My laptop has started running slowly, any suggestions ?

Inactive
By olymacaberdeen
Apr 27, 2011
Topic Status:
Not open for further replies.
  1. Hello,

    I am having difficulty with my laptop.
    It's a HP and I have only had it for 6 months but it already seems to be running slowly and I'm worried that I might have some viruses.

    Has anyone got any suggestions that could help me ?

    They would be much appreciated.

    Cheers for now,

    olymacaberdeen
  2. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +36

    Welcome to TechSpot! There are a lot of reasons for a computer slowing down. And even though your system is new, you have probably downloaded some programs and probably not taken the processes off of the Startup Menu that didn't need to start on boot.

    I can check for malware and the logs will also give me some idea of how much is running in the background.

    NOTE: If you already have any of the scanning programs on the computer, please remove them and download the versions in these links.

    Please follow the steps in the Preliminary Virus and Malware Removal thread HERE.

    When you have finished, leave the logs for review in your next reply .
    NOTE: Logs must be pasted in the replies. Attached logs will not be reviewed.

    Please do not use any other cleaning programs or scans while I'm helping you, unless I direct you to. Do not use a Registry cleaner or make any changes in the Registry.

    I have asked that your original thread posted in Introductions be closed. We will handle this problem, here on this thread.
  3. olymacaberdeen

    olymacaberdeen Newcomer, in training Topic Starter

    Hey,

    Thankyou, I really appreciate the help!

    I have clicked on the link and am starting to make my way through the steps as directed and I'll wait to see what the results are like.

    Thanks again!
  4. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +36

    Please paste the logs into your next reply. It's best to have me do the review.
  5. olymacaberdeen

    olymacaberdeen Newcomer, in training Topic Starter

    Hey this is all tha came up from the GMER scan,


    GMER 1.0.15.15570 - http://www.gmer.net
    Rootkit scan 2011-04-28 18:01:09
    Windows 6.1.7600
    Running: yv03vdoq.exe


    ---- Registry - GMER 1.0.15 ----

    Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\002713b01cf2
    Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\002713b01cf2 (not active ControlSet)

    ---- EOF - GMER 1.0.15 ----
  6. olymacaberdeen

    olymacaberdeen Newcomer, in training Topic Starter

    This is the DDS report,

    .
    DDS (Ver_11-03-05.01) - NTFS_AMD64
    Run by Olivia at 18:08:15.08 on 28/04/2011
    Internet Explorer: 8.0.7600.16385
    Microsoft Windows 7 Home Premium 6.1.7600.0.1252.44.1033.18.3835.2243 [GMT 1:00]
    .
    AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
    SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
    SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .
    ============== Running Processes ===============
    .
    C:\Windows\system32\wininit.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    C:\Windows\system32\svchost.exe -k RPCSS
    C:\Windows\system32\atiesrxx.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    C:\Windows\system32\svchost.exe -k netsvcs
    C:\Windows\system32\svchost.exe -k LocalService
    C:\Windows\system32\atieclxx.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    C:\Windows\system32\WLANExt.exe
    C:\Windows\system32\conhost.exe
    C:\Program Files\AVAST Software\Avast\AvastSvc.exe
    C:\Windows\System32\spoolsv.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
    C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    C:\Program Files (x86)\Bonjour\mDNSResponder.exe
    C:\Windows\SysWOW64\ezSharedSvcHost.exe
    C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
    C:\Program Files\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
    C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
    C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
    C:\Windows\system32\SearchIndexer.exe
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
    C:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe
    C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe
    C:\Windows\System32\svchost.exe -k secsvcs
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Program Files\Windows Media Player\wmpnetwk.exe
    C:\Windows\system32\taskhost.exe
    C:\Windows\system32\Dwm.exe
    C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
    C:\Program Files (x86)\Realtek\Audio\OSD\RTVOSD64.EXE
    C:\Program Files\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\Program Files (x86)\Hewlett-Packard\HP Advisor\Dock\HPAdvisorDock.exe
    C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe
    C:\Program Files (x86)\Skype\Phone\Skype.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Program Files (x86)\MSN Toolbar\Platform\4.0.0369.0\mswinext.exe
    C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
    C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
    C:\Program Files (x86)\Hp\HP Software Update\hpwuschd2.exe
    C:\Program Files (x86)\iTunes\iTunesHelper.exe
    C:\Program Files\AVAST Software\Avast\AvastUI.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Windows\System32\svchost.exe -k LocalServicePeerNet
    C:\Windows\system32\DllHost.exe
    C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
    C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
    C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe
    C:\Program Files (x86)\Hewlett-Packard\Shared\hpCaslNotification.exe
    C:\Windows\explorer.exe
    C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
    C:\Windows\SysWOW64\ctfmon.exe
    C:\Program Files\Java\jre6\bin\jucheck.exe
    C:\Windows\system32\wuauclt.exe
    C:\Program Files (x86)\Internet Explorer\iexplore.exe
    C:\Windows\SysWow64\Macromed\Flash\FlashUtil10e.exe
    C:\Program Files (x86)\Internet Explorer\iexplore.exe
    C:\Windows\system32\SearchProtocolHost.exe
    C:\Windows\system32\SearchFilterHost.exe
    C:\Windows\system32\DllHost.exe
    C:\Windows\system32\DllHost.exe
    C:\Windows\system32\DllHost.exe
    C:\Users\Olivia\Desktop\dds.scr
    C:\Windows\system32\conhost.exe
    .
    ============== Pseudo HJT Report ===============
    .
    uInternet Settings,ProxyOverride = *.local
    mWinlogon: Userinit=userinit.exe,
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
    BHO: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
    BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    BHO: MSN Toolbar BHO: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\MSN Toolbar\Platform\4.0.0369.0\npwinext.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
    TB: MSN Toolbar: {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\MSN Toolbar\Platform\4.0.0369.0\npwinext.dll
    TB: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
    uRun: [HPAdvisorDock] C:\Program Files (x86)\Hewlett-Packard\HP Advisor\Dock\HPAdvisorDock.exe
    uRun: [LightScribe Control Panel] C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
    uRun: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /nosplash /minimized
    uRun: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
    mRun: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
    mRun: [MSN Toolbar] "C:\Program Files (x86)\MSN Toolbar\Platform\4.0.0369.0\mswinext.exe"
    mRun: [Microsoft Default Manager] "C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume
    mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
    mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
    mRun: [Easybits Recovery] C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe
    mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
    mRun: [HP Software Update] C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe
    mRun: [<NO NAME>]
    mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
    mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
    mRun: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
    StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\MICROS~1.LNK - C:\Program Files (x86)\Microsoft Office\Office10\OSA.EXE
    mPolicies-explorer: NoActiveDesktop = 1 (0x1)
    mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
    mPolicies-explorer: EnableShellExecuteHooks = 1 (0x1)
    mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
    mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
    mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
    mPolicies-system: HideFastUserSwitching = 0 (0x0)
    IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~4\Office10\EXCEL.EXE/3000
    IE: Google Sidewiki... - C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html
    IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
    IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\PROGRA~2\MICROS~4\Office12\ONBttnIE.dll
    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~4\Office12\REFIEBAR.DLL
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
    Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\PKMCDO.DLL
    SEH: EasyBits ShellExecute Hook: {e54729e8-bb3d-4270-9d49-7389ea579090} - C:\Windows\SysWow64\EZUPBH~1.DLL
    mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Program Files (x86)\Common Files\LightScribe\LSRunOnce.exe"
    BHO-X64: avast! WebRep: {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll
    BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    BHO-X64: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    TB-X64: avast! WebRep: {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll
    mRun-x64: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe -s
    mRun-x64: [RtkOSD] C:\Program Files (x86)\Realtek\Audio\OSD\RtVOsd64.exe
    mRun-x64: [HP Quick Launch] C:\Program Files\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
    mRun-x64: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
    mRun-x64: [HPWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\DelayedAppStarter.exe 120 C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe /hidden
    .
    ============= SERVICES / DRIVERS ===============
    .
    R1 aswSnx;aswSnx;C:\Windows\System32\drivers\aswSnx.sys [2011-4-27 600920]
    R1 aswSP;aswSP;C:\Windows\System32\drivers\aswSP.sys [2011-4-27 287064]
    R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\System32\drivers\vwififlt.sys [2009-7-14 59904]
    R2 AERTFilters;Andrea RT Filters Service;C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe [2010-7-21 98208]
    R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\System32\atiesrxx.exe [2010-3-29 202752]
    R2 aswFsBlk;aswFsBlk;C:\Windows\System32\drivers\aswFsBlk.sys [2011-4-27 22360]
    R2 aswMonFlt;aswMonFlt;C:\Windows\System32\drivers\aswMonFlt.sys [2011-4-27 64344]
    R2 avast! Antivirus;avast! Antivirus;C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2011-4-27 42184]
    R2 ezSharedSvc;Easybits Services for Windows;C:\Windows\System32\ezSharedSvcHost.exe --> C:\Windows\System32\ezSharedSvcHost.exe [?]
    R2 HP Wireless Assistant Service;HP Wireless Assistant Service;C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe [2010-1-27 102968]
    R2 HPDrvMntSvc.exe;HP Quick Synchronization Service;C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2011-2-4 92216]
    R2 HPWMISVC;HPWMISVC;C:\Program Files\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [2010-1-18 20480]
    R3 amdkmdag;amdkmdag;C:\Windows\System32\drivers\atipmdag.sys [2010-3-29 6405632]
    R3 amdkmdap;amdkmdap;C:\Windows\System32\drivers\atikmpag.sys [2010-3-29 188928]
    R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2010-7-21 295424]
    R3 usbfilter;AMD USB Filter Driver;C:\Windows\System32\drivers\usbfilter.sys [2010-7-21 38456]
    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
    S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
    S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-4-27 136176]
    S3 AtiDCM;AtiDCM;C:\Program Files\ATI\CIM\Bin64\atdcm64a.sys [2010-3-29 26640]
    S3 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-4-27 136176]
    S3 netr28x;Ralink 802.11n Wireless Driver for Windows Vista;C:\Windows\System32\drivers\netr28x.sys [2009-6-10 620544]
    S3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;C:\Windows\System32\drivers\netw5v64.sys [2009-6-10 5434368]
    S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\Windows\System32\drivers\RtsUStor.sys [2010-7-21 225280]
    S3 SrvHsfHDA;SrvHsfHDA;C:\Windows\System32\drivers\VSTAZL6.SYS [2009-7-13 292864]
    S3 SrvHsfV92;SrvHsfV92;C:\Windows\System32\drivers\VSTDPV6.SYS [2009-7-13 1485312]
    S3 SrvHsfWinac;SrvHsfWinac;C:\Windows\System32\drivers\VSTCNXT6.SYS [2009-7-13 740864]
    S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2010-9-28 51712]
    S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2010-11-26 1255736]
    S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\System32\drivers\yk62x64.sys [2009-6-10 389120]
    .
    =============== Created Last 30 ================
    .
    2011-04-28 13:18:54 -------- d-----w- C:\Users\Olivia\AppData\Roaming\Malwarebytes
    2011-04-28 13:18:48 38224 ----a-w- C:\Windows\SysWow64\drivers\mbamswissarmy.sys
    2011-04-28 13:18:47 -------- d-----w- C:\PROGRA~3\Malwarebytes
    2011-04-28 13:18:45 24152 ----a-w- C:\Windows\System32\drivers\mbam.sys
    2011-04-28 13:18:44 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware
    2011-04-27 21:26:03 600920 ----a-w- C:\Windows\System32\drivers\aswSnx.sys
    2011-04-27 21:25:59 64344 ----a-w- C:\Windows\System32\drivers\aswMonFlt.sys
    2011-04-27 21:25:43 40112 ----a-w- C:\Windows\avastSS.scr
    2011-04-27 21:25:36 -------- d-----w- C:\PROGRA~3\AVAST Software
    2011-04-27 21:25:35 -------- d-----w- C:\Program Files\AVAST Software
    2011-04-27 15:43:55 -------- d-----w- C:\Users\Olivia\AppData\Roaming\AVG10
    2011-04-27 15:41:49 -------- d--h--w- C:\PROGRA~3\Common Files
    2011-04-27 15:41:05 -------- d-----w- C:\PROGRA~3\AVG10
    2011-04-27 15:40:27 -------- d-----w- C:\Program Files (x86)\AVG
    2011-04-27 15:29:23 8802128 ----a-w- C:\PROGRA~3\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll
    2011-04-27 15:29:21 8802128 ----a-w- C:\PROGRA~3\Microsoft\Windows Defender\Definition Updates\{E882CBD1-B0B2-4C23-8700-EFFFE0A7EB37}\mpengine.dll
    2011-04-27 15:27:17 270720 ------w- C:\Windows\System32\MpSigStub.exe
    2011-04-27 15:16:21 -------- d-----w- C:\Users\Olivia\AppData\Roaming\GetRightToGo
    2011-04-27 14:56:03 -------- d-----w- C:\PROGRA~3\MFAData
    2011-04-27 11:19:35 31232 ----a-w- C:\Windows\SysWow64\prevhost.exe
    2011-04-27 11:19:35 31232 ----a-w- C:\Windows\System32\prevhost.exe
    2011-04-21 17:50:03 -------- d-----w- C:\Program Files\iPod
    2011-04-21 17:50:02 -------- d-----w- C:\Program Files\iTunes
    2011-04-21 17:50:02 -------- d-----w- C:\Program Files (x86)\iTunes
    2011-04-21 14:32:50 -------- d-----w- C:\Program Files\Bonjour
    2011-04-21 14:32:50 -------- d-----w- C:\Program Files (x86)\Bonjour
    2011-04-21 14:26:28 159744 ----a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin7.dll
    2011-04-21 14:26:28 159744 ----a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin6.dll
    2011-04-21 14:26:28 159744 ----a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin5.dll
    2011-04-21 14:26:28 159744 ----a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin4.dll
    2011-04-21 14:26:28 159744 ----a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin3.dll
    2011-04-21 14:26:28 159744 ----a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin2.dll
    2011-04-21 14:26:28 159744 ----a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin.dll
    2011-04-14 23:04:59 46080 ----a-w- C:\Windows\System32\atmlib.dll
    2011-04-06 15:26:58 96544 ----a-w- C:\Windows\System32\dnssd.dll
    2011-04-06 15:26:58 69408 ----a-w- C:\Windows\System32\jdns_sd.dll
    2011-04-06 15:26:58 237856 ----a-w- C:\Windows\System32\dnssdX.dll
    2011-04-06 15:26:58 119584 ----a-w- C:\Windows\System32\dns-sd.exe
    2011-04-06 15:20:16 91424 ----a-w- C:\Windows\SysWow64\dnssd.dll
    2011-04-06 15:20:16 75040 ----a-w- C:\Windows\SysWow64\jdns_sd.dll
    2011-04-06 15:20:16 197920 ----a-w- C:\Windows\SysWow64\dnssdX.dll
    2011-04-06 15:20:16 107808 ----a-w- C:\Windows\SysWow64\dns-sd.exe
    .
    ==================== Find3M ====================
    .
    2011-03-11 06:19:26 1395712 ----a-w- C:\Windows\System32\mfc42.dll
    2011-03-11 06:19:26 1359872 ----a-w- C:\Windows\System32\mfc42u.dll
    2011-03-11 05:40:24 1164288 ----a-w- C:\Windows\SysWow64\mfc42u.dll
    2011-03-11 05:40:24 1137664 ----a-w- C:\Windows\SysWow64\mfc42.dll
    2011-03-08 06:14:30 976896 ----a-w- C:\Windows\System32\inetcomm.dll
    2011-03-08 05:38:13 740864 ----a-w- C:\Windows\SysWow64\inetcomm.dll
    2011-03-03 06:17:10 182272 ----a-w- C:\Windows\System32\dnsrslvr.dll
    2011-03-03 06:14:38 30208 ----a-w- C:\Windows\System32\dnscacheugc.exe
    2011-03-03 05:27:30 28672 ----a-w- C:\Windows\SysWow64\dnscacheugc.exe
    2011-03-03 03:58:32 3133440 ----a-w- C:\Windows\System32\win32k.sys
    2011-02-24 06:30:00 476160 ----a-w- C:\Windows\System32\XpsGdiConverter.dll
    2011-02-24 06:29:15 1197056 ----a-w- C:\Windows\System32\wininet.dll
    2011-02-24 06:24:57 57856 ----a-w- C:\Windows\System32\licmgr10.dll
    2011-02-24 05:32:52 288256 ----a-w- C:\Windows\SysWow64\XpsGdiConverter.dll
    2011-02-24 05:32:44 981504 ----a-w- C:\Windows\SysWow64\wininet.dll
    2011-02-24 05:30:16 44544 ----a-w- C:\Windows\SysWow64\licmgr10.dll
    2011-02-24 05:05:13 482816 ----a-w- C:\Windows\System32\html.iec
    2011-02-24 04:24:04 1638912 ----a-w- C:\Windows\System32\mshtml.tlb
    2011-02-24 04:23:48 386048 ----a-w- C:\Windows\SysWow64\html.iec
    2011-02-24 03:50:26 1638912 ----a-w- C:\Windows\SysWow64\mshtml.tlb
    2011-02-23 05:16:28 461312 ----a-w- C:\Windows\System32\drivers\srv.sys
    2011-02-23 05:16:01 401920 ----a-w- C:\Windows\System32\drivers\srv2.sys
    2011-02-23 05:15:50 161792 ----a-w- C:\Windows\System32\drivers\srvnet.sys
    2011-02-23 05:15:27 157696 ----a-w- C:\Windows\System32\drivers\mrxsmb.sys
    2011-02-23 05:15:14 286720 ----a-w- C:\Windows\System32\drivers\mrxsmb10.sys
    2011-02-23 05:15:13 126464 ----a-w- C:\Windows\System32\drivers\mrxsmb20.sys
    2011-02-23 05:15:06 90624 ----a-w- C:\Windows\System32\drivers\bowser.sys
    2011-02-19 06:37:44 1135104 ----a-w- C:\Windows\System32\FntCache.dll
    2011-02-19 06:37:10 1540608 ----a-w- C:\Windows\System32\DWrite.dll
    2011-02-19 06:36:49 902656 ----a-w- C:\Windows\System32\d2d1.dll
    2011-02-19 05:32:48 1074176 ----a-w- C:\Windows\SysWow64\DWrite.dll
    2011-02-19 05:32:35 739840 ----a-w- C:\Windows\SysWow64\d2d1.dll
    2011-02-19 05:32:08 34304 ----a-w- C:\Windows\SysWow64\atmlib.dll
    2011-02-19 04:13:39 367104 ----a-w- C:\Windows\System32\atmfd.dll
    2011-02-19 03:37:02 294912 ----a-w- C:\Windows\SysWow64\atmfd.dll
    2011-02-18 06:37:05 612352 ----a-w- C:\Windows\System32\vbscript.dll
    2011-02-18 05:36:26 428032 ----a-w- C:\Windows\SysWow64\vbscript.dll
    2011-02-12 06:14:41 267776 ----a-w- C:\Windows\System32\FXSCOVER.exe
    2011-02-05 12:41:43 556928 ----a-w- C:\Windows\System32\winresume.efi
    2011-02-05 12:41:35 640896 ----a-w- C:\Windows\System32\winload.efi
    2011-02-05 12:41:24 20352 ----a-w- C:\Windows\System32\kdusb.dll
    2011-02-05 12:41:24 19328 ----a-w- C:\Windows\System32\kd1394.dll
    2011-02-05 12:41:23 17792 ----a-w- C:\Windows\System32\kdcom.dll
    2011-02-05 12:39:21 603976 ----a-w- C:\Windows\System32\winload.exe
    2011-02-05 12:39:21 518160 ----a-w- C:\Windows\System32\winresume.exe
    .
    ============= FINISH: 18:08:42.11 ===============
  7. olymacaberdeen

    olymacaberdeen Newcomer, in training Topic Starter

    This is the results of the other one that says attach,

    .
    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT
    .
    DDS (Ver_11-03-05.01)
    .
    Microsoft Windows 7 Home Premium
    Boot Device: \Device\HarddiskVolume1
    Install Date: 25/11/2010 17:11:52
    System Uptime: 28/04/2011 14:28:57 (4 hours ago)
    .
    Motherboard: Hewlett-Packard | | 143B
    Processor: AMD Phenom(tm) II P820 Triple-Core Processor | Socket S1G4 | 1800/200mhz
    .
    ==== Disk Partitions =========================
    .
    C: is FIXED (NTFS) - 284 GiB total, 223.739 GiB free.
    D: is FIXED (NTFS) - 14 GiB total, 1.942 GiB free.
    E: is FIXED (FAT32) - 0 GiB total, 0.088 GiB free.
    F: is CDROM ()
    .
    ==== Disabled Device Manager Items =============
    .
    ==== System Restore Points ===================
    .
    RP35: 09/03/2011 20:07:29 - Windows Update
    RP36: 17/03/2011 12:40:39 - HPSF Applying updates
    RP37: 24/03/2011 21:11:51 - Scheduled Checkpoint
    RP38: 24/03/2011 22:46:59 - Windows Update
    RP39: 16/04/2011 14:09:07 - Windows Update
    RP40: 25/04/2011 22:26:19 - Scheduled Checkpoint
    RP41: 27/04/2011 16:03:16 - Removed Norton Online Backup
    RP42: 27/04/2011 16:05:04 - Windows Update
    RP43: 27/04/2011 16:26:56 - Windows Update
    RP44: 27/04/2011 16:40:15 - Installed AVG 2011
    RP45: 27/04/2011 16:40:37 - Installed AVG 2011
    RP46: 27/04/2011 22:18:32 - Removed AVG 2011
    RP47: 27/04/2011 22:20:21 - Removed AVG 2011
    RP48: 27/04/2011 22:25:23 - avast! Free Antivirus Setup
    .
    ==== Installed Programs ======================
    .
    Acrobat.com
    ActiveCheck component for HP Active Support Library
    Adobe AIR
    Adobe Flash Player 10 ActiveX
    Adobe Reader 9.4.1 MUI
    Adobe Shockwave Player
    Agatha Christie - Death on the Nile
    AMD USB Filter Driver
    Apple Application Support
    Apple Software Update
    avast! Free Antivirus
    Bejeweled 2 Deluxe
    Blackhawk Striker 2
    Blasterball 3
    Bus Driver
    Catalyst Control Center - Branding
    Catalyst Control Center Core Implementation
    Catalyst Control Center Graphics Full Existing
    Catalyst Control Center Graphics Full New
    Catalyst Control Center Graphics Light
    Catalyst Control Center Graphics Previews Common
    Catalyst Control Center Graphics Previews Vista
    Catalyst Control Center InstallProxy
    Catalyst Control Center Localization All
    ccc-core-static
    CCC Help Chinese Standard
    CCC Help Chinese Traditional
    CCC Help Czech
    CCC Help Danish
    CCC Help Dutch
    CCC Help English
    CCC Help Finnish
    CCC Help French
    CCC Help German
    CCC Help Greek
    CCC Help Hungarian
    CCC Help Italian
    CCC Help Japanese
    CCC Help Korean
    CCC Help Norwegian
    CCC Help Polish
    CCC Help Portuguese
    CCC Help Russian
    CCC Help Spanish
    CCC Help Swedish
    CCC Help Thai
    CCC Help Turkish
    Chuzzle Deluxe
    Compatibility Pack for the 2007 Office system
    CyberLink DVD Suite
    CyberLink PowerDVD 9
    CyberLink YouCam
    Dora's Carnival Adventure
    Escape Rosecliff Island
    ESU for Microsoft Windows 7
    Faerie Solitaire
    FATE
    Google Chrome
    Google Update Helper
    HP Advisor
    HP Customer Experience Enhancements
    HP Game Console
    HP Games
    HP Photo Creations
    HP Power Plan Utility
    HP Setup
    HP Software Framework
    HP Support Assistant
    HP Update
    HP User Guides 0211
    HPAsset component for HP Active Support Library
    Java Auto Updater
    Java(TM) 6 Update 23
    Jewel Quest 3
    Junk Mail filter update
    LabelPrint
    LightScribe System Software
    Magic Desktop
    Malwarebytes' Anti-Malware
    Microsoft Choice Guard
    Microsoft Default Manager
    Microsoft Office Excel MUI (English) 2007
    Microsoft Office Home and Student 2007
    Microsoft Office OneNote MUI (English) 2007
    Microsoft Office PowerPoint MUI (English) 2007
    Microsoft Office PowerPoint Viewer 2007 (English)
    Microsoft Office Proof (English) 2007
    Microsoft Office Proof (French) 2007
    Microsoft Office Proof (Spanish) 2007
    Microsoft Office Proofing (English) 2007
    Microsoft Office Shared MUI (English) 2007
    Microsoft Office Shared Setup Metadata MUI (English) 2007
    Microsoft Office Suite Activation Assistant
    Microsoft Office Word MUI (English) 2007
    Microsoft Office XP Media Content
    Microsoft Office XP Standard
    Microsoft Search Enhancement Pack
    Microsoft Silverlight
    Microsoft SQL Server 2005 Compact Edition [ENU]
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    Microsoft Works
    MSN Toolbar
    MSN Toolbar Platform
    MSVCRT
    Penguins!
    PhotoNow!
    Plants vs. Zombies
    Poker Superstars III
    Polar Bowler
    Polar Golfer
    Power2Go
    PowerDirector
    QuickTime
    Realtek Ethernet Controller Driver For Windows 7
    Realtek High Definition Audio Driver
    Realtek USB 2.0 Card Reader
    Recovery Manager
    Safari
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2160841)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
    Skype™ 5.1
    Spotify
    Update for Microsoft .NET Framework 4 Client Profile (KB2473228)
    Update for Office 2007 (KB934528)
    Virtual Families
    Virtual Villagers - The Secret City
    Visual Studio 2008 x64 Redistributables
    Windows Live Call
    Windows Live Communications Platform
    Windows Live Essentials
    Windows Live Mail
    Windows Live Messenger
    Windows Live Movie Maker
    Windows Live Photo Gallery
    Windows Live Sync
    Windows Live Upload Tool
    Windows Live Writer
    Zuma's Revenge
    .
    ==== Event Viewer Messages From Past Week ========
    .
    28/04/2011 14:29:24, Error: Service Control Manager [7000] - The GoToMyPC service failed to start due to the following error: The system cannot find the file specified.
    28/04/2011 14:06:41, Error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
    27/04/2011 16:23:35, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x800705b4: Update for Windows 7 for x64-based Systems (KB982018).
    27/04/2011 16:13:34, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x800705b4: Update for Windows 7 for x64-based Systems (KB2522422).
    27/04/2011 16:13:34, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x800705b4: Update for Windows 7 for x64-based Systems (KB2515325).
    27/04/2011 16:13:34, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x800705b4: Update for Windows 7 for x64-based Systems (KB2492386).
    24/04/2011 14:02:54, Error: NetBT [4321] - The name "WORKGROUP :1d" could not be registered on the interface with IP address 192.168.1.66. The computer with the IP address 192.168.1.64 did not allow the name to be claimed by this computer.
    21/04/2011 18:49:07, Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Apple Mobile Device service, but this action failed with the following error: An instance of the service is already running.
    21/04/2011 15:33:19, Error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
    .
    ==== End Of File ===========================
  8. olymacaberdeen

    olymacaberdeen Newcomer, in training Topic Starter

    And finally this is the Anti Malware log,

    Malwarebytes' Anti-Malware 1.50.1.1100
    www.malwarebytes.org

    Database version: 6463

    Windows 6.1.7600
    Internet Explorer 8.0.7600.16385

    28/04/2011 14:27:47
    mbam-log-2011-04-28 (14-27-47).txt

    Scan type: Quick scan
    Objects scanned: 160755
    Time elapsed: 2 minute(s), 13 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 5
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 0

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{258C9770-1713-4021-8D7E-1F184A2BD754} (Adware.ShoppingReport2) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1602F07D-8BF3-4C08-BDD6-DDDB1C48AEDC} (Adware.ClickPotato) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{4D1EC4CA-4B92-4324-B8F8-C9A6ED06A8AE} (Adware.Hotbar) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{BDEA95CF-F0E6-41E0-BD3D-B00F39A4E939} (Adware.ShoppingReport2) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A078F691-9C07-4AF2-BF43-35E79EECF8B7} (Adware.Softomate) -> Quarantined and deleted successfully.

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    (No malicious items detected)
  9. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +36

    The man reason the system is slow is because you have too many processes running.

    You also have 2 antivirus programs: Please remove one of the: Tools to help below:
    Avast: Avast Removal
    AVG: Use the appropriate download for your system for the AVG Remover: AVG Remover:32bit
    AVG Remover:64 bit
    Please reboot when finished.
    =========================================
    Mbam removed some adware, but there will be more entries: Please uninstall Click Potato- it is not a clean program. It is sometimes used as an addon in Firefox.

    Advise stay away from 'shopper' and 'coupon' sites. You will get adware, at least- that's how they make their money!
    ======================================
    Please note: If you have Combofix on the desktop already, please uninstall it. The download the current version and do the scan:
    Uninstall directions

    Download Combofix from HERE or HERE and save to the desktop
    • Double click combofix.exe & follow the prompts.
    • ComboFix will check to see if the Microsoft Windows Recovery Console is installed. It is recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode if needed.
      **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.
    • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
    • Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
    • Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
      [​IMG]
    • .Click on Yes, to continue scanning for malware
    • .If Combofix asks you to update the program, allow
    • .Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
    • .Close any open browsers.
    • .Double click combofix.exe[​IMG] & follow the prompts to run.
    • When the scan completes , a report will be generated-it will open a text window. Please paste the C:\ComboFix.txt in next reply..
    Re-enable your Antivirus software.
    Notes:
    1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
    2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
    3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell your helper.
    4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
    =====================================

    Run Eset NOD32 Online AntiVirus scan HERE
    1. Tick the box next to YES, I accept the Terms of Use.
    2. Click Start
    3. When asked, allow the Active X control to install
    4. Disable your current Antivirus software. You can usually do this with its Notification Tray icon near the clock.
    5. Click Start
    6. Make sure that the option "Remove found threats" is Unchecked, and the option "Scan unwanted applications" is checked
    7. Click Scan
    8. Wait for the scan to finish
    9. Click on "Copy to Clipboard"> (you won't see the 'clipboard')
    10. Click anywhere in the post where you want the logs to go, the do Ctrl V. The log will be sent from the clipboard and pasted in the post.
    11. Re-enable your Antivirus software.
      NOTE: If you forget to copy to the clipboard you can find the log here:
      C:\Program Files\EsetOnlineScanner\log.txt. Please include this on your post.
  10. olymacaberdeen

    olymacaberdeen Newcomer, in training Topic Starter

    Hey These are the results I had from the combofix scan:

    ComboFix 11-04-28.02 - Olivia 03/05/2011 12:20:16.1.3 - x64
    Microsoft Windows 7 Home Premium 6.1.7600.0.1252.44.1033.18.3835.2089 [GMT 1:00]
    Running from: c:\users\Olivia\Downloads\ComboFix.exe
    AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
    SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
    SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .
    .
    ((((((((((((((((((((((((( Files Created from 2011-04-03 to 2011-05-03 )))))))))))))))))))))))))))))))
    .
    .
    2011-05-03 12:10 . 2011-05-03 12:10 -------- d-----w- c:\users\Default\AppData\Local\temp
    2011-05-03 11:08 . 2011-03-08 06:00 2594608 ----a-w- c:\program files\Internet Explorer\ienrcore.exe
    2011-05-03 11:04 . 2011-04-18 08:15 8802128 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{1162B65E-74A4-48A5-AD4A-F34E94FA887B}\mpengine.dll
    2011-04-28 18:00 . 2011-04-28 18:00 -------- d-----w- c:\program files (x86)\Common Files\Java
    2011-04-28 17:58 . 2011-04-28 17:58 -------- d-----w- c:\windows\Sun
    2011-04-28 13:18 . 2011-04-28 13:18 -------- d-----w- c:\users\Olivia\AppData\Roaming\Malwarebytes
    2011-04-28 13:18 . 2011-04-28 13:18 -------- d-----w- c:\programdata\Malwarebytes
    2011-04-28 13:18 . 2010-12-20 17:08 24152 ----a-w- c:\windows\system32\drivers\mbam.sys
    2011-04-27 21:26 . 2011-04-18 17:13 22360 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
    2011-04-27 21:26 . 2011-04-18 17:18 287064 ----a-w- c:\windows\system32\drivers\aswSP.sys
    2011-04-27 21:26 . 2011-04-18 17:13 31064 ----a-w- c:\windows\system32\drivers\aswRdr.sys
    2011-04-27 21:26 . 2011-04-18 17:16 53592 ----a-w- c:\windows\system32\drivers\aswTdi.sys
    2011-04-27 21:26 . 2011-04-18 17:17 600920 ----a-w- c:\windows\system32\drivers\aswSnx.sys
    2011-04-27 21:25 . 2011-04-18 17:25 253888 ----a-w- c:\windows\system32\aswBoot.exe
    2011-04-27 21:25 . 2011-04-18 17:13 64344 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
    2011-04-27 21:25 . 2011-04-18 17:25 40112 ----a-w- c:\windows\avastSS.scr
    2011-04-27 21:25 . 2011-04-18 17:25 199304 ----a-w- c:\windows\SysWow64\aswBoot.exe
    2011-04-27 21:25 . 2011-04-27 21:25 -------- d-----w- c:\programdata\AVAST Software
    2011-04-27 21:25 . 2011-04-27 21:25 -------- d-----w- c:\program files\AVAST Software
    2011-04-27 15:43 . 2011-04-27 15:43 -------- d-----w- c:\users\Olivia\AppData\Roaming\AVG10
    2011-04-27 15:41 . 2011-04-27 15:41 -------- d--h--w- c:\programdata\Common Files
    2011-04-27 15:41 . 2011-04-28 13:12 -------- d-----w- c:\programdata\AVG10
    2011-04-27 15:40 . 2011-04-27 21:22 -------- d-----w- c:\program files (x86)\AVG
    2011-04-27 15:27 . 2011-02-02 17:11 270720 ------w- c:\windows\system32\MpSigStub.exe
    2011-04-27 15:16 . 2011-04-27 15:19 -------- d-----w- c:\users\Olivia\AppData\Roaming\GetRightToGo
    2011-04-27 14:56 . 2011-04-27 21:20 -------- d-----w- c:\programdata\MFAData
    2011-04-27 11:20 . 2011-02-26 06:23 2870272 ----a-w- c:\windows\explorer.exe
    2011-04-27 11:20 . 2011-02-26 05:33 2614784 ----a-w- c:\windows\SysWow64\explorer.exe
    2011-04-27 11:20 . 2011-03-12 12:03 662528 ----a-w- c:\windows\system32\XpsPrint.dll
    2011-04-27 11:20 . 2011-03-12 11:31 442880 ----a-w- c:\windows\SysWow64\XpsPrint.dll
    2011-04-27 11:19 . 2011-03-11 06:23 1657216 ----a-w- c:\windows\system32\drivers\ntfs.sys
    2011-04-27 11:19 . 2011-03-11 06:23 166272 ----a-w- c:\windows\system32\drivers\nvstor.sys
    2011-04-27 11:19 . 2011-03-11 06:23 148352 ----a-w- c:\windows\system32\drivers\nvraid.sys
    2011-04-27 11:19 . 2011-03-11 06:18 2566144 ----a-w- c:\windows\system32\esent.dll
    2011-04-27 11:19 . 2011-03-11 05:39 1686016 ----a-w- c:\windows\SysWow64\esent.dll
    2011-04-27 11:19 . 2011-03-11 06:23 187264 ----a-w- c:\windows\system32\drivers\storport.sys
    2011-04-27 11:19 . 2011-03-11 06:23 410496 ----a-w- c:\windows\system32\drivers\iaStorV.sys
    2011-04-27 11:19 . 2011-03-11 06:15 96768 ----a-w- c:\windows\system32\fsutil.exe
    2011-04-27 11:19 . 2011-03-11 05:37 74240 ----a-w- c:\windows\SysWow64\fsutil.exe
    2011-04-27 11:19 . 2011-02-18 06:33 31232 ----a-w- c:\windows\system32\prevhost.exe
    2011-04-27 11:19 . 2011-02-18 05:33 31232 ----a-w- c:\windows\SysWow64\prevhost.exe
    2011-04-21 17:50 . 2011-04-21 17:50 -------- d-----w- c:\program files\iPod
    2011-04-21 17:50 . 2011-04-21 17:50 -------- d-----w- c:\program files\iTunes
    2011-04-21 17:50 . 2011-04-21 17:50 -------- d-----w- c:\program files (x86)\iTunes
    2011-04-21 14:32 . 2011-04-21 14:32 -------- d-----w- c:\program files\Bonjour
    2011-04-21 14:32 . 2011-04-21 14:32 -------- d-----w- c:\program files (x86)\Bonjour
    2011-04-21 14:26 . 2011-04-21 14:26 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin7.dll
    2011-04-21 14:26 . 2011-04-21 14:26 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin6.dll
    2011-04-21 14:26 . 2011-04-21 14:26 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin5.dll
    2011-04-21 14:26 . 2011-04-21 14:26 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin4.dll
    2011-04-21 14:26 . 2011-04-21 14:26 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin3.dll
    2011-04-21 14:26 . 2011-04-21 14:26 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin2.dll
    2011-04-21 14:26 . 2011-04-21 14:26 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin.dll
    2011-04-21 14:26 . 2011-04-21 14:26 -------- d-----w- c:\program files (x86)\QuickTime
    2011-04-14 23:04 . 2011-02-23 05:15 161792 ----a-w- c:\windows\system32\drivers\srvnet.sys
    2011-04-14 23:03 . 2011-03-03 06:17 182272 ----a-w- c:\windows\system32\dnsrslvr.dll
    2011-04-14 02:39 . 2011-04-14 02:39 103864 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\nppdf32.dll
    2011-04-06 15:26 . 2011-04-06 15:26 96544 ----a-w- c:\windows\system32\dnssd.dll
    2011-04-06 15:26 . 2011-04-06 15:26 69408 ----a-w- c:\windows\system32\jdns_sd.dll
    2011-04-06 15:26 . 2011-04-06 15:26 237856 ----a-w- c:\windows\system32\dnssdX.dll
    2011-04-06 15:26 . 2011-04-06 15:26 119584 ----a-w- c:\windows\system32\dns-sd.exe
    2011-04-06 15:20 . 2011-04-06 15:20 91424 ----a-w- c:\windows\SysWow64\dnssd.dll
    2011-04-06 15:20 . 2011-04-06 15:20 75040 ----a-w- c:\windows\SysWow64\jdns_sd.dll
    2011-04-06 15:20 . 2011-04-06 15:20 197920 ----a-w- c:\windows\SysWow64\dnssdX.dll
    2011-04-06 15:20 . 2011-04-06 15:20 107808 ----a-w- c:\windows\SysWow64\dns-sd.exe
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2011-04-14 04:07 . 2011-01-05 17:39 472808 ----a-w- c:\windows\SysWow64\deployJava1.dll
    2011-03-23 12:53 . 2009-08-18 19:49 564632 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\wlidui.dll
    2011-03-23 12:53 . 2009-08-18 18:24 18328 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
    2011-03-04 06:17 . 2011-04-27 11:19 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll
    2011-03-04 06:17 . 2011-04-27 11:19 347648 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll
    2011-02-19 06:37 . 2011-03-09 11:10 1135104 ----a-w- c:\windows\system32\FntCache.dll
    2011-02-19 06:37 . 2011-03-09 11:10 1540608 ----a-w- c:\windows\system32\DWrite.dll
    2011-02-19 06:36 . 2011-03-09 11:10 902656 ----a-w- c:\windows\system32\d2d1.dll
    2011-02-19 05:32 . 2011-03-09 11:10 1074176 ----a-w- c:\windows\SysWow64\DWrite.dll
    2011-02-19 05:32 . 2011-03-09 11:10 739840 ----a-w- c:\windows\SysWow64\d2d1.dll
    2011-02-18 15:36 . 2011-02-18 15:36 51712 ----a-w- c:\windows\system32\drivers\usbaapl64.sys
    2011-02-18 15:36 . 2011-02-18 15:36 4184352 ----a-w- c:\windows\system32\usbaaplrc.dll
    .
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "HPAdvisorDock"="c:\program files (x86)\Hewlett-Packard\HP Advisor\Dock\HPAdvisorDock.exe" [2010-09-28 1715768]
    "LightScribe Control Panel"="c:\program files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe" [2010-02-22 2363392]
    "Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2011-01-26 15026056]
    "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1475072]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
    "StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-03-29 98304]
    "MSN Toolbar"="c:\program files (x86)\MSN Toolbar\Platform\4.0.0369.0\mswinext.exe" [2009-11-30 240472]
    "Microsoft Default Manager"="c:\program files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2009-07-17 288080]
    "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
    "Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-01-31 35760]
    "Easybits Recovery"="c:\program files (x86)\EasyBits For Kids\ezRecover.exe" [2010-01-25 61112]
    "HP Software Update"="c:\program files (x86)\Hp\HP Software Update\HPWuSchd2.exe" [2008-12-08 54576]
    "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2010-11-29 421888]
    "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2011-04-14 421160]
    "avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-04-18 3460784]
    "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-01-07 253672]
    .
    c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
    Microsoft Office.lnk - c:\program files (x86)\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "ConsentPromptBehaviorAdmin"= 5 (0x5)
    "ConsentPromptBehaviorUser"= 3 (0x3)
    "EnableUIADesktopToggle"= 0 (0x0)
    "HideFastUserSwitching"= 0 (0x0)
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
    "EnableShellExecuteHooks"= 1 (0x1)
    .
    [hkey_local_machine\software\Wow6432Node\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
    .
    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
    Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
    .
    R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
    R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
    R3 AtiDCM;AtiDCM;c:\program files\ATI\CIM\BIN64\atdcm64a.sys [2010-03-29 26640]
    R3 netr28x;Ralink 802.11n Wireless Driver for Windows Vista;c:\windows\system32\DRIVERS\netr28x.sys [x]
    R3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys [x]
    R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2009-09-23 225280]
    R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS [x]
    R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS [x]
    R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS [x]
    R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
    R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [x]
    S1 aswSnx;aswSnx; [x]
    S1 aswSP;aswSP; [x]
    S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
    S2 AERTFilters;Andrea RT Filters Service;c:\program files\Realtek\Audio\HDA\AERTSr64.exe [2009-11-18 98208]
    S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
    S2 aswFsBlk;aswFsBlk; [x]
    S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [x]
    S2 HP Wireless Assistant Service;HP Wireless Assistant Service;c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe [2010-01-27 102968]
    S2 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2011-02-04 92216]
    S2 HPWMISVC;HPWMISVC;c:\program files\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [2010-01-18 20480]
    S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atipmdag.sys [x]
    S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
    S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
    S3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]
    S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [x]
    .
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
    2010-02-22 18:38 451872 ----a-w- c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2011-04-21 c:\windows\Tasks\HPCeeScheduleForOlivia.job
    - c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-01-05 10:53]
    .
    .
    --------- x86-64 -----------
    .
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
    @="{472083B0-C522-11CF-8763-00608CC02F24}"
    [HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
    2011-04-18 17:25 134384 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtkNGUI64.exe" [2010-03-13 6234144]
    "RtkOSD"="c:\program files (x86)\Realtek\Audio\OSD\RtVOsd64.exe" [2010-01-12 995840]
    "HP Quick Launch"="c:\program files\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe" [2010-01-18 451072]
    "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2010-04-26 172032]
    "HPWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\DelayedAppStarter.exe" [2010-01-27 8192]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
    "LoadAppInit_DLLs"=0x0
    .
    ------- Supplementary Scan -------
    .
    uLocal Page = c:\windows\system32\blank.htm
    mLocal Page = c:\windows\SysWOW64\blank.htm
    uInternet Settings,ProxyOverride = *.local
    IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~4\Office10\EXCEL.EXE/3000
    IE: Google Sidewiki... - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html
    .
    - - - - ORPHANS REMOVED - - - -
    .
    AddRemove-EasyBits Magic Desktop - c:\windows\system32\ezMDUninstall.exe
    .
    .
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
    @Denied: (A 2) (Everyone)
    @="FlashBroker"
    "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10e.exe,-101"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
    "Enabled"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
    @="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10e.exe"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
    @Denied: (A 2) (Everyone)
    @="Shockwave Flash Object"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
    @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx"
    "ThreadingModel"="Apartment"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
    @="0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
    @="ShockwaveFlash.ShockwaveFlash.10"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
    @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx, 1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
    @="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
    @="ShockwaveFlash.ShockwaveFlash"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
    @Denied: (A 2) (Everyone)
    @="Macromedia Flash Factory Object"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
    @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx"
    "ThreadingModel"="Apartment"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
    @="FlashFactory.FlashFactory.1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
    @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx, 1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
    @="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
    @="FlashFactory.FlashFactory"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
    @Denied: (A 2) (Everyone)
    @="IFlashBroker3"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
    @="{00020424-0000-0000-C000-000000000046}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    "Version"="1.0"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
    @Denied: (Full) (Everyone)
    .
    Completion time: 2011-05-03 13:38:22
    ComboFix-quarantined-files.txt 2011-05-03 12:38
    .
    Pre-Run: 240,519,786,496 bytes free
    Post-Run: 240,396,587,008 bytes free
    .
    - - End Of File - - AD7A5790250D4AA79C40600488DC4179
  11. olymacaberdeen

    olymacaberdeen Newcomer, in training Topic Starter

    This is the results from the Eset online scanner.


    C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0PS72R2M\upgrade[1].cab a variant of Win32/Adware.OneStep.T application
    C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\62AXOPQ5\upgrade[1].cab a variant of Win32/Adware.OneStep.Y application
    C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FZG8CKJ5\upgrade[1].cab a variant of Win32/Adware.OneStep.Y application
    C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0PS72R2M\upgrade[1].cab a variant of Win32/Adware.OneStep.T application
    C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\62AXOPQ5\upgrade[1].cab a variant of Win32/Adware.OneStep.Y application
    C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FZG8CKJ5\upgrade[1].cab a variant of Win32/Adware.OneStep.Y application
     
  12. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +36

    Please download OTMovit by Old Timer and save to your desktop.
    • Double-click OTMoveIt3.exe to run it. (Vista users, please right click on OTMoveit3.exe and select "Run as an Administrator")
    • Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
      Code:
      :Files 
      C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0PS72R2M\upgrade[1].cab
      C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\62AXOPQ5\upgrade[1].cab 
      C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FZG8CKJ5\upgrade[1].cab 
      C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0PS72R2M\upgrade[1].cab 
      C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\62AXOPQ5\upgrade[1].cab 
      C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FZG8CKJ5\upgrade[1].cab 
      :Commands
      [purity]
      [emptytemp]
      [start explorer]
      [Reboot]
    • Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window and choose Paste.
    • Click the red Moveit! button.
    • A log of files and folders moved will be created in the c:\_OTMoveIt\MovedFiles folder in the form of Date and Time (mmddyyyy_hhmmss.log). Please open this log in Notepad and post its contents in your next reply.
    • Close OTMoveIt3
    If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.
    =======================================
    Please check in Add/Remove Programs and see if anything is listed for OneStep. There are variations so you may see OneStep.T or Y. "IF" you found a program for this, after uninstalling, use Windows Explorer to delete the program folder.

    Go ahead with that- taking a lunch break and will check Combofix this afternoon.
  13. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +36

    Please handle this> the links are in my Reply #9:
    IF you attempted the AVG removal with the link I gave you, it didn't remove AVG. Use this instead:
    Download AppRemover and save to the desktop]
    How to Use AppRemover to Remove a Complete Security Application
    1. Double click the setup on the desktop> click Next
    2. Select “Remove Security Application”
    3. Let scan finish to determine security apps
    4. A screen like below will appear:
      http://www.appremover.com/about/chooseuninstall.gif/image_preview[/img[*] Click on [b]Next[/b] after choice has been made
      [*] Check the AVG program you want to uninstall
      [*] After uninstall shows complete, follow online prompts to Exit the program.[/list]

      Temporary AV:
      [url=http://download.cnet.com/Avira-AntiVir-Personal-Free-Antivirus/3000-2239_4-10322935.html?part=dl-10322935&subj=dl&tag=button&cdlPid=11012914][b][color=blue]Avira-AntiVir-Personal-Free-Antivirus[/b][/color][/url]
      [URL="http://download.cnet.com/Avast-Free-Antivirus/3000-2239_4-10019223.html?part=dl-85737&subj=dl&tag=button"][B][COLOR="RoyalBlue"]Avast Free Version[/COLOR][/B][/URL]
      ==========================================
      I have found one of the sources of the slowness. you have a folder with 2,594,608 entries for> c:\program files\Internet Explorer\[B]ienrcore.exe.[/B]
      [B]Description: Windows Internet Explorer 9 Setup Utility[/B]

      It's a temp folder which means you're not doing any regular maintenance on the system! I'll handle it with script you'll run through Combofix.
  14. olymacaberdeen

    olymacaberdeen Newcomer, in training Topic Starter

    This is the result of the OTMovit operation.



    All processes killed
    ========== FILES ==========
    C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0PS72R2M\upgrade[1].cab moved successfully.
    C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\62AXOPQ5\upgrade[1].cab moved successfully.
    C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FZG8CKJ5\upgrade[1].cab moved successfully.
    File/Folder C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0PS72R2M\upgrade[1].cab not found.
    File/Folder C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\62AXOPQ5\upgrade[1].cab not found.
    File/Folder C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FZG8CKJ5\upgrade[1].cab not found.
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: Administrator
    ->Temp folder emptied: 0 bytes

    User: All Users

    User: Default
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: Default User
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: Olivia
    ->Temp folder emptied: 5667321 bytes
    ->Temporary Internet Files folder emptied: 111023200 bytes
    ->Java cache emptied: 3655074 bytes
    ->Google Chrome cache emptied: 6232851 bytes
    ->Apple Safari cache emptied: 0 bytes
    ->Flash cache emptied: 3230 bytes

    User: Public
    ->Temp folder emptied: 0 bytes

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 0 bytes
    %systemroot%\System32 (64bit) .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 186519 bytes
    %systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50333 bytes
    RecycleBin emptied: 0 bytes

    Total Files Cleaned = 121.00 mb


    OTM by OldTimer - Version 3.1.17.2 log created on 05062011_172807

    Files moved on Reboot...
    C:\Users\Olivia\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
    File move failed. C:\Windows\temp\_avast_\Webshlock.txt scheduled to be moved on reboot.

    Registry entries deleted on Reboot...
  15. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +36

    Please run this Custom CFScript:

    • [1]. Close any open browsers.
      [2]. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
      [3]. Open notepad> click on Format> Uncheck 'Word Wrap'> and copy/paste the text in the code below into it:Be sure to scroll down to include ALL lines.
    Code:
    File::
    c:\program files\Internet Explorer\ienrcore.exe
    Folder::
    c:\users\Olivia\AppData\Roaming\AVG10
    c:\programdata\Common Files
    c:\programdata\AVG10
    c:\program files (x86)\AVG
    Registry::
    [hkey_local_machine\software\Wow6432Node\microsoft\windows\currentversion\ex plorer\ShellExecuteHooks]
    
    RegLockDel:: 
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}].
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32].
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
    
    
    Save this as CFScript.txt, in the same location as ComboFix.exe
    [​IMG]

    Referring to the picture above, drag CFScript into ComboFix.exe

    When finished, it will produce a log for you at C:\ComboFix.txt . Please paste in your next reply.
    ====================
    Contributing to the slowness:
    I noticed you added all of the following on 4/21/2011:
    On the same date, you added 7 plugins for QuickTime to Internet Explorer:
    159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin.dll

    On 4/6/2011, you began running 8 files for the Bonjour Client Library
    The file size is the number on the left.
    ============================
    CCC Help in 22 lnguages: keep what you need, remove the rest

    Cyberlink processes running in the background. (GoToMyPC remote access)

    More plugins
    nppdf32.dll> Adobe Reader
    2011-04-14 02:39 103864 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\nppdf32.dll

    NPQTPLUGIN7.DLL was added to IE on the same date. It appears you may have thoughe these were for QuickTime.has been seen to perform the following behavior:

    * Uses rootkit techniques to conceal its presence, interrogation or removal
    * Uses low level functions to hide itself from the user and from system/security process
    ======================
    These are all considered legitimate processes. I'm guessing you started noticing the slowdown soon after 4/21/2011. But they take up 'space' on the hard drive and use RAM when running.
  16. olymacaberdeen

    olymacaberdeen Newcomer, in training Topic Starter

    This is the results from the combofix scan.

    ComboFix 11-05-06.02 - Olivia 06/05/2011 21:11:23.2.3 - x64
    Microsoft Windows 7 Home Premium 6.1.7600.0.1252.44.1033.18.3835.2385 [GMT 1:00]
    Running from: c:\users\Olivia\Desktop\ComboFix.exe
    Command switches used :: c:\users\Olivia\Desktop\CFScript.txt
    AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
    SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
    SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .
    FILE ::
    "c:\program files\Internet Explorer\ienrcore.exe"
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    c:\program files (x86)\AVG
    c:\programdata\AVG10
    c:\programdata\Common Files
    c:\programdata\Common Files\CAC95C47-6040-17BC-3875-D3E445EE4289.dat
    c:\users\Olivia\AppData\Roaming\AVG10
    c:\users\Olivia\AppData\Roaming\AVG10\cfgall\usergui.cfg
    .
    .
    ((((((((((((((((((((((((( Files Created from 2011-04-06 to 2011-05-06 )))))))))))))))))))))))))))))))
    .
    .
    2011-05-06 20:24 . 2011-05-06 20:24 -------- d-----w- c:\users\Default\AppData\Local\temp
    2011-05-06 20:24 . 2011-05-06 20:24 -------- d-----w- c:\users\Administrator\AppData\Local\temp
    2011-05-06 16:56 . 2011-04-18 17:13 22360 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
    2011-05-06 16:56 . 2011-04-18 17:18 287064 ----a-w- c:\windows\system32\drivers\aswSP.sys
    2011-05-06 16:56 . 2011-04-18 17:13 31064 ----a-w- c:\windows\system32\drivers\aswRdr.sys
    2011-05-06 16:56 . 2011-04-18 17:16 53592 ----a-w- c:\windows\system32\drivers\aswTdi.sys
    2011-05-06 16:56 . 2011-04-18 17:17 600920 ----a-w- c:\windows\system32\drivers\aswSnx.sys
    2011-05-06 16:56 . 2011-04-18 17:25 253888 ----a-w- c:\windows\system32\aswBoot.exe
    2011-05-06 16:56 . 2011-04-18 17:13 64344 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
    2011-05-06 16:55 . 2011-04-18 17:25 40112 ----a-w- c:\windows\avastSS.scr
    2011-05-06 16:55 . 2011-04-18 17:25 199304 ----a-w- c:\windows\SysWow64\aswBoot.exe
    2011-05-06 16:55 . 2011-05-06 16:55 -------- d-----w- c:\programdata\AVAST Software
    2011-05-06 16:55 . 2011-05-06 16:55 -------- d-----w- c:\program files\AVAST Software
    2011-05-06 16:28 . 2011-05-06 16:28 -------- d-----w- C:\_OTM
    2011-05-06 13:51 . 2011-04-18 08:15 8802128 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{E6641276-51A1-4541-8DF2-5CEFEC60A4EF}\mpengine.dll
    2011-04-28 18:00 . 2011-04-28 18:00 -------- d-----w- c:\program files (x86)\Common Files\Java
    2011-04-28 17:58 . 2011-04-28 17:58 -------- d-----w- c:\windows\Sun
    2011-04-28 13:18 . 2011-04-28 13:18 -------- d-----w- c:\users\Olivia\AppData\Roaming\Malwarebytes
    2011-04-28 13:18 . 2011-04-28 13:18 -------- d-----w- c:\programdata\Malwarebytes
    2011-04-28 13:18 . 2010-12-20 17:08 24152 ----a-w- c:\windows\system32\drivers\mbam.sys
    2011-04-27 15:27 . 2011-02-02 17:11 270720 ------w- c:\windows\system32\MpSigStub.exe
    2011-04-27 15:16 . 2011-04-27 15:19 -------- d-----w- c:\users\Olivia\AppData\Roaming\GetRightToGo
    2011-04-27 14:56 . 2011-04-27 21:20 -------- d-----w- c:\programdata\MFAData
    2011-04-27 11:20 . 2011-02-26 06:23 2870272 ----a-w- c:\windows\explorer.exe
    2011-04-27 11:20 . 2011-02-26 05:33 2614784 ----a-w- c:\windows\SysWow64\explorer.exe
    2011-04-27 11:20 . 2011-03-12 12:03 662528 ----a-w- c:\windows\system32\XpsPrint.dll
    2011-04-27 11:20 . 2011-03-12 11:31 442880 ----a-w- c:\windows\SysWow64\XpsPrint.dll
    2011-04-27 11:19 . 2011-03-11 06:23 1657216 ----a-w- c:\windows\system32\drivers\ntfs.sys
    2011-04-27 11:19 . 2011-03-11 06:23 166272 ----a-w- c:\windows\system32\drivers\nvstor.sys
    2011-04-27 11:19 . 2011-03-11 06:23 148352 ----a-w- c:\windows\system32\drivers\nvraid.sys
    2011-04-27 11:19 . 2011-03-11 06:18 2566144 ----a-w- c:\windows\system32\esent.dll
    2011-04-27 11:19 . 2011-03-11 05:39 1686016 ----a-w- c:\windows\SysWow64\esent.dll
    2011-04-27 11:19 . 2011-03-11 06:23 187264 ----a-w- c:\windows\system32\drivers\storport.sys
    2011-04-27 11:19 . 2011-03-11 06:23 410496 ----a-w- c:\windows\system32\drivers\iaStorV.sys
    2011-04-27 11:19 . 2011-03-11 06:15 96768 ----a-w- c:\windows\system32\fsutil.exe
    2011-04-27 11:19 . 2011-03-11 05:37 74240 ----a-w- c:\windows\SysWow64\fsutil.exe
    2011-04-27 11:19 . 2011-02-18 06:33 31232 ----a-w- c:\windows\system32\prevhost.exe
    2011-04-27 11:19 . 2011-02-18 05:33 31232 ----a-w- c:\windows\SysWow64\prevhost.exe
    2011-04-21 17:50 . 2011-04-21 17:50 -------- d-----w- c:\program files\iPod
    2011-04-21 17:50 . 2011-04-21 17:50 -------- d-----w- c:\program files\iTunes
    2011-04-21 17:50 . 2011-04-21 17:50 -------- d-----w- c:\program files (x86)\iTunes
    2011-04-21 14:32 . 2011-04-21 14:32 -------- d-----w- c:\program files\Bonjour
    2011-04-21 14:32 . 2011-04-21 14:32 -------- d-----w- c:\program files (x86)\Bonjour
    2011-04-21 14:26 . 2011-04-21 14:26 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin7.dll
    2011-04-21 14:26 . 2011-04-21 14:26 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin6.dll
    2011-04-21 14:26 . 2011-04-21 14:26 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin5.dll
    2011-04-21 14:26 . 2011-04-21 14:26 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin4.dll
    2011-04-21 14:26 . 2011-04-21 14:26 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin3.dll
    2011-04-21 14:26 . 2011-04-21 14:26 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin2.dll
    2011-04-21 14:26 . 2011-04-21 14:26 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin.dll
    2011-04-21 14:26 . 2011-04-21 14:26 -------- d-----w- c:\program files (x86)\QuickTime
    2011-04-14 23:04 . 2011-02-23 05:15 161792 ----a-w- c:\windows\system32\drivers\srvnet.sys
    2011-04-14 23:03 . 2011-03-03 06:17 182272 ----a-w- c:\windows\system32\dnsrslvr.dll
    2011-04-14 02:39 . 2011-04-14 02:39 103864 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\nppdf32.dll
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2011-04-14 04:07 . 2011-01-05 17:39 472808 ----a-w- c:\windows\SysWow64\deployJava1.dll
    2011-04-06 15:26 . 2011-04-06 15:26 96544 ----a-w- c:\windows\system32\dnssd.dll
    2011-04-06 15:26 . 2011-04-06 15:26 69408 ----a-w- c:\windows\system32\jdns_sd.dll
    2011-04-06 15:26 . 2011-04-06 15:26 237856 ----a-w- c:\windows\system32\dnssdX.dll
    2011-04-06 15:26 . 2011-04-06 15:26 119584 ----a-w- c:\windows\system32\dns-sd.exe
    2011-04-06 15:20 . 2011-04-06 15:20 91424 ----a-w- c:\windows\SysWow64\dnssd.dll
    2011-04-06 15:20 . 2011-04-06 15:20 75040 ----a-w- c:\windows\SysWow64\jdns_sd.dll
    2011-04-06 15:20 . 2011-04-06 15:20 197920 ----a-w- c:\windows\SysWow64\dnssdX.dll
    2011-04-06 15:20 . 2011-04-06 15:20 107808 ----a-w- c:\windows\SysWow64\dns-sd.exe
    2011-03-23 12:53 . 2009-08-18 19:49 564632 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\wlidui.dll
    2011-03-23 12:53 . 2009-08-18 18:24 18328 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
    2011-03-04 06:17 . 2011-04-27 11:19 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll
    2011-03-04 06:17 . 2011-04-27 11:19 347648 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll
    2011-02-19 06:37 . 2011-03-09 11:10 1135104 ----a-w- c:\windows\system32\FntCache.dll
    2011-02-19 06:37 . 2011-03-09 11:10 1540608 ----a-w- c:\windows\system32\DWrite.dll
    2011-02-19 06:36 . 2011-03-09 11:10 902656 ----a-w- c:\windows\system32\d2d1.dll
    2011-02-19 05:32 . 2011-03-09 11:10 1074176 ----a-w- c:\windows\SysWow64\DWrite.dll
    2011-02-19 05:32 . 2011-03-09 11:10 739840 ----a-w- c:\windows\SysWow64\d2d1.dll
    2011-02-18 15:36 . 2011-02-18 15:36 51712 ----a-w- c:\windows\system32\drivers\usbaapl64.sys
    2011-02-18 15:36 . 2011-02-18 15:36 4184352 ----a-w- c:\windows\system32\usbaaplrc.dll
    .
    .
    ((((((((((((((((((((((((((((( SnapShot@2011-05-03_12.12.34 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2009-07-14 04:54 . 2011-05-06 16:57 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    - 2009-07-14 04:54 . 2011-05-03 11:08 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    - 2009-07-14 04:54 . 2011-05-03 11:08 49152 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
    + 2009-07-14 04:54 . 2011-05-06 16:57 49152 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
    - 2009-07-14 04:54 . 2011-05-03 11:08 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    + 2009-07-14 04:54 . 2011-05-06 16:57 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    + 2010-04-26 16:47 . 2011-05-06 16:42 46362 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
    + 2009-07-14 05:10 . 2011-05-06 16:42 51976 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
    + 2010-11-26 00:16 . 2011-05-06 16:42 13424 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3070130791-3829390808-3701133939-1000_UserData.bin
    + 2010-11-25 23:08 . 2011-05-06 18:40 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    - 2010-11-25 23:08 . 2011-05-03 11:00 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    + 2011-05-06 16:30 . 2011-05-06 18:40 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
    - 2011-04-28 13:12 . 2011-05-03 11:00 32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
    - 2009-07-14 04:54 . 2011-05-03 11:00 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    + 2009-07-14 04:54 . 2011-05-06 18:40 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    + 2010-11-25 17:30 . 2011-05-06 16:40 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    - 2010-11-25 17:30 . 2011-05-03 11:08 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    + 2009-07-14 04:46 . 2011-05-05 10:30 78552 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\Cache\cache.dat
    - 2010-11-25 17:30 . 2011-05-03 11:08 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
    + 2010-11-25 17:30 . 2011-05-06 16:40 32768 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
    - 2010-11-25 17:30 . 2011-05-03 11:08 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    + 2010-11-25 17:30 . 2011-05-06 16:40 16384 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    + 2010-11-25 17:12 . 2011-05-06 20:09 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    - 2010-11-25 17:12 . 2011-05-03 12:04 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
    + 2010-11-25 17:12 . 2011-05-06 20:09 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    - 2010-11-25 17:12 . 2011-05-03 12:04 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
    + 2011-02-03 11:45 . 2011-05-04 17:54 90112 c:\windows\Installer\{91120409-6000-11D3-8CFE-0050048383C9}\xlicons.exe
    - 2011-02-03 11:45 . 2011-04-30 18:16 90112 c:\windows\Installer\{91120409-6000-11D3-8CFE-0050048383C9}\xlicons.exe
    + 2011-02-03 11:45 . 2011-05-04 17:54 45056 c:\windows\Installer\{91120409-6000-11D3-8CFE-0050048383C9}\wordicon.exe
    - 2011-02-03 11:45 . 2011-04-30 18:16 45056 c:\windows\Installer\{91120409-6000-11D3-8CFE-0050048383C9}\wordicon.exe
    + 2011-02-03 11:45 . 2011-05-04 17:54 22528 c:\windows\Installer\{91120409-6000-11D3-8CFE-0050048383C9}\unbndico.exe
    - 2011-02-03 11:45 . 2011-04-30 18:16 22528 c:\windows\Installer\{91120409-6000-11D3-8CFE-0050048383C9}\unbndico.exe
    - 2011-02-03 11:45 . 2011-04-30 18:16 30720 c:\windows\Installer\{91120409-6000-11D3-8CFE-0050048383C9}\pptico.exe
    + 2011-02-03 11:45 . 2011-05-04 17:54 30720 c:\windows\Installer\{91120409-6000-11D3-8CFE-0050048383C9}\pptico.exe
    + 2011-02-03 11:45 . 2011-05-04 17:54 16384 c:\windows\Installer\{91120409-6000-11D3-8CFE-0050048383C9}\PEicons.exe
    - 2011-02-03 11:45 . 2011-04-30 18:16 16384 c:\windows\Installer\{91120409-6000-11D3-8CFE-0050048383C9}\PEicons.exe
    + 2011-02-03 11:45 . 2011-05-04 17:54 34304 c:\windows\Installer\{91120409-6000-11D3-8CFE-0050048383C9}\misc.exe
    - 2011-02-03 11:45 . 2011-04-30 18:16 34304 c:\windows\Installer\{91120409-6000-11D3-8CFE-0050048383C9}\misc.exe
    - 2010-04-26 18:06 . 2011-04-26 10:07 35088 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\oisicon.exe
    + 2010-04-26 18:06 . 2011-05-04 10:39 35088 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\oisicon.exe
    + 2010-04-26 18:06 . 2011-05-04 10:39 18704 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\mspicons.exe
    - 2010-04-26 18:06 . 2011-04-26 10:07 18704 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\mspicons.exe
    - 2010-04-26 18:06 . 2011-04-26 10:07 20240 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\cagicon.exe
    + 2010-04-26 18:06 . 2011-05-04 10:39 20240 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\cagicon.exe
    - 2011-05-03 11:00 . 2011-05-03 11:00 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
    + 2011-05-06 16:40 . 2011-05-06 16:40 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
    - 2011-05-03 11:00 . 2011-05-03 11:00 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
    + 2011-05-06 16:40 . 2011-05-06 16:40 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
    + 2011-02-03 11:45 . 2011-05-04 17:54 3584 c:\windows\Installer\{91120409-6000-11D3-8CFE-0050048383C9}\opwicon.exe
    - 2011-02-03 11:45 . 2011-04-30 18:16 3584 c:\windows\Installer\{91120409-6000-11D3-8CFE-0050048383C9}\opwicon.exe
    - 2011-02-03 11:45 . 2011-04-30 18:16 8192 c:\windows\Installer\{91120409-6000-11D3-8CFE-0050048383C9}\mspicons.exe
    + 2011-02-03 11:45 . 2011-05-04 17:54 8192 c:\windows\Installer\{91120409-6000-11D3-8CFE-0050048383C9}\mspicons.exe
    - 2011-02-03 11:45 . 2011-04-30 18:16 2560 c:\windows\Installer\{91120409-6000-11D3-8CFE-0050048383C9}\cagicon.exe
    + 2011-02-03 11:45 . 2011-05-04 17:54 2560 c:\windows\Installer\{91120409-6000-11D3-8CFE-0050048383C9}\cagicon.exe
    + 2010-11-25 17:29 . 2011-05-06 18:15 278524 c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_S3.bin
    - 2009-07-14 02:36 . 2011-04-27 20:57 628460 c:\windows\system32\perfh009.dat
    + 2009-07-14 02:36 . 2011-05-05 10:26 628460 c:\windows\system32\perfh009.dat
    - 2009-07-14 02:36 . 2011-04-27 20:57 110612 c:\windows\system32\perfc009.dat
    + 2009-07-14 02:36 . 2011-05-05 10:26 110612 c:\windows\system32\perfc009.dat
    + 2009-07-14 04:45 . 2011-05-05 10:23 355368 c:\windows\system32\FNTCACHE.DAT
    - 2009-07-14 04:45 . 2011-04-20 18:26 355368 c:\windows\system32\FNTCACHE.DAT
    + 2009-07-14 05:01 . 2011-05-06 16:39 311380 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
    - 2009-07-14 05:01 . 2011-05-02 20:53 311380 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
    + 2011-02-03 11:45 . 2011-05-04 17:54 114688 c:\windows\Installer\{91120409-6000-11D3-8CFE-0050048383C9}\outicon.exe
    - 2011-02-03 11:45 . 2011-04-30 18:16 114688 c:\windows\Installer\{91120409-6000-11D3-8CFE-0050048383C9}\outicon.exe
    + 2010-04-26 18:06 . 2011-05-04 10:39 888080 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\wordicon.exe
    - 2010-04-26 18:06 . 2011-04-26 10:07 888080 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\wordicon.exe
    - 2010-04-26 18:06 . 2011-04-26 10:07 922384 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\pptico.exe
    + 2010-04-26 18:06 . 2011-05-04 10:39 922384 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\pptico.exe
    - 2010-04-26 18:06 . 2011-04-26 10:07 217864 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\misc.exe
    + 2010-04-26 18:06 . 2011-05-04 10:39 217864 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\misc.exe
    + 2010-04-26 18:06 . 2011-05-04 10:39 184080 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\joticon.exe
    - 2010-04-26 18:06 . 2011-04-26 10:07 184080 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\joticon.exe
    + 2011-05-04 10:38 . 2011-05-04 10:38 217864 c:\windows\Installer\{90120000-006E-0409-0000-0000000FF1CE}\misc.exe
    - 2011-04-20 14:34 . 2011-04-20 14:34 217864 c:\windows\Installer\{90120000-006E-0409-0000-0000000FF1CE}\misc.exe
    + 2009-07-14 04:45 . 2011-05-04 10:35 3777877 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\tokens.dat
    - 2009-07-14 04:45 . 2011-04-29 13:15 3777877 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\tokens.dat
    + 2010-07-21 23:25 . 2011-05-05 13:42 1793560 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat
    + 2010-11-25 19:49 . 2011-05-06 16:39 9544860 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-3070130791-3829390808-3701133939-1000-8192.dat
    + 2010-04-26 18:06 . 2011-05-04 10:39 1172240 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\xlicons.exe
    - 2010-04-26 18:06 . 2011-04-26 10:07 1172240 c:\windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\xlicons.exe
    + 2009-07-14 02:34 . 2011-05-06 18:56 10223616 c:\windows\system32\SMI\Store\Machine\SCHEMA.DAT
    - 2009-07-14 02:34 . 2011-05-03 11:17 10223616 c:\windows\system32\SMI\Store\Machine\SCHEMA.DAT
    + 2011-05-03 14:54 . 2011-05-03 14:54 12565504 c:\windows\Installer\d687ff.msi
    .
    -- Snapshot reset to current date --
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "HPAdvisorDock"="c:\program files (x86)\Hewlett-Packard\HP Advisor\Dock\HPAdvisorDock.exe" [2010-09-28 1715768]
    "LightScribe Control Panel"="c:\program files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe" [2010-02-22 2363392]
    "Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2011-01-26 15026056]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
    "StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-03-29 98304]
    "MSN Toolbar"="c:\program files (x86)\MSN Toolbar\Platform\4.0.0369.0\mswinext.exe" [2009-11-30 240472]
    "Microsoft Default Manager"="c:\program files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2009-07-17 288080]
    "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
    "Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-01-31 35760]
    "Easybits Recovery"="c:\program files (x86)\EasyBits For Kids\ezRecover.exe" [2010-01-25 61112]
    "HP Software Update"="c:\program files (x86)\Hp\HP Software Update\HPWuSchd2.exe" [2008-12-08 54576]
    "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2010-11-29 421888]
    "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2011-04-14 421160]
    "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-01-07 253672]
    "avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-04-18 3460784]
    .
    c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
    Microsoft Office.lnk - c:\program files (x86)\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "ConsentPromptBehaviorAdmin"= 5 (0x5)
    "ConsentPromptBehaviorUser"= 3 (0x3)
    "EnableUIADesktopToggle"= 0 (0x0)
    "HideFastUserSwitching"= 0 (0x0)
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
    "EnableShellExecuteHooks"= 1 (0x1)
    .
    [hkey_local_machine\software\Wow6432Node\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
    .
    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
    Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
    .
    R1 aswSnx;aswSnx; [x]
    R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
    R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
    R3 AtiDCM;AtiDCM;c:\program files\ATI\CIM\BIN64\atdcm64a.sys [2010-03-29 26640]
    R3 netr28x;Ralink 802.11n Wireless Driver for Windows Vista;c:\windows\system32\DRIVERS\netr28x.sys [x]
    R3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys [x]
    R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2009-09-23 225280]
    R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS [x]
    R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS [x]
    R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS [x]
    R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]
    R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
    R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [x]
    S1 aswSP;aswSP; [x]
    S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
    S2 AERTFilters;Andrea RT Filters Service;c:\program files\Realtek\Audio\HDA\AERTSr64.exe [2009-11-18 98208]
    S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
    S2 aswFsBlk;aswFsBlk; [x]
    S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [x]
    S2 HP Wireless Assistant Service;HP Wireless Assistant Service;c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe [2010-01-27 102968]
    S2 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2011-02-04 92216]
    S2 HPWMISVC;HPWMISVC;c:\program files\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [2010-01-18 20480]
    S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atipmdag.sys [x]
    S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
    S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
    S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [x]
    .
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
    2010-02-22 18:38 451872 ----a-w- c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2011-05-05 c:\windows\Tasks\HPCeeScheduleForOlivia.job
    - c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-01-05 10:53]
    .
    .
    --------- x86-64 -----------
    .
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
    @="{472083B0-C522-11CF-8763-00608CC02F24}"
    [HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
    2011-04-18 17:25 134384 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtkNGUI64.exe" [2010-03-13 6234144]
    "RtkOSD"="c:\program files (x86)\Realtek\Audio\OSD\RtVOsd64.exe" [2010-01-12 995840]
    "HP Quick Launch"="c:\program files\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe" [2010-01-18 451072]
    "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2010-04-26 172032]
    "HPWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\DelayedAppStarter.exe" [2010-01-27 8192]
    .
    ------- Supplementary Scan -------
    .
    uLocal Page = c:\windows\system32\blank.htm
    mLocal Page = c:\windows\SysWOW64\blank.htm
    uInternet Settings,ProxyOverride = *.local
    IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~4\Office10\EXCEL.EXE/3000
    IE: Google Sidewiki... - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html
    .
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
    @Denied: (A 2) (Everyone)
    @="FlashBroker"
    "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10e.exe,-101"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
    "Enabled"=dword:00000001
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
    @="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10e.exe"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
    @Denied: (A 2) (Everyone)
    @="Shockwave Flash Object"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
    @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx"
    "ThreadingModel"="Apartment"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
    @="0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
    @="ShockwaveFlash.ShockwaveFlash.10"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
    @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx, 1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
    @="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
    @="ShockwaveFlash.ShockwaveFlash"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
    @Denied: (A 2) (Everyone)
    @="Macromedia Flash Factory Object"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
    @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx"
    "ThreadingModel"="Apartment"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
    @="FlashFactory.FlashFactory.1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
    @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10e.ocx, 1"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
    @="1.0"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
    @="FlashFactory.FlashFactory"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
    @Denied: (A 2) (Everyone)
    @="IFlashBroker3"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
    @="{00020424-0000-0000-C000-000000000046}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    "Version"="1.0"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
    @Denied: (Full) (Everyone)
    .
    Completion time: 2011-05-06 21:49:24
    ComboFix-quarantined-files.txt 2011-05-06 20:49
    ComboFix2.txt 2011-05-03 12:38
    .
    Pre-Run: 240,753,807,360 bytes free
    Post-Run: 240,470,835,200 bytes free
    .
    - - End Of File - - BB0E384D911175CD43CE1DB61DDD8910
  17. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +36

    Okay, I don't see any sign of malware. There may not be much change in the speed because we really didn't remove or stop very much. If you'd like to run HijackThis, I can check the log and advise you on what to check to stop- but most would be the processes I listed: HJT doesn't scan the Services well on a 64bot OS, but we can deal with the remaining entries.

    Download HijackThis and save to your desktop.
    • Extract it to a directory on your hard drive called c:\HijackThis.
    • Then navigate to that directory and double-click on the hijackthis.exe file.
    • When started click on the Scan button and then the Save Log button to create a log of your information.
    • The log file and then the log will open in notepad. Be sure to click on Format> Uncheck Word Wrap when you open Notepad
    • Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
    • Come back here to this thread and paste (Ctrl+V) the log in your next reply.

    NOTE: Do NOT have HijackThis fix anything yet! Most of what it finds will be harmless or even required.
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.