TechSpot

Computer has a virus that takes away IE, and recycle bin icons, and start menu icons

Solved
By pwm1031
Oct 8, 2011
Topic Status:
Not open for further replies.
  1. Hello all,
    I need some help. It has been some time since I have batted a virus and the last time a forum of wonderful people such as you guys helped me out. I have a virus of some sort that attacked my main account and made my quick launch disappear along with all of the icons in my start menu. I circumvented issues by logging into another account, but now it seems it forces me to swicth to the infected desktop, where files work properly, but I cannot download anything that I was supposed to from the 6 step thread and I cannot access the control panel to create a new user. When this orginally occured on my administrator account, tons of error windows popped up. I haven't logged in there since. Any help is appreciated.
    Thanks,
    Phil
     
  2. pwm1031

    pwm1031 TS Rookie Topic Starter Posts: 21

    More information

    So the message on the orginal user with the problem is "Failed to save all the components for the file \System32\00007e87. The file is corrupted or unreadable."
    Hope this helps.
    Phil
     
  3. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +36

    Welcome to TechSpot! I'll help sort out the problem. I'm going to have you follow some preliminary steps, but I'd like you to do the following first:

    The error you note is called "Write Fail." You can do the following, but Note: this will slow the system down but can be reset later.

    To turn off Enable write caching on the disk, follow these steps:
    1. Click Start> My Computer> Right-click the hard disk> Properties.
    2. Click the Hardware tab> Select.
    3. Click to select Hard disc> then click Properties.
    4. Click the Policies tab.
    5. Click to clear the Enable write caching on the disk check box
    6. Click OK> Again OK to close the Local Disk (C) Properties dialog box.
    If you have other Hard drives installed, repeat steps 2 through 5 for each hard disk that is installed in your computer.
    ===================================================
    To show the files that have been hidden by the malware: Note: This does not remove the malware, only the attribute to hide- it will show you that the files are still actually on the system. This first run may not show them all:
    Download Unhide.exe and save to the desktop.
    • Double-click on Unhide.exe icon to run the program.
    • This program will remove the +H, or hidden, attribute from all the files on your hard drives.
    ===================================================
    Okay, now that this has been done, please follow the steps in the Preliminary Virus and Malware Removal thread HERE.

    NOTE: If you already have any of the scanning programs on the computer, please remove them and download the versions in these links.

    When you have finished, leave the logs for review in your next reply .
    NOTE: Logs must be pasted in the replies. Attached logs will not be reviewed.
    ========================================
    My Guidelines: please read and follow:
    • Be patient. Malware cleaning takes time and I am also working with other members while I am helping you.
    • Read my instructions carefully. If you don't understand or have a problem, ask me.
    • If you have questions, or if a program doesn't work, stop and tell me about it. Don't try to get around it yourself.
    • Follow the order of the tasks I give you. Order is crucial in cleaning process.
    • File sharing programs should be uninstalled or disabled during the cleaning process..
    • Observe these:
      [o] Don't use any other cleaning programs or scans while I'm helping you.
      [o] Don't use a Registry cleaner or make any changes in the Registry.
      [o] Don't download and install new programs- except those I give you.
    • Please let me know if there is any change in the system.

    If I don't get a reply from you in 5 days, the thread will be closed. If your problem persist, you can send a PM to reopen it.
    =====================================
     
  4. pwm1031

    pwm1031 TS Rookie Topic Starter Posts: 21

    Thanks for the reply. Whenever I try to click on My Computer nothing happens. I cannot open any folder, only files and documents that are already in the all programs list or on the desktop. How can I access My Computer, maybe safe mode? Just let me know.
    Thanks again,
    Phil
     
  5. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +36

    What operating system are you using?

    Did you run unhide?
     
  6. pwm1031

    pwm1031 TS Rookie Topic Starter Posts: 21

    After I ran the unhide.exe I was able to do most of the steps on the 6-step page. I was unable to get dds.scr to run properly. I may need help turning off script blocking. Below are some logs minuse the two from dds.scr.

    Malwarebytes' Anti-Malware 1.51.2.1300
    www.malwarebytes.org

    Database version: 7919

    Windows 6.0.6002 Service Pack 2
    Internet Explorer 8.0.6001.19120

    10/10/2011 9:59:17 PM
    mbam-log-2011-10-10 (21-59-17).txt

    Scan type: Quick scan
    Objects scanned: 223507
    Time elapsed: 26 minute(s), 19 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 6

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    (No malicious items detected)

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    c:\Users\martha and levi\AppData\Roaming\conhost.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
    c:\Users\martha and levi\AppData\Roaming\microsoft\lvvm.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
    c:\Users\martha and levi\AppData\Local\Temp\0.053905401011333565.exe (Rootkit.0Access) -> Quarantined and deleted successfully.
    c:\Users\martha and levi\AppData\Local\Temp\0.610044073519089.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
    c:\Users\martha and levi\AppData\Local\Temp\dwm.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
    c:\Users\martha and levi\AppData\Local\Temp\hnt.dll (Rootkit.0Access) -> Quarantined and deleted successfully.

    GMER 1.0.15.15641 - http://www.gmer.net
    Rootkit quick scan 2011-10-10 22:36:45
    Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0 WDC_WD16 rev.04.0
    Running: sbyf3l0m.exe; Driver: C:\Users\SARAH&~1\AppData\Local\Temp\kxtdqpow.sys


    ---- System - GMER 1.0.15 ----

    Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateFile [0x8D2D9998]
    Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateProcess [0x8D2D992D]
    Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateProcessEx [0x8D2D9941]
    Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwNotifyChangeKey [0x8D2D99C2]
    Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwOpenProcess [0x8D2D9905]
    Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwOpenThread [0x8D2D9919]
    Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwProtectVirtualMemory [0x8D2D99AC]
    Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwReplaceKey [0x8D2D99EA]
    Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwRestoreKey [0x8D2D99D6]
    Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwSetInformationProcess [0x8D2D996B]
    Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateUserProcess [0x8D2D9957]
    Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtCreateFile
    Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtOpenProcess
    Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtOpenThread
    Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtSetInformationProcess

    ---- Devices - GMER 1.0.15 ----

    AttachedDevice \FileSystem\Ntfs \Ntfs mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
    AttachedDevice \Driver\tdx \Device\Ip Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)
    AttachedDevice \Driver\tdx \Device\Tcp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)
    AttachedDevice \Driver\tdx \Device\Udp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)
    AttachedDevice \Driver\tdx \Device\RawIp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)
    AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
    AttachedDevice \Driver\kbdclass \Device\KeyboardClass1 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)

    ---- EOF - GMER 1.0.15 ----


    Thanks again,
    Phil
     
  7. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +36

    Did user watch a podcast recently?
    ==============================
    The results aren't good. You have the Zero Access rootkit, and the Backdoor.bots is brought with it: What you need to know about this malware:
    1. Specifically at exploiting 64-bit machines
    2. New version of ZeroAccess, which also is known as Max++
    3. Remain persistent on infected machines via rootkit hooks burrows down into the lower levels of the operating system.
    4. Installed on users' machines via drive-by downloads that aim to exploit any one of a number of known vulnerabilities, often bugs in Adobe Reader or Java.
    5. When the downloader is run on an x64 system-results in a dropper specially compiled for x64 systems being downloaded to the victim’s computer.
    6. Dropper does not contain a rootkit.
    7. It is usermode malware that replicates the behavior of an x32 rootkit except that its components are files and are stored in "$windir\assembly" with similar directory structures.
    8. Autorun on x64 systems is provided by the registry key “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems”.
    9. The body of the dropper is placed in the system32 folder under the name consrv.dll
    10. All the modules that the dropper downloads following its own installation are also designed for 64-bit platforms,"
    11. The ZeroAccess rootkit that's circulating now has the ability to download a menu of other modules, as well, including a component that will hijack search results.
    Courtesy of the good people of Wiki
    ================================
    Download and run TDSSKiller first:
    1. Double-click on TDSSKiller.exe to run the application.
    2. Click on the Start Scan button and wait for the scan and disinfection process to be over.
    3. If an infected file is detected, the default action will be Cure, click on Continue Posted Image
      [​IMG]
    4. If a suspicious file is detected, the default action will be Skip, click on Continue
      [​IMG]
    5. If you are asked to reboot the computer to complete the process, click on the Reboot Now button. A report will be automatically saved at the root of the System drive ((usually C:\) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt" (for example, C:\TDSSKiller.2.2.0_20.12.2009_15.31.43_log.txt).
    [*] If no reboot is required, click on Report. A log file will appear. Please copy and paste the contents of that file in your next reply.[/lst]
    ==========================
    Follow with download of maxhandle.exe by noahdfear to your desktop.
    1. Double click maxhandle.exeand run the application
    2. An active internet connection is required so that maxhandle.exe may download a tool from SysInternals
    3. If Max++ is present the log will open automatically.
    4. If Max++ is not found Nothing found! is echoed to the screen - no log is produced.
    5. Log is saved to c:\maxhandle.txt

    Please post both of the logs in your next reply.
     
  8. pwm1031

    pwm1031 TS Rookie Topic Starter Posts: 21

    There were no threats found by TDSSKiller and nothing found!! by maxhandle.exe. Do I still need to try to run the dds.scr that I was previously unable to run?
    Thanks,
    Phil
     
  9. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +36

    Yes please do DDS and leave the 2 logs.
     
  10. pwm1031

    pwm1031 TS Rookie Topic Starter Posts: 21

    I have had no luck in getting the DDS to run. What can I try? When I click on the icon a box quickly appears and then goes away and that is it.
    Thanks,
    Phil
     
  11. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +36

    TDSSKiller
    maxhandle.exe
    ===========================================
    First: Download but don't run yet:
    Please note: If you have previously run Combofix and it's still on the system, please uninstall it. Then download the current version and do the scan: Uninstall directions, if needed
    • Click START> then RUN
    • Now type Combofix /Uninstall in the runbox and click OK. Note the space between the X and the U, it needs to be there.
    --------------------------------------
    Download Combofix from HERE or HERE and save to the desktop
    ***********Hold on Desktop until instructed******************
    1. Double click combofix.exe & follow the prompts.
    2. ComboFix will check to see if the Microsoft Windows Recovery Console is installed. It is recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode if needed.
      **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.
    3. Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
    4. Once installed, you should see a blue screen prompt that says:
      The Recovery Console was successfully installed.
    5. .Click on Yes, to continue scanning for malware
    6. .If Combofix asks you to update the program, allow
    7. .Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
    8. .Close any open browsers.
    9. .Double click combofix.exe[​IMG] & follow the prompts to run.
    10. When the scan completes , a report will be generated-it will open a text window. Please paste the C:\ComboFix.txt in next reply..
    Re-enable your Antivirus software.

    Note 1:Do not mouse-click Combofix's window while it is running. That may cause it to stall.
    Note 2: ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
    Note 3: Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell your helper.
    Note 4: CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
    Note 5: If you receive an error "Illegal operation attempted on a registry key that has been marked for deletion", restart computer to fix the issue.
    ===============================
    Please download and run the tool below named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.

    There are 3 different versions. If one of them won't run then download and try to run the other one.

    Vista and Win7 users need to right click Rkill and choose Run as Administrator

    You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.
    • Rkill.com
    • Rkill.scr
    • Rkill.exe
    • Double-click on the Rkill desktop icon to run the tool.
    • If using Vista or Windows 7 right-click on it and choose Run As Administrator.
    • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
    • If not, delete the file, then download and use the one provided in Link 2.
    • If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
    • Do not reboot until instructed.
    • If the tool does not run from any of the links provided, please let me know.

    Once you've gotten one of them to run then try to immediately run the following>>>>.

    Please download exeHelper by Raktor and save it to your desktop.
    • Double-click on exeHelper.com or exeHelper.scr to run the fix tool.
    • A black window should pop up, press any key to close once the fix is completed.
    • A log file called exehelperlog.txt will be created and should open at the end of the scan)
    • A copy of that log will also be saved in the directory where you ran exeHelper.com
    • Copy and paste the contents of exehelperlog.txt in your next reply.

    Note: If the window shows a message that says "Error deleting file", please re-run the tool again before posting a log and then post the two logs together (they both will be in the one file).
    ================================
    'Without rebooting, Try the DDS scan again.

    Then pick up Combofix at Step 1 and complete.
    =================================
    If successful, please leave all logs in next reply.
     
     
  12. pwm1031

    pwm1031 TS Rookie Topic Starter Posts: 21

    I could not get the DDS scan to run, but I did do everything else, the Combofix, rkill, and exehelper.

    ComboFix 11-10-13.05 - Sarah&Phil 10/13/2011 22:40:34.1.2 - x86
    Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.2038.1039 [GMT -4:00]
    Running from: c:\users\Sarah&Phil\Desktop\ComboFix.exe
    AV: AntiVir Desktop *Disabled/Outdated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
    FW: McAfee Personal Firewall *Enabled* {12134D8A-643C-0ED8-8373-3C472F110AF7}
    SP: AntiVir Desktop *Disabled/Outdated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
    SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    c:\users\Sarah&Phil\g2mdlhlpx.exe
    c:\windows\Downloaded Program Files\CpnMgr.dll
    D:\Autorun.inf
    .
    .
    ((((((((((((((((((((((((( Files Created from 2011-09-14 to 2011-10-14 )))))))))))))))))))))))))))))))
    .
    .
    2011-10-14 02:59 . 2011-10-14 02:59 -------- d-----w- c:\users\Martha and Levi\AppData\Local\temp
    2011-10-14 02:59 . 2011-10-14 02:59 -------- d-----w- c:\users\Default\AppData\Local\temp
    2011-10-12 18:57 . 2011-07-29 16:01 293376 ----a-w- c:\windows\system32\psisdecd.dll
    2011-10-12 18:57 . 2011-07-29 16:01 217088 ----a-w- c:\windows\system32\psisrndr.ax
    2011-10-12 18:57 . 2011-07-29 16:00 69632 ----a-w- c:\windows\system32\Mpeg2Data.ax
    2011-10-12 18:57 . 2011-07-29 16:00 57856 ----a-w- c:\windows\system32\MSDvbNP.ax
    2011-10-12 18:31 . 2011-08-25 16:14 238080 ----a-w- c:\windows\system32\oleacc.dll
    2011-10-12 18:31 . 2011-08-25 16:15 555520 ----a-w- c:\windows\system32\UIAutomationCore.dll
    2011-10-12 18:31 . 2011-08-25 16:14 563712 ----a-w- c:\windows\system32\oleaut32.dll
    2011-10-12 18:31 . 2011-08-25 13:31 4096 ----a-w- c:\windows\system32\oleaccrc.dll
    2011-10-12 02:25 . 2011-07-07 17:28 520496 ----a-w- c:\windows\Listdlls.exe
    2011-10-12 02:25 . 2011-05-17 16:48 423288 ----a-w- c:\windows\handle.exe
    2011-10-11 02:23 . 2011-10-11 02:23 100864 ----a-w- C:\kxtdqpow.sys
    2011-10-11 01:31 . 2011-10-11 01:31 -------- d-----w- c:\users\Sarah&Phil\AppData\Roaming\Malwarebytes
    2011-10-11 01:31 . 2011-10-11 01:31 -------- d-----w- c:\programdata\Malwarebytes
    2011-10-11 01:31 . 2011-08-31 21:00 22216 ----a-w- c:\windows\system32\drivers\mbam.sys
    2011-10-11 01:31 . 2011-10-11 01:31 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2011-10-10 21:19 . 2011-10-10 21:19 -------- d-----w- c:\users\Sarah&Phil\AppData\Roaming\Avira
    2011-10-10 21:16 . 2011-07-21 16:15 138192 ----a-w- c:\windows\system32\drivers\avipbb.sys
    2011-10-10 21:16 . 2011-07-21 16:15 66616 ----a-w- c:\windows\system32\drivers\avgntflt.sys
    2011-10-10 21:15 . 2011-10-10 21:15 -------- d-----w- c:\programdata\Avira
    2011-10-10 21:15 . 2011-10-10 21:15 -------- d-----w- c:\program files\Avira
    2011-10-08 23:32 . 2011-10-08 23:32 -------- d-----w- c:\users\Martha and Levi\AppData\Local\Adobe
    2011-10-05 12:52 . 2011-10-05 12:52 -------- d-----w- c:\users\Martha and Levi\AppData\Roaming\Apple Computer
    2011-10-04 02:06 . 2011-10-04 02:06 -------- d-----w- c:\users\Sarah&Phil\AppData\Local\MigWiz
    2011-10-03 04:23 . 2008-01-19 07:33 163840 ----a-w- c:\users\Sarah&Phil\taskmgr.exe
    2011-09-29 11:56 . 2011-09-29 11:56 -------- d-----w- c:\users\Martha and Levi\AppData\Local\Apple Computer
    2011-09-29 10:13 . 2011-09-29 10:17 -------- d-----w- c:\users\Martha and Levi\AppData\Local\Microsoft Games
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2011-09-29 23:40 . 2011-06-06 02:00 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
    .
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
    "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-02-12 174872]
    "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-04-26 865840]
    "Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2010-09-14 30192]
    "Spare Backup"="c:\program files\Spare Backup\SpareBackup.exe" [2007-07-13 5252936]
    "mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2007-08-04 582992]
    "IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-01-02 141848]
    "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-01-02 166424]
    "Persistence"="c:\windows\system32\igfxpers.exe" [2008-01-02 133656]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792]
    "Conime"="c:\windows\system32\conime.exe" [2009-04-11 69120]
    "EKIJ5000StatusMonitor"="c:\windows\system32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe" [2008-10-22 1310720]
    "Monitor"="c:\program files\LeapFrog\LeapFrog Connect\Monitor.exe" [2010-11-19 193880]
    "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]
    "Windstream_BCUC_McciTrayApp"="c:\program files\Windstream_BCUC\McciTrayApp.exe" [2010-05-01 1742336]
    "avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-04-21 281768]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
    "Launcher"="c:\windows\SMINST\launcher.exe" [2007-07-04 40072]
    .
    c:\users\Sarah&Phil\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
    OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]
    .
    c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
    Kodak EasyShare software.lnk - c:\program files\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2008-10-30 282624]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "EnableUIADesktopToggle"= 0 (0x0)
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GOEC62~1.DLL
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
    @=""
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
    "DisableMonitoring"=dword:00000001
    .
    R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
    R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-02-02 135664]
    R3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2010-09-14 30192]
    R3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-02-02 135664]
    R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [x]
    R3 NETw2v32;Intel(R) PRO/Wireless 2200BG Network Connection Driver for Windows Vista;c:\windows\system32\DRIVERS\NETw2v32.sys [2006-11-02 2589184]
    R3 sscebus;SAMSUNG USB Composite Device V2 driver (WDM);c:\windows\system32\DRIVERS\sscebus.sys [2009-05-13 90240]
    R3 sscemdfl;SAMSUNG Mobile Modem V2 Filter;c:\windows\system32\DRIVERS\sscemdfl.sys [2009-05-13 14976]
    R3 sscemdm;SAMSUNG Mobile Modem V2 Drivers;c:\windows\system32\DRIVERS\sscemdm.sys [2009-05-13 121856]
    R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
    S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2011-04-21 136360]
    S2 Kodak AiO Network Discovery Service;Kodak AiO Network Discovery Service;c:\program files\Kodak\AiO\Center\EKDiscovery.exe [2009-01-19 279960]
    S2 KodakSvc;Kodak AiO Device Service;c:\program files\Kodak\AiO\center\KodakSvc.exe [2009-01-19 38296]
    S2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [2011-08-10 94880]
    S2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2007-01-04 24652]
    S3 RTL8187B;Realtek RTL8187B Wireless 802.11g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8187B.sys [2007-05-24 251904]
    .
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2011-10-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2010-02-02 15:54]
    .
    2011-10-14 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2010-02-02 15:54]
    .
    2007-08-30 c:\windows\Tasks\McDefragTask.job
    - c:\program files\mcafee\mqc\QcConsol.exe [2008-06-08 17:32]
    .
    2011-08-01 c:\windows\Tasks\McQcTask.job
    - c:\program files\mcafee\mqc\QcConsol.exe [2008-06-08 17:32]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.windstream.net/
    mStart Page = hxxp://www.gateway.com/g/startpage.html?Ch=Retail&SubCH=nofound&Br=GTW&Loc=ENG_US&Sys=PTB&M=MT6723
    uInternet Settings,ProxyOverride = *.local
    uSearchURL,(Default) = hxxp://search.yahoo.com/search?fr=mcafee&p=%s
    IE: &AIM Toolbar Search - c:\programdata\AIM Toolbar\ieToolbar\resources\en-US\local\search.html
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
    IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html
    TCP: DhcpNameServer = 192.168.2.1
    DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://games2.gamefools.com/onlinegames/Yahtzee/zylomplayer.cab
    .
    - - - - ORPHANS REMOVED - - - -
    .
    HKCU-Run-Aim6 - (no file)
    HKLM-Run-NapsterShell - c:\program files\Napster\napster.exe
    HKLM-Run-BigFix - c:\program files\Bigfix\bigfix.exe
    HKLM-Run-SunJavaUpdateSched - c:\program files\Java\jre6\bin\jusched.exe
    .
    .
    .
    **************************************************************************
    .
    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2011-10-13 23:00
    Windows 6.0.6002 Service Pack 2 NTFS
    .
    scanning hidden processes ...
    .
    scanning hidden autostart entries ...
    .
    scanning hidden files ...
    .
    scan completed successfully
    hidden files: 0
    .
    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    "MSCurrentCountry"=dword:000000b5
    .
    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    .
    [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    .
    Completion time: 2011-10-13 23:12:41
    ComboFix-quarantined-files.txt 2011-10-14 03:12
    .
    Pre-Run: 45,288,443,904 bytes free
    Post-Run: 54,528,032,768 bytes free
    .
    - - End Of File - - FD204DED4C312A41ABADDAB8711CC5B9

    exeHelper by Raktor
    Build 20100414
    Run at 23:23:41 on 10/13/11
    Now searching...
    Checking for numerical processes...
    Checking for sysguard processes...
    Checking for bad processes...
    Checking for bad files...
    Checking for bad registry entries...
    Resetting filetype association for .exe
    Resetting filetype association for .com
    Resetting userinit and shell values...
    Resetting policies...
    --Finished--
     
  13. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +36

    This deletion D:\Autorun.inf indicates that you may have a flash drive infection. These worms travel through your portable drives. If they have been connected to other machines, they may now be infected.

    Please disinfect all movable drives
    1. Please download Flash_Disinfector.exe by sUBs and save it to your desktop.
    2. Double-click Flash_Disinfector.exe to run it and follow any prompts that may appear.
      Note: Some security programs will flag Flash_Disinfector as being some sort of malware, you can safely ignore these warnings
    3. The utility may ask you to insert your flash drive and/or other removable drives including your mobile phone. Please do so and allow the utility to clean up those drives as well.
    4. Wait until it has finished scanning and then exit the program.
    5. Reboot your computer when done.

    Note: Flash_Disinfector will create a hidden folder named autorun.inf in each partition and every USB drive plugged in when you ran it. Don't delete this folder. It will help protect your drives from future infection.
    ================
    Please tell me specifically what happens when you try to run DDS.
     
  14. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +36

    Note: You have two outdated security prograqms:
    AV: AntiVir Desktop *Disabled/Outdated*
    SP: AntiVir Desktop *Disabled/Outdated*
    SP: Windows Defender *Enabled/Outdated*
    You recently installed AntiVir. Did you update it after instlalling it? If not, please do that.I don't need a scan from Avira, but to protect the system, it should be current.
    =====================================
    Please run this Custom CFScript:

    • [1]. Close any open browsers.
      [2]. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
      [3]. Open notepad> click on Format> Uncheck 'Word Wrap'> and copy/paste the text in the code below into it:Be sure to scroll down to include ALL lines.
    Code:
    File::
    C:\kxtdqpow.sys
    c:\program files\Viewpoint\Common\ViewpointService.exe 
    
    Registry::
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
    "DisableMonitoring"=
    Driver::
    Viewpoint Manager Service
    FCopy::
    
    Save this as CFScript.txt, in the same location as ComboFix.exe
    [​IMG]

    Referring to the picture above, drag CFScript into ComboFix.exe

    When finished, it will produce a log for you at C:\ComboFix.txt . Please paste in your next reply.
    ====================
     
  15. pwm1031

    pwm1031 TS Rookie Topic Starter Posts: 21

    Thanks,
    As soon as I am able to get to the infected computer I will post back. Hopefully tonight.
     
  16. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +36

    Okay- post when ready.
     
  17. pwm1031

    pwm1031 TS Rookie Topic Starter Posts: 21

    So about the only thing I was able to do was update the Avira. When I downloaded the Flash Disinfector and clicked to run it, nothing really happened except for the circle appearing beside my cursor for a second to show that something was trying to work. Then I followed your instructions on the CFScript post and I got the messange "CFScript Name Error" that states "Were you trying to run CFScript? The name, CFScript seems to be incorrectly spelt"

    As far as what happens when I try to run DDS, a window pops up very quickly, looks possibly like the command prompt window and then disappears, after this nothing happens.

    Thanks for the help.
     
  18. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +36

    Please check and make sure this is spelled correctly> Save this as CFScript.txt in the same location as ComboFix.exe
    =======================================
    Disable McAfee VirusScan ScriptStopper
    1. Right click on the McAfee VirusScan icon in the system tray. [​IMG]
    2. Select VirusScan> Options.
    3. Click Advanced button> ScriptStopper tab.
      [o]Note: McAfee VirusScan 10 users, click the Exploits tab.
    4. Make sure Enable ScriptStopper (recommended) option is unchecked
    5. Click OK and then click OK to complete disabling McAfee ScriptStopper feature.
    =============================================
    For DDS
    Please download this file: xp_scr_fix

    Unpack (unzip) the file onto your desktop and double-click it. You will be asked if you wish to merge the file with you registry, say Yes.

    You should then be able to run DDS.scr. It's the .scr file extension causing the problem.
     
  19. pwm1031

    pwm1031 TS Rookie Topic Starter Posts: 21

    I tried what you said to do for the DDS and it said the changes were made, I also completely uninstalled McAfee (it was 5 years old anyway) but DDS would still not run.

    As far as the ComboFix situation here is how I have spelled CFScript but I still get the same error after it tells me a newer version of ComboFix is available and restarts.

    Thanks
     
  20. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +36

    Full name of script files: CFScript.txt

    Run these again and please leave the logs:

    Please download and run the tool below named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.

    There are 3 different versions. If one of them won't run then download and try to run the other one.

    Vista and Win7 users need to right click Rkill and choose Run as Administrator

    You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.
    • Rkill.com
    • Rkill.scr
    • Rkill.exe
    • Double-click on the Rkill desktop icon to run the tool.
    • If using Vista or Windows 7 right-click on it and choose Run As Administrator.
    • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
    • If not, delete the file, then download and use the one provided in Link 2.
    • If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
    • Do not reboot until instructed.
    • If the tool does not run from any of the links provided, please let me know.

    Once you've gotten one of them to run then try to immediately run the following>>>>.

    Please download exeHelper by Raktor and save it to your desktop.
    • Double-click on exeHelper.com or exeHelper.scr to run the fix tool.
    • A black window should pop up, press any key to close once the fix is completed.
    • A log file called exehelperlog.txt will be created and should open at the end of the scan)
    • A copy of that log will also be saved in the directory where you ran exeHelper.com
    • Copy and paste the contents of exehelperlog.txt in your next reply.

    Note: If the window shows a message that says "Error deleting file", please re-run the tool again before posting a log and then post the two logs together (they both will be in the one file).
    ========================================
    • Hold down Control and click on the following link to open ESET OnlineScan in a new window.
      ESETOnlineScan
    • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
      [o] Click on Posted Image to download the ESET Smart Installer. Save it to your desktop.
      [o] Double click on the [​IMG]on your desktop.
    • Check 'Yes I accept terms of use.'
    • Click Start button
    • Accept any security warnings from your browser.
      [​IMG]
    • Uncheck 'Remove found threats'
    • Check 'Scan archives/
    • Leave remaining settings as is.
    • Press the Start button.
    • ESET will then download updates for itself, install itself, and begin scanning your computer. Please wait for the scan to finish.
    • When the scan completes, press List of found threats
    • Push Export of text file and save the file to your desktop using a unique name, such as ESETScan. Paste this log in your next reply.
    • Push the Back button
    • Push Finish
    NOTE: If no malware is found then no log will be produced. Let me know if this is the case.
     
  21. pwm1031

    pwm1031 TS Rookie Topic Starter Posts: 21

    I still had no luck with CFScript.txt, but here are the other logs.
    exeHelper by Raktor
    Build 20100414
    Run at 21:14:01 on 10/23/11
    Now searching...
    Checking for numerical processes...
    Checking for sysguard processes...
    Checking for bad processes...
    Checking for bad files...
    Checking for bad registry entries...
    Resetting filetype association for .exe
    Resetting filetype association for .com
    Resetting userinit and shell values...
    Resetting policies...
    --Finished--


    C:\Users\Martha and Levi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\G5PGQD84\boobfactorthumblogger_in[1].htm JS/Kryptik.CW trojan
    C:\Users\Martha and Levi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\28\e6480dc-16f65009 Win32/Cycbot.AD trojan
    C:\Users\Martha and Levi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\9\12c0d149-2ebfda63 a variant of Win32/Kryptik.TSQ trojan
    C:\Users\Sarah&Phil\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\WQPJBA2B\bestbrutalanal_in[1].htm JS/Kryptik.CW trojan
     
  22. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +36

    For Eset:

    Please download OTMovit by Old Timer and save to your desktop.
    • Double-click OTMoveIt3.exe to run it. (Vista users, please right click on OTMoveit3.exe and select "Run as an Administrator")
    • Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
      Code:
      :Files  
      C:\Users\Martha and Levi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\G5PGQD84\boobfactorthumblogger_in[1].htm 
      C:\Users\Martha and Levi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\28\e6480dc-16f65009 
      C:\Users\Martha and Levi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\9\12c0d149-2ebfda63 
      C:\Users\Sarah&Phil\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\WQPJBA2B\bestbrutalanal_in[1].htm 
      
      :Commands
      [purity]
      [emptytemp]
      [start explorer]
      [Reboot]
    • Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window and choose Paste.
    • Click the red Moveit! button.
    • A log of files and folders moved will be created in the c:\_OTMoveIt\MovedFiles folder in the form of Date and Time (mmddyyyy_hhmmss.log). Please open this log in Notepad and post its contents in your next reply.
    • Close OTMoveIt3
    If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.
    ========================================
    To clear the Java Plug-in cache:

    • [1]. Click Start > Control Panel.
      [2]. Double-click the Java icon in the control panel.The Java Control Panel appears.
      [​IMG]
      [3].Click Settings under Temporary Internet Files.The Temporary Files Settings dialog box appears.
      [​IMG]
      [4] Click Delete Files.The Delete Temporary Files dialog box appears.
      [​IMG]
      [5]. Click OK on Delete Temporary Files window.
      Note: This deletes all the Downloaded Applications and Applets from the cache.
      [6]. Click Apply> OK on Temporary Files Settings window.
    Images courtesy java.com
    ==========================================
    You are still getting active malware. Some is in the temporary internet files, some in the Java cache:

    If you have not done this, please do so now: Please update Java: Java Updates . Uninstall any earlier versions in Add/Remove Programs as they are vulnerabilities for the system.
    =========================================
    Uninstall ComboFix and all Backups of the files it deleted
    • Click START> then RUN
    • Now type Combofix /Uninstall in the runbox and click OK. Note the space between the X and the U, it needs to be there.
      [​IMG]
    ==========================================
    Uninstall DDS
    =========================================
    TFC (Temp File Cleaner)
    Download TFC to your desktop
    • Open the file and close any other windows.
    • It will close all programs itself when run, make sure to let it run uninterrupted.
    • Click the Start button to begin the process. The program should not take long to finish its job
    • Once its finished it should reboot your machine, if not, do this yourself to ensure a complete clean
    ======================================
    • Download OTL from either of the links below and save it to your desktop.
      Link 1
      Link 2
    • Double click the OTL icon to run it.[​IMG]
    • The opened console will resemble this: [​IMG]
    • Set Output at the top to Minimal Output.
    • Check the boxes beside LOP Check and Purity Check.
    • Copy the entries in the Codebox below> Paste in the Custom Scan box.
      Code:
      netsvcs
      %SYSTEMDRIVE%\*.exe
      /md5start
      explorer.exe
      winlogon.exe
      userinit.exe
      /md5stop
      %systemroot%\*. /mp /s
      CREATERESTOREPOINT
      
    • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
      Make sure all other windows are closed and to let it run uninterrupted.
    • When the scan completes, it will open two notepad windows. OTListIt.Txt and Extras.Txt. These are saved in the same location as OTL.
    • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them all in.
     
  23. pwm1031

    pwm1031 TS Rookie Topic Starter Posts: 21

    I have done everything in the previous post except for the Uninstall of Combofix didn't work I got a message saying it could not find it, so I just deleted what I could find on the desktop of it and the DDS, which I don't think ever really installed to begin with. Below are the longs in order of how I ran them.

    All processes killed
    Error: Unable to interpret <Files > in the current context!
    Error: Unable to interpret <C:\Users\Martha and Levi\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\G5PGQD84\boobfactorthumblogger_in[1].htm > in the current context!
    Error: Unable to interpret <C:\Users\Martha and Levi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\28\e6480dc-16f65009 > in the current context!
    Error: Unable to interpret <C:\Users\Martha and Levi\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\9\12c0d149-2ebfda63 > in the current context!
    Error: Unable to interpret <C:\Users\Sarah&Phil\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\WQPJBA2B\bestbrutalanal_in[1].htm > in the current context!
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: All Users

    User: AppData
    ->Temp folder emptied: 0 bytes

    User: Default
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 67 bytes

    User: Default User
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: Martha and Levi
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 66644275 bytes
    ->Java cache emptied: 523247 bytes
    ->Flash cache emptied: 2187 bytes

    User: Public
    ->Temp folder emptied: 0 bytes

    User: Sarah&Phil
    ->Temp folder emptied: 802853 bytes
    ->Temporary Internet Files folder emptied: 965346206 bytes
    ->Java cache emptied: 177320446 bytes
    ->Flash cache emptied: 341858 bytes

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 458447 bytes
    %systemroot%\System32 .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 41740355 bytes
    %systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 16349488 bytes
    RecycleBin emptied: 740114 bytes

    Total Files Cleaned = 1,211.00 mb


    OTM by OldTimer - Version 3.1.19.0 log created on 10262011_162501

    Files moved on Reboot...

    Registry entries deleted on Reboot...


    OTL logfile created on: 10/26/2011 9:35:45 PM - Run 1
    OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Sarah&Phil\Desktop
    Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
    Internet Explorer (Version = 8.0.6001.19154)
    Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

    1.99 Gb Total Physical Memory | 1.16 Gb Available Physical Memory | 58.47% Memory free
    4.22 Gb Paging File | 3.17 Gb Available in Paging File | 75.06% Paging File free
    Paging file location(s): ?:\pagefile.sys [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
    Drive C: | 138.75 Gb Total Space | 63.76 Gb Free Space | 45.95% Space Free | Partition Type: NTFS
    Drive D: | 10.30 Gb Total Space | 3.88 Gb Free Space | 37.66% Space Free | Partition Type: NTFS

    Computer Name: NOTEBOOK | User Name: Sarah&Phil | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: Current user | Quick Scan
    Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

    ========== Processes (SafeList) ==========

    PRC - C:\Users\Sarah&Phil\Desktop\OTL.exe (OldTimer Tools)
    PRC - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
    PRC - C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH)
    PRC - C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
    PRC - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
    PRC - C:\Program Files\LeapFrog\LeapFrog Connect\Monitor.exe (LeapFrog Enterprises, Inc.)
    PRC - C:\Program Files\LeapFrog\LeapFrog Connect\CommandService.exe (LeapFrog Enterprises, Inc.)
    PRC - C:\Program Files\Windstream_BCUC\McciTrayApp.exe (Alcatel-Lucent)
    PRC - C:\Windows\explorer.exe (Microsoft Corporation)
    PRC - C:\Program Files\Kodak\AiO\Center\KodakSvc.exe (Eastman Kodak Company)
    PRC - C:\Program Files\Kodak\AiO\Center\EKDiscovery.exe (Eastman Kodak Company)
    PRC - C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe (Eastman Kodak Company)
    PRC - C:\Windows\System32\spool\drivers\w32x86\3\EKIJ5000MUI.exe (Eastman Kodak Company)
    PRC - C:\Program Files\Spare Backup\SpareBackup.exe (SpareBackup, Inc.)
    PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
    PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
    PRC - C:\Program Files\Viewpoint\Common\ViewpointService.exe (Viewpoint Corporation)
    PRC - C:\Windows\System32\agrsmsvc.exe (Agere Systems)


    ========== Modules (No Company Name) ==========

    MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\6bc98e9b5eedaa8f71c5454d36a4b772\System.Management.ni.dll ()
    MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Services\6b88a2bf58d8529fc33f8f3437a7ff06\System.Web.Services.ni.dll ()
    MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\e00630ec1e225a2376fdd430645e20f7\System.Web.ni.dll ()
    MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\6d2f689baff5da3df134fdec0742a13c\System.Runtime.Remoting.ni.dll ()
    MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\02768700bc8f762ccfe37785ba8eb498\System.EnterpriseServices.ni.dll ()
    MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Transactions\8f3b3ab45e3e5fa61aa6cbfe2a8b61af\System.Transactions.ni.dll ()
    MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Security\cbfa4bf002c1abaf94ba8634139727eb\System.Security.ni.dll ()
    MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.SqlXml\2b2dd2c19c570013eb8fce9bb6578e45\System.Data.SqlXml.ni.dll ()
    MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\40da9084d0863e07d7ce55953833b8b0\System.Configuration.ni.dll ()
    MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualC\0be0eb42238f115408fd2fab2b9a387f\Microsoft.VisualC.ni.dll ()
    MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\Accessibility\bcb66dbad2b45d05235b37a02f737eb5\Accessibility.ni.dll ()
    MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\c1c06a392871267db27f7cbc40e1c4fb\System.Xml.ni.dll ()
    MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\1363115565fff5a641243a48f396f107\System.Windows.Forms.ni.dll ()
    MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\367c4043efc2f32d843cb588b0dc97fc\System.Drawing.ni.dll ()
    MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data\9e53d9921c4bb153f1ffbe1ae0e1b615\System.Data.ni.dll ()
    MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\f9c36ea806e77872dce891c77b68fac3\System.ni.dll ()
    MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\b6632a8b2f276a8e31f5b0f6b2006cd1\mscorlib.ni.dll ()
    MOD - C:\Program Files\Google\Google Desktop Search\gzlib.dll ()
    MOD - C:\Program Files\LeapFrog\LeapFrog Connect\QtGui4.dll ()
    MOD - C:\Program Files\LeapFrog\LeapFrog Connect\QtCore4.dll ()
    MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\SkinuxXML2V.dll ()
    MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\VPrintOnline.dll ()
    MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\SkinuxProcV.dll ()
    MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\SpiffyExt.dll ()
    MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\SkinuxZipV.dll ()
    MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\VPrintOnlineHelper40.dll ()
    MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\SkinuxCmpV.dll ()
    MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\SkinuxCommonV.dll ()
    MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\SkinuxBaseV.dll ()
    MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\SkinuxImV.dll ()
    MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\SkinuxFFV.dll ()
    MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\KFx.dll ()
    MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\kpries40.dll ()
    MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\LocAcqMod.dll ()
    MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\keml40.dll ()
    MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\KPCDInterface.dll ()
    MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\LocCamBack.dll ()
    MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\LocUpdateCheck.dll ()
    MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\areaifdll.dll ()
    MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\ESCom.dll ()
    MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\Atlas.dll ()
    MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\VistaAdapter.esx ()
    MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\VistaPrintOnline.esx ()
    MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\AppCore.dll ()
    MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\VistaControls.esx ()
    MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\VistaCDBackup.esx ()
    MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\UpdateChecker.esx ()
    MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\DibLibIP.dll ()
    MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\ESSkin.esx ()
    MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\ESCliWicMDRW.esx ()
    MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\ESEmail.esx ()
    MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\Pcd.esx ()
    MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\IStorageMediaStore.esx ()
    MOD - C:\Program Files\Kodak\Kodak EasyShare software\bin\DXRawFormatHandler.esx ()
    MOD - C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll ()
    MOD - C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll ()
    MOD - C:\Windows\assembly\GAC\Microsoft.Web.Services2\2.0.3.0__31bf3856ad364e35\Microsoft.Web.Services2.dll ()
    MOD - C:\Program Files\Spare Backup\System.Data.SQLite.DLL ()
    MOD - C:\Program Files\Spare Backup\UberCrypto.dll ()


    ========== Win32 Services (SafeList) ==========

    SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
    SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
    SRV - (LeapFrog Connect Device Service) -- C:\Program Files\LeapFrog\LeapFrog Connect\CommandService.exe (LeapFrog Enterprises, Inc.)
    SRV - (KodakSvc) -- C:\Program Files\Kodak\AiO\center\KodakSvc.exe (Eastman Kodak Company)
    SRV - (Kodak AiO Network Discovery Service) -- C:\Program Files\Kodak\AiO\Center\EKDiscovery.exe (Eastman Kodak Company)
    SRV - (GameConsoleService) -- C:\Program Files\Gateway Games\Gateway Game Console\GameConsoleService.exe (WildTangent, Inc.)
    SRV - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
    SRV - (IAANTMON) Intel(R) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
    SRV - (Viewpoint Manager Service) -- C:\Program Files\Viewpoint\Common\ViewpointService.exe (Viewpoint Corporation)
    SRV - (AgereModemAudio) -- C:\Windows\System32\agrsmsvc.exe (Agere Systems)


    ========== Driver Services (SafeList) ==========

    DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
    DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
    DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
    DRV - (MRESP50) -- C:\Program Files\Common Files\Motive\MRESP50.sys (Printing Communications Assoc., Inc. (PCAUSA))
    DRV - (MREMP50) -- C:\Program Files\Common Files\Motive\MREMP50.sys (Printing Communications Assoc., Inc. (PCAUSA))
    DRV - (sscemdm) -- C:\Windows\System32\drivers\sscemdm.sys (MCCI Corporation)
    DRV - (sscebus) SAMSUNG USB Composite Device V2 driver (WDM) -- C:\Windows\System32\drivers\sscebus.sys (MCCI Corporation)
    DRV - (sscemdfl) -- C:\Windows\System32\drivers\sscemdfl.sys (MCCI Corporation)
    DRV - (RTL8187B) -- C:\Windows\System32\drivers\rtl8187B.sys (Realtek Semiconductor Corporation )
    DRV - (STHDA) -- C:\Windows\System32\drivers\stwrt.sys (SigmaTel, Inc.)
    DRV - (RTL8169) -- C:\Windows\System32\drivers\Rtlh86.sys (Realtek Corporation)
    DRV - (AgereSoftModem) -- C:\Windows\System32\drivers\AGRSM.sys (Agere Systems)
    DRV - (NETw2v32) Intel(R) -- C:\Windows\System32\drivers\NETw2v32.sys (Intel® Corporation)
    DRV - (bcm4sbxp) -- C:\Windows\System32\drivers\bcm4sbxp.sys (Broadcom Corporation)


    ========== Standard Registry (SafeList) ==========


    ========== Internet Explorer ==========

    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.gateway.com/g/startpage.html?Ch=Retail&SubCH=nofound&Br=GTW&Loc=ENG_US&Sys=PTB&M=MT6723
    IE - HKLM\..\URLSearchHook: {03402f96-3dc7-4285-bc50-9e81fefafe43} - C:\Program Files\AIM Toolbar\aimtb.dll (AOL LLC.)

    IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
    IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.windstream.net/
    IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
    IE - HKCU\..\URLSearchHook: {03402f96-3dc7-4285-bc50-9e81fefafe43} - C:\Program Files\AIM Toolbar\aimtb.dll (AOL LLC.)
    IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
    IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

    FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
    FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
    FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
    FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
    FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
    FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
    FF - HKLM\Software\MozillaPlugins\@Motive.com/NpMotive,version=1.0: C:\Program Files\Common Files\Motive\npMotive.dll (Alcatel-Lucent)
    FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
    FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
    FF - HKLM\Software\MozillaPlugins\@viewpoint.com/VMP: C:\Program Files\Viewpoint\Viewpoint Media Player\npViewpoint.dll ()
    FF - HKCU\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player: C:\Users\Sarah&Phil\AppData\Roaming\Move Networks\plugins\npqmp071705000014.dll (Move Networks)

    FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{3112ca9c-de6d-4884-a869-9855de68056c}: C:\ProgramData\Google\Toolbar for Firefox\{3112ca9c-de6d-4884-a869-9855de68056c} [2010/12/09 21:49:28 | 000,000,000 | ---D | M]
    FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\moveplayer@movenetworks.com: C:\Users\Sarah&Phil\AppData\Roaming\Move Networks [2009/12/27 21:54:11 | 000,000,000 | ---D | M]


    O1 HOSTS File: ([2011/10/13 22:59:44 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
    O1 - Hosts: 127.0.0.1 localhost
    O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
    O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll (Google Inc.)
    O2 - BHO: (AIM Toolbar Loader) - {b0cda128-b425-4eef-a174-61a11ac5dbf8} - C:\Program Files\AIM Toolbar\aimtb.dll (AOL LLC.)
    O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Windows\System32\BAE.dll (Gateway Inc.)
    O3 - HKLM\..\Toolbar: (AIM Toolbar) - {61539ecd-cc67-4437-a03c-9aaccbd14326} - C:\Program Files\AIM Toolbar\aimtb.dll (AOL LLC.)
    O3 - HKCU\..\Toolbar\WebBrowser: (AIM Toolbar) - {61539ECD-CC67-4437-A03C-9AACCBD14326} - C:\Program Files\AIM Toolbar\aimtb.dll (AOL LLC.)
    O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
    O4 - HKLM..\Run: [Conime] C:\Windows\System32\conime.exe (Microsoft Corporation)
    O4 - HKLM..\Run: [EKIJ5000StatusMonitor] C:\Windows\System32\spool\drivers\w32x86\3\EKIJ5000MUI.exe (Eastman Kodak Company)
    O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe (Intel Corporation)
    O4 - HKLM..\Run: [Monitor] C:\Program Files\LeapFrog\LeapFrog Connect\Monitor.exe (LeapFrog Enterprises, Inc.)
    O4 - HKLM..\Run: [Spare Backup] C:\Program Files\Spare Backup\SpareBackup.exe (SpareBackup, Inc.)
    O4 - HKLM..\Run: [Windstream_BCUC_McciTrayApp] C:\Program Files\Windstream_BCUC\McciTrayApp.exe (Alcatel-Lucent)
    O4 - HKLM..\RunOnce: [Launcher] C:\Windows\SMINST\Launcher.exe (soft thinks)
    O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O8 - Extra context menu item: &AIM Toolbar Search - C:\ProgramData\AIM Toolbar\ieToolbar\resources\en-US\local\search.html ()
    O8 - Extra context menu item: Google Sidewiki... - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll (Google Inc.)
    O9 - Extra Button: AIM Toolbar - {0b83c99c-1efa-4259-858f-bcb33e007a5b} - C:\Program Files\AIM Toolbar\aimtb.dll (AOL LLC.)
    O9 - Extra Button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll (Apple Inc.)
    O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
    O15 - HKCU\..Trusted Domains: localhost ([]http in Local intranet)
    O15 - HKCU\..Trusted Ranges: GD ([http] in Local intranet)
    O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} http://office.microsoft.com/sites/production/ieawsdc32.cab (Microsoft Office Template and Media Control)
    O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} http://support.gateway.com/support/profiler/PCPitStop.CAB (PCPitstop Utility)
    O16 - DPF: {15B782AF-55D8-11D1-B477-006097098764} http://download.macromedia.com/pub/shockwave/cabs/authorware/awswaxf.cab (Macromedia Authorware Web Player Control)
    O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
    O16 - DPF: {1C11B948-582A-433F-A98D-A8C4D5CC64F2} https://lowes.2020.net/planner/Core/Player/2020PlayerAX_Win32.cab (20-20 3D Viewer)
    O16 - DPF: {3D3B42C2-11BF-4732-A304-A01384B70D68} http://picasaweb.google.com/s/v/67.14/uploader2.cab (UploadListView Class)
    O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} http://photo2.walgreens.com/WalgreensActivia.cab (Snapfish Activia)
    O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
    O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)
    O16 - DPF: {9A57B18E-2F5D-11D5-8997-00104BD12D94} http://www.onlineregister.com/gateway/serial/gwCID.cab (compid Class)
    O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} http://games2.gamefools.com/onlinegames/Yahtzee/zylomplayer.cab (Zylom Games Player)
    O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
    O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab (Shockwave Flash Object)
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553557800} http://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Reg Error: Key error.)
    O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} https://mckessonlearning.webex.com/client/T26L/training/ieatgpc1.cab (GpcContainer Class)
    O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4593E15F-E8C4-4C95-AA67-9AE1C6F85974}: DhcpNameServer = 192.168.2.1
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{52098EC1-C8D7-4E10-8955-463A541464AB}: DhcpNameServer = 192.168.254.254 192.168.254.254
    O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL) -C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)
    O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)
    O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)
    O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\GTW2_Standard.bmp
    O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\GTW2_Standard.bmp
    O32 - HKLM CDRom: AutoRun - 1
    O32 - AutoRun File - [2006/09/18 17:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
    O34 - HKLM BootExecute: (autocheck autochk *)
    O35 - HKLM\..comfile [open] -- "%1" %*
    O35 - HKLM\..exefile [open] -- "%1" %*
    O37 - HKLM\...com [@ = comfile] -- "%1" %*
    O37 - HKLM\...exe [@ = exefile] -- "%1" %*

    NetSvcs: FastUserSwitchingCompatibility - File not found
    NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
    NetSvcs: Nla - File not found
    NetSvcs: Ntmssvc - File not found
    NetSvcs: NWCWorkstation - File not found
    NetSvcs: Nwsapagent - File not found
    NetSvcs: SRService - File not found
    NetSvcs: WmdmPmSp - File not found
    NetSvcs: LogonHours - File not found
    NetSvcs: PCAudit - File not found
    NetSvcs: helpsvc - File not found
    NetSvcs: uploadmgr - File not found

    CREATERESTOREPOINT
    Restore point Set: OTL Restore Point

    ========== Files/Folders - Created Within 30 Days ==========

    [2011/10/26 17:10:34 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\Sarah&Phil\Desktop\OTL.exe
    [2011/10/26 16:55:18 | 000,446,464 | ---- | C] (OldTimer Tools) -- C:\Users\Sarah&Phil\Desktop\TFC.exe
    [2011/10/26 16:45:04 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
    [2011/10/26 16:25:01 | 000,000,000 | ---D | C] -- C:\_OTM
    [2011/10/26 16:24:20 | 000,523,264 | ---- | C] (OldTimer Tools) -- C:\Users\Sarah&Phil\Desktop\OTM.exe
    [2011/10/23 21:17:43 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
    [2011/10/23 21:06:36 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
    [2011/10/23 21:06:36 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
    [2011/10/23 21:06:18 | 000,000,000 | --SD | C] -- C:\ComboFix
    [2011/10/13 23:27:05 | 000,000,000 | ---D | C] -- C:\Users\Sarah&Phil\Desktop\Cleaing tools
    [2011/10/13 23:11:37 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
    [2011/10/13 22:35:17 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
    [2011/10/13 22:26:23 | 000,000,000 | ---D | C] -- C:\Qoobox
    [2011/10/11 22:25:59 | 000,520,496 | ---- | C] (Sysinternals) -- C:\Windows\Listdlls.exe
    [2011/10/11 22:25:57 | 000,423,288 | ---- | C] (Sysinternals) -- C:\Windows\handle.exe
    [2011/10/11 22:22:53 | 000,000,000 | ---D | C] -- C:\Users\Sarah&Phil\Documents\tdsskiller[1]
    [2011/10/10 22:23:10 | 000,100,864 | ---- | C] (GMER) -- C:\kxtdqpow.sys
    [2011/10/10 21:31:32 | 000,000,000 | ---D | C] -- C:\Users\Sarah&Phil\AppData\Roaming\Malwarebytes
    [2011/10/10 21:31:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
    [2011/10/10 21:31:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
    [2011/10/10 21:31:11 | 000,022,216 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
    [2011/10/10 21:31:10 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
    [2011/10/10 17:19:51 | 000,000,000 | ---D | C] -- C:\Users\Sarah&Phil\AppData\Roaming\Avira
    [2011/10/10 17:16:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
    [2011/10/10 17:16:09 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\ssmdrv.sys
    [2011/10/10 17:16:03 | 000,138,192 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys
    [2011/10/10 17:16:02 | 000,066,616 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys
    [2011/10/10 17:15:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira
    [2011/10/10 17:15:56 | 000,000,000 | ---D | C] -- C:\Program Files\Avira
    [2011/10/03 22:06:11 | 000,000,000 | ---D | C] -- C:\Users\Sarah&Phil\AppData\Local\MigWiz
    [2011/10/03 00:23:33 | 000,163,840 | ---- | C] (Microsoft Corporation) -- C:\Users\Sarah&Phil\taskmgr.exe

    ========== Files - Modified Within 30 Days ==========

    [2011/10/26 21:26:09 | 000,000,882 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
    [2011/10/26 21:26:07 | 000,003,168 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
    [2011/10/26 21:26:06 | 000,003,168 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
    [2011/10/26 21:25:53 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
    [2011/10/26 21:25:51 | 2137,448,448 | -HS- | M] () -- C:\hiberfil.sys
    [2011/10/26 20:46:00 | 000,000,886 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
    [2011/10/26 17:10:42 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Sarah&Phil\Desktop\OTL.exe
    [2011/10/26 16:56:19 | 000,446,464 | ---- | M] (OldTimer Tools) -- C:\Users\Sarah&Phil\Desktop\TFC.exe
    [2011/10/26 16:24:24 | 000,523,264 | ---- | M] (OldTimer Tools) -- C:\Users\Sarah&Phil\Desktop\OTM.exe
    [2011/10/18 21:06:56 | 000,001,608 | ---- | M] () -- C:\Users\Sarah&Phil\Desktop\xp_scr_fix.reg
    [2011/10/18 21:06:45 | 000,000,497 | ---- | M] () -- C:\Users\Sarah&Phil\Desktop\xp_scr_fix.zip
    [2011/10/16 22:38:02 | 000,132,597 | ---- | M] () -- C:\Users\Sarah&Phil\Desktop\Flash_Disinfector.exe
    [2011/10/13 23:23:39 | 000,294,400 | ---- | M] () -- C:\Users\Sarah&Phil\Desktop\exeHelper.com
    [2011/10/13 22:59:44 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
    [2011/10/13 19:28:40 | 000,295,896 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
    [2011/10/13 08:03:08 | 000,616,928 | ---- | M] () -- C:\Windows\System32\perfh009.dat
    [2011/10/13 08:03:08 | 000,110,002 | ---- | M] () -- C:\Windows\System32\perfc009.dat
    [2011/10/12 20:54:11 | 176,179,149 | ---- | M] () -- C:\Windows\MEMORY.DMP
    [2011/10/10 22:23:10 | 000,100,864 | ---- | M] (GMER) -- C:\kxtdqpow.sys
    [2011/10/08 23:19:03 | 000,000,680 | ---- | M] () -- C:\Users\Sarah&Phil\AppData\Local\d3d9caps.dat
    [2011/10/08 23:14:07 | 000,000,328 | ---- | M] () -- C:\ProgramData\1kAlMiG2Kb7FzP

    ========== Files Created - No Company Name ==========

    [2011/10/23 21:06:36 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
    [2011/10/23 21:06:36 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
    [2011/10/23 21:06:36 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
    [2011/10/23 21:06:36 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
    [2011/10/23 21:06:36 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
    [2011/10/18 21:06:41 | 000,000,497 | ---- | C] () -- C:\Users\Sarah&Phil\Desktop\xp_scr_fix.zip
    [2011/10/16 22:36:00 | 000,132,597 | ---- | C] () -- C:\Users\Sarah&Phil\Desktop\Flash_Disinfector.exe
    [2011/10/13 23:23:28 | 000,294,400 | ---- | C] () -- C:\Users\Sarah&Phil\Desktop\exeHelper.com
    [2011/10/09 08:53:23 | 2137,448,448 | -HS- | C] () -- C:\hiberfil.sys
    [2011/10/08 23:18:59 | 000,000,680 | ---- | C] () -- C:\Users\Sarah&Phil\AppData\Local\d3d9caps.dat
    [2011/10/08 23:14:07 | 000,000,328 | ---- | C] () -- C:\ProgramData\1kAlMiG2Kb7FzP
    [2010/05/11 19:01:08 | 000,000,056 | ---- | C] () -- C:\ProgramData\ezsidmv.dat
    [2010/03/09 18:20:44 | 000,000,036 | ---- | C] () -- C:\Users\Sarah&Phil\AppData\Local\housecall.guid.cache
    [2009/09/11 17:53:36 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
    [2009/09/11 17:53:36 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
    [2009/08/03 15:07:42 | 000,403,816 | ---- | C] () -- C:\Windows\System32\OGACheckControl.dll
    [2009/08/03 15:07:42 | 000,230,768 | ---- | C] () -- C:\Windows\System32\OGAEXEC.exe
    [2009/07/12 14:11:45 | 000,000,116 | ---- | C] () -- C:\Users\Sarah&Phil\AppData\Roaming\wklnhst.dat
    [2009/05/10 22:07:56 | 000,012,800 | ---- | C] () -- C:\Windows\System32\EKDeviceServices.dll
    [2008/09/17 23:02:15 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
    [2008/01/02 17:57:36 | 000,147,456 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1409.dll
    [2008/01/02 17:47:22 | 001,953,696 | ---- | C] () -- C:\Windows\System32\igklg400.dll
    [2008/01/02 17:47:22 | 001,533,360 | ---- | C] () -- C:\Windows\System32\igklg450.dll
    [2008/01/02 17:47:22 | 000,104,636 | ---- | C] () -- C:\Windows\System32\igmedcompkrn.dll
    [2007/12/25 13:03:09 | 000,124,928 | ---- | C] () -- C:\Users\Sarah&Phil\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    [2007/08/30 17:00:50 | 000,204,800 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1268.dll
    [2007/08/30 17:00:49 | 000,910,464 | ---- | C] () -- C:\Windows\System32\igmedkrn.dll
    [2007/08/30 17:00:03 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll
    [2006/11/02 08:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
    [2006/11/02 08:47:37 | 000,295,896 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
    [2006/11/02 08:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
    [2006/11/02 06:33:01 | 000,616,928 | ---- | C] () -- C:\Windows\System32\perfh009.dat
    [2006/11/02 06:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
    [2006/11/02 06:33:01 | 000,110,002 | ---- | C] () -- C:\Windows\System32\perfc009.dat
    [2006/11/02 06:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
    [2006/11/02 06:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
    [2006/11/02 04:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
    [2006/11/02 04:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
    [2006/11/02 03:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
    [2006/11/02 03:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
    [2006/06/11 20:01:15 | 000,352,256 | ---- | C] () -- C:\Windows\System32\HotlineClient.exe
    [2002/03/14 12:00:26 | 000,038,567 | ---- | C] () -- C:\Windows\System32\pcpbios.exe
    [2001/06/27 13:31:00 | 000,039,611 | ---- | C] () -- C:\Windows\System32\biosid.exe
    [1998/08/16 05:00:00 | 000,004,096 | ---- | C] () -- C:\Windows\System32\sysres.dll

    ========== LOP Check ==========

    [2009/09/09 17:23:54 | 000,000,000 | ---D | M] -- C:\Users\Sarah&Phil\AppData\Roaming\acccore
    [2010/05/28 08:09:25 | 000,000,000 | ---D | M] -- C:\Users\Sarah&Phil\AppData\Roaming\Canon
    [2009/10/20 17:13:20 | 000,000,000 | ---D | M] -- C:\Users\Sarah&Phil\AppData\Roaming\HouseCall 6.6
    [2007/12/25 13:45:19 | 000,000,000 | ---D | M] -- C:\Users\Sarah&Phil\AppData\Roaming\SampleView
    [2009/05/11 09:33:47 | 000,000,000 | ---D | M] -- C:\Users\Sarah&Phil\AppData\Roaming\Skinux
    [2011/10/26 21:27:36 | 000,000,000 | ---D | M] -- C:\Users\Sarah&Phil\AppData\Roaming\Spare Backup
    [2011/06/17 11:13:48 | 000,000,000 | ---D | M] -- C:\Users\Sarah&Phil\AppData\Roaming\Temp
    [2009/07/12 14:11:50 | 000,000,000 | ---D | M] -- C:\Users\Sarah&Phil\AppData\Roaming\Template
    [2010/01/14 10:38:33 | 000,000,000 | ---D | M] -- C:\Users\Sarah&Phil\AppData\Roaming\webex
    [2007/12/25 15:47:44 | 000,000,000 | ---D | M] -- C:\Users\Sarah&Phil\AppData\Roaming\WildTangent
    [2011/10/26 17:07:48 | 000,032,582 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

    ========== Purity Check ==========



    ========== Custom Scans ==========


    < %SYSTEMDRIVE%\*.exe >


    < MD5 for: EXPLORER.EXE >
    [2008/10/29 02:20:29 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe
    [2008/10/29 02:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe
    [2008/10/29 23:59:17 | 002,927,616 | ---- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe
    [2007/12/28 00:53:15 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=6D06CD98D954FE87FB2DB8108793B399 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16549_none_4fac29707cae347a\explorer.exe
    [2007/12/28 00:53:15 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=BD06F0BF753BC704B653C3A50F89D362 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20668_none_501f261995dcf2cf\explorer.exe
    [2009/04/11 02:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\ERDNT\cache\explorer.exe
    [2009/04/11 02:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\explorer.exe
    [2009/04/11 02:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe
    [2008/10/27 22:15:02 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe
    [2006/11/02 05:45:07 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=FD8C53FB002217F6F888BCF6F5D7084D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16386_none_4f7de5167cd15deb\explorer.exe
    [2008/01/19 03:33:10 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe

    < MD5 for: USERINIT.EXE >
    [2008/01/19 03:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\ERDNT\cache\userinit.exe
    [2008/01/19 03:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe
    [2008/01/19 03:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
    [2006/11/02 05:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6000.16386_none_d9f1f819d4c4e737\userinit.exe

    < MD5 for: WINLOGON.EXE >
    [2009/04/11 02:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\ERDNT\cache\winlogon.exe
    [2009/04/11 02:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe
    [2009/04/11 02:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
    [2006/11/02 05:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6000.16386_none_6d8c3f1ad8066b21\winlogon.exe
    [2008/01/19 03:33:37 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe

    < %systemroot%\*. /mp /s >

    ========== Alternate Data Streams ==========

    @Alternate Data Stream - 64 bytes -> C:\Users\Sarah&Phil\Desktop\True Religion - Orphan Sunday.mp4:TOC.WMV

    < End of report >
     
  24. pwm1031

    pwm1031 TS Rookie Topic Starter Posts: 21

    OTL Extras logfile created on: 10/26/2011 9:35:45 PM - Run 1
    OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Sarah&Phil\Desktop
    Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
    Internet Explorer (Version = 8.0.6001.19154)
    Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

    1.99 Gb Total Physical Memory | 1.16 Gb Available Physical Memory | 58.47% Memory free
    4.22 Gb Paging File | 3.17 Gb Available in Paging File | 75.06% Paging File free
    Paging file location(s): ?:\pagefile.sys [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
    Drive C: | 138.75 Gb Total Space | 63.76 Gb Free Space | 45.95% Space Free | Partition Type: NTFS
    Drive D: | 10.30 Gb Total Space | 3.88 Gb Free Space | 37.66% Space Free | Partition Type: NTFS

    Computer Name: NOTEBOOK | User Name: Sarah&Phil | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: Current user | Quick Scan
    Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

    ========== Extra Registry (SafeList) ==========


    ========== File Associations ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
    .cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
    .hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

    ========== Shell Spawning ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
    batfile [open] -- "%1" %*
    cmdfile [open] -- "%1" %*
    comfile [open] -- "%1" %*
    cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
    exefile [open] -- "%1" %*
    helpfile [open] -- Reg Error: Key error.
    hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
    piffile [open] -- "%1" %*
    regfile [merge] -- Reg Error: Key error.
    scrfile [config] -- "%1"
    scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
    scrfile [open] -- "%1" /S
    txtfile [edit] -- Reg Error: Key error.
    Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
    Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
    Directory [Digital Photo Professional] -- C:\Program Files\Canon\Digital Photo Professional\DPPViewer.exe /path "%1" (CANON INC.)
    Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
    Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
    Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
    Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

    ========== Security Center Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
    "cval" = 1
    "FirewallDisableNotify" = 0
    "AntiVirusDisableNotify" = 0
    "UpdatesDisableNotify" = 0

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiSpyware]
    "DisableMonitoring" = 1

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
    "AntiVirusOverride" = 0
    "AntiSpywareOverride" = 0
    "FirewallOverride" = 0
    "VistaSp1" = Reg Error: Unknown registry data type -- File not found
    "VistaSp2" = Reg Error: Unknown registry data type -- File not found

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

    ========== System Restore Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
    "DisableSR" = 0

    ========== Firewall Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
    "DisableNotifications" = 0
    "EnableFirewall" = 1

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
    "DisableNotifications" = 0
    "EnableFirewall" = 1

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
    "DisableNotifications" = 0
    "EnableFirewall" = 1

    ========== Authorized Applications List ==========

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]


    ========== Vista Active Open Ports Exception List ==========

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    "{0818B0F1-1AFC-4DD6-8F11-D7510A7F3C8E}" = lport=137 | protocol=17 | dir=in | app=system |
    "{08E728FE-A83D-4E7E-84B7-A4D6E0FB54E4}" = lport=9323 | protocol=6 | dir=in | name=ekdiscovery |
    "{0936FA0A-AB29-4722-B40D-3F51948C43E4}" = rport=138 | protocol=17 | dir=out | app=system |
    "{0EBB6C63-807C-4BA5-8616-7960AEDB9F8A}" = rport=139 | protocol=6 | dir=out | app=system |
    "{3696D040-DA51-4ED2-98B9-CC8602EE20CE}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
    "{44491D64-8487-47C5-A412-9306797359BF}" = lport=9323 | protocol=6 | dir=in | name=ekdiscovery |
    "{56477AD2-123D-4BF6-B8DD-2D0ACC2246B2}" = lport=139 | protocol=6 | dir=in | app=system |
    "{5FF7922D-836B-4A6C-B6EA-A26EFB9D0F00}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
    "{73628C5F-ECED-4661-988F-30049C9F4768}" = rport=445 | protocol=6 | dir=out | app=system |
    "{8261D50F-3D43-4906-9838-8FB820CD23D1}" = lport=9322 | protocol=6 | dir=in | name=ekdiscovery |
    "{A34DEFBA-0AD2-4313-ACA0-0965B9B23D58}" = lport=9324 | protocol=6 | dir=in | name=ekdiscovery |
    "{A5A37ECD-E8A9-4872-9DCE-35F337D09AF1}" = lport=445 | protocol=6 | dir=in | app=system |
    "{A7FECC6D-7C5D-4758-A804-1066FC102CE0}" = lport=138 | protocol=17 | dir=in | app=system |
    "{C28936CA-DC00-4D5C-9B8E-3DEA4B781074}" = lport=9322 | protocol=6 | dir=in | name=ekdiscovery |
    "{CDB1BB95-E07A-4F7B-B400-41D7C89FEAE5}" = rport=137 | protocol=17 | dir=out | app=system |
    "{D92DFCFF-D292-434B-B9CE-F3595A7C8D57}" = lport=9324 | protocol=6 | dir=in | name=ekdiscovery |

    ========== Vista Active Application Exception List ==========

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    "{031E3C1E-D2E2-4C36-AE2F-4952D31C85CF}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
    "{2CA2E717-758C-4F7E-A2B9-A6A709E3A14A}" = protocol=6 | dir=in | app=c:\program files\aim6\aim6.exe |
    "{41063CF1-FA54-4B60-A2B5-697DA72FEAF1}" = dir=in | app=c:\program files\leapfrog\leapfrog connect\leapfrogconnect.exe |
    "{5C03DA01-2B34-43CB-81A1-80C6E6AED036}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
    "{6B974271-2B9F-4BD3-9E97-620418BB3A84}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
    "{905B43D5-5622-4A02-A11A-AC36D8E9C92A}" = protocol=6 | dir=in | app=c:\program files\common files\aol\loader\aolload.exe |
    "{9B5DA9DB-D640-4340-92D5-A3DB0DAA6D7B}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
    "{A434F6BA-B955-4857-965A-58FEAD2047BE}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
    "{A6C0F1FA-F209-474D-97AB-EFEBCB827B38}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
    "{C02EDB3B-2E2E-4FEF-91C8-EFD1602720F5}" = protocol=17 | dir=in | app=c:\program files\common files\aol\loader\aolload.exe |
    "{D06914E1-2647-4DFB-A343-7E1C71E379CA}" = protocol=17 | dir=in | app=c:\program files\aim6\aim6.exe |
    "{DAEF6931-476F-4F11-B856-CE4F1A984E9C}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
    "{FC71E809-612D-40D0-9B69-A59BEAC0E5AB}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |

    ========== HKEY_LOCAL_MACHINE Uninstall List ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
    "{06FE1146-4FF8-45DF-B0D9-CBA8E38C708C}" = REALTEK USB Wireless LAN Driver
    "{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
    "{074AED0D-DD1C-432A-B38D-F8733604033F}" = aioscnnr
    "{10934A28-0CC6-4B98-A14F-76B3546003AF}" = ksDIP
    "{14D4ED84-6A9A-45A0-96F6-1753768C3CB5}" = ESSPCD
    "{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
    "{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    "{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
    "{26A24AE4-039D-4CA4-87B4-2F83216013FF}" = Java(TM) 6 Update 29
    "{2CCBABCB-6427-4A55-B091-49864623C43F}" = Google Toolbar for Firefox
    "{2D03B6F8-DF36-4980-B7B6-5B93D5BA3A8F}" = essvatgt
    "{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
    "{3EE33958-7381-4E7B-A4F3-6E43098E9E9C}" = Browser Address Error Redirector
    "{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go 5.0
    "{42938595-0D83-404D-9F73-F8177FDD531A}" = ESScore
    "{4537EA4B-F603-4181-89FB-2953FC695AB1}" = netbrdg
    "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
    "{5316DFC9-CE99-4458-9AB3-E8726EDE0210}" = skin0001
    "{56BA241F-580C-43D2-8403-947241AAE633}" = center
    "{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
    "{59B73DDC-593A-4D02-B9CA-1D8C9F912324}" = aioprnt
    "{5F00DF7E-418B-4CD9-8EC5-781156BCC49E}" = Microsoft Money Shared Libraries
    "{605A4E39-613C-4A12-B56F-DEFBE6757237}" = SHASTA
    "{643EAE81-920C-4931-9F0B-4B343B225CA6}" = ESSBrwr
    "{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
    "{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
    "{6D52C408-B09A-4520-9B18-475B81D393F1}" = Microsoft Works
    "{7F3BCF8A-8E02-4659-AF25-F9AB66BD6718}" = Gateway Recovery Center Installer
    "{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8169 PCI, 8168 and 8101E PCIe Ethernet Network Card Driver for Windows Vista
    "{8943CE61-53BD-475E-90E1-A580869E98A2}" = staticcr
    "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
    "{8A502E38-29C9-49FA-BCFA-D727CA062589}" = ESSTOOLS
    "{8E92D746-CD9F-4B90-9668-42B74C14F765}" = ESSini
    "{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
    "{90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
    "{90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
    "{90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
    "{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
    "{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
    "{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
    "{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
    "{90120000-001F-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
    "{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
    "{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
    "{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
    "{90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
    "{90120000-0115-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel(R) Matrix Storage Manager
    "{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
    "{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
    "{91517631-A9F3-4B7C-B482-43E0068FD55A}" = ESSgui
    "{98736A65-3C79-49EC-B7E9-A3C77774B0E6}" = Google SketchUp 6
    "{999D43F4-9709-4887-9B1A-83EBB15A8370}" = VPRINTOL
    "{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
    "{A462213D-EED4-42C2-9A60-7BDD4D4B0B17}" = SigmaTel Audio
    "{A57C6094-FC5A-4DEC-B1E0-1B2F48EEE8F4}" = Spare Backup
    "{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
    "{AC76BA86-7AD7-1033-7B44-A81200000003}" = Adobe Reader 8.1.2
    "{AE1FA02D-E6A4-4EA0-8E58-6483CAC016DD}" = ESSCDBK
    "{B162D0A6-9A1D-4B7C-91A5-88FB48113C45}" = OfotoXMI
    "{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
    "{B3D8B2F8-3C2C-45BC-933E-8B60E78F6684}" = Google SketchUp 6
    "{B3FED300-806C-11E0-A0D0-B8AC6F97B88E}" = Google Earth
    "{B4B44FE7-41FF-4DAD-8C0A-E406DDA72992}" = CCScore
    "{BB77DC4C-B818-4FD4-8D1D-5D3B617B78B4}" = LeapFrog My Pals Plugin
    "{C4124E95-5061-4776-8D5D-E3D931C778E1}" = Microsoft VC9 runtime libraries
    "{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = LabelPrint
    "{C6359569-E03E-4CDC-98E8-CDD080C6EEB5}" = LeapFrog Connect
    "{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
    "{D032F86A-0539-4737-816A-1AB40F1BF14D}" = C4USelfUpdater
    "{D32470A1-B10C-4059-BA53-CF0486F68EBC}" = Kodak EasyShare software
    "{DA5BDB2A-12F0-4343-8351-21AAEB293990}" = PreReq
    "{DB02F716-6275-42E9-B8D2-83BA2BF5100B}" = SFR
    "{DC24971E-1946-445D-8A82-CE685433FA7D}" = Realtek USB 2.0 Card Reader
    "{DE6B7599-D3EF-4436-8836-BAA0B0D7768D}" = aiofw
    "{E0F274B7-592B-4669-8FB8-8D9825A09858}" = KODAK All-in-One Printer Software
    "{E703EE04-8A31-470B-BA16-24D890589917}" = LeapFrog Leapster2 Plugin
    "{E79987F0-0E34-42CC-B8FF-6C860AEEB26A}" = tooltips
    "{EE5EEDAF-F932-462B-A2CB-EEBDF819D5F5}" = Gateway Connect
    "{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support
    "{F3CA9611-CD42-4562-ADAB-A554CF8E17F1}" = Microsoft WSE 2.0 SP3 Runtime
    "{F4A2E7CC-60CA-4AFA-B67F-AD5E58173C3F}" = SKINXSDK
    "{F9593CFB-D836-49BC-BFF1-0E669A411D9F}" = WIRELESS
    "{FCDB1C92-03C6-4C76-8625-371224256091}" = ESSPDock
    "8F14F2ECEDE68D26EA515B48DC25B39103C4FE8D" = Windows Driver Package - Leapfrog (Leapfrog-USBLAN) Net (09/10/2009 02.03.05.012)
    "Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
    "ActiveTouchMeetingClient" = WebEx
    "Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
    "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
    "Adobe Shockwave Player" = Adobe Shockwave Player 11.5
    "Agere Systems Soft Modem" = Agere Systems HDA Modem
    "AIM Toolbar" = AIM Toolbar
    "AIM_6" = AIM 6
    "Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
    "CameraWindowDVC6" = Canon Utilities CameraWindow DC_DV 6 for ZoomBrowser EX
    "CameraWindowLauncher" = Canon Utilities CameraWindow
    "CANON iMAGE GATEWAY Task" = CANON iMAGE GATEWAY Task for ZoomBrowser EX
    "Canon Internet Library for ZoomBrowser EX" = Canon Internet Library for ZoomBrowser EX
    "Coupon Printer for Windows4.0" = Coupon Printer for Windows
    "DPP" = Canon Utilities Digital Photo Professional 3.5
    "EOS Utility" = Canon Utilities EOS Utility
    "ESET Online Scanner" = ESET Online Scanner v3
    "Google Desktop" = Google Desktop
    "HDMI" = Intel(R) Graphics Media Accelerator Driver
    "HOMESTUDENTR" = Microsoft Office Home and Student 2007
    "Leapster2Plugin" = Use the entry named LeapFrog Connect to uninstall (LeapFrog Leapster2 Plugin)
    "Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware version 1.51.2.1300
    "Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
    "Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
    "Money2007b" = Microsoft Money Essentials
    "MyCamera" = Canon Utilities MyCamera
    "MyPalsPlugin" = Use the entry named LeapFrog Connect to uninstall (LeapFrog My Pals Plugin)
    "Original Data Security Tools" = Canon Utilities Original Data Security Tools
    "Photo Viewer S3.0_is1" = Photo Viewer S3.0
    "PhotoStitch" = Canon Utilities PhotoStitch
    "Picture Style Editor" = Canon Utilities Picture Style Editor
    "RemoteCaptureTask" = Canon Utilities RemoteCapture Task for ZoomBrowser EX
    "SAMSUNG Mobile Modem V2" = SAMSUNG Mobile Modem V2 Software
    "SoftwareUpdUtility" = Download Updater (AOL LLC)
    "SynTPDeinstKey" = Synaptics Pointing Device Driver
    "UPCShell" = LeapFrog Connect
    "ViewpointMediaPlayer" = Viewpoint Media Player
    "WFTK" = Canon Utilities WFT-E1/E2/E3 Utility
    "WildTangent gateway Master Uninstall" = Gateway Games
    "Windstream_BCUC" = Windstream Broadband Check-up Center
    "ZoomBrowser EX" = Canon Utilities ZoomBrowser EX
    "ZoomBrowser EX Memory Card Utility" = Canon ZoomBrowser EX Memory Card Utility

    ========== HKEY_CURRENT_USER Uninstall List ==========

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
    "GoToMeeting" = GoToMeeting 4.5.0.457
    "Move Media Player" = Move Media Player

    ========== Last 10 Event Log Errors ==========

    Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!

    < End of report >
     
  25. pwm1031

    pwm1031 TS Rookie Topic Starter Posts: 21

    Bump to top please.
     
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.