also @ TechSpot: Blizzard talks Diablo 3 facts, nerfing and buffs for legendary items

TechSpot
Register now for a live online demo to see how the Office 365 suite of tools
- professional email, calendars, video conferencing, and file sharing -

[Solved] Google malware?

Discussion in 'Virus and Malware Removal' started by BobLoblaw, Jan 12, 2011.

Thread Status:
Not open for further replies.
Page 2 of 2

  1. BobLoblaw Newcomer, in training

    REST OF OTL log

    ========== FireFox ==========

    FF - prefs.js..extensions.enabledItems: calendar-timezones@mozilla.org:0.1.2008d
    FF - prefs.js..extensions.enabledItems: default-palette@celtx.com:1.0
    FF - prefs.js..extensions.enabledItems: emoticons-msn-smileys@m513901.de:0.1
    FF - prefs.js..extensions.enabledItems: inspector@mozilla.org:2.0.0
    FF - prefs.js..extensions.enabledItems: messagestyle-blackened@addons.instantbird.org:0.9
    FF - prefs.js..extensions.enabledItems: messagestyle-depth@addons.instantbird.org:1.1
    FF - prefs.js..extensions.enabledItems: messagestyle-minimal20@addons.instantbird.org:1.5

    FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/12/27 13:27:27 | 000,000,000 | ---D | M]
    FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/01/13 09:23:55 | 000,000,000 | ---D | M]

    [2010/08/30 18:51:34 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Owner\AppData\Roaming\mozilla\Extensions
    [2010/08/30 18:51:34 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Owner\AppData\Roaming\mozilla\Extensions\celtx@celtx.com
    [2011/01/13 17:32:13 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Owner\AppData\Roaming\mozilla\Firefox\Profiles\p7sg9qb9.default\extensions
    [2010/05/25 19:24:51 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Owner\AppData\Roaming\mozilla\Firefox\Profiles\p7sg9qb9.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
    [2010/09/10 13:47:46 | 000,000,000 | ---D | M] ("StumbleUpon") -- C:\Users\Owner\AppData\Roaming\mozilla\Firefox\Profiles\p7sg9qb9.default\extensions\{AE93811A-5C9A-4d34-8462-F7B864FC4696}
    [2010/08/02 15:48:10 | 000,000,000 | ---D | M] (1-Click YouTube Video Downloader) -- C:\Users\Owner\AppData\Roaming\mozilla\Firefox\Profiles\p7sg9qb9.default\extensions\YoutubeDownloader@PeterOlayev.com
    [2011/01/12 10:45:33 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
    [2010/05/23 21:39:43 | 000,000,000 | ---D | M] (Skype extension for Firefox) -- C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
    [2010/06/03 22:55:27 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
    [2010/08/11 15:03:27 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
    [2010/10/19 18:03:00 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
    [2011/01/12 10:45:33 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
    [2010/05/23 21:39:43 | 000,000,000 | ---D | M] (Celebrity Toolbar) -- C:\Program Files\Mozilla Firefox\extensions\{FD2FD708-1F6F-4B68-B141-C5778F0C19BB}
    [2010/08/30 18:50:42 | 000,000,000 | ---D | M] (Timezone Definitions for Mozilla Calendar) -- C:\PROGRAM FILES\CELTX\EXTENSIONS\CALENDAR-TIMEZONES@MOZILLA.ORG
    [2010/08/30 18:50:42 | 000,000,000 | ---D | M] (Default Shot Palette) -- C:\PROGRAM FILES\CELTX\EXTENSIONS\DEFAULT-PALETTE@CELTX.COM
    [2010/08/30 18:50:42 | 000,000,000 | ---D | M] (MSN-Smileys) -- C:\PROGRAM FILES\CELTX\EXTENSIONS\EMOTICONS-MSN-SMILEYS@M513901.DE
    [2010/08/30 18:50:42 | 000,000,000 | ---D | M] (DOM Inspector) -- C:\PROGRAM FILES\CELTX\EXTENSIONS\INSPECTOR@MOZILLA.ORG
    [2010/08/30 18:50:42 | 000,000,000 | ---D | M] (Blackened) -- C:\PROGRAM FILES\CELTX\EXTENSIONS\MESSAGESTYLE-BLACKENED@ADDONS.INSTANTBIRD.ORG
    [2010/08/30 18:50:42 | 000,000,000 | ---D | M] (Depth) -- C:\PROGRAM FILES\CELTX\EXTENSIONS\MESSAGESTYLE-DEPTH@ADDONS.INSTANTBIRD.ORG
    [2010/08/30 18:50:41 | 000,000,000 | ---D | M] (Minimal) -- C:\PROGRAM FILES\CELTX\EXTENSIONS\MESSAGESTYLE-MINIMAL20@ADDONS.INSTANTBIRD.ORG
    [2010/11/12 18:53:06 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
    [2007/03/09 17:16:44 | 000,189,496 | ---- | M] (Yahoo! Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npyaxmpb.dll
    [2010/02/01 13:12:22 | 000,003,803 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\MyHeritage.xml

    O1 HOSTS File: ([2011/01/14 13:26:43 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
    O1 - Hosts: 127.0.0.1 localhost
    O2 - BHO: (MHTBPos00 Class) - {0C37B053-FD68-456a-82E1-D788EE342E6F} - C:\Program Files\Celebrity Toolbar\tbcore3.dll ()
    O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
    O2 - BHO: (Partner BHO Class) - {83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4} - C:\ProgramData\Partner\partner.dll (Google Inc.)
    O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
    O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5612.1312\swg.dll (Google Inc.)
    O2 - BHO: (Google Dictionary Compression sdch) - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll (Google Inc.)
    O2 - BHO: (Bing Bar BHO) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll (Microsoft Corporation)
    O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
    O3 - HKLM\..\Toolbar: (@C:\Program Files\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll,-100) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\MSN Toolbar\Platform\6.3.2322.0\npwinext.dll (Microsoft Corporation)
    O3 - HKLM\..\Toolbar: (Celebrity Toolbar) - {FD2FD708-1F6F-4B68-B141-C5778F0C19BB} - C:\Program Files\Celebrity Toolbar\tbcore3.dll ()
    O3 - HKU\S-1-5-21-2824094850-119664256-1579380712-1000\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
    O3 - HKU\S-1-5-21-2824094850-119664256-1579380712-1000\..\Toolbar\WebBrowser: (Celebrity Toolbar) - {FD2FD708-1F6F-4B68-B141-C5778F0C19BB} - C:\Program Files\Celebrity Toolbar\tbcore3.dll ()
    O4 - HKLM..\Run: [BrStsWnd] C:\Program Files\Brownie\BrstsWnd.exe (brother)
    O4 - HKLM..\Run: [cfFncEnabler.exe] C:\Program Files\TOSHIBA\ConfigFree\cfFncEnabler.exe (Toshiba Corporation)
    O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
    O4 - HKLM..\Run: [Microsoft Forefront Client Security Antimalware Service] c:\Program Files\Microsoft Forefront\Client Security\Client\Antimalware\MSASCui.exe (Microsoft Corporation)
    O4 - HKLM..\Run: [Reader Library Launcher] C:\Program Files\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe (Sony Corporation)
    O4 - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe (Realtek Semiconductor)
    O4 - HKLM..\Run: [Skytel] C:\Program Files\Realtek\Audio\HDA\SkyTel.exe (Realtek Semiconductor Corp.)
    O4 - HKLM..\Run: [ToshibaServiceStation] C:\Program Files\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe (TOSHIBA Corporation)
    O4 - HKLM..\Run: [TosSENotify] C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe (TOSHIBA Corporation)
    O4 - HKLM..\Run: [TWebCamera] C:\Program Files\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe (TOSHIBA)
    O4 - HKU\S-1-5-21-2824094850-119664256-1579380712-1000..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
    O4 - Startup: C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Owner\AppData\Roaming\Dropbox\bin\Dropbox.exe ()
    O4 - Startup: C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Yahoo! Widgets.lnk = C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe (Yahoo! Inc.)
    O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
    O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-21-2824094850-119664256-1579380712-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-21-2824094850-119664256-1579380712-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktopCleanupWizard = 1
    O7 - HKU\S-1-5-21-2824094850-119664256-1579380712-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\Common\Yinsthelper.dll (Installation Support)
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
    O16 - DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
    O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
    O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
    O18 - Protocol\Handler\symres {AA1061FE-6C41-421f-9344-69640C9732AB} - File not found
    O18 - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll (Microsoft Corporation)
    O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
    O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
    O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
    O24 - Desktop WallPaper: C:\Users\Owner\Pictures\01590_mupebaydreams_1440x900.jpg
    O24 - Desktop BackupWallPaper: C:\Users\Owner\Pictures\01590_mupebaydreams_1440x900.jpg
    O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
    O30 - LSA: Security Packages - (pku2u) - C:\Windows\System32\pku2u.dll (Microsoft Corporation)
    O30 - LSA: Security Packages - (livessp) - C:\Windows\System32\livessp.dll (Microsoft Corp.)
    O32 - HKLM CDRom: AutoRun - 1
    O32 - AutoRun File - [2009/06/10 15:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
    O34 - HKLM BootExecute: (autocheck autochk *) - File not found
    O34 - HKLM BootExecute: (lsdelete) - C:\Windows\System32\lsdelete.exe ()
    O35 - HKLM\..comfile [open] -- "%1" %*
    O35 - HKLM\..exefile [open] -- "%1" %*
    O37 - HKLM\...com [@ = ComFile] -- "%1" %*
    O37 - HKLM\...exe [@ = exefile] -- "%1" %*

    NetSvcs: FastUserSwitchingCompatibility - File not found
    NetSvcs: Ias - File not found
    NetSvcs: Nla - File not found
    NetSvcs: Ntmssvc - File not found
    NetSvcs: NWCWorkstation - File not found
    NetSvcs: Nwsapagent - File not found
    NetSvcs: SRService - File not found
    NetSvcs: WmdmPmSp - File not found
    NetSvcs: LogonHours - File not found
    NetSvcs: PCAudit - File not found
    NetSvcs: helpsvc - File not found
    NetSvcs: uploadmgr - File not found
    NetSvcs: Themes - C:\Windows\System32\themeservice.dll (Microsoft Corporation)
    NetSvcs: BDESVC - C:\Windows\System32\bdesvc.dll (Microsoft Corporation)

    Drivers32: msacm.dvacm - C:\Program Files\Common Files\Ulead Systems\vio\DVACM.acm (Ulead Systems, Inc.)
    Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
    Drivers32: msacm.mpegacm - C:\Program Files\Common Files\Ulead Systems\MPEG\MPEGACM.acm (Ulead Systems, Inc.)
    Drivers32: msacm.ulmp3acm - C:\Program Files\Common Files\Ulead Systems\MPEG\ulmp3acm.acm (Ulead systems)
    Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
    Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
    Drivers32: vidc.iv50 - C:\Windows\System32\ir50_32.dll (Intel Corporation)
    Drivers32: vidc.tscc - C:\Windows\System32\tsccvid.dll (TechSmith Corporation)


    ========== Files/Folders - Created Within 30 Days ==========

    [2011/01/14 14:04:35 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Owner\Desktop\OTL.exe
    [2011/01/14 13:31:12 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
    [2011/01/14 13:31:10 | 000,000,000 | ---D | C] -- C:\Windows\temp
    [2011/01/14 13:31:10 | 000,000,000 | ---D | C] -- C:\Users\Owner\AppData\Local\temp
    [2011/01/14 13:17:05 | 000,161,792 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
    [2011/01/14 13:17:05 | 000,031,232 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
    [2011/01/14 13:17:04 | 000,136,704 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
    [2011/01/14 13:16:56 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
    [2011/01/14 13:16:17 | 000,000,000 | ---D | C] -- C:\Qoobox
    [2011/01/14 13:15:58 | 000,212,480 | ---- | C] (SteelWerX) -- C:\Windows\SWXCACLS.exe
    [2011/01/14 11:48:38 | 000,000,000 | ---D | C] -- C:\Users\Owner\AppData\Roaming\Malwarebytes
    [2011/01/14 11:48:27 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
    [2011/01/14 11:48:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
    [2011/01/14 11:48:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
    [2011/01/14 11:48:22 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
    [2011/01/14 11:48:21 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
    [2011/01/14 11:47:20 | 007,734,208 | ---- | C] (Malwarebytes Corporation ) -- C:\Users\Owner\Desktop\mbam-setup-1.50.1.1100.exe
    [2011/01/14 11:38:38 | 000,446,464 | ---- | C] (OldTimer Tools) -- C:\Users\Owner\Desktop\TFC.exe
    [2011/01/13 11:49:15 | 000,000,000 | ---D | C] -- C:\Users\Owner\Desktop\New folder (3)
    [2011/01/13 09:22:53 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe
    [2011/01/13 09:22:26 | 000,000,000 | ---D | C] -- C:\Config.Msi
    [2011/01/11 17:52:45 | 000,000,000 | ---D | C] -- C:\Users\Owner\Documents\Remixes
    [2011/01/11 15:44:42 | 000,000,000 | R--D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton Security Scan
    [2011/01/11 15:44:42 | 000,000,000 | ---D | C] -- C:\Windows\System32\drivers\NSS
    [2011/01/11 15:44:42 | 000,000,000 | ---D | C] -- C:\Program Files\Norton Security Scan
    [2011/01/11 15:44:42 | 000,000,000 | ---D | C] -- C:\Windows\System32\drivers\NSS\0300010.008
    [2011/01/10 00:24:25 | 000,000,000 | ---D | C] -- C:\Users\Owner\Desktop\Hun
    [2011/01/10 00:19:46 | 000,000,000 | ---D | C] -- C:\Users\Owner\Documents\Ravi Shankar - The Sounds Of India
    [2011/01/09 02:15:24 | 000,000,000 | ---D | C] -- C:\Users\Owner\Documents\Four Tet - There Is Love in You (2010) (Retail) (mrsjs)
    [2011/01/09 01:47:23 | 000,000,000 | ---D | C] -- C:\Users\Owner\Documents\James Blake
    [2011/01/08 13:20:17 | 000,000,000 | ---D | C] -- C:\Users\Owner\Documents\Pitchfork Top 100 Tracks of 2010
    [2011/01/08 02:08:46 | 000,000,000 | ---D | C] -- C:\Users\Owner\Documents\Ben Kenney - 2 albums
    [2011/01/08 01:19:24 | 000,000,000 | ---D | C] -- C:\Users\Owner\Documents\Glasser - Ring [mp3-vbr-2010]
    [2011/01/07 23:48:51 | 000,000,000 | ---D | C] -- C:\Users\Owner\Documents\Rachel.Starr.Is.Bad.***.XXX.DVDRip.XviD-NYMPHO
    [2011/01/06 14:20:52 | 000,000,000 | ---D | C] -- C:\Users\Owner\Desktop\**** that was on external
    [2011/01/05 15:12:08 | 000,000,000 | ---D | C] -- C:\Users\Owner\Documents\Kid_Cudi-Man_On_The_Moon_II_The_Legend_Of_Mr._Rager-2010-SiRE
    [2011/01/03 23:25:05 | 000,000,000 | ---D | C] -- C:\Users\Owner\Documents\Giant Steps
    [2011/01/03 21:35:01 | 000,000,000 | ---D | C] -- C:\Users\Owner\Documents\Walter Meego - Voyager
    [2011/01/03 20:53:05 | 000,000,000 | ---D | C] -- C:\Users\Owner\Documents\RJD2 - Dead Ringer (2002)
    [2011/01/03 20:51:03 | 000,000,000 | ---D | C] -- C:\Users\Owner\Documents\Just Jack - Overtones [320kbps]
    [2011/01/03 15:39:56 | 000,000,000 | ---D | C] -- C:\Users\Owner\Documents\Wiz Khalifa - Deal Or No Deal (2009)
    [2011/01/03 15:33:48 | 000,000,000 | ---D | C] -- C:\Users\Owner\Documents\Miike Snow [Deluxe Edition]
    [2011/01/03 15:33:44 | 000,000,000 | ---D | C] -- C:\Users\Owner\Documents\The xx
    [2010/12/29 16:46:31 | 000,000,000 | ---D | C] -- C:\Users\Owner\Documents\The Best Of The Moody Blues
    [2010/12/29 16:45:20 | 000,000,000 | ---D | C] -- C:\Users\Owner\Documents\Phoenix
    [2010/12/29 16:42:52 | 000,000,000 | ---D | C] -- C:\Users\Owner\Documents\MGMT - 2010 - Congratulations (mp3)
    [2010/12/28 17:24:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
    [2010/12/28 17:23:59 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
    [2010/12/27 13:27:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
    [2010/12/27 13:21:42 | 038,147,376 | ---- | C] (Apple Inc.) -- C:\Users\Owner\QuickTimeInstaller.exe
    [2010/12/27 13:19:16 | 002,790,864 | ---- | C] (Adobe Systems, Inc.) -- C:\Users\Owner\install_flash_player.exe
    [2010/12/24 17:27:58 | 000,064,288 | ---- | C] (Lavasoft AB) -- C:\Windows\System32\drivers\Lbd.sys
    [2010/12/24 17:27:55 | 000,098,392 | ---- | C] (Sunbelt Software) -- C:\Windows\System32\drivers\SBREDrv.sys
    [2010/12/24 17:24:02 | 000,000,000 | ---D | C] -- C:\Users\Owner\AppData\Local\Sunbelt Software
    [2010/12/24 17:23:28 | 000,000,000 | -H-D | C] -- C:\ProgramData\{2162CCC0-3A5F-4887-B51F-CE5F195B3620}
    [2010/12/24 17:23:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft
    [2010/12/24 17:23:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Lavasoft
    [2010/12/24 17:23:14 | 000,000,000 | ---D | C] -- C:\Program Files\Lavasoft
    [2010/12/24 14:42:23 | 130,359,064 | ---- | C] (Lavasoft ) -- C:\Users\Owner\Ad-Aware90Install.exe
    [2010/12/22 00:05:46 | 000,000,000 | ---D | C] -- C:\Users\Owner\Desktop\Phone pics
    [2010/12/21 23:52:28 | 000,000,000 | ---D | C] -- C:\Users\Owner\Documents\film books
    [2010/12/17 11:04:30 | 000,000,000 | ---D | C] -- C:\Users\Owner\Documents\La Roux - La Roux (2009) KompletlyWyred DHZ Inc Release
    [2010/12/16 23:37:49 | 000,000,000 | ---D | C] -- C:\Users\Owner\Documents\Zero 7 (2 albums)
    [2010/12/16 23:32:24 | 000,000,000 | ---D | C] -- C:\Users\Owner\Documents\BitterSweet-The_Mating_Game
    [2010/12/16 23:29:30 | 000,000,000 | ---D | C] -- C:\Users\Owner\Documents\Conjure One
    [2010/12/16 23:23:29 | 000,000,000 | ---D | C] -- C:\Users\Owner\Documents\Machine Says Yes [UK]
    [2009/11/10 19:45:37 | 000,233,472 | ---- | C] (Propellerhead Software AB) -- C:\Users\Owner\AppData\Roaming\REX Shared Library.dll
    [2009/11/10 19:45:37 | 000,225,280 | ---- | C] (Propellerhead Software AB) -- C:\Users\Owner\AppData\Roaming\Rewire.dll
    [1 C:\Users\Owner\Desktop\*.tmp files -> C:\Users\Owner\Desktop\*.tmp -> ]

    ========== Files - Modified Within 30 Days ==========

    [2011/01/14 14:04:37 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Owner\Desktop\OTL.exe
    [2011/01/14 14:03:59 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
    [2011/01/14 13:56:57 | 000,000,908 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2824094850-119664256-1579380712-1000UA.job
    [2011/01/14 13:26:43 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
    [2011/01/14 13:10:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
    [2011/01/14 13:10:00 | 000,000,880 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
    [2011/01/14 13:01:19 | 004,154,944 | R--- | M] () -- C:\Users\Owner\Desktop\ComboFix.exe
    [2011/01/14 12:59:58 | 000,009,712 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
    [2011/01/14 12:59:58 | 000,009,712 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
    [2011/01/14 12:54:14 | 000,000,370 | ---- | M] () -- C:\Windows\tasks\Ad-Aware Update (Weekly).job
    [2011/01/14 12:52:34 | 000,000,132 | ---- | M] () -- C:\Windows\Brownie.ini
    [2011/01/14 12:52:05 | 2312,097,792 | -HS- | M] () -- C:\hiberfil.sys
    [2011/01/14 12:47:43 | 000,080,384 | ---- | M] () -- C:\Users\Owner\Desktop\MBRCheck.exe
    [2011/01/14 12:20:49 | 000,624,128 | ---- | M] () -- C:\Users\Owner\Desktop\dds.scr
    [2011/01/14 11:57:51 | 000,296,448 | ---- | M] () -- C:\Users\Owner\Desktop\kpfefkxy.exe
    [2011/01/14 11:48:28 | 000,001,078 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
    [2011/01/14 11:47:28 | 007,734,208 | ---- | M] (Malwarebytes Corporation ) -- C:\Users\Owner\Desktop\mbam-setup-1.50.1.1100.exe
    [2011/01/14 11:39:17 | 000,000,856 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2824094850-119664256-1579380712-1000Core.job
    [2011/01/14 11:38:44 | 000,446,464 | ---- | M] (OldTimer Tools) -- C:\Users\Owner\Desktop\TFC.exe
    [2011/01/13 21:14:44 | 000,000,470 | -H-- | M] () -- C:\Windows\tasks\Norton Security Scan for Owner.job
    [2011/01/13 20:36:47 | 000,008,853 | ---- | M] () -- C:\Users\Owner\Documents\The Corduroy Blazer.celtx
    [2011/01/13 11:28:19 | 000,615,360 | ---- | M] () -- C:\Windows\System32\perfh009.dat
    [2011/01/13 11:28:19 | 000,103,702 | ---- | M] () -- C:\Windows\System32\perfc009.dat
    [2011/01/13 09:23:56 | 000,001,995 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader 9.lnk
    [2011/01/12 20:57:37 | 000,002,370 | ---- | M] () -- C:\Users\Owner\Desktop\Google Chrome.lnk
    [2011/01/12 17:31:00 | 000,007,585 | ---- | M] () -- C:\Users\Owner\Documents\The Blazer.celtx
    [2011/01/12 12:02:00 | 000,058,681 | ---- | M] () -- C:\Users\Owner\Desktop\HR Forms - Interns.pdf
    [2011/01/11 15:44:48 | 000,001,308 | ---- | M] () -- C:\Users\Public\Desktop\Norton Security Scan.lnk
    [2011/01/11 12:28:42 | 000,101,973 | ---- | M] () -- C:\Users\Owner\Documents\babyboycardbetter.docx
    [2011/01/11 12:28:17 | 000,103,722 | ---- | M] () -- C:\Users\Owner\Documents\babyboycard.docx
    [2011/01/11 12:25:41 | 000,082,174 | ---- | M] () -- C:\Users\Owner\Documents\niggggaboy.png
    [2011/01/11 12:24:42 | 000,029,660 | ---- | M] () -- C:\Users\Owner\Documents\niggar.jpg
    [2011/01/11 12:01:15 | 000,101,902 | ---- | M] () -- C:\Users\Owner\Documents\niggaboy.png
    [2011/01/10 16:51:46 | 000,031,744 | ---- | M] () -- C:\Users\Owner\Documents\Essay A Final Draft final.doc
    [2011/01/10 16:49:04 | 000,034,816 | ---- | M] () -- C:\Users\Owner\Documents\Option Essay Final Draft shorter final.doc
    [2011/01/10 16:13:38 | 000,034,816 | ---- | M] () -- C:\Users\Owner\Documents\Option Essay Final Draft shorter.doc
    [2011/01/08 15:33:44 | 000,031,744 | ---- | M] () -- C:\Users\Owner\Documents\Essay A Final Draft.doc
    [2011/01/08 15:33:01 | 000,031,744 | ---- | M] () -- C:\Users\Owner\Documents\Hun Essay A.doc
    [2011/01/08 15:29:39 | 000,034,816 | ---- | M] () -- C:\Users\Owner\Documents\Option Essay Final Draft.doc
    [2011/01/08 15:28:40 | 000,034,816 | ---- | M] () -- C:\Users\Owner\Documents\Hun optional outline new.doc
    [2011/01/03 14:39:54 | 000,000,162 | -H-- | M] () -- C:\Users\Owner\Documents\~$n Optional Essay.docx
    [2011/01/03 08:22:16 | 000,000,172 | ---- | M] () -- C:\Windows\System32\drivers\NSS\0300010.008\isolate.ini
    [2011/01/01 14:52:34 | 000,011,629 | ---- | M] () -- C:\Users\Owner\Documents\Hun Issue Essay.docx
    [2011/01/01 14:51:03 | 000,012,738 | ---- | M] () -- C:\Users\Owner\Documents\Hun Optional Essay.docx
    [2010/12/30 23:22:37 | 000,033,280 | ---- | M] () -- C:\Users\Owner\issue topic essay.doc
    [2010/12/28 17:32:54 | 000,017,883 | ---- | M] () -- C:\Users\Owner\Documents\iPod Software License.rtf
    [2010/12/28 17:24:47 | 000,001,764 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
    [2010/12/24 17:27:54 | 000,098,392 | ---- | M] (Sunbelt Software) -- C:\Windows\System32\drivers\SBREDrv.sys
    [2010/12/24 17:23:27 | 000,001,135 | ---- | M] () -- C:\Users\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Ad-Aware.lnk
    [2010/12/24 17:23:27 | 000,001,111 | ---- | M] () -- C:\Users\Public\Desktop\Ad-Aware.lnk
    [2010/12/24 14:50:03 | 130,359,064 | ---- | M] (Lavasoft ) -- C:\Users\Owner\Ad-Aware90Install.exe
    [2010/12/22 00:45:36 | 000,015,813 | ---- | M] () -- C:\Users\Owner\Documents\wikipedia.docx
    [2010/12/20 18:09:00 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
    [2010/12/20 18:08:40 | 000,020,952 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
    [2010/12/16 13:35:32 | 000,027,648 | ---- | M] () -- C:\Users\Owner\Documents\TMR - directions.doc
    [2010/12/16 13:23:32 | 000,015,929 | ---- | M] () -- C:\Users\Owner\Documents\So This is Life.celtx
    [2010/12/16 13:22:17 | 000,059,392 | ---- | M] () -- C:\Users\Owner\Documents\So This Is Life - Stumble You Might Fall.doc
    [2010/12/16 11:36:02 | 000,454,704 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
    [1 C:\Users\Owner\Desktop\*.tmp files -> C:\Users\Owner\Desktop\*.tmp -> ]

    ========== Files Created - No Company Name ==========

    [2011/01/14 13:17:05 | 000,256,512 | ---- | C] () -- C:\Windows\PEV.exe
    [2011/01/14 13:17:05 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
    [2011/01/14 13:17:05 | 000,089,088 | ---- | C] () -- C:\Windows\MBR.exe
    [2011/01/14 13:17:05 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
    [2011/01/14 13:17:05 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
    [2011/01/14 13:01:02 | 004,154,944 | R--- | C] () -- C:\Users\Owner\Desktop\ComboFix.exe
    [2011/01/14 12:54:14 | 000,000,370 | ---- | C] () -- C:\Windows\tasks\Ad-Aware Update (Weekly).job
    [2011/01/14 12:47:41 | 000,080,384 | ---- | C] () -- C:\Users\Owner\Desktop\MBRCheck.exe
    [2011/01/14 12:20:44 | 000,624,128 | ---- | C] () -- C:\Users\Owner\Desktop\dds.scr
    [2011/01/14 11:57:50 | 000,296,448 | ---- | C] () -- C:\Users\Owner\Desktop\kpfefkxy.exe
    [2011/01/14 11:48:28 | 000,001,078 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
    [2011/01/13 20:36:47 | 000,008,853 | ---- | C] () -- C:\Users\Owner\Documents\The Corduroy Blazer.celtx
    [2011/01/13 09:23:06 | 000,001,995 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader 9.lnk
    [2011/01/12 17:31:00 | 000,007,585 | ---- | C] () -- C:\Users\Owner\Documents\The Blazer.celtx
    [2011/01/12 12:01:58 | 000,058,681 | ---- | C] () -- C:\Users\Owner\Desktop\HR Forms - Interns.pdf
    [2011/01/11 15:44:42 | 000,000,172 | ---- | C] () -- C:\Windows\System32\drivers\NSS\0300010.008\isolate.ini
    [2011/01/11 12:28:41 | 000,101,973 | ---- | C] () -- C:\Users\Owner\Documents\babyboycardbetter.docx
    [2011/01/11 12:25:41 | 000,082,174 | ---- | C] () -- C:\Users\Owner\Documents\niggggaboy.png
    [2011/01/11 12:24:41 | 000,029,660 | ---- | C] () -- C:\Users\Owner\Documents\niggar.jpg
    [2011/01/11 12:19:15 | 000,103,722 | ---- | C] () -- C:\Users\Owner\Documents\babyboycard.docx
    [2011/01/11 12:01:15 | 000,101,902 | ---- | C] () -- C:\Users\Owner\Documents\niggaboy.png
    [2011/01/10 16:51:45 | 000,031,744 | ---- | C] () -- C:\Users\Owner\Documents\Essay A Final Draft final.doc
    [2011/01/10 16:49:03 | 000,034,816 | ---- | C] () -- C:\Users\Owner\Documents\Option Essay Final Draft shorter final.doc
    [2011/01/10 16:13:37 | 000,034,816 | ---- | C] () -- C:\Users\Owner\Documents\Option Essay Final Draft shorter.doc
    [2011/01/08 15:33:43 | 000,031,744 | ---- | C] () -- C:\Users\Owner\Documents\Essay A Final Draft.doc
    [2011/01/08 15:29:39 | 000,034,816 | ---- | C] () -- C:\Users\Owner\Documents\Option Essay Final Draft.doc
    [2011/01/03 16:39:27 | 000,034,816 | ---- | C] () -- C:\Users\Owner\Documents\Hun optional outline new.doc
    [2011/01/03 14:39:54 | 000,000,162 | -H-- | C] () -- C:\Users\Owner\Documents\~$n Optional Essay.docx
    [2010/12/31 16:18:21 | 000,011,629 | ---- | C] () -- C:\Users\Owner\Documents\Hun Issue Essay.docx
    [2010/12/30 23:22:36 | 000,033,280 | ---- | C] () -- C:\Users\Owner\issue topic essay.doc
    [2010/12/29 17:42:45 | 000,012,738 | ---- | C] () -- C:\Users\Owner\Documents\Hun Optional Essay.docx
    [2010/12/28 17:32:54 | 000,017,883 | ---- | C] () -- C:\Users\Owner\Documents\iPod Software License.rtf
    [2010/12/28 17:24:47 | 000,001,764 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk
    [2010/12/25 01:01:35 | 000,015,880 | ---- | C] () -- C:\Windows\System32\lsdelete.exe
    [2010/12/24 17:23:27 | 000,001,135 | ---- | C] () -- C:\Users\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Ad-Aware.lnk
    [2010/12/24 17:23:27 | 000,001,111 | ---- | C] () -- C:\Users\Public\Desktop\Ad-Aware.lnk
    [2010/12/22 00:45:36 | 000,015,813 | ---- | C] () -- C:\Users\Owner\Documents\wikipedia.docx
    [2010/12/21 22:08:51 | 000,031,744 | ---- | C] () -- C:\Users\Owner\Documents\Hun Essay A.doc
    [2010/12/16 13:35:31 | 000,027,648 | ---- | C] () -- C:\Users\Owner\Documents\TMR - directions.doc
    [2010/12/16 13:23:32 | 000,015,929 | ---- | C] () -- C:\Users\Owner\Documents\So This is Life.celtx
    [2010/05/23 22:16:38 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
    [2010/04/16 22:03:11 | 000,000,094 | ---- | C] () -- C:\Windows\family.ini
    [2009/09/25 18:15:04 | 000,000,145 | ---- | C] () -- C:\Windows\BRVIDEO.INI
    [2009/09/25 18:15:04 | 000,000,000 | ---- | C] () -- C:\Windows\brmx2001.ini
    [2009/09/25 18:14:12 | 000,009,853 | ---- | C] () -- C:\Windows\HL-2140.INI
    [2009/09/25 18:14:12 | 000,000,114 | ---- | C] () -- C:\Windows\System32\brlmw03a.ini
    [2009/09/25 18:13:07 | 000,000,132 | ---- | C] () -- C:\Windows\Brownie.ini
    [2009/09/15 17:15:20 | 000,000,426 | ---- | C] () -- C:\Windows\BRWMARK.INI
    [2009/09/07 20:00:00 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
    [2009/09/06 18:53:21 | 000,000,013 | RHS- | C] () -- C:\Windows\System32\drivers\fbd.sys
    [2009/09/06 18:52:55 | 000,000,004 | RHS- | C] () -- C:\Windows\System32\drivers\taishop.sys
    [2009/08/03 14:07:42 | 000,403,816 | ---- | C] () -- C:\Windows\System32\OGACheckControl.dll
    [2009/07/13 17:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll
    [2009/07/13 17:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll
    [2009/07/02 15:24:14 | 000,000,000 | ---- | C] () -- C:\Windows\NDSTray.INI
    [2009/05/03 21:25:09 | 000,209,040 | ---- | C] () -- C:\Windows\System32\IVIresizeW7.dll
    [2009/05/03 21:25:09 | 000,204,944 | ---- | C] () -- C:\Windows\System32\IVIresizeA6.dll
    [2009/05/03 21:25:09 | 000,196,752 | ---- | C] () -- C:\Windows\System32\IVIresizeP6.dll
    [2009/05/03 21:25:09 | 000,196,752 | ---- | C] () -- C:\Windows\System32\IVIresizeM6.dll
    [2009/05/03 21:25:09 | 000,192,656 | ---- | C] () -- C:\Windows\System32\IVIresizePX.dll
    [2009/05/03 21:25:09 | 000,024,720 | ---- | C] () -- C:\Windows\System32\IVIresize.dll
    [2009/03/05 05:54:58 | 000,073,728 | ---- | C] () -- C:\Windows\System32\RtNicProp32.dll

    ========== LOP Check ==========

    [2010/10/02 15:31:24 | 000,000,000 | ---D | M] -- C:\Users\Owner\AppData\Roaming\Acapela Group
    [2011/01/12 22:18:51 | 000,000,000 | ---D | M] -- C:\Users\Owner\AppData\Roaming\BitTorrent
    [2010/05/23 21:54:09 | 000,000,000 | ---D | M] -- C:\Users\Owner\AppData\Roaming\Canon
    [2010/05/23 21:54:09 | 000,000,000 | ---D | M] -- C:\Users\Owner\AppData\Roaming\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
    [2011/01/14 12:53:04 | 000,000,000 | ---D | M] -- C:\Users\Owner\AppData\Roaming\Dropbox
    [2010/09/24 20:23:24 | 000,000,000 | ---D | M] -- C:\Users\Owner\AppData\Roaming\DVDVideoSoft
    [2010/06/13 12:39:19 | 000,000,000 | ---D | M] -- C:\Users\Owner\AppData\Roaming\Facebook
    [2010/05/23 21:54:10 | 000,000,000 | ---D | M] -- C:\Users\Owner\AppData\Roaming\Fit3DLive
    [2010/08/30 18:51:34 | 000,000,000 | ---D | M] -- C:\Users\Owner\AppData\Roaming\Greyfirst
    [2010/05/23 21:54:10 | 000,000,000 | ---D | M] -- C:\Users\Owner\AppData\Roaming\HotSync
    [2010/05/23 21:54:46 | 000,000,000 | ---D | M] -- C:\Users\Owner\AppData\Roaming\Propellerhead Software
    [2010/05/23 21:54:48 | 000,000,000 | ---D | M] -- C:\Users\Owner\AppData\Roaming\toshiba
    [2010/05/23 21:54:48 | 000,000,000 | ---D | M] -- C:\Users\Owner\AppData\Roaming\WinBatch
    [2010/10/02 15:31:36 | 000,000,000 | ---D | M] -- C:\Users\Owner\AppData\Roaming\Xtranormal
    [2011/01/14 12:54:14 | 000,000,370 | ---- | M] () -- C:\Windows\Tasks\Ad-Aware Update (Weekly).job
    [2009/07/13 22:53:46 | 000,029,672 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

    ========== Purity Check ==========



    ========== Custom Scans ==========


    < %SYSTEMDRIVE%\*.* >
    [2011/01/14 12:52:04 | 000,002,848 | ---- | M] () -- C:\aaw7boot.log
    [2009/06/10 15:42:20 | 000,000,024 | ---- | M] () -- C:\autoexec.bat
    [2009/07/13 19:38:58 | 000,383,562 | RHS- | M] () -- C:\bootmgr
    [2010/05/24 00:29:35 | 000,008,192 | RHS- | M] () -- C:\BOOTSECT.BAK
    [2011/01/14 13:31:08 | 000,018,145 | ---- | M] () -- C:\ComboFix.txt
    [2009/06/10 15:42:20 | 000,000,010 | ---- | M] () -- C:\config.sys
    [2009/09/06 19:01:02 | 000,001,491 | ---- | M] () -- C:\detestfrag.txt
    [2011/01/14 12:52:05 | 2312,097,792 | -HS- | M] () -- C:\hiberfil.sys
    [2009/06/19 03:11:49 | 000,000,520 | -H-- | M] () -- C:\log.txt
    [2011/01/14 12:52:06 | 3082,801,152 | -HS- | M] () -- C:\pagefile.sys

    < %systemroot%\Fonts\*.com >
    [2009/07/13 22:52:25 | 000,026,040 | ---- | M] () -- C:\Windows\Fonts\GlobalMonospace.CompositeFont
    [2009/07/13 22:52:25 | 000,026,489 | ---- | M] () -- C:\Windows\Fonts\GlobalSansSerif.CompositeFont
    [2009/07/13 22:52:25 | 000,029,779 | ---- | M] () -- C:\Windows\Fonts\GlobalSerif.CompositeFont
    [2009/07/13 22:52:25 | 000,043,318 | ---- | M] () -- C:\Windows\Fonts\GlobalUserInterface.CompositeFont

    < %systemroot%\Fonts\*.dll >

    < %systemroot%\Fonts\*.ini >
    [2009/06/10 15:31:19 | 000,000,065 | ---- | M] () -- C:\Windows\Fonts\desktop.ini

    < %systemroot%\Fonts\*.ini2 >

    < %systemroot%\Fonts\*.exe >

    < %systemroot%\system32\spool\prtprocs\w32x86\*.* >
    [2009/07/13 19:15:35 | 000,022,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\jnwppr.dll
    [2006/10/26 20:56:12 | 000,033,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\msonpppr.dll
    [2009/07/13 19:16:19 | 000,029,696 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\winprint.dll

    < %systemroot%\REPAIR\*.bak1 >

    < %systemroot%\REPAIR\*.ini >

    < %systemroot%\system32\*.jpg >

    < %systemroot%\*.jpg >

    < %systemroot%\*.png >

    < %systemroot%\*.scr >
    [2010/09/23 00:32:56 | 000,301,936 | ---- | M] (Microsoft Corporation) -- C:\Windows\WLXPGSS.SCR

    < %systemroot%\*._sy >

    < %APPDATA%\Adobe\Update\*.* >

    < %ALLUSERSPROFILE%\Favorites\*.* >

    < %APPDATA%\Microsoft\*.* >

    < %PROGRAMFILES%\*.* >
    [2009/07/13 22:41:57 | 000,000,174 | -HS- | M] () -- C:\Program Files\desktop.ini

    < %APPDATA%\Update\*.* >

    < %systemroot%\*. /mp /s >

    < %systemroot%\System32\config\*.sav >

    < %PROGRAMFILES%\bak. /s >

    < %systemroot%\system32\bak. /s >

    < %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

    < %systemroot%\system32\config\systemprofile\*.dat /x >

    < %systemroot%\*.config >

    < %systemroot%\system32\*.db >

    < %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
    [2009/09/28 00:30:26 | 000,000,286 | -HS- | M] () -- C:\Users\Owner\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop (1).ini
    [2010/05/23 22:15:20 | 000,000,221 | -HS- | M] () -- C:\Users\Owner\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

    < %USERPROFILE%\Desktop\*.exe >
    [2011/01/14 13:01:19 | 004,154,944 | R--- | M] () -- C:\Users\Owner\Desktop\ComboFix.exe
    [2011/01/14 11:57:51 | 000,296,448 | ---- | M] () -- C:\Users\Owner\Desktop\kpfefkxy.exe
    [2011/01/14 11:47:28 | 007,734,208 | ---- | M] (Malwarebytes Corporation ) -- C:\Users\Owner\Desktop\mbam-setup-1.50.1.1100.exe
    [2011/01/14 12:47:43 | 000,080,384 | ---- | M] () -- C:\Users\Owner\Desktop\MBRCheck.exe
    [2011/01/14 14:04:37 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Owner\Desktop\OTL.exe
    [2011/01/14 11:38:44 | 000,446,464 | ---- | M] (OldTimer Tools) -- C:\Users\Owner\Desktop\TFC.exe
    [1 C:\Users\Owner\Desktop\*.tmp files -> C:\Users\Owner\Desktop\*.tmp -> ]

    < %PROGRAMFILES%\Common Files\*.* >

    < %systemroot%\*.src >

    < %systemroot%\install\*.* >

    < %systemroot%\system32\DLL\*.* >

    < %systemroot%\system32\HelpFiles\*.* >

    < %systemroot%\system32\rundll\*.* >

    < %systemroot%\winn32\*.* >

    < %systemroot%\Java\*.* >

    < %systemroot%\system32\test\*.* >

    < %systemroot%\system32\Rundll32\*.* >

    < %systemroot%\AppPatch\Custom\*.* >

    < %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

    < %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

    < %PROGRAMFILES%\Internet Explorer\*.tmp >

    < %PROGRAMFILES%\Internet Explorer\*.dat >

    < %USERPROFILE%\My Documents\*.exe >

    < %USERPROFILE%\*.exe >
    [2010/12/24 14:50:03 | 130,359,064 | ---- | M] (Lavasoft ) -- C:\Users\Owner\Ad-Aware90Install.exe
    [2010/08/30 18:50:09 | 017,712,640 | ---- | M] (Greyfirst) -- C:\Users\Owner\CeltxSetup-2.7.exe
    [2010/09/24 20:21:43 | 013,504,384 | ---- | M] (DVDVideoSoft Limited. ) -- C:\Users\Owner\Free3GPVideoConverter.exe
    [2010/12/27 13:19:36 | 002,790,864 | ---- | M] (Adobe Systems, Inc.) -- C:\Users\Owner\install_flash_player.exe
    [2010/12/27 13:24:09 | 038,147,376 | ---- | M] (Apple Inc.) -- C:\Users\Owner\QuickTimeInstaller.exe
    [2010/09/04 21:20:21 | 004,747,136 | ---- | M] (Adobe Systems Inc.) -- C:\Users\Owner\Shockwave_Installer_Slim.exe
    [2010/04/15 19:23:19 | 001,688,360 | ---- | M] (Skype Technologies S.A.) -- C:\Users\Owner\SkypeSetup.exe
    [2010/01/11 22:28:03 | 000,318,904 | ---- | M] (Microsoft Corporation) -- C:\Users\Owner\wmpfirefoxplugin.exe

    < %systemroot%\ADDINS\*.* >
    [2009/06/10 15:20:04 | 000,000,802 | ---- | M] () -- C:\Windows\addins\FXSEXT.ecf

    < %systemroot%\assembly\*.bak2 >

    < %systemroot%\Config\*.* >

    < %systemroot%\REPAIR\*.bak2 >

    < %systemroot%\SECURITY\Database\*.sdb /x >

    < %systemroot%\SYSTEM\*.bak2 >

    < %systemroot%\Web\*.bak2 >

    < %systemroot%\Driver Cache\*.* >

    < %PROGRAMFILES%\Mozilla Firefox\0*.exe >

    < %ProgramFiles%\Microsoft Common\*.* >

    < %ProgramFiles%\TinyProxy. >

    < %USERPROFILE%\Favorites\*.url /x >
    [2010/08/04 07:38:29 | 000,000,402 | -HS- | M] () -- C:\Users\Owner\Favorites\desktop.ini

    < %systemroot%\system32\*.bk >

    < %systemroot%\*.te >

    < %systemroot%\system32\system32\*.* >

    < %ALLUSERSPROFILE%\*.dat /x >

    < %systemroot%\system32\drivers\*.rmv >

    < dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

    < dir /b "%systemroot%\*.exe" | find /i " " /c >

    < %PROGRAMFILES%\Microsoft\*.* >

    < %systemroot%\System32\Wbem\proquota.exe >

    < %PROGRAMFILES%\Mozilla Firefox\*.dat >

    < %USERPROFILE%\Cookies\*.txt /x >

    < %SystemRoot%\system32\fonts\*.* >

    < %systemroot%\system32\winlog\*.* >

    < %systemroot%\system32\Language\*.* >

    < %systemroot%\system32\Settings\*.* >

    < %systemroot%\system32\*.quo >

    < %SYSTEMROOT%\AppPatch\*.exe >

    < %SYSTEMROOT%\inf\*.exe >

    < %SYSTEMROOT%\Installer\*.exe >

    < %systemroot%\system32\config\*.bak2 >

    < %systemroot%\system32\Computers\*.* >

    < %SystemRoot%\system32\Sound\*.* >

    < %SystemRoot%\system32\SpecialImg\*.* >

    < %SystemRoot%\system32\code\*.* >

    < %SystemRoot%\system32\draft\*.* >

    < %SystemRoot%\system32\MSSSys\*.* >

    < %ProgramFiles%\Javascript\*.* >

    < %systemroot%\pchealth\helpctr\System\*.exe /s >

    < %systemroot%\Web\*.exe >

    < %systemroot%\system32\msn\*.* >

    < %systemroot%\system32\*.tro >

    < %AppData%\Microsoft\Installer\msupdates\*.* >

    < %ProgramFiles%\Messenger\*.* >

    < %systemroot%\system32\systhem32\*.* >

    < %systemroot%\system\*.exe >

    < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

    < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >


    ========== Alternate Data Streams ==========

    @Alternate Data Stream - 64 bytes -> C:\Users\Owner\Documents\Eastbound.and.Down.S01E01.HDTV.XviD-0TV.avi:TOC.WMV
    @Alternate Data Stream - 64 bytes -> C:\Users\Owner\Applebees.mp3:TOC.WMV
    @Alternate Data Stream - 64 bytes -> C:\Users\Owner\Anchorman - The Legend of Ron Burgundy (2004).avi:TOC.WMV

    < End of report >
    BobLoblaw, Jan 14, 2011
    #21

  2. BobLoblaw Newcomer, in training

    EXTRAS log

    OTL Extras logfile created on: 1/14/2011 2:06:18 PM - Run 1
    OTL by OldTimer - Version 3.2.20.2 Folder = C:\Users\Owner\Desktop
    Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation
    Internet Explorer (Version = 8.0.7600.16385)
    Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

    3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 54.00% Memory free
    6.00 Gb Paging File | 5.00 Gb Available in Paging File | 79.00% Paging File free
    Paging file location(s): ?:\pagefile.sys [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
    Drive C: | 287.79 Gb Total Space | 87.29 Gb Free Space | 30.33% Space Free | Partition Type: NTFS

    Computer Name: OWNER-PC | User Name: Owner | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: All users | Quick Scan
    Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

    ========== Extra Registry (SafeList) ==========


    ========== File Associations ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
    .cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
    .hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

    [HKEY_USERS\S-1-5-21-2824094850-119664256-1579380712-1000\SOFTWARE\Classes\<extension>]
    .html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

    ========== Shell Spawning ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
    batfile [open] -- "%1" %*
    cmdfile [open] -- "%1" %*
    comfile [open] -- "%1" %*
    cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
    exefile [open] -- "%1" %*
    helpfile [open] -- Reg Error: Key error.
    hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
    piffile [open] -- "%1" %*
    regfile [merge] -- Reg Error: Key error.
    scrfile [config] -- "%1"
    scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
    scrfile [open] -- "%1" /S
    txtfile [edit] -- Reg Error: Key error.
    Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
    Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
    Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
    Directory [Digital Photo Professional] -- C:\Program Files\Canon\Digital Photo Professional\DPPViewer.exe /path "%1" (CANON INC.)
    Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
    Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
    Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
    Folder [explore] -- Reg Error: Value error.
    Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

    ========== Security Center Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
    "cval" = 1
    "FirewallDisableNotify" = 0
    "AntiVirusDisableNotify" = 0
    "UpdatesDisableNotify" = 0

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
    "VistaSp1" = Reg Error: Unknown registry data type -- File not found
    "AntiVirusOverride" = 0
    "AntiSpywareOverride" = 0
    "FirewallOverride" = 0

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

    ========== System Restore Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
    "DisableSR" = 0

    ========== Firewall Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
    "DisableNotifications" = 0
    "EnableFirewall" = 1

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
    "DisableNotifications" = 0
    "EnableFirewall" = 1

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
    "DisableNotifications" = 0
    "EnableFirewall" = 1

    ========== Authorized Applications List ==========

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]


    ========== HKEY_LOCAL_MACHINE Uninstall List ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
    "{008D69EB-70FF-46AB-9C75-924620DF191A}" = TOSHIBA Speech System SR Engine(U.S.) Version1.0
    "{08234a0d-cf39-4dca-99f0-0c5cb496da81}" = Bing Bar
    "{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
    "{12B3A009-A080-4619-9A2A-C6DB151D8D67}" = TOSHIBA Assist
    "{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}" = Microsoft Works
    "{1696C54E-599A-4BA2-9941-BB70C4727887}" = Xtranormal State - Voicepack-English-UK-Daniel
    "{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
    "{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
    "{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    "{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
    "{21526716-DFD8-4B90-86D9-EF9F47057B3E}" = Toshiba Resources Page
    "{224821ED-CADA-4A8A-AC8D-3734CC0F0931}" = Amazon Links
    "{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
    "{26A24AE4-039D-4CA4-87B4-2F83216011FF}" = Java(TM) 6 Update 23
    "{287ECFA4-719A-2143-A09B-D6A12DE54E40}" = Acrobat.com
    "{308B6AEA-DE50-4666-996D-0FA461719D6B}" = Apple Mobile Device Support
    "{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
    "{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
    "{3C79DC59-6099-323B-B27B-90B45542B270}" = Google Talk Plugin
    "{3FBF6F99-8EC6-41B4-8527-0A32241B5496}" = TOSHIBA Speech System TTS Engine(U.S.) Version1.0
    "{4286E640-B5FB-11DF-AC4B-005056C00008}" = Google Earth
    "{467A3BF8-4C87-4E68-835C-CE5318C157C2}" = Xtranormal State - Voicepack-English-US-Tom
    "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
    "{4CBABDFD-49F8-47FD-BE7D-ECDE7270525A}" = Windows Live PIMT Platform
    "{50F68032-B5B7-4513-9116-C978DBD8F27A}" = DVD MovieFactory for TOSHIBA
    "{53536479-DFB0-47ED-9D10-43F3708C222D}" = TOSHIBA eco Utility
    "{53FA9A9F-3C19-4D43-AD6B-DEF365D469BA}" = Camtasia Studio 7
    "{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
    "{5DA0E02F-970B-424B-BF41-513A5018E4C0}" = TOSHIBA Disc Creator
    "{5E6F6CF3-BACC-4144-868C-E14622C658F3}" = TOSHIBA Web Camera Application
    "{5FFF9453-7B94-462A-B8F7-AC6D8D9EB1B5}" = Netzero Internet Access Installer
    "{617C36FD-0CBE-4600-84B2-441CEB12FADF}" = TOSHIBA Extended Tiles for Windows Mobility Center
    "{61AD15B2-50DB-4686-A739-14FE180D4429}" = Windows Live ID Sign-in Assistant
    "{65C0025A-2CDE-43C5-82D0-C7A56EF0DB39}" = Bing Bar Platform
    "{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
    "{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
    "{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
    "{6A05FEDF-662E-46BF-8A25-010E3F1C9C69}" = Windows Live UX Platform Language Pack
    "{6C5F3BDC-0A1B-4436-A696-5939629D5C31}" = TOSHIBA DVD PLAYER
    "{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
    "{7596C248-4816-4C6F-8AAC-D8C81F2B4B49}" = HD View
    "{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    "{7B15D70E-9449-4CFB-B9BC-798465B2BD5C}" = Norton Internet Security
    "{83892653-9EB8-4192-803E-D987A85CDD23}" = TOSHIBA Agreement Notification Utility
    "{838A22DF-81CA-4452-9BDD-A1745224D960}" = Xtranormal State - Voicepack-English-UK-Serena
    "{881F5DE8-9367-4B81-A325-E91BBC6472F9}" = iTunes
    "{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8136 8168 8169 Ethernet Driver
    "{890EF3F8-742F-46BD-9E8E-084B3A1F4364}" = QuickBooks Financial Center
    "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
    "{89F7D66C-777D-473B-AA11-319C0F190EAC}" = TOSHIBA Internal Modem Region Select Utility
    "{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
    "{8E9DB7EF-5DD3-499E-BA2A-A1F3153A4DF8}" = Adobe Flash Player 9 ActiveX
    "{8EC4F64D-92E4-4274-9495-4C887D49DEC3}" = Xtranormal State
    "{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
    "{90120000-0015-0409-0000-0000000FF1CE}_ENTERPRISER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
    "{90120000-0016-0409-0000-0000000FF1CE}_ENTERPRISER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
    "{90120000-0018-0409-0000-0000000FF1CE}_ENTERPRISER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
    "{90120000-0019-0409-0000-0000000FF1CE}_ENTERPRISER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
    "{90120000-001A-0409-0000-0000000FF1CE}_ENTERPRISER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
    "{90120000-001B-0409-0000-0000000FF1CE}_ENTERPRISER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
    "{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISER_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
    "{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
    "{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
    "{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISER_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
    "{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
    "{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
    "{90120000-001F-0C0A-0000-0000000FF1CE}_ENTERPRISER_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
    "{90120000-001F-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
    "{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
    "{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
    "{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
    "{90120000-0044-0409-0000-0000000FF1CE}_ENTERPRISER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
    "{90120000-006E-0409-0000-0000000FF1CE}_ENTERPRISER_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
    "{90120000-00A1-0409-0000-0000000FF1CE}_ENTERPRISER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007
    "{90120000-00BA-0409-0000-0000000FF1CE}_ENTERPRISER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007
    "{90120000-0114-0409-0000-0000000FF1CE}_ENTERPRISER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
    "{90120000-0115-0409-0000-0000000FF1CE}_ENTERPRISER_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0115-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
    "{90120000-0117-0409-0000-0000000FF1CE}_ENTERPRISER_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager
    "{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
    "{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
    "{91120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
    "{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
    "{912536C4-273C-416F-B42C-BBC5B72114D7}" = Xtranormal State - Voicepack-English-US-Samantha
    "{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
    "{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
    "{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
    "{970472D0-F5F9-4158-A6E3-1AE49EFEF2D3}" = Toshiba Application and Driver Installer
    "{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars
    "{98F2555F-6749-49BA-949F-FC887831A524}" = Palm Desktop by ACCESS
    "{9D318C86-AF4C-409F-A6AC-7183FF4CF424}" = Internet TV for Windows Media Center
    "{9DECD0F9-D3E8-48B0-A390-1CF09F54E3A4}" = TOSHIBA PC Health Monitor
    "{A208044D-A88B-4ACF-AE95-E4F213E6EDC0}" = TOSHIBA Supervisor Password
    "{A212E6C2-20F7-4A8E-BD8E-DC3EE7483FA2}" = PRS-500 USB driver
    "{A22989EE-AE7A-42F8-A0C0-9C99CFB644FB}" = Microsoft Forefront Client Security Antimalware Service
    "{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
    "{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
    "{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
    "{AC6569FA-6919-442A-8552-073BE69E247A}" = TOSHIBA Service Station
    "{AC76BA86-7AD7-1033-7B44-A94000000001}" = Adobe Reader 9.4.1
    "{B0E5D7E7-A106-458F-BA7B-2F8CAEA3BF16}" = PlayReady PC runtime
    "{B10914FD-8812-47A4-85A1-50FCDE7F1F33}" = Windows Live Sync
    "{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
    "{B5C314F7-928B-44E3-A8A3-169648B1077D}" = Xtranormal State - SoundPack-Starter Kit
    "{B65BBB06-1F8E-48F5-8A54-B024A9E15FDF}" = TOSHIBA Recovery Disc Creator
    "{B70E5793-F912-4C62-AFE2-C4F0B078FD31}" = Reader Library by Sony
    "{B90E5EBE-DF18-44D5-9D18-689ADEE9DA6C}" = Intel(R) PROSet/Wireless WiFi Software
    "{BF5A20B4-55F7-49B8-9302-FAC7C459AF3D}" = Skype Launcher
    "{BFE903DE-4845-4387-9C6C-98B21B8445A3}" = GMATPrep(TM)
    "{C424D5B8-BDE9-48FD-805E-FF276FCC76DF}" = ACL Desktop Education Edition
    "{C53D16CC-E56F-47B8-906E-70AAF8EABB4F}" = Toshiba Registration
    "{C730E42C-935A-45BB-A0C5-37E5234D111B}" = TOSHIBA Face Recognition
    "{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
    "{CFF8B8E8-E086-4DE0-935F-FE22CAB54F80}" = Microsoft Search Enhancement Pack
    "{D0387727-C89D-4774-B643-B9333EAA09DE}" = TOSHIBA Hardware Setup
    "{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
    "{D28CB048-A0AB-4F98-909F-69F3F25AA87D}" = Xtranormal State - Showpak-Playgoz-Preview
    "{D4322448-B6AF-4316-B859-D8A0E84DCB38}" = TOSHIBA HDD/SSD Alert
    "{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
    "{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
    "{D526ACED-F5F6-451F-BAAB-D5C6322DD8E2}" = Brother HL-2140
    "{DC24971E-1946-445D-8A82-CE685433FA7D}" = Realtek USB 2.0 Card Reader
    "{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}" = Ad-Aware
    "{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
    "{E1180142-3B31-4DCC-9D27-7AC2D37662BF}" = LightScribe 1.4.124.1
    "{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}" = Microsoft Office Suite Activation Assistant
    "{E69992ED-A7F6-406C-9280-1C156417BC49}" = Toshiba Quality Application
    "{E8B56B38-A826-11DB-8C83-0011430C73A4}" = Microsoft Forefront Client Security State Assessment Service
    "{EBFF48F5-3CFA-436F-8FD5-94FB01D3A0A7}" = TOSHIBA SD Memory Utilities
    "{EE033C1F-443E-41EC-A0E2-559B539A4E4D}" = TOSHIBA Speech System Applications
    "{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support
    "{F0A386D2-6E15-4A8F-A04E-87CE9BED0D48}" = TOSHIBA ConfigFree
    "{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
    "{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
    "{F2004B8D-7791-4B35-A3FA-D8CA8BB4DD81}" = Direct DiscRecorder
    "{F204E2B3-225D-419D-A5DE-3F97E8ADDD1B}" = Geek Squad 24 Hour Computer Support
    "{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
    "{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
    "{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
    "{FEDD27A0-B306-45EF-BF58-B527406B42C8}" = TOSHIBA Value Added Package
    "{FF1C31AE-0CDC-40CE-AB85-406F8B70D643}" = Bonjour
    "75070B1806113224B16C70296B90DD1AD8A53479" = Windows Driver Package - Sony Corporation (PRSUSB) USB (08/08/2006 1.0.03.08080)
    "Ad-Aware" = Ad-Aware
    "Adobe AIR" = Adobe AIR
    "Adobe Flash Player ActiveX" = Adobe Flash Player ActiveX
    "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
    "Adobe Shockwave Player" = Adobe Shockwave Player 11.5
    "Aglare Mp4 to AVI Converter_is1" = Aglare Mp4 to AVI Converter 6.5
    "Celebrity Toolbar" = Celebrity Toolbar
    "Celtx (2.7)" = Celtx (2.7)
    "DPP" = Canon Utilities Digital Photo Professional 3.0
    "ENTERPRISER" = Microsoft Office Enterprise 2007
    "EOS IEEE1394 WIA Driver" = EOS IEEE1394 WIA Driver
    "EOS USB WIA Driver" = EOS USB WIA Driver
    "EOS Utility" = Canon Utilities EOS Utility
    "Free 3GP Video Converter_is1" = Free 3GP Video Converter version 3.6
    "HDMI" = Intel(R) Graphics Media Accelerator Driver
    "HOMESTUDENTR" = Microsoft Office Home and Student 2007
    "InstallShield_{50F68032-B5B7-4513-9116-C978DBD8F27A}" = DVD MovieFactory for TOSHIBA
    "InstallShield_{53536479-DFB0-47ED-9D10-43F3708C222D}" = TOSHIBA eco Utility
    "InstallShield_{617C36FD-0CBE-4600-84B2-441CEB12FADF}" = TOSHIBA Extended Tiles for Windows Mobility Center
    "InstallShield_{83892653-9EB8-4192-803E-D987A85CDD23}" = TOSHIBA Agreement Notification Utility
    "InstallShield_{89F7D66C-777D-473B-AA11-319C0F190EAC}" = TOSHIBA Internal Modem Region Select Utility
    "InstallShield_{C730E42C-935A-45BB-A0C5-37E5234D111B}" = TOSHIBA Face Recognition
    "InstallShield_{D4322448-B6AF-4316-B859-D8A0E84DCB38}" = TOSHIBA HDD/SSD Alert
    "InstallShield_{F2004B8D-7791-4B35-A3FA-D8CA8BB4DD81}" = Direct DiscRecorder
    "InstallShield_{FEDD27A0-B306-45EF-BF58-B527406B42C8}" = TOSHIBA Value Added Package
    "Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
    "Mozilla Firefox (3.6.13)" = Mozilla Firefox (3.6.13)
    "NSS" = Norton Security Scan
    "ODSK" = Canon Utilities Original Data Security Tools
    "PhotoStitch" = Canon Utilities PhotoStitch
    "Picasa2" = Picasa 2
    "ProInst" = Intel PROSet Wireless
    "RAW Image Task" = Canon RAW Image Task for ZoomBrowser EX
    "RaybanMirror" = Ray-Ban Virtual Mirror
    "SynTPDeinstKey" = Synaptics Pointing Device Driver
    "TOSHIBA Software Modem" = TOSHIBA Software Modem
    "Uninstall_is1" = Uninstall 1.0.0.1
    "VLC media player" = VLC media player 1.0.1
    "WFTK" = Canon Utilities WFT-E1/E2 Utility
    "WildTangent toshiba Master Uninstall" = WildTangent Games
    "WinLiveSuite" = Windows Live Essentials
    "WinRAR archiver" = WinRAR archiver
    "Yahoo! Widget Engine" = Yahoo! Widgets
    "YInstHelper" = Yahoo! Install Manager
    "ZoomBrowser EX" = Canon Utilities ZoomBrowser EX

    ========== HKEY_USERS Uninstall List ==========

    [HKEY_USERS\S-1-5-21-2824094850-119664256-1579380712-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
    "BitTorrent" = BitTorrent
    "Dropbox" = Dropbox
    "Facebook Plug-In" = Facebook Plug-In
    "Google Chrome" = Google Chrome
    "Yahoo! BrowserPlus" = Yahoo! BrowserPlus 2.9.8

    ========== Last 10 Event Log Errors ==========

    Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!

    < End of report >
    BobLoblaw, Jan 14, 2011
    #22

  3. Broni Malware Annihilator

    I don't know. You tell me :)

    ===========================================================================

    Run OTL
    • Under the Custom Scans/Fixes box at the bottom, paste in the following

      Code:
      :OTL
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O18 - Protocol\Handler\symres {AA1061FE-6C41-421f-9344-69640C9732AB} - File not found
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
[1 C:\Users\Owner\Desktop\*.tmp files -> C:\Users\Owner\Desktop\*.tmp -> ]
@Alternate Data Stream - 64 bytes -> C:\Users\Owner\Documents\Eastbound.and.Down.S01E01.HDTV.XviD-0TV.avi:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\Owner\Applebees.mp3:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\Owner\Anchorman - The Legend of Ron Burgundy (2004).avi:TOC.WMV

:Commands
[purity]
[emptytemp]
[emptyflash]
[Reboot]
    • Then click the Run Fix button at the top
    • Let the program run unhindered, reboot the PC when it is done
    • You will get a log that shows the results of the fix. Please post it.

    ======================================================================

    Last scans....

    1. Download Security Check from HERE, and save it to your Desktop.
    • Double-click SecurityCheck.exe
    • Follow the onscreen instructions inside of the black box.
    • A Notepad document should open automatically called checkup.txt; please post the contents of that document.

      NOTE SecurityCheck may produce some false warning(s), so leave the results reading to me.


    2. Download Temp File Cleaner (TFC)
    • Double click on TFC.exe to run the program.
    • Click on Start button to begin cleaning process.
    • TFC will close all running programs, and it may ask you to restart computer.


    3. Please run a free online scan with the ESET Online Scanner

    • Disable your antivirus program
    • Tick the box next to YES, I accept the Terms of Use
    • Click Start
    • IMPORTANT! UN-check Remove found threats
    • Accept any security warnings from your browser.
    • Check Scan archives
    • Click Start
    • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
    • When the scan completes, push List of found threats
    • Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
    • NOTE. If Eset won't find any threats, it won't produce any log.
    Broni, Jan 14, 2011
    #23

  4. BobLoblaw Newcomer, in training

    OTL

    All processes killed
    ========== OTL ==========
    Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Malwarebytes' Anti-Malware (reboot) deleted successfully.
    C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe moved successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\symres\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AA1061FE-6C41-421f-9344-69640C9732AB}\ deleted successfully.
    File {AA1061FE-6C41-421f-9344-69640C9732AB} - File not found not found.
    Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\\{AEB6717E-7E19-11d0-97EE-00C04FD91972} deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AEB6717E-7E19-11d0-97EE-00C04FD91972}\ not found.
    C:\Users\Owner\Desktop\~PI4E3F.tmp deleted successfully.
    ADS C:\Users\Owner\Documents\Eastbound.and.Down.S01E01.HDTV.XviD-0TV.avi:TOC.WMV deleted successfully.
    ADS C:\Users\Owner\Applebees.mp3:TOC.WMV deleted successfully.
    ADS C:\Users\Owner\Anchorman - The Legend of Ron Burgundy (2004).avi:TOC.WMV deleted successfully.
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: All Users

    User: Default
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    User: Default User
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    User: Owner
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 39194 bytes
    ->Java cache emptied: 0 bytes
    ->FireFox cache emptied: 55363507 bytes
    ->Google Chrome cache emptied: 0 bytes
    ->Flash cache emptied: 2393 bytes

    User: Public
    ->Temp folder emptied: 0 bytes

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 0 bytes
    RecycleBin emptied: 0 bytes

    Total Files Cleaned = 53.00 mb


    [EMPTYFLASH]

    User: All Users

    User: Default
    ->Flash cache emptied: 0 bytes

    User: Default User
    ->Flash cache emptied: 0 bytes

    User: Owner
    ->Flash cache emptied: 0 bytes

    User: Public

    Total Flash Files Cleaned = 0.00 mb


    OTL by OldTimer - Version 3.2.20.2 log created on 01142011_144918

    Files\Folders moved on Reboot...

    Registry entries deleted on Reboot...
    BobLoblaw, Jan 14, 2011
    #24

  5. BobLoblaw Newcomer, in training

    Checkup Log

    Results of screen317's Security Check version 0.99.7
    Windows 7 (UAC is enabled)
    Internet Explorer 8
    ``````````````````````````````
    Antivirus/Firewall Check:
    Windows Firewall Enabled!
    Norton Internet Security
    WMI entry may not exist for antivirus; attempting automatic update.
    ```````````````````````````````
    Anti-malware/Other Utilities Check:
    Ad-Aware
    Malwarebytes' Anti-Malware
    Java(TM) 6 Update 23
    Out of date Java installed!
    Adobe Flash Player 9 (Out of date Flash Player installed!)
    Adobe Flash Player 10.1.102.64
    Adobe Reader 9.4.1
    Out of date Adobe Reader installed!
    ````````````````````````````````
    Process Check:
    objlist.exe by Laurent
    Windows Defender MSMpEng.exe
    Windows Defender MSASCui.exe
    Ad-Aware AAWService.exe
    Ad-Aware AAWTray.exe
    Microsoft Forefront Client Security Client Antimalware\MsMpEng.exe
    Microsoft Forefront Client Security Client Antimalware\MSASCui.exe
    ``````````End of Log````````````
    BobLoblaw, Jan 14, 2011
    #25

  6. BobLoblaw Newcomer, in training

    ESET log

    C:\Qoobox\Quarantine\C\Users\Owner\AppData\Local\msMouselib\UtilMobileTray.dll.vir a variant of Win32/Sefnit.AL trojan
    BobLoblaw, Jan 14, 2011
    #26

  7. Broni Malware Annihilator

    I can see some Norton's leftovers.
    Run this tool to remove them: http://us.norton.com/support/kb/web_view.jsp?wv_type=public_web&docurl=20080710133834EN

    ========================================================================

    Update Adobe Flash Player
    Download the Latest Adobe Flash for Firefox and IE Without Any Extras: http://www.404techsupport.com/2010/...-flash-for-firefox-and-ie-without-any-extras/

    =====================================================================

    Update Adobe Reader

    You can download it from http://www.adobe.com/products/acrobat/readstep2.html
    After installing the latest Adobe Reader, uninstall all previous versions.
    Note. If you already have Adobe Photoshop® Album Starter Edition installed or do not wish to have it installed UNcheck the box which says Also Download Adobe Photoshop® Album Starter Edition.

    Alternatively, you can uninstall Adobe Reader (33.5 MB), download and install Foxit PDF Reader(3.5MB) from HERE.
    It's a much smaller file to download and uses a lot less resources than Adobe Reader.
    Note: When installing FoxitReader, make sure to UN-check any pre-checked toolbar, or other garbage.

    =====================================================================

    Your computer is clean [IMG]

    1. We need to reset system restore to prevent your computer from being accidentally reinfected by using some old restore point(s). We'll create fresh, clean restore point, using following OTL script:

    Run OTL

    • Under the Custom Scans/Fixes box at the bottom, paste in the following:

    Code:
    :OTL
:Commands
[purity]
[emptytemp]
[EMPTYFLASH]
[CLEARALLRESTOREPOINTS]
[Reboot]
    • Then click the Run Fix button at the top
    • Let the program run unhindered, reboot the PC when it is done
    • Post resulting log.

    2. Now, we'll remove all tools, we used during our cleaning process

    Clean up with OTL:

    • Double-click OTL.exe to start the program.
    • Close all other programs apart from OTL as this step will require a reboot
    • On the OTL main screen, press the CLEANUP button
    • Say Yes to the prompt and then allow the program to reboot your computer.

    If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.

    3. Make sure, Windows Updates are current.

    4. If any Trojan was listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

    5. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

    6. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.

    7. Run Temporary File Cleaner (TFC) weekly.

    8. Download and install Secunia Personal Software Inspector (PSI): http://secunia.com/vulnerability_scanning/personal/. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.

    9. (optional) If you want to keep all your programs up to date, download and install FileHippo Update Checker.
    The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.

    10. Run defrag at your convenience.

    11. Read How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html

    12. Please, let me know, how your computer is doing.
    Broni, Jan 14, 2011
    #27

  8. Broni Malware Annihilator

    The issue seems to be resolved.
    Broni, Jan 19, 2011
    #28

  9. BobLoblaw Newcomer, in training

    hey sorry, i just started a job where i work like 12 hrs a day. this weekend ill have time to run the rest of the scans. can you keep this thread up?
    BobLoblaw, Jan 20, 2011
    #29

  10. BobLoblaw Newcomer, in training

    actually, nevermind i pretty much did it all. do you recommend that i post the otl log though?
    BobLoblaw, Jan 20, 2011
    #30

  11. Broni Malware Annihilator

    If you ran it, I trust you :)
    It's about YOUR computer well being.

    Good luck and don't work too hard :)
    Broni, Jan 20, 2011
    #31
Page 2 of 2
Thread Status:
Not open for further replies.