26 c:\windows\Tasks\DriverCure.job
- c:\program files\ParetoLogic\DriverCure\DriverCure.exe [2009-08-07 19:36]

2010-10-17 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-08-22 15:32]

2010-10-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-08-22 15:32]

2010-10-17 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-965788493-1340469518-1114669241-1000Core.job
- c:\users\farida\AppData\Local\Google\Update\GoogleUpdate.exe [2009-04-08 17:13]

2010-10-18 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-965788493-1340469518-1114669241-1000UA.job
- c:\users\farida\AppData\Local\Google\Update\GoogleUpdate.exe [2009-04-08 17:13]

2010-10-17 c:\windows\Tasks\ParetoLogic Registration.job
- c:\program files\Common Files\ParetoLogic\UUS2\UUS.dll [2009-01-13 14:59]

2010-10-17 c:\windows\Tasks\ParetoLogic Update Version2.job
- c:\program files\Common Files\ParetoLogic\UUS2\Pareto_Update.exe [2009-01-13 14:59]
------- Supplementary Scan -------
.
uStart Page = about:blank
mStart Page = [You must be registered and logged in to see this link.]
mSearch Bar = [You must be registered and logged in to see this link.]
uInternet Settings,ProxyOverride =
uSearchURL,(Default) = [You must be registered and logged in to see this link.]
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\users\farida\AppData\Roaming\Mozilla\Firefox\Profiles\hotdei75.default\
FF - prefs.js: browser.search.defaulturl - [You must be registered and logged in to see this link.]
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: browser.startup.homepage - [You must be registered and logged in to see this link.]
FF - prefs.js: keyword.URL - [You must be registered and logged in to see this link.]
FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPJinit13121.dll
FF - plugin: c:\program files\Picasa2\npPicasa3.dll
FF - plugin: c:\program files\Veoh Networks\Veoh\Plugins\noreg\NPVeohVersion.dll
FF - plugin: c:\program files\Veoh Networks\VeohWebPlayer\NPVeohTVPlugin.dll
FF - plugin: c:\program files\Veoh Networks\VeohWebPlayer\npWebPlayerVideoPluginATL.dll
FF - plugin: c:\users\farida\AppData\Local\Google\Update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\users\farida\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll
FF - plugin: c:\users\farida\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF - HiddenExtension: XULRunner: {D1CDB335-D513-4B06-A8CF-BE91FAFBB947} - c:\users\farida\AppData\Local\{D1CDB335-D513-4B06-A8CF-BE91FAFBB947}

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-Search Protection - c:\program files\Yahoo!\Search Protection\SearchProtection.exe
HKCU-Run-agknkwfk - c:\users\farida\AppData\Local\tpwcnh\fychsftav.exe
HKCU-Run-gcmbwquf - c:\users\farida\AppData\Local\hlmwnddnu\bngllxrtssd.exe
HKCU-Run-Imoxet - c:\users\farida\AppData\Local\qmldola0.dll
HKLM-Run-Ironufeworit - c:\users\farida\AppData\Local\adonubesidacibi.dll



[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Sophos Message Router]
"ImagePath"=""c:\program files\Sophos\Remote Management System\RouterNT.exe" -service -name Router -ORBListenEndpoints [You must be registered and logged in to see this link.]
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2010-10-17 22:10:18
ComboFix-quarantined-files.txt 2010-10-18 03:10
ComboFix2.txt 2009-12-18 14:32

Pre-Run: 4,254,814,208 bytes free
Post-Run: 5,610,991,616 bytes free

- - End Of File - - 0259151F7223F50E51F2A592978700A8


invisible016
Intermediate
Intermediate

Status :
Online
Offline

Posts : 61
Joined : 2009-11-02
OS : vista

View user profile

Back to top Go down

Re: Sytem very slow Unable to identify Problem Might be virus

Post by Belahzur on Mon Oct 18, 2010 11:29 pm

Hello.

Please download GooredFix from one of the locations below and save it to your Desktop
[You must be registered and logged in to see this link.]
[You must be registered and logged in to see this link.]

  • Ensure all Firefox windows are closed.
  • To run the tool, double-click it (XP), or right-click and select Run As Administrator (Vista).
  • When prompted to run the scan, click Yes.
  • GooredFix will check for infections, and then a log will appear. Please post the contents of that log in your next reply (it can also be found on your desktop, called GooredFix.txt).


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Status :
Online
Offline

Posts : 34916
Joined : 2008-08-03
Gender : Male
OS : XP SP3 Media Centre

View user profile

Back to top Go down

Re: Sytem very slow Unable to identify Problem Might be virus

Post by invisible016 on Tue Oct 19, 2010 12:37 am

Hi,
Here is the GooredFix log.

Thanks.

[b]GooredFix by jpshortstuff (03.07.10.1)
Log created at 19:32 on 18/10/2010 (farida)
Firefox version 3.0.19 (en-US)

========== GooredScan ==========

Deleting HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions\\{D1CDB335-D513-4B06-A8CF-BE91FAFBB947} -> Success!
Deleting C:\Users\farida\AppData\Local\{D1CDB335-D513-4B06-A8CF-BE91FAFBB947} -> Success!

========== GooredLog ==========

C:\Program Files\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd} [14:46 12/11/2007]

C:\Users\farida\Application Data\Mozilla\Firefox\Profiles\hotdei75.default\extensions\
{20a82645-c095-46ed-80e3-08825760534b} [19:04 14/06/2010]
{635abd67-4fe9-1b23-4f01-e679fa7484c1} [02:37 21/02/2009]

[HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions]
"{20a82645-c095-46ed-80e3-08825760534b}"="C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension" [11:12 05/03/2009]
"{ABDE892B-13A8-4d1b-88E6-365A6E755758}"="C:\Program Files\Real\RealPlayer\browserrecord" [06:49 01/05/2009]

-=E.O.F=-

invisible016
Intermediate
Intermediate

Status :
Online
Offline

Posts : 61
Joined : 2009-11-02
OS : vista

View user profile

Back to top Go down

Re: Sytem very slow Unable to identify Problem Might be virus

Post by Belahzur on Tue Oct 19, 2010 11:23 pm

Hello.

Click Start > Run and copy/paste the following bolded text into the Run box and click OK:

ComboFix /uninstall

This will also reset your restore points.

Run ESET Online Scan
Please do an online scan with [You must be registered and logged in to see this link.]. Please use Internet Explorer as it uses ActiveX.

  • Check (tick) this box: YES, I accept the Terms of Use.
  • Click on the Start button next to it.
  • When prompted to run ActiveX. click Yes.
  • You will be asked to install an ActiveX. Click Install.
  • Once installed, the scanner will be initialized.
  • After the scanner is initialized, click Start.
  • Check (tick) Remove found threats box.
  • Check (tick) Scan unwanted applications.
  • Click on Scan.
  • It will start scanning. Please be patient.
  • Once the scan is done, the log will be saved here: C:\Program Files\esetonlinescanner\log.txt.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Status :
Online
Offline

Posts : 34916
Joined : 2008-08-03
Gender : Male
OS : XP SP3 Media Centre

View user profile

Back to top Go down

Re: Sytem very slow Unable to identify Problem Might be virus

Post by invisible016 on Wed Oct 20, 2010 4:50 am

Hi,
Here is the copy of the esetonlinescanner log file.


ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=7
# iexplore.exe=7.00.6000.16386 (vista_rtm.061101-2205)
# OnlineScanner.ocx=1.0.0.6211
# api_version=3.0.2
# EOSSerial=51618fb62502764483629105723248ac
# end=finished
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2010-10-20 04:36:38
# local_time=2010-10-19 11:36:38 (-0600, Central Daylight Time)
# country="United States"
# lang=1033
# osver=6.0.6000 NT
# compatibility_mode=512 16777215 100 0 25936044 25936044 0 0
# compatibility_mode=2560 16777215 100 0 0 0 0 0
# compatibility_mode=5892 16776574 100 100 59961995 124142333 0 0
# compatibility_mode=6401 16777214 66 100 20717030 26593047 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# compatibility_mode=8449 16775141 100 99 0 25425756 0 0
# scanned=219988
# found=1
# cleaned=1
# scan_time=14639
C:\Users\farida\Desktop\GooredFix Backups\C\Users\farida\AppData\Local\{D1CDB335-D513-4B06-A8CF-BE91FAFBB947}\chrome\content\overlay.xul probably a variant of Win32/Agent.NVQFFQI trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C


invisible016
Intermediate
Intermediate

Status :
Online
Offline

Posts : 61
Joined : 2009-11-02
OS : vista

View user profile

Back to top Go down

Re: Sytem very slow Unable to identify Problem Might be virus

Post by Belahzur on Wed Oct 20, 2010 11:12 pm

No problems, just a backup. Delete this folder:
C:\Users\farida\Desktop\GooredFix Backups

How is the machine running now?


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Status :
Online
Offline

Posts : 34916
Joined : 2008-08-03
Gender : Male
OS : XP SP3 Media Centre

View user profile

Back to top Go down

Re: Sytem very slow Unable to identify Problem Might be virus

Post by invisible016 on Thu Oct 21, 2010 6:05 pm

Hi,
There a couple of problems.I dont know if they are related to virus or not.

1.The computer shuts down as soon as the charger is removed.the charging is not happening ie battery dies as soon as charger is removed.

2.Audio problem: I am able to hear sound if i have ear phones on.but if i remove them i do not here the sound even though video/songs are running.I dont know y.

Cud u pls help me out with this. is this because of the virus?

the system is working better frm wen i had posted the problem apart frm these 2 things.

thank u very very much for ur help.

invisible016
Intermediate
Intermediate

Status :
Online
Offline

Posts : 61
Joined : 2009-11-02
OS : vista

View user profile

Back to top Go down

Re: Sytem very slow Unable to identify Problem Might be virus

Post by Belahzur on Thu Oct 21, 2010 11:58 pm

Hello.

Download [You must be registered and logged in to see this link.] to your desktop.

  • Double click MBRCheck.exe to run (Vista and Windows 7 users, right click and select Run as Administrator).
  • It will show a black screen with some data on it.
  • A report called MBRcheckxxxx.txt will be on your desktop
  • Open this report and post its content in your next reply.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Status :
Online
Offline

Posts : 34916
Joined : 2008-08-03
Gender : Male
OS : XP SP3 Media Centre

View user profile

Back to top Go down

Re: Sytem very slow Unable to identify Problem Might be virus

Post by invisible016 on Fri Oct 22, 2010 12:45 am

Hi,
Here is the MBRcheckxxxx.txt.
Thanks.
MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows Vista Home Basic Edition
Windows Information: (build 6000), 32-bit
Base Board Manufacturer: Dell Inc.
BIOS Manufacturer: Dell Inc.
System Manufacturer: Dell Inc.
System Product Name: Vostro 1400
Logical Drives Mask: 0x0000001c

Kernel Drivers (total 163):
0x82C00000 \SystemRoot\system32\ntkrnlpa.exe
0x82FA1000 \SystemRoot\system32\hal.dll
0x802C6000 \SystemRoot\system32\kdcom.dll
0x80266000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
0x8025D000 \SystemRoot\system32\PSHED.dll
0x80255000 \SystemRoot\system32\BOOTVID.dll
0x8021A000 \SystemRoot\system32\CLFS.SYS
0x8051F000 \SystemRoot\system32\CI.dll
0x804A4000 \SystemRoot\system32\drivers\Wdf01000.sys
0x8020D000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x80461000 \SystemRoot\system32\drivers\acpi.sys
0x80204000 \SystemRoot\system32\drivers\WMILIB.SYS
0x80459000 \SystemRoot\system32\drivers\msisadrv.sys
0x80434000 \SystemRoot\system32\drivers\pci.sys
0x80425000 \SystemRoot\system32\drivers\volmgr.sys
0x80201000 \SystemRoot\system32\DRIVERS\compbatt.sys
0x8041B000 \SystemRoot\system32\DRIVERS\BATTC.SYS
0x8040B000 \SystemRoot\System32\drivers\mountmgr.sys
0x80404000 \SystemRoot\system32\DRIVERS\intelide.sys
0x807F2000 \SystemRoot\system32\DRIVERS\PCIIDEX.SYS
0x807EB000 \SystemRoot\system32\drivers\pciide.sys
0x807A1000 \SystemRoot\System32\drivers\volmgrx.sys
0x80701000 \SystemRoot\system32\drivers\iastorv.sys
0x80643000 \SystemRoot\system32\drivers\iastor.sys
0x8063B000 \SystemRoot\system32\drivers\atapi.sys
0x8061D000 \SystemRoot\system32\drivers\ataport.SYS
0x82BCF000 \SystemRoot\system32\drivers\fltmgr.sys
0x8060D000 \SystemRoot\system32\drivers\fileinfo.sys
0x80604000 \SystemRoot\System32\Drivers\PxHelp20.sys
0x82ACB000 \SystemRoot\system32\drivers\ndis.sys
0x82AA0000 \SystemRoot\system32\drivers\msrpc.sys
0x82A67000 \SystemRoot\system32\drivers\NETIO.SYS
0x888F8000 \SystemRoot\System32\Drivers\Ntfs.sys
0x8888E000 \SystemRoot\System32\Drivers\ksecdd.sys
0x82A31000 \SystemRoot\system32\drivers\volsnap.sys
0x82A29000 \SystemRoot\System32\Drivers\spldr.sys
0x82A1A000 \SystemRoot\System32\drivers\partmgr.sys
0x82A0B000 \SystemRoot\System32\Drivers\mup.sys
0x88869000 \SystemRoot\System32\drivers\ecache.sys
0x88858000 \SystemRoot\system32\drivers\disk.sys
0x88837000 \SystemRoot\system32\drivers\CLASSPNP.SYS
0x82A02000 \SystemRoot\system32\drivers\crcdisk.sys
0x8C657000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x8929B000 \SystemRoot\system32\DRIVERS\tunmp.sys
0x8C649000 \SystemRoot\system32\DRIVERS\intelppm.sys
0x8CA19000 \SystemRoot\system32\DRIVERS\igdkmd32.sys
0x8D163000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x8C63C000 \SystemRoot\System32\drivers\watchdog.sys
0x8C631000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0x8C7C3000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x8C623000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x8C611000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x8D0DD000 \SystemRoot\system32\DRIVERS\bcmwl6.sys
0x8D0AE000 \SystemRoot\system32\DRIVERS\b57nd60x.sys
0x89760000 \SystemRoot\system32\DRIVERS\ohci1394.sys
0x8C603000 \SystemRoot\system32\DRIVERS\1394BUS.SYS
0x8CA01000 \SystemRoot\system32\DRIVERS\sdbus.sys
0x8D0A0000 \SystemRoot\system32\DRIVERS\rimmptsk.sys
0x8D08C000 \SystemRoot\system32\DRIVERS\rimsptsk.sys
0x8D03B000 \SystemRoot\system32\DRIVERS\rixdptsk.sys
0x8D028000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0x8D3D4000 \SystemRoot\system32\DRIVERS\Apfiltr.sys
0x8C7B8000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x8D01D000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x8D005000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x8C08B000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0x8C782000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
0x8D3B6000 \SystemRoot\system32\DRIVERS\VMNetSrv.sys
0x8D398000 \SystemRoot\system32\DRIVERS\dne2000.sys
0x8D36D000 \SystemRoot\system32\DRIVERS\msiscsi.sys
0x8D32D000 \SystemRoot\system32\DRIVERS\storport.sys
0x8D322000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x8D30B000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x8D300000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x8D2DD000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x8928C000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x8D2CA000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x8D710000 \SystemRoot\system32\DRIVERS\termdd.sys
0x8D64D000 \SystemRoot\system32\DRIVERS\pctNdis.sys
0x8D2B7000 \SystemRoot\system32\DRIVERS\VBoxNetFlt.sys
0x896B4000 \SystemRoot\system32\DRIVERS\swenum.sys
0x8D28D000 \SystemRoot\system32\DRIVERS\ks.sys
0x8C0A2000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0x8D65A000 \SystemRoot\system32\DRIVERS\umbus.sys
0x8D259000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x89780000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x8DDAD000 \SystemRoot\system32\drivers\stwrt.sys
0x8DD80000 \SystemRoot\system32\drivers\portcls.sys
0x8DD5B000 \SystemRoot\system32\drivers\drmk.sys
0x8DD1E000 \SystemRoot\system32\DRIVERS\HSXHWAZL.sys
0x8DC1B000 \SystemRoot\system32\DRIVERS\HSX_DPV.sys
0x8D94C000 \SystemRoot\system32\DRIVERS\HSX_CNXT.sys
0x8D667000 \SystemRoot\system32\drivers\modem.sys
0x8D920000 \SystemRoot\system32\DRIVERS\savonaccess.sys
0x8C7AF000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0x8C164000 \SystemRoot\System32\Drivers\Null.SYS
0x8C16B000 \SystemRoot\System32\Drivers\Beep.SYS
0x8D914000 \SystemRoot\System32\drivers\vga.sys
0x8D8F3000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x8C1B0000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x8C1B8000 \SystemRoot\system32\drivers\rdpencdd.sys
0x8D8C8000 \SystemRoot\System32\Drivers\Msfs.SYS
0x8D8BA000 \SystemRoot\System32\Drivers\Npfs.SYS
0x8C770000 \SystemRoot\System32\DRIVERS\rasacd.sys
0x8DF2B000 \SystemRoot\System32\drivers\tcpip.sys
0x8D807000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x8DC06000 \SystemRoot\system32\DRIVERS\tdx.sys
0x8DEF4000 \??\C:\Windows\System32\drivers\pctgntdi.sys
0x8C190000 \??\C:\Windows\system32\drivers\OAmon.sys
0x8DEDD000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0x896B6000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x8DEAB000 \SystemRoot\System32\DRIVERS\netbt.sys
0x8DE97000 \SystemRoot\system32\DRIVERS\smb.sys
0x8DE50000 \SystemRoot\system32\drivers\afd.sys
0x8DE16000 \SystemRoot\system32\DRIVERS\OEM02Dev.sys
0x8DE00000 \SystemRoot\system32\DRIVERS\pacer.sys
0x896B2000 \SystemRoot\system32\DRIVERS\OEM02Vfx.sys
0x8F5F2000 \SystemRoot\system32\DRIVERS\netbios.sys
0x8F5DF000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x8F5A4000 \??\C:\Windows\system32\Drivers\vmm.sys
0x8D896000 \SystemRoot\system32\DRIVERS\VBoxUSBMon.sys
0x8F582000 \SystemRoot\system32\DRIVERS\VBoxDrv.sys
0x8F547000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x8F4FE000 \??\C:\Windows\system32\drivers\OADriver.sys
0x8D820000 \SystemRoot\system32\drivers\nsiproxy.sys
0x8F4E7000 \SystemRoot\System32\Drivers\dfsc.sys
0x8D674000 \SystemRoot\System32\Drivers\crashdmp.sys
0x8C6B2000 \SystemRoot\System32\Drivers\dump_iaStor.sys
0x98800000 \SystemRoot\System32\win32k.sys
0x8F45D000 \SystemRoot\System32\drivers\Dxapi.sys
0x8D74C000 \SystemRoot\system32\DRIVERS\monitor.sys
0xA9600000 \SystemRoot\System32\TSDDD.dll
0xA9610000 \SystemRoot\System32\cdd.dll
0xAC332000 \SystemRoot\system32\drivers\spsys.sys
0xAC2F1000 \SystemRoot\system32\DRIVERS\packet.sys
0x98A00000 \SystemRoot\system32\DRIVERS\lltdio.sys
0xAC214000 \SystemRoot\system32\DRIVERS\nwifi.sys
0xAB6E0000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0xAC201000 \SystemRoot\system32\DRIVERS\rspndr.sys
0xAD067000 \SystemRoot\system32\drivers\HTTP.sys
0xAD00C000 \SystemRoot\System32\DRIVERS\srvnet.sys
0xADFE7000 \SystemRoot\system32\DRIVERS\bowser.sys
0xACD7C000 \SystemRoot\System32\drivers\mpsdrv.sys
0xADF87000 \SystemRoot\system32\drivers\mrxdav.sys
0xADF69000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xADF30000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0xADF1E000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0xADEFA000 \SystemRoot\System32\DRIVERS\srv2.sys
0xADE79000 \SystemRoot\System32\DRIVERS\srv.sys
0xB1170000 \??\C:\Windows\system32\Drivers\CVPNDRVA.sys
0xACC12000 \SystemRoot\system32\DRIVERS\dsunidrv.sys
0xAABD8000 \SystemRoot\System32\Drivers\fastfat.SYS
0xAAB84000 \SystemRoot\system32\DRIVERS\mdmxsdk.sys
0xAAA19000 \??\C:\Windows\system32\drivers\PCTAppEvent.sys
0xB52E2000 \SystemRoot\system32\drivers\peauth.sys
0xAB73A000 \SystemRoot\System32\Drivers\secdrv.SYS
0x89710000 \??\C:\Windows\system32\drivers\pctNdis-PacketFilter.sys
0xB529B000 \??\C:\Windows\System32\drivers\pctplfw.sys
0xAA592000 \SystemRoot\System32\drivers\tcpipreg.sys
0x8C1E8000 \SystemRoot\system32\DRIVERS\xaudio.sys
0xBCED2000 \SystemRoot\system32\DRIVERS\cdfs.sys
0xB524E000 \??\C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys
0x77040000 \Windows\System32\ntdll.dll

Processes (total 89):
0 System Idle Process
4 System
496 C:\Windows\System32\smss.exe
560 csrss.exe
600 C:\Windows\System32\wininit.exe
608 csrss.exe
644 C:\Windows\System32\services.exe
656 C:\Windows\System32\lsass.exe
664 C:\Windows\System32\lsm.exe
716 C:\Windows\System32\winlogon.exe
840 C:\Windows\System32\svchost.exe
892 C:\Windows\System32\svchost.exe
1028 C:\Windows\System32\svchost.exe
1052 C:\Windows\System32\svchost.exe
1084 C:\Windows\System32\svchost.exe
1184 C:\Windows\System32\audiodg.exe
1220 C:\Windows\System32\SLsvc.exe
1320 C:\Windows\System32\svchost.exe
1412 C:\Program Files\Sophos\Sophos Anti-Virus\SavService.exe
1664 C:\Windows\System32\svchost.exe
1820 C:\Windows\System32\WLTRYSVC.EXE
1832 C:\Windows\System32\BCMWLTRY.EXE
1848 C:\Program Files\Tall Emu\Online Armor\oacat.exe
1936 C:\Windows\System32\spoolsv.exe
1972 C:\Windows\System32\svchost.exe
1452 C:\Windows\System32\dwm.exe
1628 C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
2012 C:\Windows\explorer.exe
344 C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
1212 C:\Program Files\Dell Network Assistant\hnm_svc.exe
2256 C:\Program Files\Sigmatel\C-Major Audio\WDM\sttray.exe
2304 C:\Windows\System32\hkcmd.exe
2320 C:\Windows\System32\igfxpers.exe
2404 C:\Windows\System32\WLTRAY.EXE
2432 C:\Windows\System32\inetsrv\inetinfo.exe
2452 C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
2464 C:\Program Files\Dell\MediaDirect\PCMService.exe
2520 C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
2548 C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
2564 C:\Windows\System32\igfxsrvc.exe
2616 C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe
2644 C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
2660 C:\Program Files\DellSupport\DSAgnt.exe
2668 C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe
2768 C:\Program Files\PC Tools Firewall Plus\FWService.exe
2788 C:\Program Files\Veoh Networks\Veoh\VeohClient.exe
2820 C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe
2876 C:\Windows\System32\svchost.exe
2896 C:\Program Files\Sophos\Sophos Anti-Virus\SAVAdminService.exe
2940 C:\Program Files\Sophos\Remote Management System\ManagementAgentNT.exe
3000 C:\Users\farida\AppData\Roaming\Google\Google Talk\googletalk.exe
3068 C:\Program Files\Sophos\AutoUpdate\ALsvc.exe
3108 C:\Program Files\Sophos\AutoUpdate\ALMon.exe
3116 C:\Program Files\Digital Line Detect\DLG.exe
3272 C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
3328 C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
3408 C:\Program Files\Dell\QuickSet\quickset.exe
3444 C:\Program Files\DellTPad\ApMsgFwd.exe
4084 C:\Program Files\DellTPad\hidfind.exe
984 C:\Windows\System32\svchost.exe
1512 C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe
2188 C:\Windows\System32\svchost.exe
2484 C:\Program Files\DellTPad\ApntEx.exe
2656 C:\Windows\System32\svchost.exe
2492 C:\Windows\System32\SearchIndexer.exe
3496 C:\Windows\System32\drivers\XAudio.exe
1800 C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
2236 C:\Windows\System32\wercon.exe
3608 C:\Windows\System32\taskeng.exe
1008 C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
4112 WmiPrvSE.exe
4424 C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
4724 C:\Windows\System32\taskeng.exe
5236 C:\Program Files\Google\Update\GoogleUpdate.exe
5260 C:\Program Files\Yahoo!\Messenger\Ymsgr_tray.exe
336 C:\Program Files\Windows Media Player\wmpnscfg.exe
2972 C:\Program Files\Windows Media Player\wmpnetwk.exe
3964 C:\Program Files\Google\Chrome\Application\chrome.exe
1772 C:\Program Files\Google\Chrome\Application\chrome.exe
4304 C:\Program Files\Google\Chrome\Application\chrome.exe
5212 C:\Program Files\Google\Chrome\Application\chrome.exe
2680 C:\Windows\System32\SearchProtocolHost.exe
5644 C:\Program Files\Sophos\Remote Management System\RouterNT.exe
5308 C:\Users\farida\AppData\Local\Google\Update\GoogleUpdate.exe
3236 C:\Windows\System32\wuauclt.exe
4104 C:\Program Files\Mozilla Firefox\firefox.exe
1172 C:\Program Files\Common Files\Real\Update_OB\realsched.exe
2092 C:\Windows\System32\SearchFilterHost.exe
4232 C:\Users\farida\Desktop\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000002`84f00000 (NTFS)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x00000000`04f00000 (NTFS)

PhysicalDrive0 Model Number: WDCWD1200BEVS-75UST0, Rev: 01.01A01

Size Device Name MBR Status
--------------------------------------------
111 GB \\.\PhysicalDrive0 Windows Vista MBR code detected
SHA1: 8DF43F2BDE2D9451948FA14B5279969C777A7979


Done!

invisible016
Intermediate
Intermediate

Status :
Online
Offline

Posts : 61
Joined : 2009-11-02
OS : vista

View user profile

Back to top Go down

Re: Sytem very slow Unable to identify Problem Might be virus

Post by Belahzur on Sat Oct 23, 2010 12:08 am

Please download and run this tool.

Download Malwarebytes' Anti-Malware from [You must be registered and logged in to see this link.]

Double Click mbam-setup.exe to install the application.

  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.


Post the contents of the MBAM Log.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Status :
Online
Offline

Posts : 34916
Joined : 2008-08-03
Gender : Male
OS : XP SP3 Media Centre

View user profile

Back to top Go down

Re: Sytem very slow Unable to identify Problem Might be virus

Post by invisible016 on Sat Oct 23, 2010 7:13 pm

Hi,
Here is the MBAM log file.

Malwarebytes' Anti-Malware 1.46
[You must be registered and logged in to see this link.]

Database version: 4928

Windows 6.0.6000
Internet Explorer 7.0.6000.17037

10/23/2010 1:55:10 PM
mbam-log-2010-10-23 (13-55-10).txt

Scan type: Quick scan
Objects scanned: 148910
Time elapsed: 30 minute(s), 50 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

invisible016
Intermediate
Intermediate

Status :
Online
Offline

Posts : 61
Joined : 2009-11-02
OS : vista

View user profile

Back to top Go down

Re: Sytem very slow Unable to identify Problem Might be virus

Post by Belahzur on Sat Oct 23, 2010 11:53 pm

Hello.

Click Start > Run and copy/paste the following bolded text into the Run box and click OK:

ComboFix /uninstall

This will also reset your restore points.

Run ESET Online Scan
Please do an online scan with [You must be registered and logged in to see this link.]. Please use Internet Explorer as it uses ActiveX.

  • Check (tick) this box: YES, I accept the Terms of Use.
  • Click on the Start button next to it.
  • When prompted to run ActiveX. click Yes.
  • You will be asked to install an ActiveX. Click Install.
  • Once installed, the scanner will be initialized.
  • After the scanner is initialized, click Start.
  • Check (tick) Remove found threats box.
  • Check (tick) Scan unwanted applications.
  • Click on Scan.
  • It will start scanning. Please be patient.
  • Once the scan is done, the log will be saved here: C:\Program Files\esetonlinescanner\log.txt.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Status :
Online
Offline

Posts : 34916
Joined : 2008-08-03
Gender : Male
OS : XP SP3 Media Centre

View user profile

Back to top Go down

Re: Sytem very slow Unable to identify Problem Might be virus

Post by invisible016 on Thu Oct 28, 2010 11:30 pm

Hi,
After doing the ESET Scan I got the message.

No threats Found

invisible016
Intermediate
Intermediate

Status :
Online
Offline

Posts : 61
Joined : 2009-11-02
OS : vista

View user profile

Back to top Go down

Re: Sytem very slow Unable to identify Problem Might be virus

Post by Belahzur on Fri Oct 29, 2010 12:59 am

Good.
How is the machine running now?


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Status :
Online
Offline

Posts : 34916
Joined : 2008-08-03
Gender : Male
OS : XP SP3 Media Centre

View user profile

Back to top Go down

Re: Sytem very slow Unable to identify Problem Might be virus

Post by invisible016 on Fri Oct 29, 2010 3:54 am

Hi,
The machine is running good now.Thanks.The only problems r with audio.Spekers r not working.And if i remove the charger the system shuts down at that instant.(battery is not retaining the charge).Earlier was able to work without charger for a couple of hrs.

thnx for all the support,
let me know if u hav any suggestions/concerns.

Thnx.


invisible016
Intermediate
Intermediate

Status :
Online
Offline

Posts : 61
Joined : 2009-11-02
OS : vista

View user profile

Back to top Go down

Re: Sytem very slow Unable to identify Problem Might be virus

Post by Belahzur on Fri Oct 29, 2010 5:20 pm

Hello.
The battery problem maybe the battery is failing, time for a new one.

Do you have the latest audio drivers?


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Status :
Online
Offline

Posts : 34916
Joined : 2008-08-03
Gender : Male
OS : XP SP3 Media Centre

View user profile

Back to top Go down

Re: Sytem very slow Unable to identify Problem Might be virus

Post by invisible016 on Mon Nov 01, 2010 3:52 am

Hi,
can u pls tell me whr i can find the latest audio drives for my system???
Thanks.

invisible016
Intermediate
Intermediate

Status :
Online
Offline

Posts : 61
Joined : 2009-11-02
OS : vista

View user profile

Back to top Go down

View previous topic View next topic Back to top

- Similar topics

 
Permissions in this forum:
You cannot reply to topics in this forum