TechSpot

New to this

By LittleBigNDN
Oct 22, 2010
  1. Hello im a little new this and i was wondering if someone could tell me if antimalware also removes spyware and if not what is a good spyware remover or help fix my problems with my computer, It runs slow, programs takes long time to load, Sometimes I open IE browser and three windows open,also the blue bar atop of the browser blinks, And i've seen files on my computer that I removed. I have anti-malware and avira so please if someone can help its much appreicated.
     
  2. Broni

    Broni Malware Annihilator Posts: 52,890   +344

    Welcome aboard [​IMG]

    Please, complete all steps listed here: http://www.techspot.com/vb/topic58138.html
    Make sure, you PASTE all logs. If some log exceeds 50,000 characters post limit, split it between couple of replies.
    Attached logs won't be reviewed.
     
  3. LittleBigNDN

    LittleBigNDN TS Rookie Topic Starter Posts: 47

    had personal info on this
     
  4. LittleBigNDN

    LittleBigNDN TS Rookie Topic Starter Posts: 47

    sorry not sure how this all works
     
  5. LittleBigNDN

    LittleBigNDN TS Rookie Topic Starter Posts: 47

    Alright I do beleive that im done with the 8 step info. that i was suppose to load up and run and post the logs on here. If i forgot something or did something wrong please let me know cuz like i said before im new to this and every little bit of help is more then helpful and once again apprecated also. Thank you very much for your time you have spent in helping me with my problems.
     
  6. Broni

    Broni Malware Annihilator Posts: 52,890   +344

    1. Please, do NOT bump your topic. It won't speed anything up.
    2. Follow instructions and PASTE all logs.
     
  7. LittleBigNDN

    LittleBigNDN TS Rookie Topic Starter Posts: 47

    Malwarebytes' Anti-Malware 1.46
    www.malwarebytes.org

    Database version: 4878

    Windows 5.1.2600 Service Pack 3
    Internet Explorer 8.0.6001.18702

    10/22/2010 8:06:37 AM
    mbam-log-2010-10-22 (08-06-37).txt

    Scan type: Quick scan
    Objects scanned: 149309
    Time elapsed: 11 minute(s), 48 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 0

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    (No malicious items detected)

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    (No malicious items detected)
     
  8. LittleBigNDN

    LittleBigNDN TS Rookie Topic Starter Posts: 47

    GMER 1.0.15.15477 - http://www.gmer.net
    Rootkit scan 2010-10-22 11:04:46
    Windows 5.1.2600 Service Pack 3
    Running: jqmfexyt.exe; Driver: C:\DOCUME~1\DAYLEN~1\LOCALS~1\Temp\kwaiypod.sys


    ---- System - GMER 1.0.15 ----

    SSDT FA0562C6 ZwCreateKey
    SSDT FA0562BC ZwCreateThread
    SSDT FA0562CB ZwDeleteKey
    SSDT FA0562D5 ZwDeleteValueKey
    SSDT IPVNMon.sys (IPVNMon/Visual Networks) ZwDeviceIoControlFile [0xF985C803]
    SSDT FA0562DA ZwLoadKey
    SSDT FA0562A8 ZwOpenProcess
    SSDT FA0562AD ZwOpenThread
    SSDT FA0562E4 ZwReplaceKey
    SSDT FA0562DF ZwRestoreKey
    SSDT FA0562D0 ZwSetValueKey

    ---- Kernel code sections - GMER 1.0.15 ----

    ? C:\DOCUME~1\DAYLEN~1\LOCALS~1\Temp\kwaiypog.sys The system cannot find the file specified. !

    ---- User code sections - GMER 1.0.15 ----

    .text C:\WINDOWS\system32\SearchIndexer.exe[560] kernel32.dll!WriteFile 7C810E27 7 Bytes JMP 00585C0C C:\WINDOWS\system32\MSSRCH.DLL (mssrch.dll/Microsoft Corporation)

    ---- Kernel IAT/EAT - GMER 1.0.15 ----

    IAT \SystemRoot\System32\DRIVERS\rasl2tp.sys[NDIS.SYS!NdisMSetAttributesEx] [F985C744] IPVNMon.sys (IPVNMon/Visual Networks)
    IAT \SystemRoot\System32\DRIVERS\rasl2tp.sys[NDIS.SYS!NdisMRegisterMiniport] [F985C51E] IPVNMon.sys (IPVNMon/Visual Networks)
    IAT \SystemRoot\System32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisCloseAdapter] [F985C71A] IPVNMon.sys (IPVNMon/Visual Networks)
    IAT \SystemRoot\System32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisOpenAdapter] [F985C6A7] IPVNMon.sys (IPVNMon/Visual Networks)
    IAT \SystemRoot\System32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisMSetAttributesEx] [F985C744] IPVNMon.sys (IPVNMon/Visual Networks)
    IAT \SystemRoot\System32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisRegisterProtocol] [F985C380] IPVNMon.sys (IPVNMon/Visual Networks)
    IAT \SystemRoot\System32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisMRegisterMiniport] [F985C51E] IPVNMon.sys (IPVNMon/Visual Networks)
    IAT \SystemRoot\System32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisRegisterProtocol] [F985C380] IPVNMon.sys (IPVNMon/Visual Networks)
    IAT \SystemRoot\System32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisOpenAdapter] [F985C6A7] IPVNMon.sys (IPVNMon/Visual Networks)
    IAT \SystemRoot\System32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisCloseAdapter] [F985C71A] IPVNMon.sys (IPVNMon/Visual Networks)
    IAT \SystemRoot\System32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisMSetAttributesEx] [F985C744] IPVNMon.sys (IPVNMon/Visual Networks)
    IAT \SystemRoot\System32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisMRegisterMiniport] [F985C51E] IPVNMon.sys (IPVNMon/Visual Networks)
    IAT \SystemRoot\System32\DRIVERS\raspptp.sys[NDIS.SYS!NdisMSetAttributesEx] [F985C744] IPVNMon.sys (IPVNMon/Visual Networks)
    IAT \SystemRoot\System32\DRIVERS\raspptp.sys[NDIS.SYS!NdisMRegisterMiniport] [F985C51E] IPVNMon.sys (IPVNMon/Visual Networks)
    IAT \SystemRoot\System32\DRIVERS\psched.sys[NDIS.SYS!NdisIMRegisterLayeredMiniport] [F985C48B] IPVNMon.sys (IPVNMon/Visual Networks)
    IAT \SystemRoot\System32\DRIVERS\psched.sys[NDIS.SYS!NdisRegisterProtocol] [F985C380] IPVNMon.sys (IPVNMon/Visual Networks)
    IAT \SystemRoot\System32\DRIVERS\psched.sys[NDIS.SYS!NdisOpenAdapter] [F985C6A7] IPVNMon.sys (IPVNMon/Visual Networks)
    IAT \SystemRoot\System32\DRIVERS\psched.sys[NDIS.SYS!NdisMSetAttributesEx] [F985C744] IPVNMon.sys (IPVNMon/Visual Networks)
    IAT \SystemRoot\System32\DRIVERS\psched.sys[NDIS.SYS!NdisCloseAdapter] [F985C71A] IPVNMon.sys (IPVNMon/Visual Networks)
    IAT \SystemRoot\System32\DRIVERS\raspti.sys[NDIS.SYS!NdisMSetAttributesEx] [F985C744] IPVNMon.sys (IPVNMon/Visual Networks)
    IAT \SystemRoot\System32\DRIVERS\raspti.sys[NDIS.SYS!NdisMRegisterMiniport] [F985C51E] IPVNMon.sys (IPVNMon/Visual Networks)
    IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisRegisterProtocol] [F985C380] IPVNMon.sys (IPVNMon/Visual Networks)
    IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisCloseAdapter] [F985C71A] IPVNMon.sys (IPVNMon/Visual Networks)
    IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisOpenAdapter] [F985C6A7] IPVNMon.sys (IPVNMon/Visual Networks)
    IAT \SystemRoot\System32\DRIVERS\tcpip.sys[NDIS.SYS!NdisCloseAdapter] [F985C71A] IPVNMon.sys (IPVNMon/Visual Networks)
    IAT \SystemRoot\System32\DRIVERS\tcpip.sys[NDIS.SYS!NdisOpenAdapter] [F985C6A7] IPVNMon.sys (IPVNMon/Visual Networks)
    IAT \SystemRoot\System32\DRIVERS\tcpip.sys[NDIS.SYS!NdisRegisterProtocol] [F985C380] IPVNMon.sys (IPVNMon/Visual Networks)
    IAT \SystemRoot\System32\DRIVERS\wanarp.sys[NDIS.SYS!NdisRegisterProtocol] [F985C380] IPVNMon.sys (IPVNMon/Visual Networks)
    IAT \SystemRoot\System32\DRIVERS\wanarp.sys[NDIS.SYS!NdisOpenAdapter] [F985C6A7] IPVNMon.sys (IPVNMon/Visual Networks)
    IAT \SystemRoot\System32\DRIVERS\wanarp.sys[NDIS.SYS!NdisCloseAdapter] [F985C71A] IPVNMon.sys (IPVNMon/Visual Networks)
    IAT \SystemRoot\System32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisRegisterProtocol] [F985C380] IPVNMon.sys (IPVNMon/Visual Networks)
    IAT \SystemRoot\System32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisCloseAdapter] [F985C71A] IPVNMon.sys (IPVNMon/Visual Networks)
    IAT \SystemRoot\System32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisOpenAdapter] [F985C6A7] IPVNMon.sys (IPVNMon/Visual Networks)
    IAT \SystemRoot\System32\DRIVERS\asyncmac.sys[NDIS.SYS!NdisMRegisterMiniport] [F985C51E] IPVNMon.sys (IPVNMon/Visual Networks)
    IAT \SystemRoot\System32\DRIVERS\asyncmac.sys[NDIS.SYS!NdisMSetAttributesEx] [F985C744] IPVNMon.sys (IPVNMon/Visual Networks)

    ---- Devices - GMER 1.0.15 ----

    AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

    ---- EOF - GMER 1.0.15 ----
     
  9. LittleBigNDN

    LittleBigNDN TS Rookie Topic Starter Posts: 47

    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT

    DDS (Ver_10-10-21.02)

    Microsoft Windows XP Home Edition
    Boot Device: \Device\HarddiskVolume2
    Install Date: 3/25/2005 11:24:23 AM
    System Uptime: 10/22/2010 3:22:03 PM (14 hours ago)

    Motherboard: Dell Computer Corp. | |
    Processor: Intel(R) Pentium(R) 4 CPU 2.00GHz | Microprocessor | 1993/400mhz

    ==== Disk Partitions =========================

    A: is Removable
    C: is FIXED (NTFS) - 56 GiB total, 36.647 GiB free.
    D: is CDROM ()
    E: is CDROM ()

    ==== Disabled Device Manager Items =============

    ==== System Restore Points ===================

    RP596: 8/22/2010 3:02:44 PM - Software Distribution Service 3.0
    RP597: 8/23/2010 4:19:55 PM - Software Distribution Service 3.0
    RP598: 8/24/2010 4:53:39 PM - System Checkpoint
    RP599: 8/25/2010 11:38:18 PM - Software Distribution Service 3.0
    RP600: 8/27/2010 1:42:02 AM - Software Distribution Service 3.0
    RP601: 8/27/2010 2:38:27 AM - Installed Java(TM) 6 Update 21
    RP602: 8/29/2010 3:53:54 PM - Software Distribution Service 3.0
    RP603: 8/30/2010 6:09:20 PM - Software Distribution Service 3.0
    RP604: 8/31/2010 10:59:21 PM - System Checkpoint
    RP605: 9/1/2010 8:36:09 PM - Software Distribution Service 3.0
    RP606: 9/2/2010 9:21:02 PM - System Checkpoint
    RP607: 9/3/2010 7:27:55 AM - Software Distribution Service 3.0
    RP608: 9/5/2010 12:47:24 AM - Software Distribution Service 3.0
    RP609: 9/6/2010 11:30:30 AM - Software Distribution Service 3.0
    RP610: 9/7/2010 3:25:17 PM - Software Distribution Service 3.0
    RP611: 9/8/2010 3:29:39 PM - System Checkpoint
    RP612: 9/10/2010 9:20:22 AM - Software Distribution Service 3.0
    RP613: 9/12/2010 6:41:15 PM - System Checkpoint
    RP614: 9/15/2010 12:10:42 AM - System Checkpoint
    RP615: 9/18/2010 9:32:27 PM - Software Distribution Service 3.0
    RP616: 9/20/2010 12:03:44 AM - Software Distribution Service 3.0
    RP617: 9/22/2010 10:43:48 PM - Software Distribution Service 3.0
    RP618: 9/23/2010 10:03:42 PM - Software Distribution Service 3.0
    RP619: 9/24/2010 2:55:15 PM - Cleaned registry with Windows Live OneCare safety scanner
    RP620: 9/24/2010 3:31:02 PM - Cleaned registry with Windows Live OneCare safety scanner
    RP621: 9/25/2010 2:55:53 AM - Software Distribution Service 3.0
    RP622: 9/25/2010 5:14:13 AM - Software Distribution Service 3.0
    RP623: 9/25/2010 10:03:31 AM - Software Distribution Service 3.0
    RP624: 9/25/2010 11:08:52 PM - Software Distribution Service 3.0
    RP625: 9/26/2010 8:05:48 AM - Software Distribution Service 3.0
    RP626: 9/27/2010 9:08:06 PM - System Checkpoint
    RP627: 9/29/2010 1:27:46 AM - System Checkpoint
    RP628: 9/29/2010 5:46:11 AM - Software Distribution Service 3.0
    RP629: 9/29/2010 11:06:43 PM - Software Distribution Service 3.0
    RP630: 9/29/2010 11:53:54 PM - Software Distribution Service 3.0
    RP631: 10/1/2010 4:33:40 AM - System Checkpoint
    RP632: 10/2/2010 6:52:40 AM - Software Distribution Service 3.0
    RP633: 10/3/2010 7:09:05 PM - System Checkpoint
    RP634: 10/4/2010 7:18:39 PM - System Checkpoint
    RP635: 10/5/2010 8:46:20 PM - System Checkpoint
    RP636: 10/5/2010 11:58:28 PM - Software Distribution Service 3.0
    RP637: 10/6/2010 5:40:34 AM - Cleaned registry with Windows Live OneCare safety scanner
    RP638: 10/7/2010 8:47:24 AM - Software Distribution Service 3.0
    RP639: 10/7/2010 10:38:41 PM - Software Distribution Service 3.0
    RP640: 10/8/2010 11:41:59 AM - Cleaned registry with Windows Live OneCare safety scanner
    RP641: 10/8/2010 11:50:47 AM - Software Distribution Service 3.0
    RP642: 10/9/2010 11:32:13 PM - Restore Operation
    RP643: 10/9/2010 11:38:27 PM - Restore Operation
    RP644: 10/9/2010 11:45:26 PM - Restore Operation
    RP645: 10/9/2010 11:52:23 PM - Restore Operation
    RP646: 10/9/2010 11:58:49 PM - Restore Operation
    RP647: 10/10/2010 12:11:37 AM - Restore Operation
    RP648: 10/10/2010 12:41:09 AM - Software Distribution Service 3.0
    RP649: 10/10/2010 3:41:50 PM - Removed Ask Toolbar.
    RP650: 10/10/2010 3:46:08 PM - Removed AT&T Yahoo! Dial Connection Manager
    RP651: 10/10/2010 3:49:07 PM - Removed Microsoft Silverlight
    RP652: 10/11/2010 9:44:31 PM - System Checkpoint
    RP653: 10/12/2010 10:08:38 PM - System Checkpoint
    RP654: 10/13/2010 2:41:13 PM - Software Distribution Service 3.0
    RP655: 10/14/2010 1:19:10 AM - Restore Operation
    RP656: 10/14/2010 1:36:38 AM - Restore Operation
    RP657: 10/14/2010 2:11:43 AM - Restore Operation
    RP658: 10/14/2010 2:36:55 AM - Restore Operation
    RP659: 10/14/2010 2:53:14 AM - Restore Operation
    RP660: 10/14/2010 3:58:20 AM - Software Distribution Service 3.0
    RP661: 10/14/2010 7:20:19 AM - Removed Ask Toolbar.
    RP662: 10/14/2010 7:22:21 AM - Removed AT&T Yahoo! Dial Connection Manager
    RP663: 10/14/2010 10:47:40 AM - Removed AT&T Yahoo! Dial Connection Manager
    RP664: 10/14/2010 11:41:11 PM - Software Distribution Service 3.0
    RP665: 10/15/2010 5:19:07 AM - Removed QuickTime
    RP666: 10/15/2010 5:56:36 AM - Removed Ask Toolbar.
    RP667: 10/15/2010 8:22:21 AM - Restore Operation
    RP668: 10/15/2010 8:32:33 AM - Removed QuickTime
    RP669: 10/15/2010 9:08:10 AM - Installed Microsoft Fix it 50416
    RP670: 10/15/2010 10:15:30 AM - Software Distribution Service 3.0
    RP671: 10/15/2010 12:57:39 PM - Restore Operation
    RP672: 10/15/2010 4:48:02 PM - Software Distribution Service 3.0
    RP673: 10/15/2010 7:12:52 PM - Revo Uninstaller's restore point - Microsoft Silverlight
    RP674: 10/15/2010 7:22:15 PM - Revo Uninstaller's restore point - Microsoft Silverlight
    RP675: 10/16/2010 7:27:45 PM - System Checkpoint
    RP676: 10/16/2010 9:27:42 PM - Software Distribution Service 3.0
    RP677: 10/18/2010 2:34:36 PM - Restore Operation
    RP678: 10/18/2010 2:38:17 PM - Restore Operation
    RP679: 10/18/2010 5:02:13 PM - Installed QuickTime
    RP680: 10/19/2010 5:08:45 PM - System Checkpoint
    RP681: 10/20/2010 5:30:56 PM - System Checkpoint
    RP682: 10/21/2010 6:33:02 PM - System Checkpoint
    RP683: 10/22/2010 7:29:16 PM - System Checkpoint

    ==== Installed Programs ======================

    Adobe Flash Player 10 ActiveX
    Adobe Flash Player 10 Plugin
    Adobe Reader 8.1.4
    Apple Application Support
    Apple Software Update
    ArcSoft PhotoImpression 5
    ArcSoft VideoImpression 2
    AT&T Yahoo! Applications
    Avira AntiVir Personal - Free Antivirus
    Critical Update for Windows Media Player 11 (KB959772)
    Dell AIO Printer A940
    Glary Utilities 2.28.0.1011
    Google Earth
    Google Update Helper
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
    Hotfix for Windows Internet Explorer 7 (KB947864)
    Hotfix for Windows Media Format 11 SDK (KB929399)
    Hotfix for Windows Media Player 11 (KB939683)
    Hotfix for Windows XP (KB2158563)
    Hotfix for Windows XP (KB915800-v4)
    Hotfix for Windows XP (KB952287)
    Hotfix for Windows XP (KB961118)
    Hotfix for Windows XP (KB970653-v3)
    Hotfix for Windows XP (KB976098-v2)
    Hotfix for Windows XP (KB981793)
    Intel(R) PRO Ethernet Adapter and Software
    iTunes
    J2SE Runtime Environment 5.0 Update 11
    Java Auto Updater
    Java(TM) 6 Update 21
    LimeWire 5.5.16
    LSI PCI Soft Modem
    Malwarebytes' Anti-Malware
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 1.1 Security Update (KB2416447)
    Microsoft .NET Framework 1.1 Security Update (KB979906)
    Microsoft .NET Framework 2.0 Service Pack 2
    Microsoft .NET Framework 3.0 Service Pack 2
    Microsoft .NET Framework 3.5 SP1
    Microsoft .NET Framework 4 Client Profile
    Microsoft .NET Framework 4 Extended
    Microsoft Application Error Reporting
    Microsoft Base Smart Card Cryptographic Service Provider Package
    Microsoft Choice Guard
    Microsoft Compression Client Pack 1.0 for Windows XP
    Microsoft Internationalized Domain Names Mitigation APIs
    Microsoft National Language Support Downlevel APIs
    Microsoft Silverlight
    Microsoft User-Mode Driver Framework Feature Pack 1.0
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    MSVCRT
    OpenOffice.org Installer 1.0
    QuickTime
    Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
    Security Update for Microsoft .NET Framework 4 Extended (KB2416472)
    Security Update for Windows Internet Explorer 7 (KB938127)
    Security Update for Windows Internet Explorer 7 (KB939653)
    Security Update for Windows Internet Explorer 7 (KB942615)
    Security Update for Windows Internet Explorer 7 (KB944533)
    Security Update for Windows Internet Explorer 7 (KB950759)
    Security Update for Windows Internet Explorer 7 (KB953838)
    Security Update for Windows Internet Explorer 7 (KB961260)
    Security Update for Windows Internet Explorer 7 (KB963027)
    Security Update for Windows Internet Explorer 8 (KB2183461)
    Security Update for Windows Internet Explorer 8 (KB2360131)
    Security Update for Windows Internet Explorer 8 (KB971961)
    Security Update for Windows Internet Explorer 8 (KB972260)
    Security Update for Windows Internet Explorer 8 (KB976325)
    Security Update for Windows Internet Explorer 8 (KB981332)
    Security Update for Windows Internet Explorer 8 (KB982381)
    Security Update for Windows Media Player (KB2378111)
    Security Update for Windows Media Player (KB911564)
    Security Update for Windows Media Player (KB952069)
    Security Update for Windows Media Player (KB954155)
    Security Update for Windows Media Player (KB968816)
    Security Update for Windows Media Player (KB973540)
    Security Update for Windows Media Player (KB975558)
    Security Update for Windows Media Player (KB978695)
    Security Update for Windows Media Player 11 (KB936782)
    Security Update for Windows Media Player 11 (KB954154)
    Security Update for Windows Media Player 9 (KB911565)
    Security Update for Windows Search 4 - KB963093
    Security Update for Windows XP (KB2079403)
    Security Update for Windows XP (KB2115168)
    Security Update for Windows XP (KB2121546)
    Security Update for Windows XP (KB2160329)
    Security Update for Windows XP (KB2229593)
    Security Update for Windows XP (KB2259922)
    Security Update for Windows XP (KB2279986)
    Security Update for Windows XP (KB2286198)
    Security Update for Windows XP (KB2296011)
    Security Update for Windows XP (KB2347290)
    Security Update for Windows XP (KB2360937)
    Security Update for Windows XP (KB2387149)
    Security Update for Windows XP (KB923561)
    Security Update for Windows XP (KB938464-v2)
    Security Update for Windows XP (KB941569)
    Security Update for Windows XP (KB946648)
    Security Update for Windows XP (KB950760)
    Security Update for Windows XP (KB950762)
    Security Update for Windows XP (KB950974)
    Security Update for Windows XP (KB951066)
    Security Update for Windows XP (KB951376-v2)
    Security Update for Windows XP (KB951376)
    Security Update for Windows XP (KB951698)
    Security Update for Windows XP (KB951748)
    Security Update for Windows XP (KB952004)
    Security Update for Windows XP (KB952954)
    Security Update for Windows XP (KB953839)
    Security Update for Windows XP (KB954459)
    Security Update for Windows XP (KB954600)
    Security Update for Windows XP (KB955069)
    Security Update for Windows XP (KB956572)
    Security Update for Windows XP (KB956744)
    Security Update for Windows XP (KB956802)
    Security Update for Windows XP (KB956803)
    Security Update for Windows XP (KB956841)
    Security Update for Windows XP (KB956844)
    Security Update for Windows XP (KB957097)
    Security Update for Windows XP (KB958644)
    Security Update for Windows XP (KB958687)
    Security Update for Windows XP (KB958690)
    Security Update for Windows XP (KB958869)
    Security Update for Windows XP (KB959426)
    Security Update for Windows XP (KB960225)
    Security Update for Windows XP (KB960715)
    Security Update for Windows XP (KB960803)
    Security Update for Windows XP (KB960859)
    Security Update for Windows XP (KB961371)
    Security Update for Windows XP (KB961373)
    Security Update for Windows XP (KB961501)
    Security Update for Windows XP (KB968537)
    Security Update for Windows XP (KB969059)
    Security Update for Windows XP (KB969947)
    Security Update for Windows XP (KB970238)
    Security Update for Windows XP (KB970430)
    Security Update for Windows XP (KB971468)
    Security Update for Windows XP (KB971557)
    Security Update for Windows XP (KB971633)
    Security Update for Windows XP (KB971657)
    Security Update for Windows XP (KB972270)
    Security Update for Windows XP (KB973346)
    Security Update for Windows XP (KB973354)
    Security Update for Windows XP (KB973507)
    Security Update for Windows XP (KB973525)
    Security Update for Windows XP (KB973869)
    Security Update for Windows XP (KB973904)
    Security Update for Windows XP (KB974112)
    Security Update for Windows XP (KB974318)
    Security Update for Windows XP (KB974392)
    Security Update for Windows XP (KB974571)
    Security Update for Windows XP (KB975025)
    Security Update for Windows XP (KB975467)
    Security Update for Windows XP (KB975560)
    Security Update for Windows XP (KB975561)
    Security Update for Windows XP (KB975562)
    Security Update for Windows XP (KB975713)
    Security Update for Windows XP (KB977816)
    Security Update for Windows XP (KB977914)
    Security Update for Windows XP (KB978037)
    Security Update for Windows XP (KB978338)
    Security Update for Windows XP (KB978542)
    Security Update for Windows XP (KB978601)
    Security Update for Windows XP (KB978706)
    Security Update for Windows XP (KB979309)
    Security Update for Windows XP (KB979482)
    Security Update for Windows XP (KB979559)
    Security Update for Windows XP (KB979683)
    Security Update for Windows XP (KB979687)
    Security Update for Windows XP (KB980195)
    Security Update for Windows XP (KB980218)
    Security Update for Windows XP (KB980232)
    Security Update for Windows XP (KB980436)
    Security Update for Windows XP (KB981322)
    Security Update for Windows XP (KB981852)
    Security Update for Windows XP (KB981957)
    Security Update for Windows XP (KB981997)
    Security Update for Windows XP (KB982132)
    Security Update for Windows XP (KB982214)
    Security Update for Windows XP (KB982665)
    Security Update for Windows XP (KB982802)
    Segoe UI
    Sound Blaster Live!
    SweetIM for Messenger 2.7
    SweetIM Toolbar for Internet Explorer 3.4
    Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
    Update for Microsoft Windows (KB971513)
    Update for Windows Internet Explorer 8 (KB976662)
    Update for Windows Internet Explorer 8 (KB982664)
    Update for Windows XP (KB2141007)
    Update for Windows XP (KB2345886)
    Update for Windows XP (KB951072-v2)
    Update for Windows XP (KB951978)
    Update for Windows XP (KB955759)
    Update for Windows XP (KB955839)
    Update for Windows XP (KB961503)
    Update for Windows XP (KB967715)
    Update for Windows XP (KB968389)
    Update for Windows XP (KB971737)
    Update for Windows XP (KB973687)
    Update for Windows XP (KB973815)
    URGE
    WebFldrs XP
    Windows Genuine Advantage v1.3.0254.0
    Windows Internet Explorer 7
    Windows Internet Explorer 8
    Windows Live Call
    Windows Live Communications Platform
    Windows Live Essentials
    Windows Live Messenger
    Windows Live Sign-in Assistant
    Windows Live Upload Tool
    Windows Management Framework Core
    Windows Media Format 11 runtime
    Windows Media Player 11
    Windows Search 4.0
    Windows XP Service Pack 3
    Yahoo! Software Update

    ==== Event Viewer Messages From Past Week ========

    10/22/2010 8:18:23 AM, error: atapi [11] - The driver detected a controller error on \Device\Ide\IdePort0.
    10/22/2010 8:18:08 AM, error: atapi [9] - The device, \Device\Ide\IdePort0, did not respond within the timeout period.
    10/22/2010 7:39:13 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the IMAPI CD-Burning COM Service service to connect.
    10/22/2010 7:39:13 AM, error: Service Control Manager [7000] - The IMAPI CD-Burning COM Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    10/22/2010 7:16:01 AM, error: Service Control Manager [7034] - The Yahoo! Updater service terminated unexpectedly. It has done this 1 time(s).
    10/22/2010 7:16:01 AM, error: Service Control Manager [7034] - The LexBce Server service terminated unexpectedly. It has done this 1 time(s).
    10/22/2010 7:16:01 AM, error: Service Control Manager [7034] - The Java Quick Starter service terminated unexpectedly. It has done this 1 time(s).
    10/22/2010 7:16:01 AM, error: Service Control Manager [7034] - The Agere Modem Call Progress Audio service terminated unexpectedly. It has done this 1 time(s).
    10/22/2010 3:30:42 PM, error: DCOM [10005] - DCOM got error "%1053" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
    10/22/2010 3:26:41 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Windows Search service to connect.
    10/22/2010 3:26:41 PM, error: Service Control Manager [7000] - The Windows Search service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    10/22/2010 2:31:15 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Net.Tcp Port Sharing Service service to connect.
    10/22/2010 2:31:15 AM, error: Service Control Manager [7000] - The Net.Tcp Port Sharing Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    10/19/2010 8:08:54 PM, error: atapi [9] - The device, \Device\Ide\IdePort1, did not respond within the timeout period.
    10/19/2010 7:38:47 AM, error: Service Control Manager [7024] - The Distributed Transaction Coordinator service terminated with service-specific error 3221229584 (0xC0001010).
    10/19/2010 6:25:23 AM, error: SideBySide [59] - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. .
    10/19/2010 6:25:23 AM, error: SideBySide [59] - Generate Activation Context failed for C:\DOCUME~1\DAYLEN~1\LOCALS~1\Temp\RarSFX0\redist.dll. Reference error message: The operation completed successfully. .
    10/19/2010 6:25:23 AM, error: SideBySide [32] - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system.
    10/19/2010 4:25:44 PM, error: Service Control Manager [7022] - The Avira AntiVir Guard service hung on starting.
    10/18/2010 2:34:24 PM, error: Service Control Manager [7024] - The Windows Search service terminated with service-specific error 2147749155 (0x80040D23).
    10/17/2010 1:59:25 AM, error: Microsoft Antimalware [2001] -
    10/16/2010 9:02:27 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Yahoo! Updater service to connect.
    10/16/2010 9:02:27 PM, error: Service Control Manager [7000] - The Yahoo! Updater service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    10/16/2010 9:02:12 PM, error: SideBySide [59] - Generate Activation Context failed for C:\WINDOWS\system32\SHELL32.dll. Reference error message: The operation completed successfully. .
    10/16/2010 9:02:12 PM, error: SideBySide [58] - Syntax error in manifest or policy file "C:\WINDOWS\system32\SHELL32.dll" on line 0.
    10/16/2010 9:02:11 PM, error: DCOM [10005] - DCOM got error "%1053" attempting to start the service YahooAUService with arguments "" in order to run the server: {90AFF435-B544-4F94-A0C2-CC020EACA4E3}

    ==== End Of File ===========================
     
  10. LittleBigNDN

    LittleBigNDN TS Rookie Topic Starter Posts: 47

    DDS (Ver_10-10-21.02) - NTFSx86
    Run by Daylene Croy at 5:49:31.79 on Sat 10/23/2010
    Internet Explorer: 8.0.6001.18702
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.255.54 [GMT -7:00]

    AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

    ============== Running Processes ===============

    C:\WINDOWS\system32\svchost -k DcomLaunch
    svchost.exe
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
    svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\LEXBCES.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\LEXPPS.EXE
    C:\Program Files\Avira\AntiVir Desktop\sched.exe
    svchost.exe
    C:\WINDOWS\system32\netdde.exe
    C:\Program Files\LSI SoftModem\agrsmsvc.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\WINDOWS\AGRSMMSG.exe
    C:\Program Files\SweetIM\Messenger\SweetIM.exe
    C:\Program Files\Common Files\Java\Java Update\jusched.exe
    C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\System32\svchost.exe -k imgsvc
    C:\WINDOWS\system32\SearchIndexer.exe
    C:\Program Files\Avira\AntiVir Desktop\avguard.exe
    C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Yahoo!\Companion\att\ToolbarSvr.exe
    C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
    C:\PROGRA~1\Yahoo!\browser\ycommon.exe
    C:\Documents and Settings\Daylene Croy\Desktop\dds.scr

    ============== Pseudo HJT Report ===============

    uStart Page = hxxp://att.yahoo.com/
    uSearch Page = hxxp://search.yahoo.com
    uSearch Bar = hxxp://www.yahoo.com/ext/search/search.html
    uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
    mDefault_Search_URL = hxxp://search.yahoo.com
    mSearch Page = hxxp://search.yahoo.com
    mSearch Bar = hxxp://www.yahoo.com/ext/search/search.html
    uSearchAssistant = hxxp://www.google.com/ie
    uSearchURL,(Default) = hxxp://search.yahoo.com
    mSearchAssistant = hxxp://home.peoplepc.com/search
    uURLSearchHooks: att.net Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn1\yt.dll
    uURLSearchHooks: SweetIM ToolbarURLSearchHook Class: {eee6c35d-6118-11dc-9c72-001320c79847} - c:\program files\sweetim\toolbars\internet explorer\mgHelper.dll
    BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn1\yt.dll
    BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
    BHO: Yahoo! IE Services Button: {5bab4b5b-68bc-4b02-94d6-2fc0de4a7897} - c:\progra~1\yahoo!\common\yiesrvc.dll
    BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
    BHO: {656ec4b7-072b-4698-b504-2a414c1f0037} - Accelerator Plugin
    BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    BHO: SweetIM Toolbar Helper: {eee6c35c-6118-11dc-9c72-001320c79847} - c:\program files\sweetim\toolbars\internet explorer\mgToolbarIE.dll
    BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn1\YTSingleInstance.dll
    TB: SweetIM Toolbar for Internet Explorer: {eee6c35b-6118-11dc-9c72-001320c79847} - c:\program files\sweetim\toolbars\internet explorer\mgToolbarIE.dll
    TB: att.net Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn1\yt.dll
    TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
    uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
    uRun: [msnmsgr] ~"c:\program files\windows live\messenger\msnmsgr.exe" /background
    mRun: [UpdReg] c:\windows\UpdReg.EXE
    mRun: [IPInSightMonitor 01] "c:\program files\sbc yahoo!\connection manager\ip insight\IPMon32.exe"
    mRun: [AGRSMMSG] AGRSMMSG.exe
    mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
    mRun: [SweetIM] c:\program files\sweetim\messenger\SweetIM.exe
    mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
    mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
    mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
    dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t
    StartupFolder: c:\docume~1\daylen~1\startm~1\programs\startup\limewi~1.lnk - c:\program files\limewire\LimeWire.exe
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\window~1.lnk - c:\program files\windows desktop search\WindowsSearch.exe
    IE: &Yahoo! Search - file:///c:\program files\yahoo!\Common/ycsrch.htm
    IE: Yahoo! &Dictionary - file:///c:\program files\yahoo!\Common/ycdict.htm
    IE: Yahoo! &Maps - file:///c:\program files\yahoo!\Common/ycmap.htm
    IE: Yahoo! &SMS - file:///c:\program files\yahoo!\Common/ycsms.htm
    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    IE: {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - c:\progra~1\yahoo!\common\yiesrvc.dll
    Trusted Zone: marlboro.com\www
    DPF: Bingo Luau by pogo - hxxp://game3.pogo.com/v/9.1.7.20/applet/freebingo/freebingo-en_US.cab
    DPF: Blackjack Carnival by pogo - hxxp://game3.pogo.com/v/9.1.7.20/applet/vbjack2/vbjack2-en_US.cab
    DPF: Bowling by pogo - hxxp://game3.pogo.com/v/9.1.7.20/applet/bowling/bowling-en_US.cab
    DPF: Cribbage by pogo - hxxp://game3.pogo.com/v/9.1.6.34/applet/cribbage/cribbage-en_US.cab
    DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab
    DPF: First Class Solitaire by pogo - hxxp://game3.pogo.com/v/9.1.7.20/applet/firstclass2/firstclass2-en_US.cab
    DPF: Greenback Bayou by pogo - hxxp://game3.pogo.com/v/9.1.6.34/applet/greenback/greenback-en_US.cab
    DPF: Hog Heaven Slots by pogo - hxxp://game3.pogo.com/v/9.1.7.20/applet/fancy/fancy-en_US.cab
    DPF: Lottso by pogo - hxxp://game3.pogo.com/v/9.1.7.20/applet/lottso/lottso-en_US.cab
    DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
    DPF: Payday Freecell Solitaire by pogo - hxxp://game3.pogo.com/v/9.1.7.20/applet/freecell2/freecell2-en_US.cab
    DPF: Phlinx by pogo - hxxp://game3.pogo.com/v/9.1.7.20/applet/flinger/flinger-en_US.cab
    DPF: Pinochle by pogo - hxxp://game3.pogo.com/v/9.1.7.22/applet/pinochle/pinochle-en_US.cab
    DPF: Poppit by pogo - hxxp://game3.pogo.com/v/9.1.7.20/applet/poppit2/poppit2-en_US.cab
    DPF: Scrabble by pogo - hxxp://game3.pogo.com/v/9.1.7.22/applet/scrabble/scrabble-en_US.cab
    DPF: Showbiz Slots 2 by pogo - hxxp://game3.pogo.com/v/9.1.6.34/applet/slots/showbiz2-en_US.cab
    DPF: SockHop Slots by pogo - hxxp://game3.pogo.com/v/9.1.7.20/applet/showbiz3/showbiz3-en_US.cab
    DPF: Spades 2 by pogo - hxxp://game3.pogo.com/v/9.1.7.20/applet/spades2/spades2-en_US.cab
    DPF: Spider Solitaire by pogo - hxxp://game3.pogo.com/v/9.1.7.20/applet/spider/spider-en_US.cab
    DPF: Team Bingo by Pogo - hxxp://game3.pogo.com/v/9.1.7.20/applet/teambingo/teambingo-en_US.cab
    DPF: Thousand Island Solitaire by pogo - hxxp://game3.pogo.com/v/9.1.7.20/applet/millbrae/millbrae-en_US.cab
    DPF: Turbo 21 v2 by pogo - hxxp://game3.pogo.com/v/9.1.7.20/applet/turbo22/turbo22-en_US.cab
    DPF: Word Whomp Whackdown by pogo - hxxp://game3.pogo.com/v/9.1.7.20/applet/whackdown/whackdown-en_US.cab
    DPF: Yahtzee Party by pogo - hxxp://game3.pogo.com/v/9.1.7.20/applet/yahtzee/yahtzee-en_US.cab
    DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1238600905125
    DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1238600842687
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
    DPF: {8D83D301-E841-11D1-B155-00600823BCF9} - hxxps://www.sbcwebsupport.com/webline/applets/msie40x.cab
    DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
    DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab
    TCP: {7FA5B984-BABD-4062-8DEE-FECD06D8562B} = 209.244.0.3 209.244.0.4
    SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
    SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll

    ============= SERVICES / DRIVERS ===============

    R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2010-10-19 11608]
    R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2010-10-19 135336]
    R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2010-10-19 267432]
    R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2010-10-19 60936]
    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
    S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-8-31 136176]
    S3 USB-100;SMC Compact USB to Ethernet converter;c:\windows\system32\drivers\SMC2208.SYS [2005-9-15 27519]
    S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [2002-9-3 14336]
    S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]

    =============== Created Last 30 ================

    2010-10-19 14:35:13 -------- d-----w- c:\docume~1\daylen~1\applic~1\Avira
    2010-10-19 13:27:14 60936 ----a-w- c:\windows\system32\drivers\avgntflt.sys
    2010-10-19 13:27:09 -------- d-----w- c:\program files\Avira
    2010-10-18 21:42:50 -------- d-----w- c:\windows\system32\wbem\repository\FS
    2010-10-18 21:42:50 -------- d-----w- c:\windows\system32\wbem\Repository
    2010-10-18 21:41:57 -------- d-----w- c:\program files\Microsoft Security Essentials(2)
    2010-10-18 21:41:57 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware(2)
    2010-10-18 21:41:55 -------- d-----w- c:\program files\Glary Utilities
    2010-10-16 02:08:45 -------- d-----w- c:\program files\VS Revo Group
    2010-10-15 19:59:15 -------- d-----w- C:\RECYCLER(3)
    2010-10-15 19:56:20 -------- d-sh--w- C:\RECYCLER(2)
    2010-10-15 18:50:18 -------- d-----w- c:\docume~1\daylen~1\locals~1\applic~1\FixItCenter
    2010-10-15 18:29:33 -------- d-----w- c:\windows\MATS
    2010-10-15 18:29:28 -------- d-----w- c:\program files\Microsoft Fix it Center
    2010-10-15 16:57:30 -------- d-----w- c:\program files\Microsoft Security Essentials
    2010-10-14 12:12:37 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2010-10-14 12:11:49 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
    2010-10-14 12:11:47 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2010-10-10 12:28:18 -------- d-----w- c:\docume~1\daylen~1\applic~1\Malwarebytes
    2010-10-10 10:10:53 -------- d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes
    2010-09-29 18:58:20 -------- d-----w- c:\docume~1\daylen~1\applic~1\Windows Search
    2010-09-25 17:15:35 -------- d-----w- c:\windows\system32\winrm
    2010-09-25 17:15:27 -------- dc-h--w- c:\windows\$968930Uinstall_KB968930$
    2010-09-25 17:08:30 -------- d-----w- c:\docume~1\daylen~1\applic~1\Windows Desktop Search
    2010-09-25 17:06:46 -------- d-----w- c:\windows\system32\GroupPolicy
    2010-09-25 17:06:46 -------- d-----w- c:\program files\Windows Desktop Search
    2010-09-25 17:04:02 98304 -c----w- c:\windows\system32\dllcache\nlhtml.dll
    2010-09-25 17:04:02 29696 -c----w- c:\windows\system32\dllcache\mimefilt.dll
    2010-09-25 17:04:01 192000 -c----w- c:\windows\system32\dllcache\offfilt.dll
    2010-09-25 13:36:36 16896 -c----w- c:\windows\system32\dllcache\iecompat.dll

    ==================== Find3M ====================

    2010-10-10 08:31:26 22154 ----a-w- c:\windows\msvideo.dll
    2010-09-18 19:23:26 974848 ----a-w- c:\windows\system32\mfc42u.dll
    2010-09-18 06:53:25 974848 ----a-w- c:\windows\system32\mfc42.dll
    2010-09-18 06:53:25 954368 ----a-w- c:\windows\system32\mfc40.dll
    2010-09-18 06:53:25 953856 ----a-w- c:\windows\system32\mfc40u.dll
    2010-09-10 05:58:08 916480 ----a-w- c:\windows\system32\wininet.dll
    2010-09-10 05:58:06 43520 ----a-w- c:\windows\system32\licmgr10.dll
    2010-09-10 05:58:06 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
    2010-09-08 18:17:46 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
    2010-09-08 18:17:46 69632 ----a-w- c:\windows\system32\QuickTime.qts
    2010-09-01 11:51:14 285824 ----a-w- c:\windows\system32\atmfd.dll
    2010-08-31 13:42:52 1852800 ----a-w- c:\windows\system32\win32k.sys
    2010-08-27 08:02:29 119808 ----a-w- c:\windows\system32\t2embed.dll
    2010-08-27 05:57:43 99840 ----a-w- c:\windows\system32\srvsvc.dll
    2010-08-26 12:52:45 5120 ----a-w- c:\windows\system32\xpsp4res.dll
    2010-08-23 16:12:04 617472 ----a-w- c:\windows\system32\comctl32.dll
    2010-08-17 13:17:06 58880 ----a-w- c:\windows\system32\spoolsv.exe
    2010-08-16 08:45:00 590848 ----a-w- c:\windows\system32\rpcrt4.dll

    ============= FINISH: 5:51:46.28 ===============
     
  11. Broni

    Broni Malware Annihilator Posts: 52,890   +344

    Download MBRCheck to your desktop

    Double click MBRCheck.exe to run (Vista and Windows 7 users, right click and select Run as Administrator).
    It will show a black screen with some data on it.
    Enter N to exit.
    A report called MBRcheckxxxx.txt will be on your desktop
    Open this report and post its content in your next reply.

    ====================================================================

    Please download ComboFix from Here or Here to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    1. Please, never rename Combofix unless instructed.
    2. Close any open browsers.
    3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
      • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
      • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
      NOTE1. If Combofix asks you to install Recovery Console, please allow it.
      NOTE 2. If Combofix asks you to update the program, always do so.
      • Close any open browsers.
      • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
      • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
      • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
    4. Double click on combofix.exe & follow the prompts.
    5. When finished, it will produce a report for you.
    6. Please post the "C:\ComboFix.txt"
    **Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

    Make sure, you re-enable your security programs, when you're done with Combofix.

    DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
     
  12. LittleBigNDN

    LittleBigNDN TS Rookie Topic Starter Posts: 47

    MBRCheck, version 1.2.3
    (c) 2010, AD

    Command-line:
    Windows Version: Windows XP Home Edition
    Windows Information: Service Pack 3 (build 2600)
    Logical Drives Mask: 0x0000001d

    Kernel Drivers (total 119):
    0x804D7000 \WINDOWS\system32\ntoskrnl.exe
    0x806EE000 \WINDOWS\system32\hal.dll
    0xF9F32000 \WINDOWS\system32\KDCOM.DLL
    0xF9E42000 \WINDOWS\system32\BOOTVID.dll
    0xF99E3000 ACPI.sys
    0xF9F34000 \WINDOWS\System32\DRIVERS\WMILIB.SYS
    0xF99D2000 pci.sys
    0xF9A32000 isapnp.sys
    0xF9FFA000 PCIIde.sys
    0xF9CB2000 \WINDOWS\System32\Drivers\PCIIDEX.SYS
    0xF9F36000 intelide.sys
    0xF9A42000 MountMgr.sys
    0xF99B3000 ftdisk.sys
    0xF9CBA000 PartMgr.sys
    0xF9A52000 VolSnap.sys
    0xF999B000 atapi.sys
    0xF9A62000 disk.sys
    0xF9A72000 \WINDOWS\System32\DRIVERS\CLASSPNP.SYS
    0xF997B000 fltmgr.sys
    0xF9969000 sr.sys
    0xF9952000 KSecDD.sys
    0xF993F000 WudfPf.sys
    0xF98B2000 Ntfs.sys
    0xF9885000 NDIS.sys
    0xF986B000 Mup.sys
    0xF9853000 IPVNMon.sys
    0xF9A82000 agp440.sys
    0xF9C52000 \SystemRoot\System32\DRIVERS\intelppm.sys
    0xF9431000 \SystemRoot\System32\DRIVERS\nv4_mini.sys
    0xF941D000 \SystemRoot\System32\DRIVERS\VIDEOPRT.SYS
    0xF9D82000 \SystemRoot\System32\DRIVERS\usbuhci.sys
    0xF93F9000 \SystemRoot\System32\DRIVERS\USBPORT.SYS
    0xF9D8A000 \SystemRoot\System32\DRIVERS\usbehci.sys
    0xF92B4000 \SystemRoot\system32\drivers\P16X.sys
    0xF9291000 \SystemRoot\system32\drivers\ks.sys
    0xF926D000 \SystemRoot\system32\drivers\portcls.sys
    0xF9C62000 \SystemRoot\system32\drivers\drmk.sys
    0xF9241000 \SystemRoot\system32\DRIVERS\ctoss2k.sys
    0xF9221000 \SystemRoot\system32\DRIVERS\ctsfm2k.sys
    0xF9802000 \SystemRoot\system32\DRIVERS\gameenum.sys
    0xF9104000 \SystemRoot\System32\DRIVERS\AGRSM.sys
    0xF9F70000 \SystemRoot\System32\DRIVERS\USBD.SYS
    0xF9D92000 \SystemRoot\System32\Drivers\Modem.SYS
    0xF90E1000 \SystemRoot\system32\DRIVERS\e100b325.sys
    0xF9D9A000 \SystemRoot\System32\DRIVERS\fdc.sys
    0xF9C72000 \SystemRoot\System32\DRIVERS\i8042prt.sys
    0xF9DA2000 \SystemRoot\System32\DRIVERS\kbdclass.sys
    0xF9DAA000 \SystemRoot\System32\DRIVERS\mouclass.sys
    0xF9C82000 \SystemRoot\System32\DRIVERS\serial.sys
    0xF9625000 \SystemRoot\System32\DRIVERS\serenum.sys
    0xF90CD000 \SystemRoot\System32\DRIVERS\parport.sys
    0xF9DB2000 \SystemRoot\system32\drivers\Afc.sys
    0xF9C92000 \SystemRoot\System32\DRIVERS\cdrom.sys
    0xF9CA2000 \SystemRoot\System32\DRIVERS\redbook.sys
    0xF9AA2000 \SystemRoot\System32\Drivers\GEARAspiWDM.sys
    0xF9B52000 \SystemRoot\System32\DRIVERS\imapi.sys
    0xFA115000 \SystemRoot\System32\DRIVERS\audstub.sys
    0xF9B62000 \SystemRoot\System32\DRIVERS\rasl2tp.sys
    0xF960D000 \SystemRoot\System32\DRIVERS\ndistapi.sys
    0xF8D62000 \SystemRoot\System32\DRIVERS\ndiswan.sys
    0xF9B72000 \SystemRoot\System32\DRIVERS\raspppoe.sys
    0xF9B82000 \SystemRoot\System32\DRIVERS\raspptp.sys
    0xF9DFA000 \SystemRoot\System32\DRIVERS\TDI.SYS
    0xF8D51000 \SystemRoot\System32\DRIVERS\psched.sys
    0xF9B92000 \SystemRoot\System32\DRIVERS\msgpc.sys
    0xF9E02000 \SystemRoot\System32\DRIVERS\ptilink.sys
    0xF9E0A000 \SystemRoot\System32\DRIVERS\raspti.sys
    0xF9BA2000 \SystemRoot\System32\DRIVERS\termdd.sys
    0xF9F84000 \SystemRoot\System32\DRIVERS\swenum.sys
    0xF8CF3000 \SystemRoot\System32\DRIVERS\update.sys
    0xF9605000 \SystemRoot\System32\DRIVERS\mssmbios.sys
    0xF9BC2000 \SystemRoot\System32\Drivers\NDProxy.SYS
    0xF9C12000 \SystemRoot\System32\DRIVERS\usbhub.sys
    0xF9F1A000 \SystemRoot\system32\drivers\MODEMCSA.sys
    0xF9D2A000 \SystemRoot\System32\DRIVERS\flpydisk.sys
    0xF9FBC000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
    0xFA085000 \SystemRoot\System32\Drivers\Null.SYS
    0xF9FBE000 \SystemRoot\System32\Drivers\Beep.SYS
    0xF9CEA000 \SystemRoot\System32\DRIVERS\HIDPARSE.SYS
    0xF9D3A000 \SystemRoot\System32\drivers\vga.sys
    0xF9FC0000 \SystemRoot\System32\Drivers\mnmdd.SYS
    0xF9FC2000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
    0xF9D42000 \SystemRoot\System32\Drivers\Msfs.SYS
    0xF9D4A000 \SystemRoot\System32\Drivers\Npfs.SYS
    0xF581B000 \SystemRoot\System32\DRIVERS\rasacd.sys
    0xF4521000 \SystemRoot\System32\DRIVERS\ipsec.sys
    0xF44C8000 \SystemRoot\System32\DRIVERS\tcpip.sys
    0xF44A0000 \SystemRoot\System32\DRIVERS\netbt.sys
    0xF447E000 \SystemRoot\System32\drivers\afd.sys
    0xF8F99000 \SystemRoot\System32\DRIVERS\netbios.sys
    0xF9D52000 \SystemRoot\system32\DRIVERS\ssmdrv.sys
    0xF4453000 \SystemRoot\System32\DRIVERS\rdbss.sys
    0xF43BB000 \SystemRoot\System32\DRIVERS\mrxsmb.sys
    0xF57E7000 \SystemRoot\System32\Drivers\Fips.SYS
    0xF4395000 \SystemRoot\System32\DRIVERS\ipnat.sys
    0xF57D7000 \SystemRoot\System32\DRIVERS\wanarp.sys
    0xF41E6000 \SystemRoot\system32\DRIVERS\avipbb.sys
    0xF9FD0000 \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys
    0xF0D21000 \SystemRoot\System32\Drivers\Cdfs.SYS
    0xBF800000 \SystemRoot\System32\win32k.sys
    0xF444B000 \SystemRoot\System32\drivers\Dxapi.sys
    0xF9D12000 \SystemRoot\System32\watchdog.sys
    0xBF000000 \SystemRoot\System32\drivers\dxg.sys
    0xFA17F000 \SystemRoot\System32\drivers\dxgthk.sys
    0xBF012000 \SystemRoot\System32\nv4_disp.dll
    0xBFFA0000 \SystemRoot\System32\ATMFD.DLL
    0xF0840000 \SystemRoot\system32\DRIVERS\avgntflt.sys
    0xF4437000 \SystemRoot\System32\DRIVERS\ndisuio.sys
    0xF0723000 \SystemRoot\System32\DRIVERS\mrxdav.sys
    0xF06D7000 \SystemRoot\System32\Drivers\Fastfat.SYS
    0xF06C2000 \SystemRoot\system32\drivers\wdmaud.sys
    0xF8FE9000 \SystemRoot\system32\drivers\sysaudio.sys
    0xF9F6A000 \SystemRoot\System32\Drivers\ParVdm.SYS
    0xF044B000 \SystemRoot\System32\Drivers\HTTP.sys
    0xF0303000 \SystemRoot\System32\DRIVERS\srv.sys
    0xF035B000 \??\C:\WINDOWS\system32\drivers\PfModNT.sys
    0xF0167000 \SystemRoot\System32\DRIVERS\asyncmac.sys
    0xEF204000 \SystemRoot\system32\drivers\kmixer.sys
    0x7C900000 \WINDOWS\system32\ntdll.dll

    Processes (total 40):
    0 System Idle Process
    4 System
    2024 C:\WINDOWS\system32\smss.exe
    564 csrss.exe
    592 C:\WINDOWS\system32\winlogon.exe
    656 C:\WINDOWS\system32\services.exe
    668 C:\WINDOWS\system32\lsass.exe
    856 C:\WINDOWS\system32\svchost.exe
    972 svchost.exe
    1036 C:\WINDOWS\system32\svchost.exe
    1136 C:\WINDOWS\system32\svchost.exe
    1348 C:\WINDOWS\explorer.exe
    1416 svchost.exe
    1608 C:\WINDOWS\system32\LEXBCES.EXE
    1636 C:\WINDOWS\system32\spoolsv.exe
    1648 C:\WINDOWS\system32\LEXPPS.EXE
    1736 C:\Program Files\Avira\AntiVir Desktop\sched.exe
    1792 svchost.exe
    1932 C:\WINDOWS\system32\netdde.exe
    204 C:\Program Files\LSI SoftModem\agrsmsvc.exe
    232 C:\Program Files\Avira\AntiVir Desktop\avguard.exe
    416 C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
    524 C:\WINDOWS\system32\svchost.exe
    556 C:\Program Files\Java\jre6\bin\jqs.exe
    1368 C:\WINDOWS\AGRSMMSG.exe
    1428 C:\Program Files\SweetIM\Messenger\SweetIM.exe
    1436 C:\Program Files\Common Files\Java\Java Update\jusched.exe
    1452 C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
    1476 C:\WINDOWS\system32\ctfmon.exe
    1680 C:\Program Files\Windows Media Player\wmpnscfg.exe
    436 C:\WINDOWS\system32\svchost.exe
    2240 C:\WINDOWS\system32\searchindexer.exe
    2812 wmpnetwk.exe
    2752 alg.exe
    1204 C:\Program Files\Internet Explorer\iexplore.exe
    2412 C:\Program Files\Internet Explorer\iexplore.exe
    540 C:\Program Files\Yahoo!\Companion\att\ToolbarSvr.exe
    3200 C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
    2616 C:\PROGRA~1\Yahoo!\browser\ycommon.exe
    2700 C:\Documents and Settings\Daylene Croy\Desktop\MBRCheck.exe

    \\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`01f60800 (NTFS)

    PhysicalDrive0 Model Number: WDCWD600BB-75CAA0, Rev: 16.06V16

    Size Device Name MBR Status
    --------------------------------------------
    55 GB \\.\PhysicalDrive0 Windows XP MBR code detected
    SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A


    Done!
     
  13. Broni

    Broni Malware Annihilator Posts: 52,890   +344

    Looks good :)
     
  14. LittleBigNDN

    LittleBigNDN TS Rookie Topic Starter Posts: 47

    How to do I disable the Malwarebytes anti-malware if you would please let me know thank you again for all your help
     
  15. Broni

    Broni Malware Annihilator Posts: 52,890   +344

    If you have a free version, there is nothing to disable. It's not active in real time.
     
  16. LittleBigNDN

    LittleBigNDN TS Rookie Topic Starter Posts: 47

    Ok thank you also im going to start running the combofix program
     
  17. Broni

    Broni Malware Annihilator Posts: 52,890   +344

    Sure thing :)
     
  18. LittleBigNDN

    LittleBigNDN TS Rookie Topic Starter Posts: 47

    ComboFix 10-10-23.02 - Daylene Croy 10/24/2010 18:43:58.1.1 - x86
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.255.109 [GMT -7:00]
    Running from: c:\documents and settings\Daylene Croy\Desktop\ComboFix.exe
    AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\windows\system32\Data

    .
    ((((((((((((((((((((((((( Files Created from 2010-09-25 to 2010-10-25 )))))))))))))))))))))))))))))))
    .

    2010-10-19 14:35 . 2010-10-19 14:35 -------- d-----w- c:\documents and settings\Daylene Croy\Application Data\Avira
    2010-10-19 13:27 . 2010-03-01 17:05 124784 ----a-w- c:\windows\system32\drivers\avipbb.sys
    2010-10-19 13:27 . 2010-02-16 21:24 60936 ----a-w- c:\windows\system32\drivers\avgntflt.sys
    2010-10-19 13:27 . 2009-05-11 19:49 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
    2010-10-19 13:27 . 2009-05-11 19:49 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
    2010-10-19 13:27 . 2010-10-19 13:27 -------- d-----w- c:\program files\Avira
    2010-10-18 21:42 . 2010-10-18 21:42 -------- d-----w- c:\windows\system32\wbem\Repository
    2010-10-18 21:41 . 2010-10-19 00:04 -------- d-----w- c:\program files\QuickTime
    2010-10-18 21:41 . 2010-10-18 21:41 -------- d-----w- c:\program files\Glary Utilities
    2010-10-18 21:41 . 2010-10-18 21:41 -------- d-----w- c:\program files\Microsoft Silverlight
    2010-10-16 02:08 . 2010-10-16 02:08 -------- d-----w- c:\program files\VS Revo Group
    2010-10-15 19:59 . 2010-10-18 21:41 -------- d-----w- C:\RECYCLER(3)
    2010-10-15 19:56 . 2010-10-18 21:41 -------- d-----w- C:\RECYCLER(2)
    2010-10-15 18:50 . 2010-10-15 18:50 -------- d-----w- c:\documents and settings\Daylene Croy\Local Settings\Application Data\FixItCenter
    2010-10-15 18:29 . 2010-10-18 21:42 -------- d-----w- c:\windows\MATS
    2010-10-15 18:29 . 2010-10-18 21:42 -------- d-----w- c:\program files\Microsoft Fix it Center
    2010-10-15 16:57 . 2010-10-18 21:42 -------- d-----w- c:\program files\Microsoft Security Essentials
    2010-10-14 12:12 . 2010-04-29 22:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2010-10-14 12:11 . 2010-04-29 22:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
    2010-10-14 12:11 . 2010-10-14 12:13 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2010-10-14 09:50 . 2010-10-14 09:50 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
    2010-10-14 01:36 . 2010-10-14 01:36 -------- d-----w- c:\documents and settings\Administrator\IETldCache
    2010-10-13 15:35 . 2010-10-13 15:35 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\PCHealth
    2010-10-10 12:28 . 2010-10-10 12:28 -------- d-----w- c:\documents and settings\Daylene Croy\Application Data\Malwarebytes
    2010-10-10 10:10 . 2010-10-10 10:10 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
    2010-09-29 18:58 . 2010-09-29 18:58 -------- d-----w- c:\documents and settings\Daylene Croy\Application Data\Windows Search
    2010-09-25 17:33 . 2010-09-25 17:33 -------- d-----w- c:\program files\Microsoft.NET
    2010-09-25 17:15 . 2010-09-25 17:15 -------- d-----w- c:\windows\system32\winrm
    2010-09-25 17:15 . 2010-09-25 17:15 -------- dc-h--w- c:\windows\$968930Uinstall_KB968930$
    2010-09-25 17:09 . 2010-09-25 17:09 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
    2010-09-25 17:08 . 2010-09-25 17:08 -------- d-----w- c:\documents and settings\Daylene Croy\Application Data\Windows Desktop Search
    2010-09-25 17:06 . 2010-09-26 06:10 -------- d-----w- c:\program files\Windows Desktop Search
    2010-09-25 17:06 . 2010-09-25 17:06 -------- d-----w- c:\windows\system32\GroupPolicy
    2010-09-25 17:04 . 2008-03-07 17:02 98304 -c----w- c:\windows\system32\dllcache\nlhtml.dll
    2010-09-25 17:04 . 2008-03-07 17:02 29696 -c----w- c:\windows\system32\dllcache\mimefilt.dll
    2010-09-25 17:04 . 2008-03-07 17:02 192000 -c----w- c:\windows\system32\dllcache\offfilt.dll
    2010-09-25 13:36 . 2010-06-18 11:39 16896 -c----w- c:\windows\system32\dllcache\iecompat.dll

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2010-10-10 08:31 . 2002-09-03 16:49 22154 ----a-w- c:\windows\msvideo.dll
    2010-09-18 19:23 . 2002-09-03 16:41 974848 ----a-w- c:\windows\system32\mfc42u.dll
    2010-09-18 06:53 . 2002-09-03 16:41 974848 ----a-w- c:\windows\system32\mfc42.dll
    2010-09-18 06:53 . 2002-09-03 16:41 954368 ----a-w- c:\windows\system32\mfc40.dll
    2010-09-18 06:53 . 2002-09-03 16:41 953856 ----a-w- c:\windows\system32\mfc40u.dll
    2010-09-15 11:50 . 2010-08-27 09:40 472808 ----a-w- c:\windows\system32\deployJava1.dll
    2010-09-15 09:29 . 2009-01-04 03:30 73728 ----a-w- c:\windows\system32\javacpl.cpl
    2010-09-10 05:58 . 2002-09-03 17:12 916480 ----a-w- c:\windows\system32\wininet.dll
    2010-09-10 05:58 . 2002-09-03 16:39 43520 ----a-w- c:\windows\system32\licmgr10.dll
    2010-09-10 05:58 . 2002-09-03 16:35 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
    2010-09-08 18:17 . 2010-09-08 18:17 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
    2010-09-08 18:17 . 2010-09-08 18:17 69632 ----a-w- c:\windows\system32\QuickTime.qts
    2010-09-01 11:51 . 2002-09-03 16:27 285824 ----a-w- c:\windows\system32\atmfd.dll
    2010-08-31 13:42 . 2002-09-03 17:11 1852800 ----a-w- c:\windows\system32\win32k.sys
    2010-08-27 08:02 . 2002-09-03 17:06 119808 ----a-w- c:\windows\system32\t2embed.dll
    2010-08-27 05:57 . 2002-09-03 17:04 99840 ----a-w- c:\windows\system32\srvsvc.dll
    2010-08-26 13:39 . 2002-09-03 17:04 357248 ----a-w- c:\windows\system32\drivers\srv.sys
    2010-08-26 12:52 . 2009-04-18 04:32 5120 ----a-w- c:\windows\system32\xpsp4res.dll
    2010-08-23 16:12 . 2002-09-03 16:29 617472 ----a-w- c:\windows\system32\comctl32.dll
    2010-08-17 13:17 . 2002-09-03 17:04 58880 ----a-w- c:\windows\system32\spoolsv.exe
    2010-08-16 08:45 . 2002-09-03 16:56 590848 ----a-w- c:\windows\system32\rpcrt4.dll
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
    "{EEE6C35D-6118-11DC-9C72-001320C79847}"= "c:\program files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll" [2009-05-20 177464]

    [HKEY_CLASSES_ROOT\clsid\{eee6c35d-6118-11dc-9c72-001320c79847}]
    [HKEY_CLASSES_ROOT\SweetIM_URLSearchHook.ToolbarURLSearchHook.1]
    [HKEY_CLASSES_ROOT\TypeLib\{EEE6C35F-6118-11DC-9C72-001320C79847}]
    [HKEY_CLASSES_ROOT\SweetIM_URLSearchHook.ToolbarURLSearchHook]

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}]
    2009-05-20 21:36 1258808 ----a-w- c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    "{EEE6C35B-6118-11DC-9C72-001320C79847}"= "c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll" [2009-05-20 1258808]

    [HKEY_CLASSES_ROOT\clsid\{eee6c35b-6118-11dc-9c72-001320c79847}]
    [HKEY_CLASSES_ROOT\SWEETIE.IEToolbar.1]
    [HKEY_CLASSES_ROOT\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}]
    [HKEY_CLASSES_ROOT\SWEETIE.IEToolbar]

    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
    "{EEE6C35B-6118-11DC-9C72-001320C79847}"= "c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll" [2009-05-20 1258808]

    [HKEY_CLASSES_ROOT\clsid\{eee6c35b-6118-11dc-9c72-001320c79847}]
    [HKEY_CLASSES_ROOT\SWEETIE.IEToolbar.1]
    [HKEY_CLASSES_ROOT\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}]
    [HKEY_CLASSES_ROOT\SWEETIE.IEToolbar]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-19 204288]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]
    "IPInSightMonitor 01"="c:\program files\SBC Yahoo!\Connection Manager\IP InSight\IPMon32.exe" [2003-07-14 98304]
    "AGRSMMSG"="AGRSMMSG.exe" [2004-10-08 88363]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
    "SweetIM"="c:\program files\SweetIM\Messenger\SweetIM.exe" [2009-05-20 111928]
    "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
    "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-09-08 421888]
    "avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-03-02 282792]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]

    c:\documents and settings\Daylene Croy\Start Menu\Programs\Startup\
    LimeWire On Startup.lnk - c:\program files\LimeWire\LimeWire.exe [2010-9-30 503808]

    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]

    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
    "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]
    "QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\PROGRA~1\\Yahoo!\\MESSEN~1\\yserver.exe"=
    "c:\\Program Files\\Messenger\\msmsgs.exe"=
    "c:\\WINDOWS\\system32\\LEXPPS.EXE"=
    "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\Program Files\\LimeWire\\LimeWire.exe"=
    "c:\\Program Files\\iTunes\\iTunes.exe"=
    "c:\\WINDOWS\\system32\\mmc.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "c:\\Program Files\\Google\\Google Earth\\client\\googleearth.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management

    R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
    R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-09-01 136176]
    R3 USB-100;SMC Compact USB to Ethernet converter;c:\windows\system32\DRIVERS\SMC2208.SYS [2001-09-25 27519]
    R3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe [2008-04-14 14336]
    R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
    S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2010-02-24 135336]


    --- Other Services/Drivers In Memory ---

    *Deregistered* - IPVNMon

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    WINRM REG_MULTI_SZ WINRM
    .
    Contents of the 'Scheduled Tasks' folder

    2010-10-24 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2010-09-01 00:19]

    2010-10-25 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2010-09-01 00:19]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://att.yahoo.com/
    uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
    mSearch Bar = hxxp://www.yahoo.com/ext/search/search.html
    uSearchAssistant = hxxp://www.google.com/ie
    uSearchURL,(Default) = hxxp://search.yahoo.com
    IE: &Yahoo! Search - file:///c:\program files\Yahoo!\Common/ycsrch.htm
    IE: Yahoo! &Dictionary - file:///c:\program files\Yahoo!\Common/ycdict.htm
    IE: Yahoo! &Maps - file:///c:\program files\Yahoo!\Common/ycmap.htm
    IE: Yahoo! &SMS - file:///c:\program files\Yahoo!\Common/ycsms.htm
    Trusted Zone: marlboro.com\www
    TCP: {7FA5B984-BABD-4062-8DEE-FECD06D8562B} = 209.244.0.3 209.244.0.4
    DPF: Bingo Luau by pogo - hxxp://game3.pogo.com/v/9.1.7.20/applet/freebingo/freebingo-en_US.cab
    DPF: Blackjack Carnival by pogo - hxxp://game3.pogo.com/v/9.1.7.20/applet/vbjack2/vbjack2-en_US.cab
    DPF: Bowling by pogo - hxxp://game3.pogo.com/v/9.1.7.20/applet/bowling/bowling-en_US.cab
    DPF: Cribbage by pogo - hxxp://game3.pogo.com/v/9.1.6.34/applet/cribbage/cribbage-en_US.cab
    DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
    DPF: First Class Solitaire by pogo - hxxp://game3.pogo.com/v/9.1.7.20/applet/firstclass2/firstclass2-en_US.cab
    DPF: Greenback Bayou by pogo - hxxp://game3.pogo.com/v/9.1.6.34/applet/greenback/greenback-en_US.cab
    DPF: Hog Heaven Slots by pogo - hxxp://game3.pogo.com/v/9.1.7.20/applet/fancy/fancy-en_US.cab
    DPF: Lottso by pogo - hxxp://game3.pogo.com/v/9.1.7.20/applet/lottso/lottso-en_US.cab
    DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
    DPF: Payday Freecell Solitaire by pogo - hxxp://game3.pogo.com/v/9.1.7.20/applet/freecell2/freecell2-en_US.cab
    DPF: Phlinx by pogo - hxxp://game3.pogo.com/v/9.1.7.20/applet/flinger/flinger-en_US.cab
    DPF: Pinochle by pogo - hxxp://game3.pogo.com/v/9.1.7.22/applet/pinochle/pinochle-en_US.cab
    DPF: Poppit by pogo - hxxp://game3.pogo.com/v/9.1.7.20/applet/poppit2/poppit2-en_US.cab
    DPF: Scrabble by pogo - hxxp://game3.pogo.com/v/9.1.7.22/applet/scrabble/scrabble-en_US.cab
    DPF: Showbiz Slots 2 by pogo - hxxp://game3.pogo.com/v/9.1.6.34/applet/slots/showbiz2-en_US.cab
    DPF: SockHop Slots by pogo - hxxp://game3.pogo.com/v/9.1.7.20/applet/showbiz3/showbiz3-en_US.cab
    DPF: Spades 2 by pogo - hxxp://game3.pogo.com/v/9.1.7.20/applet/spades2/spades2-en_US.cab
    DPF: Spider Solitaire by pogo - hxxp://game3.pogo.com/v/9.1.7.20/applet/spider/spider-en_US.cab
    DPF: Team Bingo by Pogo - hxxp://game3.pogo.com/v/9.1.7.20/applet/teambingo/teambingo-en_US.cab
    DPF: Thousand Island Solitaire by pogo - hxxp://game3.pogo.com/v/9.1.7.20/applet/millbrae/millbrae-en_US.cab
    DPF: Turbo 21 v2 by pogo - hxxp://game3.pogo.com/v/9.1.7.20/applet/turbo22/turbo22-en_US.cab
    DPF: Word Whomp Whackdown by pogo - hxxp://game3.pogo.com/v/9.1.7.20/applet/whackdown/whackdown-en_US.cab
    DPF: Yahtzee Party by pogo - hxxp://game3.pogo.com/v/9.1.7.20/applet/yahtzee/yahtzee-en_US.cab
    .
    - - - - ORPHANS REMOVED - - - -

    WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
    HKCU-Run-msnmsgr - ~c:\program files\Windows Live\Messenger\msnmsgr.exe
    AddRemove-LSI Soft Modem - c:\windows\agrsmdel



    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2010-10-24 18:58
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    HKCU\Software\Microsoft\Windows\CurrentVersion\Run
    msnmsgr = ~"c:\program files\Windows Live\Messenger\msnmsgr.exe" /background?

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
    @Denied: (A 2) (Everyone)
    @="FlashBroker"
    "LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101"

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
    "Enabled"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
    @="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe"

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
    @Denied: (A 2) (Everyone)
    @="IFlashBroker4"

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
    @="{00020424-0000-0000-C000-000000000046}"

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
    "Version"="1.0"
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'explorer.exe'(2748)
    c:\windows\system32\WININET.dll
    c:\windows\system32\ieframe.dll
    c:\windows\system32\webcheck.dll
    c:\windows\system32\WPDShServiceObj.dll
    c:\windows\system32\PortableDeviceTypes.dll
    c:\windows\system32\PortableDeviceApi.dll
    .
    Completion time: 2010-10-24 19:06:24
    ComboFix-quarantined-files.txt 2010-10-25 02:06

    Pre-Run: 39,040,114,688 bytes free
    Post-Run: 39,023,349,760 bytes free

    WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
    [boot loader]
    timeout=2
    default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
    [operating systems]
    c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
    UnsupportedDebug="do not select this" /debug
    multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn

    - - End Of File - - F18EED6E41856F3F284F8469DD8A500F
     
  19. Broni

    Broni Malware Annihilator Posts: 52,890   +344

    That looks good as well....

    Download OTL to your Desktop.

    • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
    • Under the Custom Scan box paste this in:


    netsvcs
    drivers32
    %SYSTEMDRIVE%\*.*
    %systemroot%\Fonts\*.com
    %systemroot%\Fonts\*.dll
    %systemroot%\Fonts\*.ini
    %systemroot%\Fonts\*.ini2
    %systemroot%\Fonts\*.exe
    %systemroot%\system32\spool\prtprocs\w32x86\*.*
    %systemroot%\REPAIR\*.bak1
    %systemroot%\REPAIR\*.ini
    %systemroot%\system32\*.jpg
    %systemroot%\*.jpg
    %systemroot%\*.png
    %systemroot%\*.scr
    %systemroot%\*._sy
    %APPDATA%\Adobe\Update\*.*
    %ALLUSERSPROFILE%\Favorites\*.*
    %APPDATA%\Microsoft\*.*
    %PROGRAMFILES%\*.*
    %APPDATA%\Update\*.*
    %systemroot%\*. /mp /s
    CREATERESTOREPOINT
    %systemroot%\System32\config\*.sav
    %PROGRAMFILES%\bak. /s
    %systemroot%\system32\bak. /s
    %ALLUSERSPROFILE%\Start Menu\*.lnk /x
    %systemroot%\system32\config\systemprofile\*.dat /x
    %systemroot%\*.config
    %systemroot%\system32\*.db
    %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
    %USERPROFILE%\Desktop\*.exe
    %PROGRAMFILES%\Common Files\*.*
    %systemroot%\*.src
    %systemroot%\install\*.*
    %systemroot%\system32\DLL\*.*
    %systemroot%\system32\HelpFiles\*.*
    %systemroot%\system32\rundll\*.*
    %systemroot%\winn32\*.*
    %systemroot%\Java\*.*
    %systemroot%\system32\test\*.*
    %systemroot%\system32\Rundll32\*.*
    %systemroot%\AppPatch\Custom\*.*
    %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x
    %PROGRAMFILES%\PC-Doctor\Downloads\*.*
    %PROGRAMFILES%\Internet Explorer\*.tmp
    %PROGRAMFILES%\Internet Explorer\*.dat
    %USERPROFILE%\My Documents\*.exe
    %USERPROFILE%\*.exe
    %systemroot%\ADDINS\*.*
    %systemroot%\assembly\*.bak2
    %systemroot%\Config\*.*
    %systemroot%\REPAIR\*.bak2
    %systemroot%\SECURITY\Database\*.sdb /x
    %systemroot%\SYSTEM\*.bak2
    %systemroot%\Web\*.bak2
    %systemroot%\Driver Cache\*.*
    %PROGRAMFILES%\Mozilla Firefox\0*.exe
    %ProgramFiles%\Microsoft Common\*.*
    %ProgramFiles%\TinyProxy.
    %USERPROFILE%\Favorites\*.url /x
    %systemroot%\system32\*.bk
    %systemroot%\*.te
    %systemroot%\system32\system32\*.*
    %ALLUSERSPROFILE%\*.dat /x
    %systemroot%\system32\drivers\*.rmv
    dir /b "%systemroot%\system32\*.exe" | find /i " " /c
    dir /b "%systemroot%\*.exe" | find /i " " /c
    %PROGRAMFILES%\Microsoft\*.*
    %systemroot%\System32\Wbem\proquota.exe
    %PROGRAMFILES%\Mozilla Firefox\*.dat
    %USERPROFILE%\Cookies\*.txt /x
    %SystemRoot%\system32\fonts\*.*
    %systemroot%\system32\winlog\*.*
    %systemroot%\system32\Language\*.*
    %systemroot%\system32\Settings\*.*
    %systemroot%\system32\*.quo
    %SYSTEMROOT%\AppPatch\*.exe
    %SYSTEMROOT%\inf\*.exe
    %SYSTEMROOT%\Installer\*.exe
    %systemroot%\system32\config\*.bak2
    %systemroot%\system32\Computers\*.*
    %SystemRoot%\system32\Sound\*.*
    %SystemRoot%\system32\SpecialImg\*.*
    %SystemRoot%\system32\code\*.*
    %SystemRoot%\system32\draft\*.*
    %SystemRoot%\system32\MSSSys\*.*
    %ProgramFiles%\Javascript\*.*
    %systemroot%\pchealth\helpctr\System\*.exe /s
    %systemroot%\Web\*.exe
    %systemroot%\system32\msn\*.*
    %systemroot%\system32\*.tro
    %AppData%\Microsoft\Installer\msupdates\*.*
    %ProgramFiles%\Messenger\*.*
    %systemroot%\system32\systhem32\*.*
    %systemroot%\system\*.exe
    HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
    /md5start
    /md5stop


    • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
    • When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
    • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.
     
  20. LittleBigNDN

    LittleBigNDN TS Rookie Topic Starter Posts: 47

    with all theses logs and this combofix on my desktop is it ok if i remove them or do i keep them cuz the DDS program and the GMER program and there was one more you had me put on my desktop anyways there no longer on desktop
     
  21. Broni

    Broni Malware Annihilator Posts: 52,890   +344

    Don't do anything else, than I tell you to do.
    Everything has to be done in certain order.
     
  22. LittleBigNDN

    LittleBigNDN TS Rookie Topic Starter Posts: 47

    OTL logfile created on: 10/24/2010 7:33:08 PM - Run 1
    OTL by OldTimer - Version 3.2.17.1 Folder = C:\Documents and Settings\Daylene Croy\Desktop
    Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
    Internet Explorer (Version = 8.0.6001.18702)
    Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

    255.00 Mb Total Physical Memory | 77.00 Mb Available Physical Memory | 30.00% Memory free
    618.00 Mb Paging File | 240.00 Mb Available in Paging File | 39.00% Paging File free
    Paging file location(s): C:\pagefile.sys 384 768 [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
    Drive C: | 55.84 Gb Total Space | 36.36 Gb Free Space | 65.12% Space Free | Partition Type: NTFS

    Computer Name: ELDA-PZICIO1813 | User Name: Daylene Croy | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: Current user
    Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

    ========== Processes (SafeList) ==========

    PRC - [2010/10/24 19:30:48 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Daylene Croy\Desktop\OTL.exe
    PRC - [2010/04/01 13:33:19 | 000,267,432 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe
    PRC - [2010/03/02 11:28:31 | 000,282,792 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
    PRC - [2010/02/24 10:28:09 | 000,135,336 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe
    PRC - [2010/01/14 22:11:00 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
    PRC - [2009/05/20 15:11:40 | 000,111,928 | R--- | M] (SweetIM Technologies Ltd.) -- C:\Program Files\SweetIM\Messenger\SweetIM.exe
    PRC - [2009/03/27 22:10:56 | 000,014,336 | ---- | M] (LSI Corporation) -- C:\Program Files\LSI SoftModem\agrsmsvc.exe
    PRC - [2008/11/09 13:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
    PRC - [2008/04/13 17:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
    PRC - [2006/03/03 13:18:10 | 000,200,704 | ---- | M] (Yahoo!, Inc.) -- C:\Program Files\Yahoo!\browser\ycommon.exe


    ========== Modules (SafeList) ==========

    MOD - [2010/10/24 19:30:48 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Daylene Croy\Desktop\OTL.exe
    MOD - [2010/08/23 09:12:02 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll


    ========== Win32 Services (SafeList) ==========

    SRV - File not found [On_Demand | Stopped] -- C:\WINDOWS\System32\appmgmts.dll -- (AppMgmt)
    SRV - [2010/04/01 13:33:19 | 000,267,432 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
    SRV - [2010/03/18 16:47:22 | 000,035,160 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe -- (aspnet_state)
    SRV - [2010/03/18 13:16:28 | 000,753,504 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe -- (WPFFontCache_v0400)
    SRV - [2010/03/18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
    SRV - [2010/03/18 13:16:28 | 000,124,240 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe -- (NetTcpPortSharing)
    SRV - [2010/02/24 10:28:09 | 000,135,336 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
    SRV - [2009/03/27 22:10:56 | 000,014,336 | ---- | M] (LSI Corporation) [Auto | Running] -- C:\Program Files\LSI SoftModem\agrsmsvc.exe -- (AgereModemAudio)
    SRV - [2008/11/09 13:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) [On_Demand | Running] -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService)
    SRV - [2003/05/19 16:07:38 | 000,086,016 | ---- | M] (Yahoo! Inc.) [On_Demand | Stopped] -- C:\WINDOWS\system32\YPcservice.exe -- (YPCService)


    ========== Driver Services (SafeList) ==========

    DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\Drivers\usbaapl.sys -- (USBAAPL)
    DRV - [2010/03/01 10:05:24 | 000,124,784 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
    DRV - [2010/02/16 14:24:01 | 000,060,936 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)
    DRV - [2009/08/13 15:07:12 | 001,163,328 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AGRSM.sys -- (AgereSoftModem)
    DRV - [2009/05/11 12:49:19 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Program Files\Avira\AntiVir Desktop\avgio.sys -- (avgio)
    DRV - [2009/05/11 10:12:49 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
    DRV - [2008/04/13 11:45:29 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\gameenum.sys -- (gameenum)
    DRV - [2005/02/23 14:58:56 | 000,011,776 | ---- | M] (Arcsoft, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\afc.sys -- (Afc)
    DRV - [2004/08/03 22:29:56 | 001,897,408 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv)
    DRV - [2003/09/22 12:43:06 | 001,330,048 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\P16X.sys -- (P16X) Creative SB Live! Series (WDM)
    DRV - [2003/09/22 08:48:06 | 000,130,192 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ctsfm2k.sys -- (ctsfm2k)
    DRV - [2003/09/22 08:47:38 | 000,178,672 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ctoss2k.sys -- (ossrv)
    DRV - [2003/03/05 12:19:28 | 000,015,840 | ---- | M] (Creative Technology Ltd.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\PFMODNT.SYS -- (PfModNT)
    DRV - [2001/09/25 14:02:18 | 000,027,519 | R--- | M] (SMC2208USB/ETH) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\SMC2208.SYS -- (USB-100)
    DRV - [2001/08/17 06:28:00 | 000,871,388 | ---- | M] (BCM) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\BCMDM.sys -- (BCMModem)


    ========== Standard Registry (SafeList) ==========


    ========== Internet Explorer ==========

    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch = http://www.yahoo.com/ext/search/search.html
    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie

    IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
    IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
    IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://att.yahoo.com/
    IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
    IE - HKCU\..\URLSearchHook: {EEE6C35D-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll (SweetIM Technologies Ltd.)
    IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll (Yahoo! Inc.)
    IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0


    [2009/05/11 20:35:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Daylene Croy\Application Data\Mozilla\Extensions
    [2009/05/11 20:35:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Daylene Croy\Application Data\Mozilla\Extensions\mozswing@mozswing.org

    O1 HOSTS File: ([2002/09/03 09:34:19 | 000,000,734 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
    O1 - Hosts: 127.0.0.1 localhost
    O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll (Yahoo! Inc.)
    O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
    O2 - BHO: (Yahoo! IE Services Button) - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll (Yahoo! Inc.)
    O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
    O2 - BHO: (Accelerator Plugin) - {656EC4B7-072B-4698-B504-2A414C1F0037} - Reg Error: Value error. File not found
    O2 - BHO: (SweetIM Toolbar Helper) - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
    O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\YTSingleInstance.dll (Yahoo! Inc)
    O3 - HKLM\..\Toolbar: (SweetIM Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
    O3 - HKLM\..\Toolbar: (att.net Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll (Yahoo! Inc.)
    O3 - HKCU\..\Toolbar\WebBrowser: (SweetIM Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
    O3 - HKCU\..\Toolbar\WebBrowser: (att.net Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll (Yahoo! Inc.)
    O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
    O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
    O4 - HKLM..\Run: [IPInSightMonitor 01] C:\Program Files\SBC Yahoo!\Connection Manager\IP InSight\IPMon32.exe (Visual Networks)
    O4 - HKLM..\Run: [SweetIM] C:\Program Files\SweetIM\Messenger\SweetIM.exe (SweetIM Technologies Ltd.)
    O4 - HKLM..\Run: [UpdReg] C:\WINDOWS\Updreg.EXE (Creative Technology Ltd.)
    O4 - Startup: C:\Documents and Settings\Daylene Croy\Start Menu\Programs\StartUp\LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe (Lime Wire, LLC)
    O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
    O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 1
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
    O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
    O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
    O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O8 - Extra context menu item: &Yahoo! Search - C:\Program Files\Yahoo!\Common [2010/04/28 11:50:44 | 000,000,000 | ---D | M]
    O8 - Extra context menu item: Yahoo! &Dictionary - C:\Program Files\Yahoo!\Common [2010/04/28 11:50:44 | 000,000,000 | ---D | M]
    O8 - Extra context menu item: Yahoo! &Maps - C:\Program Files\Yahoo!\Common [2010/04/28 11:50:44 | 000,000,000 | ---D | M]
    O8 - Extra context menu item: Yahoo! &SMS - C:\Program Files\Yahoo!\Common [2010/04/28 11:50:44 | 000,000,000 | ---D | M]
    O9 - Extra Button: AT&T Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll (Yahoo! Inc.)
    O15 - HKCU\..Trusted Domains: ([]msn in My Computer)
    O15 - HKCU\..Trusted Domains: marlboro.com ([www] https in Trusted sites)
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1238600905125 (WUWebControl Class)
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1238600842687 (MUWebControl Class)
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
    O16 - DPF: {8D83D301-E841-11D1-B155-00600823BCF9} https://www.sbcwebsupport.com/webline/applets/msie40x.cab (WebLine Browser Integration Classes)
    O16 - DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab (Reg Error: Key error.)
    O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
    O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab (Shockwave Flash Object)
    O16 - DPF: Bingo Luau by pogo http://game3.pogo.com/v/9.1.7.20/applet/freebingo/freebingo-en_US.cab (Reg Error: Key error.)
    O16 - DPF: Blackjack Carnival by pogo http://game3.pogo.com/v/9.1.7.20/applet/vbjack2/vbjack2-en_US.cab (Reg Error: Key error.)
    O16 - DPF: Bowling by pogo http://game3.pogo.com/v/9.1.7.20/applet/bowling/bowling-en_US.cab (Reg Error: Key error.)
    O16 - DPF: Cribbage by pogo http://game3.pogo.com/v/9.1.6.34/applet/cribbage/cribbage-en_US.cab (Reg Error: Key error.)
    O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.)
    O16 - DPF: First Class Solitaire by pogo http://game3.pogo.com/v/9.1.7.20/applet/firstclass2/firstclass2-en_US.cab (Reg Error: Key error.)
    O16 - DPF: Greenback Bayou by pogo http://game3.pogo.com/v/9.1.6.34/applet/greenback/greenback-en_US.cab (Reg Error: Key error.)
    O16 - DPF: Hog Heaven Slots by pogo http://game3.pogo.com/v/9.1.7.20/applet/fancy/fancy-en_US.cab (Reg Error: Key error.)
    O16 - DPF: Lottso by pogo http://game3.pogo.com/v/9.1.7.20/applet/lottso/lottso-en_US.cab (Reg Error: Key error.)
    O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
    O16 - DPF: Payday Freecell Solitaire by pogo http://game3.pogo.com/v/9.1.7.20/applet/freecell2/freecell2-en_US.cab (Reg Error: Key error.)
    O16 - DPF: Phlinx by pogo http://game3.pogo.com/v/9.1.7.20/applet/flinger/flinger-en_US.cab (Reg Error: Key error.)
    O16 - DPF: Pinochle by pogo http://game3.pogo.com/v/9.1.7.22/applet/pinochle/pinochle-en_US.cab (Reg Error: Key error.)
    O16 - DPF: Poppit by pogo http://game3.pogo.com/v/9.1.7.20/applet/poppit2/poppit2-en_US.cab (Reg Error: Key error.)
    O16 - DPF: Scrabble by pogo http://game3.pogo.com/v/9.1.7.22/applet/scrabble/scrabble-en_US.cab (Reg Error: Key error.)
    O16 - DPF: Showbiz Slots 2 by pogo http://game3.pogo.com/v/9.1.6.34/applet/slots/showbiz2-en_US.cab (Reg Error: Key error.)
    O16 - DPF: SockHop Slots by pogo http://game3.pogo.com/v/9.1.7.20/applet/showbiz3/showbiz3-en_US.cab (Reg Error: Key error.)
    O16 - DPF: Spades 2 by pogo http://game3.pogo.com/v/9.1.7.20/applet/spades2/spades2-en_US.cab (Reg Error: Key error.)
    O16 - DPF: Spider Solitaire by pogo http://game3.pogo.com/v/9.1.7.20/applet/spider/spider-en_US.cab (Reg Error: Key error.)
    O16 - DPF: Team Bingo by Pogo http://game3.pogo.com/v/9.1.7.20/applet/teambingo/teambingo-en_US.cab (Reg Error: Key error.)
    O16 - DPF: Thousand Island Solitaire by pogo http://game3.pogo.com/v/9.1.7.20/applet/millbrae/millbrae-en_US.cab (Reg Error: Key error.)
    O16 - DPF: Turbo 21 v2 by pogo http://game3.pogo.com/v/9.1.7.20/applet/turbo22/turbo22-en_US.cab (Reg Error: Key error.)
    O16 - DPF: Word Whomp Whackdown by pogo http://game3.pogo.com/v/9.1.7.20/applet/whackdown/whackdown-en_US.cab (Reg Error: Key error.)
    O16 - DPF: Yahtzee Party by pogo http://game3.pogo.com/v/9.1.7.20/applet/yahtzee/yahtzee-en_US.cab (Reg Error: Key error.)
    O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
    O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
    O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
    O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
    O32 - HKLM CDRom: AutoRun - 1
    O34 - HKLM BootExecute: (autocheck autochk *) - File not found
    O35 - HKLM\..comfile [open] -- "%1" %*
    O35 - HKLM\..exefile [open] -- "%1" %*
    O37 - HKLM\...com [@ = ComFile] -- "%1" %*
    O37 - HKLM\...exe [@ = exefile] -- "%1" %*

    NetSvcs: 6to4 - File not found
    NetSvcs: AppMgmt - C:\WINDOWS\System32\appmgmts.dll File not found
    NetSvcs: Ias - File not found
    NetSvcs: Iprip - File not found
    NetSvcs: Irmon - File not found
    NetSvcs: NWCWorkstation - File not found
    NetSvcs: Nwsapagent - File not found
    NetSvcs: WmdmPmSp - File not found

    Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
    Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
    Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
    Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
    Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
    Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
    Drivers32: wave - C:\WINDOWS\System32\serwvdrv.dll (Microsoft Corporation)
    Drivers32: wave1 - C:\WINDOWS\System32\serwvdrv.dll (Microsoft Corporation)
    Drivers32: wave4 - C:\WINDOWS\System32\serwvdrv.dll (Microsoft Corporation)
    Drivers32: wave5 - C:\WINDOWS\System32\serwvdrv.dll (Microsoft Corporation)
    Drivers32: wave6 - C:\WINDOWS\System32\serwvdrv.dll (Microsoft Corporation)

    CREATERESTOREPOINT
    Restore point Set: OTL Restore Point (16902109354000384)

    ========== Files/Folders - Created Within 30 Days ==========

    [2010/10/24 19:30:46 | 000,575,488 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Daylene Croy\Desktop\OTL.exe
    [2010/10/24 18:40:30 | 000,000,000 | RHSD | C] -- C:\cmdcons
    [2010/10/24 18:18:24 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
    [2010/10/24 18:18:24 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
    [2010/10/24 18:18:24 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
    [2010/10/24 18:18:24 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
    [2010/10/24 18:18:03 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
    [2010/10/24 18:16:55 | 000,000,000 | ---D | C] -- C:\Qoobox
    [2010/10/24 11:48:17 | 000,153,376 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
    [2010/10/24 11:48:17 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
    [2010/10/24 11:48:17 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
    [2010/10/19 07:35:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Daylene Croy\Application Data\Avira
    [2010/10/19 06:27:19 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\ssmdrv.sys
    [2010/10/19 06:27:14 | 000,124,784 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avipbb.sys
    [2010/10/19 06:27:14 | 000,060,936 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntflt.sys
    [2010/10/19 06:27:14 | 000,045,416 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntdd.sys
    [2010/10/19 06:27:14 | 000,022,360 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntmgr.sys
    [2010/10/19 06:27:09 | 000,000,000 | ---D | C] -- C:\Program Files\Avira
    [2010/10/18 14:41:57 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Security Essentials(2)
    [2010/10/18 14:41:57 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware(2)
    [2010/10/18 14:41:55 | 000,000,000 | ---D | C] -- C:\Program Files\QuickTime
    [2010/10/18 14:41:55 | 000,000,000 | ---D | C] -- C:\Program Files\Glary Utilities
    [2010/10/18 14:41:17 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Silverlight
    [2010/10/15 19:08:45 | 000,000,000 | ---D | C] -- C:\Program Files\VS Revo Group
    [2010/10/15 12:59:15 | 000,000,000 | ---D | C] -- C:\RECYCLER(3)
    [2010/10/15 12:56:20 | 000,000,000 | ---D | C] -- C:\RECYCLER(2)
    [2010/10/15 11:50:18 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Daylene Croy\Local Settings\Application Data\FixItCenter
    [2010/10/15 11:29:33 | 000,000,000 | ---D | C] -- C:\WINDOWS\MATS
    [2010/10/15 11:29:28 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Fix it Center
    [2010/10/15 09:57:30 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Security Essentials
    [2010/10/14 05:12:37 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
    [2010/10/14 05:11:49 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
    [2010/10/14 05:11:47 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
    [2010/10/14 02:50:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\NOS
    [2010/10/13 08:35:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\PCHealth
    [2010/10/10 05:28:18 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Daylene Croy\Application Data\Malwarebytes
    [2010/10/10 03:10:53 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    [2010/09/29 11:58:20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Daylene Croy\Application Data\Windows Search
    [2010/09/25 10:33:49 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft.NET
    [2010/09/25 10:15:37 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\WindowsPowerShell
    [2010/09/25 10:15:35 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\winrm
    [2010/09/25 10:15:27 | 000,000,000 | -H-D | C] -- C:\WINDOWS\$968930Uinstall_KB968930$
    [2010/09/25 10:08:30 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Daylene Croy\Application Data\Windows Desktop Search
    [2010/09/25 10:06:46 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Desktop Search
    [2010/09/25 10:06:46 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\GroupPolicy
    [2010/09/25 10:04:02 | 000,098,304 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\nlhtml.dll
    [2010/09/25 10:04:02 | 000,029,696 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mimefilt.dll
    [2010/09/25 10:04:01 | 000,192,000 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\offfilt.dll
    [2002/04/11 00:41:00 | 000,065,536 | ---- | C] ( ) -- C:\WINDOWS\System32\A3d.dll

    ========== Files - Modified Within 30 Days ==========

    [2010/10/24 19:35:08 | 000,000,898 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
    [2010/10/24 19:30:48 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Daylene Croy\Desktop\OTL.exe
    [2010/10/24 18:40:43 | 000,000,327 | RHS- | M] () -- C:\boot.ini
    [2010/10/24 18:02:25 | 003,883,109 | R--- | M] () -- C:\Documents and Settings\Daylene Croy\Desktop\ComboFix.exe
    [2010/10/24 17:44:41 | 000,080,384 | ---- | M] () -- C:\Documents and Settings\Daylene Croy\Desktop\MBRCheck.exe
    [2010/10/24 16:48:42 | 000,001,744 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
    [2010/10/24 16:40:08 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
    [2010/10/24 16:36:47 | 000,000,894 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
    [2010/10/24 16:36:37 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
    [2010/10/24 16:36:35 | 267,460,608 | -HS- | M] () -- C:\hiberfil.sys
    [2010/10/19 06:27:53 | 000,001,707 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Avira AntiVir Control Center.lnk
    [2010/10/18 17:03:49 | 000,001,604 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\QuickTime Player.lnk
    [2010/10/16 02:11:48 | 000,001,632 | ---- | M] () -- C:\WINDOWS\System32\d3d8caps.dat
    [2010/10/15 08:12:16 | 000,000,446 | ---- | M] () -- C:\Documents and Settings\Daylene Croy\My Documents\uninstall.reg
    [2010/10/15 04:20:31 | 000,116,560 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
    [2010/10/14 23:51:25 | 000,586,276 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
    [2010/10/14 23:51:25 | 000,120,904 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
    [2010/10/14 23:44:44 | 000,001,393 | ---- | M] () -- C:\WINDOWS\imsins.BAK
    [2010/10/14 05:13:11 | 000,000,696 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
    [2010/10/10 01:31:26 | 000,022,154 | ---- | M] () -- C:\WINDOWS\msvideo.dll
    [2010/10/09 03:31:38 | 000,000,000 | -H-- | M] () -- C:\Documents and Settings\Daylene Croy\My Documents\Default.rdp
    [2010/10/03 20:55:27 | 000,001,538 | ---- | M] () -- C:\Documents and Settings\Daylene Croy\Start Menu\Programs\StartUp\LimeWire On Startup.lnk
    [2010/10/03 20:52:22 | 000,001,580 | ---- | M] () -- C:\Documents and Settings\Daylene Croy\Desktop\LimeWire 5.5.16.lnk
    [2010/09/25 10:07:33 | 000,001,787 | ---- | M] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Windows Search.lnk
    [2010/09/25 04:56:05 | 000,000,562 | ---- | M] () -- C:\Documents and Settings\Daylene Croy\Desktop\Internet Connection.lnk
    [2010/09/25 04:16:44 | 000,001,915 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Google Earth.lnk

    ========== Files Created - No Company Name ==========

    [2010/10/24 18:40:43 | 000,000,211 | ---- | C] () -- C:\Boot.bak
    [2010/10/24 18:40:36 | 000,260,272 | RHS- | C] () -- C:\cmldr
    [2010/10/24 18:18:24 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe
    [2010/10/24 18:18:24 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
    [2010/10/24 18:18:24 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
    [2010/10/24 18:18:24 | 000,077,312 | ---- | C] () -- C:\WINDOWS\MBR.exe
    [2010/10/24 18:18:24 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
    [2010/10/24 18:02:23 | 003,883,109 | R--- | C] () -- C:\Documents and Settings\Daylene Croy\Desktop\ComboFix.exe
    [2010/10/24 17:44:32 | 000,080,384 | ---- | C] () -- C:\Documents and Settings\Daylene Croy\Desktop\MBRCheck.exe
    [2010/10/19 06:27:53 | 000,001,707 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Avira AntiVir Control Center.lnk
    [2010/10/18 17:03:48 | 000,001,604 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\QuickTime Player.lnk
    [2010/10/15 08:12:16 | 000,000,446 | ---- | C] () -- C:\Documents and Settings\Daylene Croy\My Documents\uninstall.reg
    [2010/10/14 05:13:11 | 000,000,696 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
    [2010/10/13 19:03:07 | 267,460,608 | -HS- | C] () -- C:\hiberfil.sys
    [2010/10/09 03:31:38 | 000,000,000 | -H-- | C] () -- C:\Documents and Settings\Daylene Croy\My Documents\Default.rdp
    [2010/10/03 20:55:27 | 000,001,538 | ---- | C] () -- C:\Documents and Settings\Daylene Croy\Start Menu\Programs\StartUp\LimeWire On Startup.lnk
    [2010/10/03 20:52:21 | 000,001,580 | ---- | C] () -- C:\Documents and Settings\Daylene Croy\Desktop\LimeWire 5.5.16.lnk
    [2010/09/25 10:07:33 | 000,001,787 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Windows Search.lnk
    [2010/09/25 04:56:05 | 000,000,562 | ---- | C] () -- C:\Documents and Settings\Daylene Croy\Desktop\Internet Connection.lnk
    [2010/09/25 04:16:44 | 000,001,915 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Google Earth.lnk
    [2010/08/11 19:07:18 | 000,069,320 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
    [2007/09/27 10:51:02 | 000,020,698 | ---- | C] () -- C:\WINDOWS\System32\idxcntrs.ini
    [2007/09/27 10:48:48 | 000,030,628 | ---- | C] () -- C:\WINDOWS\System32\gsrvctr.ini
    [2007/09/27 10:48:28 | 000,031,698 | ---- | C] () -- C:\WINDOWS\System32\gthrctr.ini
    [2007/07/21 17:41:11 | 000,000,593 | ---- | C] () -- C:\WINDOWS\SysMech6.INI
    [2006/12/27 23:06:18 | 000,001,359 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
    [2006/07/17 19:05:24 | 000,000,084 | ---- | C] () -- C:\WINDOWS\encore_launcher.ini
    [2006/03/27 12:31:58 | 000,007,168 | ---- | C] () -- C:\Documents and Settings\Daylene Croy\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    [2005/09/17 01:51:24 | 000,000,490 | ---- | C] () -- C:\WINDOWS\DELLSTAT.INI
    [2005/09/17 01:50:58 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\dlbavs.dll
    [2005/09/17 01:50:36 | 000,000,177 | ---- | C] () -- C:\WINDOWS\System32\dlbacoin.ini
    [2005/09/17 01:31:37 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\YCRWin32.dll
    [2005/09/15 11:06:36 | 000,000,066 | ---- | C] () -- C:\WINDOWS\SBWIN.INI
    [2005/09/15 11:06:17 | 000,002,516 | ---- | C] () -- C:\WINDOWS\System32\P16X.ini
    [2005/09/15 11:06:17 | 000,000,026 | ---- | C] () -- C:\WINDOWS\System32\ctzapxx.ini
    [2005/03/25 03:14:01 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
    [2003/09/01 10:06:14 | 000,002,696 | ---- | C] () -- C:\WINDOWS\MIXDEF.INI
    [2003/07/08 13:41:48 | 000,047,616 | ---- | C] () -- C:\WINDOWS\System32\P16X.dll
    [2002/09/03 09:49:58 | 000,022,154 | ---- | C] () -- C:\WINDOWS\msvideo.dll

    ========== Custom Scans ==========


    < %SYSTEMDRIVE%\*.* >
    [2009/04/07 03:04:24 | 000,000,211 | ---- | M] () -- C:\Boot.bak
    [2010/10/24 18:40:43 | 000,000,327 | RHS- | M] () -- C:\boot.ini
    [2004/08/03 23:00:00 | 000,260,272 | RHS- | M] () -- C:\cmldr
    [2010/10/24 19:06:26 | 000,017,660 | ---- | M] () -- C:\ComboFix.txt
    [2005/03/25 11:22:06 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
    [2010/04/30 00:02:47 | 000,000,372 | ---- | M] () -- C:\content_update_notification.xml
    [2010/10/24 16:36:35 | 267,460,608 | -HS- | M] () -- C:\hiberfil.sys
    [2005/03/25 11:22:06 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
    [2005/03/25 11:22:06 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
    [2005/09/15 09:50:59 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
    [2009/04/11 04:49:04 | 000,250,048 | RHS- | M] () -- C:\ntldr
    [2010/10/24 16:36:23 | 402,653,184 | -HS- | M] () -- C:\pagefile.sys
    [2009/08/28 00:07:35 | 000,000,268 | -H-- | M] () -- C:\sqmdata00.sqm
    [2009/08/28 20:05:37 | 000,000,268 | -H-- | M] () -- C:\sqmdata01.sqm
    [2009/08/29 23:45:26 | 000,000,268 | -H-- | M] () -- C:\sqmdata02.sqm
    [2009/08/30 22:08:36 | 000,000,268 | -H-- | M] () -- C:\sqmdata03.sqm
    [2009/08/31 12:43:45 | 000,000,268 | -H-- | M] () -- C:\sqmdata04.sqm
    [2009/08/31 15:00:07 | 000,000,268 | -H-- | M] () -- C:\sqmdata05.sqm
    [2009/08/31 23:45:25 | 000,000,268 | -H-- | M] () -- C:\sqmdata06.sqm
    [2009/10/08 04:46:34 | 000,000,232 | -H-- | M] () -- C:\sqmdata07.sqm
    [2009/10/08 04:46:44 | 000,000,232 | -H-- | M] () -- C:\sqmdata08.sqm
    [2009/10/08 04:47:07 | 000,000,232 | -H-- | M] () -- C:\sqmdata09.sqm
    [2009/10/08 04:47:17 | 000,000,232 | -H-- | M] () -- C:\sqmdata10.sqm
    [2009/10/08 04:47:21 | 000,000,232 | -H-- | M] () -- C:\sqmdata11.sqm
    [2009/10/08 11:53:19 | 000,000,232 | -H-- | M] () -- C:\sqmdata12.sqm
    [2009/10/08 14:01:34 | 000,000,232 | -H-- | M] () -- C:\sqmdata13.sqm
    [2009/10/08 19:44:30 | 000,000,232 | -H-- | M] () -- C:\sqmdata14.sqm
    [2009/10/09 12:30:40 | 000,000,232 | -H-- | M] () -- C:\sqmdata15.sqm
    [2009/10/10 00:05:28 | 000,000,232 | -H-- | M] () -- C:\sqmdata16.sqm
    [2009/08/21 23:38:17 | 000,000,268 | -H-- | M] () -- C:\sqmdata17.sqm
    [2009/08/24 02:21:33 | 000,000,268 | -H-- | M] () -- C:\sqmdata18.sqm
    [2009/08/26 23:33:02 | 000,000,268 | -H-- | M] () -- C:\sqmdata19.sqm
    [2009/08/28 00:07:35 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt00.sqm
    [2009/08/28 20:05:37 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt01.sqm
    [2009/08/29 23:45:26 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt02.sqm
    [2009/08/30 22:08:36 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt03.sqm
    [2009/08/31 12:43:45 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt04.sqm
    [2009/08/31 15:00:07 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt05.sqm
    [2009/08/31 23:45:25 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt06.sqm
    [2009/10/08 04:46:34 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt07.sqm
    [2009/10/08 04:46:44 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt08.sqm
    [2009/10/08 04:47:06 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt09.sqm
    [2009/10/08 04:47:17 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt10.sqm
    [2009/10/08 04:47:21 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt11.sqm
    [2009/10/08 11:53:19 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt12.sqm
    [2009/10/08 14:01:34 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt13.sqm
    [2009/10/08 19:44:30 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt14.sqm
    [2009/10/09 12:30:40 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt15.sqm
    [2009/10/10 00:05:28 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt16.sqm
    [2009/08/21 23:38:17 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt17.sqm
    [2009/08/24 02:21:32 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt18.sqm
    [2009/08/26 23:33:02 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt19.sqm
    [2010/10/10 02:03:25 | 000,000,137 | ---- | M] () -- C:\VundoFix.txt
    [2010/04/07 00:47:33 | 000,097,577 | ---- | M] () -- C:\YServer.txt

    < %systemroot%\Fonts\*.com >
    [2006/04/18 15:39:28 | 000,026,040 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
    [2006/06/29 14:53:56 | 000,026,489 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
    [2006/04/18 15:39:28 | 000,029,779 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
    [2006/06/29 14:58:52 | 000,030,808 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

    < %systemroot%\Fonts\*.dll >

    < %systemroot%\Fonts\*.ini >
    [2005/03/25 11:21:41 | 000,000,067 | -HS- | M] () -- C:\WINDOWS\Fonts\desktop.ini

    < %systemroot%\Fonts\*.ini2 >

    < %systemroot%\Fonts\*.exe >

    < %systemroot%\system32\spool\prtprocs\w32x86\*.* >
    [2003/02/17 17:00:42 | 000,077,824 | ---- | M] () -- C:\WINDOWS\system32\spool\prtprocs\w32x86\DLBAPP5C.DLL
    [2008/07/06 05:06:10 | 000,089,088 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
    [2008/07/06 03:50:03 | 000,597,504 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

    < %systemroot%\REPAIR\*.bak1 >

    < %systemroot%\REPAIR\*.ini >

    < %systemroot%\system32\*.jpg >

    < %systemroot%\*.jpg >

    < %systemroot%\*.png >

    < %systemroot%\*.scr >

    < %systemroot%\*._sy >

    < %APPDATA%\Adobe\Update\*.* >

    < %ALLUSERSPROFILE%\Favorites\*.* >

    < %APPDATA%\Microsoft\*.* >

    < %PROGRAMFILES%\*.* >

    < %APPDATA%\Update\*.* >

    < %systemroot%\*. /mp /s >

    < %systemroot%\System32\config\*.sav >
    [2005/03/25 03:12:22 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
    [2005/03/25 03:12:21 | 000,602,112 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
    [2005/03/25 03:12:21 | 000,413,696 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav

    < %PROGRAMFILES%\bak. /s >

    < %systemroot%\system32\bak. /s >

    < %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
    [2009/04/11 04:58:19 | 000,000,272 | ---- | M] () -- C:\Documents and Settings\All Users\Start Menu\desktop.ini

    < %systemroot%\system32\config\systemprofile\*.dat /x >

    < %systemroot%\*.config >

    < %systemroot%\system32\*.db >

    < %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
    [2005/09/15 10:11:53 | 000,000,177 | ---- | M] () -- C:\Documents and Settings\Daylene Croy\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
    [2005/04/30 17:29:51 | 000,000,079 | ---- | M] () -- C:\Documents and Settings\Daylene Croy\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

    < %USERPROFILE%\Desktop\*.exe >
    [2010/10/24 18:02:25 | 003,883,109 | R--- | M] () -- C:\Documents and Settings\Daylene Croy\Desktop\ComboFix.exe
    [2010/10/24 17:44:41 | 000,080,384 | ---- | M] () -- C:\Documents and Settings\Daylene Croy\Desktop\MBRCheck.exe
    [2010/10/24 19:30:48 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Daylene Croy\Desktop\OTL.exe

    < %PROGRAMFILES%\Common Files\*.* >

    < %systemroot%\*.src >

    < %systemroot%\install\*.* >

    < %systemroot%\system32\DLL\*.* >

    < %systemroot%\system32\HelpFiles\*.* >

    < %systemroot%\system32\rundll\*.* >

    < %systemroot%\winn32\*.* >

    < %systemroot%\Java\*.* >
    [2007/07/15 19:46:06 | 000,023,350 | ---- | M] () -- C:\WINDOWS\java\javalog.txt

    < %systemroot%\system32\test\*.* >

    < %systemroot%\system32\Rundll32\*.* >

    < %systemroot%\AppPatch\Custom\*.* >

    < %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

    < %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

    < %PROGRAMFILES%\Internet Explorer\*.tmp >

    < %PROGRAMFILES%\Internet Explorer\*.dat >

    < %USERPROFILE%\My Documents\*.exe >

    < %USERPROFILE%\*.exe >

    < %systemroot%\ADDINS\*.* >

    < %systemroot%\assembly\*.bak2 >

    < %systemroot%\Config\*.* >

    < %systemroot%\REPAIR\*.bak2 >

    < %systemroot%\SECURITY\Database\*.sdb /x >

    < %systemroot%\SYSTEM\*.bak2 >

    < %systemroot%\Web\*.bak2 >

    < %systemroot%\Driver Cache\*.* >

    < %PROGRAMFILES%\Mozilla Firefox\0*.exe >

    < %ProgramFiles%\Microsoft Common\*.* >

    < %ProgramFiles%\TinyProxy. >

    < %USERPROFILE%\Favorites\*.url /x >
    [2005/09/15 10:11:53 | 000,000,122 | -HS- | M] () -- C:\Documents and Settings\Daylene Croy\Favorites\Desktop.ini

    < %systemroot%\system32\*.bk >

    < %systemroot%\*.te >

    < %systemroot%\system32\system32\*.* >

    < %ALLUSERSPROFILE%\*.dat /x >

    < %systemroot%\system32\drivers\*.rmv >

    < dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

    < dir /b "%systemroot%\*.exe" | find /i " " /c >

    < %PROGRAMFILES%\Microsoft\*.* >

    < %systemroot%\System32\Wbem\proquota.exe >

    < %PROGRAMFILES%\Mozilla Firefox\*.dat >

    < %USERPROFILE%\Cookies\*.txt /x >
    [2009/04/14 10:34:50 | 000,000,067 | -HS- | M] () -- C:\Documents and Settings\Daylene Croy\Cookies\desktop.ini
    [2010/10/24 19:33:04 | 000,131,072 | -HS- | M] () -- C:\Documents and Settings\Daylene Croy\Cookies\index.dat

    < %SystemRoot%\system32\fonts\*.* >

    < %systemroot%\system32\winlog\*.* >

    < %systemroot%\system32\Language\*.* >

    < %systemroot%\system32\Settings\*.* >

    < %systemroot%\system32\*.quo >

    < %SYSTEMROOT%\AppPatch\*.exe >

    < %SYSTEMROOT%\inf\*.exe >
    [2007/06/26 22:10:26 | 000,317,440 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\inf\unregmp2.exe

    < %SYSTEMROOT%\Installer\*.exe >

    < %systemroot%\system32\config\*.bak2 >

    < %systemroot%\system32\Computers\*.* >

    < %SystemRoot%\system32\Sound\*.* >

    < %SystemRoot%\system32\SpecialImg\*.* >

    < %SystemRoot%\system32\code\*.* >

    < %SystemRoot%\system32\draft\*.* >

    < %SystemRoot%\system32\MSSSys\*.* >

    < %ProgramFiles%\Javascript\*.* >

    < %systemroot%\pchealth\helpctr\System\*.exe /s >

    < %systemroot%\Web\*.exe >

    < %systemroot%\system32\msn\*.* >

    < %systemroot%\system32\*.tro >

    < %AppData%\Microsoft\Installer\msupdates\*.* >

    < %ProgramFiles%\Messenger\*.* >
    [2008/04/13 17:11:51 | 000,033,792 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\custsat.dll
    [2002/09/03 09:39:47 | 000,004,821 | ---- | M] () -- C:\Program Files\Messenger\logowin.gif
    [2002/08/20 13:32:18 | 000,007,047 | ---- | M] () -- C:\Program Files\Messenger\lvback.gif
    [2002/08/20 13:32:22 | 000,000,807 | ---- | M] () -- C:\Program Files\Messenger\mailtmpl.txt
    [2008/05/02 07:01:49 | 000,083,968 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgsc.dll
    [2008/04/13 10:30:28 | 000,180,224 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgslang.dll
    [2008/04/13 17:12:28 | 001,695,232 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msmsgs.exe
    [2002/08/20 16:08:38 | 000,069,663 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msmsgsin.exe
    [2002/09/03 09:49:05 | 000,002,882 | ---- | M] () -- C:\Program Files\Messenger\newalert.wav
    [2002/09/03 09:49:07 | 000,006,156 | ---- | M] () -- C:\Program Files\Messenger\newemail.wav
    [2002/09/03 09:51:10 | 000,006,160 | ---- | M] () -- C:\Program Files\Messenger\online.wav
    [2002/08/20 13:32:20 | 000,004,454 | ---- | M] () -- C:\Program Files\Messenger\type.wav
    [2004/07/17 11:41:06 | 000,115,981 | ---- | M] () -- C:\Program Files\Messenger\xpmsgr.chm

    < %systemroot%\system32\systhem32\*.* >

    < %systemroot%\system\*.exe >

    < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

    < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >


    < End of report >
     
  23. LittleBigNDN

    LittleBigNDN TS Rookie Topic Starter Posts: 47

    OTL Extras logfile created on: 10/24/2010 7:33:08 PM - Run 1
    OTL by OldTimer - Version 3.2.17.1 Folder = C:\Documents and Settings\Daylene Croy\Desktop
    Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
    Internet Explorer (Version = 8.0.6001.18702)
    Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

    255.00 Mb Total Physical Memory | 77.00 Mb Available Physical Memory | 30.00% Memory free
    618.00 Mb Paging File | 240.00 Mb Available in Paging File | 39.00% Paging File free
    Paging file location(s): C:\pagefile.sys 384 768 [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
    Drive C: | 55.84 Gb Total Space | 36.36 Gb Free Space | 65.12% Space Free | Partition Type: NTFS

    Computer Name: ELDA-PZICIO1813 | User Name: Daylene Croy | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: Current user
    Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

    ========== Extra Registry (SafeList) ==========


    ========== File Associations ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

    ========== Shell Spawning ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
    batfile [open] -- "%1" %*
    cmdfile [open] -- "%1" %*
    comfile [open] -- "%1" %*
    exefile [open] -- "%1" %*
    htmlfile [edit] -- Reg Error: Key error.
    piffile [open] -- "%1" %*
    regfile [merge] -- Reg Error: Key error.
    scrfile [config] -- "%1"
    scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
    scrfile [open] -- "%1" /S
    txtfile [edit] -- Reg Error: Key error.
    Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
    Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
    Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
    Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
    Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

    ========== Security Center Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
    "AntiVirusDisableNotify" = 0
    "FirewallDisableNotify" = 0
    "UpdatesDisableNotify" = 0
    "AntiVirusOverride" = 0
    "FirewallOverride" = 0

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

    ========== System Restore Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
    "DisableSR" = 0

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
    "Start" = 0

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
    "Start" = 2

    ========== Firewall Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
    "1900:UDP" = 1900:UDP:LocalSubNet:Enabled:mad:xpsp2res.dll,-22007
    "2869:TCP" = 2869:TCP:LocalSubNet:Enabled:mad:xpsp2res.dll,-22008
    "10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
    "10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
    "10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
    "10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
    "10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
    "10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
    "EnableFirewall" = 1
    "DoNotAllowExceptions" = 0
    "DisableNotifications" = 0

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
    "1900:UDP" = 1900:UDP:LocalSubNet:Enabled:mad:xpsp2res.dll,-22007
    "2869:TCP" = 2869:TCP:LocalSubNet:Enabled:mad:xpsp2res.dll,-22008
    "5985:TCP" = 5985:TCP:*:Disabled:Windows Remote Management
    "10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
    "10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
    "10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
    "10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
    "10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service
    "10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service

    ========== Authorized Applications List ==========

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
    "C:\PROGRA~1\Yahoo!\MESSEN~1\yserver.exe" = C:\PROGRA~1\Yahoo!\MESSEN~1\yserver.exe:*:Enabled:Yahoo! FT Server -- (Yahoo! Inc.)
    "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" = C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger -- (Yahoo! Inc.)
    "C:\Program Files\LimeWire\LimeWire.exe" = C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire -- (Lime Wire, LLC)
    "C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes -- (Apple Inc.)
    "C:\WINDOWS\system32\mmc.exe" = C:\WINDOWS\system32\mmc.exe:*:Enabled:Microsoft Management Console -- (Microsoft Corporation)
    "C:\Program Files\Google\Google Earth\client\googleearth.exe" = C:\Program Files\Google\Google Earth\client\googleearth.exe:*:Enabled:Google Earth -- (Google)


    ========== HKEY_LOCAL_MACHINE Uninstall List ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
    "{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
    "{0D499481-22C6-4B25-8AC2-6D3F6C885FB9}" = OpenOffice.org Installer 1.0
    "{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    "{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
    "{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
    "{26A24AE4-039D-4CA4-87B4-2F83216011FF}" = Java(TM) 6 Update 22
    "{3248F0A8-6813-11D6-A77B-00B0D0150110}" = J2SE Runtime Environment 5.0 Update 11
    "{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
    "{36C3A0DA-07E0-4173-A406-D9308C1CBDAB}" = ArcSoft VideoImpression 2
    "{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
    "{3E8C2BA2-F4CA-4A1D-A690-6B9A411DAF8B}" = ArcSoft PhotoImpression 5
    "{4286E640-B5FB-11DF-AC4B-005056C00008}" = Google Earth
    "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
    "{63569CE9-FA00-469C-AF5C-E5D4D93ACF91}" = Windows Genuine Advantage v1.3.0254.0
    "{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
    "{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    "{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}" = Windows Live Essentials
    "{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
    "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
    "{8BBF6DFD-0AD9-43A7-9FBD-BF065E3866AF}" = URGE
    "{8C13BEE4-E7CE-4E46-BD13-8F41DAD00FEF}" = SweetIM Toolbar for Internet Explorer 3.4
    "{9422C8EA-B0C6-4197-B8FC-DC797658CA00}" = Windows Live Sign-in Assistant
    "{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
    "{96E16100-A77F-4B31-B9AD-FFBA040EE1BD}" = Sound Blaster Live!
    "{99ECF41F-5CCA-42BD-B8B8-A8333E2E2944}" = iTunes
    "{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
    "{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
    "{A85FD55B-891B-4314-97A5-EA96C0BD80B5}" = Windows Live Messenger
    "{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
    "{AC76BA86-7AD7-1033-7B44-A81300000003}" = Adobe Reader 8.1.4
    "{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
    "{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
    "{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
    "{DAEAFD68-BB4A-4507-A241-C8804D2EA66D}" = Apple Application Support
    "{E7004147-2CCA-431C-AA05-2AB166B9785D}" = QuickTime
    "{E848C9C0-E6FF-4A3F-9D67-AE53AC3628FE}" = SweetIM for Messenger 2.7
    "{ECA1A3B6-898F-4DCE-9F04-714CF3BA126B}" = Adobe Flash Player 10 Plugin
    "{ED00D08A-3C5F-488D-93A0-A04F21F23956}" = Windows Live Communications Platform
    "{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
    "{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call
    "Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
    "Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
    "Dell AIO Printer A940" = Dell AIO Printer A940
    "Glary Utilities_is1" = Glary Utilities 2.28.0.1011
    "IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
    "ie7" = Windows Internet Explorer 7
    "ie8" = Windows Internet Explorer 8
    "LimeWire" = LimeWire 5.5.16
    "Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
    "Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
    "Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
    "Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
    "Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
    "MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
    "NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
    "PROSet" = Intel(R) PRO Ethernet Adapter and Software
    "Windows Media Format Runtime" = Windows Media Format 11 runtime
    "Windows Media Player" = Windows Media Player 11
    "Windows XP Service Pack" = Windows XP Service Pack 3
    "WinLiveSuite_Wave3" = Windows Live Essentials
    "WMFDist11" = Windows Media Format 11 runtime
    "wmp11" = Windows Media Player 11
    "Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
    "Yahoo! Applications" = AT&T Yahoo! Applications
    "Yahoo! Software Update" = Yahoo! Software Update

    ========== Last 10 Event Log Errors ==========

    [ Application Events ]
    Error - 10/24/2010 7:47:20 PM | Computer Name = ELDA-PZICIO1813 | Source = Windows Search Service | ID = 3013
    Description = The entry <C:\DOCUMENTS AND SETTINGS\DAYLENE CROY\MY DOCUMENTS\LIMEWIRE\INCOMPLETE\.LIMEWIREICONFINDER.LQT>
    in the hash map cannot be updated. Context: Application, SystemIndex Catalog Details:
    A
    device attached to the system is not functioning. (0x8007001f)

    Error - 10/24/2010 7:47:20 PM | Computer Name = ELDA-PZICIO1813 | Source = Windows Search Service | ID = 3013
    Description = The entry <C:\DOCUMENTS AND SETTINGS\DAYLENE CROY\MY DOCUMENTS\LIMEWIRE\INCOMPLETE\.LIMEWIREICONFINDER.M4A>
    in the hash map cannot be updated. Context: Application, SystemIndex Catalog Details:
    A
    device attached to the system is not functioning. (0x8007001f)

    Error - 10/24/2010 7:47:20 PM | Computer Name = ELDA-PZICIO1813 | Source = Windows Search Service | ID = 3013
    Description = The entry <C:\DOCUMENTS AND SETTINGS\DAYLENE CROY\MY DOCUMENTS\LIMEWIRE\INCOMPLETE\.LIMEWIREICONFINDER.M4P>
    in the hash map cannot be updated. Context: Application, SystemIndex Catalog Details:
    A
    device attached to the system is not functioning. (0x8007001f)

    Error - 10/24/2010 7:47:21 PM | Computer Name = ELDA-PZICIO1813 | Source = Windows Search Service | ID = 3013
    Description = The entry <C:\DOCUMENTS AND SETTINGS\DAYLENE CROY\MY DOCUMENTS\LIMEWIRE\INCOMPLETE\.LIMEWIREICONFINDER.MED>
    in the hash map cannot be updated. Context: Application, SystemIndex Catalog Details:
    A
    device attached to the system is not functioning. (0x8007001f)

    Error - 10/24/2010 7:47:21 PM | Computer Name = ELDA-PZICIO1813 | Source = Windows Search Service | ID = 3013
    Description = The entry <C:\DOCUMENTS AND SETTINGS\DAYLENE CROY\MY DOCUMENTS\LIMEWIRE\INCOMPLETE\.LIMEWIREICONFINDER.MID>
    in the hash map cannot be updated. Context: Application, SystemIndex Catalog Details:
    A
    device attached to the system is not functioning. (0x8007001f)

    Error - 10/24/2010 7:47:21 PM | Computer Name = ELDA-PZICIO1813 | Source = Windows Search Service | ID = 3013
    Description = The entry <C:\DOCUMENTS AND SETTINGS\DAYLENE CROY\MY DOCUMENTS\LIMEWIRE\INCOMPLETE\.LIMEWIREICONFINDER.MIDI>
    in the hash map cannot be updated. Context: Application, SystemIndex Catalog Details:
    A
    device attached to the system is not functioning. (0x8007001f)

    Error - 10/24/2010 7:47:22 PM | Computer Name = ELDA-PZICIO1813 | Source = Windows Search Service | ID = 3013
    Description = The entry <C:\DOCUMENTS AND SETTINGS\DAYLENE CROY\MY DOCUMENTS\LIMEWIRE\INCOMPLETE\.LIMEWIREICONFINDER.MKA>
    in the hash map cannot be updated. Context: Application, SystemIndex Catalog Details:
    A
    device attached to the system is not functioning. (0x8007001f)

    Error - 10/24/2010 7:47:24 PM | Computer Name = ELDA-PZICIO1813 | Source = Windows Search Service | ID = 3013
    Description = The entry <C:\DOCUMENTS AND SETTINGS\DAYLENE CROY\MY DOCUMENTS\LIMEWIRE\INCOMPLETE\.LIMEWIREICONFINDER.MOD>
    in the hash map cannot be updated. Context: Application, SystemIndex Catalog Details:
    A
    device attached to the system is not functioning. (0x8007001f)

    Error - 10/24/2010 7:47:24 PM | Computer Name = ELDA-PZICIO1813 | Source = Windows Search Service | ID = 3013
    Description = The entry <C:\DOCUMENTS AND SETTINGS\DAYLENE CROY\MY DOCUMENTS\LIMEWIRE\INCOMPLETE\.LIMEWIREICONFINDER.MP1>
    in the hash map cannot be updated. Context: Application, SystemIndex Catalog Details:
    A
    device attached to the system is not functioning. (0x8007001f)

    Error - 10/24/2010 7:47:24 PM | Computer Name = ELDA-PZICIO1813 | Source = Windows Search Service | ID = 3013
    Description = The entry <C:\DOCUMENTS AND SETTINGS\DAYLENE CROY\MY DOCUMENTS\LIMEWIRE\INCOMPLETE\.LIMEWIREICONFINDER.MP2>
    in the hash map cannot be updated. Context: Application, SystemIndex Catalog Details:
    A
    device attached to the system is not functioning. (0x8007001f)

    [ System Events ]
    Error - 10/24/2010 3:34:23 PM | Computer Name = ELDA-PZICIO1813 | Source = Service Control Manager | ID = 7024
    Description = The Distributed Transaction Coordinator service terminated with service-specific
    error 3221229584 (0xC0001010).

    Error - 10/24/2010 7:39:18 PM | Computer Name = ELDA-PZICIO1813 | Source = Service Control Manager | ID = 7009
    Description = Timeout (30000 milliseconds) waiting for the Net.Tcp Port Sharing
    Service service to connect.

    Error - 10/24/2010 7:39:19 PM | Computer Name = ELDA-PZICIO1813 | Source = Service Control Manager | ID = 7000
    Description = The Net.Tcp Port Sharing Service service failed to start due to the
    following error: %%1053

    Error - 10/24/2010 7:45:30 PM | Computer Name = ELDA-PZICIO1813 | Source = Service Control Manager | ID = 7009
    Description = Timeout (30000 milliseconds) waiting for the IMAPI CD-Burning COM
    Service service to connect.

    Error - 10/24/2010 7:45:30 PM | Computer Name = ELDA-PZICIO1813 | Source = Service Control Manager | ID = 7000
    Description = The IMAPI CD-Burning COM Service service failed to start due to the
    following error: %%1053

    Error - 10/24/2010 9:22:15 PM | Computer Name = ELDA-PZICIO1813 | Source = Service Control Manager | ID = 7031
    Description = The Windows Media Player Network Sharing Service service terminated
    unexpectedly. It has done this 1 time(s). The following corrective action will
    be taken in 30000 milliseconds: Restart the service.

    Error - 10/24/2010 9:23:01 PM | Computer Name = ELDA-PZICIO1813 | Source = WMPNetworkSvc | ID = 866312
    Description = A new media server was not initialized because WMCreateDeviceRegistration()
    encountered error '0xc00d2711'. The Windows Media DRM components on your computer
    might be corrupted. Verify that protected files play correctly in Windows Media
    Player, and then restart the WMPNetworkSvc service.

    Error - 10/24/2010 9:23:02 PM | Computer Name = ELDA-PZICIO1813 | Source = WMPNetworkSvc | ID = 866312
    Description = A new media server was not initialized because WMCreateDeviceRegistration()
    encountered error '0xc00d2711'. The Windows Media DRM components on your computer
    might be corrupted. Verify that protected files play correctly in Windows Media
    Player, and then restart the WMPNetworkSvc service.

    Error - 10/24/2010 9:43:34 PM | Computer Name = ELDA-PZICIO1813 | Source = Service Control Manager | ID = 7031
    Description = The Windows Media Player Network Sharing Service service terminated
    unexpectedly. It has done this 1 time(s). The following corrective action will
    be taken in 30000 milliseconds: Restart the service.

    Error - 10/24/2010 9:49:59 PM | Computer Name = ELDA-PZICIO1813 | Source = Service Control Manager | ID = 7031
    Description = The Windows Media Player Network Sharing Service service terminated
    unexpectedly. It has done this 1 time(s). The following corrective action will
    be taken in 30000 milliseconds: Restart the service.


    < End of report >
     
  24. Broni

    Broni Malware Annihilator Posts: 52,890   +344

    You have very little of RAM. XP needs at least 512MB of RAM to run OK (1GB preferably).

    ===========================================================================

    Run OTL
    • Under the Custom Scans/Fixes box at the bottom, paste in the following

      Code:
      :OTL
      O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
      O2 - BHO: (Accelerator Plugin) - {656EC4B7-072B-4698-B504-2A414C1F0037} - Reg Error: Value error. File not found
      O4 - HKLM..\Run: [UpdReg] C:\WINDOWS\Updreg.EXE (Creative Technology Ltd.)
      O16 - DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jin...ndows-i586.cab (Reg Error: Key error.)
      O16 - DPF: Bingo Luau by pogo http://game3.pogo.com/v/9.1.7.20/app...ingo-en_US.cab (Reg Error: Key error.)
      O16 - DPF: Blackjack Carnival by pogo http://game3.pogo.com/v/9.1.7.20/app...ack2-en_US.cab (Reg Error: Key error.)
      O16 - DPF: Bowling by pogo http://game3.pogo.com/v/9.1.7.20/app...ling-en_US.cab (Reg Error: Key error.)
      O16 - DPF: Cribbage by pogo http://game3.pogo.com/v/9.1.6.34/app...bage-en_US.cab (Reg Error: Key error.)
      O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.)
      O16 - DPF: First Class Solitaire by pogo http://game3.pogo.com/v/9.1.7.20/app...ass2-en_US.cab (Reg Error: Key error.)
      O16 - DPF: Greenback Bayou by pogo http://game3.pogo.com/v/9.1.6.34/app...back-en_US.cab (Reg Error: Key error.)
      O16 - DPF: Hog Heaven Slots by pogo http://game3.pogo.com/v/9.1.7.20/app...ancy-en_US.cab (Reg Error: Key error.)
      O16 - DPF: Lottso by pogo http://game3.pogo.com/v/9.1.7.20/app...ttso-en_US.cab (Reg Error: Key error.)
      O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
      O16 - DPF: Payday Freecell Solitaire by pogo http://game3.pogo.com/v/9.1.7.20/app...ell2-en_US.cab (Reg Error: Key error.)
      O16 - DPF: Phlinx by pogo http://game3.pogo.com/v/9.1.7.20/app...nger-en_US.cab (Reg Error: Key error.)
      O16 - DPF: Pinochle by pogo http://game3.pogo.com/v/9.1.7.22/app...chle-en_US.cab (Reg Error: Key error.)
      O16 - DPF: Poppit by pogo http://game3.pogo.com/v/9.1.7.20/app...pit2-en_US.cab (Reg Error: Key error.)
      O16 - DPF: Scrabble by pogo http://game3.pogo.com/v/9.1.7.22/app...bble-en_US.cab (Reg Error: Key error.)
      O16 - DPF: Showbiz Slots 2 by pogo http://game3.pogo.com/v/9.1.6.34/app...biz2-en_US.cab (Reg Error: Key error.)
      O16 - DPF: SockHop Slots by pogo http://game3.pogo.com/v/9.1.7.20/app...biz3-en_US.cab (Reg Error: Key error.)
      O16 - DPF: Spades 2 by pogo http://game3.pogo.com/v/9.1.7.20/app...des2-en_US.cab (Reg Error: Key error.)
      O16 - DPF: Spider Solitaire by pogo http://game3.pogo.com/v/9.1.7.20/app...ider-en_US.cab (Reg Error: Key error.)
      O16 - DPF: Team Bingo by Pogo http://game3.pogo.com/v/9.1.7.20/app...ingo-en_US.cab (Reg Error: Key error.)
      O16 - DPF: Thousand Island Solitaire by pogo http://game3.pogo.com/v/9.1.7.20/app...brae-en_US.cab (Reg Error: Key error.)
      O16 - DPF: Turbo 21 v2 by pogo http://game3.pogo.com/v/9.1.7.20/app...bo22-en_US.cab (Reg Error: Key error.)
      O16 - DPF: Word Whomp Whackdown by pogo http://game3.pogo.com/v/9.1.7.20/app...down-en_US.cab (Reg Error: Key error.)
      O16 - DPF: Yahtzee Party by pogo http://game3.pogo.com/v/9.1.7.20/app...tzee-en_US.cab (Reg Error: Key error.)
      [2010/10/18 14:41:57 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Security Essentials(2)
      [2010/10/15 09:57:30 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Security Essentials
      
      
      :Services
      
      :Reg
      
      :Files
      
      :Commands
      [purity]
      [emptytemp]
      [emptyflash]
      [Reboot]
      
    • Then click the Run Fix button at the top
    • Let the program run unhindered, reboot the PC when it is done
    • You will get a log that shows the results of the fix. Please post it.

    ====================================================================

    Last scans...

    1. Download Security Check from HERE, and save it to your Desktop.
    • Double-click SecurityCheck.exe
    • Follow the onscreen instructions inside of the black box.
    • A Notepad document should open automatically called checkup.txt; please post the contents of that document.


    2. Download Temp File Cleaner (TFC)
    • Double click on TFC.exe to run the program.
    • Click on Start button to begin cleaning process.
    • TFC will close all running programs, and it may ask you to restart computer.


    3. Please run a free online scan with the ESET Online Scanner

    • Disable your antivirus program
    • Tick the box next to YES, I accept the Terms of Use
    • Click Start
    • IMPORTANT! UN-check Remove found threats
    • Accept any security warnings from your browser.
    • Check Scan archives
    • Click Start
    • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
    • When the scan completes, push List of found threats
    • Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
    • NOTE. If Eset won't find any threats, it won't produce any log.
     
  25. LittleBigNDN

    LittleBigNDN TS Rookie Topic Starter Posts: 47

    All processes killed
    ========== OTL ==========
    Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
    Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{656EC4B7-072B-4698-B504-2A414C1F0037}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{656EC4B7-072B-4698-B504-2A414C1F0037}\ deleted successfully.
    Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\UpdReg deleted successfully.
    C:\WINDOWS\Updreg.EXE moved successfully.
    Starting removal of ActiveX control {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}\ not found.
    Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}\ not found.
    Starting removal of ActiveX control Bingo Luau by pogo
    Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Bingo Luau by pogo\DownloadInformation\\INF .
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Bingo Luau by pogo\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Bingo Luau by pogo\ not found.
    Starting removal of ActiveX control Blackjack Carnival by pogo
    Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Blackjack Carnival by pogo\DownloadInformation\\INF .
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Blackjack Carnival by pogo\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Blackjack Carnival by pogo\ not found.
    Starting removal of ActiveX control Bowling by pogo
    Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Bowling by pogo\DownloadInformation\\INF .
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Bowling by pogo\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Bowling by pogo\ not found.
    Starting removal of ActiveX control Cribbage by pogo
    Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Cribbage by pogo\DownloadInformation\\INF .
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Cribbage by pogo\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Cribbage by pogo\ not found.
    File Animation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab not found.
    Starting removal of ActiveX control DirectAnimation Java Classes
    Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\DirectAnimation Java Classes\DownloadInformation\\INF .
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\DirectAnimation Java Classes\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\DirectAnimation Java Classes\ not found.
    Starting removal of ActiveX control First Class Solitaire by pogo
    Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\First Class Solitaire by pogo\DownloadInformation\\INF .
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\First Class Solitaire by pogo\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\First Class Solitaire by pogo\ not found.
    Starting removal of ActiveX control Greenback Bayou by pogo
    Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Greenback Bayou by pogo\DownloadInformation\\INF .
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Greenback Bayou by pogo\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Greenback Bayou by pogo\ not found.
    Starting removal of ActiveX control Hog Heaven Slots by pogo
    Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Hog Heaven Slots by pogo\DownloadInformation\\INF .
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Hog Heaven Slots by pogo\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Hog Heaven Slots by pogo\ not found.
    Starting removal of ActiveX control Lottso by pogo
    Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Lottso by pogo\DownloadInformation\\INF .
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Lottso by pogo\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Lottso by pogo\ not found.
    File oft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab not found.
    Starting removal of ActiveX control Microsoft XML Parser for Java
    Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Microsoft XML Parser for Java\DownloadInformation\\INF .
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Microsoft XML Parser for Java\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Microsoft XML Parser for Java\ not found.
    Starting removal of ActiveX control Payday Freecell Solitaire by pogo
    Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Payday Freecell Solitaire by pogo\DownloadInformation\\INF .
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Payday Freecell Solitaire by pogo\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Payday Freecell Solitaire by pogo\ not found.
    Starting removal of ActiveX control Phlinx by pogo
    Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Phlinx by pogo\DownloadInformation\\INF .
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Phlinx by pogo\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Phlinx by pogo\ not found.
    Starting removal of ActiveX control Pinochle by pogo
    Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Pinochle by pogo\DownloadInformation\\INF .
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Pinochle by pogo\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Pinochle by pogo\ not found.
    Starting removal of ActiveX control Poppit by pogo
    Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Poppit by pogo\DownloadInformation\\INF .
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Poppit by pogo\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Poppit by pogo\ not found.
    Starting removal of ActiveX control Scrabble by pogo
    Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Scrabble by pogo\DownloadInformation\\INF .
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Scrabble by pogo\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Scrabble by pogo\ not found.
    Starting removal of ActiveX control Showbiz Slots 2 by pogo
    Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Showbiz Slots 2 by pogo\DownloadInformation\\INF .
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Showbiz Slots 2 by pogo\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Showbiz Slots 2 by pogo\ not found.
    Starting removal of ActiveX control SockHop Slots by pogo
    Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\SockHop Slots by pogo\DownloadInformation\\INF .
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\SockHop Slots by pogo\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\SockHop Slots by pogo\ not found.
    Starting removal of ActiveX control Spades 2 by pogo
    Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Spades 2 by pogo\DownloadInformation\\INF .
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Spades 2 by pogo\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Spades 2 by pogo\ not found.
    Starting removal of ActiveX control Spider Solitaire by pogo
    Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Spider Solitaire by pogo\DownloadInformation\\INF .
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Spider Solitaire by pogo\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Spider Solitaire by pogo\ not found.
    Starting removal of ActiveX control Team Bingo by Pogo
    Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Team Bingo by Pogo\DownloadInformation\\INF .
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Team Bingo by Pogo\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Team Bingo by Pogo\ not found.
    Starting removal of ActiveX control Thousand Island Solitaire by pogo
    Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Thousand Island Solitaire by pogo\DownloadInformation\\INF .
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Thousand Island Solitaire by pogo\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Thousand Island Solitaire by pogo\ not found.
    Starting removal of ActiveX control Turbo 21 v2 by pogo
    Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Turbo 21 v2 by pogo\DownloadInformation\\INF .
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Turbo 21 v2 by pogo\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Turbo 21 v2 by pogo\ not found.
    Starting removal of ActiveX control Word Whomp Whackdown by pogo
    Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Word Whomp Whackdown by pogo\DownloadInformation\\INF .
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Word Whomp Whackdown by pogo\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Word Whomp Whackdown by pogo\ not found.
    Starting removal of ActiveX control Yahtzee Party by pogo
    Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Yahtzee Party by pogo\DownloadInformation\\INF .
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Yahtzee Party by pogo\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Yahtzee Party by pogo\ not found.
    C:\Program Files\Microsoft Security Essentials(2)\en-us(2) folder moved successfully.
    C:\Program Files\Microsoft Security Essentials(2)\Backup(2)\en-us(2) folder moved successfully.
    C:\Program Files\Microsoft Security Essentials(2)\Backup(2) folder moved successfully.
    C:\Program Files\Microsoft Security Essentials(2) folder moved successfully.
    C:\Program Files\Microsoft Security Essentials\en-us folder moved successfully.
    C:\Program Files\Microsoft Security Essentials\Backup\en-us folder moved successfully.
    C:\Program Files\Microsoft Security Essentials\Backup folder moved successfully.
    C:\Program Files\Microsoft Security Essentials folder moved successfully.
    ========== SERVICES/DRIVERS ==========
    ========== REGISTRY ==========
    ========== FILES ==========
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: Administrator
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: All Users

    User: Daylene Croy
    ->Temp folder emptied: 32768 bytes
    ->Temporary Internet Files folder emptied: 2748702 bytes
    ->Java cache emptied: 0 bytes
    ->Flash cache emptied: 456 bytes

    User: Default User
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    User: Elda Reynolds
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: LocalService
    ->Temp folder emptied: 65536 bytes
    ->Temporary Internet Files folder emptied: 32835 bytes

    User: NetworkService
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 0 bytes
    %systemroot%\System32\dllcache .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 0 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
    RecycleBin emptied: 0 bytes

    Total Files Cleaned = 3.00 mb


    [EMPTYFLASH]

    User: Administrator

    User: All Users

    User: Daylene Croy
    ->Flash cache emptied: 0 bytes

    User: Default User
    ->Flash cache emptied: 0 bytes

    User: Elda Reynolds

    User: LocalService

    User: NetworkService

    Total Flash Files Cleaned = 0.00 mb


    OTL by OldTimer - Version 3.2.17.1 log created on 10242010_201507

    Files\Folders moved on Reboot...
    C:\Documents and Settings\Daylene Croy\Local Settings\Temp\~DFD86E.tmp moved successfully.
    C:\Documents and Settings\Daylene Croy\Local Settings\Temporary Internet Files\Content.IE5\UBUKSYBM\sh25[1].html moved successfully.
    C:\Documents and Settings\Daylene Croy\Local Settings\Temporary Internet Files\Content.IE5\QMSAIMES\topic155303-2[1].html moved successfully.

    Registry entries deleted on Reboot...
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...