TechSpot

8 steps completed; logs provided

By ignoramus
Nov 27, 2010
  1. Hi,

    I recently discovered that my work laptop had a virus on it. That is being sorted out on another thread, but I would like to have my second computer checked out if that is possible. I should add, I have seen no evidence of any viruses on this computer - I'm just concerned because this computer and the infected one both operate on my home network and I want to be on the safe side.

    I should also say, in regards to my antivirus software, that I had this computer when I was a student and it used to be configured to connect to the university network. It used to have Sophos antivirus on it (which was updated from the uni network). I now run Avast, but I had a lot if difficulty getting sophos uninstalled and I think pieces of it might still be on here. The add/remove programs tool did not work; I ran a batch file provided by Sophos which seems to have removed most of the components, but sophos still appears in the add/remove programs list (although the "remove" button has disappeared). Anyway, if it shows up that I've got 2 antivirus programs, that is what's going on.


    Thanks in advance. Here are the logs.

    Malwarebytes:

    Malwarebytes' Anti-Malware 1.46
    www.malwarebytes.org

    Database version: 5174

    Windows 5.1.2600 Service Pack 3
    Internet Explorer 8.0.6001.18702

    23/11/2010 7:32:16 PM
    mbam-log-2010-11-23 (19-32-16).txt

    Scan type: Quick scan
    Objects scanned: 154132
    Time elapsed: 14 minute(s), 26 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 0
    Registry Data Items Infected: 3
    Folders Infected: 0
    Files Infected: 0

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    (No malicious items detected)

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    (No malicious items detected)





    Gmer:

    GMER 1.0.15.15530 - http://www.gmer.net
    Rootkit quick scan 2010-11-27 16:59:21
    Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 FUJITSU_MHT2040AH rev.006C
    Running: vere70t1.exe; Driver: C:\Temp\fgtdapow.sys


    ---- System - GMER 1.0.15 ----

    Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwCreateProcessEx [0xF49EABAE]
    Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwCreateSection [0xF49EA9D2]
    Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwLoadDriver [0xF49EAB0C]
    Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) NtCreateSection
    Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ObInsertObject
    Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ObMakeTemporaryObject

    ---- Devices - GMER 1.0.15 ----

    Device \FileSystem\Ntfs \Ntfs aswSP.SYS (avast! self protection module/AVAST Software)

    AttachedDevice \FileSystem\Ntfs \Ntfs savonaccessfilter.sys (SAV On-access and HIPS for Windows XP (x86)/Sophos Plc)
    AttachedDevice \FileSystem\Ntfs \Ntfs aswMon2.SYS (avast! File System Filter Driver for Windows XP/AVAST Software)
    AttachedDevice \Driver\Tcpip \Device\Ip aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)
    AttachedDevice \Driver\Tcpip \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)
    AttachedDevice \Driver\Tcpip \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)
    AttachedDevice \Driver\Tcpip \Device\RawIp aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)

    ---- EOF - GMER 1.0.15 ----




    DDS:


    DDS (Ver_10-11-26.01) - NTFSx86
    Run by Bek at 17:18:01.38 on Sat 27/11/2010
    Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_21
    Microsoft Windows XP Professional 5.1.2600.3.1252.61.1033.18.767.413 [GMT 11:00]

    AV: Sophos Anti-Virus *On-access scanning disabled* (Outdated) {3F13C776-3CBE-4DE9-8BF6-09E5183CA2BD}
    AV: avast! Antivirus *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

    ============== Running Processes ===============

    C:\WINDOWS\system32\svchost -k DcomLaunch
    svchost.exe
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
    C:\WINDOWS\System32\S24EvMon.exe
    svchost.exe
    svchost.exe
    C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
    C:\WINDOWS\system32\ZCfgSvc.exe
    C:\WINDOWS\System32\1XConfig.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\System32\00THotkey.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\Apoint2K\Apoint.exe
    C:\Program Files\TOSHIBA\DualPointUtility\TEDTray.exe
    C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe
    C:\WINDOWS\system32\TFNF5.exe
    C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
    C:\WINDOWS\system32\TPSMain.exe
    C:\Program Files\TOSHIBA\TME3\TMERzCtl.EXE
    C:\Program Files\TOSHIBA\TME3\TMESBS32.EXE
    C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe
    C:\Program Files\Toshiba\TAudEffect\TAudEff.exe
    C:\WINDOWS\AGRSMMSG.exe
    C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    C:\WINDOWS\system32\ezSP_Px.exe
    C:\Program Files\Apoint2K\Apntex.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\WINDOWS\system32\TPSBattM.exe
    C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe
    C:\Program Files\TOSHIBA\Bluetooth Monitor\BtMon.exe
    C:\WINDOWS\system32\spoolsv.exe
    svchost.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    svchost.exe
    C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
    C:\WINDOWS\System32\DVDRAMSV.exe
    C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\WINDOWS\System32\svchost.exe -k HPZ12
    C:\WINDOWS\System32\nvsvc32.exe
    C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe
    C:\WINDOWS\System32\svchost.exe -k HPZ12
    C:\WINDOWS\System32\RegSrvc.exe
    C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    C:\Program Files\TOSHIBA\TME3\Tmesbs32.exe
    C:\Program Files\TOSHIBA\TME3\Tmesrv31.exe
    C:\WINDOWS\system32\UBDesktopLdr.exe
    C:\Program Files\TOSHIBA\TME3\TMEEJME.EXE
    C:\WINDOWS\System32\svchost.exe -k HTTPFilter
    C:\Program Files\Java\jre1.6.0_05\bin\jucheck.exe
    C:\Documents and Settings\Bek\Desktop\dds.scr

    ============== Pseudo HJT Report ===============

    uStart Page = hxxp://www.google.com.au/
    uInternet Settings,ProxyServer = proxy.ballarat.edu.au:8080
    uInternet Settings,ProxyOverride = *.ballarat.edu.au*
    BHO: -{39EA7695-B3F2-4C44-A4BC-297ADA8FD235} - No File
    BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
    BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
    BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll
    EB: Adobe PDF: {182ec0be-5110-49c8-a062-beb1d02a220b} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll
    EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
    mRun: [00THotkey] c:\windows\system32\00THotkey.exe
    mRun: [000StTHK] 000StTHK.exe
    mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
    mRun: [NVRotateSysTray] rundll32.exe c:\windows\system32\nvsysrot.dll,Enable
    mRun: [Apoint] c:\program files\apoint2k\Apoint.exe
    mRun: [DpUtil] c:\program files\toshiba\dualpointutility\TEDTray.exe
    mRun: [TosHKCW.exe] "c:\program files\toshiba\wireless hotkey\TosHKCW.exe"
    mRun: [TFNF5] TFNF5.exe
    mRun: [SmoothView] c:\program files\toshiba\toshiba zooming utility\SmoothView.exe
    mRun: [TPSMain] TPSMain.exe
    mRun: [TMESRV.EXE] c:\program files\toshiba\tme3\TMESRV31.EXE /Logon
    mRun: [TMERzCtl.EXE] c:\program files\toshiba\tme3\TMERzCtl.EXE /Service
    mRun: [TMESBS.EXE] c:\program files\toshiba\tme3\TMESBS32.EXE /Client
    mRun: [TFncKy] TFncKy.exe
    mRun: [TAudEffect] c:\program files\toshiba\taudeffect\TAudEff.exe /run
    mRun: [AGRSMMSG] AGRSMMSG.exe
    mRun: [PRONoMgr.exe] c:\program files\intel\prosetwireless\ncs\proset\PRONoMgr.exe
    mRun: [<NO NAME>]
    mRun: [SunJavaUpdateSched] "c:\program files\java\jre1.6.0_05\bin\jusched.exe"
    mRun: [ezShieldProtector for Px] c:\windows\system32\ezSP_Px.exe
    mRun: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
    mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
    mRun: [avast5] c:\progra~1\alwils~1\avast5\avastUI.exe /nogui
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\blueto~1.lnk - c:\program files\toshiba\bluetooth monitor\BtMon.exe
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\epsons~1.lnk - c:\windows\system32\spool\drivers\w32x86\3\E_SRCV02.EXE
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\blueto~1.lnk - c:\program files\toshiba\bluetooth monitor\BtMon.exe
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\epsons~1.lnk - c:\windows\system32\spool\drivers\w32x86\3\E_SRCV02.EXE
    uPolicies-explorer: NoSMConfigurePrograms = 1 (0x1)
    IE: Append to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    IE: Convert link target to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html
    IE: Convert link target to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    IE: Convert selected links to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    IE: Convert selected links to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    IE: Convert selection to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html
    IE: Convert selection to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    IE: Convert to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html
    IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
    DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} - hxxp://office.microsoft.com/officeupdate/content/opuc.cab
    DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1207271305714
    DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1207271280388
    DPF: {88D969C0-F192-11D4-A65F-0040963251E5} - file://c:\windows\msxml4.cab
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
    DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} - hxxp://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38120.7486458333
    DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
    Notify: Sebring - c:\windows\system32\LgNotify.dll
    SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

    ================= FIREFOX ===================

    FF - ProfilePath - c:\docume~1\bek\applic~1\mozilla\firefox\profiles\9azh5w1w.default\
    FF - prefs.js: browser.startup.homepage - hxxp://www.google.com.au/
    FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
    FF - plugin: c:\program files\viewpoint\viewpoint media player\npViewpoint.dll
    FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
    FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}

    ============= SERVICES / DRIVERS ===============

    R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2010-9-22 165584]
    R1 SAVOnAccessControl;SAVOnAccessControl;c:\windows\system32\drivers\savonaccesscontrol.sys [2007-2-13 104704]
    R1 SAVOnAccessFilter;SAVOnAccessFilter;c:\windows\system32\drivers\savonaccessfilter.sys [2007-2-13 35584]
    R1 TMEI3E;TMEI3E;c:\windows\system32\drivers\TMEI3E.sys [2004-1-8 5760]
    R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2010-9-22 17744]
    R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast5\AvastSvc.exe [2010-9-22 40384]
    R2 OMSI download service;Sony Ericsson OMSI download service;c:\program files\sony ericsson\sony ericsson pc suite\SupServ.exe [2010-1-31 90112]
    R2 Tmesbs;Tmesbs32;c:\program files\toshiba\tme3\tmesbs32.exe [2004-1-8 86016]
    R2 Tmesrv;Tmesrv3;c:\program files\toshiba\tme3\TMESRV31.exe [2004-1-8 126976]
    R2 UBDesktopLdrNTSvc;UB Desktop Service Loader;c:\windows\system32\UBDesktopLdr.exe [2004-5-15 444928]
    R3 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast5\AvastSvc.exe [2010-9-22 40384]
    R3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast5\AvastSvc.exe [2010-9-22 40384]
    R3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\system32\drivers\seehcri.sys [2010-1-31 27632]
    R3 TEchoCan;Toshiba Audio Effect;c:\windows\system32\drivers\TEchoCan.sys [2004-1-14 28416]
    S2 UBDesktopSvcNTSvc;UB Desktop Service;c:\windows\system32\UBDesktopSvc.exe [2004-5-15 598528]
    S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys [2010-1-28 13224]
    S4 SophosBootDriver;SophosBootDriver;c:\windows\system32\drivers\SophosBootDriver.sys [2008-10-1 14976]

    =============== Created Last 30 ================

    2010-11-27 06:17:59 98816 ----a-w- c:\temp\69.tmp\SED.DAT
    2010-11-27 06:17:59 89088 ----a-w- c:\temp\69.tmp\MBR.DAT
    2010-11-27 06:17:59 518144 ----a-w- c:\temp\69.tmp\SWREG.DAT
    2010-11-27 06:17:59 256512 ----a-w- c:\temp\69.tmp\PEV.DAT
    2010-11-27 04:27:43 -------- d-----w- C:\Temp
    2010-11-24 08:28:20 -------- d-----w- C:\155fabfce8180507d7bcc33f6b74
    2010-11-24 07:57:23 -------- d-----w- C:\c458b24023cda7e0db44e1eb04
    2010-11-24 07:57:02 -------- d-----w- C:\4bc0d45331d96606d8deee59
    2010-11-24 06:00:16 -------- d-----w- c:\windows\ie8updates
    2010-11-23 08:16:21 -------- d-----w- c:\docume~1\bek\applic~1\Malwarebytes
    2010-11-23 08:16:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2010-11-23 08:16:07 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
    2010-11-23 08:16:07 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2010-11-23 08:16:07 -------- d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes
    2010-11-23 08:08:06 590848 -c----w- c:\windows\system32\dllcache\rpcrt4.dll
    2010-11-23 07:49:39 617472 -c----w- c:\windows\system32\dllcache\comctl32.dll
    2010-11-23 07:47:29 744448 -c----w- c:\windows\system32\dllcache\helpsvc.exe
    2010-11-23 07:46:48 81920 -c----w- c:\windows\system32\dllcache\fontsub.dll
    2010-11-23 07:46:48 119808 -c----w- c:\windows\system32\dllcache\t2embed.dll
    2010-11-23 07:46:05 2146304 -c----w- c:\windows\system32\dllcache\ntkrnlmp.exe
    2010-11-23 07:46:04 2189952 -c----w- c:\windows\system32\dllcache\ntoskrnl.exe
    2010-11-23 07:46:03 2066816 -c----w- c:\windows\system32\dllcache\ntkrnlpa.exe
    2010-11-23 07:46:03 2024448 -c----w- c:\windows\system32\dllcache\ntkrpamp.exe
    2010-11-23 07:44:37 247808 -c----w- c:\windows\system32\dllcache\ieproxy.dll
    2010-11-23 07:44:37 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
    2010-11-23 07:44:34 743424 -c----w- c:\windows\system32\dllcache\iedvtool.dll
    2010-11-23 07:37:18 954368 -c----w- c:\windows\system32\dllcache\mfc40.dll
    2010-11-23 07:37:17 974848 -c----w- c:\windows\system32\dllcache\mfc42.dll
    2010-11-23 07:37:17 953856 -c----w- c:\windows\system32\dllcache\mfc40u.dll
    2010-11-23 07:36:50 471552 -c----w- c:\windows\system32\dllcache\aclayers.dll
    2010-11-23 07:35:51 473600 -c----w- c:\windows\system32\dllcache\fastprox.dll
    2010-11-23 07:35:51 453120 -c----w- c:\windows\system32\dllcache\wmiprvsd.dll
    2010-11-23 07:35:51 401408 -c----w- c:\windows\system32\dllcache\rpcss.dll
    2010-11-23 07:35:51 35328 -c----w- c:\windows\system32\dllcache\sc.exe
    2010-11-23 07:35:51 284160 -c----w- c:\windows\system32\dllcache\pdh.dll
    2010-11-23 07:35:51 227840 -c----w- c:\windows\system32\dllcache\wmiprvse.exe
    2010-11-23 07:35:51 110592 -c----w- c:\windows\system32\dllcache\services.exe
    2010-11-23 07:35:50 714752 -c----w- c:\windows\system32\dllcache\ntdll.dll
    2010-11-23 07:35:50 617472 -c----w- c:\windows\system32\dllcache\advapi32.dll
    2010-11-23 07:32:57 3558912 -c----w- c:\windows\system32\dllcache\moviemk.exe

    ==================== Find3M ====================

    2010-09-22 01:59:14 73728 ----a-w- c:\windows\system32\javacpl.cpl
    2010-09-22 01:59:13 423656 ----a-w- c:\windows\system32\deployJava1.dll
    2010-09-18 06:53:25 974848 ----a-w- c:\windows\system32\mfc42.dll
    2010-09-18 06:53:25 954368 ----a-w- c:\windows\system32\mfc40.dll
    2010-09-18 06:53:25 953856 ----a-w- c:\windows\system32\mfc40u.dll
    2010-09-18 01:23:26 974848 ----a-w- c:\windows\system32\mfc42u.dll
    2010-09-10 05:58:08 916480 ----a-w- c:\windows\system32\wininet.dll
    2010-09-10 05:58:06 43520 ----a-w- c:\windows\system32\licmgr10.dll
    2010-09-10 05:58:06 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
    2010-09-07 15:12:17 38848 ----a-w- c:\windows\avastSS.scr
    2010-09-01 11:51:14 285824 ----a-w- c:\windows\system32\atmfd.dll
    2010-08-31 13:42:52 1852800 ----a-w- c:\windows\system32\win32k.sys

    ============= FINISH: 17:19:12.34 ===============




    DDS attach log:


    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT

    DDS (Ver_10-11-26.01)

    Microsoft Windows XP Professional
    Boot Device: \Device\HarddiskVolume1
    Install Date: 15/05/2004 4:40:31 AM
    System Uptime: 27/11/2010 3:57:34 PM (2 hours ago)

    Motherboard: TOSHIBA | | Portable PC
    Processor: Intel(R) Pentium(R) M processor 1500MHz | uFC-PGA Socket | 1496/100mhz

    ==== Disk Partitions =========================

    C: is FIXED (NTFS) - 37 GiB total, 6.952 GiB free.
    D: is CDROM ()

    ==== Disabled Device Manager Items =============

    ==== System Restore Points ===================

    RP150: 24/11/2010 8:59:08 PM - Software Distribution Service 3.0
    RP151: 27/11/2010 10:32:32 AM - Removed Apple Software Update
    RP152: 27/11/2010 11:40:46 AM - Software Distribution Service 3.0
    RP153: 27/11/2010 3:16:15 PM - saturday

    ==== Installed Programs ======================

    32 Bit HP CIO Components Installer
    Add or Remove Adobe Creative Suite 3 Master Collection
    Adobe Acrobat 8 Professional
    Adobe Acrobat 8.1.2 Professional
    Adobe After Effects CS3 Presets
    Adobe Anchor Service CS3
    Adobe Asset Services CS3
    Adobe Bridge CS3
    Adobe Bridge Start Meeting
    Adobe BridgeTalk Plugin CS3
    Adobe Camera Raw 4.0
    Adobe CMaps
    Adobe Color - Photoshop Specific
    Adobe Color Common Settings
    Adobe Color EU Extra Settings
    Adobe Color JA Extra Settings
    Adobe Color NA Recommended Settings
    Adobe Creative Suite 3 Master Collection
    Adobe Default Language CS3
    Adobe Device Central CS3
    Adobe Dreamweaver CS3
    Adobe ExtendScript Toolkit 2
    Adobe Extension Manager CS3
    Adobe Fireworks CS3
    Adobe Flash CS3
    Adobe Flash Player 10 ActiveX
    Adobe Flash Player 10 Plugin
    Adobe Flash Player 9 ActiveX
    Adobe Flash Player 9 Plugin
    Adobe Flash Video Encoder
    Adobe Fonts All
    Adobe Help Viewer CS3
    Adobe InDesign CS3 Icon Handler
    Adobe Linguistics CS3
    Adobe MotionPicture Color Files
    Adobe PDF Library Files
    Adobe Setup
    Adobe SING CS3
    Adobe Stock Photos CS3
    Adobe Type Support
    Adobe Update Manager CS3
    Adobe Version Cue CS3 Client
    Adobe Video Profiles
    Adobe WAS CS3
    Adobe WinSoft Linguistics Plugin
    Adobe XMP DVA Panels CS3
    Adobe XMP Panels CS3
    AHV content for Acrobat and Flash
    ALPS Touch Pad Driver
    Amos 16.0
    Atheros Wireless LAN MiniPCI card Driver
    Audacity 1.2.6
    avast! Free Antivirus
    Bluetooth Monitor
    CD/DVD Drive Acoustic Silencer
    Choice Guard
    Citrix Presentation Server Client - Web Only
    Compatibility Pack for the 2007 Office system
    Drag'n Drop CD+DVD
    DVD-RAM Driver
    EPSON Printer Software
    ES C40 C20 Problem Solver
    GroupWise
    HighMAT Extension to Microsoft Windows XP CD Writing Wizard
    Hotfix for Microsoft .NET Framework 3.0 (KB932471)
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
    Hotfix for Windows Internet Explorer 7 (KB947864)
    Hotfix for Windows Media Format 11 SDK (KB929399)
    Hotfix for Windows Media Format SDK (KB902344)
    Hotfix for Windows Media Player 11 (KB939683)
    Hotfix for Windows XP (KB2158563)
    Hotfix for Windows XP (KB952287)
    Hotfix for Windows XP (KB954550-v5)
    Hotfix for Windows XP (KB961118)
    Hotfix for Windows XP (KB970653-v3)
    HTML-Kit
    Intel(R) PRO Network Adapters and Drivers
    Intel(R) PROSet for Wireless
    InterVideo WinDVD 4
    InterVideo WinDVD Creator 2
    Java(TM) 6 Update 21
    Java(TM) 6 Update 5
    Malwarebytes' Anti-Malware
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 1.1 Security Update (KB2416447)
    Microsoft .NET Framework 2.0 Service Pack 2
    Microsoft .NET Framework 3.0 Service Pack 2
    Microsoft .NET Framework 3.5 SP1
    Microsoft Application Error Reporting
    Microsoft Base Smart Card Cryptographic Service Provider Package
    Microsoft Compression Client Pack 1.0 for Windows XP
    Microsoft Internationalized Domain Names Mitigation APIs
    Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
    Microsoft National Language Support Downlevel APIs
    Microsoft Office 2000 Disc 2
    Microsoft Office FrontPage 2003
    Microsoft Office OneNote 2003
    Microsoft Office Professional Edition 2003
    Microsoft Office Project Professional 2003
    Microsoft Office Visio Professional 2003
    Microsoft Producer for Microsoft Office PowerPoint 2003
    Microsoft Silverlight
    Microsoft User-Mode Driver Framework Feature Pack 1.0
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    Mozilla Firefox (3.6.12)
    MSVCRT
    MSXML 4.0 SP2 (KB925672)
    MSXML 4.0 SP2 (KB927978)
    MSXML 4.0 SP2 (KB936181)
    MSXML 4.0 SP2 (KB954430)
    MSXML 4.0 SP2 (KB973688)
    MSXML 6 Service Pack 2 (KB954459)
    NICI (Shared) U.S./Worldwide (128 bit) (2.7.0-2)
    NVIDIA Windows 2000/XP Display Drivers
    OGA Notifier 2.0.0048.0
    Paint.NET v3.20
    PDF Settings
    Photo Story 3 for Windows
    PrintServer Network driver
    PrintServer Utilities
    QuickTime
    RealPlayer
    SecureW2 TTLS Client 3.3.3 for Windows
    Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
    Security Update for Step By Step Interactive Training (KB898458)
    Security Update for Step By Step Interactive Training (KB923723)
    Security Update for Windows Internet Explorer 7 (KB938127)
    Security Update for Windows Internet Explorer 7 (KB942615)
    Security Update for Windows Internet Explorer 7 (KB944533)
    Security Update for Windows Internet Explorer 8 (KB2360131)
    Security Update for Windows Internet Explorer 8 (KB971961)
    Security Update for Windows Internet Explorer 8 (KB981332)
    Security Update for Windows Media Player (KB2378111)
    Security Update for Windows Media Player (KB911564)
    Security Update for Windows Media Player (KB952069)
    Security Update for Windows Media Player (KB954155)
    Security Update for Windows Media Player (KB973540)
    Security Update for Windows Media Player (KB975558)
    Security Update for Windows Media Player (KB978695)
    Security Update for Windows Media Player 10 (KB917734)
    Security Update for Windows Media Player 10 (KB936782)
    Security Update for Windows Media Player 11 (KB936782)
    Security Update for Windows Media Player 11 (KB954154)
    Security Update for Windows Media Player 6.4 (KB925398)
    Security Update for Windows Media Player 9 (KB917734)
    Security Update for Windows XP (KB2079403)
    Security Update for Windows XP (KB2115168)
    Security Update for Windows XP (KB2121546)
    Security Update for Windows XP (KB2229593)
    Security Update for Windows XP (KB2259922)
    Security Update for Windows XP (KB2279986)
    Security Update for Windows XP (KB2286198)
    Security Update for Windows XP (KB2296011)
    Security Update for Windows XP (KB2347290)
    Security Update for Windows XP (KB2360937)
    Security Update for Windows XP (KB2387149)
    Security Update for Windows XP (KB923561)
    Security Update for Windows XP (KB923689)
    Security Update for Windows XP (KB941569)
    Security Update for Windows XP (KB946648)
    Security Update for Windows XP (KB950762)
    Security Update for Windows XP (KB950974)
    Security Update for Windows XP (KB951066)
    Security Update for Windows XP (KB951376-v2)
    Security Update for Windows XP (KB951748)
    Security Update for Windows XP (KB952004)
    Security Update for Windows XP (KB952954)
    Security Update for Windows XP (KB954459)
    Security Update for Windows XP (KB954600)
    Security Update for Windows XP (KB955069)
    Security Update for Windows XP (KB956572)
    Security Update for Windows XP (KB956744)
    Security Update for Windows XP (KB956802)
    Security Update for Windows XP (KB956803)
    Security Update for Windows XP (KB956844)
    Security Update for Windows XP (KB957097)
    Security Update for Windows XP (KB958644)
    Security Update for Windows XP (KB958687)
    Security Update for Windows XP (KB958869)
    Security Update for Windows XP (KB959426)
    Security Update for Windows XP (KB960803)
    Security Update for Windows XP (KB960859)
    Security Update for Windows XP (KB961501)
    Security Update for Windows XP (KB969059)
    Security Update for Windows XP (KB970430)
    Security Update for Windows XP (KB971633)
    Security Update for Windows XP (KB971657)
    Security Update for Windows XP (KB971961)
    Security Update for Windows XP (KB972270)
    Security Update for Windows XP (KB973507)
    Security Update for Windows XP (KB973869)
    Security Update for Windows XP (KB973904)
    Security Update for Windows XP (KB974112)
    Security Update for Windows XP (KB974318)
    Security Update for Windows XP (KB974392)
    Security Update for Windows XP (KB974571)
    Security Update for Windows XP (KB975025)
    Security Update for Windows XP (KB975467)
    Security Update for Windows XP (KB975560)
    Security Update for Windows XP (KB975562)
    Security Update for Windows XP (KB975713)
    Security Update for Windows XP (KB977816)
    Security Update for Windows XP (KB977914)
    Security Update for Windows XP (KB978037)
    Security Update for Windows XP (KB978338)
    Security Update for Windows XP (KB978542)
    Security Update for Windows XP (KB978601)
    Security Update for Windows XP (KB978706)
    Security Update for Windows XP (KB979309)
    Security Update for Windows XP (KB979482)
    Security Update for Windows XP (KB979687)
    Security Update for Windows XP (KB980195)
    Security Update for Windows XP (KB980232)
    Security Update for Windows XP (KB980436)
    Security Update for Windows XP (KB981322)
    Security Update for Windows XP (KB981852)
    Security Update for Windows XP (KB981957)
    Security Update for Windows XP (KB981997)
    Security Update for Windows XP (KB982132)
    Security Update for Windows XP (KB982214)
    Security Update for Windows XP (KB982665)
    Segoe UI
    Sony Ericsson Media Manager 1.2
    Sony Ericsson PC Suite 6.009.00
    SoundMAX
    SPSS 16.0 for Windows
    SPSS SmartViewer 16.0
    TOSHIBA Audio Effect
    TOSHIBA ConfigFree
    TOSHIBA Console
    TOSHIBA Controls
    TOSHIBA Display Devices Change Utility
    TOSHIBA Dual Pointing Device Utility
    TOSHIBA Hotkey Utility for Display Devices
    TOSHIBA IPPhone
    TOSHIBA Mobile Extension3 for Windows XP V3.59.00.XP
    TOSHIBA PC Diagnostic Tool
    TOSHIBA Power Saver
    TOSHIBA SD Memory Boot Utility
    TOSHIBA SD Memory Card Format
    TOSHIBA Software Modem
    TOSHIBA Utilities
    TOSHIBA Zooming Utility
    Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
    Update for Windows Internet Explorer 8 (KB976662)
    Update for Windows XP (KB2141007)
    Update for Windows XP (KB2345886)
    Update for Windows XP (KB951978)
    Update for Windows XP (KB955759)
    Update for Windows XP (KB967715)
    Update for Windows XP (KB968389)
    Update for Windows XP (KB971737)
    Update for Windows XP (KB973815)
    Update Service
    Viewpoint Media Player (Remove Only)
    WebFldrs XP
    Windows Genuine Advantage Notifications (KB905474)
    Windows Genuine Advantage Validation Tool (KB892130)
    Windows Imaging Component
    Windows Installer Clean Up
    Windows Internet Explorer 7
    Windows Internet Explorer 8
    Windows Live Call
    Windows Live Communications Platform
    Windows Live Essentials
    Windows Media Format 11 runtime
    Windows Media Format SDK Hotfix - KB891122
    Windows Media Player 11
    Windows Presentation Foundation
    Windows SD Host Controller Driver
    Windows XP Service Pack 3
    Wireless Hotkey
    Write-N-Cite
    XML Paper Specification Shared Components Pack 1.0
    XQDC X-Setup Pro 9.2.100

    ==== Event Viewer Messages From Past Week ========

    27/11/2010 11:55:26 AM, error: Dhcp [1002] - The IP address lease 192.168.1.2 for the Network Card with network address 0011F540FD3D has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message).
    24/11/2010 8:47:02 PM, error: Service Control Manager [7000] - The IMAPI CD-Burning COM Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    24/11/2010 8:46:24 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the IMAPI CD-Burning COM Service service to connect.
    24/11/2010 8:16:17 PM, error: Service Control Manager [7034] - The Windows Installer service terminated unexpectedly. It has done this 1 time(s).
    24/11/2010 7:43:40 PM, error: Windows Update Agent [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Microsoft .NET Framework 3.5 Service Pack 1 and .NET Framework 3.5 Family Update for .NET versions 2.0 through 3.5 (KB951847) x86.
    24/11/2010 5:25:41 PM, error: Windows Update Agent [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Microsoft .NET Framework 2.0 Service Pack 1 Security Update for Windows 2000, Windows Server 2003, and Windows XP (KB953300).
    24/11/2010 5:14:55 PM, error: Windows Update Agent [20] - Installation Failure: Windows failed to install the following update with error 0x80070652: Security Update for Microsoft Office 2003 (KB972580).
    24/11/2010 5:13:23 PM, error: Windows Update Agent [20] - Installation Failure: Windows failed to install the following update with error 0x80070652: Security Update for Microsoft Office Project 2003 (KB961082).
    24/11/2010 5:11:02 PM, error: Windows Update Agent [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Security Update for Microsoft Silverlight (KB978464).
    24/11/2010 5:04:52 PM, error: atapi [9] - The device, \Device\Ide\IdePort0, did not respond within the timeout period.
    24/11/2010 5:04:52 PM, error: atapi [11] - The driver detected a controller error on \Device\Ide\IdePort0.
    24/11/2010 4:39:48 PM, error: Service Control Manager [7023] - The IPSEC Services service terminated with the following error: The authentication service is unknown.
    24/11/2010 4:39:48 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the UB Desktop Service service to connect.
    24/11/2010 4:39:48 PM, error: Service Control Manager [7000] - The UB Desktop Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    24/11/2010 4:39:48 PM, error: Service Control Manager [7000] - The Sophos Anti-Virus status reporter service failed to start due to the following error: The system cannot find the file specified.
    24/11/2010 4:39:48 PM, error: Service Control Manager [7000] - The Sophos Anti-Virus service failed to start due to the following error: The system cannot find the file specified.
    23/11/2010 6:54:08 PM, error: Service Control Manager [7034] - The UB Desktop Service Loader service terminated unexpectedly. It has done this 1 time(s).
    23/11/2010 6:54:08 PM, error: Service Control Manager [7034] - The RegSrvc service terminated unexpectedly. It has done this 1 time(s).
    23/11/2010 6:54:07 PM, error: Service Control Manager [7034] - The Tmesrv3 service terminated unexpectedly. It has done this 1 time(s).
    23/11/2010 6:54:07 PM, error: Service Control Manager [7034] - The Tmesbs32 service terminated unexpectedly. It has done this 1 time(s).
    23/11/2010 6:54:07 PM, error: Service Control Manager [7034] - The SoundMAX Agent Service service terminated unexpectedly. It has done this 1 time(s).
    23/11/2010 6:54:06 PM, error: Service Control Manager [7034] - The Sony Ericsson OMSI download service service terminated unexpectedly. It has done this 1 time(s).
    23/11/2010 6:54:06 PM, error: Service Control Manager [7034] - The NVIDIA Driver Helper Service service terminated unexpectedly. It has done this 1 time(s).
    23/11/2010 6:54:06 PM, error: Service Control Manager [7034] - The Java Quick Starter service terminated unexpectedly. It has done this 1 time(s).
    23/11/2010 6:54:06 PM, error: Service Control Manager [7034] - The EPSON Printer Status Agent2 service terminated unexpectedly. It has done this 1 time(s).
    23/11/2010 6:54:06 PM, error: Service Control Manager [7034] - The DVD-RAM_Service service terminated unexpectedly. It has done this 1 time(s).
    23/11/2010 6:54:05 PM, error: Service Control Manager [7034] - The Spectrum24 Event Monitor service terminated unexpectedly. It has done this 1 time(s).
    23/11/2010 6:54:05 PM, error: Service Control Manager [7034] - The ConfigFree Service service terminated unexpectedly. It has done this 1 time(s).
    23/11/2010 6:54:05 PM, error: Service Control Manager [7034] - The ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## service terminated unexpectedly. It has done this 1 time(s).
    23/11/2010 6:34:09 PM, error: Service Control Manager [7006] - The ScRegSetValueExW call failed for FailureActions with the following error: Access is denied.
    23/11/2010 6:19:20 PM, error: Service Control Manager [7031] - The Print Spooler service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
    23/11/2010 6:18:48 PM, error: Service Control Manager [7034] - The Machine Debug Manager service terminated unexpectedly. It has done this 1 time(s).

    ==== End Of File ===========================
     
  2. crunchie

    crunchie Malware Helper Posts: 728

    Not seeing much there.

    Please Run the ESET Online Scanner and post the ScanLog with your post for assistance.
    • You will need to use Internet Explorer to complete this scan.
    • You will need to temporarily Disable your current Anti-virus program.
    • Be sure the option to Remove found threats is Un-checked at this time (we may have it clean what it finds at a later time), and the option to Scan unwanted applications is Checked.
    • When you have completed that scan, a scanlog ought to have been created and located at C:\Program Files\EsetOnlineScanner\log.txt. Please post that log for us as directed below.

    NOTE: If you are unable to complete the ESET scan, please try another from the list below:

     
  3. Bobbye

    Bobbye Helper on the Fringe Posts: 16,335   +36

    Crunchie, you may want the OP to clarify how many computers they have us working on! My apology but things are getting murky since there are two other active threads. I recognized the name since I'm working on 2 threads for this OP.

    ignoramus, I am helping you on the following two threads which are still Active, although you have not following through with one of them.
    1.) 4 Days Ago
    Avast thinks the download of GMER has a "win32:trojan-gen" infection
    After reboot the original issue was resolved and you left the thread.
    http://www.techspot.com/vb/topic157039.html

    2.) 5 Days Ago- thread still active, last post 17 hours ago
    "Antivirus2010" virus - I've followed the steps, is that it?
    http://www.techspot.com/vb/topic156987.html
    ==========================================
    Now you have started another thread:
    3.) 12 Hours Ago
    8 steps completed; logs provided
    http://www.techspot.com/vb/topic157263.html

    The computers are connected through a home network- is that right? Are #2 and #3 two different computers, both connected to the home network? Or are they the same computers. Since one is a work computer but is connected to the home network, what is the total number of different systems you're putting here for cleaning?
     
  4. crunchie

    crunchie Malware Helper Posts: 728

    No worries. Thanks Bobbye.
     
  5. ignoramus

    ignoramus TS Rookie Topic Starter Posts: 18

    Hello,

    I'm sorry about the confusion I've caused here. The total number of computers I have is 2. I have a computer which I use at home for leisure (for clarity, I'll start caling that the "leisure computer"), and a second computer that I use primarily for work purposes but which I also use at home (the "work computer"). The work computer was the initial infected one and the one with which Bobbye has been assisting me.

    I then decided to check the leisure computer out as well. I started the thread you've numbered 1 ("Avast thinks the download of GMER has a "win32:trojan-gen" infection") because I was having trouble downloading GMER on the leisure computer. I left that thread because that particular issue was resolved. I thought (mistakenly it seems) I should post the logs from the lesiure computer as a new thread, since they were about having the computer scanned which was - I thought - a separate issue from the downloading problem.

    When I say they're on a home network - they both access the same wirless print server and they both get their internet via wi-fi from the same source. There is no sharing of drives or anything like that though.

    I'm not sure what I should do now. Do you still want me to post the ESET log? (it didn't find anything).
     
  6. crunchie

    crunchie Malware Helper Posts: 728

    My advice is to disconnect this PC from the network (and any other) until Bobbye has cleared the infected one.
    Is this particular PC showing symptoms of malware?
     
  7. ignoramus

    ignoramus TS Rookie Topic Starter Posts: 18

    Ok, thanks Crunchie. It's not showing signs of any problem at all, I just wanted to play it safe. I'll wait and see what comes about from the work computer.

    Cheers.
     
  8. Bobbye

    Bobbye Helper on the Fringe Posts: 16,335   +36

    The wrap up- I think!

    Original Work laptop:
    Second computer> I started helping you but you did not leave the logs.
    You started the thread for the second computer because you thought it 'might be' infected. I picked up the thread- you were having a problem with one of the scans. It got resolved so you started a new thread.

    I for one was very confused and have spent a lot of time trying to figure out what you did. I'm going to close the second thread with the GMER problem and I will back off that computer.

    Crunchie, why don't you just help her with this, the second system, with no regard for the other. She isn't print or file sharing and has not indication of a DNS infection.

    Ignorance, please keep anything about the second computer- the leisure one, here
    I will help you separately on the work laptop and everything for and about that system must go on the original thread.
     
  9. crunchie

    crunchie Malware Helper Posts: 728

    No worries Bobbye.

    Let's look a little deeper just to be sure then.

    Download OTL to your Desktop.

    * Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
    * Under the Custom Scan box paste this in:


    netsvcs
    %SYSTEMDRIVE%\*.exe
    /md5start
    eventlog.dll
    scecli.dll
    netlogon.dll
    cngaudit.dll
    sceclt.dll
    ntelogon.dll
    logevent.dll
    iaStor.sys
    nvstor.sys
    atapi.sys
    IdeChnDr.sys
    viasraid.sys
    AGP440.sys
    vaxscsi.sys
    nvatabus.sys
    viamraid.sys
    nvata.sys
    nvgts.sys
    iastorv.sys
    ViPrt.sys
    eNetHook.dll
    ahcix86.sys
    KR10N.sys
    nvstor32.sys
    /md5stop
    %systemroot%\*. /mp /s
    %systemroot%\system32\*.dll /lockedfiles
    %systemroot%\System32\config\*.sav
    CREATERESTOREPOINT


    * Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
    • When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
    • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.

    ==============

    Go to Kaspersky website and perform an online antivirus scan.

    1. Disable your active antivirus program.
    2. Read through the requirements and privacy statement and click on the Accept button.
    3. It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
    4. When the downloads have finished, click on Settings.
    5. Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:

    • Spyware, Adware, Dialers, and other potentially dangerous programs
      [*] Archives
      [*] Mail databases
    6. Click on My Computer under Scan.
    7. Once the scan is complete, it will display the results. Click on View Scan Report.
    8. You will see a list of infected items there. Click on Save Report As....
    9. Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button. Then post it here.
     
  10. ignoramus

    ignoramus TS Rookie Topic Starter Posts: 18

    Bobbye - yes that summary is correct. I thought I was doing the right thing. Sorry once again.

    Crunchie - thanks for your help. The 2 logs from OTL are below. When I went to run Kaspersky, I got a warning message that said:

    "Java has discovered application components that could indicate a secrity concern.

    Name: javavm
    Block potentially unsafe components from being run? (recommended)

    The application contains both signed and unsigned code. Contact the application vendor to ensure it has not been tampered with".

    Should I proced with the scan? And do I need to "Block potentially unsafe components "?

    Cheers.

    OTL.txt:

    OTL logfile created on: 29/11/2010 6:56:12 PM - Run 1
    OTL by OldTimer - Version 3.2.17.3 Folder = C:\Documents and Settings\Bek\Desktop
    Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
    Internet Explorer (Version = 8.0.6001.18702)
    Locale: 00000C09 | Country: Australia | Language: ENA | Date Format: d/MM/yyyy

    767.00 Mb Total Physical Memory | 473.00 Mb Available Physical Memory | 62.00% Memory free
    1.00 Gb Paging File | 1.00 Gb Available in Paging File | 86.00% Paging File free
    Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
    Drive C: | 37.25 Gb Total Space | 6.71 Gb Free Space | 18.02% Space Free | Partition Type: NTFS

    Computer Name: LAPTOP | User Name: Bek | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: Current user | Quick Scan
    Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

    ========== Processes (SafeList) ==========

    PRC - [2010/11/29 18:51:12 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Bek\Desktop\OTL.exe
    PRC - [2010/09/08 02:12:02 | 002,838,912 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastUI.exe
    PRC - [2010/09/08 02:11:59 | 000,040,384 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
    PRC - [2009/04/30 12:23:26 | 000,090,112 | ---- | M] () -- C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe
    PRC - [2008/04/14 05:42:20 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
    PRC - [2008/02/22 05:25:21 | 000,144,784 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    PRC - [2008/02/22 05:25:20 | 000,329,104 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre1.6.0_05\bin\jucheck.exe
    PRC - [2003/12/26 11:17:32 | 000,208,972 | ---- | M] (TOSHIBA) -- C:\Program Files\Toshiba\TAudEffect\TAudEff.exe
    PRC - [2003/12/16 09:30:06 | 000,356,352 | ---- | M] (Intel Corporation) -- C:\WINDOWS\system32\ZCfgSvc.exe
    PRC - [2003/12/16 09:24:20 | 000,184,320 | ---- | M] (Intel) -- C:\WINDOWS\system32\1XConfig.exe
    PRC - [2003/12/16 09:23:40 | 000,303,171 | ---- | M] (Intel Corporation ) -- C:\WINDOWS\system32\S24EvMon.exe
    PRC - [2003/12/16 09:22:36 | 000,122,880 | ---- | M] (Intel Corporation) -- C:\WINDOWS\system32\RegSrvc.exe
    PRC - [2003/12/16 06:54:20 | 000,278,528 | ---- | M] (TOSHIBA Corporation) -- C:\WINDOWS\system32\TPSMain.exe
    PRC - [2003/12/16 06:53:56 | 000,045,056 | ---- | M] (TOSHIBA Corporation) -- C:\WINDOWS\system32\TPSBattM.exe
    PRC - [2003/12/10 15:50:54 | 000,126,976 | ---- | M] (TOSHIBA) -- C:\Program Files\Toshiba\TME3\TMESRV31.exe
    PRC - [2003/12/04 07:26:14 | 000,131,072 | ---- | M] (TOSHIBA Corporation) -- C:\Program Files\Toshiba\TOSHIBA Zooming Utility\SmoothView.exe
    PRC - [2003/12/02 19:05:54 | 000,028,672 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files\Toshiba\ConfigFree\CFSvcs.exe
    PRC - [2003/11/22 09:49:28 | 000,258,048 | ---- | M] (TOSHIBA Corp.) -- C:\WINDOWS\system32\00THotkey.exe
    PRC - [2003/11/17 21:42:12 | 000,073,728 | ---- | M] (TOSHIBA Corp.) -- C:\WINDOWS\system32\TFNF5.exe
    PRC - [2003/11/12 15:19:04 | 000,159,744 | ---- | M] (TOSHIBA) -- C:\Program Files\Toshiba\DualPointUtility\TEDTray.exe
    PRC - [2003/10/22 00:28:42 | 000,065,536 | ---- | M] (TOSHIBA) -- C:\Program Files\Toshiba\Bluetooth Monitor\BtMon.exe
    PRC - [2003/10/07 12:43:50 | 000,077,824 | ---- | M] (TOSHIBA) -- C:\Program Files\Toshiba\TME3\TMERzCtl.exe
    PRC - [2003/09/19 17:32:32 | 000,077,824 | ---- | M] (TOSHIBA) -- C:\Program Files\Toshiba\TME3\TMEEJME.exe
    PRC - [2003/08/19 04:51:02 | 000,102,400 | ---- | M] (TOSHIBA Corporation) -- C:\Program Files\Toshiba\TOSHIBA Controls\TFncKy.exe
    PRC - [2003/08/02 09:56:02 | 000,086,016 | ---- | M] (TOSHIBA Corporation) -- C:\Program Files\Toshiba\TME3\tmesbs32.exe
    PRC - [2003/05/23 15:38:26 | 000,106,496 | ---- | M] (Matsushita Electric Industrial Co., Ltd.) -- C:\WINDOWS\system32\DVDRAMSV.exe
    PRC - [2002/09/21 11:50:10 | 000,045,056 | ---- | M] (Analog Devices, Inc.) -- C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    PRC - [2002/09/10 10:07:34 | 000,049,152 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files\Toshiba\Wireless Hotkey\TosHKCW.exe
    PRC - [2002/08/20 12:29:26 | 000,040,960 | ---- | M] (Easy Systems Japan Ltd.) -- C:\WINDOWS\system32\ezSP_Px.exe
    PRC - [2002/05/03 15:01:06 | 000,444,928 | ---- | M] (University of Ballarat) -- C:\WINDOWS\system32\UBDesktopLdr.exe
    PRC - [2000/11/17 01:02:00 | 000,114,688 | ---- | M] (SEIKO EPSON CORPORATION) -- C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe


    ========== Modules (SafeList) ==========

    MOD - [2010/11/29 18:51:12 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Bek\Desktop\OTL.exe
    MOD - [2010/08/24 03:12:02 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll


    ========== Win32 Services (SafeList) ==========

    SRV - File not found [On_Demand | Stopped] -- C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe -- (Macromedia Licensing Service)
    SRV - File not found [Disabled | Stopped] -- C:\WINDOWS\System32\hidserv.dll -- (HidServ)
    SRV - [2010/09/08 02:11:59 | 000,040,384 | ---- | M] (AVAST Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Web Scanner)
    SRV - [2010/09/08 02:11:59 | 000,040,384 | ---- | M] (AVAST Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Mail Scanner)
    SRV - [2010/09/08 02:11:59 | 000,040,384 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus)
    SRV - [2009/04/30 12:23:26 | 000,090,112 | ---- | M] () [Auto | Running] -- C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe -- (OMSI download service)
    SRV - [2008/04/04 14:37:58 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
    SRV - [2003/12/16 09:23:40 | 000,303,171 | ---- | M] (Intel Corporation ) [Auto | Running] -- C:\WINDOWS\system32\S24EvMon.exe -- (S24EventMonitor)
    SRV - [2003/12/16 09:22:36 | 000,122,880 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\WINDOWS\system32\RegSrvc.exe -- (RegSrvc)
    SRV - [2003/12/10 15:50:54 | 000,126,976 | ---- | M] (TOSHIBA) [Auto | Running] -- C:\Program Files\TOSHIBA\TME3\Tmesrv31.exe -- (Tmesrv)
    SRV - [2003/12/02 19:05:54 | 000,028,672 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- C:\Program Files\Toshiba\ConfigFree\CFSvcs.exe -- (CFSvcs)
    SRV - [2003/08/02 09:56:02 | 000,086,016 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Program Files\TOSHIBA\TME3\Tmesbs32.exe -- (Tmesbs)
    SRV - [2003/05/23 15:38:26 | 000,106,496 | ---- | M] (Matsushita Electric Industrial Co., Ltd.) [Auto | Running] -- C:\WINDOWS\system32\DVDRAMSV.exe -- (DVD-RAM_Service)
    SRV - [2002/09/21 11:50:10 | 000,045,056 | ---- | M] (Analog Devices, Inc.) [Auto | Running] -- C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe -- (SoundMAX Agent Service (default))
    SRV - [2002/05/03 15:01:06 | 000,444,928 | ---- | M] (University of Ballarat) [Auto | Running] -- C:\WINDOWS\system32\UBDesktopLdr.exe -- (UBDesktopLdrNTSvc)
    SRV - [2002/05/03 15:00:42 | 000,598,528 | ---- | M] (University of Ballarat) [Auto | Stopped] -- C:\WINDOWS\system32\UBDesktopSvc.exe -- (UBDesktopSvcNTSvc)
    SRV - [2000/11/17 01:02:00 | 000,114,688 | ---- | M] (SEIKO EPSON CORPORATION) [Auto | Running] -- C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe -- (EPSONStatusAgent2)


    ========== Driver Services (SafeList) ==========

    DRV - [2010/09/08 01:52:25 | 000,046,672 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswTdi.sys -- (aswTdi)
    DRV - [2010/09/08 01:52:03 | 000,165,584 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswSP.sys -- (aswSP)
    DRV - [2010/09/08 01:47:46 | 000,023,376 | ---- | M] (AVAST Software) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\aswRdr.sys -- (aswRdr)
    DRV - [2010/09/08 01:47:19 | 000,100,176 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswmon2.sys -- (aswMon2)
    DRV - [2010/09/08 01:47:07 | 000,017,744 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
    DRV - [2010/09/08 01:46:51 | 000,028,880 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aavmker4.sys -- (Aavmker4)
    DRV - [2010/01/28 14:34:05 | 000,025,512 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ggsemc.sys -- (ggsemc)
    DRV - [2010/01/28 14:34:05 | 000,013,224 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ggflt.sys -- (ggflt)
    DRV - [2008/10/01 13:07:15 | 000,014,976 | ---- | M] (Sophos Plc) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\drivers\SophosBootDriver.sys -- (SophosBootDriver)
    DRV - [2008/10/01 13:07:11 | 000,104,704 | ---- | M] (Sophos Plc) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\savonaccesscontrol.sys -- (SAVOnAccessControl)
    DRV - [2008/10/01 13:07:09 | 000,035,584 | ---- | M] (Sophos Plc) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\savonaccessfilter.sys -- (SAVOnAccessFilter)
    DRV - [2008/04/03 06:03:08 | 001,333,152 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\athw.sys -- (AR5416)
    DRV - [2008/01/09 12:28:34 | 000,027,632 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\seehcri.sys -- (seehcri)
    DRV - [2007/06/25 12:43:38 | 000,098,344 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s117obex.sys -- (s117obex)
    DRV - [2007/06/25 12:43:36 | 000,108,456 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s117mdm.sys -- (s117mdm)
    DRV - [2007/06/25 12:43:36 | 000,100,264 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s117mgmt.sys -- (s117mgmt) Sony Ericsson Device 117 USB WMC Device Management Drivers (WDM)
    DRV - [2007/06/25 12:43:36 | 000,098,856 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s117unic.sys -- (s117unic) Sony Ericsson Device 117 USB Ethernet Emulation SEMC117 (WDM)
    DRV - [2007/06/25 12:43:36 | 000,022,952 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s117nd5.sys -- (s117nd5) Sony Ericsson Device 117 USB Ethernet Emulation SEMC117 (NDIS)
    DRV - [2007/06/25 12:43:26 | 000,014,888 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s117mdfl.sys -- (s117mdfl)
    DRV - [2007/06/25 12:43:22 | 000,082,984 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s117bus.sys -- (s117bus) Sony Ericsson Device 117 driver (WDM)
    DRV - [2005/09/12 19:08:30 | 000,468,736 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ar5211.sys -- (AR5211)
    DRV - [2004/01/10 14:26:46 | 000,028,416 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\TEchoCan.sys -- (TEchoCan)
    DRV - [2004/01/07 15:29:39 | 000,008,605 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Tosrfec.sys -- (tosrfec)
    DRV - [2003/12/17 15:08:46 | 000,013,312 | ---- | M] (National Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\NscTpmDD.sys -- (portio)
    DRV - [2003/12/16 09:16:26 | 000,010,970 | ---- | M] (Intel Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\s24trans.sys -- (s24trans)
    DRV - [2003/12/10 19:11:26 | 000,100,153 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Apfiltr.sys -- (ApfiltrService)
    DRV - [2003/12/10 08:50:00 | 001,373,436 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv)
    DRV - [2003/12/05 21:50:28 | 000,979,840 | R--- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\w70n51.sys -- (w70n51) Intel(R)
    DRV - [2003/10/24 15:53:14 | 000,090,416 | ---- | M] (Matsushita Electric Industrial Co.,Ltd.) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\meiudf.sys -- (meiudf)
    DRV - [2003/08/24 21:57:00 | 000,010,240 | ---- | M] (Padus, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\pfc.sys -- (Pfc)
    DRV - [2003/08/08 10:52:00 | 000,009,216 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\TVALZ.SYS -- (TVALZ)
    DRV - [2003/01/29 16:35:00 | 000,012,032 | ---- | M] (TOSHIBA Corporation.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\Netdevio.sys -- (Netdevio)
    DRV - [2002/12/21 08:07:34 | 001,164,576 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AGRSM.sys -- (AgereSoftModem)
    DRV - [2002/11/18 19:20:44 | 000,030,976 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\gv3.sys -- (gv3)
    DRV - [2002/09/27 08:15:28 | 000,005,760 | ---- | M] (Toshiba Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\TMEI3E.sys -- (TMEI3E)
    DRV - [2002/04/07 14:50:56 | 000,019,607 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\System32\drivers\TOSSMBNT.sys -- (tossmbnt)
    DRV - [2001/09/11 13:54:32 | 000,038,425 | ---- | M] (SMC) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\smcirda.sys -- (SMCIRDA)
    DRV - [2001/08/17 23:13:20 | 000,027,164 | ---- | M] (Xircom, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\CE3N5.SYS -- (CE3)
    DRV - [2001/08/17 14:53:32 | 000,003,328 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\qv2kux.sys -- (QV2KUX)


    ========== Standard Registry (SafeList) ==========


    ========== Internet Explorer ==========


    IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com.au/
    IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
    IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.ballarat.edu.au*
    IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = proxy.ballarat.edu.au:8080

    ========== FireFox ==========

    FF - prefs.js..browser.startup.homepage: "http://www.google.com.au/"
    FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.2.2
    FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
    FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0

    FF - HKLM\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/11/08 22:11:43 | 000,000,000 | ---D | M]
    FF - HKLM\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/10/30 14:51:16 | 000,000,000 | ---D | M]

    [2008/12/16 16:43:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bek\Application Data\Mozilla\Extensions
    [2010/11/29 18:51:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bek\Application Data\Mozilla\Firefox\Profiles\9azh5w1w.default\extensions
    [2010/10/22 17:36:37 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Documents and Settings\Bek\Application Data\Mozilla\Firefox\Profiles\9azh5w1w.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
    [2010/11/29 18:51:45 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
    [2010/09/22 12:59:41 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
    [2010/09/22 12:59:16 | 000,423,656 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll

    O1 HOSTS File: ([2003/03/31 23:00:00 | 000,000,734 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
    O1 - Hosts: 127.0.0.1 localhost
    O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
    O2 - BHO: (no name) - -{39EA7695-B3F2-4C44-A4BC-297ADA8FD235} - No CLSID value found.
    O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
    O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
    O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
    O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
    O4 - HKLM..\Run: [] File not found
    O4 - HKLM..\Run: [000StTHK] C:\WINDOWS\System32\000StTHK.exe ()
    O4 - HKLM..\Run: [00THotkey] C:\WINDOWS\system32\00THotkey.exe (TOSHIBA Corp.)
    O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\AvastUI.exe (AVAST Software)
    O4 - HKLM..\Run: [BluetoothAuthenticationAgent] C:\WINDOWS\System32\bthprops.cpl (Microsoft Corporation)
    O4 - HKLM..\Run: [DpUtil] C:\Program Files\Toshiba\DualPointUtility\TEDTray.exe (TOSHIBA)
    O4 - HKLM..\Run: [ezShieldProtector for Px] C:\WINDOWS\system32\ezSP_Px.exe (Easy Systems Japan Ltd.)
    O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
    O4 - HKLM..\Run: [NVRotateSysTray] C:\WINDOWS\System32\nvsysrot.DLL (NVIDIA Corporation)
    O4 - HKLM..\Run: [PRONoMgr.exe] C:\Program Files\Intel\PROSetWireless\NCS\PROSet\PRONoMgr.exe (Intel(R) Corporation)
    O4 - HKLM..\Run: [SmoothView] C:\Program Files\Toshiba\TOSHIBA Zooming Utility\SmoothView.exe (TOSHIBA Corporation)
    O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe (Sun Microsystems, Inc.)
    O4 - HKLM..\Run: [TAudEffect] C:\Program Files\Toshiba\TAudEffect\TAudEff.exe (TOSHIBA)
    O4 - HKLM..\Run: [TFncKy] File not found
    O4 - HKLM..\Run: [TFNF5] C:\WINDOWS\System32\TFNF5.exe (TOSHIBA Corp.)
    O4 - HKLM..\Run: [TMERzCtl.EXE] C:\Program Files\TOSHIBA\TME3\TMERzCtl.EXE (TOSHIBA)
    O4 - HKLM..\Run: [TMESBS.EXE] C:\Program Files\TOSHIBA\TME3\TMESBS32.EXE (TOSHIBA Corporation)
    O4 - HKLM..\Run: [TMESRV.EXE] C:\Program Files\TOSHIBA\TME3\TMESRV31.EXE (TOSHIBA)
    O4 - HKLM..\Run: [TosHKCW.exe] C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe (TOSHIBA CORPORATION)
    O4 - HKLM..\Run: [TPSMain] C:\WINDOWS\System32\TPSMain.exe (TOSHIBA Corporation)
    O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Bluetooth Monitor.lnk = C:\Program Files\Toshiba\Bluetooth Monitor\BtMon.exe (TOSHIBA)
    O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV02.EXE (SEIKO EPSON CORPORATION)
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
    O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
    O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMConfigurePrograms = 1
    O8 - Extra context menu item: Append to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
    O8 - Extra context menu item: Convert link target to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
    O8 - Extra context menu item: Convert link target to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
    O8 - Extra context menu item: Convert selected links to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
    O8 - Extra context menu item: Convert selected links to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
    O8 - Extra context menu item: Convert selection to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
    O8 - Extra context menu item: Convert selection to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
    O8 - Extra context menu item: Convert to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
    O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Computer, Inc.)
    O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} http://office.microsoft.com/officeupdate/content/opuc.cab (Office Update Installation Engine)
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://www.update.microsoft.com/mic...ls/en/x86/client/wuweb_site.cab?1207271305714 (WUWebControl Class)
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1207271280388 (MUWebControl Class)
    O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
    O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} file://C:\WINDOWS\msxml4.cab (XML DOM Document 4.0)
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
    O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38120.7486458333 (Reg Error: Key error.)
    O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Java Plug-in 1.6.0_05)
    O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
    O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
    O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
    O20 - Winlogon\Notify\Sebring: DllName - C:\WINDOWS\System32\LgNotify.dll - C:\WINDOWS\system32\LgNotify.dll (Intel Corporation)
    O24 - Desktop WallPaper: C:\Documents and Settings\Bek\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
    O24 - Desktop BackupWallPaper: C:\Documents and Settings\Bek\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
    O32 - HKLM CDRom: AutoRun - 1
    O32 - AutoRun File - [2004/01/08 06:58:37 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
    O33 - MountPoints2\{5c6f334c-54eb-11df-bff9-00037a205c33}\Shell - "" = AutoRun
    O33 - MountPoints2\{5c6f334c-54eb-11df-bff9-00037a205c33}\Shell\AutoRun - "" = Auto&Play
    O33 - MountPoints2\{5c6f334c-54eb-11df-bff9-00037a205c33}\Shell\AutoRun\command - "" = E:\Connect.exe -- File not found
    O33 - MountPoints2\{fd2af9a0-d7cc-11dd-bf73-0011f540fd3d}\Shell\AutoRun\command - "" = E:\InstallTomTomHOME.exe -- File not found
    O34 - HKLM BootExecute: (autocheck autochk *) - File not found
    O35 - HKLM\..comfile [open] -- "%1" %*
    O35 - HKLM\..exefile [open] -- "%1" %*
    O37 - HKLM\...com [@ = comfile] -- "%1" %*
    O37 - HKLM\...exe [@ = exefile] -- "%1" %*

    NetSvcs: 6to4 - File not found
    NetSvcs: HidServ - C:\WINDOWS\System32\hidserv.dll File not found
    NetSvcs: Ias - File not found
    NetSvcs: Iprip - File not found
    NetSvcs: LanmanWorkstation - File not found
    NetSvcs: Messenger - File not found
    NetSvcs: NWCWorkstation - File not found
    NetSvcs: Nwsapagent - File not found
    NetSvcs: WmdmPmSp - File not found
    NetSvcs: Ip6FwHlp - File not found

    CREATERESTOREPOINT
    Restore point Set: OTL Restore Point (16902109354000384)

    ========== Files/Folders - Created Within 30 Days ==========

    [2010/11/29 18:51:10 | 000,575,488 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Bek\Desktop\OTL.exe
    [2010/11/28 19:01:25 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Bek\Desktop\ThankYou_files
    [2010/11/28 11:38:20 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
    [2010/11/27 15:27:43 | 000,000,000 | ---D | C] -- C:\Temp
    [2010/11/24 21:29:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage
    [2010/11/24 20:12:34 | 000,000,000 | -HSD | C] -- C:\Config.Msi
    [2010/11/24 19:28:20 | 000,000,000 | ---D | C] -- C:\155fabfce8180507d7bcc33f6b74
    [2010/11/24 18:57:23 | 000,000,000 | ---D | C] -- C:\c458b24023cda7e0db44e1eb04
    [2010/11/24 18:57:02 | 000,000,000 | ---D | C] -- C:\4bc0d45331d96606d8deee59
    [2010/11/24 18:47:31 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\zh-TW
    [2010/11/24 18:47:31 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\zh-HK
    [2010/11/24 18:47:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\tr-TR
    [2010/11/24 18:47:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\sv-SE
    [2010/11/24 18:47:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\pt-BR
    [2010/11/24 18:47:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\nl-NL
    [2010/11/24 18:47:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\nb-NO
    [2010/11/24 18:47:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\ko-KR
    [2010/11/24 18:47:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\it-IT
    [2010/11/24 18:47:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\he-IL
    [2010/11/24 18:47:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\fr-FR
    [2010/11/24 18:47:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\fi-FI
    [2010/11/24 18:47:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\es-ES
    [2010/11/24 18:47:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\el-GR
    [2010/11/24 18:47:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\de-DE
    [2010/11/24 18:47:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\da-DK
    [2010/11/24 18:47:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\ar-SA
    [2010/11/24 17:00:16 | 000,000,000 | ---D | C] -- C:\WINDOWS\ie8updates
    [2010/11/23 19:16:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Bek\Application Data\Malwarebytes
    [2010/11/23 19:16:09 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
    [2010/11/23 19:16:07 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
    [2010/11/23 19:16:07 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
    [2010/11/23 19:16:07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    [2010/11/23 18:53:12 | 000,446,464 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Bek\Desktop\TFC.exe
    [2010/11/10 20:53:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Bek\Desktop\Mum's rescued documents
    [2010/11/06 20:43:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Bek\Desktop\confirmation.jsp_files
    [2010/01/31 17:27:13 | 000,148,736 | ---- | C] (Avanquest Software) -- C:\Documents and Settings\All Users\Application Data\hpe3.dll

    ========== Files - Modified Within 30 Days ==========

    [2010/11/29 18:51:12 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Bek\Desktop\OTL.exe
    [2010/11/29 18:42:03 | 000,000,198 | ---- | M] () -- C:\PSLOG
    [2010/11/29 18:40:54 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
    [2010/11/29 18:40:00 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
    [2010/11/29 18:39:56 | 804,638,720 | -HS- | M] () -- C:\hiberfil.sys
    [2010/11/28 19:01:29 | 000,022,585 | ---- | M] () -- C:\Documents and Settings\Bek\Desktop\ThankYou.htm
    [2010/11/27 16:57:40 | 000,296,448 | ---- | M] () -- C:\Documents and Settings\Bek\Desktop\vere70t1.exe
    [2010/11/27 15:42:55 | 000,594,254 | ---- | M] () -- C:\Documents and Settings\Bek\Desktop\uninstall.reg
    [2010/11/27 15:27:23 | 000,436,520 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
    [2010/11/27 15:27:22 | 000,070,152 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
    [2010/11/27 15:13:42 | 000,018,614 | ---- | M] () -- C:\Documents and Settings\Bek\Desktop\sophos.bat
    [2010/11/27 15:09:30 | 000,001,393 | ---- | M] () -- C:\WINDOWS\imsins.BAK
    [2010/11/24 21:28:46 | 001,569,080 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
    [2010/11/24 20:00:53 | 000,000,153 | ---- | M] () -- C:\WINDOWS\WININIT.INI
    [2010/11/23 19:16:12 | 000,000,703 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
    [2010/11/23 18:53:26 | 000,446,464 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Bek\Desktop\TFC.exe
    [2010/11/23 18:34:08 | 000,002,626 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
    [2010/11/21 19:46:54 | 000,015,360 | ---- | M] () -- C:\Documents and Settings\Bek\My Documents\Book2.xls
    [2010/11/13 21:53:40 | 000,018,432 | ---- | M] () -- C:\Documents and Settings\Bek\Desktop\grade1-2_assessment_data_end_2010.xls
    [2010/11/07 17:15:43 | 000,098,816 | ---- | M] () -- C:\Documents and Settings\Bek\My Documents\You are hereby invited to attend.doc
    [2010/11/06 22:08:17 | 000,040,408 | ---- | M] () -- C:\Documents and Settings\Bek\Desktop\uniball08-20.JPG
    [2010/11/06 22:06:39 | 000,030,099 | ---- | M] () -- C:\Documents and Settings\Bek\Desktop\uniball08-12.JPG
    [2010/11/06 22:04:42 | 000,030,527 | ---- | M] () -- C:\Documents and Settings\Bek\Desktop\uniball08-5.JPG
    [2010/11/06 20:44:22 | 000,345,838 | ---- | M] () -- C:\Documents and Settings\Bek\Desktop\alto.xps
    [2010/11/06 20:43:53 | 000,019,503 | ---- | M] () -- C:\Documents and Settings\Bek\Desktop\confirmation.jsp.htm

    ========== Files Created - No Company Name ==========

    [2010/11/28 19:01:24 | 000,022,585 | ---- | C] () -- C:\Documents and Settings\Bek\Desktop\ThankYou.htm
    [2010/11/27 19:24:17 | 804,638,720 | -HS- | C] () -- C:\hiberfil.sys
    [2010/11/27 16:57:36 | 000,296,448 | ---- | C] () -- C:\Documents and Settings\Bek\Desktop\vere70t1.exe
    [2010/11/27 15:42:55 | 000,594,254 | ---- | C] () -- C:\Documents and Settings\Bek\Desktop\uninstall.reg
    [2010/11/27 15:13:42 | 000,018,614 | ---- | C] () -- C:\Documents and Settings\Bek\Desktop\sophos.bat
    [2010/11/23 19:16:12 | 000,000,703 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
    [2010/11/13 21:31:48 | 000,018,432 | ---- | C] () -- C:\Documents and Settings\Bek\Desktop\grade1-2_assessment_data_end_2010.xls
    [2010/11/07 17:15:41 | 000,098,816 | ---- | C] () -- C:\Documents and Settings\Bek\My Documents\You are hereby invited to attend.doc
    [2010/11/06 22:08:17 | 000,040,408 | ---- | C] () -- C:\Documents and Settings\Bek\Desktop\uniball08-20.JPG
    [2010/11/06 22:06:39 | 000,030,099 | ---- | C] () -- C:\Documents and Settings\Bek\Desktop\uniball08-12.JPG
    [2010/11/06 22:04:42 | 000,030,527 | ---- | C] () -- C:\Documents and Settings\Bek\Desktop\uniball08-5.JPG
    [2010/11/06 20:44:19 | 000,345,838 | ---- | C] () -- C:\Documents and Settings\Bek\Desktop\alto.xps
    [2010/11/06 20:43:51 | 000,019,503 | ---- | C] () -- C:\Documents and Settings\Bek\Desktop\confirmation.jsp.htm
    [2010/09/28 19:51:03 | 000,000,000 | ---- | C] () -- C:\WINDOWS\HPMProp.INI
    [2010/09/28 19:43:14 | 000,200,704 | ---- | C] () -- C:\WINDOWS\System32\Bot.dll
    [2010/09/28 19:43:14 | 000,000,101 | ---- | C] () -- C:\WINDOWS\Psxlpr.ini
    [2009/08/03 15:07:42 | 000,403,816 | ---- | C] () -- C:\WINDOWS\System32\OGACheckControl.dll
    [2008/09/30 21:02:05 | 000,001,024 | ---- | C] () -- C:\WINDOWS\System32\grcauth2.dll
    [2008/09/30 21:02:05 | 000,001,024 | ---- | C] () -- C:\WINDOWS\System32\grcauth1.dll
    [2008/09/30 21:02:05 | 000,000,100 | ---- | C] () -- C:\WINDOWS\System32\prsgrc.dll
    [2008/09/07 23:44:44 | 000,005,120 | ---- | C] () -- C:\Documents and Settings\Bek\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    [2008/06/12 00:00:39 | 000,000,126 | ---- | C] () -- C:\Documents and Settings\Bek\Local Settings\Application Data\fusioncache.dat
    [2008/06/02 19:08:03 | 000,023,253 | ---- | C] () -- C:\WINDOWS\UBDesktop.ini
    [2008/05/20 01:06:50 | 000,000,097 | ---- | C] () -- C:\WINDOWS\WirelessFTP.INI
    [2008/04/04 14:51:33 | 002,463,976 | ---- | C] () -- C:\WINDOWS\System32\NPSWF32.dll
    [2007/02/13 13:51:14 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\setupw2k.dll
    [2007/02/13 13:51:13 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\nwslog32.dll
    [2007/02/12 16:17:10 | 000,001,024 | ---- | C] () -- C:\WINDOWS\System32\clauth2.dll
    [2007/02/12 16:17:10 | 000,001,024 | ---- | C] () -- C:\WINDOWS\System32\clauth1.dll
    [2007/02/12 16:17:10 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\ssprs.dll
    [2007/02/12 16:17:10 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\serauth2.dll
    [2007/02/12 16:17:10 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\serauth1.dll
    [2007/02/12 16:17:10 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\nsprs.dll
    [2007/02/12 16:15:15 | 000,001,025 | ---- | C] () -- C:\WINDOWS\System32\sysprs7.dll
    [2007/02/12 16:15:15 | 000,000,205 | ---- | C] () -- C:\WINDOWS\System32\lsprst7.dll
    [2007/02/09 17:28:06 | 000,002,276 | ---- | C] () -- C:\WINDOWS\opera.ini
    [2006/06/13 18:05:00 | 000,757,818 | ---- | C] () -- C:\WINDOWS\System32\gwadd1.dll
    [2006/06/13 16:21:06 | 000,303,166 | ---- | C] () -- C:\WINDOWS\System32\gwodm132.dll
    [2006/06/13 15:37:20 | 000,098,354 | ---- | C] () -- C:\WINDOWS\System32\GWLDO132.DLL
    [2004/07/09 10:31:18 | 000,155,700 | ---- | C] () -- C:\WINDOWS\System32\ODMA32.DLL
    [2004/05/17 14:23:04 | 000,000,199 | ---- | C] () -- C:\WINDOWS\swacnfg.ini
    [2004/05/15 05:56:44 | 000,204,800 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeW7.dll
    [2004/05/15 05:56:44 | 000,200,704 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeA6.dll
    [2004/05/15 05:56:44 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeP6.dll
    [2004/05/15 05:56:44 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeM6.dll
    [2004/05/15 05:56:44 | 000,188,416 | ---- | C] () -- C:\WINDOWS\System32\IVIresizePX.dll
    [2004/05/15 05:56:44 | 000,020,480 | ---- | C] () -- C:\WINDOWS\System32\IVIresize.dll
    [2004/05/15 05:32:40 | 000,010,165 | ---- | C] () -- C:\WINDOWS\System32\tosmreg.ini
    [2004/05/15 05:32:39 | 000,128,113 | ---- | C] () -- C:\WINDOWS\System32\csellang.ini
    [2004/05/15 05:32:39 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\csellang.dll
    [2004/05/15 05:32:39 | 000,007,671 | ---- | C] () -- C:\WINDOWS\System32\cseltbl.ini
    [2004/05/14 16:42:30 | 000,000,153 | ---- | C] () -- C:\WINDOWS\WININIT.INI
    [2004/01/14 06:23:00 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
    [2004/01/08 09:10:02 | 000,000,908 | ---- | C] () -- C:\WINDOWS\System32\Px.ini
    [2004/01/08 09:01:44 | 000,019,607 | ---- | C] () -- C:\WINDOWS\System32\drivers\TOSSMBNT.sys
    [2004/01/08 08:59:01 | 000,000,000 | ---- | C] () -- C:\WINDOWS\NDSTray.INI
    [2004/01/08 07:29:28 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
    [2004/01/08 07:22:03 | 000,363,520 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
    [2004/01/08 07:19:02 | 000,000,791 | ---- | C] () -- C:\WINDOWS\orun32.ini
    [2004/01/08 07:02:01 | 000,122,880 | ---- | C] () -- C:\WINDOWS\System32\e1000msg.dll
    [2004/01/08 07:02:00 | 000,016,384 | ---- | C] () -- C:\WINDOWS\System32\e100bmsg.dll
    [2004/01/08 05:43:57 | 000,000,350 | -H-- | C] () -- C:\WINDOWS\System32\oeminfo.ini
    [2004/01/07 22:51:38 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
    [2004/01/07 15:29:37 | 001,478,656 | ---- | C] () -- C:\WINDOWS\System32\TosMousePage.dll
    [2004/01/07 15:29:36 | 000,770,048 | ---- | C] () -- C:\WINDOWS\System32\TosKeyboardPage.dll
    [2004/01/07 15:29:35 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\TosBtHcrpAPI.dll
    [2004/01/07 15:29:33 | 000,114,688 | ---- | C] () -- C:\WINDOWS\System32\TosBtAcc.dll
    [2004/01/07 15:29:32 | 000,114,688 | ---- | C] () -- C:\WINDOWS\System32\TBTMonUI.dll
    [2003/12/16 09:29:42 | 000,204,800 | ---- | C] () -- C:\WINDOWS\System32\C1XStngs.dll
    [2002/12/04 11:57:00 | 000,651,264 | ---- | C] () -- C:\WINDOWS\System32\libeay32.dll
    [2002/12/04 11:57:00 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\ssleay32.dll

    ========== LOP Check ==========

    [2010/09/22 12:42:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Alwil Software
    [2008/04/04 15:40:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SafeNet Sentinel
    [2008/08/26 14:15:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Sony
    [2008/04/04 15:38:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SPSS
    [2008/06/09 20:55:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\X-Setup Pro
    [2008/06/12 00:15:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bek\Application Data\FileZilla
    [2004/01/08 09:13:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bek\Application Data\InterTrust
    [2008/04/09 12:36:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bek\Application Data\InterVideo
    [2008/05/15 23:07:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bek\Application Data\iPodder
    [2008/08/26 14:15:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bek\Application Data\Sony
    [2004/01/08 09:01:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bek\Application Data\toshiba
    [2008/06/09 20:55:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bek\Application Data\X-Setup Pro

    ========== Purity Check ==========



    ========== Custom Scans ==========


    < %SYSTEMDRIVE%\*.exe >


    < MD5 for: AGP440.SYS >
    [2007/02/13 15:28:59 | 022,245,337 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
    [2008/04/14 05:51:44 | 020,056,462 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
    [2007/02/13 15:28:59 | 022,245,337 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp2.cab:AGP440.sys
    [2008/04/14 05:51:44 | 020,056,462 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
    [2008/04/14 00:06:40 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys
    [2008/04/14 00:06:40 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys
    [2004/08/04 17:07:41 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB -- C:\WINDOWS\$NtServicePackUninstall$\agp440.sys

    < MD5 for: ATAPI.SYS >
    [2003/03/31 23:00:00 | 010,158,890 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp1.cab:atapi.sys
    [2007/02/13 15:28:59 | 022,245,337 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
    [2008/04/14 05:51:44 | 020,056,462 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
    [2003/03/31 23:00:00 | 010,158,890 | ---- | M] () .cab file -- C:\WINDOWS\I386\sp1.cab:atapi.sys
    [2007/02/13 15:28:59 | 022,245,337 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp2.cab:atapi.sys
    [2008/04/14 05:51:44 | 020,056,462 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
    [2003/03/31 23:00:00 | 000,086,912 | ---- | M] (Microsoft Corporation) MD5=95B858761A00E1D4F81F79A0DA019ACA -- C:\WINDOWS\system32\ReinstallBackups\0005\DriverFiles\i386\atapi.sys
    [2008/04/14 00:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys
    [2008/04/14 00:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
    [2004/08/04 16:59:42 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys

    < MD5 for: EVENTLOG.DLL >
    [2008/04/14 05:41:54 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
    [2008/04/14 05:41:54 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\system32\eventlog.dll
    [2004/08/04 18:56:42 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll

    < MD5 for: NETLOGON.DLL >
    [2008/04/14 05:42:02 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
    [2008/04/14 05:42:02 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\system32\netlogon.dll
    [2009/02/07 05:46:09 | 000,408,064 | ---- | M] (Microsoft Corporation) MD5=6C476D33D82F1054849790181E8F7772 -- C:\WINDOWS\SoftwareDistribution\Download\555558d2c7916b118ad5baef62b18136\sp2qfe\netlogon.dll
    [2004/08/04 18:56:44 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll

    < MD5 for: SCECLI.DLL >
    [2004/08/04 18:56:44 | 000,180,224 | ---- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
    [2008/04/14 05:42:06 | 000,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll
    [2008/04/14 05:42:06 | 000,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\system32\scecli.dll

    < %systemroot%\*. /mp /s >

    < %systemroot%\system32\*.dll /lockedfiles >

    < %systemroot%\System32\config\*.sav >
    [2004/01/07 22:50:20 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
    [2004/01/07 22:50:19 | 000,626,688 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
    [2004/01/07 22:50:19 | 000,425,984 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav

    < End of report >
     
  11. ignoramus

    ignoramus TS Rookie Topic Starter Posts: 18

    Extras.txt:

    I don't seem to be able to post this text. It just gives me the message,
    "You have included 9 images in your message. You are limited to using 6 images so please go back and correct the problem and then continue again.

    Images include use of smilies, the BB code tag and HTML <img> tags. The use of these is all subject to them being enabled by the administrator."

    I don't understand this. I looked through the file and couldn't see any img tags. What should I do?
     
  12. crunchie

    crunchie Malware Helper Posts: 728

     
  13. ignoramus

    ignoramus TS Rookie Topic Starter Posts: 18

    Ok, Java is updated and I've put the extras.txt log (which seems to work fine with code tags - thanks!) and the new OTL one below. Still having trouble with kaspersky though - didn't get the warning message this time, but it couldn't update its virus database and thus wouldn't run the scan. It said:

    "Update has failed The program could not be started. Please close the window of Kaspersky Online Scanner 7.0 and start the program again from the web site of Kaspersky Lab.

    Successful updating of Kaspersky Online Scanner 7.0 and scanning of your computer requires uninterrupted Internet connection. Please make sure that the Internet connection is established. [ERROR: License has expired]"

    My internet connection seems fine. Several restarts in both firefox and internet explorer didn't fix this. Will try again tomorrow.

    Here are the logs anyway:

    extras.txt:

    Code:
    OTL Extras logfile created on: 29/11/2010 6:56:12 PM - Run 1
    OTL by OldTimer - Version 3.2.17.3     Folder = C:\Documents and Settings\Bek\Desktop
    Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
    Internet Explorer (Version = 8.0.6001.18702)
    Locale: 00000C09 | Country: Australia | Language: ENA | Date Format: d/MM/yyyy
     
    767.00 Mb Total Physical Memory | 473.00 Mb Available Physical Memory | 62.00% Memory free
    1.00 Gb Paging File | 1.00 Gb Available in Paging File | 86.00% Paging File free
    Paging file location(s): C:\pagefile.sys 768 1536 [binary data]
     
    %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
    Drive C: | 37.25 Gb Total Space | 6.71 Gb Free Space | 18.02% Space Free | Partition Type: NTFS
     
    Computer Name: LAPTOP | User Name: Bek | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: Current user | Quick Scan
    Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
     
    [color=#E56717]========== Extra Registry (SafeList) ==========[/color]
     
     
    [color=#E56717]========== File Associations ==========[/color]
     
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
     
    [HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
    .html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
     
    [color=#E56717]========== Shell Spawning ==========[/color]
     
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
    batfile [open] -- "%1" %*
    cmdfile [open] -- "%1" %*
    comfile [open] -- "%1" %*
    exefile [open] -- "%1" %*
    jsfile [edit] -- Reg Error: Key error.
    piffile [open] -- "%1" %*
    regfile [merge] -- Reg Error: Key error.
    scrfile [config] -- "%1"
    scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
    scrfile [open] -- "%1" /S
    txtfile [edit] -- Reg Error: Key error.
    Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
    Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
    Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
    Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
    Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
     
    [color=#E56717]========== Security Center Settings ==========[/color]
     
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
    "AntiVirusOverride" = 0
    "FirewallOverride" = 0
    "AntiVirusDisableNotify" = 0
    "FirewallDisableNotify" = 0
    "UpdatesDisableNotify" = 0
     
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
     
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
     
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
     
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
     
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
     
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
     
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
     
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
     
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
    "DisableMonitoring" = 1
     
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
     
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
     
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
     
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
     
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
     
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
     
    [color=#E56717]========== System Restore Settings ==========[/color]
     
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
    "DisableSR" = 0
     
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
    "Start" = 0
     
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
    "Start" = 2
     
    [color=#E56717]========== Firewall Settings ==========[/color]
     
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
     
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
    "3389:TCP" = 3389:TCP:*:Disabled:@xpsp2res.dll,-22009
     
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
    "EnableFirewall" = 1
    "DoNotAllowExceptions" = 0
    "DisableNotifications" = 0
     
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
    "3389:TCP" = 3389:TCP:*:Disabled:@xpsp2res.dll,-22009
    "1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
    "2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
    "139:TCP" = 139:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22004
    "445:TCP" = 445:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22005
    "137:UDP" = 137:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22001
    "138:UDP" = 138:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22002
     
    [color=#E56717]========== Authorized Applications List ==========[/color]
     
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
    "C:\Program Files\Windows Live\Messenger\wlcsdk.exe" = C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call -- File not found
     
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
    "C:\Novell\GroupWise\grpwise.exe" = C:\Novell\GroupWise\grpwise.exe:*:Enabled:Novell GroupWise -- (Novell, Inc.)
    "C:\Novell\GroupWise\notify.exe" = C:\Novell\GroupWise\notify.exe:*:Enabled:Novell Notify -- (Novell, Inc.)
    "C:\Program Files\SPSSInc\SPSS16\SPSSWinWrapIDE.exe" = C:\Program Files\SPSSInc\SPSS16\SPSSWinWrapIDE.exe:*:Disabled:SPSS Basic Script Editor (1033) -- (SPSS Inc.)
    "C:\Program Files\SPSSInc\SPSS16\spss.exe" = C:\Program Files\SPSSInc\SPSS16\spss.exe:*:Disabled:SPSS 16.0 for Windows (1033:exe) -- (SPSS Inc)
    "C:\Program Files\SPSSInc\SPSS16\spss.com" = C:\Program Files\SPSSInc\SPSS16\spss.com:*:Disabled:SPSS 16.0 for Windows (1033:com) -- (SPSS Inc)
    "C:\Program Files\Sony Ericsson\Sony Ericsson Media Manager\MediaManager.exe" = C:\Program Files\Sony Ericsson\Sony Ericsson Media Manager\MediaManager.exe:*:Enabled:Sony Ericsson Media Manager 1.2 -- (Sony Creative Software Inc.)
    "C:\Program Files\Windows Live\Messenger\wlcsdk.exe" = C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call -- File not found
    "C:\Program Files\Sony Ericsson\Update Service\Update Service.exe" = C:\Program Files\Sony Ericsson\Update Service\Update Service.exe:*:Enabled:Update Service -- ()
     
     
    [color=#E56717]========== HKEY_LOCAL_MACHINE Uninstall List ==========[/color]
     
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
    "{00040409-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 Disc 2
    "{0224CACC-994D-45F8-B973-D65056EA9C2F}" = Adobe XMP DVA Panels CS3
    "{05832D65-6EDB-4D32-BA78-BCD0E2B91C02}" = Atheros Wireless LAN MiniPCI card Driver
    "{08B32819-6EEF-4057-AEDA-5AB681A36A23}" = Adobe Bridge Start Meeting
    "{121634B0-2F4B-11D3-ADA3-00C04F52DD52}" = Windows Installer Clean Up
    "{155FBB0D-0EE9-42D1-9E41-15E08F691033}" = Microsoft Producer for Microsoft Office PowerPoint 2003
    "{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}" = Adobe WinSoft Linguistics Plugin
    "{193EAFD0-1BAF-4FB4-B18F-79D5D6A4B285}" = Adobe After Effects CS3 Presets
    "{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    "{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
    "{23E8D2D6-F7C8-4A35-816C-6C914EE0A601}" = Citrix Presentation Server Client - Web Only
    "{24D7346D-D4B4-45E8-98EA-75EC14B42DD8}" = Adobe ExtendScript Toolkit 2
    "{26A24AE4-039D-4CA4-87B4-2F83216021FF}" = Java(TM) 6 Update 21
    "{29E5EA97-5F74-4A57-B8B2-D4F169117183}" = Adobe Stock Photos CS3
    "{2EFFFC71-1E66-454E-A6E6-CEEC800B96D2}" = Adobe Flash Video Encoder
    "{2FCE4FC5-6930-40E7-A4F1-F862207424EF}" = InterVideo WinDVD Creator 2
    "{2FFE93F0-BB72-4E52-8761-354D1AAA9387}" = Sony Ericsson PC Suite 6.009.00
    "{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java(TM) 6 Update 5
    "{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
    "{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
    "{3CF0858D-1AC5-4308-9DE7-AD15288A8BDC}" = TOSHIBA Console
    "{4701BF4D-9DBD-4F3B-953A-AFC3316E821B}" = TOSHIBA Dual Pointing Device Utility
    "{48CF9A66-5F03-4025-ABD0-B3A3FA095A59}" = TOSHIBA SD Memory Card Format
    "{4DA782CB-C9A0-462F-9D18-17D301BC507C}" = Amos 16.0
    "{4DC49A9A-6DD0-40D2-A851-527764DA8379}" = Adobe Setup
    "{4F41AD68-89F2-4262-A32C-2F70B01FCE9E}" = Photo Story 3 for Windows
    "{51846830-E7B2-4218-8968-B77F0FF475B8}" = Adobe Color EU Extra Settings
    "{54793AA1-5001-42F4-ABB6-C364617C6078}" = Adobe Linguistics CS3
    "{60B28ECA-78BC-4D18-AB63-4A9A93BF881D}" = Adobe Creative Suite 3 Master Collection
    "{61539202-097E-487E-9237-B291AB56D54C}" = Bluetooth Monitor
    "{621025AE-3510-478E-BC27-1A647150976F}" = SPSS 16.0 for Windows
    "{64212898-097F-4F3F-AECA-6D34A7EF82DF}" = TOSHIBA Zooming Utility
    "{64C1FA9A-FA94-4B6E-B3E4-8573738E4AD1}" = Adobe Setup
    "{6ABE0BEE-D572-4FE8-B434-9E72A289431B}" = Adobe Fonts All
    "{6B52140A-F189-4945-BFFC-DB3F00B8C589}" = Adobe Flash CS3
    "{6B708481-748A-4EB4-97C1-CD386244FF77}" = Adobe MotionPicture Color Files
    "{6BBAA81D-6A7E-43AD-8889-2F002DCAAFDD}" = AHV content for Acrobat and Flash
    "{6D4AC5A4-4CF9-4F90-8111-B9B53CE257BF}" = Adobe Color Common Settings
    "{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}" = Adobe Asset Services CS3
    "{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
    "{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    "{7862BAD8-A379-4128-8AA1-EFD5A9603C53}" = Wireless Hotkey
    "{7ACFB90E-8FD0-4397-AD3A-5195412623A3}" = Adobe Help Viewer CS3
    "{7B9A0703-0191-49CD-8A35-5B463197C619}" = Windows SD Host Controller Driver
    "{7C10F5C7-F00F-4BD3-A110-C7D240D2DD25}" = Adobe Dreamweaver CS3
    "{7DFC1012-D346-46CE-B03E-FF79125AE029}" = Adobe Fireworks CS3
    "{845A8DB9-8802-4FD3-9FE3-938A6C46A2EC}" = Adobe Video Profiles
    "{85376E80-1A9D-4b13-92FE-5B0797FFB7DA}" = Intel(R) PROSet for Wireless
    "{88D422DB-E9C7-4E16-9D80-2999F4FD6AD9}" = Adobe Flash Player 9 Plugin
    "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
    "{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}" = Adobe Device Central CS3
    "{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}" = Adobe Type Support
    "{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}" = Choice Guard
    "{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
    "{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
    "{90170409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office FrontPage 2003
    "{90176341-0A8B-4CCC-A78D-F862228A6B95}" = Adobe Anchor Service CS3
    "{903B0409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Project Professional 2003
    "{90510409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Visio Professional 2003
    "{91A10409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office OneNote 2003
    "{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
    "{95655ED4-7CA5-46DF-907F-7144877A32E5}" = Adobe Color NA Recommended Settings
    "{98E8A2EF-4EAE-43B8-A172-74842B764777}" = InterVideo WinDVD 4
    "{9C9824D9-9000-4373-A6A5-D0E5D4831394}" = Adobe Bridge CS3
    "{9D765FA6-F2BC-40AF-8145-50808F9BDF4E}" = DVD-RAM Driver
    "{9EB1504E-FD95-4BCD-8E93-B4039F59C469}" = Sony Ericsson Media Manager 1.2
    "{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = ALPS Touch Pad Driver
    "{9FE35071-CAB2-4E79-93E7-BFC6A2DC5C5D}" = CD/DVD Drive Acoustic Silencer
    "{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
    "{A2B242BD-FF8D-4840-9DAA-9170EABEC59C}" = Adobe CMaps
    "{A2D81E70-2A98-4A08-A628-94388B063C5E}" = Adobe Color - Photoshop Specific
    "{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
    "{A6690C0E-B96E-4F0F-A8EB-D5B332454AC6}" = TOSHIBA Controls
    "{AC5B0C19-D851-42F4-BDA0-410ECF7F70A5}" = PDF Settings
    "{AC76BA86-1033-0000-7760-000000000003}" = Adobe Acrobat 8 Professional
    "{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
    "{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}" = Adobe Camera Raw 4.0
    "{B3C02EC1-A7B0-4987-9A43-8789426AAA7D}" = Adobe Setup
    "{B671CBFD-4109-4D35-9252-3062D3CCB7B2}" = Adobe SING CS3
    "{B73CFB12-C814-4638-AFFD-7E3AAFAF0B4E}" = Adobe BridgeTalk Plugin CS3
    "{B9A93A85-1997-4381-8979-4B0BB28AEBC7}" = GroupWise
    "{B9B35331-B7E4-4E5C-BF4C-7BC87856124D}" = Adobe Default Language CS3
    "{BAF78226-3200-4DB4-BE33-4D922A799840}" = Windows Presentation Foundation
    "{BC4F8E84-5E29-49EC-B4E7-E6F9CB50986C}" = Adobe Flash Player 9 ActiveX
    "{BDD83DC9-BEE9-4654-A5DA-CC46C250088D}" = TOSHIBA ConfigFree
    "{BE5F3842-8309-4754-92D5-83E02E6077A3}" = Adobe Extension Manager CS3
    "{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
    "{C1CAAF9E-2A80-4AD0-8D9A-B4327966249F}" = Paint.NET v3.20
    "{C5BD220A-EFE8-48A5-B70E-9503D535FACE}" = Adobe WAS CS3
    "{C6CA8874-5F22-4AF0-9BE3-016BF299C536}" = Windows Live Essentials
    "{C861921A-E002-498F-9800-153CCBABB9C9}" = 32 Bit HP CIO Components Installer
    "{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
    "{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
    "{D0DFF92A-492E-4C40-B862-A74A173C25C5}" = Adobe Version Cue CS3 Client
    "{D177BD9B-9B11-4E28-8584-E0F93BB33F5B}" = TOSHIBA IPPhone
    "{D2559B88-CC9D-4B48-81BB-F492BAA9C48C}" = Adobe PDF Library Files
    "{D5A31AB1-345D-47C7-A87B-036A669F6DF1}" = Adobe XMP Panels CS3
    "{DD7DB3C5-6FA3-4FA3-8A71-C2F2940EB029}" = Adobe Color JA Extra Settings
    "{DDC146FA-73E0-4FA1-A353-841EA14BF600}" = Drag'n Drop CD+DVD
    "{E0D51394-1D45-460A-B62D-383BC4F8B335}" = QuickTime
    "{E69AE897-9E0B-485C-8552-7841F48D42D8}" = Adobe Update Manager CS3
    "{EA61B3FD-10FF-4979-BC69-D3CC9E753765}" = SPSS SmartViewer 16.0
    "{EA7B3CC4-366D-4CF6-8350-FD7A7034116E}" = Adobe InDesign CS3 Icon Handler
    "{F02DBC5D-33E3-45E9-B0F8-B7745229ED1C}" = NICI (Shared) U.S./Worldwide (128 bit) (2.7.0-2)
    "{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX
    "{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call
    "{F816A1EB-392D-459C-A5A2-8C8B9CD75446}" = TOSHIBA SD Memory Boot Utility
    "{FC99D835-CA4A-4E58-82F6-31D0ACF0CACA}" = TOSHIBA Audio Effect
    "{FCE65C4E-B0E8-4FBD-AD16-EDCBE6CD591F}" = HighMAT Extension to Microsoft Windows XP CD Writing Wizard
    "Adobe Acrobat 8 Professional" = Adobe Acrobat 8.1.2 Professional
    "Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
    "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
    "Adobe_3e054d2218e7aa282c2369d939e58ff" = Adobe ExtendScript Toolkit 2
    "Adobe_6c8e2cb4fd241c55406016127a6ab2e" = Adobe Color Common Settings
    "Adobe_915239ded2552e78978d0dbab7657a5" = Add or Remove Adobe Creative Suite 3 Master Collection
    "Audacity_is1" = Audacity 1.2.6
    "avast5" = avast! Free Antivirus
    "EPSON Printer and Utilities" = EPSON Printer Software
    "ES C40 C20 PSolver" = ES C40 C20 Problem Solver
    "ESET Online Scanner" = ESET Online Scanner v3
    "HTMLKit_is1" = HTML-Kit
    "IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
    "ie7" = Windows Internet Explorer 7
    "ie8" = Windows Internet Explorer 8
    "Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
    "Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1
    "Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
    "Mozilla Firefox (3.6.12)" = Mozilla Firefox (3.6.12)
    "MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
    "NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
    "NVIDIA" = NVIDIA Windows 2000/XP Display Drivers
    "PC Diagnostic Tool" = TOSHIBA PC Diagnostic Tool
    "Power Saver" = TOSHIBA Power Saver
    "PrintServer Network driver" = PrintServer Network driver
    "PrintServer Utilities" = PrintServer Utilities
    "PROSet" = Intel(R) PRO Network Adapters and Drivers
    "RealPlayer 6.0" = RealPlayer
    "SecureW2 TTLS Client" = SecureW2 TTLS Client 3.3.3 for Windows
    "TDspBtn" = TOSHIBA Display Devices Change Utility
    "TFNF5" = TOSHIBA Hotkey Utility for Display Devices
    "TME3" = TOSHIBA Mobile Extension3 for Windows XP V3.59.00.XP
    "TOSHIBA Software Modem" = TOSHIBA Software Modem
    "TOSHIBA Utilities" = TOSHIBA Utilities
    "Update Service" = Update Service
    "ViewpointMediaPlayer" = Viewpoint Media Player (Remove Only)
    "Wdf01007" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
    "WIC" = Windows Imaging Component
    "Windows Media Format Runtime" = Windows Media Format 11 runtime
    "Windows Media Player" = Windows Media Player 11
    "Windows XP Service Pack" = Windows XP Service Pack 3
    "WMFDist11" = Windows Media Format 11 runtime
    "wmp11" = Windows Media Player 11
    "Write-N-Cite" = Write-N-Cite
    "Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
    "XpsEPSC" = XML Paper Specification Shared Components Pack 1.0
    "xqdcXSP_is1" = XQDC X-Setup Pro 9.2.100
     
    < End of report >
    



    The OTL one from the custom script:

    All processes killed
    ========== OTL ==========
    Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\-{39EA7695-B3F2-4C44-A4BC-297ADA8FD235}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
    Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
    Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\TFncKy deleted successfully.
    ========== COMMANDS ==========

    [EMPTYFLASH]

    User: 2452074

    User: Administrator

    User: All Users

    User: Bek
    ->Flash cache emptied: 1962 bytes

    User: Default User
    ->Flash cache emptied: 0 bytes

    User: LocalService

    User: NetworkService

    Total Flash Files Cleaned = 0.00 mb


    [EMPTYTEMP]

    User: 2452074

    User: Administrator

    User: All Users

    User: Bek
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 119541817 bytes
    ->Java cache emptied: 5400 bytes
    ->FireFox cache emptied: 77022686 bytes
    ->Flash cache emptied: 0 bytes

    User: Default User
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 33170 bytes
    ->Flash cache emptied: 0 bytes

    User: LocalService
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 33170 bytes

    User: NetworkService
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 33170 bytes

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 0 bytes
    %systemroot%\System32\dllcache .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 483 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 25576726 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
    RecycleBin emptied: 2160431 bytes

    Total Files Cleaned = 214.00 mb

    C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
    HOSTS file reset successfully

    OTL by OldTimer - Version 3.2.17.3 log created on 11302010_172914

    Files\Folders moved on Reboot...
    File\Folder C:\WINDOWS\temp\_avast5_\Webshlock.txt not found!

    Registry entries deleted on Reboot...
     
  14. ignoramus

    ignoramus TS Rookie Topic Starter Posts: 18

    And the OTL one from the quick scan:

    OTL logfile created on: 30/11/2010 5:58:00 PM - Run 2
    OTL by OldTimer - Version 3.2.17.3 Folder = C:\Documents and Settings\Bek\Desktop
    Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
    Internet Explorer (Version = 8.0.6001.18702)
    Locale: 00000C09 | Country: Australia | Language: ENA | Date Format: d/MM/yyyy

    767.00 Mb Total Physical Memory | 324.00 Mb Available Physical Memory | 42.00% Memory free
    1.00 Gb Paging File | 1.00 Gb Available in Paging File | 77.00% Paging File free
    Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
    Drive C: | 37.25 Gb Total Space | 7.26 Gb Free Space | 19.49% Space Free | Partition Type: NTFS

    Computer Name: LAPTOP | User Name: Bek | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: Current user | Quick Scan
    Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

    ========== Processes (SafeList) ==========

    PRC - [2010/11/29 18:51:12 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Bek\Desktop\OTL.exe
    PRC - [2010/10/30 14:50:58 | 000,912,344 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
    PRC - [2010/09/08 02:12:02 | 002,838,912 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastUI.exe
    PRC - [2010/09/08 02:11:59 | 000,040,384 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
    PRC - [2009/04/30 12:23:26 | 000,090,112 | ---- | M] () -- C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe
    PRC - [2008/04/14 05:42:20 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
    PRC - [2003/12/26 11:17:32 | 000,208,972 | ---- | M] (TOSHIBA) -- C:\Program Files\Toshiba\TAudEffect\TAudEff.exe
    PRC - [2003/12/16 09:30:06 | 000,356,352 | ---- | M] (Intel Corporation) -- C:\WINDOWS\system32\ZCfgSvc.exe
    PRC - [2003/12/16 09:24:20 | 000,184,320 | ---- | M] (Intel) -- C:\WINDOWS\system32\1XConfig.exe
    PRC - [2003/12/16 09:23:40 | 000,303,171 | ---- | M] (Intel Corporation ) -- C:\WINDOWS\system32\S24EvMon.exe
    PRC - [2003/12/16 09:22:36 | 000,122,880 | ---- | M] (Intel Corporation) -- C:\WINDOWS\system32\RegSrvc.exe
    PRC - [2003/12/16 06:54:20 | 000,278,528 | ---- | M] (TOSHIBA Corporation) -- C:\WINDOWS\system32\TPSMain.exe
    PRC - [2003/12/16 06:53:56 | 000,045,056 | ---- | M] (TOSHIBA Corporation) -- C:\WINDOWS\system32\TPSBattM.exe
    PRC - [2003/12/10 15:50:54 | 000,126,976 | ---- | M] (TOSHIBA) -- C:\Program Files\Toshiba\TME3\TMESRV31.exe
    PRC - [2003/12/04 07:26:14 | 000,131,072 | ---- | M] (TOSHIBA Corporation) -- C:\Program Files\Toshiba\TOSHIBA Zooming Utility\SmoothView.exe
    PRC - [2003/12/02 19:05:54 | 000,028,672 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files\Toshiba\ConfigFree\CFSvcs.exe
    PRC - [2003/11/22 09:49:28 | 000,258,048 | ---- | M] (TOSHIBA Corp.) -- C:\WINDOWS\system32\00THotkey.exe
    PRC - [2003/11/17 21:42:12 | 000,073,728 | ---- | M] (TOSHIBA Corp.) -- C:\WINDOWS\system32\TFNF5.exe
    PRC - [2003/11/12 15:19:04 | 000,159,744 | ---- | M] (TOSHIBA) -- C:\Program Files\Toshiba\DualPointUtility\TEDTray.exe
    PRC - [2003/10/22 00:28:42 | 000,065,536 | ---- | M] (TOSHIBA) -- C:\Program Files\Toshiba\Bluetooth Monitor\BtMon.exe
    PRC - [2003/10/07 12:43:50 | 000,077,824 | ---- | M] (TOSHIBA) -- C:\Program Files\Toshiba\TME3\TMERzCtl.exe
    PRC - [2003/09/19 17:32:32 | 000,077,824 | ---- | M] (TOSHIBA) -- C:\Program Files\Toshiba\TME3\TMEEJME.exe
    PRC - [2003/08/02 09:56:02 | 000,086,016 | ---- | M] (TOSHIBA Corporation) -- C:\Program Files\Toshiba\TME3\tmesbs32.exe
    PRC - [2003/05/23 15:38:26 | 000,106,496 | ---- | M] (Matsushita Electric Industrial Co., Ltd.) -- C:\WINDOWS\system32\DVDRAMSV.exe
    PRC - [2002/09/21 11:50:10 | 000,045,056 | ---- | M] (Analog Devices, Inc.) -- C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    PRC - [2002/09/10 10:07:34 | 000,049,152 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files\Toshiba\Wireless Hotkey\TosHKCW.exe
    PRC - [2002/08/20 12:29:26 | 000,040,960 | ---- | M] (Easy Systems Japan Ltd.) -- C:\WINDOWS\system32\ezSP_Px.exe
    PRC - [2002/05/03 15:01:06 | 000,444,928 | ---- | M] (University of Ballarat) -- C:\WINDOWS\system32\UBDesktopLdr.exe
    PRC - [2001/01/19 14:00:00 | 000,068,608 | ---- | M] (SEIKO EPSON CORPORATION) -- C:\WINDOWS\system32\spool\drivers\w32x86\3\E_S10IC2.EXE
    PRC - [2000/11/17 01:02:00 | 000,114,688 | ---- | M] (SEIKO EPSON CORPORATION) -- C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe


    ========== Modules (SafeList) ==========

    MOD - [2010/11/29 18:51:12 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Bek\Desktop\OTL.exe
    MOD - [2010/08/24 03:12:02 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll


    ========== Win32 Services (SafeList) ==========

    SRV - File not found [On_Demand | Stopped] -- C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe -- (Macromedia Licensing Service)
    SRV - File not found [Disabled | Stopped] -- C:\WINDOWS\System32\hidserv.dll -- (HidServ)
    SRV - [2010/09/08 02:11:59 | 000,040,384 | ---- | M] (AVAST Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Web Scanner)
    SRV - [2010/09/08 02:11:59 | 000,040,384 | ---- | M] (AVAST Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Mail Scanner)
    SRV - [2010/09/08 02:11:59 | 000,040,384 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus)
    SRV - [2009/04/30 12:23:26 | 000,090,112 | ---- | M] () [Auto | Running] -- C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe -- (OMSI download service)
    SRV - [2008/04/04 14:37:58 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
    SRV - [2003/12/16 09:23:40 | 000,303,171 | ---- | M] (Intel Corporation ) [Auto | Running] -- C:\WINDOWS\system32\S24EvMon.exe -- (S24EventMonitor)
    SRV - [2003/12/16 09:22:36 | 000,122,880 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\WINDOWS\system32\RegSrvc.exe -- (RegSrvc)
    SRV - [2003/12/10 15:50:54 | 000,126,976 | ---- | M] (TOSHIBA) [Auto | Running] -- C:\Program Files\TOSHIBA\TME3\Tmesrv31.exe -- (Tmesrv)
    SRV - [2003/12/02 19:05:54 | 000,028,672 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- C:\Program Files\Toshiba\ConfigFree\CFSvcs.exe -- (CFSvcs)
    SRV - [2003/08/02 09:56:02 | 000,086,016 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Program Files\TOSHIBA\TME3\Tmesbs32.exe -- (Tmesbs)
    SRV - [2003/05/23 15:38:26 | 000,106,496 | ---- | M] (Matsushita Electric Industrial Co., Ltd.) [Auto | Running] -- C:\WINDOWS\system32\DVDRAMSV.exe -- (DVD-RAM_Service)
    SRV - [2002/09/21 11:50:10 | 000,045,056 | ---- | M] (Analog Devices, Inc.) [Auto | Running] -- C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe -- (SoundMAX Agent Service (default))
    SRV - [2002/05/03 15:01:06 | 000,444,928 | ---- | M] (University of Ballarat) [Auto | Running] -- C:\WINDOWS\system32\UBDesktopLdr.exe -- (UBDesktopLdrNTSvc)
    SRV - [2002/05/03 15:00:42 | 000,598,528 | ---- | M] (University of Ballarat) [Auto | Stopped] -- C:\WINDOWS\system32\UBDesktopSvc.exe -- (UBDesktopSvcNTSvc)
    SRV - [2000/11/17 01:02:00 | 000,114,688 | ---- | M] (SEIKO EPSON CORPORATION) [Auto | Running] -- C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe -- (EPSONStatusAgent2)


    ========== Driver Services (SafeList) ==========

    DRV - [2010/09/08 01:52:25 | 000,046,672 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswTdi.sys -- (aswTdi)
    DRV - [2010/09/08 01:52:03 | 000,165,584 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswSP.sys -- (aswSP)
    DRV - [2010/09/08 01:47:46 | 000,023,376 | ---- | M] (AVAST Software) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\aswRdr.sys -- (aswRdr)
    DRV - [2010/09/08 01:47:19 | 000,100,176 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswmon2.sys -- (aswMon2)
    DRV - [2010/09/08 01:47:07 | 000,017,744 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
    DRV - [2010/09/08 01:46:51 | 000,028,880 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aavmker4.sys -- (Aavmker4)
    DRV - [2010/01/28 14:34:05 | 000,025,512 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ggsemc.sys -- (ggsemc)
    DRV - [2010/01/28 14:34:05 | 000,013,224 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ggflt.sys -- (ggflt)
    DRV - [2008/10/01 13:07:15 | 000,014,976 | ---- | M] (Sophos Plc) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\drivers\SophosBootDriver.sys -- (SophosBootDriver)
    DRV - [2008/10/01 13:07:11 | 000,104,704 | ---- | M] (Sophos Plc) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\savonaccesscontrol.sys -- (SAVOnAccessControl)
    DRV - [2008/10/01 13:07:09 | 000,035,584 | ---- | M] (Sophos Plc) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\savonaccessfilter.sys -- (SAVOnAccessFilter)
    DRV - [2008/04/03 06:03:08 | 001,333,152 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\athw.sys -- (AR5416)
    DRV - [2008/01/09 12:28:34 | 000,027,632 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\seehcri.sys -- (seehcri)
    DRV - [2007/06/25 12:43:38 | 000,098,344 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s117obex.sys -- (s117obex)
    DRV - [2007/06/25 12:43:36 | 000,108,456 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s117mdm.sys -- (s117mdm)
    DRV - [2007/06/25 12:43:36 | 000,100,264 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s117mgmt.sys -- (s117mgmt) Sony Ericsson Device 117 USB WMC Device Management Drivers (WDM)
    DRV - [2007/06/25 12:43:36 | 000,098,856 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s117unic.sys -- (s117unic) Sony Ericsson Device 117 USB Ethernet Emulation SEMC117 (WDM)
    DRV - [2007/06/25 12:43:36 | 000,022,952 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s117nd5.sys -- (s117nd5) Sony Ericsson Device 117 USB Ethernet Emulation SEMC117 (NDIS)
    DRV - [2007/06/25 12:43:26 | 000,014,888 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s117mdfl.sys -- (s117mdfl)
    DRV - [2007/06/25 12:43:22 | 000,082,984 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s117bus.sys -- (s117bus) Sony Ericsson Device 117 driver (WDM)
    DRV - [2005/09/12 19:08:30 | 000,468,736 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ar5211.sys -- (AR5211)
    DRV - [2004/01/10 14:26:46 | 000,028,416 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\TEchoCan.sys -- (TEchoCan)
    DRV - [2004/01/07 15:29:39 | 000,008,605 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Tosrfec.sys -- (tosrfec)
    DRV - [2003/12/17 15:08:46 | 000,013,312 | ---- | M] (National Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\NscTpmDD.sys -- (portio)
    DRV - [2003/12/16 09:16:26 | 000,010,970 | ---- | M] (Intel Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\s24trans.sys -- (s24trans)
    DRV - [2003/12/10 19:11:26 | 000,100,153 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Apfiltr.sys -- (ApfiltrService)
    DRV - [2003/12/10 08:50:00 | 001,373,436 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv)
    DRV - [2003/12/05 21:50:28 | 000,979,840 | R--- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\w70n51.sys -- (w70n51) Intel(R)
    DRV - [2003/10/24 15:53:14 | 000,090,416 | ---- | M] (Matsushita Electric Industrial Co.,Ltd.) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\meiudf.sys -- (meiudf)
    DRV - [2003/08/24 21:57:00 | 000,010,240 | ---- | M] (Padus, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\pfc.sys -- (Pfc)
    DRV - [2003/08/08 10:52:00 | 000,009,216 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\TVALZ.SYS -- (TVALZ)
    DRV - [2003/01/29 16:35:00 | 000,012,032 | ---- | M] (TOSHIBA Corporation.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\Netdevio.sys -- (Netdevio)
    DRV - [2002/12/21 08:07:34 | 001,164,576 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AGRSM.sys -- (AgereSoftModem)
    DRV - [2002/11/18 19:20:44 | 000,030,976 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\gv3.sys -- (gv3)
    DRV - [2002/09/27 08:15:28 | 000,005,760 | ---- | M] (Toshiba Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\TMEI3E.sys -- (TMEI3E)
    DRV - [2002/04/07 14:50:56 | 000,019,607 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\System32\drivers\TOSSMBNT.sys -- (tossmbnt)
    DRV - [2001/09/11 13:54:32 | 000,038,425 | ---- | M] (SMC) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\smcirda.sys -- (SMCIRDA)
    DRV - [2001/08/17 23:13:20 | 000,027,164 | ---- | M] (Xircom, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\CE3N5.SYS -- (CE3)
    DRV - [2001/08/17 14:53:32 | 000,003,328 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\qv2kux.sys -- (QV2KUX)


    ========== Standard Registry (SafeList) ==========


    ========== Internet Explorer ==========


    IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com.au/
    IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
    IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.ballarat.edu.au*
    IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = proxy.ballarat.edu.au:8080

    ========== FireFox ==========

    FF - prefs.js..browser.startup.homepage: "http://www.google.com.au/"
    FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.2.2
    FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
    FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0

    FF - HKLM\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/11/08 22:11:43 | 000,000,000 | ---D | M]
    FF - HKLM\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/10/30 14:51:16 | 000,000,000 | ---D | M]

    [2008/12/16 16:43:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bek\Application Data\Mozilla\Extensions
    [2010/11/29 18:51:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bek\Application Data\Mozilla\Firefox\Profiles\9azh5w1w.default\extensions
    [2010/10/22 17:36:37 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Documents and Settings\Bek\Application Data\Mozilla\Firefox\Profiles\9azh5w1w.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
    [2010/11/30 17:55:48 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
    [2010/11/30 17:55:48 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
    [2010/11/30 17:54:37 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll

    O1 HOSTS File: ([2010/11/30 17:32:27 | 000,000,098 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\Hosts
    O1 - Hosts: 127.0.0.1 localhost
    O1 - Hosts: ::1 localhost
    O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
    O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
    O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
    O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
    O4 - HKLM..\Run: [000StTHK] C:\WINDOWS\System32\000StTHK.exe ()
    O4 - HKLM..\Run: [00THotkey] C:\WINDOWS\system32\00THotkey.exe (TOSHIBA Corp.)
    O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\AvastUI.exe (AVAST Software)
    O4 - HKLM..\Run: [BluetoothAuthenticationAgent] C:\WINDOWS\System32\bthprops.cpl (Microsoft Corporation)
    O4 - HKLM..\Run: [DpUtil] C:\Program Files\Toshiba\DualPointUtility\TEDTray.exe (TOSHIBA)
    O4 - HKLM..\Run: [ezShieldProtector for Px] C:\WINDOWS\system32\ezSP_Px.exe (Easy Systems Japan Ltd.)
    O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
    O4 - HKLM..\Run: [NVRotateSysTray] C:\WINDOWS\System32\nvsysrot.DLL (NVIDIA Corporation)
    O4 - HKLM..\Run: [PRONoMgr.exe] C:\Program Files\Intel\PROSetWireless\NCS\PROSet\PRONoMgr.exe (Intel(R) Corporation)
    O4 - HKLM..\Run: [SmoothView] C:\Program Files\Toshiba\TOSHIBA Zooming Utility\SmoothView.exe (TOSHIBA Corporation)
    O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe File not found
    O4 - HKLM..\Run: [TAudEffect] C:\Program Files\Toshiba\TAudEffect\TAudEff.exe (TOSHIBA)
    O4 - HKLM..\Run: [TFNF5] C:\WINDOWS\System32\TFNF5.exe (TOSHIBA Corp.)
    O4 - HKLM..\Run: [TMERzCtl.EXE] C:\Program Files\TOSHIBA\TME3\TMERzCtl.EXE (TOSHIBA)
    O4 - HKLM..\Run: [TMESBS.EXE] C:\Program Files\TOSHIBA\TME3\TMESBS32.EXE (TOSHIBA Corporation)
    O4 - HKLM..\Run: [TMESRV.EXE] C:\Program Files\TOSHIBA\TME3\TMESRV31.EXE (TOSHIBA)
    O4 - HKLM..\Run: [TosHKCW.exe] C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe (TOSHIBA CORPORATION)
    O4 - HKLM..\Run: [TPSMain] C:\WINDOWS\System32\TPSMain.exe (TOSHIBA Corporation)
    O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Bluetooth Monitor.lnk = C:\Program Files\Toshiba\Bluetooth Monitor\BtMon.exe (TOSHIBA)
    O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV02.EXE (SEIKO EPSON CORPORATION)
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
    O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
    O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMConfigurePrograms = 1
    O8 - Extra context menu item: Append to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
    O8 - Extra context menu item: Convert link target to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
    O8 - Extra context menu item: Convert link target to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
    O8 - Extra context menu item: Convert selected links to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
    O8 - Extra context menu item: Convert selected links to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
    O8 - Extra context menu item: Convert selection to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
    O8 - Extra context menu item: Convert selection to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
    O8 - Extra context menu item: Convert to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
    O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Computer, Inc.)
    O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} http://office.microsoft.com/officeupdate/content/opuc.cab (Office Update Installation Engine)
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://www.update.microsoft.com/mic...ls/en/x86/client/wuweb_site.cab?1207271305714 (WUWebControl Class)
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1207271280388 (MUWebControl Class)
    O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
    O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} file://C:\WINDOWS\msxml4.cab (XML DOM Document 4.0)
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
    O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38120.7486458333 (Reg Error: Key error.)
    O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
    O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
    O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
    O20 - Winlogon\Notify\Sebring: DllName - C:\WINDOWS\System32\LgNotify.dll - C:\WINDOWS\system32\LgNotify.dll (Intel Corporation)
    O24 - Desktop WallPaper: C:\Documents and Settings\Bek\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
    O24 - Desktop BackupWallPaper: C:\Documents and Settings\Bek\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
    O32 - HKLM CDRom: AutoRun - 1
    O32 - AutoRun File - [2004/01/08 06:58:37 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
    O33 - MountPoints2\{5c6f334c-54eb-11df-bff9-00037a205c33}\Shell - "" = AutoRun
    O33 - MountPoints2\{5c6f334c-54eb-11df-bff9-00037a205c33}\Shell\AutoRun - "" = Auto&Play
    O33 - MountPoints2\{5c6f334c-54eb-11df-bff9-00037a205c33}\Shell\AutoRun\command - "" = E:\Connect.exe -- File not found
    O33 - MountPoints2\{fd2af9a0-d7cc-11dd-bf73-0011f540fd3d}\Shell\AutoRun\command - "" = E:\InstallTomTomHOME.exe -- File not found
    O34 - HKLM BootExecute: (autocheck autochk *) - File not found
    O35 - HKLM\..comfile [open] -- "%1" %*
    O35 - HKLM\..exefile [open] -- "%1" %*
    O37 - HKLM\...com [@ = comfile] -- "%1" %*
    O37 - HKLM\...exe [@ = exefile] -- "%1" %*

    ========== Files/Folders - Created Within 30 Days ==========

    [2010/11/30 17:42:32 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Bek\Desktop\JavaRa
    [2010/11/30 17:29:14 | 000,000,000 | ---D | C] -- C:\_OTL
    [2010/11/29 18:51:10 | 000,575,488 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Bek\Desktop\OTL.exe
    [2010/11/28 19:01:25 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Bek\Desktop\ThankYou_files
    [2010/11/28 11:38:20 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
    [2010/11/27 15:27:43 | 000,000,000 | ---D | C] -- C:\Temp
    [2010/11/24 21:29:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage
    [2010/11/24 20:12:34 | 000,000,000 | -HSD | C] -- C:\Config.Msi
    [2010/11/24 19:28:20 | 000,000,000 | ---D | C] -- C:\155fabfce8180507d7bcc33f6b74
    [2010/11/24 18:57:23 | 000,000,000 | ---D | C] -- C:\c458b24023cda7e0db44e1eb04
    [2010/11/24 18:57:02 | 000,000,000 | ---D | C] -- C:\4bc0d45331d96606d8deee59
    [2010/11/24 18:47:31 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\zh-TW
    [2010/11/24 18:47:31 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\zh-HK
    [2010/11/24 18:47:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\tr-TR
    [2010/11/24 18:47:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\sv-SE
    [2010/11/24 18:47:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\pt-BR
    [2010/11/24 18:47:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\nl-NL
    [2010/11/24 18:47:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\nb-NO
    [2010/11/24 18:47:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\ko-KR
    [2010/11/24 18:47:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\it-IT
    [2010/11/24 18:47:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\he-IL
    [2010/11/24 18:47:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\fr-FR
    [2010/11/24 18:47:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\fi-FI
    [2010/11/24 18:47:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\es-ES
    [2010/11/24 18:47:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\el-GR
    [2010/11/24 18:47:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\de-DE
    [2010/11/24 18:47:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\da-DK
    [2010/11/24 18:47:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\ar-SA
    [2010/11/24 17:00:16 | 000,000,000 | ---D | C] -- C:\WINDOWS\ie8updates
    [2010/11/23 19:16:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Bek\Application Data\Malwarebytes
    [2010/11/23 19:16:09 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
    [2010/11/23 19:16:07 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
    [2010/11/23 19:16:07 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
    [2010/11/23 19:16:07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    [2010/11/23 18:53:12 | 000,446,464 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Bek\Desktop\TFC.exe
    [2010/11/10 20:53:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Bek\Desktop\Mum's rescued documents
    [2010/11/06 20:43:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Bek\Desktop\confirmation.jsp_files
    [2010/01/31 17:27:13 | 000,148,736 | ---- | C] (Avanquest Software) -- C:\Documents and Settings\All Users\Application Data\hpe3.dll

    ========== Files - Modified Within 30 Days ==========

    [2010/11/30 17:41:46 | 000,205,540 | ---- | M] () -- C:\Documents and Settings\Bek\Desktop\JavaRa.zip
    [2010/11/30 17:36:19 | 000,000,198 | ---- | M] () -- C:\PSLOG
    [2010/11/30 17:36:07 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
    [2010/11/30 17:35:16 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
    [2010/11/30 17:35:13 | 804,638,720 | -HS- | M] () -- C:\hiberfil.sys
    [2010/11/30 17:32:27 | 000,000,098 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\Hosts
    [2010/11/29 19:24:23 | 000,025,712 | ---- | M] () -- C:\Documents and Settings\Bek\Desktop\kasperskywarning.JPG
    [2010/11/29 18:51:12 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Bek\Desktop\OTL.exe
    [2010/11/28 19:01:29 | 000,022,585 | ---- | M] () -- C:\Documents and Settings\Bek\Desktop\ThankYou.htm
    [2010/11/27 16:57:40 | 000,296,448 | ---- | M] () -- C:\Documents and Settings\Bek\Desktop\vere70t1.exe
    [2010/11/27 15:42:55 | 000,594,254 | ---- | M] () -- C:\Documents and Settings\Bek\Desktop\uninstall.reg
    [2010/11/27 15:27:23 | 000,436,520 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
    [2010/11/27 15:27:22 | 000,070,152 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
    [2010/11/27 15:13:42 | 000,018,614 | ---- | M] () -- C:\Documents and Settings\Bek\Desktop\sophos.bat
    [2010/11/27 15:09:30 | 000,001,393 | ---- | M] () -- C:\WINDOWS\imsins.BAK
    [2010/11/24 21:28:46 | 001,569,080 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
    [2010/11/24 20:00:53 | 000,000,153 | ---- | M] () -- C:\WINDOWS\WININIT.INI
    [2010/11/23 19:16:12 | 000,000,703 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
    [2010/11/23 18:53:26 | 000,446,464 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Bek\Desktop\TFC.exe
    [2010/11/23 18:34:08 | 000,002,626 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
    [2010/11/21 19:46:54 | 000,015,360 | ---- | M] () -- C:\Documents and Settings\Bek\My Documents\Book2.xls
    [2010/11/13 21:53:40 | 000,018,432 | ---- | M] () -- C:\Documents and Settings\Bek\Desktop\grade1-2_assessment_data_end_2010.xls
    [2010/11/07 17:15:43 | 000,098,816 | ---- | M] () -- C:\Documents and Settings\Bek\My Documents\You are hereby invited to attend.doc
    [2010/11/06 22:08:17 | 000,040,408 | ---- | M] () -- C:\Documents and Settings\Bek\Desktop\uniball08-20.JPG
    [2010/11/06 22:06:39 | 000,030,099 | ---- | M] () -- C:\Documents and Settings\Bek\Desktop\uniball08-12.JPG
    [2010/11/06 22:04:42 | 000,030,527 | ---- | M] () -- C:\Documents and Settings\Bek\Desktop\uniball08-5.JPG
    [2010/11/06 20:44:22 | 000,345,838 | ---- | M] () -- C:\Documents and Settings\Bek\Desktop\alto.xps
    [2010/11/06 20:43:53 | 000,019,503 | ---- | M] () -- C:\Documents and Settings\Bek\Desktop\confirmation.jsp.htm

    ========== Files Created - No Company Name ==========

    [2010/11/30 17:41:44 | 000,205,540 | ---- | C] () -- C:\Documents and Settings\Bek\Desktop\JavaRa.zip
    [2010/11/29 19:24:23 | 000,025,712 | ---- | C] () -- C:\Documents and Settings\Bek\Desktop\kasperskywarning.JPG
    [2010/11/28 19:01:24 | 000,022,585 | ---- | C] () -- C:\Documents and Settings\Bek\Desktop\ThankYou.htm
    [2010/11/27 19:24:17 | 804,638,720 | -HS- | C] () -- C:\hiberfil.sys
    [2010/11/27 16:57:36 | 000,296,448 | ---- | C] () -- C:\Documents and Settings\Bek\Desktop\vere70t1.exe
    [2010/11/27 15:42:55 | 000,594,254 | ---- | C] () -- C:\Documents and Settings\Bek\Desktop\uninstall.reg
    [2010/11/27 15:13:42 | 000,018,614 | ---- | C] () -- C:\Documents and Settings\Bek\Desktop\sophos.bat
    [2010/11/23 19:16:12 | 000,000,703 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
    [2010/11/13 21:31:48 | 000,018,432 | ---- | C] () -- C:\Documents and Settings\Bek\Desktop\grade1-2_assessment_data_end_2010.xls
    [2010/11/07 17:15:41 | 000,098,816 | ---- | C] () -- C:\Documents and Settings\Bek\My Documents\You are hereby invited to attend.doc
    [2010/11/06 22:08:17 | 000,040,408 | ---- | C] () -- C:\Documents and Settings\Bek\Desktop\uniball08-20.JPG
    [2010/11/06 22:06:39 | 000,030,099 | ---- | C] () -- C:\Documents and Settings\Bek\Desktop\uniball08-12.JPG
    [2010/11/06 22:04:42 | 000,030,527 | ---- | C] () -- C:\Documents and Settings\Bek\Desktop\uniball08-5.JPG
    [2010/11/06 20:44:19 | 000,345,838 | ---- | C] () -- C:\Documents and Settings\Bek\Desktop\alto.xps
    [2010/11/06 20:43:51 | 000,019,503 | ---- | C] () -- C:\Documents and Settings\Bek\Desktop\confirmation.jsp.htm
    [2010/09/28 19:51:03 | 000,000,000 | ---- | C] () -- C:\WINDOWS\HPMProp.INI
    [2010/09/28 19:43:14 | 000,200,704 | ---- | C] () -- C:\WINDOWS\System32\Bot.dll
    [2010/09/28 19:43:14 | 000,000,101 | ---- | C] () -- C:\WINDOWS\Psxlpr.ini
    [2009/08/03 15:07:42 | 000,403,816 | ---- | C] () -- C:\WINDOWS\System32\OGACheckControl.dll
    [2008/09/30 21:02:05 | 000,001,024 | ---- | C] () -- C:\WINDOWS\System32\grcauth2.dll
    [2008/09/30 21:02:05 | 000,001,024 | ---- | C] () -- C:\WINDOWS\System32\grcauth1.dll
    [2008/09/30 21:02:05 | 000,000,100 | ---- | C] () -- C:\WINDOWS\System32\prsgrc.dll
    [2008/09/07 23:44:44 | 000,005,120 | ---- | C] () -- C:\Documents and Settings\Bek\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    [2008/06/12 00:00:39 | 000,000,126 | ---- | C] () -- C:\Documents and Settings\Bek\Local Settings\Application Data\fusioncache.dat
    [2008/06/02 19:08:03 | 000,023,253 | ---- | C] () -- C:\WINDOWS\UBDesktop.ini
    [2008/05/20 01:06:50 | 000,000,097 | ---- | C] () -- C:\WINDOWS\WirelessFTP.INI
    [2008/04/04 14:51:33 | 002,463,976 | ---- | C] () -- C:\WINDOWS\System32\NPSWF32.dll
    [2007/02/13 13:51:14 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\setupw2k.dll
    [2007/02/13 13:51:13 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\nwslog32.dll
    [2007/02/12 16:17:10 | 000,001,024 | ---- | C] () -- C:\WINDOWS\System32\clauth2.dll
    [2007/02/12 16:17:10 | 000,001,024 | ---- | C] () -- C:\WINDOWS\System32\clauth1.dll
    [2007/02/12 16:17:10 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\ssprs.dll
    [2007/02/12 16:17:10 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\serauth2.dll
    [2007/02/12 16:17:10 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\serauth1.dll
    [2007/02/12 16:17:10 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\nsprs.dll
    [2007/02/12 16:15:15 | 000,001,025 | ---- | C] () -- C:\WINDOWS\System32\sysprs7.dll
    [2007/02/12 16:15:15 | 000,000,205 | ---- | C] () -- C:\WINDOWS\System32\lsprst7.dll
    [2007/02/09 17:28:06 | 000,002,276 | ---- | C] () -- C:\WINDOWS\opera.ini
    [2006/06/13 18:05:00 | 000,757,818 | ---- | C] () -- C:\WINDOWS\System32\gwadd1.dll
    [2006/06/13 16:21:06 | 000,303,166 | ---- | C] () -- C:\WINDOWS\System32\gwodm132.dll
    [2006/06/13 15:37:20 | 000,098,354 | ---- | C] () -- C:\WINDOWS\System32\GWLDO132.DLL
    [2004/07/09 10:31:18 | 000,155,700 | ---- | C] () -- C:\WINDOWS\System32\ODMA32.DLL
    [2004/05/17 14:23:04 | 000,000,199 | ---- | C] () -- C:\WINDOWS\swacnfg.ini
    [2004/05/15 05:56:44 | 000,204,800 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeW7.dll
    [2004/05/15 05:56:44 | 000,200,704 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeA6.dll
    [2004/05/15 05:56:44 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeP6.dll
    [2004/05/15 05:56:44 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeM6.dll
    [2004/05/15 05:56:44 | 000,188,416 | ---- | C] () -- C:\WINDOWS\System32\IVIresizePX.dll
    [2004/05/15 05:56:44 | 000,020,480 | ---- | C] () -- C:\WINDOWS\System32\IVIresize.dll
    [2004/05/15 05:32:40 | 000,010,165 | ---- | C] () -- C:\WINDOWS\System32\tosmreg.ini
    [2004/05/15 05:32:39 | 000,128,113 | ---- | C] () -- C:\WINDOWS\System32\csellang.ini
    [2004/05/15 05:32:39 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\csellang.dll
    [2004/05/15 05:32:39 | 000,007,671 | ---- | C] () -- C:\WINDOWS\System32\cseltbl.ini
    [2004/05/14 16:42:30 | 000,000,153 | ---- | C] () -- C:\WINDOWS\WININIT.INI
    [2004/01/14 06:23:00 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
    [2004/01/08 09:10:02 | 000,000,908 | ---- | C] () -- C:\WINDOWS\System32\Px.ini
    [2004/01/08 09:01:44 | 000,019,607 | ---- | C] () -- C:\WINDOWS\System32\drivers\TOSSMBNT.sys
    [2004/01/08 08:59:01 | 000,000,000 | ---- | C] () -- C:\WINDOWS\NDSTray.INI
    [2004/01/08 07:29:28 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
    [2004/01/08 07:22:03 | 000,363,520 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
    [2004/01/08 07:19:02 | 000,000,791 | ---- | C] () -- C:\WINDOWS\orun32.ini
    [2004/01/08 07:02:01 | 000,122,880 | ---- | C] () -- C:\WINDOWS\System32\e1000msg.dll
    [2004/01/08 07:02:00 | 000,016,384 | ---- | C] () -- C:\WINDOWS\System32\e100bmsg.dll
    [2004/01/08 05:43:57 | 000,000,350 | -H-- | C] () -- C:\WINDOWS\System32\oeminfo.ini
    [2004/01/07 22:51:38 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
    [2004/01/07 15:29:37 | 001,478,656 | ---- | C] () -- C:\WINDOWS\System32\TosMousePage.dll
    [2004/01/07 15:29:36 | 000,770,048 | ---- | C] () -- C:\WINDOWS\System32\TosKeyboardPage.dll
    [2004/01/07 15:29:35 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\TosBtHcrpAPI.dll
    [2004/01/07 15:29:33 | 000,114,688 | ---- | C] () -- C:\WINDOWS\System32\TosBtAcc.dll
    [2004/01/07 15:29:32 | 000,114,688 | ---- | C] () -- C:\WINDOWS\System32\TBTMonUI.dll
    [2003/12/16 09:29:42 | 000,204,800 | ---- | C] () -- C:\WINDOWS\System32\C1XStngs.dll
    [2002/12/04 11:57:00 | 000,651,264 | ---- | C] () -- C:\WINDOWS\System32\libeay32.dll
    [2002/12/04 11:57:00 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\ssleay32.dll

    ========== LOP Check ==========

    [2010/09/22 12:42:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Alwil Software
    [2008/04/04 15:40:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SafeNet Sentinel
    [2008/08/26 14:15:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Sony
    [2008/04/04 15:38:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SPSS
    [2008/06/09 20:55:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\X-Setup Pro
    [2008/06/12 00:15:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bek\Application Data\FileZilla
    [2004/01/08 09:13:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bek\Application Data\InterTrust
    [2008/04/09 12:36:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bek\Application Data\InterVideo
    [2008/05/15 23:07:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bek\Application Data\iPodder
    [2008/08/26 14:15:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bek\Application Data\Sony
    [2004/01/08 09:01:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bek\Application Data\toshiba
    [2008/06/09 20:55:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bek\Application Data\X-Setup Pro

    ========== Purity Check ==========



    < End of report >
     
  15. crunchie

    crunchie Malware Helper Posts: 728

  16. ignoramus

    ignoramus TS Rookie Topic Starter Posts: 18

    I found out why Kaspersky wasn't working. There is now a message on their website which says:

    "Coming soon:
    A new, improved version of the
    Kaspersky Online Scanner

    The current Kaspersky Online Scanner is unavailable - we apologize for the inconvenience. While you are waiting for the improved Online Scanner, why not take a free trial of Kaspersky Internet Security 2011, which has everything you need to keep your computer safe."

    What now?
     
  17. crunchie

    crunchie Malware Helper Posts: 728

    Everything so far (unless I have missed something) points to a clean computer.
    I would say that this one is good to go.
     
  18. ignoramus

    ignoramus TS Rookie Topic Starter Posts: 18

    Awesome. When it comes back online I'll run Kaspersky to make sure. Thanks so much for your time and help, you are a champ. :)
     
  19. crunchie

    crunchie Malware Helper Posts: 728

    No worries :).

    To remove all of the tools we used and the files and folders they created, please do the following:
    Please download OTC by OldTimer:
    Save it to your Desktop.
    Double click OTC.exe.
    Click the CleanUp! button.
    If you are prompted to Reboot during the cleanup, select Yes. The tool will delete itself once it finishes.
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...