Inactive 8 steps completed; logs provided

No worries. Thanks Bobbye.

Hello,

I'm sorry about the confusion I've caused here. The total number of computers I have is 2. I have a computer which I use at home for leisure (for clarity, I'll start caling that the "leisure computer"), and a second computer that I use primarily for work purposes but which I also use at home (the "work computer"). The work computer was the initial infected one and the one with which Bobbye has been assisting me.

I then decided to check the leisure computer out as well. I started the thread you've numbered 1 ("Avast thinks the download of GMER has a "win32:trojan-gen" infection") because I was having trouble downloading GMER on the leisure computer. I left that thread because that particular issue was resolved. I thought (mistakenly it seems) I should post the logs from the lesiure computer as a new thread, since they were about having the computer scanned which was - I thought - a separate issue from the downloading problem.

When I say they're on a home network - they both access the same wirless print server and they both get their internet via wi-fi from the same source. There is no sharing of drives or anything like that though.

I'm not sure what I should do now. Do you still want me to post the ESET log? (it didn't find anything).

My advice is to disconnect this PC from the network (and any other) until Bobbye has cleared the infected one.
Is this particular PC showing symptoms of malware?

Ok, thanks Crunchie. It's not showing signs of any problem at all, I just wanted to play it safe. I'll wait and see what comes about from the work computer.

Cheers.

The wrap up- I think!

Original Work laptop:

https://www.techspot.com/vb/topic156987.html> original thread, Antivirus 2010. I left instructions for you to rerun Combofix and run HJT. I hadn't gone over them yet and written the script.
This is the work computer- is that correct?

Click to expand...

Second computer> I started helping you but you did not leave the logs.

https://www.techspot.com/vb/topic157039.html> 2nd computer where I am helping you.
You has an Avast/GMER problem which you resolved. My last request was "Please leave logs when finished." You should have then gone on to add the logs after you ran the scans.

Click to expand...

Instead you started this third thread- same second computer> you left the requested logs here.
https://www.techspot.com/vb/topic157263.html> 2nd computer

Click to expand...

You started the thread for the second computer because you thought it 'might be' infected. I picked up the thread- you were having a problem with one of the scans. It got resolved so you started a new thread.

I for one was very confused and have spent a lot of time trying to figure out what you did. I'm going to close the second thread with the GMER problem and I will back off that computer.

Crunchie, why don't you just help her with this, the second system, with no regard for the other. She isn't print or file sharing and has not indication of a DNS infection.

Ignorance, please keep anything about the second computer- the leisure one, here
I will help you separately on the work laptop and everything for and about that system must go on the original thread.

No worries Bobbye.

Let's look a little deeper just to be sure then.

Download OTL to your Desktop.

* Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
* Under the Custom Scan box paste this in:


netsvcs
%SYSTEMDRIVE%\*.exe
/md5start
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
sceclt.dll
ntelogon.dll
logevent.dll
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
/md5stop
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\System32\config\*.sav
CREATERESTOREPOINT


* Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

• When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
• Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.

==============

Go to Kaspersky website and perform an online antivirus scan.

1. Disable your active antivirus program.
2. Read through the requirements and privacy statement and click on the Accept button.
3. It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
4. When the downloads have finished, click on Settings.
5. Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:

• Spyware, Adware, Dialers, and other potentially dangerous programs
  [*] Archives
  [*] Mail databases

6. Click on My Computer under Scan.
7. Once the scan is complete, it will display the results. Click on View Scan Report.
8. You will see a list of infected items there. Click on Save Report As....
9. Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button. Then post it here.

Bobbye - yes that summary is correct. I thought I was doing the right thing. Sorry once again.

Crunchie - thanks for your help. The 2 logs from OTL are below. When I went to run Kaspersky, I got a warning message that said:

"Java has discovered application components that could indicate a secrity concern.

Name: javavm
Block potentially unsafe components from being run? (recommended)

The application contains both signed and unsigned code. Contact the application vendor to ensure it has not been tampered with".

Should I proced with the scan? And do I need to "Block potentially unsafe components "?

Cheers.

OTL.txt:

OTL logfile created on: 29/11/2010 6:56:12 PM - Run 1
OTL by OldTimer - Version 3.2.17.3 Folder = C:\Documents and Settings\Bek\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000C09 | Country: Australia | Language: ENA | Date Format: d/MM/yyyy

767.00 Mb Total Physical Memory | 473.00 Mb Available Physical Memory | 62.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 86.00% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 37.25 Gb Total Space | 6.71 Gb Free Space | 18.02% Space Free | Partition Type: NTFS

Computer Name: LAPTOP | User Name: Bek | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2010/11/29 18:51:12 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Bek\Desktop\OTL.exe
PRC - [2010/09/08 02:12:02 | 002,838,912 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastUI.exe
PRC - [2010/09/08 02:11:59 | 000,040,384 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
PRC - [2009/04/30 12:23:26 | 000,090,112 | ---- | M] () -- C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe
PRC - [2008/04/14 05:42:20 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2008/02/22 05:25:21 | 000,144,784 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
PRC - [2008/02/22 05:25:20 | 000,329,104 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre1.6.0_05\bin\jucheck.exe
PRC - [2003/12/26 11:17:32 | 000,208,972 | ---- | M] (TOSHIBA) -- C:\Program Files\Toshiba\TAudEffect\TAudEff.exe
PRC - [2003/12/16 09:30:06 | 000,356,352 | ---- | M] (Intel Corporation) -- C:\WINDOWS\system32\ZCfgSvc.exe
PRC - [2003/12/16 09:24:20 | 000,184,320 | ---- | M] (Intel) -- C:\WINDOWS\system32\1XConfig.exe
PRC - [2003/12/16 09:23:40 | 000,303,171 | ---- | M] (Intel Corporation ) -- C:\WINDOWS\system32\S24EvMon.exe
PRC - [2003/12/16 09:22:36 | 000,122,880 | ---- | M] (Intel Corporation) -- C:\WINDOWS\system32\RegSrvc.exe
PRC - [2003/12/16 06:54:20 | 000,278,528 | ---- | M] (TOSHIBA Corporation) -- C:\WINDOWS\system32\TPSMain.exe
PRC - [2003/12/16 06:53:56 | 000,045,056 | ---- | M] (TOSHIBA Corporation) -- C:\WINDOWS\system32\TPSBattM.exe
PRC - [2003/12/10 15:50:54 | 000,126,976 | ---- | M] (TOSHIBA) -- C:\Program Files\Toshiba\TME3\TMESRV31.exe
PRC - [2003/12/04 07:26:14 | 000,131,072 | ---- | M] (TOSHIBA Corporation) -- C:\Program Files\Toshiba\TOSHIBA Zooming Utility\SmoothView.exe
PRC - [2003/12/02 19:05:54 | 000,028,672 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files\Toshiba\ConfigFree\CFSvcs.exe
PRC - [2003/11/22 09:49:28 | 000,258,048 | ---- | M] (TOSHIBA Corp.) -- C:\WINDOWS\system32\00THotkey.exe
PRC - [2003/11/17 21:42:12 | 000,073,728 | ---- | M] (TOSHIBA Corp.) -- C:\WINDOWS\system32\TFNF5.exe
PRC - [2003/11/12 15:19:04 | 000,159,744 | ---- | M] (TOSHIBA) -- C:\Program Files\Toshiba\DualPointUtility\TEDTray.exe
PRC - [2003/10/22 00:28:42 | 000,065,536 | ---- | M] (TOSHIBA) -- C:\Program Files\Toshiba\Bluetooth Monitor\BtMon.exe
PRC - [2003/10/07 12:43:50 | 000,077,824 | ---- | M] (TOSHIBA) -- C:\Program Files\Toshiba\TME3\TMERzCtl.exe
PRC - [2003/09/19 17:32:32 | 000,077,824 | ---- | M] (TOSHIBA) -- C:\Program Files\Toshiba\TME3\TMEEJME.exe
PRC - [2003/08/19 04:51:02 | 000,102,400 | ---- | M] (TOSHIBA Corporation) -- C:\Program Files\Toshiba\TOSHIBA Controls\TFncKy.exe
PRC - [2003/08/02 09:56:02 | 000,086,016 | ---- | M] (TOSHIBA Corporation) -- C:\Program Files\Toshiba\TME3\tmesbs32.exe
PRC - [2003/05/23 15:38:26 | 000,106,496 | ---- | M] (Matsushita Electric Industrial Co., Ltd.) -- C:\WINDOWS\system32\DVDRAMSV.exe
PRC - [2002/09/21 11:50:10 | 000,045,056 | ---- | M] (Analog Devices, Inc.) -- C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
PRC - [2002/09/10 10:07:34 | 000,049,152 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files\Toshiba\Wireless Hotkey\TosHKCW.exe
PRC - [2002/08/20 12:29:26 | 000,040,960 | ---- | M] (Easy Systems Japan Ltd.) -- C:\WINDOWS\system32\ezSP_Px.exe
PRC - [2002/05/03 15:01:06 | 000,444,928 | ---- | M] (University of Ballarat) -- C:\WINDOWS\system32\UBDesktopLdr.exe
PRC - [2000/11/17 01:02:00 | 000,114,688 | ---- | M] (SEIKO EPSON CORPORATION) -- C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe


========== Modules (SafeList) ==========

MOD - [2010/11/29 18:51:12 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Bek\Desktop\OTL.exe
MOD - [2010/08/24 03:12:02 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] -- C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe -- (Macromedia Licensing Service)
SRV - File not found [Disabled | Stopped] -- C:\WINDOWS\System32\hidserv.dll -- (HidServ)
SRV - [2010/09/08 02:11:59 | 000,040,384 | ---- | M] (AVAST Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Web Scanner)
SRV - [2010/09/08 02:11:59 | 000,040,384 | ---- | M] (AVAST Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Mail Scanner)
SRV - [2010/09/08 02:11:59 | 000,040,384 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus)
SRV - [2009/04/30 12:23:26 | 000,090,112 | ---- | M] () [Auto | Running] -- C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe -- (OMSI download service)
SRV - [2008/04/04 14:37:58 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2003/12/16 09:23:40 | 000,303,171 | ---- | M] (Intel Corporation ) [Auto | Running] -- C:\WINDOWS\system32\S24EvMon.exe -- (S24EventMonitor)
SRV - [2003/12/16 09:22:36 | 000,122,880 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\WINDOWS\system32\RegSrvc.exe -- (RegSrvc)
SRV - [2003/12/10 15:50:54 | 000,126,976 | ---- | M] (TOSHIBA) [Auto | Running] -- C:\Program Files\TOSHIBA\TME3\Tmesrv31.exe -- (Tmesrv)
SRV - [2003/12/02 19:05:54 | 000,028,672 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- C:\Program Files\Toshiba\ConfigFree\CFSvcs.exe -- (CFSvcs)
SRV - [2003/08/02 09:56:02 | 000,086,016 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Program Files\TOSHIBA\TME3\Tmesbs32.exe -- (Tmesbs)
SRV - [2003/05/23 15:38:26 | 000,106,496 | ---- | M] (Matsushita Electric Industrial Co., Ltd.) [Auto | Running] -- C:\WINDOWS\system32\DVDRAMSV.exe -- (DVD-RAM_Service)
SRV - [2002/09/21 11:50:10 | 000,045,056 | ---- | M] (Analog Devices, Inc.) [Auto | Running] -- C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe -- (SoundMAX Agent Service (default))
SRV - [2002/05/03 15:01:06 | 000,444,928 | ---- | M] (University of Ballarat) [Auto | Running] -- C:\WINDOWS\system32\UBDesktopLdr.exe -- (UBDesktopLdrNTSvc)
SRV - [2002/05/03 15:00:42 | 000,598,528 | ---- | M] (University of Ballarat) [Auto | Stopped] -- C:\WINDOWS\system32\UBDesktopSvc.exe -- (UBDesktopSvcNTSvc)
SRV - [2000/11/17 01:02:00 | 000,114,688 | ---- | M] (SEIKO EPSON CORPORATION) [Auto | Running] -- C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe -- (EPSONStatusAgent2)


========== Driver Services (SafeList) ==========

DRV - [2010/09/08 01:52:25 | 000,046,672 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2010/09/08 01:52:03 | 000,165,584 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2010/09/08 01:47:46 | 000,023,376 | ---- | M] (AVAST Software) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\aswRdr.sys -- (aswRdr)
DRV - [2010/09/08 01:47:19 | 000,100,176 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswmon2.sys -- (aswMon2)
DRV - [2010/09/08 01:47:07 | 000,017,744 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2010/09/08 01:46:51 | 000,028,880 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aavmker4.sys -- (Aavmker4)
DRV - [2010/01/28 14:34:05 | 000,025,512 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ggsemc.sys -- (ggsemc)
DRV - [2010/01/28 14:34:05 | 000,013,224 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ggflt.sys -- (ggflt)
DRV - [2008/10/01 13:07:15 | 000,014,976 | ---- | M] (Sophos Plc) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\drivers\SophosBootDriver.sys -- (SophosBootDriver)
DRV - [2008/10/01 13:07:11 | 000,104,704 | ---- | M] (Sophos Plc) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\savonaccesscontrol.sys -- (SAVOnAccessControl)
DRV - [2008/10/01 13:07:09 | 000,035,584 | ---- | M] (Sophos Plc) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\savonaccessfilter.sys -- (SAVOnAccessFilter)
DRV - [2008/04/03 06:03:08 | 001,333,152 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\athw.sys -- (AR5416)
DRV - [2008/01/09 12:28:34 | 000,027,632 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\seehcri.sys -- (seehcri)
DRV - [2007/06/25 12:43:38 | 000,098,344 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s117obex.sys -- (s117obex)
DRV - [2007/06/25 12:43:36 | 000,108,456 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s117mdm.sys -- (s117mdm)
DRV - [2007/06/25 12:43:36 | 000,100,264 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s117mgmt.sys -- (s117mgmt) Sony Ericsson Device 117 USB WMC Device Management Drivers (WDM)
DRV - [2007/06/25 12:43:36 | 000,098,856 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s117unic.sys -- (s117unic) Sony Ericsson Device 117 USB Ethernet Emulation SEMC117 (WDM)
DRV - [2007/06/25 12:43:36 | 000,022,952 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s117nd5.sys -- (s117nd5) Sony Ericsson Device 117 USB Ethernet Emulation SEMC117 (NDIS)
DRV - [2007/06/25 12:43:26 | 000,014,888 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s117mdfl.sys -- (s117mdfl)
DRV - [2007/06/25 12:43:22 | 000,082,984 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s117bus.sys -- (s117bus) Sony Ericsson Device 117 driver (WDM)
DRV - [2005/09/12 19:08:30 | 000,468,736 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ar5211.sys -- (AR5211)
DRV - [2004/01/10 14:26:46 | 000,028,416 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\TEchoCan.sys -- (TEchoCan)
DRV - [2004/01/07 15:29:39 | 000,008,605 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Tosrfec.sys -- (tosrfec)
DRV - [2003/12/17 15:08:46 | 000,013,312 | ---- | M] (National Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\NscTpmDD.sys -- (portio)
DRV - [2003/12/16 09:16:26 | 000,010,970 | ---- | M] (Intel Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\s24trans.sys -- (s24trans)
DRV - [2003/12/10 19:11:26 | 000,100,153 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Apfiltr.sys -- (ApfiltrService)
DRV - [2003/12/10 08:50:00 | 001,373,436 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv)
DRV - [2003/12/05 21:50:28 | 000,979,840 | R--- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\w70n51.sys -- (w70n51) Intel(R)
DRV - [2003/10/24 15:53:14 | 000,090,416 | ---- | M] (Matsushita Electric Industrial Co.,Ltd.) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\meiudf.sys -- (meiudf)
DRV - [2003/08/24 21:57:00 | 000,010,240 | ---- | M] (Padus, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\pfc.sys -- (Pfc)
DRV - [2003/08/08 10:52:00 | 000,009,216 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\TVALZ.SYS -- (TVALZ)
DRV - [2003/01/29 16:35:00 | 000,012,032 | ---- | M] (TOSHIBA Corporation.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\Netdevio.sys -- (Netdevio)
DRV - [2002/12/21 08:07:34 | 001,164,576 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AGRSM.sys -- (AgereSoftModem)
DRV - [2002/11/18 19:20:44 | 000,030,976 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\gv3.sys -- (gv3)
DRV - [2002/09/27 08:15:28 | 000,005,760 | ---- | M] (Toshiba Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\TMEI3E.sys -- (TMEI3E)
DRV - [2002/04/07 14:50:56 | 000,019,607 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\System32\drivers\TOSSMBNT.sys -- (tossmbnt)
DRV - [2001/09/11 13:54:32 | 000,038,425 | ---- | M] (SMC) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\smcirda.sys -- (SMCIRDA)
DRV - [2001/08/17 23:13:20 | 000,027,164 | ---- | M] (Xircom, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\CE3N5.SYS -- (CE3)
DRV - [2001/08/17 14:53:32 | 000,003,328 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\qv2kux.sys -- (QV2KUX)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com.au/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.ballarat.edu.au*
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = proxy.ballarat.edu.au:8080

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.google.com.au/"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.2.2
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/11/08 22:11:43 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/10/30 14:51:16 | 000,000,000 | ---D | M]

[2008/12/16 16:43:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bek\Application Data\Mozilla\Extensions
[2010/11/29 18:51:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bek\Application Data\Mozilla\Firefox\Profiles\9azh5w1w.default\extensions
[2010/10/22 17:36:37 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Documents and Settings\Bek\Application Data\Mozilla\Firefox\Profiles\9azh5w1w.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010/11/29 18:51:45 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2010/09/22 12:59:41 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010/09/22 12:59:16 | 000,423,656 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll

O1 HOSTS File: ([2003/03/31 23:00:00 | 000,000,734 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (no name) - -{39EA7695-B3F2-4C44-A4BC-297ADA8FD235} - No CLSID value found.
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [000StTHK] C:\WINDOWS\System32\000StTHK.exe ()
O4 - HKLM..\Run: [00THotkey] C:\WINDOWS\system32\00THotkey.exe (TOSHIBA Corp.)
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\AvastUI.exe (AVAST Software)
O4 - HKLM..\Run: [BluetoothAuthenticationAgent] C:\WINDOWS\System32\bthprops.cpl (Microsoft Corporation)
O4 - HKLM..\Run: [DpUtil] C:\Program Files\Toshiba\DualPointUtility\TEDTray.exe (TOSHIBA)
O4 - HKLM..\Run: [ezShieldProtector for Px] C:\WINDOWS\system32\ezSP_Px.exe (Easy Systems Japan Ltd.)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NVRotateSysTray] C:\WINDOWS\System32\nvsysrot.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [PRONoMgr.exe] C:\Program Files\Intel\PROSetWireless\NCS\PROSet\PRONoMgr.exe (Intel(R) Corporation)
O4 - HKLM..\Run: [SmoothView] C:\Program Files\Toshiba\TOSHIBA Zooming Utility\SmoothView.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [TAudEffect] C:\Program Files\Toshiba\TAudEffect\TAudEff.exe (TOSHIBA)
O4 - HKLM..\Run: [TFncKy] File not found
O4 - HKLM..\Run: [TFNF5] C:\WINDOWS\System32\TFNF5.exe (TOSHIBA Corp.)
O4 - HKLM..\Run: [TMERzCtl.EXE] C:\Program Files\TOSHIBA\TME3\TMERzCtl.EXE (TOSHIBA)
O4 - HKLM..\Run: [TMESBS.EXE] C:\Program Files\TOSHIBA\TME3\TMESBS32.EXE (TOSHIBA Corporation)
O4 - HKLM..\Run: [TMESRV.EXE] C:\Program Files\TOSHIBA\TME3\TMESRV31.EXE (TOSHIBA)
O4 - HKLM..\Run: [TosHKCW.exe] C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe (TOSHIBA CORPORATION)
O4 - HKLM..\Run: [TPSMain] C:\WINDOWS\System32\TPSMain.exe (TOSHIBA Corporation)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Bluetooth Monitor.lnk = C:\Program Files\Toshiba\Bluetooth Monitor\BtMon.exe (TOSHIBA)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV02.EXE (SEIKO EPSON CORPORATION)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMConfigurePrograms = 1
O8 - Extra context menu item: Append to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert link target to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert link target to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selected links to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selected links to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selection to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selection to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Computer, Inc.)
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} http://office.microsoft.com/officeupdate/content/opuc.cab (Office Update Installation Engine)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://www.update.microsoft.com/mic...ls/en/x86/client/wuweb_site.cab?1207271305714 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1207271280388 (MUWebControl Class)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} file://C:\WINDOWS\msxml4.cab (XML DOM Document 4.0)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38120.7486458333 (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Java Plug-in 1.6.0_05)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\Sebring: DllName - C:\WINDOWS\System32\LgNotify.dll - C:\WINDOWS\system32\LgNotify.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Bek\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Bek\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/01/08 06:58:37 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{5c6f334c-54eb-11df-bff9-00037a205c33}\Shell - "" = AutoRun
O33 - MountPoints2\{5c6f334c-54eb-11df-bff9-00037a205c33}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{5c6f334c-54eb-11df-bff9-00037a205c33}\Shell\AutoRun\command - "" = E:\Connect.exe -- File not found
O33 - MountPoints2\{fd2af9a0-d7cc-11dd-bf73-0011f540fd3d}\Shell\AutoRun\command - "" = E:\InstallTomTomHOME.exe -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: HidServ - C:\WINDOWS\System32\hidserv.dll File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: LanmanWorkstation - File not found
NetSvcs: Messenger - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: Ip6FwHlp - File not found

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (16902109354000384)

========== Files/Folders - Created Within 30 Days ==========

[2010/11/29 18:51:10 | 000,575,488 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Bek\Desktop\OTL.exe
[2010/11/28 19:01:25 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Bek\Desktop\ThankYou_files
[2010/11/28 11:38:20 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2010/11/27 15:27:43 | 000,000,000 | ---D | C] -- C:\Temp
[2010/11/24 21:29:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage
[2010/11/24 20:12:34 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2010/11/24 19:28:20 | 000,000,000 | ---D | C] -- C:\155fabfce8180507d7bcc33f6b74
[2010/11/24 18:57:23 | 000,000,000 | ---D | C] -- C:\c458b24023cda7e0db44e1eb04
[2010/11/24 18:57:02 | 000,000,000 | ---D | C] -- C:\4bc0d45331d96606d8deee59
[2010/11/24 18:47:31 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\zh-TW
[2010/11/24 18:47:31 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\zh-HK
[2010/11/24 18:47:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\tr-TR
[2010/11/24 18:47:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\sv-SE
[2010/11/24 18:47:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\pt-BR
[2010/11/24 18:47:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\nl-NL
[2010/11/24 18:47:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\nb-NO
[2010/11/24 18:47:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\ko-KR
[2010/11/24 18:47:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\it-IT
[2010/11/24 18:47:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\he-IL
[2010/11/24 18:47:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\fr-FR
[2010/11/24 18:47:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\fi-FI
[2010/11/24 18:47:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\es-ES
[2010/11/24 18:47:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\el-GR
[2010/11/24 18:47:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\de-DE
[2010/11/24 18:47:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\da-DK
[2010/11/24 18:47:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\ar-SA
[2010/11/24 17:00:16 | 000,000,000 | ---D | C] -- C:\WINDOWS\ie8updates
[2010/11/23 19:16:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Bek\Application Data\Malwarebytes
[2010/11/23 19:16:09 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/11/23 19:16:07 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010/11/23 19:16:07 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010/11/23 19:16:07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2010/11/23 18:53:12 | 000,446,464 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Bek\Desktop\TFC.exe
[2010/11/10 20:53:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Bek\Desktop\Mum's rescued documents
[2010/11/06 20:43:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Bek\Desktop\confirmation.jsp_files
[2010/01/31 17:27:13 | 000,148,736 | ---- | C] (Avanquest Software) -- C:\Documents and Settings\All Users\Application Data\hpe3.dll

========== Files - Modified Within 30 Days ==========

[2010/11/29 18:51:12 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Bek\Desktop\OTL.exe
[2010/11/29 18:42:03 | 000,000,198 | ---- | M] () -- C:\PSLOG
[2010/11/29 18:40:54 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/11/29 18:40:00 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/11/29 18:39:56 | 804,638,720 | -HS- | M] () -- C:\hiberfil.sys
[2010/11/28 19:01:29 | 000,022,585 | ---- | M] () -- C:\Documents and Settings\Bek\Desktop\ThankYou.htm
[2010/11/27 16:57:40 | 000,296,448 | ---- | M] () -- C:\Documents and Settings\Bek\Desktop\vere70t1.exe
[2010/11/27 15:42:55 | 000,594,254 | ---- | M] () -- C:\Documents and Settings\Bek\Desktop\uninstall.reg
[2010/11/27 15:27:23 | 000,436,520 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010/11/27 15:27:22 | 000,070,152 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010/11/27 15:13:42 | 000,018,614 | ---- | M] () -- C:\Documents and Settings\Bek\Desktop\sophos.bat
[2010/11/27 15:09:30 | 000,001,393 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2010/11/24 21:28:46 | 001,569,080 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010/11/24 20:00:53 | 000,000,153 | ---- | M] () -- C:\WINDOWS\WININIT.INI
[2010/11/23 19:16:12 | 000,000,703 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/11/23 18:53:26 | 000,446,464 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Bek\Desktop\TFC.exe
[2010/11/23 18:34:08 | 000,002,626 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
[2010/11/21 19:46:54 | 000,015,360 | ---- | M] () -- C:\Documents and Settings\Bek\My Documents\Book2.xls
[2010/11/13 21:53:40 | 000,018,432 | ---- | M] () -- C:\Documents and Settings\Bek\Desktop\grade1-2_assessment_data_end_2010.xls
[2010/11/07 17:15:43 | 000,098,816 | ---- | M] () -- C:\Documents and Settings\Bek\My Documents\You are hereby invited to attend.doc
[2010/11/06 22:08:17 | 000,040,408 | ---- | M] () -- C:\Documents and Settings\Bek\Desktop\uniball08-20.JPG
[2010/11/06 22:06:39 | 000,030,099 | ---- | M] () -- C:\Documents and Settings\Bek\Desktop\uniball08-12.JPG
[2010/11/06 22:04:42 | 000,030,527 | ---- | M] () -- C:\Documents and Settings\Bek\Desktop\uniball08-5.JPG
[2010/11/06 20:44:22 | 000,345,838 | ---- | M] () -- C:\Documents and Settings\Bek\Desktop\alto.xps
[2010/11/06 20:43:53 | 000,019,503 | ---- | M] () -- C:\Documents and Settings\Bek\Desktop\confirmation.jsp.htm

========== Files Created - No Company Name ==========

[2010/11/28 19:01:24 | 000,022,585 | ---- | C] () -- C:\Documents and Settings\Bek\Desktop\ThankYou.htm
[2010/11/27 19:24:17 | 804,638,720 | -HS- | C] () -- C:\hiberfil.sys
[2010/11/27 16:57:36 | 000,296,448 | ---- | C] () -- C:\Documents and Settings\Bek\Desktop\vere70t1.exe
[2010/11/27 15:42:55 | 000,594,254 | ---- | C] () -- C:\Documents and Settings\Bek\Desktop\uninstall.reg
[2010/11/27 15:13:42 | 000,018,614 | ---- | C] () -- C:\Documents and Settings\Bek\Desktop\sophos.bat
[2010/11/23 19:16:12 | 000,000,703 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/11/13 21:31:48 | 000,018,432 | ---- | C] () -- C:\Documents and Settings\Bek\Desktop\grade1-2_assessment_data_end_2010.xls
[2010/11/07 17:15:41 | 000,098,816 | ---- | C] () -- C:\Documents and Settings\Bek\My Documents\You are hereby invited to attend.doc
[2010/11/06 22:08:17 | 000,040,408 | ---- | C] () -- C:\Documents and Settings\Bek\Desktop\uniball08-20.JPG
[2010/11/06 22:06:39 | 000,030,099 | ---- | C] () -- C:\Documents and Settings\Bek\Desktop\uniball08-12.JPG
[2010/11/06 22:04:42 | 000,030,527 | ---- | C] () -- C:\Documents and Settings\Bek\Desktop\uniball08-5.JPG
[2010/11/06 20:44:19 | 000,345,838 | ---- | C] () -- C:\Documents and Settings\Bek\Desktop\alto.xps
[2010/11/06 20:43:51 | 000,019,503 | ---- | C] () -- C:\Documents and Settings\Bek\Desktop\confirmation.jsp.htm
[2010/09/28 19:51:03 | 000,000,000 | ---- | C] () -- C:\WINDOWS\HPMProp.INI
[2010/09/28 19:43:14 | 000,200,704 | ---- | C] () -- C:\WINDOWS\System32\Bot.dll
[2010/09/28 19:43:14 | 000,000,101 | ---- | C] () -- C:\WINDOWS\Psxlpr.ini
[2009/08/03 15:07:42 | 000,403,816 | ---- | C] () -- C:\WINDOWS\System32\OGACheckControl.dll
[2008/09/30 21:02:05 | 000,001,024 | ---- | C] () -- C:\WINDOWS\System32\grcauth2.dll
[2008/09/30 21:02:05 | 000,001,024 | ---- | C] () -- C:\WINDOWS\System32\grcauth1.dll
[2008/09/30 21:02:05 | 000,000,100 | ---- | C] () -- C:\WINDOWS\System32\prsgrc.dll
[2008/09/07 23:44:44 | 000,005,120 | ---- | C] () -- C:\Documents and Settings\Bek\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/06/12 00:00:39 | 000,000,126 | ---- | C] () -- C:\Documents and Settings\Bek\Local Settings\Application Data\fusioncache.dat
[2008/06/02 19:08:03 | 000,023,253 | ---- | C] () -- C:\WINDOWS\UBDesktop.ini
[2008/05/20 01:06:50 | 000,000,097 | ---- | C] () -- C:\WINDOWS\WirelessFTP.INI
[2008/04/04 14:51:33 | 002,463,976 | ---- | C] () -- C:\WINDOWS\System32\NPSWF32.dll
[2007/02/13 13:51:14 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\setupw2k.dll
[2007/02/13 13:51:13 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\nwslog32.dll
[2007/02/12 16:17:10 | 000,001,024 | ---- | C] () -- C:\WINDOWS\System32\clauth2.dll
[2007/02/12 16:17:10 | 000,001,024 | ---- | C] () -- C:\WINDOWS\System32\clauth1.dll
[2007/02/12 16:17:10 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\ssprs.dll
[2007/02/12 16:17:10 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\serauth2.dll
[2007/02/12 16:17:10 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\serauth1.dll
[2007/02/12 16:17:10 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\nsprs.dll
[2007/02/12 16:15:15 | 000,001,025 | ---- | C] () -- C:\WINDOWS\System32\sysprs7.dll
[2007/02/12 16:15:15 | 000,000,205 | ---- | C] () -- C:\WINDOWS\System32\lsprst7.dll
[2007/02/09 17:28:06 | 000,002,276 | ---- | C] () -- C:\WINDOWS\opera.ini
[2006/06/13 18:05:00 | 000,757,818 | ---- | C] () -- C:\WINDOWS\System32\gwadd1.dll
[2006/06/13 16:21:06 | 000,303,166 | ---- | C] () -- C:\WINDOWS\System32\gwodm132.dll
[2006/06/13 15:37:20 | 000,098,354 | ---- | C] () -- C:\WINDOWS\System32\GWLDO132.DLL
[2004/07/09 10:31:18 | 000,155,700 | ---- | C] () -- C:\WINDOWS\System32\ODMA32.DLL
[2004/05/17 14:23:04 | 000,000,199 | ---- | C] () -- C:\WINDOWS\swacnfg.ini
[2004/05/15 05:56:44 | 000,204,800 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeW7.dll
[2004/05/15 05:56:44 | 000,200,704 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeA6.dll
[2004/05/15 05:56:44 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeP6.dll
[2004/05/15 05:56:44 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeM6.dll
[2004/05/15 05:56:44 | 000,188,416 | ---- | C] () -- C:\WINDOWS\System32\IVIresizePX.dll
[2004/05/15 05:56:44 | 000,020,480 | ---- | C] () -- C:\WINDOWS\System32\IVIresize.dll
[2004/05/15 05:32:40 | 000,010,165 | ---- | C] () -- C:\WINDOWS\System32\tosmreg.ini
[2004/05/15 05:32:39 | 000,128,113 | ---- | C] () -- C:\WINDOWS\System32\csellang.ini
[2004/05/15 05:32:39 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\csellang.dll
[2004/05/15 05:32:39 | 000,007,671 | ---- | C] () -- C:\WINDOWS\System32\cseltbl.ini
[2004/05/14 16:42:30 | 000,000,153 | ---- | C] () -- C:\WINDOWS\WININIT.INI
[2004/01/14 06:23:00 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2004/01/08 09:10:02 | 000,000,908 | ---- | C] () -- C:\WINDOWS\System32\Px.ini
[2004/01/08 09:01:44 | 000,019,607 | ---- | C] () -- C:\WINDOWS\System32\drivers\TOSSMBNT.sys
[2004/01/08 08:59:01 | 000,000,000 | ---- | C] () -- C:\WINDOWS\NDSTray.INI
[2004/01/08 07:29:28 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2004/01/08 07:22:03 | 000,363,520 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2004/01/08 07:19:02 | 000,000,791 | ---- | C] () -- C:\WINDOWS\orun32.ini
[2004/01/08 07:02:01 | 000,122,880 | ---- | C] () -- C:\WINDOWS\System32\e1000msg.dll
[2004/01/08 07:02:00 | 000,016,384 | ---- | C] () -- C:\WINDOWS\System32\e100bmsg.dll
[2004/01/08 05:43:57 | 000,000,350 | -H-- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2004/01/07 22:51:38 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2004/01/07 15:29:37 | 001,478,656 | ---- | C] () -- C:\WINDOWS\System32\TosMousePage.dll
[2004/01/07 15:29:36 | 000,770,048 | ---- | C] () -- C:\WINDOWS\System32\TosKeyboardPage.dll
[2004/01/07 15:29:35 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\TosBtHcrpAPI.dll
[2004/01/07 15:29:33 | 000,114,688 | ---- | C] () -- C:\WINDOWS\System32\TosBtAcc.dll
[2004/01/07 15:29:32 | 000,114,688 | ---- | C] () -- C:\WINDOWS\System32\TBTMonUI.dll
[2003/12/16 09:29:42 | 000,204,800 | ---- | C] () -- C:\WINDOWS\System32\C1XStngs.dll
[2002/12/04 11:57:00 | 000,651,264 | ---- | C] () -- C:\WINDOWS\System32\libeay32.dll
[2002/12/04 11:57:00 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\ssleay32.dll

========== LOP Check ==========

[2010/09/22 12:42:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Alwil Software
[2008/04/04 15:40:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SafeNet Sentinel
[2008/08/26 14:15:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Sony
[2008/04/04 15:38:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SPSS
[2008/06/09 20:55:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\X-Setup Pro
[2008/06/12 00:15:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bek\Application Data\FileZilla
[2004/01/08 09:13:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bek\Application Data\InterTrust
[2008/04/09 12:36:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bek\Application Data\InterVideo
[2008/05/15 23:07:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bek\Application Data\iPodder
[2008/08/26 14:15:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bek\Application Data\Sony
[2004/01/08 09:01:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bek\Application Data\toshiba
[2008/06/09 20:55:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bek\Application Data\X-Setup Pro

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.exe >


< MD5 for: AGP440.SYS >
[2007/02/13 15:28:59 | 022,245,337 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2008/04/14 05:51:44 | 020,056,462 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2007/02/13 15:28:59 | 022,245,337 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp2.cab:AGP440.sys
[2008/04/14 05:51:44 | 020,056,462 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
[2008/04/14 00:06:40 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008/04/14 00:06:40 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys
[2004/08/04 17:07:41 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB -- C:\WINDOWS\$NtServicePackUninstall$\agp440.sys

< MD5 for: ATAPI.SYS >
[2003/03/31 23:00:00 | 010,158,890 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp1.cab:atapi.sys
[2007/02/13 15:28:59 | 022,245,337 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2008/04/14 05:51:44 | 020,056,462 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2003/03/31 23:00:00 | 010,158,890 | ---- | M] () .cab file -- C:\WINDOWS\I386\sp1.cab:atapi.sys
[2007/02/13 15:28:59 | 022,245,337 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp2.cab:atapi.sys
[2008/04/14 05:51:44 | 020,056,462 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2003/03/31 23:00:00 | 000,086,912 | ---- | M] (Microsoft Corporation) MD5=95B858761A00E1D4F81F79A0DA019ACA -- C:\WINDOWS\system32\ReinstallBackups\0005\DriverFiles\i386\atapi.sys
[2008/04/14 00:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008/04/14 00:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
[2004/08/04 16:59:42 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys

< MD5 for: EVENTLOG.DLL >
[2008/04/14 05:41:54 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008/04/14 05:41:54 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\system32\eventlog.dll
[2004/08/04 18:56:42 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll

< MD5 for: NETLOGON.DLL >
[2008/04/14 05:42:02 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008/04/14 05:42:02 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\system32\netlogon.dll
[2009/02/07 05:46:09 | 000,408,064 | ---- | M] (Microsoft Corporation) MD5=6C476D33D82F1054849790181E8F7772 -- C:\WINDOWS\SoftwareDistribution\Download\555558d2c7916b118ad5baef62b18136\sp2qfe\netlogon.dll
[2004/08/04 18:56:44 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll

< MD5 for: SCECLI.DLL >
[2004/08/04 18:56:44 | 000,180,224 | ---- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
[2008/04/14 05:42:06 | 000,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008/04/14 05:42:06 | 000,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\system32\scecli.dll

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2004/01/07 22:50:20 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
[2004/01/07 22:50:19 | 000,626,688 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
[2004/01/07 22:50:19 | 000,425,984 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav

< End of report >

Extras.txt:

I don't seem to be able to post this text. It just gives me the message,
"You have included 9 images in your message. You are limited to using 6 images so please go back and correct the problem and then continue again.

Images include use of smilies, the BB code tag and HTML <img> tags. The use of these is all subject to them being enabled by the administrator."

I don't understand this. I looked through the file and couldn't see any img tags. What should I do?

Ok, Java is updated and I've put the extras.txt log (which seems to work fine with code tags - thanks!) and the new OTL one below. Still having trouble with kaspersky though - didn't get the warning message this time, but it couldn't update its virus database and thus wouldn't run the scan. It said:

"Update has failed The program could not be started. Please close the window of Kaspersky Online Scanner 7.0 and start the program again from the web site of Kaspersky Lab.

Successful updating of Kaspersky Online Scanner 7.0 and scanning of your computer requires uninterrupted Internet connection. Please make sure that the Internet connection is established. [ERROR: License has expired]"

My internet connection seems fine. Several restarts in both firefox and internet explorer didn't fix this. Will try again tomorrow.

Here are the logs anyway:

extras.txt:





The OTL one from the custom script:

All processes killed
========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\-{39EA7695-B3F2-4C44-A4BC-297ADA8FD235}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\TFncKy deleted successfully.
========== COMMANDS ==========

[EMPTYFLASH]

User: 2452074

User: Administrator

User: All Users

User: Bek
->Flash cache emptied: 1962 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: LocalService

User: NetworkService

Total Flash Files Cleaned = 0.00 mb


[EMPTYTEMP]

User: 2452074

User: Administrator

User: All Users

User: Bek
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 119541817 bytes
->Java cache emptied: 5400 bytes
->FireFox cache emptied: 77022686 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 483 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 25576726 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 2160431 bytes

Total Files Cleaned = 214.00 mb

C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

OTL by OldTimer - Version 3.2.17.3 log created on 11302010_172914

Files\Folders moved on Reboot...
File\Folder C:\WINDOWS\temp\_avast5_\Webshlock.txt not found!

Registry entries deleted on Reboot...

And the OTL one from the quick scan:

OTL logfile created on: 30/11/2010 5:58:00 PM - Run 2
OTL by OldTimer - Version 3.2.17.3 Folder = C:\Documents and Settings\Bek\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000C09 | Country: Australia | Language: ENA | Date Format: d/MM/yyyy

767.00 Mb Total Physical Memory | 324.00 Mb Available Physical Memory | 42.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 77.00% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 37.25 Gb Total Space | 7.26 Gb Free Space | 19.49% Space Free | Partition Type: NTFS

Computer Name: LAPTOP | User Name: Bek | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2010/11/29 18:51:12 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Bek\Desktop\OTL.exe
PRC - [2010/10/30 14:50:58 | 000,912,344 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2010/09/08 02:12:02 | 002,838,912 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastUI.exe
PRC - [2010/09/08 02:11:59 | 000,040,384 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
PRC - [2009/04/30 12:23:26 | 000,090,112 | ---- | M] () -- C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe
PRC - [2008/04/14 05:42:20 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2003/12/26 11:17:32 | 000,208,972 | ---- | M] (TOSHIBA) -- C:\Program Files\Toshiba\TAudEffect\TAudEff.exe
PRC - [2003/12/16 09:30:06 | 000,356,352 | ---- | M] (Intel Corporation) -- C:\WINDOWS\system32\ZCfgSvc.exe
PRC - [2003/12/16 09:24:20 | 000,184,320 | ---- | M] (Intel) -- C:\WINDOWS\system32\1XConfig.exe
PRC - [2003/12/16 09:23:40 | 000,303,171 | ---- | M] (Intel Corporation ) -- C:\WINDOWS\system32\S24EvMon.exe
PRC - [2003/12/16 09:22:36 | 000,122,880 | ---- | M] (Intel Corporation) -- C:\WINDOWS\system32\RegSrvc.exe
PRC - [2003/12/16 06:54:20 | 000,278,528 | ---- | M] (TOSHIBA Corporation) -- C:\WINDOWS\system32\TPSMain.exe
PRC - [2003/12/16 06:53:56 | 000,045,056 | ---- | M] (TOSHIBA Corporation) -- C:\WINDOWS\system32\TPSBattM.exe
PRC - [2003/12/10 15:50:54 | 000,126,976 | ---- | M] (TOSHIBA) -- C:\Program Files\Toshiba\TME3\TMESRV31.exe
PRC - [2003/12/04 07:26:14 | 000,131,072 | ---- | M] (TOSHIBA Corporation) -- C:\Program Files\Toshiba\TOSHIBA Zooming Utility\SmoothView.exe
PRC - [2003/12/02 19:05:54 | 000,028,672 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files\Toshiba\ConfigFree\CFSvcs.exe
PRC - [2003/11/22 09:49:28 | 000,258,048 | ---- | M] (TOSHIBA Corp.) -- C:\WINDOWS\system32\00THotkey.exe
PRC - [2003/11/17 21:42:12 | 000,073,728 | ---- | M] (TOSHIBA Corp.) -- C:\WINDOWS\system32\TFNF5.exe
PRC - [2003/11/12 15:19:04 | 000,159,744 | ---- | M] (TOSHIBA) -- C:\Program Files\Toshiba\DualPointUtility\TEDTray.exe
PRC - [2003/10/22 00:28:42 | 000,065,536 | ---- | M] (TOSHIBA) -- C:\Program Files\Toshiba\Bluetooth Monitor\BtMon.exe
PRC - [2003/10/07 12:43:50 | 000,077,824 | ---- | M] (TOSHIBA) -- C:\Program Files\Toshiba\TME3\TMERzCtl.exe
PRC - [2003/09/19 17:32:32 | 000,077,824 | ---- | M] (TOSHIBA) -- C:\Program Files\Toshiba\TME3\TMEEJME.exe
PRC - [2003/08/02 09:56:02 | 000,086,016 | ---- | M] (TOSHIBA Corporation) -- C:\Program Files\Toshiba\TME3\tmesbs32.exe
PRC - [2003/05/23 15:38:26 | 000,106,496 | ---- | M] (Matsushita Electric Industrial Co., Ltd.) -- C:\WINDOWS\system32\DVDRAMSV.exe
PRC - [2002/09/21 11:50:10 | 000,045,056 | ---- | M] (Analog Devices, Inc.) -- C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
PRC - [2002/09/10 10:07:34 | 000,049,152 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files\Toshiba\Wireless Hotkey\TosHKCW.exe
PRC - [2002/08/20 12:29:26 | 000,040,960 | ---- | M] (Easy Systems Japan Ltd.) -- C:\WINDOWS\system32\ezSP_Px.exe
PRC - [2002/05/03 15:01:06 | 000,444,928 | ---- | M] (University of Ballarat) -- C:\WINDOWS\system32\UBDesktopLdr.exe
PRC - [2001/01/19 14:00:00 | 000,068,608 | ---- | M] (SEIKO EPSON CORPORATION) -- C:\WINDOWS\system32\spool\drivers\w32x86\3\E_S10IC2.EXE
PRC - [2000/11/17 01:02:00 | 000,114,688 | ---- | M] (SEIKO EPSON CORPORATION) -- C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe


========== Modules (SafeList) ==========

MOD - [2010/11/29 18:51:12 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Bek\Desktop\OTL.exe
MOD - [2010/08/24 03:12:02 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] -- C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe -- (Macromedia Licensing Service)
SRV - File not found [Disabled | Stopped] -- C:\WINDOWS\System32\hidserv.dll -- (HidServ)
SRV - [2010/09/08 02:11:59 | 000,040,384 | ---- | M] (AVAST Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Web Scanner)
SRV - [2010/09/08 02:11:59 | 000,040,384 | ---- | M] (AVAST Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Mail Scanner)
SRV - [2010/09/08 02:11:59 | 000,040,384 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus)
SRV - [2009/04/30 12:23:26 | 000,090,112 | ---- | M] () [Auto | Running] -- C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe -- (OMSI download service)
SRV - [2008/04/04 14:37:58 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2003/12/16 09:23:40 | 000,303,171 | ---- | M] (Intel Corporation ) [Auto | Running] -- C:\WINDOWS\system32\S24EvMon.exe -- (S24EventMonitor)
SRV - [2003/12/16 09:22:36 | 000,122,880 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\WINDOWS\system32\RegSrvc.exe -- (RegSrvc)
SRV - [2003/12/10 15:50:54 | 000,126,976 | ---- | M] (TOSHIBA) [Auto | Running] -- C:\Program Files\TOSHIBA\TME3\Tmesrv31.exe -- (Tmesrv)
SRV - [2003/12/02 19:05:54 | 000,028,672 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- C:\Program Files\Toshiba\ConfigFree\CFSvcs.exe -- (CFSvcs)
SRV - [2003/08/02 09:56:02 | 000,086,016 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Program Files\TOSHIBA\TME3\Tmesbs32.exe -- (Tmesbs)
SRV - [2003/05/23 15:38:26 | 000,106,496 | ---- | M] (Matsushita Electric Industrial Co., Ltd.) [Auto | Running] -- C:\WINDOWS\system32\DVDRAMSV.exe -- (DVD-RAM_Service)
SRV - [2002/09/21 11:50:10 | 000,045,056 | ---- | M] (Analog Devices, Inc.) [Auto | Running] -- C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe -- (SoundMAX Agent Service (default))
SRV - [2002/05/03 15:01:06 | 000,444,928 | ---- | M] (University of Ballarat) [Auto | Running] -- C:\WINDOWS\system32\UBDesktopLdr.exe -- (UBDesktopLdrNTSvc)
SRV - [2002/05/03 15:00:42 | 000,598,528 | ---- | M] (University of Ballarat) [Auto | Stopped] -- C:\WINDOWS\system32\UBDesktopSvc.exe -- (UBDesktopSvcNTSvc)
SRV - [2000/11/17 01:02:00 | 000,114,688 | ---- | M] (SEIKO EPSON CORPORATION) [Auto | Running] -- C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe -- (EPSONStatusAgent2)


========== Driver Services (SafeList) ==========

DRV - [2010/09/08 01:52:25 | 000,046,672 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2010/09/08 01:52:03 | 000,165,584 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2010/09/08 01:47:46 | 000,023,376 | ---- | M] (AVAST Software) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\aswRdr.sys -- (aswRdr)
DRV - [2010/09/08 01:47:19 | 000,100,176 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswmon2.sys -- (aswMon2)
DRV - [2010/09/08 01:47:07 | 000,017,744 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2010/09/08 01:46:51 | 000,028,880 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aavmker4.sys -- (Aavmker4)
DRV - [2010/01/28 14:34:05 | 000,025,512 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ggsemc.sys -- (ggsemc)
DRV - [2010/01/28 14:34:05 | 000,013,224 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ggflt.sys -- (ggflt)
DRV - [2008/10/01 13:07:15 | 000,014,976 | ---- | M] (Sophos Plc) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\drivers\SophosBootDriver.sys -- (SophosBootDriver)
DRV - [2008/10/01 13:07:11 | 000,104,704 | ---- | M] (Sophos Plc) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\savonaccesscontrol.sys -- (SAVOnAccessControl)
DRV - [2008/10/01 13:07:09 | 000,035,584 | ---- | M] (Sophos Plc) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\savonaccessfilter.sys -- (SAVOnAccessFilter)
DRV - [2008/04/03 06:03:08 | 001,333,152 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\athw.sys -- (AR5416)
DRV - [2008/01/09 12:28:34 | 000,027,632 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\seehcri.sys -- (seehcri)
DRV - [2007/06/25 12:43:38 | 000,098,344 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s117obex.sys -- (s117obex)
DRV - [2007/06/25 12:43:36 | 000,108,456 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s117mdm.sys -- (s117mdm)
DRV - [2007/06/25 12:43:36 | 000,100,264 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s117mgmt.sys -- (s117mgmt) Sony Ericsson Device 117 USB WMC Device Management Drivers (WDM)
DRV - [2007/06/25 12:43:36 | 000,098,856 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s117unic.sys -- (s117unic) Sony Ericsson Device 117 USB Ethernet Emulation SEMC117 (WDM)
DRV - [2007/06/25 12:43:36 | 000,022,952 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s117nd5.sys -- (s117nd5) Sony Ericsson Device 117 USB Ethernet Emulation SEMC117 (NDIS)
DRV - [2007/06/25 12:43:26 | 000,014,888 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s117mdfl.sys -- (s117mdfl)
DRV - [2007/06/25 12:43:22 | 000,082,984 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s117bus.sys -- (s117bus) Sony Ericsson Device 117 driver (WDM)
DRV - [2005/09/12 19:08:30 | 000,468,736 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ar5211.sys -- (AR5211)
DRV - [2004/01/10 14:26:46 | 000,028,416 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\TEchoCan.sys -- (TEchoCan)
DRV - [2004/01/07 15:29:39 | 000,008,605 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Tosrfec.sys -- (tosrfec)
DRV - [2003/12/17 15:08:46 | 000,013,312 | ---- | M] (National Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\NscTpmDD.sys -- (portio)
DRV - [2003/12/16 09:16:26 | 000,010,970 | ---- | M] (Intel Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\s24trans.sys -- (s24trans)
DRV - [2003/12/10 19:11:26 | 000,100,153 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Apfiltr.sys -- (ApfiltrService)
DRV - [2003/12/10 08:50:00 | 001,373,436 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv)
DRV - [2003/12/05 21:50:28 | 000,979,840 | R--- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\w70n51.sys -- (w70n51) Intel(R)
DRV - [2003/10/24 15:53:14 | 000,090,416 | ---- | M] (Matsushita Electric Industrial Co.,Ltd.) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\meiudf.sys -- (meiudf)
DRV - [2003/08/24 21:57:00 | 000,010,240 | ---- | M] (Padus, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\pfc.sys -- (Pfc)
DRV - [2003/08/08 10:52:00 | 000,009,216 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\TVALZ.SYS -- (TVALZ)
DRV - [2003/01/29 16:35:00 | 000,012,032 | ---- | M] (TOSHIBA Corporation.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\Netdevio.sys -- (Netdevio)
DRV - [2002/12/21 08:07:34 | 001,164,576 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AGRSM.sys -- (AgereSoftModem)
DRV - [2002/11/18 19:20:44 | 000,030,976 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\gv3.sys -- (gv3)
DRV - [2002/09/27 08:15:28 | 000,005,760 | ---- | M] (Toshiba Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\TMEI3E.sys -- (TMEI3E)
DRV - [2002/04/07 14:50:56 | 000,019,607 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\System32\drivers\TOSSMBNT.sys -- (tossmbnt)
DRV - [2001/09/11 13:54:32 | 000,038,425 | ---- | M] (SMC) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\smcirda.sys -- (SMCIRDA)
DRV - [2001/08/17 23:13:20 | 000,027,164 | ---- | M] (Xircom, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\CE3N5.SYS -- (CE3)
DRV - [2001/08/17 14:53:32 | 000,003,328 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\qv2kux.sys -- (QV2KUX)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com.au/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.ballarat.edu.au*
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = proxy.ballarat.edu.au:8080

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.google.com.au/"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.2.2
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/11/08 22:11:43 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/10/30 14:51:16 | 000,000,000 | ---D | M]

[2008/12/16 16:43:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bek\Application Data\Mozilla\Extensions
[2010/11/29 18:51:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bek\Application Data\Mozilla\Firefox\Profiles\9azh5w1w.default\extensions
[2010/10/22 17:36:37 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Documents and Settings\Bek\Application Data\Mozilla\Firefox\Profiles\9azh5w1w.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010/11/30 17:55:48 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2010/11/30 17:55:48 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2010/11/30 17:54:37 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll

O1 HOSTS File: ([2010/11/30 17:32:27 | 000,000,098 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4 - HKLM..\Run: [000StTHK] C:\WINDOWS\System32\000StTHK.exe ()
O4 - HKLM..\Run: [00THotkey] C:\WINDOWS\system32\00THotkey.exe (TOSHIBA Corp.)
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\AvastUI.exe (AVAST Software)
O4 - HKLM..\Run: [BluetoothAuthenticationAgent] C:\WINDOWS\System32\bthprops.cpl (Microsoft Corporation)
O4 - HKLM..\Run: [DpUtil] C:\Program Files\Toshiba\DualPointUtility\TEDTray.exe (TOSHIBA)
O4 - HKLM..\Run: [ezShieldProtector for Px] C:\WINDOWS\system32\ezSP_Px.exe (Easy Systems Japan Ltd.)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NVRotateSysTray] C:\WINDOWS\System32\nvsysrot.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [PRONoMgr.exe] C:\Program Files\Intel\PROSetWireless\NCS\PROSet\PRONoMgr.exe (Intel(R) Corporation)
O4 - HKLM..\Run: [SmoothView] C:\Program Files\Toshiba\TOSHIBA Zooming Utility\SmoothView.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe File not found
O4 - HKLM..\Run: [TAudEffect] C:\Program Files\Toshiba\TAudEffect\TAudEff.exe (TOSHIBA)
O4 - HKLM..\Run: [TFNF5] C:\WINDOWS\System32\TFNF5.exe (TOSHIBA Corp.)
O4 - HKLM..\Run: [TMERzCtl.EXE] C:\Program Files\TOSHIBA\TME3\TMERzCtl.EXE (TOSHIBA)
O4 - HKLM..\Run: [TMESBS.EXE] C:\Program Files\TOSHIBA\TME3\TMESBS32.EXE (TOSHIBA Corporation)
O4 - HKLM..\Run: [TMESRV.EXE] C:\Program Files\TOSHIBA\TME3\TMESRV31.EXE (TOSHIBA)
O4 - HKLM..\Run: [TosHKCW.exe] C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe (TOSHIBA CORPORATION)
O4 - HKLM..\Run: [TPSMain] C:\WINDOWS\System32\TPSMain.exe (TOSHIBA Corporation)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Bluetooth Monitor.lnk = C:\Program Files\Toshiba\Bluetooth Monitor\BtMon.exe (TOSHIBA)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV02.EXE (SEIKO EPSON CORPORATION)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMConfigurePrograms = 1
O8 - Extra context menu item: Append to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert link target to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert link target to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selected links to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selected links to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selection to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selection to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Computer, Inc.)
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} http://office.microsoft.com/officeupdate/content/opuc.cab (Office Update Installation Engine)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://www.update.microsoft.com/mic...ls/en/x86/client/wuweb_site.cab?1207271305714 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1207271280388 (MUWebControl Class)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} file://C:\WINDOWS\msxml4.cab (XML DOM Document 4.0)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38120.7486458333 (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\Sebring: DllName - C:\WINDOWS\System32\LgNotify.dll - C:\WINDOWS\system32\LgNotify.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Bek\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Bek\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/01/08 06:58:37 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{5c6f334c-54eb-11df-bff9-00037a205c33}\Shell - "" = AutoRun
O33 - MountPoints2\{5c6f334c-54eb-11df-bff9-00037a205c33}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{5c6f334c-54eb-11df-bff9-00037a205c33}\Shell\AutoRun\command - "" = E:\Connect.exe -- File not found
O33 - MountPoints2\{fd2af9a0-d7cc-11dd-bf73-0011f540fd3d}\Shell\AutoRun\command - "" = E:\InstallTomTomHOME.exe -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/11/30 17:42:32 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Bek\Desktop\JavaRa
[2010/11/30 17:29:14 | 000,000,000 | ---D | C] -- C:\_OTL
[2010/11/29 18:51:10 | 000,575,488 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Bek\Desktop\OTL.exe
[2010/11/28 19:01:25 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Bek\Desktop\ThankYou_files
[2010/11/28 11:38:20 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2010/11/27 15:27:43 | 000,000,000 | ---D | C] -- C:\Temp
[2010/11/24 21:29:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage
[2010/11/24 20:12:34 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2010/11/24 19:28:20 | 000,000,000 | ---D | C] -- C:\155fabfce8180507d7bcc33f6b74
[2010/11/24 18:57:23 | 000,000,000 | ---D | C] -- C:\c458b24023cda7e0db44e1eb04
[2010/11/24 18:57:02 | 000,000,000 | ---D | C] -- C:\4bc0d45331d96606d8deee59
[2010/11/24 18:47:31 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\zh-TW
[2010/11/24 18:47:31 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\zh-HK
[2010/11/24 18:47:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\tr-TR
[2010/11/24 18:47:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\sv-SE
[2010/11/24 18:47:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\pt-BR
[2010/11/24 18:47:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\nl-NL
[2010/11/24 18:47:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\nb-NO
[2010/11/24 18:47:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\ko-KR
[2010/11/24 18:47:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\it-IT
[2010/11/24 18:47:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\he-IL
[2010/11/24 18:47:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\fr-FR
[2010/11/24 18:47:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\fi-FI
[2010/11/24 18:47:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\es-ES
[2010/11/24 18:47:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\el-GR
[2010/11/24 18:47:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\de-DE
[2010/11/24 18:47:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\da-DK
[2010/11/24 18:47:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\ar-SA
[2010/11/24 17:00:16 | 000,000,000 | ---D | C] -- C:\WINDOWS\ie8updates
[2010/11/23 19:16:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Bek\Application Data\Malwarebytes
[2010/11/23 19:16:09 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/11/23 19:16:07 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010/11/23 19:16:07 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010/11/23 19:16:07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2010/11/23 18:53:12 | 000,446,464 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Bek\Desktop\TFC.exe
[2010/11/10 20:53:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Bek\Desktop\Mum's rescued documents
[2010/11/06 20:43:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Bek\Desktop\confirmation.jsp_files
[2010/01/31 17:27:13 | 000,148,736 | ---- | C] (Avanquest Software) -- C:\Documents and Settings\All Users\Application Data\hpe3.dll

========== Files - Modified Within 30 Days ==========

[2010/11/30 17:41:46 | 000,205,540 | ---- | M] () -- C:\Documents and Settings\Bek\Desktop\JavaRa.zip
[2010/11/30 17:36:19 | 000,000,198 | ---- | M] () -- C:\PSLOG
[2010/11/30 17:36:07 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/11/30 17:35:16 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/11/30 17:35:13 | 804,638,720 | -HS- | M] () -- C:\hiberfil.sys
[2010/11/30 17:32:27 | 000,000,098 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\Hosts
[2010/11/29 19:24:23 | 000,025,712 | ---- | M] () -- C:\Documents and Settings\Bek\Desktop\kasperskywarning.JPG
[2010/11/29 18:51:12 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Bek\Desktop\OTL.exe
[2010/11/28 19:01:29 | 000,022,585 | ---- | M] () -- C:\Documents and Settings\Bek\Desktop\ThankYou.htm
[2010/11/27 16:57:40 | 000,296,448 | ---- | M] () -- C:\Documents and Settings\Bek\Desktop\vere70t1.exe
[2010/11/27 15:42:55 | 000,594,254 | ---- | M] () -- C:\Documents and Settings\Bek\Desktop\uninstall.reg
[2010/11/27 15:27:23 | 000,436,520 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010/11/27 15:27:22 | 000,070,152 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010/11/27 15:13:42 | 000,018,614 | ---- | M] () -- C:\Documents and Settings\Bek\Desktop\sophos.bat
[2010/11/27 15:09:30 | 000,001,393 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2010/11/24 21:28:46 | 001,569,080 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010/11/24 20:00:53 | 000,000,153 | ---- | M] () -- C:\WINDOWS\WININIT.INI
[2010/11/23 19:16:12 | 000,000,703 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/11/23 18:53:26 | 000,446,464 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Bek\Desktop\TFC.exe
[2010/11/23 18:34:08 | 000,002,626 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
[2010/11/21 19:46:54 | 000,015,360 | ---- | M] () -- C:\Documents and Settings\Bek\My Documents\Book2.xls
[2010/11/13 21:53:40 | 000,018,432 | ---- | M] () -- C:\Documents and Settings\Bek\Desktop\grade1-2_assessment_data_end_2010.xls
[2010/11/07 17:15:43 | 000,098,816 | ---- | M] () -- C:\Documents and Settings\Bek\My Documents\You are hereby invited to attend.doc
[2010/11/06 22:08:17 | 000,040,408 | ---- | M] () -- C:\Documents and Settings\Bek\Desktop\uniball08-20.JPG
[2010/11/06 22:06:39 | 000,030,099 | ---- | M] () -- C:\Documents and Settings\Bek\Desktop\uniball08-12.JPG
[2010/11/06 22:04:42 | 000,030,527 | ---- | M] () -- C:\Documents and Settings\Bek\Desktop\uniball08-5.JPG
[2010/11/06 20:44:22 | 000,345,838 | ---- | M] () -- C:\Documents and Settings\Bek\Desktop\alto.xps
[2010/11/06 20:43:53 | 000,019,503 | ---- | M] () -- C:\Documents and Settings\Bek\Desktop\confirmation.jsp.htm

========== Files Created - No Company Name ==========

[2010/11/30 17:41:44 | 000,205,540 | ---- | C] () -- C:\Documents and Settings\Bek\Desktop\JavaRa.zip
[2010/11/29 19:24:23 | 000,025,712 | ---- | C] () -- C:\Documents and Settings\Bek\Desktop\kasperskywarning.JPG
[2010/11/28 19:01:24 | 000,022,585 | ---- | C] () -- C:\Documents and Settings\Bek\Desktop\ThankYou.htm
[2010/11/27 19:24:17 | 804,638,720 | -HS- | C] () -- C:\hiberfil.sys
[2010/11/27 16:57:36 | 000,296,448 | ---- | C] () -- C:\Documents and Settings\Bek\Desktop\vere70t1.exe
[2010/11/27 15:42:55 | 000,594,254 | ---- | C] () -- C:\Documents and Settings\Bek\Desktop\uninstall.reg
[2010/11/27 15:13:42 | 000,018,614 | ---- | C] () -- C:\Documents and Settings\Bek\Desktop\sophos.bat
[2010/11/23 19:16:12 | 000,000,703 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/11/13 21:31:48 | 000,018,432 | ---- | C] () -- C:\Documents and Settings\Bek\Desktop\grade1-2_assessment_data_end_2010.xls
[2010/11/07 17:15:41 | 000,098,816 | ---- | C] () -- C:\Documents and Settings\Bek\My Documents\You are hereby invited to attend.doc
[2010/11/06 22:08:17 | 000,040,408 | ---- | C] () -- C:\Documents and Settings\Bek\Desktop\uniball08-20.JPG
[2010/11/06 22:06:39 | 000,030,099 | ---- | C] () -- C:\Documents and Settings\Bek\Desktop\uniball08-12.JPG
[2010/11/06 22:04:42 | 000,030,527 | ---- | C] () -- C:\Documents and Settings\Bek\Desktop\uniball08-5.JPG
[2010/11/06 20:44:19 | 000,345,838 | ---- | C] () -- C:\Documents and Settings\Bek\Desktop\alto.xps
[2010/11/06 20:43:51 | 000,019,503 | ---- | C] () -- C:\Documents and Settings\Bek\Desktop\confirmation.jsp.htm
[2010/09/28 19:51:03 | 000,000,000 | ---- | C] () -- C:\WINDOWS\HPMProp.INI
[2010/09/28 19:43:14 | 000,200,704 | ---- | C] () -- C:\WINDOWS\System32\Bot.dll
[2010/09/28 19:43:14 | 000,000,101 | ---- | C] () -- C:\WINDOWS\Psxlpr.ini
[2009/08/03 15:07:42 | 000,403,816 | ---- | C] () -- C:\WINDOWS\System32\OGACheckControl.dll
[2008/09/30 21:02:05 | 000,001,024 | ---- | C] () -- C:\WINDOWS\System32\grcauth2.dll
[2008/09/30 21:02:05 | 000,001,024 | ---- | C] () -- C:\WINDOWS\System32\grcauth1.dll
[2008/09/30 21:02:05 | 000,000,100 | ---- | C] () -- C:\WINDOWS\System32\prsgrc.dll
[2008/09/07 23:44:44 | 000,005,120 | ---- | C] () -- C:\Documents and Settings\Bek\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/06/12 00:00:39 | 000,000,126 | ---- | C] () -- C:\Documents and Settings\Bek\Local Settings\Application Data\fusioncache.dat
[2008/06/02 19:08:03 | 000,023,253 | ---- | C] () -- C:\WINDOWS\UBDesktop.ini
[2008/05/20 01:06:50 | 000,000,097 | ---- | C] () -- C:\WINDOWS\WirelessFTP.INI
[2008/04/04 14:51:33 | 002,463,976 | ---- | C] () -- C:\WINDOWS\System32\NPSWF32.dll
[2007/02/13 13:51:14 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\setupw2k.dll
[2007/02/13 13:51:13 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\nwslog32.dll
[2007/02/12 16:17:10 | 000,001,024 | ---- | C] () -- C:\WINDOWS\System32\clauth2.dll
[2007/02/12 16:17:10 | 000,001,024 | ---- | C] () -- C:\WINDOWS\System32\clauth1.dll
[2007/02/12 16:17:10 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\ssprs.dll
[2007/02/12 16:17:10 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\serauth2.dll
[2007/02/12 16:17:10 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\serauth1.dll
[2007/02/12 16:17:10 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\nsprs.dll
[2007/02/12 16:15:15 | 000,001,025 | ---- | C] () -- C:\WINDOWS\System32\sysprs7.dll
[2007/02/12 16:15:15 | 000,000,205 | ---- | C] () -- C:\WINDOWS\System32\lsprst7.dll
[2007/02/09 17:28:06 | 000,002,276 | ---- | C] () -- C:\WINDOWS\opera.ini
[2006/06/13 18:05:00 | 000,757,818 | ---- | C] () -- C:\WINDOWS\System32\gwadd1.dll
[2006/06/13 16:21:06 | 000,303,166 | ---- | C] () -- C:\WINDOWS\System32\gwodm132.dll
[2006/06/13 15:37:20 | 000,098,354 | ---- | C] () -- C:\WINDOWS\System32\GWLDO132.DLL
[2004/07/09 10:31:18 | 000,155,700 | ---- | C] () -- C:\WINDOWS\System32\ODMA32.DLL
[2004/05/17 14:23:04 | 000,000,199 | ---- | C] () -- C:\WINDOWS\swacnfg.ini
[2004/05/15 05:56:44 | 000,204,800 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeW7.dll
[2004/05/15 05:56:44 | 000,200,704 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeA6.dll
[2004/05/15 05:56:44 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeP6.dll
[2004/05/15 05:56:44 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeM6.dll
[2004/05/15 05:56:44 | 000,188,416 | ---- | C] () -- C:\WINDOWS\System32\IVIresizePX.dll
[2004/05/15 05:56:44 | 000,020,480 | ---- | C] () -- C:\WINDOWS\System32\IVIresize.dll
[2004/05/15 05:32:40 | 000,010,165 | ---- | C] () -- C:\WINDOWS\System32\tosmreg.ini
[2004/05/15 05:32:39 | 000,128,113 | ---- | C] () -- C:\WINDOWS\System32\csellang.ini
[2004/05/15 05:32:39 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\csellang.dll
[2004/05/15 05:32:39 | 000,007,671 | ---- | C] () -- C:\WINDOWS\System32\cseltbl.ini
[2004/05/14 16:42:30 | 000,000,153 | ---- | C] () -- C:\WINDOWS\WININIT.INI
[2004/01/14 06:23:00 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2004/01/08 09:10:02 | 000,000,908 | ---- | C] () -- C:\WINDOWS\System32\Px.ini
[2004/01/08 09:01:44 | 000,019,607 | ---- | C] () -- C:\WINDOWS\System32\drivers\TOSSMBNT.sys
[2004/01/08 08:59:01 | 000,000,000 | ---- | C] () -- C:\WINDOWS\NDSTray.INI
[2004/01/08 07:29:28 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2004/01/08 07:22:03 | 000,363,520 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2004/01/08 07:19:02 | 000,000,791 | ---- | C] () -- C:\WINDOWS\orun32.ini
[2004/01/08 07:02:01 | 000,122,880 | ---- | C] () -- C:\WINDOWS\System32\e1000msg.dll
[2004/01/08 07:02:00 | 000,016,384 | ---- | C] () -- C:\WINDOWS\System32\e100bmsg.dll
[2004/01/08 05:43:57 | 000,000,350 | -H-- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2004/01/07 22:51:38 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2004/01/07 15:29:37 | 001,478,656 | ---- | C] () -- C:\WINDOWS\System32\TosMousePage.dll
[2004/01/07 15:29:36 | 000,770,048 | ---- | C] () -- C:\WINDOWS\System32\TosKeyboardPage.dll
[2004/01/07 15:29:35 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\TosBtHcrpAPI.dll
[2004/01/07 15:29:33 | 000,114,688 | ---- | C] () -- C:\WINDOWS\System32\TosBtAcc.dll
[2004/01/07 15:29:32 | 000,114,688 | ---- | C] () -- C:\WINDOWS\System32\TBTMonUI.dll
[2003/12/16 09:29:42 | 000,204,800 | ---- | C] () -- C:\WINDOWS\System32\C1XStngs.dll
[2002/12/04 11:57:00 | 000,651,264 | ---- | C] () -- C:\WINDOWS\System32\libeay32.dll
[2002/12/04 11:57:00 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\ssleay32.dll

========== LOP Check ==========

[2010/09/22 12:42:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Alwil Software
[2008/04/04 15:40:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SafeNet Sentinel
[2008/08/26 14:15:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Sony
[2008/04/04 15:38:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SPSS
[2008/06/09 20:55:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\X-Setup Pro
[2008/06/12 00:15:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bek\Application Data\FileZilla
[2004/01/08 09:13:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bek\Application Data\InterTrust
[2008/04/09 12:36:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bek\Application Data\InterVideo
[2008/05/15 23:07:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bek\Application Data\iPodder
[2008/08/26 14:15:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bek\Application Data\Sony
[2004/01/08 09:01:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bek\Application Data\toshiba
[2008/06/09 20:55:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Bek\Application Data\X-Setup Pro

========== Purity Check ==========



< End of report >

Try here for a possible fix; http://www.google.com.au/search?hl=...xpired]+kaspersky&aq=f&aqi=&aql=&oq=&gs_rfai=

==

Let me know how you get on.

I found out why Kaspersky wasn't working. There is now a message on their website which says:

"Coming soon:
A new, improved version of the
Kaspersky Online Scanner

The current Kaspersky Online Scanner is unavailable - we apologize for the inconvenience. While you are waiting for the improved Online Scanner, why not take a free trial of Kaspersky Internet Security 2011, which has everything you need to keep your computer safe."

What now?

Everything so far (unless I have missed something) points to a clean computer.
I would say that this one is good to go.

Awesome. When it comes back online I'll run Kaspersky to make sure. Thanks so much for your time and help, you are a champ.

No worries .

To remove all of the tools we used and the files and folders they created, please do the following:
Please download OTC by OldTimer:
Save it to your Desktop.
Double click OTC.exe.
Click the CleanUp! button.
If you are prompted to Reboot during the cleanup, select Yes. The tool will delete itself once it finishes.