TechSpot

Google redirect again - sorry

By dmill
Nov 14, 2010
  1. I also am a victim of the google redirect virus.

    I hope I am attaching the info as directed. Thank you, in advance, for any assistance you may be able to extend to me.
     

    Attached Files:

  2. Broni

    Broni Malware Annihilator Posts: 52,892   +344

  3. dmill

    dmill TS Rookie Topic Starter

    As per the forum rules I have now copied the files directed to post regarding the google redirect virus. Sorry and I hope this helps.



    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT

    DDS (Ver_10-11-10.01)

    Microsoft Windows XP Professional
    Boot Device: \Device\HarddiskVolume2
    Install Date: 3/14/2008 7:23:24 PM
    System Uptime: 11/14/2010 7:25:58 AM (2 hours ago)

    Motherboard: Dell Inc. | | 0KP561
    Processor: Intel(R) Pentium(R) Dual CPU E2180 @ 2.00GHz | CPU | 1994/800mhz

    ==== Disk Partitions =========================

    C: is FIXED (NTFS) - 60 GiB total, 8.589 GiB free.
    D: is FIXED (NTFS) - 89 GiB total, 88.573 GiB free.
    E: is CDROM (CDFS)
    F: is CDROM ()
    G: is Removable
    H: is Removable

    ==== Disabled Device Manager Items =============

    ==== System Restore Points ===================

    RP752: 11/11/2010 6:02:36 PM - Installed Windows Internet Explorer 8.
    RP753: 11/11/2010 6:03:12 PM - Software Distribution Service 3.0
    RP754: 11/11/2010 9:46:02 PM - Removed MSN Toolbar
    RP755: 11/12/2010 3:00:57 AM - Software Distribution Service 3.0
    RP756: 11/13/2010 3:29:43 AM - System Checkpoint
    RP757: 11/14/2010 3:48:33 AM - System Checkpoint

    ==== Hosts File Hijack ======================

    Hosts: 74.125.45.100 safebrowsing-cache.google.com
    Hosts: 74.125.45.100 urs.microsoft.com
    Hosts: 74.125.45.100 www.securesoftwarebill.com
    Hosts: 74.125.45.100 secure-plus-payments.com
    Hosts: 74.125.45.100 www.secure-plus-payments.com
    Hosts: 74.125.45.100 secure.paysecuresystem.com
    Hosts: 74.125.45.100 paysoftbillsolution.com
    Hosts: 74.125.45.100 protected.maxisoftwaremart.com
    Hosts: 95.211.99.111 www.google.com
    Hosts: 95.211.99.111 google.com
    Hosts: 95.211.99.111 google.com.au
    Hosts: 95.211.99.111 www.google.com.au
    Hosts: 95.211.99.111 google.be
    Hosts: 95.211.99.111 www.google.be
    Hosts: 95.211.99.111 google.com.br
    Hosts: 95.211.99.111 www.google.com.br
    Hosts: 95.211.99.111 google.ca
    Hosts: 95.211.99.111 www.google.ca
    Hosts: 95.211.99.111 google.ch
    Hosts: 95.211.99.111 www.google.ch
    Hosts: 95.211.99.111 google.de
    Hosts: 95.211.99.111 www.google.de
    Hosts: 95.211.99.111 google.dk
    Hosts: 95.211.99.111 www.google.dk
    Hosts: 95.211.99.111 google.fr
    Hosts: 95.211.99.111 www.google.fr
    Hosts: 95.211.99.111 google.ie
    Hosts: 95.211.99.111 www.google.ie
    Hosts: 95.211.99.111 google.it
    Hosts: 95.211.99.111 www.google.it
    Hosts: 95.211.99.111 google.co.jp
    Hosts: 95.211.99.111 www.google.co.jp
    Hosts: 95.211.99.111 google.nl
    Hosts: 95.211.99.111 www.google.nl
    Hosts: 95.211.99.111 google.no
    Hosts: 95.211.99.111 www.google.no
    Hosts: 95.211.99.111 google.co.nz
    Hosts: 95.211.99.111 www.google.co.nz
    Hosts: 95.211.99.111 google.pl
    Hosts: 95.211.99.111 www.google.pl
    Hosts: 95.211.99.111 google.se
    Hosts: 95.211.99.111 www.google.se
    Hosts: 95.211.99.111 google.co.uk
    Hosts: 95.211.99.111 www.google.co.uk
    Hosts: 95.211.99.111 google.co.za
    Hosts: 95.211.99.111 www.google.co.za
    Hosts: 95.211.99.111 www.google-analytics.com
    Hosts: 95.211.99.111 www.bing.com
    Hosts: 95.211.99.111 search.yahoo.com
    Hosts: 95.211.99.111 www.search.yahoo.com
    Hosts: 95.211.99.111 uk.search.yahoo.com
    Hosts: 95.211.99.111 ca.search.yahoo.com
    Hosts: 95.211.99.111 de.search.yahoo.com
    Hosts: 95.211.99.111 fr.search.yahoo.com
    Hosts: 95.211.99.111 au.search.yahoo.com
    Hosts: 74.125.45.100 4-open-davinci.com
    Hosts: 74.125.45.100 securitysoftwarepayments.com
    Hosts: 74.125.45.100 privatesecuredpayments.com
    Hosts: 74.125.45.100 secure.privatesecuredpayments.com
    Hosts: 74.125.45.100 getantivirusplusnow.com
    Hosts: 74.125.45.100 www.getantivirusplusnow.com
    Hosts: 74.125.45.100 www.getavplusnow.com

    ==== Installed Programs ======================


    2007 Microsoft Office system
    ABBYY FineReader 6.0 Sprint
    Adobe Acrobat 4.0
    Adobe AIR
    Adobe Flash Player 10 ActiveX
    Adobe Media Player
    Adobe Photoshop 7.0
    Adobe Reader 8.2.5
    Adobe Shockwave Player 11.5
    Annabel
    AOL Coach Version 1.0(Build:20030807.3)
    AOL Uninstaller (Choose which Products to Remove)
    Apple Application Support
    Apple Mobile Device Support
    Apple Software Update
    ArcSoft Panorama Maker 3
    Avira AntiVir Personal - Free Antivirus
    Awakening: The Dreamless Castle
    Azada ®
    Big Fish Games: Game Manager
    Bonjour
    Broadcom ASF Management Applications
    Broadcom Gigabit Integrated Controller
    Broadcom Management Programs
    Browser Address Error Redirector
    Dell Driver Download Manager
    Dell Driver Download Manager - 1
    Diagnostic Tool for the Microsoft VM
    DIGOpt
    DIGReqEx
    DirectX 9 Runtime
    Download Updater (AOL LLC)
    Dream Chronicles
    Dream Chronicles - The Chosen Child
    Dream Chronicles 2
    Dream Chronicles: The Book of Air Collector's Edition
    GDR 4053 for SQL Server Database Services 2005 ENU (KB970892)
    Generations
    GHOST Chronicles Phantom of the Ren Faire
    Haunted Manor: Lord of Mirrors
    Hidden in Time: Mirror Mirror
    Hidden Mysteries: Vampire Secrets
    High Definition Audio Driver Package - KB835221
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
    Hotfix for Windows Internet Explorer 7 (KB947864)
    Hotfix for Windows Media Format 11 SDK (KB929399)
    Hotfix for Windows Media Format SDK (KB902344)
    Hotfix for Windows Media Format SDK (KB910998)
    Hotfix for Windows Media Player 11 (KB939683)
    Hotfix for Windows XP (KB2158563)
    Hotfix for Windows XP (KB896344)
    Hotfix for Windows XP (KB914440)
    Hotfix for Windows XP (KB915865)
    Hotfix for Windows XP (KB952287)
    Hotfix for Windows XP (KB954550-v5)
    Hotfix for Windows XP (KB961118)
    Hotfix for Windows XP (KB970653-v3)
    Hotfix for Windows XP (KB976098-v2)
    Hotfix for Windows XP (KB979306)
    Hotfix for Windows XP (KB981793)
    Hoyle Card Games 2003
    HP Memories Disc
    HP Photo and Imaging 2.0 - All-in-One
    HP Photo and Imaging 2.0 - All-in-One Drivers
    hp psc 2170 series
    Image Transfer
    ImageMixer for Sony
    Intel(R) Graphics Media Accelerator Driver
    Intel(R) Matrix Storage Manager
    iPhone Configuration Utility
    Island: The Lost Medallion
    iTunes
    Java Auto Updater
    Java(TM) 6 Update 20
    Learn2 Player (Uninstall Only)
    Lexmark 9500 Series
    Linksys EasyLink Advisor
    Lottso! Deluxe
    Love & Death ™: Bitten ™
    magicJack
    Malwarebytes' Anti-Malware
    MathPlayer
    McAfee SecurityCenter
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 1.1 Security Update (KB2416447)
    Microsoft .NET Framework 1.1 Security Update (KB979906)
    Microsoft .NET Framework 2.0 Service Pack 2
    Microsoft .NET Framework 3.0 Service Pack 2
    Microsoft .NET Framework 3.5 SP1
    Microsoft Application Error Reporting
    Microsoft Compression Client Pack 1.0 for Windows XP
    Microsoft Data Access Components KB870669
    Microsoft Internationalized Domain Names Mitigation APIs
    Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
    Microsoft National Language Support Downlevel APIs
    Microsoft Office 2003 Web Components
    Microsoft Office 2007 Service Pack 2 (SP2)
    Microsoft Office Access MUI (English) 2007
    Microsoft Office Access Setup Metadata MUI (English) 2007
    Microsoft Office Accounting 2007
    Microsoft Office Accounting ADP Payroll Addin
    Microsoft Office Accounting Equifax Addin
    Microsoft Office Accounting Fixed Asset Manager
    Microsoft Office Accounting PayPal Addin
    Microsoft Office Excel MUI (English) 2007
    Microsoft Office Outlook Connector for MSN
    Microsoft Office Outlook MUI (English) 2007
    Microsoft Office PowerPoint MUI (English) 2007
    Microsoft Office Professional Edition 2003
    Microsoft Office Professional Hybrid 2007
    Microsoft Office Proof (English) 2007
    Microsoft Office Proof (French) 2007
    Microsoft Office Proof (Spanish) 2007
    Microsoft Office Proofing (English) 2007
    Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
    Microsoft Office Publisher MUI (English) 2007
    Microsoft Office Shared MUI (English) 2007
    Microsoft Office Shared Setup Metadata MUI (English) 2007
    Microsoft Office Small Business Connectivity Components
    Microsoft Office Word MUI (English) 2007
    Microsoft Picture It! Express 9
    Microsoft Picture It! Library 9
    Microsoft Silverlight
    Microsoft Software Update for Web Folders (English) 12
    Microsoft SQL Server 2005
    Microsoft SQL Server 2005 Express Edition (MSSMLBIZ)
    Microsoft SQL Server Native Client
    Microsoft SQL Server Setup Support Files (English)
    Microsoft SQL Server VSS Writer
    Microsoft User-Mode Driver Framework Feature Pack 1.0
    Microsoft VC9 runtime libraries
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    Microsoft Web Publishing Wizard 1.52
    Microsoft WinUsb 1.0
    MicroStaff WINASPI
    MobileMe Control Panel
    MSN
    MSN Encarta Plus Support Files
    MSN Messenger 6.1
    MSXML 4.0 SP2 (KB936181)
    MSXML 4.0 SP2 (KB954430)
    MSXML 4.0 SP2 (KB973688)
    MSXML 6.0 Parser (KB933579)
    Musicmatch® Jukebox
    Mysteries of Magic Island
    Mystery Age: The Dark Priests
    Mystery Case Files: Return to Ravenhearst ™
    Mystery of the Earl
    Mystic Gateways: The Celestial Quest
    Nightshift Legacy - The Jaguars Eye
    Nikon Message Center
    OGA Notifier 2.0.0048.0
    OpenAL
    OpenOffice.org Installer 1.0
    PC Matic 1.1.0.33
    PC Pitstop Driver Alert 1.0.0.13
    PCmover
    PCsync
    PictureProject
    PowerDVD
    Presto! Forms 3.60.10
    Presto! PageManager 7.12.20
    Princess Isabella A Witch’s Curse
    Pure Networks Platform
    QuickTime
    Ravenhearst
    RealPlayer Basic
    Reincarnations: Awakening
    Robin's Quest: A Legend Born
    Roxio Activation Module
    Roxio CinePlayer Decoder Pack
    Roxio Creator Audio
    Roxio Creator BDAV Plugin
    Roxio Creator Copy
    Roxio Creator Data
    Roxio Creator DE
    Roxio Creator Tools
    Roxio Drag-to-Disc
    Roxio Easy VHS to DVD
    Roxio Easy VHS to DVD Content
    Roxio Express Labeler
    Roxio Update Manager
    Safari
    Samantha Swift and the Golden Touch
    Samantha Swift and the Hidden Roses of Athena
    Samantha Swift: Mystery From Atlantis
    SearchAssist
    Security Update for 2007 Microsoft Office System (KB2288621)
    Security Update for 2007 Microsoft Office System (KB2289158)
    Security Update for 2007 Microsoft Office System (KB2344875)
    Security Update for 2007 Microsoft Office System (KB2345043)
    Security Update for 2007 Microsoft Office System (KB969559)
    Security Update for 2007 Microsoft Office System (KB976321)
    Security Update for CAPICOM (KB931906)
    Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
    Security Update for Microsoft Office Access 2007 (KB979440)
    Security Update for Microsoft Office Excel 2007 (KB2345035)
    Security Update for Microsoft Office InfoPath 2007 (KB979441)
    Security Update for Microsoft Office Outlook 2007 (KB2288953)
    Security Update for Microsoft Office PowerPoint 2007 (KB982158)
    Security Update for Microsoft Office PowerPoint Viewer (KB2413381)
    Security Update for Microsoft Office Publisher 2007 (KB982124)
    Security Update for Microsoft Office system 2007 (972581)
    Security Update for Microsoft Office system 2007 (KB974234)
    Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
    Security Update for Microsoft Office Word 2007 (KB2344993)
    Security Update for Step By Step Interactive Training (KB923723)
    Security Update for Windows Internet Explorer 7 (KB928090)
    Security Update for Windows Internet Explorer 7 (KB929969)
    Security Update for Windows Internet Explorer 7 (KB931768)
    Security Update for Windows Internet Explorer 7 (KB933566)
    Security Update for Windows Internet Explorer 7 (KB937143)
    Security Update for Windows Internet Explorer 7 (KB938127)
    Security Update for Windows Internet Explorer 7 (KB939653)
    Security Update for Windows Internet Explorer 7 (KB942615)
    Security Update for Windows Internet Explorer 7 (KB944533)
    Security Update for Windows Internet Explorer 7 (KB950759)
    Security Update for Windows Internet Explorer 7 (KB953838)
    Security Update for Windows Internet Explorer 7 (KB956390)
    Security Update for Windows Internet Explorer 7 (KB958215)
    Security Update for Windows Internet Explorer 7 (KB960714)
    Security Update for Windows Internet Explorer 7 (KB961260)
    Security Update for Windows Internet Explorer 7 (KB963027)
    Security Update for Windows Internet Explorer 7 (KB969897)
    Security Update for Windows Internet Explorer 8 (KB2360131)
    Security Update for Windows Internet Explorer 8 (KB971961)
    Security Update for Windows Internet Explorer 8 (KB981332)
    Security Update for Windows Internet Explorer 8 (KB982381)
    Security Update for Windows Media Player (KB2378111)
    Security Update for Windows Media Player (KB911564)
    Security Update for Windows Media Player (KB952069)
    Security Update for Windows Media Player (KB954155)
    Security Update for Windows Media Player (KB968816)
    Security Update for Windows Media Player (KB973540)
    Security Update for Windows Media Player (KB975558)
    Security Update for Windows Media Player (KB978695)
    Security Update for Windows Media Player 10 (KB917734)
    Security Update for Windows Media Player 10 (KB936782)
    Security Update for Windows Media Player 11 (KB954154)
    Security Update for Windows Media Player 6.4 (KB925398)
    Security Update for Windows Media Player 9 (KB911565)
    Security Update for Windows Media Player 9 (KB917734)
    Security Update for Windows Media Player 9 (KB936782)
    Security Update for Windows XP (KB2079403)
    Security Update for Windows XP (KB2115168)
    Security Update for Windows XP (KB2121546)
    Security Update for Windows XP (KB2160329)
    Security Update for Windows XP (KB2229593)
    Security Update for Windows XP (KB2259922)
    Security Update for Windows XP (KB2279986)
    Security Update for Windows XP (KB2286198)
    Security Update for Windows XP (KB2296011)
    Security Update for Windows XP (KB2347290)
    Security Update for Windows XP (KB2360937)
    Security Update for Windows XP (KB2387149)
    Security Update for Windows XP (KB883939)
    Security Update for Windows XP (KB890046)
    Security Update for Windows XP (KB893756)
    Security Update for Windows XP (KB896358)
    Security Update for Windows XP (KB896422)
    Security Update for Windows XP (KB896423)
    Security Update for Windows XP (KB896424)
    Security Update for Windows XP (KB896428)
    Security Update for Windows XP (KB896688)
    Security Update for Windows XP (KB899587)
    Security Update for Windows XP (KB899588)
    Security Update for Windows XP (KB899591)
    Security Update for Windows XP (KB900725)
    Security Update for Windows XP (KB901017)
    Security Update for Windows XP (KB901190)
    Security Update for Windows XP (KB901214)
    Security Update for Windows XP (KB902400)
    Security Update for Windows XP (KB903235)
    Security Update for Windows XP (KB904706)
    Security Update for Windows XP (KB905414)
    Security Update for Windows XP (KB905749)
    Security Update for Windows XP (KB905915)
    Security Update for Windows XP (KB908519)
    Security Update for Windows XP (KB908531)
    Security Update for Windows XP (KB911280)
    Security Update for Windows XP (KB911562)
    Security Update for Windows XP (KB911567)
    Security Update for Windows XP (KB911927)
    Security Update for Windows XP (KB912812)
    Security Update for Windows XP (KB912919)
    Security Update for Windows XP (KB913446)
    Security Update for Windows XP (KB913580)
    Security Update for Windows XP (KB914388)
    Security Update for Windows XP (KB914389)
    Security Update for Windows XP (KB916281)
    Security Update for Windows XP (KB917159)
    Security Update for Windows XP (KB917344)
    Security Update for Windows XP (KB917422)
    Security Update for Windows XP (KB917953)
    Security Update for Windows XP (KB918118)
    Security Update for Windows XP (KB918439)
    Security Update for Windows XP (KB918899)
    Security Update for Windows XP (KB919007)
    Security Update for Windows XP (KB920213)
    Security Update for Windows XP (KB920214)
    Security Update for Windows XP (KB920670)
    Security Update for Windows XP (KB920683)
    Security Update for Windows XP (KB920685)
    Security Update for Windows XP (KB921398)
    Security Update for Windows XP (KB921503)
    Security Update for Windows XP (KB921883)
    Security Update for Windows XP (KB922616)
    Security Update for Windows XP (KB922760)
    Security Update for Windows XP (KB922819)
    Security Update for Windows XP (KB923191)
    Security Update for Windows XP (KB923414)
    Security Update for Windows XP (KB923561)
    Security Update for Windows XP (KB923689)
    Security Update for Windows XP (KB923694)
    Security Update for Windows XP (KB923980)
    Security Update for Windows XP (KB924191)
    Security Update for Windows XP (KB924270)
    Security Update for Windows XP (KB924496)
    Security Update for Windows XP (KB924667)
    Security Update for Windows XP (KB925454)
    Security Update for Windows XP (KB925486)
    Security Update for Windows XP (KB925902)
    Security Update for Windows XP (KB926255)
    Security Update for Windows XP (KB926436)
    Security Update for Windows XP (KB927779)
    Security Update for Windows XP (KB927802)
    Security Update for Windows XP (KB928255)
    Security Update for Windows XP (KB928843)
    Security Update for Windows XP (KB929123)
    Security Update for Windows XP (KB930178)
    Security Update for Windows XP (KB931261)
    Security Update for Windows XP (KB931784)
    Security Update for Windows XP (KB932168)
    Security Update for Windows XP (KB933729)
    Security Update for Windows XP (KB935839)
    Security Update for Windows XP (KB935840)
    Security Update for Windows XP (KB936021)
    Security Update for Windows XP (KB938464)
    Security Update for Windows XP (KB938829)
    Security Update for Windows XP (KB941202)
    Security Update for Windows XP (KB941568)
    Security Update for Windows XP (KB941569)
    Security Update for Windows XP (KB941644)
    Security Update for Windows XP (KB943055)
    Security Update for Windows XP (KB943460)
    Security Update for Windows XP (KB943485)
    Security Update for Windows XP (KB944653)
    Security Update for Windows XP (KB946026)
    Security Update for Windows XP (KB946648)
    Security Update for Windows XP (KB950760)
    Security Update for Windows XP (KB950762)
    Security Update for Windows XP (KB950974)
    Security Update for Windows XP (KB951066)
    Security Update for Windows XP (KB951376-v2)
    Security Update for Windows XP (KB951376)
    Security Update for Windows XP (KB951698)
    Security Update for Windows XP (KB951748)
    Security Update for Windows XP (KB952004)
    Security Update for Windows XP (KB952954)
    Security Update for Windows XP (KB953839)
    Security Update for Windows XP (KB954211)
    Security Update for Windows XP (KB954459)
    Security Update for Windows XP (KB954600)
    Security Update for Windows XP (KB955069)
    Security Update for Windows XP (KB956391)
    Security Update for Windows XP (KB956572)
    Security Update for Windows XP (KB956744)
    Security Update for Windows XP (KB956802)
    Security Update for Windows XP (KB956803)
    Security Update for Windows XP (KB956841)
    Security Update for Windows XP (KB956844)
    Security Update for Windows XP (KB957095)
    Security Update for Windows XP (KB957097)
    Security Update for Windows XP (KB958644)
    Security Update for Windows XP (KB958687)
    Security Update for Windows XP (KB958690)
    Security Update for Windows XP (KB958869)
    Security Update for Windows XP (KB959426)
    Security Update for Windows XP (KB960225)
    Security Update for Windows XP (KB960715)
    Security Update for Windows XP (KB960803)
    Security Update for Windows XP (KB960859)
    Security Update for Windows XP (KB961371)
    Security Update for Windows XP (KB961373)
    Security Update for Windows XP (KB961501)
    Security Update for Windows XP (KB968537)
    Security Update for Windows XP (KB969059)
    Security Update for Windows XP (KB969898)
    Security Update for Windows XP (KB969947)
    Security Update for Windows XP (KB970238)
    Security Update for Windows XP (KB970430)
    Security Update for Windows XP (KB971468)
    Security Update for Windows XP (KB971486)
    Security Update for Windows XP (KB971557)
    Security Update for Windows XP (KB971633)
    Security Update for Windows XP (KB971657)
    Security Update for Windows XP (KB972270)
    Security Update for Windows XP (KB973346)
    Security Update for Windows XP (KB973354)
    Security Update for Windows XP (KB973507)
    Security Update for Windows XP (KB973525)
    Security Update for Windows XP (KB973869)
    Security Update for Windows XP (KB973904)
    Security Update for Windows XP (KB974112)
    Security Update for Windows XP (KB974318)
    Security Update for Windows XP (KB974392)
    Security Update for Windows XP (KB974571)
    Security Update for Windows XP (KB975025)
    Security Update for Windows XP (KB975467)
    Security Update for Windows XP (KB975560)
    Security Update for Windows XP (KB975561)
    Security Update for Windows XP (KB975562)
    Security Update for Windows XP (KB975713)
    Security Update for Windows XP (KB977165)
    Security Update for Windows XP (KB977816)
    Security Update for Windows XP (KB977914)
    Security Update for Windows XP (KB978037)
    Security Update for Windows XP (KB978251)
    Security Update for Windows XP (KB978262)
    Security Update for Windows XP (KB978338)
    Security Update for Windows XP (KB978542)
    Security Update for Windows XP (KB978601)
    Security Update for Windows XP (KB978706)
    Security Update for Windows XP (KB979309)
    Security Update for Windows XP (KB979482)
    Security Update for Windows XP (KB979559)
    Security Update for Windows XP (KB979683)
    Security Update for Windows XP (KB979687)
    Security Update for Windows XP (KB980195)
    Security Update for Windows XP (KB980218)
    Security Update for Windows XP (KB980232)
    Security Update for Windows XP (KB980436)
    Security Update for Windows XP (KB981322)
    Security Update for Windows XP (KB981852)
    Security Update for Windows XP (KB981957)
    Security Update for Windows XP (KB981997)
    Security Update for Windows XP (KB982132)
    Security Update for Windows XP (KB982214)
    Security Update for Windows XP (KB982665)
    Security Update for Windows XP (KB982802)
    SierraHome Print Artist 8.0
    Sonic Activation Module
    Sony USB Driver
    SoundMAX
    System Requirements Lab
    System Requirements Lab for Intel
    The Mystery of the Crystal Portal
    The Mystery of the Crystal Portal: Beyond the Horizon
    The Serpent of Isis ™
    Time Mysteries: Inheritance
    TranslatorBar_1 Toolbar
    TranslatorBar_1.2 Toolbar
    Treasure Seekers: The Enchanted Canvases
    TWC Customer Controls
    Uninstall AOL Emergency Connect Utility 1.0
    Update for 2007 Microsoft Office System (KB967642)
    Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
    Update for Outlook 2007 Junk Email Filter (KB2443839)
    Update for Windows Internet Explorer 8 (KB2362765)
    Update for Windows Internet Explorer 8 (KB976662)
    Update for Windows XP (KB2141007)
    Update for Windows XP (KB2345886)
    Update for Windows XP (KB894391)
    Update for Windows XP (KB896727)
    Update for Windows XP (KB898461)
    Update for Windows XP (KB900485)
    Update for Windows XP (KB904942)
    Update for Windows XP (KB910437)
    Update for Windows XP (KB916595)
    Update for Windows XP (KB920872)
    Update for Windows XP (KB922582)
    Update for Windows XP (KB927891)
    Update for Windows XP (KB929338)
    Update for Windows XP (KB930916)
    Update for Windows XP (KB931836)
    Update for Windows XP (KB933360)
    Update for Windows XP (KB936357)
    Update for Windows XP (KB938828)
    Update for Windows XP (KB942763)
    Update for Windows XP (KB951072-v2)
    Update for Windows XP (KB951978)
    Update for Windows XP (KB955759)
    Update for Windows XP (KB955839)
    Update for Windows XP (KB967715)
    Update for Windows XP (KB968389)
    Update for Windows XP (KB971737)
    Update for Windows XP (KB973687)
    Update for Windows XP (KB973815)
    Victorian Mysteries: Woman in White
    Video Capture USB
    Viewpoint Media Player
    Visio Professional
    WebEx Support Manager for Internet Explorer
    WebFldrs XP
    Windows 7 Upgrade Advisor
    Windows Driver Package - Roxio Technology (USB28xxBGA) Media (11/14/2008 5.8.0912.1114)
    Windows Easy Transfer
    Windows Genuine Advantage Notifications (KB905474)
    Windows Genuine Advantage Validation Tool (KB892130)
    Windows Installer 3.1 (KB893803)
    Windows Internet Explorer 7
    Windows Internet Explorer 8
    Windows Live OneCare safety scanner
    Windows Media Format 11 runtime
    Windows Media Player 11
    Windows XP Hotfix - KB834707
    Windows XP Hotfix - KB867282
    Windows XP Hotfix - KB873333
    Windows XP Hotfix - KB873339
    Windows XP Hotfix - KB885250
    Windows XP Hotfix - KB885835
    Windows XP Hotfix - KB885836
    Windows XP Hotfix - KB885884
    Windows XP Hotfix - KB886185
    Windows XP Hotfix - KB887472
    Windows XP Hotfix - KB887742
    Windows XP Hotfix - KB888113
    Windows XP Hotfix - KB888302
    Windows XP Hotfix - KB890047
    Windows XP Hotfix - KB890175
    Windows XP Hotfix - KB890859
    Windows XP Hotfix - KB890923
    Windows XP Hotfix - KB891781
    Windows XP Hotfix - KB893066
    Windows XP Hotfix - KB893086
    Windows XP Service Pack 3
    WinZip 14.5
    Yahoo! Software Update
    Yahoo! Toolbar

    ==== Event Viewer Messages From Past Week ========

    11/8/2010 9:14:07 AM, error: Service Control Manager [7001] - The Remote Access Connection Manager service depends on the Telephony service which failed to start because of the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.

    ==== End Of File ===========================
    Malwarebytes' Anti-Malware 1.46
    www.malwarebytes.org

    Database version: 5111

    Windows 5.1.2600 Service Pack 3
    Internet Explorer 8.0.6001.18702

    11/14/2010 7:58:40 AM
    mbam-log-2010-11-14 (07-58-40).txt

    Scan type: Quick scan
    Objects scanned: 167622
    Time elapsed: 11 minute(s), 12 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 0

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    (No malicious items detected)

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    (No malicious items detected)

    DDS (Ver_10-11-10.01) - NTFSx86
    Run by Donna Militello at 9:50:24.64 on Sun 11/14/2010
    Internet Explorer: 8.0.6001.18702
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2037.1289 [GMT -5:00]

    AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
    AV: McAfee VirusScan *On-access scanning enabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
    FW: McAfee Personal Firewall *disabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}

    ============== Running Processes ===============

    C:\WINDOWS\system32\svchost -k DcomLaunch
    svchost.exe
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    svchost.exe
    svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Avira\AntiVir Desktop\sched.exe
    C:\WINDOWS\Explorer.EXE
    svchost.exe
    C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
    C:\Program Files\Common Files\AOL\1206122613\ee\AOLSoftware.exe
    C:\Program Files\McAfee.com\Agent\mcagent.exe
    C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe
    C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtProc.exe
    C:\Program Files\Lexmark 9500 Series\lxdomon.exe
    C:\Program Files\Lexmark 9500 Series\lxdoamon.exe
    C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe
    C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\WINDOWS\system32\igfxsrvc.exe
    C:\WINDOWS\system32\igfxpers.exe
    C:\Program Files\Analog Devices\Core\smax4pnp.exe
    C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
    C:\Program Files\Common Files\Java\Java Update\jusched.exe
    C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\program files\common files\installshield\updateservice\issch.exe
    C:\Program Files\AOL 9.1\waol.exe
    C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
    C:\Program Files\WinZip\WZQKPICK.EXE
    C:\Program Files\Avira\AntiVir Desktop\avguard.exe
    C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\Linksys\Linksys Updater\bin\LinksysUpdater.exe
    C:\WINDOWS\system32\lxdocoms.exe
    C:\WINDOWS\system32\java.exe
    C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
    C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
    c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
    c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
    C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
    C:\Program Files\McAfee\MPF\MPFSrv.exe
    C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
    C:\WINDOWS\system32\svchost.exe -k imgsvc
    C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
    C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
    C:\Documents and Settings\Donna Militello\Application Data\mjusbsp\magicJack.exe
    C:\WINDOWS\system32\WISPTIS.EXE
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\System32\svchost.exe -k HTTPFilter
    C:\Program Files\AOL 9.1\shellmon.exe
    C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
    C:\Program Files\Common Files\Java\Java Update\jucheck.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Documents and Settings\Administrator\Desktop\Desktop\dds.scr

    ============== Pseudo HJT Report ===============

    uStart Page = about:blank
    uSearch Page =
    uDefault_Page_URL = hxxp://www.internet-home-page.com
    uSearchMigratedDefaultURL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
    uInternet Connection Wizard,ShellNext = hxxp://partnerpage.google.com/smallbiz.dell.com/en_us?hl=en&client=dell-usuk&channel=us-smb&ibd=0080311
    uInternet Settings,ProxyOverride = <local>
    uURLSearchHooks: H - No File
    uURLSearchHooks: H - No File
    uURLSearchHooks: TranslatorBar 1.2 Toolbar: {548f6736-8fe4-4680-82f2-170d6c07e1d2} - c:\program files\translatorbar_1.2\tbTra0.dll
    uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -
    BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
    BHO: AskBar BHO: {201f27d4-3704-41d6-89c1-aa35e39143ed} - c:\program files\askbardis\bar\bin\askBar.dll
    BHO: TranslatorBar 1.2 Toolbar: {548f6736-8fe4-4680-82f2-170d6c07e1d2} - c:\program files\translatorbar_1.2\tbTra0.dll
    BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\mcafee\virusscan\scriptsn.dll
    BHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\program files\dell\bae\BAE.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn\YTSingleInstance.dll
    TB: {3041d03e-fd4b-44e0-b742-2d9b88305f98} - No File
    TB: TranslatorBar 1.2 Toolbar: {548f6736-8fe4-4680-82f2-170d6c07e1d2} - c:\program files\translatorbar_1.2\tbTra0.dll
    TB: {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File
    TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
    EB: {92a40b0a-740a-4a11-9ddb-70460c6da383} - Mamma Desktop Search
    EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll
    EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
    uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
    uRun: [cdloader] "c:\documents and settings\donna militello\application data\mjusbsp\cdloader2.exe" MAGICJACK
    uRun: [DW6] "c:\program files\the weather channel fw\desktop\DesktopWeather.exe"
    uRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
    uRun: [AOL Fast Start] "c:\program files\aol 9.1\AOL.EXE" -b
    mRun: [PDVDDXSrv] "c:\program files\cyberlink\powerdvd dx\PDVDDXSrv.exe"
    mRun: [HostManager] c:\program files\common files\aol\1206122613\ee\AOLSoftware.exe
    mRun: [mcagent_exe] "c:\program files\mcafee.com\agent\mcagent.exe" /runkey
    mRun: [WrtMon.exe] c:\windows\system32\spool\drivers\w32x86\3\WrtMon.exe
    mRun: [lxdomon.exe] "c:\program files\lexmark 9500 series\lxdomon.exe"
    mRun: [lxdoamon] "c:\program files\lexmark 9500 series\lxdoamon.exe"
    mRun: [Lexmark 9500 Series Fax Server] "c:\program files\lexmark 9500 series\fm3032.exe" /s
    mRun: [RoxioDragToDisc] "c:\program files\roxio\drag-to-disc\DrgToDsc.exe"
    mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\bin\AppleSyncNotifier.exe
    mRun: [nmctxth] "c:\program files\common files\pure networks shared\platform\nmctxth.exe"
    mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
    mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
    mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
    mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
    mRun: [ISUSPM Startup] c:\progra~1\common~1\instal~1\update~1\isuspm.exe -startup
    mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
    mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
    mRun: [Persistence] c:\windows\system32\igfxpers.exe
    mRun: [SoundMAXPnP] c:\program files\analog devices\core\smax4pnp.exe
    mRun: [IAAnotif] "c:\program files\intel\intel matrix storage manager\Iaanotif.exe"
    mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
    mRun: [EmailScan] c:\program files\mcafee.com\antivirus\mcvsescn.exe
    mRun: [PC Pitstop PC Matic Reminder] c:\program files\pcpitstop\pc matic\Reminder-PCMatic.exe
    mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
    dRun: [StartUp This] "c:\program files\laplink\pcmover\LaunchSt.exe"
    dRunOnce: [PCmover MapiFix] "c:\program files\laplink\pcmover\mapifix.exe"
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\nkbmon~1.lnk - c:\program files\nikon\pictureproject\NkbMonitor.exe
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\winzip~1.lnk - c:\program files\winzip\WZQKPICK.EXE
    uPolicies-explorer: DisallowRun = 1 (0x1)
    IE: &Search
    IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000
    IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html
    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office11\REFIEBAR.DLL
    IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
    Trusted Zone: internet
    Trusted Zone: mcafee.com
    Trusted Zone: pogo.com\www
    Trusted Zone: musicmatch.com\online
    DPF: DirectAnimation Java Classes
    DPF: Microsoft XML Parser for Java
    DPF: Win32 Classes
    DPF: {01113300-3E00-11D2-8470-0060089874ED} - hxxp://pccheckup.dellfix.com/sdccommon/download/tgctlcm.cab
    DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} - hxxp://support.dell.com/systemprofiler/SysPro.CAB
    DPF: {038E2507-7A48-41E2-94AD-7F23D199AF4E} - hxxp://www.worldwinner.com/games/v54/zengems/zengems.cab
    DPF: {070DC617-E3B7-468B-A29C-D4E84FAE938C} - hxxp://utilities.pcpitstop.com/Nirvana/controls/pcmatic.cab
    DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} - hxxp://utilities.pcpitstop.com/Nirvana/controls/pcmatic.cab
    DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
    DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204
    DPF: {49232000-16E4-426C-A231-62846947304B} - hxxp://ipgweb.cce.hp.com/rdq/downloads/sysinfo.cab
    DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} - hxxp://aolcc.aol.com/computercheckup/qdiagcc.cab
    DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - hxxp://download.av.aol.com/molbin/shared/mcinsctl/en-us/4,0,0,83/mcinsctl.cab
    DPF: {54BE6B6F-3056-470B-97E1-BB92E051B6C4} - hxxp://h20264.www2.hp.com/ediags/dd/install/HPDriverDiagnosticsxp2k.cab
    DPF: {5727FF4C-EF4E-4d96-A96C-03AD91910448} - hxxp://www.srtest.com/srl_bin/sysreqlab_ind.cab
    DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase6662.cab
    DPF: {615F158E-D5CA-422F-A8E7-F6A5EED7063B} - hxxp://www.worldwinner.com/games/v46/bejeweled/bejeweled.cab
    DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} -
    DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} - hxxp://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab
    DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1205787266000
    DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} - hxxp://clubgames.pogo.com/online2/pogop/luxor_2/mjolauncher.cab
    DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
    DPF: {88D969C0-F192-11D4-A65F-0040963251E5} - hxxp://ipgweb.cce.hp.com/rdq/downloads/msxml4.cab
    DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} - hxxp://www.worldwinner.com/games/shared/wwlaunch.cab
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
    DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} - hxxp://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38045.7731597222
    DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - hxxp://download.av.aol.com/molbin/shared/mcgdmgr/en-us/1,0,0,20/mcgdmgr.cab
    DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
    DPF: {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} - hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_intel_4.1.66.0.cab
    DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} -
    DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
    DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} - hxxp://utilities.pcpitstop.com/Optimize2/pcpitstop2.dll
    Handler: pure-go - {4746C79A-2042-4332-8650-48966E44ABA8} - c:\program files\common files\pure networks shared\platform\puresp4.dll
    Notify: igfxcui - igfxdev.dll
    SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
    mASetup: {9EF0045A-CDD9-438e-95E6-02B9AFEC8E11} - c:\windows\system32\updcrl.exe -e -u c:\windows\system\verisignpub1.crl
    IFEO: image file execution options - svchost.exe
    Hosts: 74.125.45.100 safebrowsing-cache.google.com
    Hosts: 74.125.45.100 urs.microsoft.com
    Hosts: 74.125.45.100 www.securesoftwarebill.com
    Hosts: 74.125.45.100 secure-plus-payments.com
    Hosts: 74.125.45.100 www.secure-plus-payments.com

    Note: multiple HOSTS entries found. Please refer to Attach.txt

    ============= SERVICES / DRIVERS ===============

    R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2010-11-14 11608]
    R1 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2008-3-14 214664]
    R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2010-11-14 135336]
    R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2010-11-14 267944]
    R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2010-11-14 60936]
    R2 LinksysUpdater;Linksys Updater;c:\program files\linksys\linksys updater\bin\LinksysUpdater.exe [2008-11-13 204800]
    R2 lxdo_device;lxdo_device;c:\windows\system32\lxdocoms.exe -service --> c:\windows\system32\lxdocoms.exe -service [?]
    R2 McProxy;McAfee Proxy Service;c:\progra~1\common~1\mcafee\mcproxy\mcproxy.exe [2008-6-2 359952]
    R2 McShield;McAfee Real-time Scanner;c:\progra~1\mcafee\viruss~1\mcshield.exe [2008-3-14 144704]
    R3 McSysmon;McAfee SystemGuards;c:\progra~1\mcafee\viruss~1\mcsysmon.exe [2008-3-14 606736]
    R3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2008-3-14 79816]
    R3 mfebopk;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2008-3-14 35272]
    R3 mfesmfk;McAfee Inc. mfesmfk;c:\windows\system32\drivers\mfesmfk.sys [2008-3-14 40552]
    S2 ASFIPmon;Broadcom ASF IP and SMBIOS Mailbox Monitor;c:\program files\broadcom\asfipmon\AsfIpMon.exe [2007-6-20 79168]
    S2 lxdoCATSCustConnectService;lxdoCATSCustConnectService;c:\windows\system32\spool\drivers\w32x86\3\lxdoserv.exe [2008-7-24 94208]
    S3 cpudrv;cpudrv;c:\program files\systemrequirementslab\cpudrv.sys [2009-12-18 11336]
    S3 LLUSBFLT;LLUSBFLT;c:\windows\system32\drivers\llusbflt.sys [2009-1-28 4736]
    S3 mferkdk;McAfee Inc. mferkdk;c:\windows\system32\drivers\mferkdk.sys [2008-3-14 34248]
    S3 PCPitstop Scheduling;PCPitstop Scheduling;c:\program files\pcpitstop\PCPitstopScheduleService.exe [2010-11-13 90864]
    S3 PLUsbbc2;High-Speed USB Bridge Cable Driver;c:\windows\system32\drivers\usbbc2.sys [2009-1-28 8960]
    S3 RoxMediaDB11;RoxMediaDB11;c:\program files\common files\roxio shared\11.0\sharedcom\RoxMediaDB11.exe [2008-11-17 1128944]

    =============== Created Last 30 ================

    2010-11-14 12:13:46 60936 ----a-w- c:\windows\system32\drivers\avgntflt.sys
    2010-11-14 12:13:44 -------- dc----w- c:\docume~1\alluse~1\applic~1\Avira
    2010-11-14 12:13:44 -------- d-----w- c:\program files\Avira
    2010-11-14 00:09:20 -------- dc----w- c:\docume~1\alluse~1\applic~1\PCPitstopDat
    2010-11-13 13:11:15 16968 ----a-w- c:\windows\system32\drivers\hitmanpro35.sys
    2010-11-13 13:10:13 -------- dc----w- c:\docume~1\alluse~1\applic~1\Hitman Pro
    2010-11-11 23:02:16 -------- dc-h--w- c:\windows\ie8
    2010-11-08 03:38:14 -------- d-----w- c:\docume~1\donnam~1\applic~1\MA2
    2010-11-08 03:37:12 -------- d-----w- c:\program files\Mystery Age - The Dark Priests
    2010-11-04 02:54:33 -------- d-----w- c:\program files\Haunted Halls - Green Hills Sanitarium Collector's Edition
    2010-10-27 02:41:35 -------- d-----w- c:\documents and settings\donna militello\Saved Games
    2010-10-26 20:34:35 1645272 -c--a-w- c:\documents and settings\all users\SPL4877.tmp
    2010-10-26 02:30:06 -------- d-----w- c:\docume~1\donnam~1\applic~1\Aerohills
    2010-10-26 02:28:54 -------- d-----w- c:\program files\Mystery of the Earl
    2010-10-24 01:11:37 -------- d-----w- c:\docume~1\donnam~1\applic~1\VampireSaga
    2010-10-22 23:14:56 -------- d-----w- c:\docume~1\donnam~1\applic~1\perfect future studio
    2010-10-22 23:13:00 -------- d-----w- c:\program files\Mysteries of Magic Island
    2010-10-22 18:19:33 -------- d-----w- c:\docume~1\donnam~1\applic~1\PlayPond

    ==================== Find3M ====================

    2010-09-18 16:23:26 974848 ----a-w- c:\windows\system32\mfc42u.dll
    2010-09-18 06:53:25 974848 ----a-w- c:\windows\system32\mfc42.dll
    2010-09-18 06:53:25 954368 ----a-w- c:\windows\system32\mfc40.dll
    2010-09-18 06:53:25 953856 ----a-w- c:\windows\system32\mfc40u.dll
    2010-09-10 05:58:08 916480 ----a-w- c:\windows\system32\wininet.dll
    2010-09-10 05:58:06 43520 ------w- c:\windows\system32\licmgr10.dll
    2010-09-10 05:58:06 1469440 ------w- c:\windows\system32\inetcpl.cpl
    2010-09-01 11:51:14 285824 ----a-w- c:\windows\system32\atmfd.dll
    2010-08-31 13:42:52 1852800 ----a-w- c:\windows\system32\win32k.sys
    2010-08-27 08:02:29 119808 ----a-w- c:\windows\system32\t2embed.dll
    2010-08-27 05:57:43 99840 ----a-w- c:\windows\system32\srvsvc.dll
    2010-08-26 12:52:45 5120 ----a-w- c:\windows\system32\xpsp4res.dll
    2010-08-23 16:12:04 617472 ----a-w- c:\windows\system32\comctl32.dll
    2010-08-17 13:17:06 58880 ----a-w- c:\windows\system32\spoolsv.exe

    ============= FINISH: 9:51:20.40 ===============
    GMER 1.0.15.15530 - http://www.gmer.net
    Rootkit quick scan 2010-11-14 09:48:40
    Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD16 rev.20.0
    Running: jryuwe4z.exe; Driver: C:\DOCUME~1\DONNAM~1\LOCALS~1\Temp\pxtdypod.sys


    ---- System - GMER 1.0.15 ----

    Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateFile [0x9F390794]
    Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateProcess [0x9F390742]
    Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateProcessEx [0x9F390756]
    Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwEnumerateKey [0x9F3908E7]
    Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwEnumerateValueKey [0x9F3908D1]
    Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwMapViewOfSection [0x9F3907D4]
    Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwNotifyChangeKey [0x9F390913]
    Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwOpenKey [0x9F390817]
    Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwProtectVirtualMemory [0x9F3907A8]
    Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwQueryKey [0x9F390959]
    Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwQueryMultipleValueKey [0x9F3908BB]
    Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwQueryValueKey [0x9F3908A5]
    Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwRenameKey [0x9F39085D]
    Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwSetContextThread [0x9F390780]
    Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwSetInformationProcess [0x9F39076C]
    Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwTerminateProcess [0x9F390803]
    Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwUnloadKey [0x9F3908FD]
    Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwUnmapViewOfSection [0x9F3907EA]
    Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwYieldExecution [0x9F3907BE]
    Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtCreateFile
    Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtMapViewOfSection
    Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtSetInformationProcess

    ---- Devices - GMER 1.0.15 ----

    AttachedDevice \FileSystem\Ntfs \Ntfs mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
    AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
    AttachedDevice \FileSystem\Fastfat \Fat mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
    AttachedDevice \Driver\Tcpip \Device\Ip Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)
    AttachedDevice \Driver\Tcpip \Device\Tcp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)
    AttachedDevice \Driver\Tcpip \Device\Udp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)
    AttachedDevice \Driver\Tcpip \Device\RawIp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)

    ---- EOF - GMER 1.0.15 ----
     
  4. Broni

    Broni Malware Annihilator Posts: 52,892   +344

    Please, observe following rules:
    • Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
    • If you're stuck, or you're not sure about certain step, always ask before doing anything else.
    • Please refrain from running tools or applying updates other than those I suggest.
    • Never run more than one scan at a time.
    • Keep updating me regarding your computer behavior, good, or bad.
    • The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
    • If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
    • I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

    ========================================================================

    You're running two AV programs, Avira and McAfee.
    One of them has to go.
    If McAfee (preferably), make sure to use this tool to remove it: http://www.softpedia.com/get/Tweak/Uninstallers/McAfee-Consumer-Product-Removal-Tool.shtml

    ========================================================================

    Download HostsXpert ( http://www.majorgeeks.com/Hoster_d4626.html ) and then follow the steps below:

    * Unzip HostsXpert.zip
    * It will create a folder named HostsXpert in whatever folder you extract it to.
    * Run HostsXpert.exe by double clicking on it (Vista and Windows 7 users, right click and click "Run As Administrator").
    * click Restore MS Hosts File and then click OK.
    * Click the X to exit the program

    Restart computer.

    ========================================================================

    Download MBRCheck to your desktop

    Double click MBRCheck.exe to run (Vista and Windows 7 users, right click and select Run as Administrator).
    It will show a black screen with some data on it.
    Enter N to exit.
    A report called MBRcheckxxxx.txt will be on your desktop
    Open this report and post its content in your next reply.

    =======================================================================

    Please download ComboFix from Here or Here to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    1. Please, never rename Combofix unless instructed.
    2. Close any open browsers.
    3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
      • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
      • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
      NOTE1. If Combofix asks you to install Recovery Console, please allow it.
      NOTE 2. If Combofix asks you to update the program, always do so.
      • Close any open browsers.
      • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
      • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
      • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
    4. Double click on combofix.exe & follow the prompts.
    5. When finished, it will produce a report for you.
    6. Please post the "C:\ComboFix.txt"
    **Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

    Make sure, you re-enable your security programs, when you're done with Combofix.

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    NOTE.
    If, for some reason, Combofix refuses to run, try one of the following:

    1. Run Combofix from Safe Mode.

    2. Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
    Do NOT run it yet.

    Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.

    There are 4 different versions. If one of them won't run then download and try to run the other one.

    Vista and Win7 users need to right click Rkill and choose Run as Administrator

    You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

    Rkill.com
    Rkill.scr
    Rkill.pif
    Rkill.exe

    • Double-click on the Rkill desktop icon to run the tool.
    • If using Vista or Windows 7 right-click on it and choose Run As Administrator.
    • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
    • If not, delete the file, then download and use the one provided in Link 2.
    • If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
    • Do not reboot until instructed.
    • If the tool does not run from any of the links provided, please let me know.

    Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

    If normal mode still doesn't work, run BOTH tools from safe mode.

    In case #2, please post BOTH logs, rKill and Combofix.

    DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
     
  5. dmill

    dmill TS Rookie Topic Starter

    Hi,

    Got a message when I attempted to run HostXpert as follows : "You Host file is marked as a "system file" and can NOT be manipulated. Press OK to remove file attribute, Cancel to quit." I pressed "OK" and clicked the "Restore MS Hosts File" and received the following popup "Error: cannot creat file C:\WindowsSystem32\Drivers\Etc\Hosts

    Was able to run MBRCheck and Combofix. Logs are attached.

    ComboFix 10-11-15.03 - Donna Militello 11/15/2010 15:55:33.1.2 - x86
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2037.1392 [GMT -5:00]
    Running from: c:\documents and settings\Administrator\Desktop\Desktop\ComboFix.exe
    AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\documents and settings\Donna Militello\Application Data\PriceGong
    c:\documents and settings\Donna Militello\Application Data\PriceGong\Data\1.xml
    c:\documents and settings\Donna Militello\Application Data\PriceGong\Data\a.xml
    c:\documents and settings\Donna Militello\Application Data\PriceGong\Data\b.xml
    c:\documents and settings\Donna Militello\Application Data\PriceGong\Data\c.xml
    c:\documents and settings\Donna Militello\Application Data\PriceGong\Data\d.xml
    c:\documents and settings\Donna Militello\Application Data\PriceGong\Data\e.xml
    c:\documents and settings\Donna Militello\Application Data\PriceGong\Data\f.xml
    c:\documents and settings\Donna Militello\Application Data\PriceGong\Data\g.xml
    c:\documents and settings\Donna Militello\Application Data\PriceGong\Data\h.xml
    c:\documents and settings\Donna Militello\Application Data\PriceGong\Data\i.xml
    c:\documents and settings\Donna Militello\Application Data\PriceGong\Data\J.xml
    c:\documents and settings\Donna Militello\Application Data\PriceGong\Data\k.xml
    c:\documents and settings\Donna Militello\Application Data\PriceGong\Data\l.xml
    c:\documents and settings\Donna Militello\Application Data\PriceGong\Data\m.xml
    c:\documents and settings\Donna Militello\Application Data\PriceGong\Data\mru.xml
    c:\documents and settings\Donna Militello\Application Data\PriceGong\Data\n.xml
    c:\documents and settings\Donna Militello\Application Data\PriceGong\Data\o.xml
    c:\documents and settings\Donna Militello\Application Data\PriceGong\Data\p.xml
    c:\documents and settings\Donna Militello\Application Data\PriceGong\Data\q.xml
    c:\documents and settings\Donna Militello\Application Data\PriceGong\Data\r.xml
    c:\documents and settings\Donna Militello\Application Data\PriceGong\Data\s.xml
    c:\documents and settings\Donna Militello\Application Data\PriceGong\Data\t.xml
    c:\documents and settings\Donna Militello\Application Data\PriceGong\Data\u.xml
    c:\documents and settings\Donna Militello\Application Data\PriceGong\Data\v.xml
    c:\documents and settings\Donna Militello\Application Data\PriceGong\Data\w.xml
    c:\documents and settings\Donna Militello\Application Data\PriceGong\Data\x.xml
    c:\documents and settings\Donna Militello\Application Data\PriceGong\Data\y.xml
    c:\documents and settings\Donna Militello\Application Data\PriceGong\Data\z.xml
    c:\documents and settings\Donna Militello\Recent\ANTIGEN.drv
    c:\documents and settings\Donna Militello\Recent\ANTIGEN.exe
    c:\documents and settings\Donna Militello\Recent\ANTIGEN.tmp
    c:\documents and settings\Donna Militello\Recent\cid.dll
    c:\documents and settings\Donna Militello\Recent\CLSV.sys
    c:\documents and settings\Donna Militello\Recent\ddv.drv
    c:\documents and settings\Donna Militello\Recent\energy.exe
    c:\documents and settings\Donna Militello\Recent\exec.tmp
    c:\documents and settings\Donna Militello\Recent\fan.drv
    c:\documents and settings\Donna Militello\Recent\kernel32.dll
    c:\documents and settings\Donna Militello\Recent\PE.drv
    c:\documents and settings\Donna Militello\Recent\SM.tmp
    c:\documents and settings\Donna Militello\Recent\snl2w.sys
    c:\documents and settings\Donna Militello\Recent\std.drv
    c:\documents and settings\Donna Militello\Recent\std.exe
    c:\documents and settings\Donna Militello\Recent\std.tmp
    c:\documents and settings\Donna Militello\Recent\tjd.exe
    c:\windows\addins\xafnu.bak1
    c:\windows\addins\xafnu.bak2
    c:\windows\AppPatch\dvdsod.bak1
    c:\windows\AppPatch\dvdsod.ini
    c:\windows\AppPatch\kablld.bak1
    c:\windows\AppPatch\kablld.ini
    c:\windows\Cursors\nursod.bak2
    c:\windows\Fonts\acrsec.fon
    c:\windows\java.exe
    c:\windows\patch.exe
    c:\windows\start.exe
    c:\windows\Web\default.htt

    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    -------\Legacy_MYWEBSEARCHSERVICE


    ((((((((((((((((((((((((( Files Created from 2010-10-15 to 2010-11-15 )))))))))))))))))))))))))))))))
    .

    2010-11-15 20:50 . 2010-11-15 20:50 -------- d-----w- c:\documents and settings\Donna Militello\Application Data\Avira
    2010-11-15 11:25 . 2010-11-15 20:39 -------- d-----w- c:\documents and settings\Donna Militello\Local Settings\Application Data\WinZip
    2010-11-14 23:26 . 2010-11-14 23:26 -------- d-----w- C:\found.000
    2010-11-14 12:13 . 2010-08-02 21:10 60936 ----a-w- c:\windows\system32\drivers\avgntflt.sys
    2010-11-14 12:13 . 2010-08-02 21:10 126856 ----a-w- c:\windows\system32\drivers\avipbb.sys
    2010-11-14 12:13 . 2010-06-17 20:27 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
    2010-11-14 12:13 . 2010-06-17 20:27 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
    2010-11-14 12:13 . 2010-11-14 12:13 -------- dc----w- c:\documents and settings\All Users\Application Data\Avira
    2010-11-14 12:13 . 2010-11-14 12:13 -------- d-----w- c:\program files\Avira
    2010-11-14 00:09 . 2010-11-14 00:09 -------- dc----w- c:\documents and settings\All Users\Application Data\PCPitstopDat
    2010-11-13 13:11 . 2010-11-13 13:11 16968 ----a-w- c:\windows\system32\drivers\hitmanpro35.sys
    2010-11-13 13:10 . 2010-11-13 13:10 -------- dc----w- c:\documents and settings\All Users\Application Data\Hitman Pro
    2010-11-11 23:02 . 2010-11-11 23:02 -------- dc-h--w- c:\windows\ie8
    2010-11-08 03:38 . 2010-11-08 03:38 -------- d-----w- c:\documents and settings\Donna Militello\Application Data\MA2
    2010-11-08 03:37 . 2010-11-08 03:37 -------- d-----w- c:\program files\Mystery Age - The Dark Priests
    2010-11-04 02:54 . 2010-11-04 04:03 -------- d-----w- c:\program files\Haunted Halls - Green Hills Sanitarium Collector's Edition
    2010-10-27 02:41 . 2010-10-27 02:41 -------- d-----w- c:\documents and settings\Donna Militello\Saved Games
    2010-10-26 20:34 . 2010-10-26 20:34 1645272 -c--a-w- c:\documents and settings\All Users\SPL4877.tmp
    2010-10-26 02:30 . 2010-10-26 02:30 -------- d-----w- c:\documents and settings\Donna Militello\Application Data\Aerohills
    2010-10-26 02:28 . 2010-10-26 02:29 -------- d-----w- c:\program files\Mystery of the Earl
    2010-10-24 01:11 . 2010-10-24 01:11 -------- d-----w- c:\documents and settings\Donna Militello\Application Data\VampireSaga
    2010-10-22 23:14 . 2010-10-22 23:14 -------- d-----w- c:\documents and settings\Donna Militello\Application Data\perfect future studio
    2010-10-22 23:13 . 2010-10-22 23:13 -------- d-----w- c:\program files\Mysteries of Magic Island
    2010-10-22 18:19 . 2010-10-22 18:19 -------- d-----w- c:\documents and settings\Donna Militello\Application Data\PlayPond

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2010-09-18 16:23 . 2004-08-11 22:00 974848 ----a-w- c:\windows\system32\mfc42u.dll
    2010-09-18 06:53 . 2004-08-11 22:00 974848 ----a-w- c:\windows\system32\mfc42.dll
    2010-09-18 06:53 . 2004-08-11 22:00 954368 ----a-w- c:\windows\system32\mfc40.dll
    2010-09-18 06:53 . 2004-08-11 22:00 953856 ----a-w- c:\windows\system32\mfc40u.dll
    2010-09-10 05:58 . 2004-08-11 22:00 916480 ----a-w- c:\windows\system32\wininet.dll
    2010-09-10 05:58 . 2004-08-11 22:00 43520 ------w- c:\windows\system32\licmgr10.dll
    2010-09-10 05:58 . 2004-08-11 22:00 1469440 ------w- c:\windows\system32\inetcpl.cpl
    2010-09-01 11:51 . 2004-08-11 22:00 285824 ----a-w- c:\windows\system32\atmfd.dll
    2010-08-31 13:42 . 2004-08-11 22:00 1852800 ----a-w- c:\windows\system32\win32k.sys
    2010-08-27 08:02 . 2004-08-11 22:00 119808 ----a-w- c:\windows\system32\t2embed.dll
    2010-08-27 05:57 . 2004-08-11 22:00 99840 ----a-w- c:\windows\system32\srvsvc.dll
    2010-08-26 13:39 . 2004-08-11 22:00 357248 ----a-w- c:\windows\system32\drivers\srv.sys
    2010-08-26 12:52 . 2009-04-15 09:04 5120 ----a-w- c:\windows\system32\xpsp4res.dll
    2010-08-23 16:12 . 2004-08-11 22:00 617472 ----a-w- c:\windows\system32\comctl32.dll
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
    "{548f6736-8fe4-4680-82f2-170d6c07e1d2}"= "c:\program files\TranslatorBar_1.2\tbTra0.dll" [2010-09-11 2735200]

    [HKEY_CLASSES_ROOT\clsid\{548f6736-8fe4-4680-82f2-170d6c07e1d2}]

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{548f6736-8fe4-4680-82f2-170d6c07e1d2}]
    2010-09-11 03:20 2735200 ----a-w- c:\program files\TranslatorBar_1.2\tbTra0.dll

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    "{548f6736-8fe4-4680-82f2-170d6c07e1d2}"= "c:\program files\TranslatorBar_1.2\tbTra0.dll" [2010-09-11 2735200]

    [HKEY_CLASSES_ROOT\clsid\{548f6736-8fe4-4680-82f2-170d6c07e1d2}]

    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
    "{548F6736-8FE4-4680-82F2-170D6C07E1D2}"= "c:\program files\TranslatorBar_1.2\tbTra0.dll" [2010-09-11 2735200]

    [HKEY_CLASSES_ROOT\clsid\{548f6736-8fe4-4680-82f2-170d6c07e1d2}]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "cdloader"="c:\documents and settings\Donna Militello\Application Data\mjusbsp\cdloader2.exe" [2010-10-08 50592]
    "DW6"="c:\program files\The Weather Channel FW\Desktop\DesktopWeather.exe" [2009-10-08 818288]
    "ISUSScheduler"="c:\program files\common files\installshield\updateservice\issch.exe" [2008-10-24 79136]
    "AOL Fast Start"="c:\program files\AOL 9.1\AOL.EXE" [2007-10-31 50528]
    "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "PDVDDXSrv"="c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2006-10-20 118784]
    "HostManager"="c:\program files\Common Files\AOL\1206122613\ee\AOLSoftware.exe" [2008-06-24 41824]
    "WrtMon.exe"="c:\windows\system32\spool\drivers\w32x86\3\WrtMon.exe" [2007-04-11 26704]
    "lxdomon.exe"="c:\program files\Lexmark 9500 Series\lxdomon.exe" [2007-09-06 450560]
    "lxdoamon"="c:\program files\Lexmark 9500 Series\lxdoamon.exe" [2007-08-10 20480]
    "Lexmark 9500 Series Fax Server"="c:\program files\Lexmark 9500 Series\fm3032.exe" [2007-09-18 307200]
    "RoxioDragToDisc"="c:\program files\Roxio\Drag-to-Disc\DrgToDsc.exe" [2006-08-17 1116920]
    "AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-08-13 177440]
    "nmctxth"="c:\program files\Common Files\Pure Networks Shared\Platform\nmctxth.exe" [2008-12-12 642856]
    "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-11-11 417792]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2010-09-24 40368]
    "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-01-23 141608]
    "ISUSPM Startup"="c:\progra~1\common~1\instal~1\update~1\isuspm.exe" [2004-07-27 221184]
    "IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-08-18 150040]
    "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-08-18 170520]
    "Persistence"="c:\windows\system32\igfxpers.exe" [2008-08-18 141848]
    "SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2007-08-01 1036288]
    "IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-10-03 178712]
    "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
    "PC Pitstop PC Matic Reminder"="c:\program files\PCPitstop\PC Matic\Reminder-PCMatic.exe" [2010-10-13 324848]
    "avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-08-02 281768]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "StartUp This"="c:\program files\Laplink\PCmover\LaunchSt.exe" [2008-08-26 251184]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
    "PCmover MapiFix"="c:\program files\Laplink\PCmover\mapifix.exe" [2008-08-26 66864]

    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    NkbMonitor.exe.lnk - c:\program files\Nikon\PictureProject\NkbMonitor.exe [2009-12-18 118784]
    WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2010-10-29 612168]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
    @=""

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
    backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
    backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^BigFix.lnk]
    backup=c:\windows\pss\BigFix.lnkCommon Startup
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\BigFix.lnk

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^hp psc 2000 Series.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\hp psc 2000 Series.lnk
    backup=c:\windows\pss\hp psc 2000 Series.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^hpoddt01.exe.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\hpoddt01.exe.lnk
    backup=c:\windows\pss\hpoddt01.exe.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Image Transfer.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Image Transfer.lnk
    backup=c:\windows\pss\Image Transfer.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech Desktop Messenger.lnk]
    backup=c:\windows\pss\Logitech Desktop Messenger.lnkCommon Startup
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Logitech Desktop Messenger.lnk

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech SetPoint.lnk]
    backup=c:\windows\pss\Logitech SetPoint.lnkCommon Startup
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Logitech SetPoint.lnk

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
    backup=c:\windows\pss\Microsoft Office.lnkCommon Startup
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Sonic CinePlayer Quick Launch.lnk]
    backup=c:\windows\pss\Sonic CinePlayer Quick Launch.lnkCommon Startup
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Sonic CinePlayer Quick Launch.lnk

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Symantec Fax Starter Edition Port.lnk]

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Windows Desktop Search.lnk]
    backup=c:\windows\pss\Windows Desktop Search.lnkCommon Startup
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Windows Desktop Search.lnk

    [HKLM\~\startupfolder\C:^Documents and Settings^Donna^Start Menu^Programs^Startup^America Online 5.0 Tray Icon.lnk]
    backup=c:\windows\pss\America Online 5.0 Tray Icon.lnkStartup
    path=c:\documents and settings\Donna\Start Menu\Programs\Startup\America Online 5.0 Tray Icon.lnk

    [HKLM\~\startupfolder\C:^Documents and Settings^Donna^Start Menu^Programs^Startup^LimeWire On Startup.lnk]
    backup=c:\windows\pss\LimeWire On Startup.lnkStartup
    path=c:\documents and settings\Donna\Start Menu\Programs\Startup\LimeWire On Startup.lnk

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
    c:\windows\system32\dumprep 0 -k [X]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
    2010-09-24 09:15 40368 ----a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOLDialer]
    2006-10-23 12:50 71216 ----a-r- c:\program files\Common Files\AOL\ACS\AOLDial.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
    2008-04-14 00:12 15360 ----a-w- c:\windows\system32\ctfmon.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ECenter]
    2007-05-24 12:03 17920 -c--a-w- c:\dell\E-Center\EULALauncher.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Fellowes Proxy]
    2003-01-21 22:48 86016 ----a-w- c:\windows\system32\r3proxy.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
    2008-08-18 17:59 170520 ----a-w- c:\windows\system32\hkcmd.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IAAnotif]
    2007-10-03 19:44 178712 ----a-w- c:\program files\Intel\Intel Matrix Storage Manager\IAAnotif.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
    2010-01-23 00:16 141608 ----a-w- c:\program files\iTunes\iTunesHelper.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Hardware Abstraction Layer]
    2007-01-23 20:44 101136 ----a-w- c:\windows\KHALMNPR.Exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MimBoot]
    2006-11-07 20:41 8192 ----a-w- c:\progra~1\MUSICM~1\MUSICM~1\mimboot.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray]
    2006-11-07 20:41 110592 ----a-w- c:\program files\MusicMatch\MusicMatch Jukebox\mm_tray.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
    2008-04-14 00:12 1695232 ----a-w- c:\program files\Messenger\msmsgs.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
    2003-12-18 04:02 4677632 ----a-w- c:\program files\MSN Messenger\msnmsgr.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
    2003-10-06 19:16 5058560 ----a-w- c:\windows\system32\nvcpl.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCDRealtime]
    2004-08-29 18:07 91648 ----a-w- c:\windows\realtime.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
    2008-08-18 17:59 141848 ----a-w- c:\windows\system32\igfxpers.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
    2009-11-11 04:08 417792 ----a-w- c:\program files\QuickTime\QTTask.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
    2008-03-15 01:00 26112 ----a-w- c:\program files\Real\RealPlayer\realplay.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxioDragToDisc]
    2006-08-17 13:00 1116920 ----a-w- c:\program files\Roxio\Drag-to-Disc\DrgToDsc.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP]
    2007-08-01 18:52 1036288 ----a-w- c:\program files\Analog Devices\Core\smax4pnp.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "UPS"=3 (0x3)
    "TermService"=3 (0x3)
    "TapiSrv"=2 (0x2)
    "SCardSvr"=3 (0x3)
    "RemoteRegistry"=2 (0x2)
    "RDSessMgr"=3 (0x3)
    "Netlogon"=3 (0x3)
    "mnmsrvc"=3 (0x3)
    "FastUserSwitchingCompatibility"=3 (0x3)
    "CiSvc"=3 (0x3)
    "Browser"=2 (0x2)

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
    "LDM"=c:\program files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
    "Mozilla Quick Launch"="c:\program files\Netscape\Netscape\Netscp.exe" -turbo

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
    "Adaptec DirectCD"=c:\progra~1\HPCD-W~1\DIRECTCD\DIRECTCD.EXE
    "CriticalUpdate"=c:\windows\SYSTEM32\WUCRTUPD.EXE -startup

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\setup\disabledrunkeys]
    "ICSMGR"=ICSMGR.EXE
    "LexStart"=Lexstart.exe
    "MMTray"=c:\program files\MusicMatch\MusicMatch Jukebox\mm_tray.exe
    "QuickTime Task"="c:\windows\SYSTEM32\QTTASK.EXE" -atboottime

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices-]
    "AolAcsDaemon1"="c:\program files\COMMON FILES\AOL\ACS\ACSD.EXE"
    "CSINJECT.EXE"=c:\program files\Norton CleanSweep\CSINJECT.EXE
    "LoadPowerProfile"=Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    "SchedulingAgent"=mstask.exe

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
    "c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=
    "c:\\Program Files\\Common Files\\AOL\\1206122613\\ee\\aolsoftware.exe"=
    "c:\\Program Files\\Common Files\\AOL\\TopSpeed\\3.0\\aoltpsd3.exe"=
    "c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
    "c:\\Program Files\\Common Files\\AOL\\System Information\\sinf.exe"=
    "c:\\Program Files\\Lexmark 9500 Series\\lxdomon.exe"=
    "c:\\Program Files\\Lexmark 9500 Series\\lxdoamon.exe"=
    "c:\\Program Files\\Lexmark 9500 Series\\FRun.exe"=
    "c:\\Program Files\\Abbyy FineReader 6.0 Sprint\\scan\\scanman6.exe"=
    "c:\\Program Files\\Lexmark 9500 Series\\lxdofax.exe"=
    "c:\\WINDOWS\\system32\\lxdocoms.exe"=
    "c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdopswx.exe"=
    "c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdotime.exe"=
    "c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdojswx.exe"=
    "c:\\Program Files\\AOL 9.1\\waol.exe"=
    "c:\\Program Files\\Lexmark 9500 Series\\Wireless\\lxdowpss.exe"=
    "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
    "c:\\Program Files\\iTunes\\iTunes.exe"=
    "c:\\Documents and Settings\\Donna Militello\\Application Data\\mjusbsp\\magicJack.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "67:UDP"= 67:UDP:DHCP Discovery Service

    R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [11/14/2010 7:13 AM 135336]
    R2 LinksysUpdater;Linksys Updater;c:\program files\Linksys\Linksys Updater\bin\LinksysUpdater.exe [11/13/2008 2:43 PM 204800]
    R2 lxdo_device;lxdo_device;c:\windows\system32\lxdocoms.exe -service --> c:\windows\system32\lxdocoms.exe -service [?]
    S2 ASFIPmon;Broadcom ASF IP and SMBIOS Mailbox Monitor;c:\program files\Broadcom\ASFIPMon\AsfIpMon.exe [6/20/2007 1:30 PM 79168]
    S2 lxdoCATSCustConnectService;lxdoCATSCustConnectService;c:\windows\system32\spool\drivers\w32x86\3\lxdoserv.exe [7/24/2008 10:03 PM 94208]
    S3 cpudrv;cpudrv;c:\program files\SystemRequirementsLab\cpudrv.sys [12/18/2009 9:58 AM 11336]
    S3 LLUSBFLT;LLUSBFLT;c:\windows\system32\drivers\llusbflt.sys [1/28/2009 5:15 PM 4736]
    S3 PCPitstop Scheduling;PCPitstop Scheduling;c:\program files\PCPitstop\PCPitstopScheduleService.exe [11/13/2010 7:04 PM 90864]
    S3 PLUsbbc2;High-Speed USB Bridge Cable Driver;c:\windows\system32\drivers\usbbc2.sys [1/28/2009 5:15 PM 8960]
    S3 RoxMediaDB11;RoxMediaDB11;c:\program files\Common Files\Roxio Shared\11.0\SharedCOM\RoxMediaDB11.exe [11/17/2008 10:51 AM 1128944]

    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9EF0045A-CDD9-438e-95E6-02B9AFEC8E11}]
    2001-03-23 21:17 7168 ----a-w- c:\windows\system32\UPDCRL.EXE
    .
    Contents of the 'Scheduled Tasks' folder

    2010-11-13 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]

    2008-06-29 c:\windows\Tasks\FRU Task 2003-04-06 08:52ewlett-Packard2003-04-06 08:52p psc 2170 series5E771253C1676EBED677BF361FDFC537825E15B8205861613.job
    - c:\program files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe [2003-04-06 04:52]

    2008-07-03 c:\windows\Tasks\FRU Task 2003-04-06 08:52ewlett-Packard2003-04-06 08:52p psc 2170 series5E771253C1676EBED677BF361FDFC537825E15B8205865305.job
    - c:\program files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe [2003-04-06 04:52]

    2010-11-15 c:\windows\Tasks\OGALogon.job
    - c:\windows\system32\OGAEXEC.exe [2009-08-03 20:07]

    2010-11-15 c:\windows\Tasks\User_Feed_Synchronization-{F6F43152-6187-43E6-AED5-B7F92EA5A2EE}.job
    - c:\windows\system32\msfeedssync.exe [2007-08-13 09:31]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = about:blank
    uSearchMigratedDefaultURL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
    uInternet Connection Wizard,ShellNext = hxxp://partnerpage.google.com/smallbiz.dell.com/en_us?hl=en&client=dell-usuk&channel=us-smb&ibd=0080311
    uInternet Settings,ProxyOverride = <local>
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
    IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html
    Trusted Zone: internet
    Trusted Zone: mcafee.com
    Trusted Zone: pogo.com\www
    Trusted Zone: musicmatch.com\online
    DPF: DirectAnimation Java Classes
    DPF: Microsoft XML Parser for Java
    DPF: Win32 Classes
    DPF: {070DC617-E3B7-468B-A29C-D4E84FAE938C} - hxxp://utilities.pcpitstop.com/Nirvana/controls/pcmatic.cab
    .
    - - - - ORPHANS REMOVED - - - -

    URLSearchHooks-{00bf7b9c-acd2-4080-bea8-b1c41987070f} - (no file)
    BHO-{201f27d4-3704-41d6-89c1-aa35e39143ed} - c:\program files\AskBarDis\bar\bin\askBar.dll
    Toolbar-{3041d03e-fd4b-44e0-b742-2d9b88305f98} - (no file)
    WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file)
    WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
    ShellIconOverlayIdentifiers-{7D688A77-C613-11D0-999B-00C04FD655E1} - (no file)
    HKLM-Run-EmailScan - c:\program files\mcafee.com\antivirus\mcvsescn.exe
    MSConfigStartUp-AOL Fast Start - c:\program files\America Online 9.0a\AOL.EXE
    MSConfigStartUp-AOLSPScheduler - c:\program files\Common Files\AOL\1100814799\ee\services\safetyCore\ver210_5_2_1\AOLSP Scheduler.exe
    MSConfigStartUp-catole - c:\windows\Driver Cache\catole.exe
    MSConfigStartUp-dvdsys - c:\windows\java\Packages\dvdsys.exe
    MSConfigStartUp-Google Desktop Search - c:\program files\Google\Google Desktop Search\GoogleDesktop.exe
    MSConfigStartUp-HostManager - c:\program files\Common Files\AOL\1100814799\ee\AOLSoftware.exe
    MSConfigStartUp-HP Software Update - c:\program files\Hp\HP Software Update\HPWuSchd2.exe
    MSConfigStartUp-IPInSightLAN 01 - c:\program files\Verizon Online\Visual IP InSight\IPClient.exe
    MSConfigStartUp-IPInSightMonitor 01 - c:\program files\Verizon Online\Visual IP InSight\IPMon32.exe
    MSConfigStartUp-LDM - c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
    MSConfigStartUp-lphclfkj0e531 - c:\windows\system32\lphclfkj0e531.exe
    MSConfigStartUp-MPFExe - c:\program files\mcafee.com\personal firewall\MPfTray.exe
    MSConfigStartUp-OASClnt - c:\program files\mcafee.com\antivirus\oasclnt.exe
    MSConfigStartUp-PC Pitstop Optimize Reminder - c:\program files\PCPitstop\Optimize2\Reminder.exe
    MSConfigStartUp-Pure Networks Port Magic - c:\progra~1\PURENE~1\PORTMA~1\PortAOL.exe
    MSConfigStartUp-SMrhcgfkj0e531 - c:\program files\rhcgfkj0e531\rhcgfkj0e531.exe
    MSConfigStartUp-SNM - c:\program files\SpyNoMore\SNM.exe
    MSConfigStartUp-sscRun - c:\program files\Common Files\AOL\1100814799\ee\SSCRun.exe
    MSConfigStartUp-SunJavaUpdateSched - c:\program files\Java\jre6\bin\jusched.exe
    MSConfigStartUp-swg - c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    MSConfigStartUp-TkBellExe - c:\program files\Common Files\Real\Update_OB\realsched.exe
    MSConfigStartUp-ViewMgr - c:\program files\Viewpoint\Viewpoint Manager\ViewMgr_.exe
    MSConfigStartUp-WildTangent CDA - c:\program files\WildTangent\Apps\CDA\cdaEngine0400.dll
    AddRemove-AOL Toolbar 5.0 - c:\program files\AOL\AOL Toolbar 5.0\uninstall.exe



    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2010-11-15 16:01
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
    @Denied: (A 2) (Everyone)
    @="FlashBroker"
    "LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101"

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
    "Enabled"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
    @="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe"

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
    @Denied: (A 2) (Everyone)
    @="IFlashBroker4"

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
    @="{00020424-0000-0000-C000-000000000046}"

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    "Version"="1.0"
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'winlogon.exe'(708)
    c:\windows\system32\l3codeca.acm

    - - - - - - - > 'explorer.exe'(3724)
    c:\windows\system32\WININET.dll
    c:\windows\system32\hccutils.DLL
    c:\windows\system32\ieframe.dll
    c:\windows\system32\dfshim.dll
    c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll
    c:\windows\system32\webcheck.dll
    c:\windows\system32\WPDShServiceObj.dll
    c:\program files\Roxio\Drag-to-Disc\Shellex.dll
    c:\windows\system32\DLAAPI_W.DLL
    c:\windows\system32\CDRTC.DLL
    c:\program files\Roxio\Drag-to-Disc\ShellRes.dll
    c:\windows\system32\PortableDeviceTypes.dll
    c:\windows\system32\PortableDeviceApi.dll
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\program files\Avira\AntiVir Desktop\avguard.exe
    c:\windows\system32\spool\drivers\w32x86\3\WrtProc.exe
    c:\program files\Common Files\AOL\ACS\AOLacsd.exe
    c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    c:\program files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
    c:\program files\Java\jre6\bin\jqs.exe
    c:\program files\Avira\AntiVir Desktop\avshadow.exe
    c:\windows\system32\igfxsrvc.exe
    c:\program files\AOL 9.1\waol.exe
    c:\windows\system32\lxdocoms.exe
    c:\windows\system32\java.exe
    c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
    c:\program files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
    c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
    c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe
    c:\program files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
    c:\program files\iPod\bin\iPodService.exe
    c:\program files\AOL 9.1\shellmon.exe
    c:\program files\Common Files\Java\Java Update\jucheck.exe
    .
    **************************************************************************
    .
    Completion time: 2010-11-15 16:07:24 - machine was rebooted
    ComboFix-quarantined-files.txt 2010-11-15 21:07

    Pre-Run: 9,362,862,080 bytes free
    Post-Run: 9,275,228,160 bytes free

    WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
    [boot loader]
    timeout=2
    default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
    [operating systems]
    c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
    UnsupportedDebug="do not select this" /debug
    multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

    - - End Of File - - FA24B92DB426581C4024F56B4DB73E26
    MBRCheck, version 1.2.3
    (c) 2010, AD

    Command-line:
    Windows Version: Windows XP Professional
    Windows Information: Service Pack 3 (build 2600)
    Logical Drives Mask: 0x000000fc

    Kernel Drivers (total 148):
    0x804D7000 \WINDOWS\system32\ntkrnlpa.exe
    0x806E4000 \WINDOWS\system32\hal.dll
    0xBA5A8000 \WINDOWS\system32\KDCOM.DLL
    0xBA4B8000 \WINDOWS\system32\BOOTVID.dll
    0xB9F79000 ACPI.sys
    0xBA5AA000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
    0xB9F68000 pci.sys
    0xBA0A8000 isapnp.sys
    0xBA670000 pciide.sys
    0xBA328000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
    0xBA0B8000 MountMgr.sys
    0xB9F49000 ftdisk.sys
    0xBA5AC000 dmload.sys
    0xB9F23000 dmio.sys
    0xBA330000 PartMgr.sys
    0xBA0C8000 VolSnap.sys
    0xB9F0B000 atapi.sys
    0xB9E43000 iaStor.sys
    0xBA0D8000 disk.sys
    0xBA0E8000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
    0xB9E23000 fltmgr.sys
    0xB9E11000 sr.sys
    0xBA0F8000 PxHelp20.sys
    0xB9DFB000 DRVMCDB.SYS
    0xB9DE4000 KSecDD.sys
    0xB9D57000 Ntfs.sys
    0xB9D2A000 NDIS.sys
    0xB9D10000 Mup.sys
    0xBA128000 \SystemRoot\system32\DRIVERS\intelppm.sys
    0xB88AF000 \SystemRoot\system32\DRIVERS\igxpmp32.sys
    0xB889B000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
    0xB8873000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
    0xB8848000 \SystemRoot\system32\DRIVERS\b57xp32.sys
    0xBA4A0000 \SystemRoot\system32\DRIVERS\usbuhci.sys
    0xB8824000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
    0xBA4A8000 \SystemRoot\system32\DRIVERS\usbehci.sys
    0xB8810000 \SystemRoot\system32\DRIVERS\parport.sys
    0xBA138000 \SystemRoot\system32\DRIVERS\serial.sys
    0xB96CA000 \SystemRoot\system32\DRIVERS\serenum.sys
    0xBA148000 \SystemRoot\system32\DRIVERS\imapi.sys
    0xBA158000 \SystemRoot\System32\Drivers\AFS2K.SYS
    0xBA630000 \SystemRoot\System32\Drivers\DLACDBHM.SYS
    0xBA168000 \SystemRoot\system32\DRIVERS\cdrom.sys
    0xBA178000 \SystemRoot\system32\DRIVERS\redbook.sys
    0xB87ED000 \SystemRoot\system32\DRIVERS\ks.sys
    0xBA4B0000 \SystemRoot\System32\Drivers\GEARAspiWDM.sys
    0xBA632000 \SystemRoot\system32\DRIVERS\serscan.sys
    0xBA7D2000 \SystemRoot\system32\DRIVERS\audstub.sys
    0xBA188000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
    0xB96C2000 \SystemRoot\system32\DRIVERS\ndistapi.sys
    0xB87D6000 \SystemRoot\system32\DRIVERS\ndiswan.sys
    0xBA198000 \SystemRoot\system32\DRIVERS\raspppoe.sys
    0xB8EFE000 \SystemRoot\system32\DRIVERS\raspptp.sys
    0xBA340000 \SystemRoot\system32\DRIVERS\TDI.SYS
    0xB87C5000 \SystemRoot\system32\DRIVERS\psched.sys
    0xB8EEE000 \SystemRoot\system32\DRIVERS\msgpc.sys
    0xBA350000 \SystemRoot\system32\DRIVERS\ptilink.sys
    0xBA358000 \SystemRoot\system32\DRIVERS\raspti.sys
    0xBA360000 \SystemRoot\system32\DRIVERS\wanatw4.sys
    0xB8795000 \SystemRoot\system32\DRIVERS\rdpdr.sys
    0xB8EDE000 \SystemRoot\system32\DRIVERS\termdd.sys
    0xBA368000 \SystemRoot\system32\DRIVERS\kbdclass.sys
    0xBA370000 \SystemRoot\system32\DRIVERS\mouclass.sys
    0xBA634000 \SystemRoot\system32\DRIVERS\swenum.sys
    0xB8737000 \SystemRoot\system32\DRIVERS\update.sys
    0xBA584000 \SystemRoot\system32\DRIVERS\mssmbios.sys
    0xBA2E8000 \SystemRoot\System32\Drivers\NDProxy.SYS
    0xA40B6000 \SystemRoot\system32\drivers\ADIHdAud.sys
    0xA4092000 \SystemRoot\system32\drivers\portcls.sys
    0xBA2F8000 \SystemRoot\system32\drivers\drmk.sys
    0xA4032000 \SystemRoot\system32\drivers\Senfilt.sys
    0xA6C66000 \SystemRoot\system32\DRIVERS\usbhub.sys
    0xBA5C6000 \SystemRoot\system32\DRIVERS\USBD.SYS
    0xA71AE000 \SystemRoot\System32\Drivers\i2omgmt.SYS
    0xBA5CC000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
    0xA2992000 \SystemRoot\System32\Drivers\Null.SYS
    0xBA5CE000 \SystemRoot\System32\Drivers\Beep.SYS
    0xA6E54000 \SystemRoot\System32\Drivers\DLARTL_M.SYS
    0xA6E4C000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
    0xA3C1B000 \SystemRoot\System32\drivers\vga.sys
    0xBA5D0000 \SystemRoot\System32\Drivers\mnmdd.SYS
    0xBA5D2000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
    0xA3C13000 \SystemRoot\System32\Drivers\Msfs.SYS
    0xA3C0B000 \SystemRoot\System32\Drivers\Npfs.SYS
    0xA71A2000 \SystemRoot\system32\DRIVERS\rasacd.sys
    0xA245B000 \SystemRoot\system32\DRIVERS\ipsec.sys
    0xA2402000 \SystemRoot\system32\DRIVERS\tcpip.sys
    0xA23DA000 \SystemRoot\system32\DRIVERS\netbt.sys
    0xA23B4000 \SystemRoot\system32\DRIVERS\ipnat.sys
    0xA2392000 \SystemRoot\System32\drivers\afd.sys
    0xA3E3A000 \SystemRoot\system32\DRIVERS\netbios.sys
    0xA3C03000 \SystemRoot\system32\DRIVERS\ssmdrv.sys
    0xA2367000 \SystemRoot\system32\DRIVERS\rdbss.sys
    0xA22F7000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
    0xA3E2A000 \SystemRoot\System32\Drivers\Fips.SYS
    0xA22C0000 \SystemRoot\system32\DRIVERS\avipbb.sys
    0xBA5E2000 \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys
    0xA1A89000 \SystemRoot\system32\DRIVERS\wanarp.sys
    0xA2486000 \SystemRoot\system32\DRIVERS\usbccgp.sys
    0xA1332000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
    0xA1445000 \SystemRoot\system32\drivers\usbaudio.sys
    0xA1D2B000 \SystemRoot\system32\DRIVERS\hidusb.sys
    0xA1435000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
    0xA1D27000 \SystemRoot\system32\DRIVERS\usbscan.sys
    0xA132A000 \SystemRoot\system32\DRIVERS\usbprint.sys
    0x98A31000 \SystemRoot\system32\DRIVERS\kbdhid.sys
    0x979E2000 \SystemRoot\system32\DRIVERS\NuidFltr.sys
    0x9815B000 \SystemRoot\system32\DRIVERS\WDFLDR.SYS
    0x96ED5000 \SystemRoot\system32\DRIVERS\Wdf01000.sys
    0x98A2D000 \SystemRoot\system32\DRIVERS\mouhid.sys
    0x96EB1000 \SystemRoot\System32\Drivers\Fastfat.SYS
    0x9812B000 \SystemRoot\System32\Drivers\Cdfs.SYS
    0x96DE9000 \SystemRoot\System32\Drivers\dump_iaStor.sys
    0xBF800000 \SystemRoot\System32\win32k.sys
    0x97A36000 \SystemRoot\System32\drivers\Dxapi.sys
    0x9751A000 \SystemRoot\System32\watchdog.sys
    0xBF000000 \SystemRoot\System32\drivers\dxg.sys
    0xBA6FB000 \SystemRoot\System32\drivers\dxgthk.sys
    0xBF024000 \SystemRoot\System32\igxpgd32.dll
    0xBF012000 \SystemRoot\System32\igxprd32.dll
    0xBF04F000 \SystemRoot\System32\igxpdv32.DLL
    0xBF25B000 \SystemRoot\System32\igxpdx32.DLL
    0x96DD4000 \SystemRoot\system32\DRIVERS\avgntflt.sys
    0x9E5E9000 \SystemRoot\System32\Drivers\DRVNDDM.SYS
    0x972AF000 \SystemRoot\System32\DLA\DLADResM.SYS
    0x96DBC000 \SystemRoot\System32\DLA\DLAIFS_M.SYS
    0x9703A000 \SystemRoot\System32\DLA\DLAOPIOM.SYS
    0x971D5000 \SystemRoot\System32\DLA\DLAPoolM.SYS
    0x97032000 \SystemRoot\System32\DLA\DLABMFSM.SYS
    0x9702A000 \SystemRoot\System32\DLA\DLABOIOM.SYS
    0x96DA6000 \SystemRoot\System32\DLA\DLAUDFAM.SYS
    0x96D8F000 \SystemRoot\System32\DLA\DLAUDF_M.SYS
    0xBFFA0000 \SystemRoot\System32\ATMFD.DLL
    0xBA1C8000 \SystemRoot\system32\DRIVERS\ipfltdrv.sys
    0xA22A0000 \SystemRoot\system32\DRIVERS\ndisuio.sys
    0xA0FF1000 \SystemRoot\system32\DRIVERS\pnarp.sys
    0xA0FE9000 \SystemRoot\system32\DRIVERS\purendis.sys
    0x96D2A000 \SystemRoot\system32\drivers\wdmaud.sys
    0x97257000 \SystemRoot\system32\drivers\sysaudio.sys
    0x96CAF000 \SystemRoot\system32\DRIVERS\mrxdav.sys
    0xBA5DA000 \SystemRoot\System32\Drivers\ASCTRM.SYS
    0x95FD1000 \SystemRoot\system32\DRIVERS\srv.sys
    0xBA5E0000 \SystemRoot\System32\Drivers\MASPINT.SYS
    0x95771000 \SystemRoot\System32\Drivers\HTTP.sys
    0x98E91000 \??\C:\Program Files\Broadcom\WMI\BASFND.sys
    0x97A26000 \SystemRoot\system32\DRIVERS\asyncmac.sys
    0x8A907000 \SystemRoot\system32\drivers\kmixer.sys
    0x7C900000 \WINDOWS\system32\ntdll.dll

    Processes (total 63):
    0 System Idle Process
    4 System
    632 C:\WINDOWS\system32\smss.exe
    684 csrss.exe
    708 C:\WINDOWS\system32\winlogon.exe
    752 C:\WINDOWS\system32\services.exe
    764 C:\WINDOWS\system32\lsass.exe
    1016 C:\WINDOWS\system32\svchost.exe
    1060 svchost.exe
    1156 C:\WINDOWS\system32\svchost.exe
    1328 svchost.exe
    1408 svchost.exe
    1552 C:\WINDOWS\system32\spoolsv.exe
    1624 C:\Program Files\Avira\AntiVir Desktop\sched.exe
    1812 svchost.exe
    1968 C:\WINDOWS\explorer.exe
    276 C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
    284 C:\Program Files\Common Files\AOL\1206122613\ee\aolsoftware.exe
    292 C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe
    304 C:\Program Files\Lexmark 9500 Series\lxdomon.exe
    300 C:\Program Files\Lexmark 9500 Series\lxdoamon.exe
    328 C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe
    472 C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe
    508 C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtProc.exe
    600 C:\Program Files\iTunes\iTunesHelper.exe
    676 C:\WINDOWS\system32\hkcmd.exe
    688 C:\WINDOWS\system32\igfxpers.exe
    1104 C:\WINDOWS\system32\igfxsrvc.exe
    1120 C:\Program Files\Analog Devices\Core\smax4pnp.exe
    1224 C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
    1256 C:\Program Files\Common Files\Java\Java Update\jusched.exe
    1296 C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
    1388 C:\WINDOWS\system32\ctfmon.exe
    1540 C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
    1744 C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
    2260 C:\Program Files\Avira\AntiVir Desktop\avguard.exe
    2292 C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    2304 C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe
    2368 C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
    2416 C:\Program Files\Java\jre6\bin\jqs.exe
    2432 C:\Program Files\Linksys\Linksys Updater\bin\LinksysUpdater.exe
    2704 C:\WINDOWS\system32\lxdocoms.exe
    2720 C:\WINDOWS\system32\java.exe
    2796 sqlservr.exe
    2892 C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
    2996 sqlbrowser.exe
    3112 C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
    3152 C:\WINDOWS\system32\svchost.exe
    3180 C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
    3264 C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
    3536 C:\Documents and Settings\Donna Militello\Application Data\mjusbsp\magicJack.exe
    188 C:\WINDOWS\system32\WISPTIS.EXE
    2508 C:\Program Files\iPod\bin\iPodService.exe
    1248 alg.exe
    3512 C:\WINDOWS\system32\svchost.exe
    496 C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe
    1712 C:\Program Files\Common Files\Java\Java Update\jucheck.exe
    2576 C:\Program Files\WinZip\WZQKPICK.EXE
    3452 C:\Program Files\AOL 9.1\waol.exe
    2924 C:\Program Files\AOL 9.1\shellmon.exe
    2112 C:\Program Files\Common Files\AOL\TopSpeed\3.0\aoltpsd3.exe
    1088 C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdopswx.exe
    4004 C:\Documents and Settings\Donna Militello\Local Settings\Temporary Internet Files\Content.IE5\I03NJGOI\MBRCheck[1].exe

    \\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`02f10c00 (NTFS)
    \\.\D: --> \\.\PhysicalDrive0 at offset 0x0000000f`03adbe00 (NTFS)

    PhysicalDrive0 Model Number: WDCWD1600YS-18SHB2, Rev: 20.06C07

    Size Device Name MBR Status
    --------------------------------------------
    149 GB \\.\PhysicalDrive0 Windows XP MBR code detected
    SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A


    Done!
     
  6. Broni

    Broni Malware Annihilator Posts: 52,892   +344

    Combofix looks good now :)

    How is redirection, btw?

    Download OTL to your Desktop.

    • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
    • Under the Custom Scan box paste this in:


    netsvcs
    drivers32
    %SYSTEMDRIVE%\*.*
    %systemroot%\Fonts\*.com
    %systemroot%\Fonts\*.dll
    %systemroot%\Fonts\*.ini
    %systemroot%\Fonts\*.ini2
    %systemroot%\Fonts\*.exe
    %systemroot%\system32\spool\prtprocs\w32x86\*.*
    %systemroot%\REPAIR\*.bak1
    %systemroot%\REPAIR\*.ini
    %systemroot%\system32\*.jpg
    %systemroot%\*.jpg
    %systemroot%\*.png
    %systemroot%\*.scr
    %systemroot%\*._sy
    %APPDATA%\Adobe\Update\*.*
    %ALLUSERSPROFILE%\Favorites\*.*
    %APPDATA%\Microsoft\*.*
    %PROGRAMFILES%\*.*
    %APPDATA%\Update\*.*
    %systemroot%\*. /mp /s
    CREATERESTOREPOINT
    %systemroot%\System32\config\*.sav
    %PROGRAMFILES%\bak. /s
    %systemroot%\system32\bak. /s
    %ALLUSERSPROFILE%\Start Menu\*.lnk /x
    %systemroot%\system32\config\systemprofile\*.dat /x
    %systemroot%\*.config
    %systemroot%\system32\*.db
    %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
    %USERPROFILE%\Desktop\*.exe
    %PROGRAMFILES%\Common Files\*.*
    %systemroot%\*.src
    %systemroot%\install\*.*
    %systemroot%\system32\DLL\*.*
    %systemroot%\system32\HelpFiles\*.*
    %systemroot%\system32\rundll\*.*
    %systemroot%\winn32\*.*
    %systemroot%\Java\*.*
    %systemroot%\system32\test\*.*
    %systemroot%\system32\Rundll32\*.*
    %systemroot%\AppPatch\Custom\*.*
    %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x
    %PROGRAMFILES%\PC-Doctor\Downloads\*.*
    %PROGRAMFILES%\Internet Explorer\*.tmp
    %PROGRAMFILES%\Internet Explorer\*.dat
    %USERPROFILE%\My Documents\*.exe
    %USERPROFILE%\*.exe
    %systemroot%\ADDINS\*.*
    %systemroot%\assembly\*.bak2
    %systemroot%\Config\*.*
    %systemroot%\REPAIR\*.bak2
    %systemroot%\SECURITY\Database\*.sdb /x
    %systemroot%\SYSTEM\*.bak2
    %systemroot%\Web\*.bak2
    %systemroot%\Driver Cache\*.*
    %PROGRAMFILES%\Mozilla Firefox\0*.exe
    %ProgramFiles%\Microsoft Common\*.*
    %ProgramFiles%\TinyProxy.
    %USERPROFILE%\Favorites\*.url /x
    %systemroot%\system32\*.bk
    %systemroot%\*.te
    %systemroot%\system32\system32\*.*
    %ALLUSERSPROFILE%\*.dat /x
    %systemroot%\system32\drivers\*.rmv
    dir /b "%systemroot%\system32\*.exe" | find /i " " /c
    dir /b "%systemroot%\*.exe" | find /i " " /c
    %PROGRAMFILES%\Microsoft\*.*
    %systemroot%\System32\Wbem\proquota.exe
    %PROGRAMFILES%\Mozilla Firefox\*.dat
    %USERPROFILE%\Cookies\*.txt /x
    %SystemRoot%\system32\fonts\*.*
    %systemroot%\system32\winlog\*.*
    %systemroot%\system32\Language\*.*
    %systemroot%\system32\Settings\*.*
    %systemroot%\system32\*.quo
    %SYSTEMROOT%\AppPatch\*.exe
    %SYSTEMROOT%\inf\*.exe
    %SYSTEMROOT%\Installer\*.exe
    %systemroot%\system32\config\*.bak2
    %systemroot%\system32\Computers\*.*
    %SystemRoot%\system32\Sound\*.*
    %SystemRoot%\system32\SpecialImg\*.*
    %SystemRoot%\system32\code\*.*
    %SystemRoot%\system32\draft\*.*
    %SystemRoot%\system32\MSSSys\*.*
    %ProgramFiles%\Javascript\*.*
    %systemroot%\pchealth\helpctr\System\*.exe /s
    %systemroot%\Web\*.exe
    %systemroot%\system32\msn\*.*
    %systemroot%\system32\*.tro
    %AppData%\Microsoft\Installer\msupdates\*.*
    %ProgramFiles%\Messenger\*.*
    %systemroot%\system32\systhem32\*.*
    %systemroot%\system\*.exe
    HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
    /md5start
    /md5stop


    • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
    • When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
    • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.
     
  7. dmill

    dmill TS Rookie Topic Starter

    Redirect no longer shows in german. Mini "google" search window to the right of my main search window. When you typed any search in there it would come up to nederland. Is there any way I can remove this small window?

    In the meantime here are the two files. You have been really very helpful and very patient I am very appreciative of your efforts. Thank you very much! You rock!

    According to the forum the text was too long to attach both files on the same message. I had to break the OTL file out into two sections. This is the first section. Hopefully the second section of hte OTL file and the Extras file will be in another message.

    OTL logfile created on: 11/15/2010 8:09:44 PM - Run 1
    OTL by OldTimer - Version 3.2.17.3 Folder = C:\Documents and Settings\Administrator\Desktop\Desktop
    Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
    Internet Explorer (Version = 8.0.6001.18702)
    Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

    2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 72.00% Memory free
    4.00 Gb Paging File | 3.00 Gb Available in Paging File | 86.00% Paging File free
    Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
    Drive C: | 60.00 Gb Total Space | 8.33 Gb Free Space | 13.87% Space Free | Partition Type: NTFS
    Drive D: | 88.95 Gb Total Space | 88.60 Gb Free Space | 99.60% Space Free | Partition Type: NTFS
    Unable to calculate disk information.

    Computer Name: FAMILY | User Name: Donna Militello | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: Current user
    Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

    ========== Processes (SafeList) ==========

    PRC - [2010/11/15 20:06:39 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Administrator\Desktop\Desktop\OTL.exe
    PRC - [2010/10/29 15:00:00 | 000,612,168 | R--- | M] (WinZip Computing, S.L.) -- C:\Program Files\WinZip\WZQKPICK.EXE
    PRC - [2010/10/08 14:00:46 | 022,234,512 | ---- | M] (magicJack L.P.) -- C:\Documents and Settings\Donna Militello\Application Data\mjusbsp\magicJack.exe
    PRC - [2010/08/02 16:10:00 | 000,135,336 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe
    PRC - [2010/08/02 16:09:55 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
    PRC - [2010/08/02 16:09:55 | 000,267,944 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe
    PRC - [2010/06/18 20:41:54 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\system32\java.exe
    PRC - [2010/02/18 10:43:20 | 000,490,728 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Common Files\Java\Java Update\jucheck.exe
    PRC - [2010/01/14 22:11:00 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
    PRC - [2008/12/12 17:06:40 | 000,642,856 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
    PRC - [2008/12/12 17:06:40 | 000,642,856 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe
    PRC - [2008/11/13 14:43:49 | 000,204,800 | ---- | M] () -- C:\Program Files\Linksys\Linksys Updater\bin\LinksysUpdater.exe
    PRC - [2008/11/09 15:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
    PRC - [2008/10/24 08:14:38 | 000,079,136 | ---- | M] (Macrovision Corporation) -- C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
    PRC - [2008/06/24 13:34:50 | 000,041,824 | ---- | M] (AOL LLC) -- C:\Program Files\Common Files\AOL\1206122613\ee\aolsoftware.exe
    PRC - [2008/04/13 19:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
    PRC - [2007/10/31 12:46:28 | 000,054,624 | ---- | M] (AOL, LLC.) -- C:\Program Files\AOL 9.1\shellmon.exe
    PRC - [2007/10/03 14:45:02 | 000,358,936 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
    PRC - [2007/10/03 14:44:58 | 000,178,712 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
    PRC - [2007/09/20 15:05:06 | 000,589,824 | ---- | M] ( ) -- C:\WINDOWS\system32\lxdocoms.exe
    PRC - [2007/09/06 15:38:57 | 000,450,560 | ---- | M] () -- C:\Program Files\Lexmark 9500 Series\lxdomon.exe
    PRC - [2007/08/10 01:11:54 | 000,020,480 | ---- | M] () -- C:\Program Files\Lexmark 9500 Series\lxdoamon.exe
    PRC - [2007/08/01 13:52:42 | 001,036,288 | ---- | M] (Analog Devices, Inc.) -- C:\Program Files\Analog Devices\Core\smax4pnp.exe
    PRC - [2007/04/11 09:30:34 | 000,030,800 | ---- | M] () -- C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtProc.exe
    PRC - [2007/04/11 09:30:06 | 000,026,704 | ---- | M] () -- C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe
    PRC - [2006/10/26 12:45:04 | 000,293,376 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\WISPTIS.EXE
    PRC - [2006/10/23 07:50:35 | 000,046,640 | R--- | M] (AOL LLC) -- C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe
    PRC - [2006/10/20 16:23:38 | 000,118,784 | ---- | M] (CyberLink Corp.) -- C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
    PRC - [2006/08/17 08:00:00 | 001,116,920 | ---- | M] (Roxio) -- C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe


    ========== Modules (SafeList) ==========

    MOD - [2010/11/15 20:06:39 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Administrator\Desktop\Desktop\OTL.exe
    MOD - [2010/08/23 11:12:02 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll


    ========== Win32 Services (SafeList) ==========

    SRV - [2010/10/13 11:18:30 | 000,090,864 | ---- | M] (PC Pitstop LLC) [On_Demand | Stopped] -- C:\Program Files\PCPitstop\PCPitstopScheduleService.exe -- (PCPitstop Scheduling)
    SRV - [2010/08/02 16:10:00 | 000,135,336 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
    SRV - [2010/08/02 16:09:55 | 000,267,944 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
    SRV - [2008/12/12 17:06:40 | 000,642,856 | ---- | M] (Cisco Systems, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe -- (nmservice)
    SRV - [2008/11/17 10:51:58 | 001,128,944 | ---- | M] (Sonic Solutions) [On_Demand | Stopped] -- C:\Program Files\Common Files\Roxio Shared\11.0\SharedCOM\RoxMediaDB11.exe -- (RoxMediaDB11)
    SRV - [2008/11/13 14:43:49 | 000,204,800 | ---- | M] () [Auto | Running] -- C:\Program Files\Linksys\Linksys Updater\bin\LinksysUpdater.exe -- (LinksysUpdater)
    SRV - [2008/11/09 15:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) [Auto | Running] -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService)
    SRV - [2008/07/15 17:38:32 | 000,394,608 | ---- | M] (SupportSoft, Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Supportsoft\bin\ssrc.exe -- (SupportSoft RemoteAssist)
    SRV - [2007/10/11 06:20:39 | 000,042,368 | R--- | M] (AOL LLC) [Auto | Stopped] -- C:\Program Files\Common Files\AOL\ACS\acsd.exe -- (AOL ACS)
    SRV - [2007/10/03 14:45:02 | 000,358,936 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel(R)
    SRV - [2007/09/20 15:05:06 | 000,589,824 | ---- | M] ( ) [Auto | Running] -- C:\WINDOWS\System32\lxdocoms.exe -- (lxdo_device)
    SRV - [2007/07/17 07:26:03 | 000,094,208 | ---- | M] () [Auto | Stopped] -- C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\lxdoserv.exe -- (lxdoCATSCustConnectService)
    SRV - [2007/06/20 13:30:18 | 000,079,168 | ---- | M] (Broadcom Corporation) [Auto | Stopped] -- C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe -- (ASFIPmon)
    SRV - [2003/03/09 15:31:02 | 000,065,795 | R--- | M] (HP) [On_Demand | Stopped] -- C:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12)


    ========== Driver Services (SafeList) ==========

    DRV - File not found [Kernel | On_Demand | Running] -- C:\ComboFix\catchme.sys -- (catchme)
    DRV - [2010/08/02 16:10:08 | 000,126,856 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
    DRV - [2010/08/02 16:10:08 | 000,060,936 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)
    DRV - [2010/06/17 15:27:22 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
    DRV - [2010/06/17 15:27:12 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Program Files\Avira\AntiVir Desktop\avgio.sys -- (avgio)
    DRV - [2009/12/18 09:58:52 | 000,011,336 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Program Files\SystemRequirementsLab\cpudrv.sys -- (cpudrv)
    DRV - [2008/12/12 17:05:20 | 000,025,264 | ---- | M] (Cisco Systems, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\purendis.sys -- (purendis)
    DRV - [2008/12/12 17:05:18 | 000,023,984 | ---- | M] (Cisco Systems, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\pnarp.sys -- (pnarp)
    DRV - [2008/09/12 13:22:54 | 000,540,288 | ---- | M] (eMPIA Technology, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\emBDA.sys -- (USB28xxBGA)
    DRV - [2008/09/12 13:22:24 | 000,443,520 | ---- | M] (eMPIA Technology, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\emOEM.sys -- (USB28xxOEM)
    DRV - [2008/06/11 17:15:38 | 006,021,184 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\igxpmp32.sys -- (ialm)
    DRV - [2008/04/13 13:46:22 | 000,015,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\MPE.sys -- (MPE)
    DRV - [2008/04/13 13:45:12 | 000,060,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\USBAUDIO.sys -- (usbaudio) USB Audio Driver (WDM)
    DRV - [2008/04/13 13:36:39 | 000,043,008 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\amdagp.sys -- (amdagp)
    DRV - [2008/04/13 13:36:39 | 000,040,960 | ---- | M] (Silicon Integrated Systems Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\sisagp.sys -- (sisagp)
    DRV - [2008/04/13 11:36:05 | 000,144,384 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus)
    DRV - [2008/03/14 20:00:34 | 000,008,552 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | Auto | Running] -- C:\WINDOWS\System32\drivers\asctrm.sys -- (ASCTRM)
    DRV - [2007/09/29 22:03:12 | 000,308,248 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\iaStor.sys -- (iaStor)
    DRV - [2007/08/03 14:29:12 | 000,307,712 | ---- | M] (Analog Devices, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ADIHdAud.sys -- (ADIHdAudAddService)
    DRV - [2007/06/06 11:51:04 | 000,161,792 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\b57xp32.sys -- (b57w2k)
    DRV - [2006/11/02 06:00:08 | 000,039,368 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\winusb.sys -- (winusb)
    DRV - [2006/08/18 12:18:08 | 000,009,400 | ---- | M] (Roxio) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLADResM.SYS -- (DLADResM)
    DRV - [2006/08/18 12:17:46 | 000,035,096 | ---- | M] (Roxio) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLABMFSM.SYS -- (DLABMFSM)
    DRV - [2006/08/18 12:17:44 | 000,097,848 | ---- | M] (Roxio) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLAUDF_M.SYS -- (DLAUDF_M)
    DRV - [2006/08/18 12:17:44 | 000,094,648 | ---- | M] (Roxio) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLAUDFAM.SYS -- (DLAUDFAM)
    DRV - [2006/08/18 12:17:42 | 000,026,008 | ---- | M] (Roxio) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLAOPIOM.SYS -- (DLAOPIOM)
    DRV - [2006/08/18 12:17:40 | 000,032,472 | ---- | M] (Roxio) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLABOIOM.SYS -- (DLABOIOM)
    DRV - [2006/08/18 12:17:38 | 000,104,472 | ---- | M] (Roxio) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLAIFS_M.SYS -- (DLAIFS_M)
    DRV - [2006/08/18 12:17:38 | 000,014,520 | ---- | M] (Roxio) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLAPoolM.SYS -- (DLAPoolM)
    DRV - [2006/08/11 10:05:58 | 000,051,768 | ---- | M] (Roxio) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\DRVNDDM.SYS -- (DRVNDDM)
    DRV - [2006/08/11 09:35:18 | 000,012,920 | ---- | M] (Roxio) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\DLACDBHM.SYS -- (DLACDBHM)
    DRV - [2006/08/11 09:35:16 | 000,028,184 | ---- | M] (Roxio) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\DLARTL_M.SYS -- (DLARTL_M)
    DRV - [2006/07/21 10:21:26 | 000,099,176 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\DRVMCDB.SYS -- (DRVMCDB)
    DRV - [2006/03/17 17:18:58 | 000,392,960 | ---- | M] (Sensaura) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\senfilt.sys -- (SenFiltService)
    DRV - [2005/08/03 15:59:38 | 000,008,960 | R--- | M] (Prolific Technology Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usbbc2.sys -- (PLUsbbc2)
    DRV - [2005/08/03 15:59:36 | 000,004,736 | R--- | M] (Laplink Software, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\llusbflt.sys -- (LLUSBFLT)
    DRV - [2004/10/07 20:16:04 | 000,035,840 | ---- | M] (Oak Technology Inc.) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\AFS2K.SYS -- (AFS2K)
    DRV - [2004/08/03 22:29:56 | 001,897,408 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv)
    DRV - [2003/01/10 16:13:04 | 000,033,588 | R--- | M] (America Online, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\wanatw4.sys -- (wanatw) WAN Miniport (ATW)
    DRV - [2002/10/15 21:41:06 | 000,102,220 | ---- | M] (Sony Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\sonypvs1.sys -- (sonypvs1)
    DRV - [2001/08/17 14:07:44 | 000,019,072 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\sparrow.sys -- (Sparrow)
    DRV - [2001/08/17 14:07:42 | 000,030,688 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\sym_u3.sys -- (sym_u3)
    DRV - [2001/08/17 14:07:40 | 000,028,384 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\sym_hi.sys -- (sym_hi)
    DRV - [2001/08/17 14:07:36 | 000,032,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\symc8xx.sys -- (symc8xx)
    DRV - [2001/08/17 14:07:34 | 000,016,256 | ---- | M] (Symbios Logic Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\symc810.sys -- (symc810)
    DRV - [2001/08/17 13:52:22 | 000,036,736 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\ultra.sys -- (ultra)
    DRV - [2001/08/17 13:52:20 | 000,045,312 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\ql12160.sys -- (ql12160)
    DRV - [2001/08/17 13:52:20 | 000,040,320 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\ql1080.sys -- (ql1080)
    DRV - [2001/08/17 13:52:18 | 000,049,024 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\ql1280.sys -- (ql1280)
    DRV - [2001/08/17 13:52:16 | 000,179,584 | ---- | M] (Mylex Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\dac2w2k.sys -- (dac2w2k)
    DRV - [2001/08/17 13:52:12 | 000,017,280 | ---- | M] (American Megatrends Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\mraid35x.sys -- (mraid35x)
    DRV - [2001/08/17 13:52:00 | 000,026,496 | ---- | M] (Advanced System Products, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\asc.sys -- (asc)
    DRV - [2001/08/17 13:51:58 | 000,014,848 | ---- | M] (Advanced System Products, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\asc3550.sys -- (asc3550)
    DRV - [2001/08/17 13:51:56 | 000,005,248 | ---- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\aliide.sys -- (AliIde)
    DRV - [2001/08/17 13:51:54 | 000,006,656 | ---- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\cmdide.sys -- (CmdIde)
    DRV - [2000/03/29 16:11:20 | 000,008,096 | ---- | M] (MicroStaff Co.,Ltd.) [Kernel | Auto | Running] -- C:\WINDOWS\System32\drivers\MASPINT.SYS -- (MASPINT)


    ========== Standard Registry (SafeList) ==========


    ========== Internet Explorer ==========

    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch = http://us.rd.yahoo.com/customize/ie/defaults/cs/ymj/*http://www.yahoo.com/ext/search/search.html
    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Page_URL = partnerpage.google.com/smallbiz.dell.com/en_us?hl=en&client=dell-usuk&channel=us-smb&ibd=0080311
    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Search Assistant = http://www.google.com/hws/sb/dell-usuk/en/side.html?channel=us-smb
    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Start Page = partnerpage.google.com/smallbiz.dell.com/en_us?hl=en&client=dell-usuk&channel=us-smb&ibd=0080311

    IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
    IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Live Search
    IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
    IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
    IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Search Assistant =
    IE - HKCU\..\URLSearchHook: - Reg Error: Key error. File not found
    IE - HKCU\..\URLSearchHook: {548f6736-8fe4-4680-82f2-170d6c07e1d2} - C:\Program Files\TranslatorBar_1.2\tbTra0.dll (Conduit Ltd.)
    IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - Reg Error: Key error. File not found
    IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
    IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>

    FF - HKLM\software\mozilla\Firefox\extensions\\m3ffxtbr@mywebsearch.com: C:\Program Files\MyWebSearch\bar\3.bin File not found


    O1 HOSTS File: ([2010/11/15 16:00:54 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
    O1 - Hosts: 127.0.0.1 localhost
    O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
    O2 - BHO: (TranslatorBar 1.2 Toolbar) - {548f6736-8fe4-4680-82f2-170d6c07e1d2} - C:\Program Files\TranslatorBar_1.2\tbTra0.dll (Conduit Ltd.)
    O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll (Dell Inc.)
    O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll (Yahoo! Inc)
    O3 - HKLM\..\Toolbar: (TranslatorBar 1.2 Toolbar) - {548f6736-8fe4-4680-82f2-170d6c07e1d2} - C:\Program Files\TranslatorBar_1.2\tbTra0.dll (Conduit Ltd.)
    O3 - HKCU\..\Toolbar\WebBrowser: (TranslatorBar 1.2 Toolbar) - {548F6736-8FE4-4680-82F2-170D6C07E1D2} - C:\Program Files\TranslatorBar_1.2\tbTra0.dll (Conduit Ltd.)
    O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
    O4 - HKLM..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe (Apple Inc.)
    O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
    O4 - HKLM..\Run: [HostManager] C:\Program Files\Common Files\AOL\1206122613\ee\aolsoftware.exe (AOL LLC)
    O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe (Intel Corporation)
    O4 - HKLM..\Run: [ISUSPM Startup] c:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe (InstallShield Software Corporation)
    O4 - HKLM..\Run: [Lexmark 9500 Series Fax Server] C:\Program Files\Lexmark 9500 Series\fm3032.exe ()
    O4 - HKLM..\Run: [lxdoamon] C:\Program Files\Lexmark 9500 Series\lxdoamon.exe ()
    O4 - HKLM..\Run: [lxdomon.exe] C:\Program Files\Lexmark 9500 Series\lxdomon.exe ()
    O4 - HKLM..\Run: [nmctxth] C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe (Cisco Systems, Inc.)
    O4 - HKLM..\Run: [PC Pitstop PC Matic Reminder] C:\Program Files\PCPitstop\PC Matic\Reminder-PCMatic.exe (PC Pitstop LLC)
    O4 - HKLM..\Run: [PDVDDXSrv] C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe (CyberLink Corp.)
    O4 - HKLM..\Run: [RoxioDragToDisc] C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe (Roxio)
    O4 - HKLM..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe (Analog Devices, Inc.)
    O4 - HKLM..\Run: [WrtMon.exe] C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe ()
    O4 - HKCU..\Run: [AOL Fast Start] C:\Program Files\AOL 9.1\AOL.EXE (AOL, LLC.)
    O4 - HKCU..\Run: [cdloader] C:\Documents and Settings\Donna Militello\Application Data\mjusbsp\cdloader2.exe (magicJack L.P.)
    O4 - HKCU..\Run: [DW6] C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe (The Weather Channel Interactive, Inc.)
    O4 - HKCU..\Run: [ISUSScheduler] c:\program files\common files\installshield\updateservice\issch.exe (Macrovision Corporation)
    O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE (WinZip Computing, S.L.)
    O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
    O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: CDRAutoRun = [binary data]
    O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 1
    O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
    O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
    O15 - HKLM\..Trusted Domains: musicmatch.com ([online] https in Trusted sites)
    O15 - HKCU\..Trusted Domains: ([]msn in My Computer)
    O15 - HKCU\..Trusted Domains: //@mail.mar@/ ([]msn in Local intranet)
    O15 - HKCU\..Trusted Domains: //@signup.mar@/ ([]msn in My Computer)
    O15 - HKCU\..Trusted Domains: aol.com ([objects] * is out of zone range - 5)
    O15 - HKCU\..Trusted Domains: internet ([]about in Trusted sites)
    O15 - HKCU\..Trusted Domains: mcafee.com ([]http in Trusted sites)
    O15 - HKCU\..Trusted Domains: mcafee.com ([]https in Trusted sites)
    O15 - HKCU\..Trusted Domains: pogo.com ([www] https in Trusted sites)
    O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} http://pccheckup.dellfix.com/sdccommon/download/tgctlcm.cab (Support.com Configuration Class)
    O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} http://support.dell.com/systemprofiler/SysPro.CAB (SysProWmi Class)
    O16 - DPF: {038E2507-7A48-41E2-94AD-7F23D199AF4E} http://www.worldwinner.com/games/v54/zengems/zengems.cab (ZenGems Control)
    O16 - DPF: {070DC617-E3B7-468B-A29C-D4E84FAE938C} http://utilities.pcpitstop.com/Nirvana/controls/pcmatic.cab (VersionControl Class)
    O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} http://utilities.pcpitstop.com/Nirvana/controls/pcmatic.cab (PCPitstop Utility)
    O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool)
    O16 - DPF: {49232000-16E4-426C-A231-62846947304B} http://ipgweb.cce.hp.com/rdq/downloads/sysinfo.cab (Reg Error: Key error.)
    O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} http://aolcc.aol.com/computercheckup/qdiagcc.cab (Reg Error: Key error.)
    O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} Reg Error: Key error. (Reg Error: Key error.)
    O16 - DPF: {54BE6B6F-3056-470B-97E1-BB92E051B6C4} http://h20264.www2.hp.com/ediags/dd/install/HPDriverDiagnosticsxp2k.cab (Reg Error: Key error.)
    O16 - DPF: {5727FF4C-EF4E-4d96-A96C-03AD91910448} http://www.srtest.com/srl_bin/sysreqlab_ind.cab (System Requirements Lab Class)
    O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase6662.cab (Windows Live Safety Center Base Module)
    O16 - DPF: {615F158E-D5CA-422F-A8E7-F6A5EED7063B} http://www.worldwinner.com/games/v46/bejeweled/bejeweled.cab (Bejeweled Control)
    O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class)
    O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab (Reg Error: Key error.)
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1205787266000 (MUWebControl Class)
    O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} http://clubgames.pogo.com/online2/pogop/luxor_2/mjolauncher.cab (MJLauncherCtrl Class)
    O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab (Facebook Photo Uploader 5 Control)
    O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} http://ipgweb.cce.hp.com/rdq/downloads/msxml4.cab (XML DOM Document 4.0)
    O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} http://www.worldwinner.com/games/shared/wwlaunch.cab (Wwlaunch Control)
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
    O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38045.7731597222 (Reg Error: Key error.)
    O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} http://download.av.aol.com/molbin/shared/mcgdmgr/en-us/1,0,0,20/mcgdmgr.cab (Reg Error: Key error.)
    O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab (Reg Error: Key error.)
    O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Reg Error: Key error.)
    O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
    O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
    O16 - DPF: {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} http://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_intel_4.1.66.0.cab (SysInfo Class)
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
    O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (Reg Error: Value error.)
    O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
    O16 - DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} http://utilities.pcpitstop.com/Optimize2/pcpitstop2.dll (PCPitstop Exam)
    O16 - DPF: DirectAnimation Java Classes Reg Error: Key error. (Reg Error: Key error.)
    O16 - DPF: Microsoft XML Parser for Java Reg Error: Key error. (Reg Error: Key error.)
    O16 - DPF: Win32 Classes Reg Error: Key error. (Reg Error: Key error.)
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 209.18.47.61 209.18.47.62
    O18 - Protocol\Handler\pure-go {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files\Common Files\Pure Networks Shared\Platform\puresp4.dll (Cisco Systems, Inc.)
    O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
    O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)
    O24 - Desktop WallPaper: C:\Documents and Settings\Donna Militello\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
    O24 - Desktop BackupWallPaper: C:\Documents and Settings\Donna Militello\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
    O32 - HKLM CDRom: AutoRun - 1
    O32 - AutoRun File - [2003/07/03 20:41:54 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.001 -- [ NTFS ]
    O32 - AutoRun File - [2004/02/21 10:26:30 | 000,000,102 | -HS- | M] () - C:\autoexec.bak -- [ NTFS ]
    O32 - AutoRun File - [2004/08/11 17:15:00 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
    O34 - HKLM BootExecute: (autocheck autochk *) - File not found
    O35 - HKLM\..comfile [open] -- "%1" %*
    O35 - HKLM\..exefile [open] -- "%1" %*
    O37 - HKLM\...com [@ = ComFile] -- "%1" %*
    O37 - HKLM\...exe [@ = exefile] -- "%1" %*

    NetSvcs: 6to4 - File not found
    NetSvcs: Ias - File not found
    NetSvcs: Iprip - File not found
    NetSvcs: Irmon - File not found
    NetSvcs: NWCWorkstation - File not found
    NetSvcs: Nwsapagent - File not found
    NetSvcs: WmdmPmSp - File not found

    Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
    Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
    Drivers32: msacm.lhacm - C:\WINDOWS\System32\LHACM.ACM (Microsoft Corporation)
    Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
    Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
    Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
    Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
    Drivers32: vidc.DIVX - C:\WINDOWS\System32\DivX.dll (DivXNetworks, Inc.)
    Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
    Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
    Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
    Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
    Drivers32: VIDC.VDOM - vdowave.drv File not found
    Drivers32: VIDC.WMV3 - C:\WINDOWS\System32\WMV9VCM.DLL (Microsoft Corporation)

    CREATERESTOREPOINT
    Restore point Set: OTL Restore Point (17183584330711040)

    ========== Files/Folders - Created Within 30 Days ==========

    [2010/11/15 20:06:34 | 000,575,488 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Administrator\Desktop\Desktop\OTL.exe
    [2010/11/15 15:54:12 | 000,000,000 | RHSD | C] -- C:\cmdcons
    [2010/11/15 15:52:43 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
    [2010/11/15 15:52:43 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
    [2010/11/15 15:52:43 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
    [2010/11/15 15:52:43 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
    [2010/11/15 15:52:37 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
    [2010/11/15 15:52:10 | 000,000,000 | ---D | C] -- C:\Qoobox
    [2010/11/15 15:50:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Donna Militello\Application Data\Avira
    [2010/11/15 06:25:45 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Donna Militello\Local Settings\Application Data\WinZip
    [2010/11/15 06:25:27 | 000,000,000 | ---D | C] -- C:\Program Files\WinZip
    [2010/11/14 18:26:20 | 000,000,000 | ---D | C] -- C:\found.000
    [2010/11/14 07:19:18 | 000,446,464 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Administrator\Desktop\Desktop\TFC.exe
    [2010/11/14 07:13:49 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\ssmdrv.sys
    [2010/11/14 07:13:46 | 000,126,856 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avipbb.sys
    [2010/11/14 07:13:46 | 000,060,936 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntflt.sys
    [2010/11/14 07:13:46 | 000,022,360 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntmgr.sys
    [2010/11/14 07:13:45 | 000,045,416 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntdd.sys
    [2010/11/14 07:13:44 | 000,000,000 | ---D | C] -- C:\Program Files\Avira
    [2010/11/14 07:13:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Avira
    [2010/11/13 19:09:20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\PCPitstopDat
    [2010/11/13 08:10:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Hitman Pro
    [2010/11/13 08:09:40 | 006,387,008 | ---- | C] (SurfRight B.V.) -- C:\Documents and Settings\Administrator\Desktop\Desktop\HitmanPro35.exe
    [2010/11/11 18:02:16 | 000,000,000 | -H-D | C] -- C:\WINDOWS\ie8
    [2010/11/11 17:28:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Donna Militello\My Documents\My Received Files
    [2010/11/07 22:38:14 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Donna Militello\Application Data\MA2
    [2010/11/07 22:37:12 | 000,000,000 | ---D | C] -- C:\Program Files\Mystery Age - The Dark Priests
    [2010/11/04 21:05:22 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Donna Militello\My Documents\Green Gamer
    [2010/11/03 21:54:33 | 000,000,000 | ---D | C] -- C:\Program Files\Haunted Halls - Green Hills Sanitarium Collector's Edition
    [2010/10/27 14:05:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Donna Militello\Desktop
    [2010/10/26 21:41:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Donna Militello\Saved Games
    [2010/10/25 21:30:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Donna Militello\Application Data\Aerohills
    [2010/10/25 21:28:54 | 000,000,000 | ---D | C] -- C:\Program Files\Mystery of the Earl
    [2010/10/23 20:11:37 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Donna Militello\Application Data\VampireSaga
    [2010/10/22 18:14:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Donna Militello\Application Data\perfect future studio
    [2010/10/22 18:13:00 | 000,000,000 | ---D | C] -- C:\Program Files\Mysteries of Magic Island
    [2010/10/22 13:19:33 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Donna Militello\Application Data\PlayPond
    [2010/10/19 14:30:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Donna Militello\My Documents\0riginal_message
    [2008/07/24 21:55:16 | 000,438,272 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdohcp.dll
    [2008/07/24 21:55:15 | 001,069,056 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdoserv.dll
    [2008/07/24 21:55:15 | 000,954,368 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdousb1.dll
    [2008/07/24 21:55:15 | 000,360,448 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdoinpa.dll
    [2008/07/24 21:55:15 | 000,339,968 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdoiesc.dll
    [2008/07/24 21:55:14 | 000,643,072 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdopmui.dll
    [2008/07/24 21:55:14 | 000,569,344 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdolmpm.dll
    [2008/07/24 21:55:14 | 000,053,248 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdoprox.dll
    [2008/07/24 21:55:12 | 000,663,552 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdohbn3.dll
    [2008/07/24 21:55:10 | 000,851,968 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdocomc.dll
    [2008/07/24 21:55:10 | 000,364,544 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdocomm.dll
    [4 C:\Documents and Settings\All Users\*.tmp files -> C:\Documents and Settings\All Users\*.tmp -> ]

    ========== Files - Modified Within 30 Days ==========

    [2010/11/15 20:06:39 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Administrator\Desktop\Desktop\OTL.exe
    [2010/11/15 17:29:23 | 000,018,788 | ---- | M] () -- C:\Documents and Settings\Donna Militello\My Documents\prefmutualinspymnt11-10.docx
    [2010/11/15 17:28:40 | 000,002,521 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\Desktop\Microsoft Office Word 2007.lnk
    [2010/11/15 17:21:05 | 000,457,940 | ---- | M] () -- C:\Documents and Settings\Donna Militello\My Documents\2010_P12_9812_hostSpecial.pdf
    [2010/11/15 16:51:06 | 000,001,109 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\Desktop\magicJack.lnk
    [2010/11/15 16:01:54 | 000,000,444 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{F6F43152-6187-43E6-AED5-B7F92EA5A2EE}.job
    [2010/11/15 16:01:37 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
    [2010/11/15 16:00:54 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
    [2010/11/15 16:00:48 | 000,000,236 | ---- | M] () -- C:\WINDOWS\tasks\OGALogon.job
    [2010/11/15 16:00:45 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
    [2010/11/15 15:54:17 | 000,000,327 | RHS- | M] () -- C:\boot.ini
    [2010/11/15 15:49:56 | 003,910,069 | R--- | M] () -- C:\Documents and Settings\Administrator\Desktop\Desktop\ComboFix.exe
    [2010/11/15 15:38:53 | 000,353,485 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\Desktop\HostsXpert.zip
    [2010/11/15 15:33:00 | 000,020,326 | ---- | M] () -- C:\Documents and Settings\All Users\lxdo
    [2010/11/15 06:28:28 | 000,089,073 | ---- | M] () -- C:\Documents and Settings\Donna Militello\My Documents\winzip purchaseproduct selection.docx
    [2010/11/15 06:25:39 | 000,001,732 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\WinZip.lnk
    [2010/11/15 06:25:39 | 000,001,660 | ---- | M] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
    [2010/11/14 21:55:49 | 000,001,246 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\More Great Games.lnk
    [2010/11/14 07:44:55 | 000,630,272 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\Desktop\dds.scr
    [2010/11/14 07:42:16 | 000,296,448 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\Desktop\jryuwe4z.exe
    [2010/11/14 07:19:27 | 000,446,464 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Administrator\Desktop\Desktop\TFC.exe
    [2010/11/14 07:14:03 | 000,001,707 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Avira AntiVir Control Center.lnk
    [2010/11/13 08:11:15 | 000,016,968 | ---- | M] () -- C:\WINDOWS\System32\drivers\hitmanpro35.sys
    [2010/11/13 08:10:27 | 006,387,008 | ---- | M] (SurfRight B.V.) -- C:\Documents and Settings\Administrator\Desktop\Desktop\HitmanPro35.exe
    [2010/11/12 21:47:28 | 000,000,440 | ---- | M] () -- C:\Documents and Settings\Donna Militello\Application Data\prefsdb.dat
    [2010/11/12 21:34:01 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
    [2010/11/12 03:09:03 | 000,001,393 | ---- | M] () -- C:\WINDOWS\imsins.BAK
    [2010/11/11 20:54:07 | 000,090,150 | ---- | M] () -- C:\Documents and Settings\Donna Militello\My Documents\msg0016.wav
    [2010/11/11 20:28:17 | 000,000,211 | ---- | M] () -- C:\Boot.bak
    [2010/11/11 18:05:44 | 000,000,815 | ---- | M] () -- C:\Documents and Settings\Donna Militello\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
    [2010/11/11 17:29:45 | 000,493,482 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
    [2010/11/11 17:29:45 | 000,091,058 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
    [2010/11/08 01:20:24 | 000,089,088 | ---- | M] () -- C:\WINDOWS\MBR.exe
    [2010/11/04 16:22:58 | 000,000,822 | ---- | M] () -- C:\Documents and Settings\Donna Militello\My Documents\my resume2 with borders.lnk
    [2010/11/03 16:40:31 | 000,010,850 | ---- | M] () -- C:\Documents and Settings\Donna Militello\My Documents\msg0005.wav
    [2010/11/01 16:52:04 | 000,023,330 | ---- | M] () -- C:\Documents and Settings\Donna Militello\My Documents\msg0002.wav
    [2010/10/24 08:22:52 | 000,005,946 | ---- | M] () -- C:\Documents and Settings\Donna Militello\My Documents\My Favorite Theme.theme
    [2010/10/24 08:14:31 | 000,000,348 | ---- | M] () -- C:\Documents and Settings\Donna Militello\Shortcut to My Documents.lnk
    [2010/10/23 19:09:50 | 000,018,780 | ---- | M] () -- C:\Documents and Settings\Donna Militello\My Documents\msg0010.wav
    [2010/10/22 18:13:57 | 000,001,745 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Play Mysteries of Magic Island.lnk
    [2010/10/19 14:30:15 | 000,014,982 | ---- | M] () -- C:\Documents and Settings\Donna Militello\My Documents\0riginal_message.zip
    [4 C:\Documents and Settings\All Users\*.tmp files -> C:\Documents and Settings\All Users\*.tmp -> ]

    ========== Files Created - No Company Name ==========

    [2010/11/15 17:29:23 | 000,018,788 | ---- | C] () -- C:\Documents and Settings\Donna Militello\My Documents\prefmutualinspymnt11-10.docx
    [2010/11/15 17:21:03 | 000,457,940 | ---- | C] () -- C:\Documents and Settings\Donna Militello\My Documents\2010_P12_9812_hostSpecial.pdf
    [2010/11/15 15:54:17 | 000,000,211 | ---- | C] () -- C:\Boot.bak
    [2010/11/15 15:54:13 | 000,260,272 | RHS- | C] () -- C:\cmldr
    [2010/11/15 15:52:43 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe
    [2010/11/15 15:52:43 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
    [2010/11/15 15:52:43 | 000,089,088 | ---- | C] () -- C:\WINDOWS\MBR.exe
    [2010/11/15 15:52:43 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
    [2010/11/15 15:52:43 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
    [2010/11/15 15:49:47 | 003,910,069 | R--- | C] () -- C:\Documents and Settings\Administrator\Desktop\Desktop\ComboFix.exe
    [2010/11/15 10:21:23 | 000,000,822 | ---- | C] () -- C:\Documents and Settings\Donna Militello\My Documents\my resume2 with borders.lnk
    [2010/11/15 06:28:27 | 000,089,073 | ---- | C] () -- C:\Documents and Settings\Donna Militello\My Documents\winzip purchaseproduct selection.docx
    [2010/11/15 06:25:39 | 000,001,732 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\WinZip.lnk
    [2010/11/15 06:25:39 | 000,001,660 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
    [2010/11/15 06:18:47 | 000,353,485 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\Desktop\HostsXpert.zip
    [2010/11/14 21:55:49 | 000,001,246 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\More Great Games.lnk
    [2010/11/14 07:44:47 | 000,630,272 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\Desktop\dds.scr
    [2010/11/14 07:42:12 | 000,296,448 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\Desktop\jryuwe4z.exe
    [2010/11/14 07:14:03 | 000,001,707 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Avira AntiVir Control Center.lnk
    [2010/11/13 08:11:15 | 000,016,968 | ---- | C] () -- C:\WINDOWS\System32\drivers\hitmanpro35.sys
    [2010/11/03 16:40:28 | 000,010,850 | ---- | C] () -- C:\Documents and Settings\Donna Militello\My Documents\msg0005.wav
    [2010/10/25 15:00:10 | 000,023,330 | ---- | C] () -- C:\Documents and Settings\Donna Militello\My Documents\msg0002.wav
    [2010/10/24 08:22:51 | 000,005,946 | ---- | C] () -- C:\Documents and Settings\Donna Militello\My Documents\My Favorite Theme.theme
    [2010/10/22 18:14:21 | 000,000,440 | ---- | C] () -- C:\Documents and Settings\Donna Militello\Application Data\prefsdb.dat
    [2010/10/22 18:13:57 | 000,001,745 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Play Mysteries of Magic Island.lnk
    [2010/10/19 14:30:15 | 000,014,982 | ---- | C] () -- C:\Documents and Settings\Donna Militello\My Documents\0riginal_message.zip
    [2010/08/31 15:25:12 | 000,696,256 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
    [2010/08/07 10:12:57 | 000,000,062 | ---- | C] () -- C:\WINDOWS\pcvcdbr.INI
    [2010/08/07 10:03:17 | 000,000,000 | ---- | C] () -- C:\WINDOWS\pcvcdvw.INI
    [2009/12/22 21:40:53 | 000,000,020 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\PKP_DLec.DAT
    [2009/08/17 14:16:21 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\igfxCoIn_v4957.dll
    [2009/08/03 15:07:42 | 000,403,816 | ---- | C] () -- C:\WINDOWS\System32\OGACheckControl.dll
    [2009/07/09 19:13:56 | 000,000,074 | ---- | C] () -- C:\WINDOWS\MPLAYER.INI
    [2009/03/29 21:02:02 | 000,056,056 | ---- | C] () -- C:\WINDOWS\System32\DLAAPI_W.DLL
    [2008/09/06 14:28:23 | 000,003,654 | ---- | C] () -- C:\WINDOWS\System32\drivers\Sonyhcp.dll
    [2008/09/06 14:27:55 | 000,030,208 | ---- | C] () -- C:\WINDOWS\System32\WNASPI32.DLL
    [2008/09/06 14:27:54 | 000,000,291 | ---- | C] () -- C:\WINDOWS\msfsetup.ini
    [2008/08/25 09:05:21 | 000,001,152 | ---- | C] () -- C:\WINDOWS\System32\windrv.sys
    [2008/07/25 09:09:36 | 000,000,029 | ---- | C] () -- C:\WINDOWS\DEBUGSM.INI
    [2008/07/24 22:04:08 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\lxdovs.dll
    [2008/07/24 22:04:02 | 000,348,160 | ---- | C] () -- C:\WINDOWS\System32\lxdocoin.dll
    [2008/07/24 22:03:29 | 000,692,224 | ---- | C] () -- C:\WINDOWS\System32\lxdodrs.dll
    [2008/07/24 22:03:29 | 000,069,632 | ---- | C] () -- C:\WINDOWS\System32\lxdocnv4.dll
    [2008/07/24 22:03:29 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\lxdocaps.dll
    [2008/07/24 22:03:07 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\LXDOPMON.DLL
    [2008/07/24 22:03:07 | 000,032,768 | ---- | C] () -- C:\WINDOWS\System32\LXDOFXPU.DLL
    [2008/07/24 22:02:47 | 000,069,632 | ---- | C] () -- C:\WINDOWS\System32\lxdooem.dll
    [2008/07/24 21:55:50 | 000,028,672 | ---- | C] () -- C:\WINDOWS\hookdllX.dll
    [2008/07/24 21:55:50 | 000,011,776 | ---- | C] () -- C:\WINDOWS\System32\pmsbfn32.dll
    [2008/07/24 21:55:28 | 000,000,060 | -H-- | C] () -- C:\WINDOWS\System32\lxdorwrd.ini
    [2008/07/24 21:55:16 | 000,348,160 | ---- | C] () -- C:\WINDOWS\System32\lxdoinst.dll
    [2008/07/24 21:55:11 | 000,208,896 | ---- | C] () -- C:\WINDOWS\System32\lxdogrd.dll
    [2008/03/17 19:00:36 | 000,397,312 | ---- | C] () -- C:\WINDOWS\System32\Snbd6w95.dll
    [2008/03/17 19:00:36 | 000,044,544 | ---- | C] () -- C:\WINDOWS\System32\gif89.dll
    [2008/03/17 19:00:35 | 000,072,704 | ---- | C] () -- C:\WINDOWS\System32\XMain32A.dll
    [2008/03/17 19:00:16 | 000,000,333 | ---- | C] () -- C:\WINDOWS\Generations.INI
    [2008/03/17 18:38:34 | 000,000,694 | ---- | C] () -- C:\WINDOWS\Sierra.ini
    [2008/03/17 18:00:22 | 000,014,336 | ---- | C] () -- C:\Documents and Settings\Donna Militello\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
     
  8. dmill

    dmill TS Rookie Topic Starter

    Here's the some moret of OTL . According to the forum rules I am limited to 6 images and had to again break up the file in order to send it. Extras is too long and will be posted yet again in another message.

    [2008/03/17 15:52:53 | 000,001,047 | ---- | C] () -- C:\WINDOWS\ODBC.INI
    [2008/03/16 01:28:22 | 000,003,099 | ---- | C] () -- C:\Documents and Settings\Donna Militello\Application Data\HPCOM_48BitScanUpdate.log
    [2008/03/16 01:28:22 | 000,000,214 | ---- | C] () -- C:\WINDOWS\HP_48BitScanUpdatePatch.ini
    [2008/03/14 21:21:29 | 000,000,000 | -H-- | C] () -- C:\Documents and Settings\Donna Militello\Application Data\hpothb07.tif
    [2008/03/14 21:21:29 | 000,000,000 | -H-- | C] () -- C:\Documents and Settings\Donna Militello\Application Data\hpothb07.dat
    [2008/03/14 19:22:23 | 000,002,275 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\hpzinstall.log
    [2008/03/14 18:57:54 | 000,561,152 | R--- | C] () -- C:\WINDOWS\System32\hpotscl.dll
    [2008/03/11 13:11:20 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
    [2008/03/11 13:09:49 | 000,000,375 | ---- | C] () -- C:\WINDOWS\wininit.ini
    [2008/03/11 12:52:07 | 000,204,800 | ---- | C] () -- C:\WINDOWS\System32\igfxCoIn_v4837.dll
    [2008/03/11 12:50:53 | 000,001,119 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
    [2007/03/22 16:15:31 | 000,002,110 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
    [2006/11/09 16:07:44 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini
    [2006/09/16 22:36:50 | 000,520,192 | ---- | C] () -- C:\WINDOWS\System32\CddbPlaylist2Roxio.dll
    [2006/09/16 22:36:50 | 000,204,800 | ---- | C] () -- C:\WINDOWS\System32\CddbFileTaggerRoxio.dll
    [2005/02/18 15:56:36 | 000,399,872 | ---- | C] () -- C:\WINDOWS\c4dstand.dll
    [2005/02/18 15:56:12 | 000,003,363 | ---- | C] () -- C:\WINDOWS\Splash.ini
    [2004/11/22 21:31:32 | 000,000,000 | ---- | C] () -- C:\WINDOWS\hpqEmlsz.INI
    [2004/11/18 16:31:40 | 000,000,101 | ---- | C] () -- C:\WINDOWS\upst.ini
    [2004/08/11 17:24:19 | 000,000,791 | ---- | C] () -- C:\WINDOWS\orun32.ini
    [2004/08/11 17:11:31 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
    [2004/08/11 17:07:24 | 000,004,346 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
    [2004/06/04 06:26:45 | 000,222,120 | ---- | C] () -- C:\WINDOWS\System32\language.dll
    [2004/05/21 17:39:13 | 000,000,046 | ---- | C] () -- C:\WINDOWS\upth.ini
    [2004/05/21 17:39:13 | 000,000,029 | ---- | C] () -- C:\WINDOWS\atid.ini
    [2004/03/04 21:07:22 | 000,009,136 | ---- | C] () -- C:\WINDOWS\System32\inetwh16.dll
    [2004/03/04 21:07:19 | 000,061,440 | ---- | C] () -- C:\WINDOWS\System32\vtdg8830.dll
    [2004/03/04 21:07:15 | 000,000,002 | ---- | C] () -- C:\WINDOWS\Vtray.ini
    [2004/02/28 21:56:14 | 000,363,520 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
    [2004/02/22 09:33:04 | 000,093,696 | ---- | C] () -- C:\WINDOWS\System32\hpgt42.dll
    [2004/02/21 13:17:03 | 000,023,719 | ---- | C] () -- C:\WINDOWS\cdPlayer.ini
    [2004/02/21 13:17:03 | 000,015,047 | ---- | C] () -- C:\WINDOWS\HPSETUP.INI
    [2004/02/21 13:17:03 | 000,012,327 | ---- | C] () -- C:\WINDOWS\IOS.INI
    [2004/02/21 13:17:03 | 000,005,068 | ---- | C] () -- C:\WINDOWS\DELETEFI.INI
    [2004/02/21 13:17:03 | 000,003,909 | ---- | C] () -- C:\WINDOWS\MDSHELL.INI
    [2004/02/21 13:17:03 | 000,003,598 | ---- | C] () -- C:\WINDOWS\HTMLHELP.INI
    [2004/02/21 13:17:03 | 000,002,501 | ---- | C] () -- C:\WINDOWS\LEXSTAT.INI
    [2004/02/21 13:17:03 | 000,002,376 | ---- | C] () -- C:\WINDOWS\wininit.nin.ini
    [2004/02/21 13:17:03 | 000,000,787 | ---- | C] () -- C:\WINDOWS\SCANREG.INI
    [2004/02/21 13:17:03 | 000,000,735 | ---- | C] () -- C:\WINDOWS\USERINFO.INI
    [2004/02/21 13:17:03 | 000,000,488 | ---- | C] () -- C:\WINDOWS\Cmousecc.ini
    [2004/02/21 13:17:03 | 000,000,439 | ---- | C] () -- C:\WINDOWS\LEXHBP.INI
    [2004/02/21 13:17:03 | 000,000,426 | ---- | C] () -- C:\WINDOWS\PCPHOTO.INI
    [2004/02/21 13:17:03 | 000,000,388 | ---- | C] () -- C:\WINDOWS\QTW.INI
    [2004/02/21 13:17:03 | 000,000,225 | ---- | C] () -- C:\WINDOWS\TELEPHON.INI
    [2004/02/21 13:17:03 | 000,000,216 | ---- | C] () -- C:\WINDOWS\AudioMix.ini
    [2004/02/21 13:17:03 | 000,000,179 | ---- | C] () -- C:\WINDOWS\KPCMS.INI
    [2004/02/21 13:17:03 | 000,000,120 | ---- | C] () -- C:\WINDOWS\PROTOCOL.INI
    [2004/02/21 13:17:03 | 000,000,102 | ---- | C] () -- C:\WINDOWS\msoffice.ini
    [2004/02/21 13:17:03 | 000,000,068 | ---- | C] () -- C:\WINDOWS\FPXPRESS.INI
    [2004/02/21 13:17:03 | 000,000,059 | ---- | C] () -- C:\WINDOWS\IPLAYER.INI
    [2004/02/21 13:17:03 | 000,000,053 | ---- | C] () -- C:\WINDOWS\WWWBATCH.INI
    [2004/02/21 13:17:03 | 000,000,041 | ---- | C] () -- C:\WINDOWS\TBSLNCH2.INI
    [2004/02/21 13:17:03 | 000,000,036 | ---- | C] () -- C:\WINDOWS\PROGMAN.INI
    [2004/02/21 13:17:03 | 000,000,033 | ---- | C] () -- C:\WINDOWS\SOL.INI
    [2004/02/21 13:17:03 | 000,000,027 | ---- | C] () -- C:\WINDOWS\UP9ASP.INI
    [2004/02/21 13:17:03 | 000,000,017 | ---- | C] () -- C:\WINDOWS\venderID.ini
    [2004/02/21 13:17:03 | 000,000,000 | ---- | C] () -- C:\WINDOWS\USBGUI.INI
    [2004/02/21 13:17:03 | 000,000,000 | ---- | C] () -- C:\WINDOWS\MSINFO32.INI
    [2004/02/21 13:17:03 | 000,000,000 | ---- | C] () -- C:\WINDOWS\AS32CHASSIS.INI
    [2004/02/21 13:17:02 | 000,007,885 | ---- | C] () -- C:\WINDOWS\NETDET.INI
    [2004/02/21 13:17:02 | 000,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI
    [2004/02/21 13:17:02 | 000,000,679 | ---- | C] () -- C:\WINDOWS\TSC.ini
    [2004/02/21 13:17:02 | 000,000,269 | ---- | C] () -- C:\WINDOWS\TMUPDATE.INI
    [2004/02/21 13:17:02 | 000,000,256 | ---- | C] () -- C:\WINDOWS\AUCFG.INI
    [2004/02/21 13:17:02 | 000,000,170 | ---- | C] () -- C:\WINDOWS\GetServer.ini
    [2004/02/21 13:17:02 | 000,000,060 | ---- | C] () -- C:\WINDOWS\POWERPNT.INI
    [2004/02/21 13:17:02 | 000,000,054 | ---- | C] () -- C:\WINDOWS\WAVEMIX.INI
    [2004/02/18 22:09:17 | 000,071,749 | ---- | C] () -- C:\WINDOWS\HCExtOutput.dll
    [2004/02/07 09:36:14 | 000,093,184 | ---- | C] () -- C:\WINDOWS\System32\WVJAVA.DLL
    [2004/01/18 22:05:00 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\REGISTRY.INI
    [2003/11/09 00:36:27 | 000,040,448 | ---- | C] () -- C:\WINDOWS\Regobj.dll
    [2003/10/06 14:16:00 | 000,027,136 | ---- | C] () -- C:\WINDOWS\System32\nvcod.dll
    [2003/09/19 18:25:53 | 000,095,232 | ---- | C] () -- C:\WINDOWS\System32\Lfkodak.dll
    [2003/07/04 10:08:29 | 000,210,944 | ---- | C] () -- C:\WINDOWS\System32\MSVCRT10.DLL
    [2003/07/04 10:06:23 | 000,338,944 | ---- | C] () -- C:\WINDOWS\System32\Lffpx7.dll
    [2003/07/04 07:58:15 | 000,086,016 | ---- | C] () -- C:\WINDOWS\System32\NVRSNL.DLL
    [2003/07/04 00:20:55 | 000,022,016 | ---- | C] () -- C:\WINDOWS\TSOUND32.DLL
    [2003/07/04 00:20:53 | 000,149,898 | ---- | C] () -- C:\WINDOWS\mdshell.dll
    [2002/12/10 00:00:00 | 001,708,032 | ---- | C] () -- C:\WINDOWS\System32\MSO97V.DLL
    [2002/12/10 00:00:00 | 000,032,768 | ---- | C] () -- C:\WINDOWS\System32\MSORFS.DLL
    [2001/08/31 15:33:58 | 000,425,984 | ---- | C] () -- C:\WINDOWS\System32\VxDMDcDlg.dll
    [1999/07/23 13:46:48 | 000,000,116 | ---- | C] () -- C:\WINDOWS\AuHCcup1.ini
    [1999/07/23 10:53:20 | 000,129,536 | ---- | C] () -- C:\WINDOWS\AuHCcup1.dll
    [1999/03/18 21:09:54 | 000,057,344 | ---- | C] () -- C:\WINDOWS\System32\icmfilter.dll
    [1998/08/16 06:00:00 | 000,004,096 | ---- | C] () -- C:\WINDOWS\System32\SYSRES.DLL
    [1998/03/22 13:50:02 | 000,010,240 | ---- | C] () -- C:\WINDOWS\System32\vidx16.dll
    [1996/12/13 00:00:00 | 000,022,016 | ---- | C] () -- C:\WINDOWS\System32\DOCOBJ.DLL
    [1996/11/17 00:37:00 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\HLINKPRX.DLL
    [1980/01/01 00:00:00 | 000,188,416 | ---- | C] () -- C:\WINDOWS\System32\MEMBG.DLL

    ========== Custom Scans ==========

    < %SYSTEMDRIVE%\*.* >
    [2003/03/31 04:00:00 | 000,245,920 | R--- | M] () -- C:\$LDR$
    [2005/12/05 21:37:08 | 000,010,920 | ---- | M] () -- C:\aolconnfix.exe
    [2005/12/05 21:37:08 | 000,001,039 | ---- | M] () -- C:\aolconnfix.txt
    [2003/07/03 20:41:54 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.001
    [2004/02/21 10:26:30 | 000,000,102 | -HS- | M] () -- C:\autoexec.bak
    [2004/08/11 17:15:00 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT
    [2010/11/11 20:28:17 | 000,000,211 | ---- | M] () -- C:\Boot.bak
    [2010/11/15 15:54:17 | 000,000,327 | RHS- | M] () -- C:\boot.ini
    [2003/11/28 09:37:46 | 000,000,172 | ---- | M] () -- C:\CKINFO.TXT
    [2004/08/03 23:00:00 | 000,260,272 | RHS- | M] () -- C:\cmldr
    [2010/11/15 16:07:25 | 000,032,635 | ---- | M] () -- C:\ComboFix.txt
    [2004/08/11 17:15:00 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
    [2003/12/14 15:49:52 | 000,000,143 | ---- | M] () -- C:\Create & Print Home.url
    [2006/05/29 16:50:30 | 005,016,613 | ---- | M] () -- C:\Dani California.mp3
    [2008/03/11 12:52:42 | 000,006,116 | RH-- | M] () -- C:\dell.sdr
    [2004/03/21 07:19:36 | 000,004,550 | -H-- | M] () -- C:\ffastun.ffa
    [2004/03/21 07:19:36 | 001,097,728 | -H-- | M] () -- C:\ffastun.ffl
    [2004/03/21 07:19:36 | 000,368,640 | -H-- | M] () -- C:\ffastun.ffo
    [2004/03/21 07:19:36 | 001,941,504 | -H-- | M] () -- C:\ffastun0.ffx
    [2004/03/22 17:04:58 | 001,097,728 | ---- | M] () -- C:\ffastunT.ffl
    [2003/07/12 23:51:48 | 000,000,000 | ---- | M] () -- C:\FixKlez.log
    [2006/05/29 16:43:32 | 004,923,516 | ---- | M] () -- C:\Foo Fighters - Darling Nikki.mp3
    [2003/07/03 18:17:40 | 000,001,012 | ---- | M] () -- C:\FRUNLOG.TXT
    [2008/07/24 09:39:58 | 000,000,488 | ---- | M] () -- C:\hpfr5550.xml
    [2006/06/02 16:37:24 | 000,005,717 | -H-- | M] () -- C:\hpothb07.dat
    [2006/06/02 16:37:22 | 000,082,594 | -H-- | M] () -- C:\hpothb07.tif
    [2008/03/14 19:44:28 | 000,004,128 | ---- | M] () -- C:\INFCACHE.1
    [2004/08/11 17:15:00 | 000,000,000 | -H-- | M] () -- C:\IO.SYS
    [2003/07/04 12:27:50 | 000,000,005 | ---- | M] () -- C:\lcl.txt
    [2003/07/03 18:35:18 | 000,001,676 | RHS- | M] () -- C:\MSDOS.BAK
    [2004/08/11 17:15:00 | 000,000,000 | -H-- | M] () -- C:\MSDOS.SYS
    [2003/09/03 17:17:34 | 000,000,000 | ---- | M] () -- C:\New Text Document.txt
    [2003/07/20 09:36:50 | 000,001,505 | ---- | M] () -- C:\nrunonce.log
    [2004/08/04 05:00:00 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
    [2008/08/18 15:15:22 | 000,250,048 | RHS- | M] () -- C:\ntldr
    [2010/11/15 16:00:43 | 2145,386,496 | -HS- | M] () -- C:\pagefile.sys
    [2003/11/30 08:24:38 | 000,000,560 | ---- | M] () -- C:\PCDOC.BAT
    [2008/08/24 09:24:23 | 068,381,854 | ---- | M] () -- C:\regfiles82408.reg
    [2010/09/26 13:57:49 | 000,000,493 | ---- | M] () -- C:\rkill.log
    [2004/02/14 10:53:16 | 000,000,933 | ---- | M] () -- C:\SCANDISK.LOG
    [2003/11/01 20:01:04 | 000,002,653 | ---- | M] () -- C:\SETUPXLG.TXT
    [2003/07/08 20:13:18 | 000,000,000 | ---- | M] () -- C:\SQL.LOG
    [2004/02/26 15:42:36 | 000,000,495 | ---- | M] () -- C:\stub.log
    [2005/10/31 11:56:02 | 000,700,416 | ---- | M] (LimeWire) -- C:\StubInstaller.exe
    [2010/11/13 07:35:27 | 000,053,552 | ---- | M] () -- C:\TDSSKiller.2.4.7.0_13.11.2010_07.34.56_log.txt
    [2003/03/31 04:00:00 | 000,440,432 | R--- | M] () -- C:\txtsetup.sif
    [2003/12/16 10:45:16 | 000,001,475 | ---- | M] () -- C:\usblog.txt
    [2006/04/02 14:15:20 | 000,017,978 | ---- | M] () -- C:\VETlog.txt
    [2004/07/30 18:14:08 | 000,000,090 | ---- | M] () -- C:\VolStp.log
    [2004/01/30 20:06:02 | 000,000,082 | ---- | M] () -- C:\wbemcore.log
    [2003/11/14 14:59:00 | 000,000,000 | ---- | M] () -- C:\WINDOWS000.000
    [2003/12/02 18:22:44 | 000,000,063 | ---- | M] () -- C:\WINDOWSWinHlp32.BMK
    [2004/01/30 20:08:08 | 000,000,084 | ---- | M] () -- C:\WinMgmt.log
    [2007/08/09 16:01:16 | 000,000,162 | ---- | M] () -- C:\YServer.txt
    [2003/07/08 22:25:42 | 000,065,536 | ---- | M] () -- C:\Zipsend2.exe
    [2004/01/30 16:21:12 | 000,000,000 | ---- | M] () -- C:\~cevts0

    < %systemroot%\Fonts\*.com >
    [2006/04/18 14:39:28 | 000,026,040 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
    [2006/06/29 13:53:56 | 000,026,489 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
    [2006/04/18 14:39:28 | 000,029,779 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
    [2006/06/29 13:58:52 | 000,030,808 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

    < %systemroot%\Fonts\*.dll >

    < %systemroot%\Fonts\*.ini >
    [2004/08/11 17:14:22 | 000,000,067 | -HS- | M] () -- C:\WINDOWS\Fonts\desktop.ini

    < %systemroot%\Fonts\*.ini2 >

    < %systemroot%\Fonts\*.exe >

    < %systemroot%\system32\spool\prtprocs\w32x86\*.* >
    [2008/07/06 07:06:10 | 000,089,088 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
    [2007/07/18 05:42:20 | 000,113,664 | ---- | M] () -- C:\WINDOWS\system32\spool\prtprocs\w32x86\lxdodrpp.dll
    [2007/04/09 12:23:54 | 000,028,552 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\mdippr.dll
    [2008/07/06 05:50:03 | 000,597,504 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

    < %systemroot%\REPAIR\*.bak1 >

    < %systemroot%\REPAIR\*.ini >

    < %systemroot%\system32\*.jpg >

    < %systemroot%\*.jpg >

    < %systemroot%\*.png >

    < %systemroot%\*.scr >
    [1998/04/18 08:34:56 | 000,054,784 | ---- | M] (Storm Technology, Inc.) -- C:\WINDOWS\EasyPhoto Slide Show.scr
    [2000/05/02 19:53:42 | 000,087,872 | ---- | M] () -- C:\WINDOWS\INCUBU~1.SCR
    [1995/09/29 14:52:36 | 000,030,464 | ---- | M] () -- C:\WINDOWS\TWINKLE.SCR

    < %systemroot%\*._sy >

    < %APPDATA%\Adobe\Update\*.* >

    < %ALLUSERSPROFILE%\Favorites\*.* >

    < %APPDATA%\Microsoft\*.* >

    < %PROGRAMFILES%\*.* >

    < %APPDATA%\Update\*.* >

    < %systemroot%\*. /mp /s >

    < %systemroot%\System32\config\*.sav >
    [2004/08/11 17:06:14 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
    [2004/08/11 17:06:14 | 000,659,456 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
    [2004/08/11 17:06:14 | 000,876,544 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav

    < %PROGRAMFILES%\bak. /s >

    < %systemroot%\system32\bak. /s >

    < %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
    [2008/08/20 21:15:47 | 000,000,272 | -HS- | M] () -- C:\Documents and Settings\All Users\Start Menu\desktop.ini

    < %systemroot%\system32\config\systemprofile\*.dat /x >

    < %systemroot%\*.config >

    < %systemroot%\system32\*.db >

    < %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
    [2008/03/14 18:23:37 | 000,000,119 | -HS- | M] () -- C:\Documents and Settings\Donna Militello\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
    [2004/08/11 17:20:42 | 000,000,079 | ---- | M] () -- C:\Documents and Settings\Donna Militello\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

    < %USERPROFILE%\Desktop\*.exe >

    < %PROGRAMFILES%\Common Files\*.* >

    < %systemroot%\*.src >

    < %systemroot%\install\*.* >

    < %systemroot%\system32\DLL\*.* >

    < %systemroot%\system32\HelpFiles\*.* >

    < %systemroot%\system32\rundll\*.* >

    < %systemroot%\winn32\*.* >

    < %systemroot%\Java\*.* >

    < %systemroot%\system32\test\*.* >

    < %systemroot%\system32\Rundll32\*.* >

    < %systemroot%\AppPatch\Custom\*.* >

    < %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

    < %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

    < %PROGRAMFILES%\Internet Explorer\*.tmp >

    < %PROGRAMFILES%\Internet Explorer\*.dat >

    < %USERPROFILE%\My Documents\*.exe >
    [2009/08/17 13:58:35 | 004,101,344 | ---- | M] () -- C:\Documents and Settings\Donna Militello\My Documents\CW1348A0.exe
    [2009/08/17 13:57:56 | 000,777,714 | ---- | M] () -- C:\Documents and Settings\Donna Militello\My Documents\O330-A06.EXE
    [2009/08/17 13:57:15 | 004,147,920 | ---- | M] () -- C:\Documents and Settings\Donna Militello\My Documents\R160758.exe
    [2009/08/17 13:57:17 | 005,761,160 | ---- | M] () -- C:\Documents and Settings\Donna Militello\My Documents\R161008.EXE
    [2009/08/17 13:57:17 | 007,229,152 | ---- | M] () -- C:\Documents and Settings\Donna Militello\My Documents\R161010.EXE
    [2009/08/17 13:57:35 | 012,150,160 | ---- | M] () -- C:\Documents and Settings\Donna Militello\My Documents\R161013.EXE
    [2009/08/17 13:57:46 | 014,556,976 | ---- | M] () -- C:\Documents and Settings\Donna Militello\My Documents\R164899.EXE
    [2009/08/17 13:57:20 | 000,322,544 | ---- | M] () -- C:\Documents and Settings\Donna Militello\My Documents\R165147.EXE
    [2009/08/17 13:57:22 | 000,326,896 | ---- | M] () -- C:\Documents and Settings\Donna Militello\My Documents\R173412.exe
    [2009/08/17 13:58:27 | 020,910,515 | ---- | M] () -- C:\Documents and Settings\Donna Militello\My Documents\R173416.exe
    [2009/08/17 13:58:17 | 025,600,328 | ---- | M] () -- C:\Documents and Settings\Donna Militello\My Documents\R174616.exe
    [2010/05/01 13:48:45 | 020,221,528 | ---- | M] () -- C:\Documents and Settings\Donna Militello\My Documents\R205648.EXE

    < %USERPROFILE%\*.exe >

    < %systemroot%\ADDINS\*.* >
    [2004/08/04 05:00:00 | 000,000,791 | ---- | M] () -- C:\WINDOWS\addins\fxsext.ecf

    < %systemroot%\assembly\*.bak2 >

    < %systemroot%\Config\*.* >

    < %systemroot%\REPAIR\*.bak2 >

    < %systemroot%\SECURITY\Database\*.sdb /x >

    < %systemroot%\SYSTEM\*.bak2 >

    < %systemroot%\Web\*.bak2 >

    < %systemroot%\Driver Cache\*.* >

    < %PROGRAMFILES%\Mozilla Firefox\0*.exe >

    < %ProgramFiles%\Microsoft Common\*.* >

    < %ProgramFiles%\TinyProxy. >

    < %USERPROFILE%\Favorites\*.url /x >
    [2008/03/14 18:23:36 | 000,000,122 | -HS- | M] () -- C:\Documents and Settings\Donna Militello\Favorites\Desktop.ini
    [2008/03/14 21:21:26 | 000,000,571 | -H-- | M] () -- C:\Documents and Settings\Donna Militello\Favorites\hpothb07.dat
    [2008/03/14 21:21:26 | 000,000,775 | -H-- | M] () -- C:\Documents and Settings\Donna Militello\Favorites\hpothb07.tif
    [2004/05/09 14:39:26 | 000,001,423 | ---- | M] () -- C:\Documents and Settings\Donna Militello\Favorites\Try AOL for Broadband.lnk

    < %systemroot%\system32\*.bk >

    < %systemroot%\*.te >

    < %systemroot%\system32\system32\*.* >

    < %ALLUSERSPROFILE%\*.dat /x >
    [2010/11/15 15:33:00 | 000,020,326 | ---- | M] () -- C:\Documents and Settings\All Users\lxdo
    [4 C:\Documents and Settings\All Users\*.tmp files -> C:\Documents and Settings\All Users\*.tmp -> ]

    < %systemroot%\system32\drivers\*.rmv >

    < dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

    < dir /b "%systemroot%\*.exe" | find /i " " /c >

    < %PROGRAMFILES%\Microsoft\*.* >

    < %systemroot%\System32\Wbem\proquota.exe >

    < %PROGRAMFILES%\Mozilla Firefox\*.dat >

    < %USERPROFILE%\Cookies\*.txt /x >
    [2010/11/15 17:43:36 | 000,000,067 | -HS- | M] () -- C:\Documents and Settings\Donna Militello\Cookies\desktop.ini
    [2010/11/15 20:09:49 | 000,442,368 | ---- | M] () -- C:\Documents and Settings\Donna Militello\Cookies\index.dat

    < %SystemRoot%\system32\fonts\*.* >

    < %systemroot%\system32\winlog\*.* >

    < %systemroot%\system32\Language\*.* >

    < %systemroot%\system32\Settings\*.* >

    < %systemroot%\system32\*.quo >

    < %SYSTEMROOT%\AppPatch\*.exe >

    < %SYSTEMROOT%\inf\*.exe >
    [2007/06/26 22:10:26 | 000,317,440 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\inf\unregmp2.exe

    < %SYSTEMROOT%\Installer\*.exe >

    < %systemroot%\system32\config\*.bak2 >

    < %systemroot%\system32\Computers\*.* >

    < %SystemRoot%\system32\Sound\*.* >

    < %SystemRoot%\system32\SpecialImg\*.* >

    < %SystemRoot%\system32\code\*.* >

    < %SystemRoot%\system32\draft\*.* >

    < %SystemRoot%\system32\MSSSys\*.* >

    < %ProgramFiles%\Javascript\*.* >

    < %systemroot%\pchealth\helpctr\System\*.exe /s >

    < %systemroot%\Web\*.exe >

    < %systemroot%\system32\msn\*.* >

    < %systemroot%\system32\*.tro >

    < %AppData%\Microsoft\Installer\msupdates\*.* >

    < %ProgramFiles%\Messenger\*.* >
    [2008/04/13 19:11:51 | 000,033,792 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\custsat.dll
    [2004/08/04 01:06:34 | 000,004,821 | ---- | M] () -- C:\Program Files\Messenger\logowin.gif
    [2004/08/04 01:06:34 | 000,007,047 | ---- | M] () -- C:\Program Files\Messenger\lvback.gif
    [2008/05/02 09:01:49 | 000,083,968 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgsc.dll
    [2008/04/13 12:30:28 | 000,180,224 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgslang.dll
    [2008/04/13 19:12:28 | 001,695,232 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msmsgs.exe
    [2004/08/04 01:06:36 | 000,002,882 | ---- | M] () -- C:\Program Files\Messenger\newalert.wav
    [2004/08/04 01:06:36 | 000,006,156 | ---- | M] () -- C:\Program Files\Messenger\newemail.wav
    [2004/08/04 01:06:36 | 000,006,160 | ---- | M] () -- C:\Program Files\Messenger\online.wav
    [2004/08/04 01:06:36 | 000,004,454 | ---- | M] () -- C:\Program Files\Messenger\type.wav
    [2004/08/04 01:06:36 | 000,115,981 | ---- | M] () -- C:\Program Files\Messenger\xpmsgr.chm

    < %systemroot%\system32\systhem32\*.* >

    < %systemroot%\system\*.exe >

    < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

    < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-11-12 08:09:16
     
  9. dmill

    dmill TS Rookie Topic Starter

    Here is the again part of the OTL file. The rest of the OTL file and Extras file will follow.

    ========== Alternate Data Streams ==========

    @Alternate Data Stream - 97 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:0C988F7D
    @Alternate Data Stream - 387 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CA9366D8
    @Alternate Data Stream - 338 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:1DFBC3C0
    @Alternate Data Stream - 236 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:EF0C5444
    @Alternate Data Stream - 236 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:6247E766
    @Alternate Data Stream - 233 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:79875988
    @Alternate Data Stream - 230 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:88C0A705
    @Alternate Data Stream - 227 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:29F0CA7D
    @Alternate Data Stream - 226 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:341C1FBD
    @Alternate Data Stream - 224 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:E411AA0D
    @Alternate Data Stream - 220 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:FAB64002
    @Alternate Data Stream - 219 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:569CEE83
    @Alternate Data Stream - 218 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:70E897B5
    @Alternate Data Stream - 218 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:6017A808
    @Alternate Data Stream - 217 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:C22674B6
    @Alternate Data Stream - 217 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:94B46CA2
    @Alternate Data Stream - 217 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:206470A5
    @Alternate Data Stream - 213 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:B1786630
    @Alternate Data Stream - 210 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:B1381B34
    @Alternate Data Stream - 208 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DE875C30
    @Alternate Data Stream - 208 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:774A0E14
    @Alternate Data Stream - 205 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D48500F8
    @Alternate Data Stream - 193 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:95198126
    @Alternate Data Stream - 192 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:C07A6A6B
    @Alternate Data Stream - 192 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:8DCF53BE
    @Alternate Data Stream - 182 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:8D8F3340
     
  10. dmill

    dmill TS Rookie Topic Starter

    @Alternate Data Stream - 179 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:FDAF118C
    @Alternate Data Stream - 178 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:001F2DD1
    @Alternate Data Stream - 175 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D09AEE3D
    @Alternate Data Stream - 166 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:92D18A5E
    @Alternate Data Stream - 158 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DE455370
    @Alternate Data Stream - 151 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:8599F087
    @Alternate Data Stream - 151 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:478FEFC3
    @Alternate Data Stream - 151 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:07348C09
    @Alternate Data Stream - 150 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CF2C26D2
    @Alternate Data Stream - 150 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:0E660858
    @Alternate Data Stream - 148 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:39F44D9C
    @Alternate Data Stream - 147 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:EA10407C
    @Alternate Data Stream - 147 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A819A132
    @Alternate Data Stream - 147 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:4F7FE589
    @Alternate Data Stream - 146 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:3A7527E8
    @Alternate Data Stream - 146 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:1C93E55E
    @Alternate Data Stream - 145 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:EBE4F6FC
    @Alternate Data Stream - 144 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:F8F070C2
    @Alternate Data Stream - 142 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A4AF8D0D
    @Alternate Data Stream - 142 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5EC637CB
    @Alternate Data Stream - 141 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:67CF910D
    @Alternate Data Stream - 140 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:E8A39657
    @Alternate Data Stream - 140 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:689E7F7D
    @Alternate Data Stream - 137 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:9491C9C7
    @Alternate Data Stream - 137 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:69B9AAE7
    @Alternate Data Stream - 136 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CCB49694
    @Alternate Data Stream - 135 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D3A89E47
    @Alternate Data Stream - 135 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:2A551D3B
    @Alternate Data Stream - 134 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A6D6E537
    @Alternate Data Stream - 134 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:8B4B9596
    @Alternate Data Stream - 134 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:609CAC7C
    @Alternate Data Stream - 133 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D3904CCE
    @Alternate Data Stream - 133 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:C76CFF82
    @Alternate Data Stream - 133 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:588B60C7
    @Alternate Data Stream - 131 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:7FCB9D0D
    @Alternate Data Stream - 130 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:EAF954B6
    @Alternate Data Stream - 130 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:4A448DB2
    @Alternate Data Stream - 129 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:9D3C27E1
    @Alternate Data Stream - 129 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:99AC3203
    @Alternate Data Stream - 128 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DD04902E
    @Alternate Data Stream - 127 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:3DB6F365
    @Alternate Data Stream - 126 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:98982C88
    @Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:C8EAE2CC
    @Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:C0893153
    @Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:550179F5
    @Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:3086B95F
    @Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:AA6C7C38
    @Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:864881BF
    @Alternate Data Stream - 123 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:ADFAD95A
    @Alternate Data Stream - 123 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:4FA837B4
    @Alternate Data Stream - 123 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:3651A580
    @Alternate Data Stream - 123 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:193426B4
    @Alternate Data Stream - 121 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:FB65A4AA
    @Alternate Data Stream - 121 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:1D6B18F1
    @Alternate Data Stream - 121 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:0C0B833D
    @Alternate Data Stream - 119 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DC0B1070
    @Alternate Data Stream - 119 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:041C0562
    @Alternate Data Stream - 117 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:86FB3865
    @Alternate Data Stream - 114 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A0CB43B2
    @Alternate Data Stream - 113 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:AECF4772
    @Alternate Data Stream - 111 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:3595B780

    < End of report >
     
  11. dmill

    dmill TS Rookie Topic Starter

    This is now the extras file.

    OTL Extras logfile created on: 11/15/2010 9:18:57 PM - Run 1
    OTL by OldTimer - Version 3.2.17.3 Folder = C:\Documents and Settings\Administrator\Desktop\Desktop
    Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
    Internet Explorer (Version = 8.0.6001.18702)
    Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

    2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 63.00% Memory free
    4.00 Gb Paging File | 3.00 Gb Available in Paging File | 81.00% Paging File free
    Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
    Drive C: | 60.00 Gb Total Space | 8.47 Gb Free Space | 14.11% Space Free | Partition Type: NTFS
    Drive D: | 88.95 Gb Total Space | 88.60 Gb Free Space | 99.60% Space Free | Partition Type: NTFS
    Unable to calculate disk information.

    Computer Name: FAMILY | User Name: Donna Militello | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: Current user
    Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

    ========== Extra Registry (SafeList) ==========


    ========== File Associations ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

    [HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
    .hta [@ = htafile] -- Reg Error: Key error. File not found
    .url [@ = InternetShortcut] -- Reg Error: Key error. File not found
    .vbs [@ = VBSFile] -- Reg Error: Key error. File not found

    ========== Shell Spawning ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
    batfile [open] -- "%1" %*
    cmdfile [open] -- "%1" %*
    comfile [open] -- "%1" %*
    exefile [open] -- "%1" %*
    piffile [open] -- "%1" %*
    regfile [merge] -- Reg Error: Key error.
    scrfile [config] -- "%1"
    scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
    scrfile [open] -- "%1" /S
    txtfile [edit] -- Reg Error: Key error.
    Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
    Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
    Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
    Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
    Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

    ========== Security Center Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
    "FirstRunDisabled" = 1
    "UpdatesDisableNotify" = 0
    "AntiVirusOverride" = 0
    "FirewallOverride" = 0
    "AntiVirusDisableNotify" = 0
    "FirewallDisableNotify" = 0

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

    ========== System Restore Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
    "DisableSR" = 0

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
    "Start" = 0

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
    "Start" = 2

    ========== Firewall Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
    "EnableFirewall" = 1
    "DoNotAllowExceptions" = 0

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
    "1900:UDP" = 1900:UDP:LocalSubNet:Enabled:mad:xpsp2res.dll,-22007
    "2869:TCP" = 2869:TCP:LocalSubNet:Enabled:mad:xpsp2res.dll,-22008
    "67:UDP" = 67:UDP:*:Enabled:DHCP Discovery Service

    ========== Authorized Applications List ==========

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
    "C:\Program Files\America Online 9.0\waol.exe" = C:\Program Files\America Online 9.0\waol.exe:*:Enabled:America Online 9.0 -- File not found
    "C:\Program Files\AOL 9.1\waol.exe" = C:\Program Files\AOL 9.1\waol.exe:*:Enabled:AOL 9.1 -- (AOL, LLC.)

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
    "C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" = C:\Program Files\Common Files\AOL\ACS\AOLDial.exe:*:Enabled:AOL Connectivity Service Dialer -- (AOL LLC)
    "C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe" = C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe:*:Enabled:AOL Connectivity Service -- (AOL LLC)
    "C:\Program Files\Common Files\AOL\1206122613\ee\aolsoftware.exe" = C:\Program Files\Common Files\AOL\1206122613\ee\aolsoftware.exe:*:Enabled:AOL Shared Components -- (AOL LLC)
    "C:\Program Files\Common Files\AOL\TopSpeed\3.0\aoltpsd3.exe" = C:\Program Files\Common Files\AOL\TopSpeed\3.0\aoltpsd3.exe:*:Enabled:AOL TopSpeed -- (AOL LLC)
    "C:\Program Files\Common Files\AOL\Loader\aolload.exe" = C:\Program Files\Common Files\AOL\Loader\aolload.exe:*:Enabled:AOL Loader -- (AOL LLC)
    "C:\Program Files\Common Files\AOL\System Information\sinf.exe" = C:\Program Files\Common Files\AOL\System Information\sinf.exe:*:Enabled:AOL System Information -- (AOL LLC)
    "C:\Program Files\Lexmark 9500 Series\lxdomon.exe" = C:\Program Files\Lexmark 9500 Series\lxdomon.exe:*:Enabled:printer Device Monitor -- ()
    "C:\Program Files\Lexmark 9500 Series\lxdoamon.exe" = C:\Program Files\Lexmark 9500 Series\lxdoamon.exe:*:Enabled:Lexmark Device Monitor -- ()
    "C:\Program Files\Lexmark 9500 Series\FRun.exe" = C:\Program Files\Lexmark 9500 Series\FRun.exe:*:Enabled:Lexmark Productivity Studio -- ()
    "C:\Program Files\Abbyy FineReader 6.0 Sprint\scan\scanman6.exe" = C:\Program Files\Abbyy FineReader 6.0 Sprint\scan\scanman6.exe:*:Enabled:ABBYY FineReader -- (ABBYY (BIT Software))
    "C:\Program Files\Lexmark 9500 Series\lxdofax.exe" = C:\Program Files\Lexmark 9500 Series\lxdofax.exe:*:Enabled:Fax software -- ()
    "C:\WINDOWS\system32\lxdocoms.exe" = C:\WINDOWS\system32\lxdocoms.exe:*:Enabled:Lexmark Communications System -- ( )
    "C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdopswx.exe" = C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdopswx.exe:*:Enabled:printer Status Window Interface -- ()
    "C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdotime.exe" = C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdotime.exe:*:Enabled:Lexmark Connect Time Executable -- (Lexmark International, Inc.)
    "C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdojswx.exe" = C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdojswx.exe:*:Enabled:Job Status Window Interface -- ()
    "C:\Program Files\AOL 9.1\waol.exe" = C:\Program Files\AOL 9.1\waol.exe:*:Enabled:AOL 9.1 -- (AOL, LLC.)
    "C:\Program Files\Lexmark 9500 Series\Wireless\lxdowpss.exe" = C:\Program Files\Lexmark 9500 Series\Wireless\lxdowpss.exe:*:Enabled: -- (Lexmark International, Inc.)
    "C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes -- (Apple Inc.)
    "C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe" = C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe:LocalSubNet:Enabled:pure Networks Platform Service -- (Cisco Systems, Inc.)
    "C:\Documents and Settings\Donna Militello\Application Data\mjusbsp\magicJack.exe" = C:\Documents and Settings\Donna Militello\Application Data\mjusbsp\magicJack.exe:*:Enabled:magicJack -- (magicJack L.P.)


    ========== HKEY_LOCAL_MACHINE Uninstall List ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
    "{00000000-785F-478A-BAA2-87F1A136068C}" = MSN Encarta Plus Support Files
    "{00203668-8170-44A0-BE44-B632FA4D780F}" = Adobe AIR
    "{00CB213D-CA43-4CB7-A9ED-808E1D0E4739}" = Video Capture USB
    "{0394CDC8-FABD-4ed8-B104-03393876DFDF}" = Roxio Creator Tools
    "{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
    "{0D397393-9B50-4c52-84D5-77E344289F87}" = Roxio Creator Data
    "{0D499481-22C6-4B25-8AC2-6D3F6C885FB9}" = OpenOffice.org Installer 1.0
    "{1451DE6B-ABE1-4F62-BE9A-B363A17588A2}" = QuickTime
    "{177D1318-3E4B-4A7C-A300-AC4E21BE090B}" = Broadcom Management Programs
    "{1B4AA674-F5CA-4BB5-831A-CD37B4021959}" = ImageMixer for Sony
    "{1D53B6F9-E66E-42D8-A221-4FF8AC134FD7}" = Roxio Activation Module
    "{1EBB57D4-63FF-87CC-A0F0-D73982CF6008}" = Adobe Media Player
    "{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    "{21ABEA96-CCAB-4C40-8699-6BDFEC5FD63C}" = Roxio Easy VHS to DVD Content
    "{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java(TM) 6 Update 20
    "{281ECE39-F043-492B-8337-F2E546B5604A}" = PowerDVD
    "{2AFFFDD7-ED85-4A90-8C52-5DA9EBDC9B8F}" = Microsoft SQL Server 2005 Express Edition (MSSMLBIZ)
    "{2F4C24E6-CBD4-4AAC-B56F-C9FD44DE5668}" = Roxio Drag-to-Disc
    "{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Roxio Update Manager
    "{32F66A20-7614-11D4-BD11-00104BD3F987}" = MathPlayer
    "{3383136B-4F86-4F05-8612-DD4BB16A1EAE}" = Roxio Easy VHS to DVD
    "{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
    "{353D20CC-719B-4A60-AD33-D03F88C10330}" = Microsoft Office Accounting PayPal Addin
    "{35E1EC43-D4FC-4E4A-AAB3-20DDA27E8BB0}" = Sonic Activation Module
    "{3AC54383-31D1-4907-961B-B12CBB1D0AE8}" = MobileMe Control Panel
    "{3AF1FB80-21BD-4715-8EE2-AB77925519D9}" = PCsync
    "{46614A49-222A-48EF-87A9-BFD603E608E1}" = Microsoft Office Accounting Fixed Asset Manager
    "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
    "{4D97A48B-B4AB-4872-9F47-09D8C3455B84}" = PCmover
    "{4F1CECBC-670F-4daa-81D6-944B12450917}" = DIGReqEx
    "{53F5C3EE-05ED-4830-994B-50B2F0D50FCE}" = Microsoft SQL Server Setup Support Files (English)
    "{553255F3-78FD-40F1-A6F8-6882140265FE}" = Apple Application Support
    "{564A8DD3-70BC-4018-A5C3-7CEB10BBB6E9}" = Image Transfer
    "{56B4002F-671C-49F4-984C-C760FE3806B5}" = Microsoft SQL Server VSS Writer
    "{5C29CB8B-AC1E-4114-8D68-9CD080140D4A}" = Sony USB Driver
    "{5FA793A6-0071-42C1-9355-8F69A428C44F}" = Microsoft Office Accounting ADP Payroll Addin
    "{619CDD8A-14B6-43a1-AB6C-0F4EE48CE048}" = Roxio Creator Copy
    "{62230596-37E5-4618-A329-0D21F529A86F}" = Browser Address Error Redirector
    "{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler
    "{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
    "{6ECB39BD-73C2-44DD-B1A0-898207C58D8B}" = HP Photo and Imaging 2.0 - All-in-One Drivers
    "{72CD4C5F-AB0B-4814-8780-9A4F26A2086B}" = Presto! PageManager 7.12.20
    "{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    "{7919D8D9-69FB-4E94-B330-04C4AF251867}" = Roxio Easy VHS to DVD
    "{797EE0CA-8165-405C-B5CE-F11EC20F1BB0}" = Microsoft VC9 runtime libraries
    "{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112930333}" = Lottso! Deluxe
    "{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113143653}" = Dream Chronicles
    "{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-116723770}" = Annabel
    "{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-117326840}" = The Mystery of the Crystal Portal
    "{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-117337303}" = GHOST Chronicles Phantom of the Ren Faire
    "{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-117629560}" = Princess Isabella A Witch’s Curse
    "{83FFCFC7-88C6-41c6-8752-958A45325C82}" = Roxio Creator Audio
    "{85D3CC30-8859-481A-9654-FD9B74310BEF}" = Musicmatch® Jukebox
    "{86844E31-42CC-49C8-B647-7213009F4719}" = Diagnostic Tool for the Microsoft VM
    "{880AF49C-34F7-4285-A8AD-8F7A3D1C33DC}" = Roxio Creator BDAV Plugin
    "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
    "{8C711818-076E-475C-B95B-DF11CD9D8DBE}" = Microsoft Office Accounting Equifax Addin
    "{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
    "{90120000-0010-0409-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (English) 12
    "{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
    "{90120000-0015-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
    "{90120000-0016-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
    "{90120000-0018-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
    "{90120000-0019-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
    "{90120000-001A-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
    "{90120000-001B-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
    "{90120000-001F-0409-0000-0000000FF1CE}_PROHYBRIDR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
    "{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
    "{90120000-001F-040C-0000-0000000FF1CE}_PROHYBRIDR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
    "{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
    "{90120000-001F-0C0A-0000-0000000FF1CE}_PROHYBRIDR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
    "{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
    "{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
    "{90120000-006E-0409-0000-0000000FF1CE}_PROHYBRIDR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
    "{90120000-0115-0409-0000-0000000FF1CE}_PROHYBRIDR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
    "{90120000-0117-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel(R) Matrix Storage Manager
    "{90A40409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office 2003 Web Components
    "{91120000-0031-0000-0000-0000000FF1CE}" = Microsoft Office Professional Hybrid 2007
    "{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
    "{93FB47FB-4FDF-4131-B5FD-7A37883868E7}" = hp psc 2170 series
    "{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
    "{9867A917-5D17-40DE-83BA-BEA5293194B1}" = HP Photo and Imaging 2.0 - All-in-One
    "{9ABA26E1-843A-4A72-95AF-C72474E191F6}" = Hoyle Card Games 2003
    "{9F7FC79B-3059-4264-9450-39EB368E3220}" = Microsoft Picture It! Library 9
    "{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
    "{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
    "{A5F68DC8-0278-4AD8-B413-861509B5F25B}" = ArcSoft Panorama Maker 3
    "{A67BB21E-D419-45BB-AB86-7D87D14BBCE2}" = Safari
    "{A939D341-5A04-4E0A-BB55-3E65B386432D}" = Microsoft Office Small Business Connectivity Components
    "{AADEA55D-C834-4BCB-98A3-4B8D1C18F4EE}" = Apple Mobile Device Support
    "{AB05F2C8-F608-403b-95E1-FD8ADFACD31E}" = Windows 7 Upgrade Advisor
    "{ABEB838C-A1A7-4C5D-B7E1-8B4314600207}" = MSN Messenger 6.1
    "{AC76BA86-7AD7-1033-7B44-A82000000003}" = Adobe Reader 8.2.5
    "{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}" = ABBYY FineReader 6.0 Sprint
    "{AF9E97C1-7431-426D-A8D5-ABE40995C0B1}" = DirectX 9 Runtime
    "{B0717D5A-1976-482B-9ADF-F19631A541A4}" = Microsoft Office Accounting 2007
    "{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
    "{B376402D-58EA-45EA-BD50-DD924EB67A70}" = HP Memories Disc
    "{B79920F8-AB6E-45B2-B257-900BBA969FF7}" = Presto! Forms 3.60.10
    "{BD68F46D-8A82-4664-8E68-F87C55BDEFD4}" = Microsoft SQL Server Native Client
    "{BF2A74BF-8D12-47F1-8B19-22B30AF6B0D1}" = Linksys EasyLink Advisor
    "{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
    "{C0FE37FA-0886-4B66-B01B-76CF70FB77AB}" = Roxio CinePlayer Decoder Pack
    "{C34FAEF3-4241-4C4E-9CFF-7BBD8BCEABE7}" = WebEx Support Manager for Internet Explorer
    "{C769B501-2BE8-46ed-9E69-118F008A0917}" = DIGOpt
    "{C8B0680B-CDAE-4809-9F91-387B6DE00F7C}" = Roxio Creator DE
    "{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
    "{CB9EA6BB-B653-11D4-B6F6-00105A27284D}" = Generations
    "{CD95F661-A5C4-44F5-A6AA-ECDD91C240BE}" = WinZip 15.0
    "{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
    "{D2FCC1AE-6311-47C5-8130-C6C66D77DD71}" = Nikon Message Center
    "{D5D52242-0767-4A6E-8A8A-B5CB8015E9BF}" = Video Capture USB
    "{DBA8B9E1-C6FF-4624-9598-73D3B41A0900}" = Microsoft Picture It! Express 9
    "{DC4DD556-DD03-422A-926B-470746D8B50D}" = Microsoft Office Outlook Connector for MSN
    "{E40D6E16-6D7D-4AF3-9E13-B3A308571E81}" = Roxio Easy VHS to DVD
    "{E56D5DC8-4C73-44B1-B650-AAD75C7A2701}" = Broadcom ASF Management Applications
    "{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX
    "{F439D7AF-03F3-4F8E-AEC4-571BFE977C61}" = iTunes
    "{F7FC9307-374E-4017-8E9D-DE1154780480}" = System Requirements Lab for Intel
    "{F8722041-B63A-47FB-82A8-5F0977E1CF45}" = TWC Customer Controls
    "{FA54AFB1-5745-4389-B8C1-9F7509672ED1}" = iPhone Configuration Utility
    "{FBDBC490-089D-4476-BF72-1F7A6368200A}" = Pure Networks Platform
    "{FC57FC53-104C-415C-98D7-B05E659461A9}" = Broadcom Gigabit Integrated Controller
    "{FF3999BE-1A7B-4738-88AA-97BF14094A4A}" = PictureProject
    "Adobe Acrobat 4.0" = Adobe Acrobat 4.0
    "Adobe AIR" = Adobe AIR
    "Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
    "Adobe Photoshop 7.0" = Adobe Photoshop 7.0
    "Adobe Shockwave Player" = Adobe Shockwave Player 11.5
    "AOL Emergency Connect Utility 1.0" = Uninstall AOL Emergency Connect Utility 1.0
    "AOL Uninstaller" = AOL Uninstaller (Choose which Products to Remove)
    "AolCoach" = AOL Coach Version 1.0(Build:20030807.3)
    "Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
    "BFG-Awakening - The Dreamless Castle" = Awakening: The Dreamless Castle
    "BFG-Azada" = Azada &reg;
    "BFGC" = Big Fish Games: Game Manager
    "BFG-Dream Chronicles - The Book of Air Collector's Edition" = Dream Chronicles: The Book of Air Collector's Edition
    "BFG-Haunted Manor - Lord of Mirrors" = Haunted Manor: Lord of Mirrors
    "BFG-Hidden in Time - Mirror Mirror" = Hidden in Time: Mirror Mirror
    "BFG-Hidden Mysteries - Vampire Secrets" = Hidden Mysteries: Vampire Secrets
    "BFG-Island - The Lost Medallion" = Island: The Lost Medallion
    "BFG-Love and Death - Bitten" = Love & Death ™: Bitten ™
    "BFG-Mysteries of Magic Island" = Mysteries of Magic Island
    "BFG-Mystery Age - The Dark Priests" = Mystery Age: The Dark Priests
    "BFG-Mystery Case Files - Return to Ravenhearst" = Mystery Case Files: Return to Ravenhearst ™
    "BFG-Mystery of the Earl" = Mystery of the Earl
    "BFG-Mystic Gateways - The Celestial Quest" = Mystic Gateways: The Celestial Quest
    "BFG-Reincarnations - Awakening" = Reincarnations: Awakening
    "BFG-Robin's Quest - A Legend Born" = Robin's Quest: A Legend Born
    "BFG-Samantha Swift - Mystery From Atlantis" = Samantha Swift: Mystery From Atlantis
    "BFG-The Mystery of the Crystal Portal - Beyond the Horizon" = The Mystery of the Crystal Portal: Beyond the Horizon
    "BFG-The Serpent of Isis" = The Serpent of Isis ™
    "BFG-Time Mysteries - Inheritance" = Time Mysteries: Inheritance
    "BFG-Treasure Seekers - The Enchanted Canvases" = Treasure Seekers: The Enchanted Canvases
    "BFG-Victorian Mysteries - Woman in White" = Victorian Mysteries: Woman in White
    "CD7CFA9080156C3BB6CE0662E209EB7415EFCD0F" = Windows Driver Package - Roxio Technology (USB28xxBGA) Media (11/14/2008 5.8.0912.1114)
    "com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player
    "Dream Chronicles - The Chosen Child" = Dream Chronicles - The Chosen Child
    "Dream Chronicles 2" = Dream Chronicles 2
    "HDMI" = Intel(R) Graphics Media Accelerator Driver
    "IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
    "ie7" = Windows Internet Explorer 7
    "ie8" = Windows Internet Explorer 8
    "InstallShield_{9ABA26E1-843A-4A72-95AF-C72474E191F6}" = Hoyle Card Games 2003
    "Lexmark 9500 Series" = Lexmark 9500 Series
    "Linksys EasyLink Advisor" = Linksys EasyLink Advisor
    "Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
    "Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
    "Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
    "Microsoft Office Accounting 2007" = Microsoft Office Accounting 2007
    "Microsoft Office Accounting Equifax Addin" = Microsoft Office Accounting Equifax Addin
    "Microsoft Office Accounting PayPal Addin" = Microsoft Office Accounting PayPal Addin
    "Microsoft SQL Server 2005" = Microsoft SQL Server 2005
    "MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
    "MSNINST" = MSN
    "MWASPI" = MicroStaff WINASPI
    "Nightshift Legacy - The Jaguars Eye" = Nightshift Legacy - The Jaguars Eye
    "NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
    "OpenAL" = OpenAL
    "PC Matic_is1" = PC Matic 1.1.0.33
    "PC Pitstop Driver Alert_is1" = PC Pitstop Driver Alert 1.0.0.13
    "PictureIt_POD_v9" = Microsoft Picture It! Library 9
    "PictureIt_v9" = Microsoft Picture It! Express 9
    "Print Artist 8.0" = SierraHome Print Artist 8.0
    "PROHYBRIDR" = 2007 Microsoft Office system
    "Ravenhearst" = Ravenhearst
    "RealPlayer 6.0" = RealPlayer Basic
    "Samantha Swift and the Golden Touch" = Samantha Swift and the Golden Touch
    "Samantha Swift and the Hidden Roses of Athena" = Samantha Swift and the Hidden Roses of Athena
    "SearchAssist" = SearchAssist
    "SoftwareUpdUtility" = Download Updater (AOL LLC)
    "StreetPlugin" = Learn2 Player (Uninstall Only)
    "SystemRequirementsLab" = System Requirements Lab
    "TranslatorBar_1 Toolbar" = TranslatorBar_1 Toolbar
    "TranslatorBar_1.2 Toolbar" = TranslatorBar_1.2 Toolbar
    "ViewpointMediaPlayer" = Viewpoint Media Player
    "Visio Professional" = Visio Professional
    "Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
    "WebPost" = Microsoft Web Publishing Wizard 1.52
    "WETCable" = Windows Easy Transfer
    "Windows Live OneCare safety scanner" = Windows Live OneCare safety scanner
    "Windows Media Format Runtime" = Windows Media Format 11 runtime
    "Windows Media Player" = Windows Media Player 11
    "Windows XP Service Pack" = Windows XP Service Pack 3
    "winusb0100" = Microsoft WinUsb 1.0
    "WMFDist11" = Windows Media Format 11 runtime
    "wmp11" = Windows Media Player 11
    "Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
    "Yahoo! Companion" = Yahoo! Toolbar
    "Yahoo! Software Update" = Yahoo! Software Update

    ========== HKEY_CURRENT_USER Uninstall List ==========

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
    "309a46b1dc89b774" = Dell Driver Download Manager
    "f031ef6ac137efc5" = Dell Driver Download Manager - 1
    "magicJack" = magicJack

    ========== Last 10 Event Log Errors ==========

    [ Application Events ]
    Error - 11/11/2010 6:54:47 PM | Computer Name = FAMILY | Source = Userenv | ID = 1041
    Description = Windows cannot query DllName registry entry for {CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}
    and it will not be loaded. This is most likely caused by a faulty registration.

    Error - 11/11/2010 6:54:47 PM | Computer Name = FAMILY | Source = Userenv | ID = 1041
    Description = Windows cannot query DllName registry entry for {7B849a69-220F-451E-B3FE-2CB811AF94AE}
    and it will not be loaded. This is most likely caused by a faulty registration.

    Error - 11/11/2010 6:54:47 PM | Computer Name = FAMILY | Source = Userenv | ID = 1041
    Description = Windows cannot query DllName registry entry for {CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}
    and it will not be loaded. This is most likely caused by a faulty registration.

    Error - 11/11/2010 6:55:02 PM | Computer Name = FAMILY | Source = Broadcom ASF IP and SMBIOS Mailbox Monitor | ID = 0
    Description =

    Error - 11/11/2010 10:20:46 PM | Computer Name = FAMILY | Source = Broadcom ASF IP and SMBIOS Mailbox Monitor | ID = 0
    Description =

    Error - 11/12/2010 4:26:09 AM | Computer Name = FAMILY | Source = Broadcom ASF IP and SMBIOS Mailbox Monitor | ID = 0
    Description =

    Error - 11/13/2010 7:45:01 PM | Computer Name = FAMILY | Source = Broadcom ASF IP and SMBIOS Mailbox Monitor | ID = 0
    Description =

    Error - 11/14/2010 8:26:50 AM | Computer Name = FAMILY | Source = Broadcom ASF IP and SMBIOS Mailbox Monitor | ID = 0
    Description =

    Error - 11/14/2010 7:28:07 PM | Computer Name = FAMILY | Source = Broadcom ASF IP and SMBIOS Mailbox Monitor | ID = 0
    Description =

    Error - 11/15/2010 5:01:13 PM | Computer Name = FAMILY | Source = Broadcom ASF IP and SMBIOS Mailbox Monitor | ID = 0
    Description =

    [ OSession Events ]
    Error - 3/17/2010 8:25:36 PM | Computer Name = FAMILY | Source = Microsoft Office 12 Sessions | ID = 7001
    Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
    12.0.6504.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 1997
    seconds with 60 seconds of active time. This session ended with a crash.

    [ System Events ]
    Error - 11/15/2010 9:41:30 PM | Computer Name = FAMILY | Source = Service Control Manager | ID = 7001
    Description = The Remote Access Connection Manager service depends on the Telephony
    service which failed to start because of the following error: %%1058

    Error - 11/15/2010 9:54:40 PM | Computer Name = FAMILY | Source = Service Control Manager | ID = 7001
    Description = The Remote Access Connection Manager service depends on the Telephony
    service which failed to start because of the following error: %%1058

    Error - 11/15/2010 9:54:50 PM | Computer Name = FAMILY | Source = Service Control Manager | ID = 7001
    Description = The Remote Access Connection Manager service depends on the Telephony
    service which failed to start because of the following error: %%1058

    Error - 11/15/2010 10:01:40 PM | Computer Name = FAMILY | Source = Service Control Manager | ID = 7001
    Description = The Remote Access Connection Manager service depends on the Telephony
    service which failed to start because of the following error: %%1058

    Error - 11/15/2010 10:04:35 PM | Computer Name = FAMILY | Source = Service Control Manager | ID = 7001
    Description = The Remote Access Connection Manager service depends on the Telephony
    service which failed to start because of the following error: %%1058

    Error - 11/15/2010 10:16:46 PM | Computer Name = FAMILY | Source = Service Control Manager | ID = 7001
    Description = The Remote Access Connection Manager service depends on the Telephony
    service which failed to start because of the following error: %%1058

    Error - 11/15/2010 10:18:05 PM | Computer Name = FAMILY | Source = Service Control Manager | ID = 7001
    Description = The Remote Access Connection Manager service depends on the Telephony
    service which failed to start because of the following error: %%1058

    Error - 11/15/2010 10:18:18 PM | Computer Name = FAMILY | Source = Service Control Manager | ID = 7001
    Description = The Remote Access Connection Manager service depends on the Telephony
    service which failed to start because of the following error: %%1058

    Error - 11/15/2010 10:18:20 PM | Computer Name = FAMILY | Source = Service Control Manager | ID = 7001
    Description = The Remote Access Connection Manager service depends on the Telephony
    service which failed to start because of the following error: %%1058

    Error - 11/15/2010 10:18:33 PM | Computer Name = FAMILY | Source = Service Control Manager | ID = 7001
    Description = The Remote Access Connection Manager service depends on the Telephony
    service which failed to start because of the following error: %%1058


    < End of report >
     
  12. Broni

    Broni Malware Annihilator Posts: 52,892   +344

    You're very welcome :)
    Which browser is affected?

    Update your Java version here: http://www.java.com/en/download/installed.jsp

    Note 1: UNCHECK any pre-checked toolbar and/or software offered with the Java update. The pre-checked toolbars/software are not part of the Java update.

    Note 2: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. If you don't want to run another extra service, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click OK and restart your computer.

    Now, we need to remove old Java version and its remnants...

    Download JavaRa to your desktop and unzip it to its own folder
    • Run JavaRa.exe (Vista users! Right click on JavaRa.exe, click Run As Administrator), pick the language of your choice and click Select. Then click Remove Older Versions.
    • Accept any prompts.

    =========================================================================

    Run OTL
    • Under the Custom Scans/Fixes box at the bottom, paste in the following

      Code:
      :OTL
      IE - HKCU\..\URLSearchHook: - Reg Error: Key error. File not found
      IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - Reg Error: Key error. File not found
      IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
      FF - HKLM\software\mozilla\Firefox\extensions\\m3ffxtbr@mywebsearch.com: C:\Program Files\MyWebSearch\bar\3.bin File not found
      O16 - DPF: {49232000-16E4-426C-A231-62846947304B} http://ipgweb.cce.hp.com/rdq/downloads/sysinfo.cab (Reg Error: Key error.)
      O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} http://aolcc.aol.com/computercheckup/qdiagcc.cab (Reg Error: Key error.)
      O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} Reg Error: Key error. (Reg Error: Key error.)
      O16 - DPF: {54BE6B6F-3056-470B-97E1-BB92E051B6C4} http://h20264.www2.hp.com/ediags/dd/...osticsxp2k.cab (Reg Error: Key error.)
      O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} http://h20270.www2.hp.com/ediags/gmn...tDetection.cab (Reg Error: Key error.)
      O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} http://v4.windowsupdate.microsoft.co...045.7731597222 (Reg Error: Key error.)
      O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} http://download.av.aol.com/molbin/sh...20/mcgdmgr.cab (Reg Error: Key error.)
      O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Reg Error: Key error.)
      O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Reg Error: Key error.)
      O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (Reg Error: Value error.)
      O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
      O16 - DPF: DirectAnimation Java Classes Reg Error: Key error. (Reg Error: Key error.)
      O16 - DPF: Microsoft XML Parser for Java Reg Error: Key error. (Reg Error: Key error.)
      O16 - DPF: Win32 Classes Reg Error: Key error. (Reg Error: Key error.)
      [4 C:\Documents and Settings\All Users\*.tmp files -> C:\Documents and Settings\All Users\*.tmp -> ]
      @Alternate Data Stream - 97 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:0C988F7D
      @Alternate Data Stream - 387 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CA9366D8
      @Alternate Data Stream - 338 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:1DFBC3C0
      @Alternate Data Stream - 236 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:EF0C5444
      @Alternate Data Stream - 236 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:6247E766
      @Alternate Data Stream - 233 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:79875988
      @Alternate Data Stream - 230 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:88C0A705
      @Alternate Data Stream - 227 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:29F0CA7D
      @Alternate Data Stream - 226 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:341C1FBD
      @Alternate Data Stream - 224 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:E411AA0D
      @Alternate Data Stream - 220 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:FAB64002
      @Alternate Data Stream - 219 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:569CEE83
      @Alternate Data Stream - 218 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:70E897B5
      @Alternate Data Stream - 218 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:6017A808
      @Alternate Data Stream - 217 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:C22674B6
      @Alternate Data Stream - 217 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:94B46CA2
      @Alternate Data Stream - 217 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:206470A5
      @Alternate Data Stream - 213 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:B1786630
      @Alternate Data Stream - 210 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:B1381B34
      @Alternate Data Stream - 208 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DE875C30
      @Alternate Data Stream - 208 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:774A0E14
      @Alternate Data Stream - 205 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D48500F8
      @Alternate Data Stream - 193 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:95198126
      @Alternate Data Stream - 192 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:C07A6A6B
      @Alternate Data Stream - 192 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:8DCF53BE
      @Alternate Data Stream - 182 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:8D8F3340 
      @Alternate Data Stream - 179 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:FDAF118C
      @Alternate Data Stream - 178 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:001F2DD1
      @Alternate Data Stream - 175 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D09AEE3D
      @Alternate Data Stream - 166 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:92D18A5E
      @Alternate Data Stream - 158 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DE455370
      @Alternate Data Stream - 151 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:8599F087
      @Alternate Data Stream - 151 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:478FEFC3
      @Alternate Data Stream - 151 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:07348C09
      @Alternate Data Stream - 150 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CF2C26D2
      @Alternate Data Stream - 150 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:0E660858
      @Alternate Data Stream - 148 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:39F44D9C
      @Alternate Data Stream - 147 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:EA10407C
      @Alternate Data Stream - 147 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A819A132
      @Alternate Data Stream - 147 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:4F7FE589
      @Alternate Data Stream - 146 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:3A7527E8
      @Alternate Data Stream - 146 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:1C93E55E
      @Alternate Data Stream - 145 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:EBE4F6FC
      @Alternate Data Stream - 144 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:F8F070C2
      @Alternate Data Stream - 142 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A4AF8D0D
      @Alternate Data Stream - 142 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5EC637CB
      @Alternate Data Stream - 141 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:67CF910D
      @Alternate Data Stream - 140 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:E8A39657
      @Alternate Data Stream - 140 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:689E7F7D
      @Alternate Data Stream - 137 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:9491C9C7
      @Alternate Data Stream - 137 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:69B9AAE7
      @Alternate Data Stream - 136 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CCB49694
      @Alternate Data Stream - 135 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D3A89E47
      @Alternate Data Stream - 135 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:2A551D3B
      @Alternate Data Stream - 134 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A6D6E537
      @Alternate Data Stream - 134 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:8B4B9596
      @Alternate Data Stream - 134 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:609CAC7C
      @Alternate Data Stream - 133 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D3904CCE
      @Alternate Data Stream - 133 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:C76CFF82
      @Alternate Data Stream - 133 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:588B60C7
      @Alternate Data Stream - 131 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:7FCB9D0D
      @Alternate Data Stream - 130 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:EAF954B6
      @Alternate Data Stream - 130 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:4A448DB2
      @Alternate Data Stream - 129 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:9D3C27E1
      @Alternate Data Stream - 129 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:99AC3203
      @Alternate Data Stream - 128 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DD04902E
      @Alternate Data Stream - 127 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:3DB6F365
      @Alternate Data Stream - 126 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:98982C88
      @Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:C8EAE2CC
      @Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:C0893153
      @Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:550179F5
      @Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:3086B95F
      @Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:AA6C7C38
      @Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:864881BF
      @Alternate Data Stream - 123 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:ADFAD95A
      @Alternate Data Stream - 123 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:4FA837B4
      @Alternate Data Stream - 123 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:3651A580
      @Alternate Data Stream - 123 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:193426B4
      @Alternate Data Stream - 121 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:FB65A4AA
      @Alternate Data Stream - 121 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:1D6B18F1
      @Alternate Data Stream - 121 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:0C0B833D
      @Alternate Data Stream - 119 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DC0B1070
      @Alternate Data Stream - 119 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:041C0562
      @Alternate Data Stream - 117 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:86FB3865
      @Alternate Data Stream - 114 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A0CB43B2
      @Alternate Data Stream - 113 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:AECF4772
      @Alternate Data Stream - 111 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:3595B780
      
      :Services
      
      :Reg
      
      :Files
      
      :Commands
      [purity]
      [emptytemp]
      [emptyflash]
      [Reboot]
      
    • Then click the Run Fix button at the top
    • Let the program run unhindered, reboot the PC when it is done
    • You will get a log that shows the results of the fix. Please post it.
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...