OTL Scan results and C-Drive still not well

Viruses and worms
1

So here’s my OTL scan results, only part 1:
OTL logfile created on: 09/04/2010 5:49:32 PM - Run 1
OTL by OldTimer - Version 3.2.1.1 Folder = C:\Documents and Settings\Administrator\桌面
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00001009 | Country: 加拿大 | Language: ENC | Date Format: dd/MM/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 47.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 73.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 29.58 Gb Total Space | 0.29 Gb Free Space | 0.99% Space Free | Partition Type: FAT32
Drive D: | 85.41 Gb Total Space | 82.49 Gb Free Space | 96.59% Space Free | Partition Type: FAT32
Drive E: | 30.02 Gb Total Space | 29.92 Gb Free Space | 99.67% Space Free | Partition Type: NTFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: USER-B695BE53E9
Current User Name: Administrator
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Processes (SafeList) ==========

PRC - [2010/04/09 17:48:18 | 000,561,664 | ---- | M] (OldTimer Tools) – C:\Documents and Settings\Administrator\桌面\OTL.exe
PRC - [2010/03/26 01:09:58 | 010,358,568 | ---- | M] (Apple Inc.) – C:\Program Files\iTunes\iTunes.exe
PRC - [2010/03/19 10:58:22 | 000,128,288 | ---- | M] (Apple Inc.) – C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceHelper.exe
PRC - [2010/03/19 10:49:20 | 000,144,672 | ---- | M] (Apple Inc.) – C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
PRC - [2010/03/15 16:56:54 | 000,013,088 | ---- | M] (Apple Inc.) – C:\Program Files\Common Files\Apple\Apple Application Support\distnoted.exe
PRC - [2009/11/24 18:51:40 | 000,081,000 | ---- | M] (ALWIL Software) – C:\Program Files\Alwil Software\Avast4\ashDisp.exe
PRC - [2009/11/24 18:51:36 | 000,138,680 | ---- | M] (ALWIL Software) – C:\Program Files\Alwil Software\Avast4\ashServ.exe
PRC - [2009/11/24 18:51:22 | 000,254,040 | ---- | M] (ALWIL Software) – C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
PRC - [2009/11/24 18:48:48 | 000,352,920 | ---- | M] (ALWIL Software) – C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
PRC - [2009/11/24 18:43:56 | 000,018,752 | ---- | M] (ALWIL Software) – C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
PRC - [2009/09/26 05:24:18 | 000,059,744 | ---- | M] (Microsoft Corporation) – C:\Program Files\Common Files\Microsoft Shared\IME14\SHARED\IMEDICTUPDATE.EXE
PRC - [2009/08/22 03:21:20 | 000,117,640 | R— | M] (Symantec Corporation) – C:\Program Files\Norton Internet Security\Norton Internet Security\Engine\16.8.0.41\ccSvcHst.exe
PRC - [2009/05/19 02:53:18 | 000,049,968 | ---- | M] (AOL LLC) – C:\Program Files\AIM6\aim6.exe
PRC - [2009/03/20 17:40:52 | 000,140,584 | ---- | M] (AOL LLC) – c:\Program Files\AOL Toolbar\aoltbServer.exe
PRC - [2008/11/06 15:03:00 | 000,041,264 | ---- | M] (AOL LLC) – C:\Program Files\AIM6\aolsoftware.exe
PRC - [2008/09/16 19:35:14 | 000,548,760 | ---- | M] (北京暴风网际科技有限公司) – C:\Program Files\StormII\stormliv.exe
PRC - [2008/04/13 23:44:00 | 000,978,432 | ---- | M] (Microsoft Corporation) – C:\WINDOWS\explorer.exe
PRC - [2007/02/07 18:44:50 | 000,024,576 | ---- | M] (Syntek America Inc.) – C:\WINDOWS\system32\StkCSrv.exe
PRC - [2007/01/05 05:38:10 | 000,024,652 | ---- | M] (Viewpoint Corporation) – C:\Program Files\Viewpoint\Common\ViewpointService.exe
PRC - [2006/08/23 22:22:14 | 000,110,592 | ---- | M] () – C:\WINDOWS\ATK0100\HControl.exe
PRC - [2006/08/10 22:08:04 | 002,379,776 | ---- | M] () – C:\WINDOWS\ATK0100\ATKOSD.exe
PRC - [2006/05/17 19:52:56 | 000,491,520 | ---- | M] (ASUSTek Computer Inc.) – C:\Program Files\ASUS\Asus MultiFrame\MultiFrame.exe
PRC - [2006/03/21 22:54:22 | 000,544,768 | ---- | M] (Motorola Inc.) – C:\WINDOWS\sm56hlpr.exe
PRC - [2006/03/14 17:46:00 | 000,090,112 | ---- | M] (ASUSTeK Computer Inc.) – C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe

========== Modules (SafeList) ==========

MOD - [2010/04/09 17:48:18 | 000,561,664 | ---- | M] (OldTimer Tools) – C:\Documents and Settings\Administrator\桌面\OTL.exe
MOD - [2009/11/24 18:50:32 | 000,139,264 | ---- | M] (ALWIL Software) – C:\Program Files\Alwil Software\Avast4\AhJsctNs.dll
MOD - [2009/08/22 03:21:16 | 000,419,696 | R— | M] (Symantec Corporation) – C:\Program Files\Norton Internet Security\Norton Internet Security\Engine\16.8.0.41\asOEHook.dll
MOD - [2006/05/17 16:39:26 | 000,028,672 | ---- | M] () – C:\Program Files\ASUS\Asus MultiFrame\HookTitle.dll

========== Win32 Services (SafeList) ==========

SRV - [2010/03/19 10:49:20 | 000,144,672 | ---- | M] (Apple Inc.) [Auto | Running] – C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe – (Apple Mobile Device)
SRV - [2009/11/24 18:51:36 | 000,138,680 | ---- | M] (ALWIL Software) [Auto | Running] – C:\Program Files\Alwil Software\Avast4\ashServ.exe – (avast! Antivirus)
SRV - [2009/11/24 18:51:22 | 000,254,040 | ---- | M] (ALWIL Software) [On_Demand | Running] – C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe – (avast! Mail Scanner)
SRV - [2009/11/24 18:48:48 | 000,352,920 | ---- | M] (ALWIL Software) [On_Demand | Running] – C:\Program Files\Alwil Software\Avast4\ashWebSv.exe – (avast! Web Scanner)
SRV - [2009/11/24 18:43:56 | 000,018,752 | ---- | M] (ALWIL Software) [Auto | Running] – C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe – (aswUpdSv)
SRV - [2009/09/26 05:24:18 | 000,059,744 | ---- | M] (Microsoft Corporation) [Auto | Running] – C:\Program Files\Common Files\Microsoft Shared\IME14\SHARED\IMEDICTUPDATE.EXE – (ImeDictUpdateService)
SRV - [2009/09/26 04:28:22 | 004,639,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE – (osppsvc)
SRV - [2009/09/23 16:36:06 | 000,051,168 | ---- | M] (NOS Microsystems Ltd.) [On_Demand | Stopped] – C:\Program Files\NOS\bin\getPlus_Helper.dll – (getPlusHelper) getPlus(R)
SRV - [2009/08/22 03:21:20 | 000,117,640 | R— | M] (Symantec Corporation) [Auto | Running] – C:\Program Files\Norton Internet Security\Norton Internet Security\Engine\16.8.0.41\ccSvcHst.exe – (Norton Internet Security)
SRV - [2008/09/16 19:35:14 | 000,548,760 | ---- | M] (北京暴风网际科技有限公司) [Auto | Running] – C:\Program Files\StormII\stormliv.exe – (ccosm)
SRV - [2007/02/07 18:44:50 | 000,024,576 | ---- | M] (Syntek America Inc.) [Auto | Running] – C:\WINDOWS\system32\StkCSrv.exe – (StkSSrv)
SRV - [2007/01/05 05:38:10 | 000,024,652 | ---- | M] (Viewpoint Corporation) [Auto | Running] – C:\Program Files\Viewpoint\Common\ViewpointService.exe – (Viewpoint Manager Service)

2

========== Driver Services (SafeList) ==========

DRV - [2010/02/03 04:00:00 | 001,324,720 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\Documents and Settings\All Users\Application Data\Norton{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100408.032\NAVEX15.SYS – (NAVEX15)
DRV - [2010/02/03 04:00:00 | 000,084,912 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\Documents and Settings\All Users\Application Data\Norton{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100408.032\NAVENG.SYS – (NAVENG)
DRV - [2010/01/28 22:51:28 | 000,482,432 | ---- | M] (Symantec Corporation) [Kernel | System | Running] – C:\WINDOWS\System32\Drivers\NIS\1008000.029\ccHPx86.sys – (ccHP)
DRV - [2009/11/24 18:49:08 | 000,048,560 | ---- | M] (ALWIL Software) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\aswTdi.sys – (aswTdi)
DRV - [2009/11/24 18:48:58 | 000,023,120 | ---- | M] (ALWIL Software) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\aswRdr.sys – (aswRdr)
DRV - [2009/11/24 18:47:54 | 000,027,408 | ---- | M] (ALWIL Software) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\aavmker4.sys – (Aavmker4)
DRV - [2009/10/28 17:37:24 | 000,329,592 | ---- | M] (Symantec Corporation) [Kernel | System | Running] – C:\Documents and Settings\All Users\Application Data\Norton{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100402.001\IDSXpx86.sys – (IDSxpx86)
DRV - [2009/09/15 06:56:14 | 000,094,160 | ---- | M] (ALWIL Software) [File_System | Auto | Running] – C:\WINDOWS\system32\drivers\aswmon2.sys – (aswMon2)
DRV - [2009/09/15 06:55:30 | 000,114,768 | ---- | M] (ALWIL Software) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\aswSP.sys – (aswSP)
DRV - [2009/09/15 06:55:20 | 000,020,560 | ---- | M] (ALWIL Software) [File_System | Auto | Running] – C:\WINDOWS\system32\drivers\aswFsBlk.sys – (aswFsBlk)
DRV - [2009/09/10 18:51:58 | 000,124,976 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\SYMEVENT.SYS – (SymEvent)
DRV - [2009/08/28 11:56:00 | 000,102,448 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys – (EraserUtilRebootDrv)
DRV - [2009/08/26 16:00:00 | 000,371,248 | ---- | M] (Symantec Corporation) [Kernel | System | Running] – C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys – (eeCtrl)
DRV - [2009/08/22 03:21:20 | 000,310,320 | ---- | M] (Symantec Corporation) [File_System | Boot | Running] – C:\WINDOWS\system32\drivers\NIS\1008000.029\SYMEFA.SYS – (SymEFA)
DRV - [2009/08/22 03:21:20 | 000,308,272 | ---- | M] (Symantec Corporation) [File_System | On_Demand | Running] – C:\WINDOWS\System32\Drivers\NIS\1008000.029\SRTSP.SYS – (SRTSP)
DRV - [2009/08/22 03:21:20 | 000,259,632 | ---- | M] (Symantec Corporation) [Kernel | System | Running] – C:\WINDOWS\System32\Drivers\NIS\1008000.029\BHDrvx86.sys – (BHDrvx86)
DRV - [2009/08/22 03:21:20 | 000,217,136 | ---- | M] (Symantec Corporation) [Kernel | System | Running] – C:\WINDOWS\System32\Drivers\NIS\1008000.029\SYMTDI.SYS – (SYMTDI)
DRV - [2009/08/22 03:21:20 | 000,089,904 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\System32\Drivers\NIS\1008000.029\SYMFW.SYS – (SYMFW)
DRV - [2009/08/22 03:21:20 | 000,043,696 | ---- | M] (Symantec Corporation) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\NIS\1008000.029\SRTSPX.SYS – (SRTSPX) Symantec Real Time Storage Protection (PEL)
DRV - [2009/08/22 03:21:20 | 000,036,400 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\System32\Drivers\NIS\1008000.029\SYMNDIS.SYS – (SYMNDIS)
DRV - [2009/08/22 03:21:20 | 000,033,072 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\System32\Drivers\NIS\1008000.029\SYMIDS.SYS – (SYMIDS)
DRV - [2009/08/22 03:21:06 | 000,036,400 | R— | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\SymIM.sys – (SymIMMP)
DRV - [2009/08/22 03:21:06 | 000,036,400 | R— | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\SymIM.sys – (SymIM)
DRV - [2008/04/13 16:26:06 | 000,088,320 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\nwlnkipx.sys – (NwlnkIpx)
DRV - [2008/04/13 14:06:06 | 000,144,384 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\Hdaudbus.sys – (HDAudBus)
DRV - [2007/10/11 08:50:58 | 000,024,960 | ---- | M] (America Online) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\atwpkt2.sys – (ATWPKT2)
DRV - [2007/09/29 11:06:00 | 002,456,064 | R— | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\ati2mtag.sys – (ati2mtag)
DRV - [2007/06/22 10:14:20 | 005,762,208 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\igxpmp32.sys – (ialm)
DRV - [2007/05/23 04:35:00 | 006,346,688 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\nv4_mini.sys – (nv)
DRV - [2007/04/27 04:01:34 | 002,203,520 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\NETw4x32.sys – (NETw4x32) Intel(R)
DRV - [2007/03/15 14:12:04 | 000,038,656 | ---- | M] (Attansic Technology corporation.) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\atl01_xp.sys – (AtcL001)
DRV - [2007/02/13 12:41:22 | 001,245,056 | ---- | M] (Syntek) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\StkCMini.sys – (StkCMini)
DRV - [2007/02/12 13:36:54 | 000,277,784 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] – C:\WINDOWS\system32\drivers\iaStor.sys – (iaStor)
DRV - [2006/11/15 08:00:58 | 000,528,096 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\ar5211.sys – (AR5211)
DRV - [2006/08/15 14:41:16 | 004,368,896 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\RtkHDAud.sys – (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2006/03/21 23:04:24 | 000,889,472 | ---- | M] (Motorola Inc.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\smserial.sys – (smserial)
DRV - [2005/11/16 16:08:16 | 000,078,976 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\Rtenicxp.sys – (RTL8023xp)
DRV - [2005/09/30 10:34:10 | 000,310,016 | ---- | M] (REDC) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\rixdptsk.sys – (rismxdp)
DRV - [2005/09/17 11:01:50 | 000,028,672 | ---- | M] (REDC) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\rimmptsk.sys – (rimmptsk)
DRV - [2005/09/14 12:45:24 | 000,050,560 | ---- | M] (REDC) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\rimsptsk.sys – (rimsptsk)
DRV - [2005/02/17 23:07:48 | 000,005,632 | ---- | M] () [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\ATKACPI.sys – (MTsensor)
DRV - [2001/08/31 15:20:30 | 000,035,913 | ---- | M] (SMC) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\smcirda.sys – (SMCIRDA)
DRV - [2001/08/17 13:57:38 | 000,016,128 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\MODEMCSA.sys – (MODEMCSA)
DRV - [2000/01/01 00:00:00 | 000,063,232 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\nwlnknb.sys – (NwlnkNb)
DRV - [2000/01/01 00:00:00 | 000,055,936 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] – C:\WINDOWS\system32\drivers\nwlnkspx.sys – (NwlnkSpx)
DRV - [2000/01/01 00:00:00 | 000,012,160 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\fsvga.sys – (FsVga)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM..\URLSearchHook: {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL Toolbar\aoltb.dll (AOL LLC)

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.aol.com/?ncid=customie8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.sina.com.cn/
IE - HKCU..\URLSearchHook: {54EB34EA-E6BE-4CFD-9F4F-C4A0C2EAFA22} - C:\Program Files\AIM Search\AOLSearch.dll (America Online, Inc.)
IE - HKCU..\URLSearchHook: {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL Toolbar\aoltb.dll (AOL LLC)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: “ProxyEnable” = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: “ProxyOverride” = *.local

FF - HKLM\software\mozilla\Firefox\Extensions\{7BA52691-1876-45ce-9EE6-54BCB3B04BBC}: C:\Documents and Settings\All Users\Application Data\Norton{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn\ [2010/04/09 17:17:28 | 000,000,000 | —D | M]

3

What problems do you have ?

I can see two AV’s there Avast and Norton, that is not conducive to good operation

http://majorgeeks.com/Norton_Removal_Tool_SymNRT_d4749.html Norton removal tool