[nick6318]

I am getting loads of virus alerts saying its on system32 and is a white line system file that shouldnt be removed. also had the Antivirus 2009 come up. tried downloading from the link you provided but comes up unable to display page and diagnose connection problems even tho have internet connection etc. please help and treat me like the idiot i am as i struggle to delve deeper than the basics.
Thanks Nick

[kahdah]

Hello nick6318

Welcome to G2Go.
=====================

• Download OTL to your desktop.
  
• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  
• When the window appears, underneath Output at the top change it to Minimal Output.
  
• Under the Standard Registry box change it to All.
  
• Check the boxes beside LOP Check and Purity Check.
  
• Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
    
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.

===========
Download This file. Note its name and save it to your root folder, such as C:\.

• Disconnect from the Internet and close all running programs.
  
• Temporarily disable any real-time active protection so your security program drivers will not conflict with this file.
  
• Click on this link to see a list of programs that should be disabled.
  
• Double-click on the downloaded file to start the program. (If running Vista, right click on it and select "Run as an Administrator")
  
• Allow the driver to load if asked.
  
• You may be prompted to scan immediately if it detects rootkit activity.
  
• If you are prompted to scan your system click "Yes" to begin the scan.
  
• If not prompted, click the "Rootkit/Malware" tab.
  
• On the right-side, all items to be scanned should be checked by default except for "Show All". Leave that box unchecked.
  
• Select all drives that are connected to your system to be scanned.
  
• Click the Scan button to begin. (Please be patient as it can take some time to complete)
  
• When the scan is finished, click Save to save the scan results to your Desktop.
  
• Save the file as Results.log and copy/paste the contents in your next reply.
  
• Exit the program and re-enable all active protection when done.

[nick6318]

Hi thanks for the help. this is the first parts you asked for ( OTL) but whilst running the scan on the second link it came up "this programme has stopped working Windows wil now close the programme" Then it closed

OTL logfile created on: 18/10/2009 22:08:05 - Run 1
OTL by OldTimer - Version 3.0.21.0 Folder = C:\Users\nick and michelle\Downloads
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18828)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

2.00 Gb Total Physical Memory | 1.37 Gb Available Physical Memory | 68.44% Memory free
4.00 Gb Paging File | 4.00 Gb Available in Paging File | 100.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 223.08 Gb Total Space | 152.30 Gb Free Space | 68.27% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
Drive E: | 9.77 Gb Total Space | 4.72 Gb Free Space | 48.35% Space Free | Partition Type: NTFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: NICKANDMICH-PC
Current User Name: nick and michelle
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Program Files\AVG\AVG8\avgam.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG8\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG8\avgemc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG8\avgnsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG8\avgrsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG8\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG8\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe (Nokia)
PRC - C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe (CyberLink Corp.)
PRC - C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
PRC - C:\Program Files\Dell Support Center\bin\sprtsvc.exe (SupportSoft, Inc.)
PRC - C:\Program Files\Dell\DellDock\DockLogin.exe (Stardock Corporation)
PRC - C:\Program Files\Dell\QuickSet\quickset.exe (Dell Inc.)
PRC - C:\Program Files\DellTPad\ApMsgFwd.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\DellTPad\Apntex.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\DellTPad\HidFind.exe (Alps Electric Co., Ltd.)
PRC - C:\Program Files\Entriq\MediaSphere\3.8.2.9\EntriqMediaServer.exe (Entriq, Inc.)
PRC - C:\Program Files\Entriq\MediaSphere\EntriqMediaTray.exe (Entriq, Inc.)
PRC - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google)
PRC - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
PRC - C:\Program Files\IDT\WDM\sttray.exe (IDT, Inc.)
PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe (Intel Corporation)
PRC - C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
PRC - C:\Program Files\Kontiki\KHost.exe (Kontiki Inc.)
PRC - C:\Program Files\Kontiki\KService.exe (Kontiki Inc.)
PRC - C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corporation)
PRC - C:\Program Files\OpenOffice.org 3\program\soffice.bin (OpenOffice.org)
PRC - C:\Program Files\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)
PRC - C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe (Vodafone)
PRC - C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe (Vodafone)
PRC - C:\Program Files\Windows Live\Family Safety\fsssvc.exe (Microsoft Corporation)
PRC - C:\Program Files\Windows Live\Family Safety\fsui.exe (Microsoft Corporation)
PRC - C:\Program Files\Windows Live\Messenger\msnmsgr.exe (Microsoft Corporation)
PRC - C:\Program Files\Windows Live\Toolbar\wltuser.exe (Microsoft Corporation)
PRC - C:\Program Files\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
PRC - C:\Program Files\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
PRC - C:\Users\nick and michelle\AppData\Local\wgpfp.exe ()
PRC - C:\Users\nick and michelle\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Windows\Explorer.EXE (Microsoft Corporation)
PRC - C:\Windows\System32\AUDIODG.EXE (Microsoft Corporation)
PRC - C:\Windows\System32\bcmwltry.exe (Dell Inc.)
PRC - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_85b55258\aestsrv.exe (Andrea Electronics Corporation)
PRC - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_85b55258\STacSV.exe (IDT, Inc.)
PRC - C:\Windows\System32\hkcmd.exe (Intel Corporation)
PRC - C:\Windows\System32\igfxpers.exe (Intel Corporation)
PRC - C:\Windows\System32\igfxsrvc.exe (Intel Corporation)
PRC - C:\Windows\System32\wbem\unsecapp.exe (Microsoft Corporation)
PRC - C:\Windows\System32\wbem\wmiprvse.exe (Microsoft Corporation)
PRC - C:\Windows\System32\winupdate.exe (Microsoft Corporation)
PRC - C:\Windows\System32\WLTRAY.EXE (Dell Inc.)
PRC - C:\Windows\System32\WLTRYSVC.EXE ()

========== Win32 Services (SafeList) ==========

SRV - (0102611230135484mcinstcleanup [Auto | Stopped]) -- File not found
SRV - (AESTFilters [Auto | Running]) -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_85b55258\aestsrv.exe (Andrea Electronics Corporation)
SRV - (avg8emc [Auto | Running]) -- C:\Program Files\AVG\AVG8\avgemc.exe (AVG Technologies CZ, s.r.o.)
SRV - (avg8wd [Auto | Running]) -- C:\Program Files\AVG\AVG8\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (clr_optimization_v2.0.50727_32 [On_Demand | Stopped]) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (COMSysApp [On_Demand | Stopped]) -- File not found
SRV - (DockLoginService [Auto | Running]) -- C:\Program Files\Dell\DellDock\DockLogin.exe (Stardock Corporation)
SRV - (ehRecvr [On_Demand | Stopped]) -- C:\Windows\ehome\ehRecvr.exe (Microsoft Corporation)
SRV - (ehSched [On_Demand | Stopped]) -- C:\Windows\ehome\ehsched.exe (Microsoft Corporation)
SRV - (ehstart [Auto | Stopped]) -- C:\Windows\ehome\ehstart.dll (Microsoft Corporation)
SRV - (Eventlog [Auto | Running]) -- C:\Windows\System32\wevtsvc.dll (Microsoft Corporation)
SRV - (FontCache3.0.0.0 [On_Demand | Stopped]) -- C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe (Microsoft Corporation)
SRV - (fsssvc [Auto | Running]) -- C:\Program Files\Windows Live\Family Safety\fsssvc.exe (Microsoft Corporation)
SRV - (GoogleDesktopManager-092308-165331 [On_Demand | Stopped]) -- C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google)
SRV - (GoToAssist [On_Demand | Stopped]) -- C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe (Citrix Online, a division of Citrix Systems, Inc.)
SRV - (gupdate1c994dc9153bd30 [Auto | Stopped]) -- C:\Program Files\Google\Update\GoogleUpdate.exe (Google Inc.)
SRV - (gusvc [Auto | Stopped]) -- C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (Google)
SRV - (IAANTMON [Auto | Running]) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe (Intel Corporation)
SRV - (idsvc [Unknown | Stopped]) -- C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe (Microsoft Corporation)
SRV - (KService [Auto | Running]) -- C:\Program Files\Kontiki\KService.exe (Kontiki Inc.)
SRV - (NetTcpPortSharing [Disabled | Stopped]) -- C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe (Microsoft Corporation)
SRV - (SeaPort [Auto | Running]) -- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corporation)
SRV - (ServiceLayer [On_Demand | Stopped]) -- File not found
SRV - (sprtsvc_DellSupportCenter [Auto | Running]) -- C:\Program Files\Dell Support Center\bin\sprtsvc.exe (SupportSoft, Inc.)
SRV - (STacSV [Auto | Running]) -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_85b55258\STacSV.exe (IDT, Inc.)
SRV - (stllssvr [On_Demand | Stopped]) -- C:\Program Files\Common Files\SureThing Shared\stllssvr.exe (MicroVision Development, Inc.)
SRV - (Symantec RemoteAssist [On_Demand | Stopped]) -- C:\Program Files\Common Files\Symantec Shared\Support Controls\ssrc.exe (Symantec, Inc.)
SRV - (VMCService [Auto | Running]) -- C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe (Vodafone)
SRV - (WinDefend [Auto | Stopped]) -- C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
SRV - (wltrysvc [Auto | Running]) -- C:\Windows\System32\WLTRYSVC.EXE ()
SRV - (wmiApSrv [Unknown | Stopped]) -- File not found
SRV - (WMPNetworkSvc [Auto | Running]) -- C:\Program Files\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV - (adp94xx [Disabled | Stopped]) -- C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
DRV - (adpahci [Disabled | Stopped]) -- C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
DRV - (adpu160m [Disabled | Stopped]) -- C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
DRV - (adpu320 [Disabled | Stopped]) -- C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
DRV - (aic78xx [Disabled | Stopped]) -- C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
DRV - (aliide [Disabled | Stopped]) -- C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (ApfiltrService [On_Demand | Running]) -- C:\Windows\System32\DRIVERS\Apfiltr.sys (Alps Electric Co., Ltd.)
DRV - (arc [Disabled | Stopped]) -- C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
DRV - (arcsas [Disabled | Stopped]) -- C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
DRV - (AvgLdx86 [System | Running]) -- C:\Windows\System32\Drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AvgMfx86 [System | Running]) -- C:\Windows\System32\Drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AvgRkx86 [Boot | Running]) -- C:\Windows\System32\Drivers\avgrkx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AvgTdiX [System | Running]) -- C:\Windows\System32\Drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (BCM42RLY [On_Demand | Running]) -- C:\Windows\System32\drivers\BCM42RLY.sys (Broadcom Corporation)
DRV - (BCM43XX [On_Demand | Running]) -- C:\Windows\System32\DRIVERS\bcmwl6.sys (Broadcom Corporation)
DRV - (BrFiltLo [On_Demand | Stopped]) -- C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
DRV - (BrFiltUp [On_Demand | Stopped]) -- C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
DRV - (Brserid [Disabled | Stopped]) -- C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
DRV - (BrSerWdm [Disabled | Stopped]) -- C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm [Disabled | Stopped]) -- C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
DRV - (BrUsbSer [On_Demand | Stopped]) -- C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)
DRV - (cmdide [Disabled | Stopped]) -- C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (e1express [On_Demand | Stopped]) -- C:\Windows\System32\DRIVERS\e1e6032.sys (Intel Corporation)
DRV - (E1G60 [On_Demand | Stopped]) -- C:\Windows\System32\DRIVERS\E1G60I32.sys (Intel Corporation)
DRV - (elxstor [Disabled | Stopped]) -- C:\Windows\system32\drivers\elxstor.sys (Emulex)
DRV - (fssfltr [Auto | Running]) -- C:\Windows\System32\DRIVERS\fssfltr.sys (Microsoft Corporation)
DRV - (GEARAspiWDM [On_Demand | Running]) -- C:\Windows\System32\Drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV - (HpCISSs [Disabled | Stopped]) -- C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (hwdatacard [On_Demand | Stopped]) -- C:\Windows\System32\DRIVERS\ewusbmdm.sys (Huawei Technologies Co., Ltd.)
DRV - (iaStor [Boot | Running]) -- C:\Windows\system32\drivers\iastor.sys (Intel Corporation)
DRV - (iaStorV [Disabled | Stopped]) -- C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
DRV - (igfx [On_Demand | Running]) -- C:\Windows\System32\DRIVERS\igdkmd32.sys (Intel Corporation)
DRV - (iirsp [Disabled | Stopped]) -- C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (iteatapi [Disabled | Stopped]) -- C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)
DRV - (iteraid [Disabled | Stopped]) -- C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)
DRV - (LSI_FC [Disabled | Stopped]) -- C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
DRV - (LSI_SAS [Disabled | Stopped]) -- C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
DRV - (LSI_SCSI [Disabled | Stopped]) -- C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
DRV - (megasas [Disabled | Stopped]) -- C:\Windows\system32\drivers\megasas.sys (LSI Corporation)
DRV - (MegaSR [Disabled | Stopped]) -- C:\Windows\system32\drivers\megasr.sys (LSI Corporation, Inc.)
DRV - (Mraid35x [Disabled | Stopped]) -- C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
DRV - (nfrd960 [Disabled | Stopped]) -- C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
DRV - (ntrigdigi [Disabled | Stopped]) -- C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)
DRV - (nvraid [Disabled | Stopped]) -- C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (nvstor [Disabled | Stopped]) -- C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
DRV - (pccsmcfd [On_Demand | Stopped]) -- C:\Windows\System32\DRIVERS\pccsmcfd.sys (Nokia)
DRV - (pcouffin [On_Demand | Running]) -- C:\Windows\System32\Drivers\pcouffin.sys (VSO Software)
DRV - (PxHelp20 [Boot | Running]) -- C:\Windows\System32\Drivers\PxHelp20.sys (Sonic Solutions)
DRV - (ql2300 [Disabled | Stopped]) -- C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
DRV - (ql40xx [Disabled | Stopped]) -- C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
DRV - (R300 [On_Demand | Stopped]) -- C:\Windows\System32\DRIVERS\atikmdag.sys (ATI Technologies Inc.)
DRV - (ROOTMODEM [On_Demand | Stopped]) -- C:\Windows\System32\Drivers\RootMdm.sys (Microsoft Corporation)
DRV - (RTSTOR [On_Demand | Running]) -- C:\Windows\System32\drivers\RTSTOR.SYS (Realtek Semiconductor Corp.)
DRV - (secdrv [Auto | Running]) -- C:\Windows\System32\drivers\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
DRV - (SiSRaid4 [Disabled | Stopped]) -- C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)
DRV - (STHDA [On_Demand | Running]) -- C:\Windows\System32\DRIVERS\stwrt.sys (IDT, Inc.)
DRV - (Sym_hi [Disabled | Stopped]) -- C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
DRV - (Sym_u3 [Disabled | Stopped]) -- C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
DRV - (Symc8xx [Disabled | Stopped]) -- C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
DRV - (uliahci [Disabled | Stopped]) -- C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
DRV - (UlSata [Disabled | Stopped]) -- C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
DRV - (ulsata2 [Disabled | Stopped]) -- C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
DRV - (viaide [Disabled | Stopped]) -- C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
DRV - (vsmraid [Disabled | Stopped]) -- C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (yukonwlh [On_Demand | Running]) -- C:\Windows\System32\DRIVERS\yk60x86.sys (Marvell)

========== Standard Registry (All) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.co.uk/ig/dell?hl=en&...amp;ibd=1081201
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\System32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
IE - HKLM\..\URLSearchHook: {00d7d675-6622-437e-ac75-7d328435bb9e} - C:\Program Files\ThePirateBayVIO\tbThe1.dll (Conduit Ltd.)

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.orange.co.uk
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.aol.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook: {00d7d675-6622-437e-ac75-7d328435bb9e} - C:\Program Files\ThePirateBayVIO\tbThe1.dll (Conduit Ltd.)
IE - HKCU\..\URLSearchHook: {4FBACD73-F67C-42AE-B46A-03960AFE3DFB} - Reg Error: Key error. File not found
IE - HKCU\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\Windows\System32\ieframe.dll (Microsoft Corporation)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>

FF - HKLM\software\mozilla\Firefox\Extensions\\{20a82645-c095-46ed-80e3-08825760534b}: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [2009/08/26 03:01:45 | 00,000,000 | ---D | M]


O1 HOSTS File: (761 bytes) - C:\Windows\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (ThePirateBayVIO Toolbar) - {00d7d675-6622-437e-ac75-7d328435bb9e} - C:\Program Files\ThePirateBayVIO\tbThe1.dll (Conduit Ltd.)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Windows Live Family Safety Browser Helper Class) - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll (Microsoft Corporation)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Windows Live Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll (Google Inc.)
O2 - BHO: (Google Dictionary Compression sdch) - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll (Google Inc.)
O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll (Dell Inc.)
O2 - BHO: (Windows Live Toolbar Helper) - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (ThePirateBayVIO Toolbar) - {00d7d675-6622-437e-ac75-7d328435bb9e} - C:\Program Files\ThePirateBayVIO\tbThe1.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (no name) - {E97B5F2E-CA8E-4D34-BDA3-44EEC4ED2B12} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (ThePirateBayVIO Toolbar) - {00D7D675-6622-437E-AC75-7D328435BB9E} - C:\Program Files\ThePirateBayVIO\tbThe1.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O4 - HKLM..\Run: [4oD] C:\Program Files\Kontiki\KHost.exe (Kontiki Inc.)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [AVG8_TRAY] C:\Program Files\AVG\AVG8\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [Broadcom Wireless Manager UI] C:\Windows\System32\WLTRAY.exe (Dell Inc.)
O4 - HKLM..\Run: [dellsupportcenter] C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
O4 - HKLM..\Run: [five Media Manager Tray] C:\Program Files\Entriq\MediaSphere\EntriqMediaTray.exe (Entriq, Inc.)
O4 - HKLM..\Run: [fssui] C:\Program Files\Windows Live\Family Safety\fsui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [Google Desktop Search] C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google)
O4 - HKLM..\Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe (Intel Corporation)
O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe (Intel Corporation)
O4 - HKLM..\Run: [IgfxTray] C:\Windows\System32\igfxtray.exe (Intel Corporation)
O4 - HKLM..\Run: [MobileConnect] C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe (Vodafone)
O4 - HKLM..\Run: [NokiaMServer] C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe (Nokia)
O4 - HKLM..\Run: [PC Pitstop Optimize Reminder] C:\Program Files\PCPitstop\Optimize2\Reminder.exe File not found
O4 - HKLM..\Run: [PDVDDXSrv] C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe (CyberLink Corp.)
O4 - HKLM..\Run: [Persistence] C:\Windows\System32\igfxpers.exe (Intel Corporation)
O4 - HKLM..\Run: [QuickSet] C:\Program Files\Dell\QuickSet\QuickSet.exe (Dell Inc.)
O4 - HKLM..\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray.exe (IDT, Inc.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [winupdate.exe] C:\Windows\System32\winupdate.exe (Microsoft Corporation)
O4 - HKLM..\Run: [Wvulabokogikewej] File not found
O4 - HKCU..\Run: [kdx] C:\Program Files\Kontiki\KHost.exe (Kontiki Inc.)
O4 - HKCU..\Run: [MsnMsgr] C:\Program Files\Windows Live\Messenger\msnmsgr.exe (Microsoft Corporation)
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - HKCU..\Run: [wgpfp] c:\users\nick and michelle\appdata\local\wgpfp.exe ()
O4 - HKCU..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe (Microsoft Corporation)
O4 - HKCU..\RunOnce: [Shockwave Updater] C:\Windows\System32\Adobe\Shockwave 11\SwHelper_1150595.exe -Update -1150595 -Mozilla\4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident\4.0; File not found
O4 - Startup: C:\Users\nick and michelle\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 2
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableInstallerDetection = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableSecureUIAPaths = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableVirtualization = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ValidateAdminCodeSignatures = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: scforceoption = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: FilterAdministratorToken = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableUIADesktopToggle = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_TEXT = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_BITMAP = 2
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_OEMTEXT = 7
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIB = 8
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_PALETTE = 9
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_UNICODETEXT = 13
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIBV5 = 17
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetActiveDesktop = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll (Sun Microsystems, Inc.)
O9 - Extra Button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\Windows\System32\NLAapi.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - C:\Windows\System32\napinsp.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - C:\Windows\System32\pnrpnsp.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Windows\System32\pnrpnsp.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000006 [] - C:\Windows\System32\winrnr.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Windows\System32\wshbth.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000020 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000021 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000022 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000023 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000024 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000025 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000026 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000027 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000028 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000029 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000030 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000031 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000032 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000033 - C:\Windows\System32\mswsock.dll (Microsoft Corporation)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Ranges: GD ([http] in Local intranet)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa...director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} http://ak.exe.imgfarm.com/images/nocache/f...etup1.0.1.1.cab (Reg Error: Key error.)
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.0...oUploader55.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash...r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} http://tools.ebayimg.com/eps/wl/activex/eB...l_v1-0-27-0.cab (EPUImageControl Class)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} http://utilities.pcp.../pcpitstop2.dll (PCPitstop Exam)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\Windows\System32\msvidctl.dll (Microsoft Corporation)
O18 - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\System32\itss.dll (Microsoft Corporation)
O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation)
O18 - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\Windows\System32\inetcomm.dll (Microsoft Corporation)
O18 - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\System32\itss.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation)
O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\Windows\System32\msvidctl.dll (Microsoft Corporation)
O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\System32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Filter: - application/octet-stream - C:\Windows\System32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter: - application/x-complus - C:\Windows\System32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter: - application/x-msdownload - C:\Windows\System32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter: - deflate - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter: - gzip - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
O20 - AppInit_DLLs: (AVGRSSTX.DLL) - C:\Windows\System32\AVGRSSTX.DLL (AVG Technologies CZ, s.r.o.)
O20 - AppInit_DLLs: (C:\PROGRA~1\GOOGLE\GOOGLE~3\GOEC62~1.DLL) - C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (rundll32 shell32) - C:\Windows\System32\shell32.dll (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (Control_RunDLL "sysdm.cpl") - C:\Windows\System32\sysdm.cpl (Microsoft Corporation)
O20 - Winlogon\Notify\GoToAssist: DllName - C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll - C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll (Citrix Online, a division of Citrix Systems, Inc.)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\Windows\System32\igfxdev.dll (Intel Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\Windows\System32\webcheck.dll (Microsoft Corporation)
O22 - SharedTaskScheduler: {8C7461EF-2B13-11d2-BE35-3078302C2030} - Component Categories cache daemon - C:\Windows\System32\browseui.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (credssp.dll) - C:\Windows\System32\credssp.dll (Microsoft Corporation)
O30 - LSA: Authentication Packages - (msv1_0) - C:\Windows\System32\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (kerberos) - C:\Windows\System32\kerberos.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (msv1_0) - C:\Windows\System32\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (schannel) - C:\Windows\System32\schannel.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (wdigest) - C:\Windows\System32\wdigest.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (tspkg) - C:\Windows\System32\tspkg.dll (Microsoft Corporation)
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 22:43:36 | 00,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{7fc5be29-d268-11dd-b2ec-0023ae096204}\Shell - "" = AutoRun
O33 - MountPoints2\{7fc5be29-d268-11dd-b2ec-0023ae096204}\Shell\AutoRun\command - "" = D:\setup.exe -- File not found
O33 - MountPoints2\{7fc5be2b-d268-11dd-b2ec-0023ae096204}\Shell - "" = AutoRun
O33 - MountPoints2\{7fc5be2b-d268-11dd-b2ec-0023ae096204}\Shell\AutoRun\command - "" = D:\setup.exe -- File not found
O33 - MountPoints2\{e85b4f8d-dcaa-11dd-8af3-0023ae096204}\Shell - "" = AutoRun
O33 - MountPoints2\{e85b4f8d-dcaa-11dd-8af3-0023ae096204}\Shell\AutoRun\command - "" = D:\setup.exe -- File not found
O33 - MountPoints2\{e85b4f8e-dcaa-11dd-8af3-0023ae096204}\Shell - "" = AutoRun
O33 - MountPoints2\{e85b4f8e-dcaa-11dd-8af3-0023ae096204}\Shell\AutoRun\command - "" = D:\setup.exe -- File not found
O33 - MountPoints2\{ffc1c44a-d1c2-11dd-a71e-0023ae096204}\Shell - "" = AutoRun
O33 - MountPoints2\{ffc1c44a-d1c2-11dd-a71e-0023ae096204}\Shell\AutoRun\command - "" = D:\setup.exe -- File not found
O33 - MountPoints2\{ffc1c44f-d1c2-11dd-a71e-0023ae096204}\Shell - "" = AutoRun
O33 - MountPoints2\{ffc1c44f-d1c2-11dd-a71e-0023ae096204}\Shell\AutoRun\command - "" = D:\setup.exe -- File not found
O33 - MountPoints2\{fffbf0d1-fa00-11dd-94c8-001583073942}\Shell - "" = AutoRun
O33 - MountPoints2\{fffbf0d1-fa00-11dd-94c8-001583073942}\Shell\AutoRun\command - "" = D:\DPFMate.exe -- File not found
O33 - MountPoints2\G\Shell - "" = AutoRun
O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\setup.exe -- File not found
O34 - HKLM BootExecute: (autocheck) - File not found
O34 - HKLM BootExecute: (autochk) - C:\Windows\System32\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (*) - File not found
O35 - comfile [open] -- "%1" %* File not found
O35 - exefile [open] -- "%1" %* File not found

========== Files/Folders - Created Within 30 Days ==========

[1 C:\Windows\*.tmp files]
[2009/10/06 11:31:51 | 00,000,000 | ---D | C] -- C:\ProgramData\Entriq
[2009/10/06 15:00:36 | 00,000,000 | ---D | C] -- C:\Users\nick and michelle\AppData\Local\Entriq
[2009/10/18 13:52:01 | 00,000,000 | ---D | C] -- C:\Program Files\Belltech Small Business Publisher
[2009/10/06 11:31:54 | 00,000,000 | ---D | C] -- C:\Program Files\Entriq
[2009/10/18 14:01:53 | 00,024,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\winupdate.exe
[2009/10/18 14:01:50 | 00,044,032 | ---- | C] (Microsoft Corporation) -- C:\biabqjx.exe
[2009/10/18 13:49:44 | 00,000,000 | ---D | C] -- C:\Users\nick and michelle\Documents\Belltech Small Business Publisher v5.1
[2009/10/15 11:35:58 | 00,000,000 | ---D | C] -- C:\Eminem-Relapse-2009
[2009/10/15 03:23:00 | 00,213,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msv1_0.dll
[2009/10/15 03:22:50 | 03,597,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe
[2009/10/15 03:22:49 | 03,546,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe
[2009/10/15 03:21:52 | 00,428,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\EncDec.dll
[2009/10/15 03:21:31 | 00,217,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\psisrndr.ax
[2009/10/15 03:21:29 | 00,293,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\psisdecd.dll
[2009/10/15 03:21:29 | 00,177,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mpg2splt.ax
[2009/10/15 03:21:29 | 00,080,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MSNP.ax
[2009/10/15 03:21:18 | 05,940,224 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.dll
[2009/10/15 03:21:15 | 11,069,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieframe.dll
[2009/10/15 03:21:13 | 01,985,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iertutil.dll
[2009/10/15 03:21:12 | 01,208,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\urlmon.dll
[2009/10/15 03:21:11 | 00,916,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wininet.dll
[2009/10/15 03:21:11 | 00,594,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2009/10/15 03:21:10 | 01,469,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2009/10/15 03:21:10 | 00,387,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll
[2009/10/15 03:21:10 | 00,206,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\occache.dll
[2009/10/15 03:21:09 | 00,184,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll
[2009/10/15 03:21:09 | 00,164,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2009/10/15 03:21:09 | 00,153,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2009/10/15 03:21:08 | 00,192,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ie4uinit.exe
[2009/10/15 03:21:08 | 00,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesysprep.dll
[2009/10/15 03:21:08 | 00,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesetup.dll
[2009/10/15 03:21:08 | 00,055,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iernonce.dll
[2009/10/15 03:21:08 | 00,055,296 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll
[2009/10/15 03:21:08 | 00,032,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe
[2009/10/15 03:21:08 | 00,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2009/10/15 03:21:07 | 01,638,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2009/10/15 03:21:02 | 00,061,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msasn1.dll
[2009/10/15 03:20:58 | 00,144,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\srv2.sys
[2009/10/15 03:20:54 | 00,604,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WMSPDMOD.DLL
[2009/10/14 13:36:49 | 00,000,000 | ---D | C] -- C:\Users\nick and michelle\Documents\Alexandra Burke - Bad Boys (Feat. Flo Rida) [CDQ]-TNas11
[2009/10/14 13:22:38 | 00,000,000 | ---D | C] -- C:\Users\nick and michelle\Documents\Q music top 500
[2009/10/14 13:10:37 | 00,000,000 | ---D | C] -- C:\Users\nick and michelle\Documents\Chipmunk - I Am Chipmunk (2009) - Hip Hop [www.torrentazos.com]
[2009/10/13 23:04:29 | 00,000,000 | ---D | C] -- C:\Users\nick and michelle\Documents\Black Eyed Peas -The E.N.D. [DE] [2009][2CD+SkidVid_XviD+Cov]
[2009/10/13 23:03:14 | 00,000,000 | ---D | C] -- C:\Users\nick and michelle\Documents\Shakira - She Wolf CDRip 320Kbps [2009][Cov+CD][Bubanee]
[2009/10/09 08:10:36 | 00,000,000 | ---D | C] -- C:\Users\nick and michelle\Documents\Damage.2010.DvdRip.Xvid.ISWE-Rg
[2009/10/09 08:07:01 | 00,000,000 | ---D | C] -- C:\Users\nick and michelle\Documents\Haunting.Of.Winchester.House.2009.DVDRip.XviD-FiCO avi - [ www.torrentday.com ]
[2009/10/09 08:03:59 | 00,000,000 | ---D | C] -- C:\Users\nick and michelle\Documents\Star Trek (2009) DVDRip XviD-MAXSPEED
[2009/10/06 11:31:52 | 00,000,000 | ---D | C] -- C:\Windows\Ver
[2009/10/03 07:17:58 | 02,421,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wucltux.dll
[2009/10/03 07:17:58 | 01,929,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wuaueng.dll
[2009/10/03 07:17:58 | 00,053,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wuauclt.exe
[2009/10/03 07:17:58 | 00,044,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wups2.dll
[2009/10/03 07:17:45 | 00,575,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wuapi.dll
[2009/10/03 07:17:45 | 00,087,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wudriver.dll
[2009/10/03 07:17:45 | 00,035,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wups.dll
[2009/10/03 07:17:39 | 00,171,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wuwebv.dll
[2009/10/03 07:17:39 | 00,053,248 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wuapp.exe
[2009/04/24 13:35:44 | 00,345,088 | ---- | C] (crachoir) -- C:\Users\nick and michelle\AppData\Local\meyuw.exe
[2009/03/29 10:02:32 | 00,047,360 | ---- | C] (VSO Software) -- C:\Users\nick and michelle\AppData\Roaming\pcouffin.sys

========== Files - Modified Within 30 Days ==========

[1 C:\Windows\*.tmp files]
[2009/10/18 22:26:51 | 00,005,991 | ---- | M] () -- C:\Users\nick and michelle\AppData\Local\wgpfp_navps.dat
[2009/10/18 22:26:19 | 00,004,199 | ---- | M] () -- C:\Users\nick and michelle\AppData\Local\wgpfp.dat
[2009/10/18 22:19:16 | 00,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2009/10/18 22:19:16 | 00,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2009/10/18 22:18:04 | 00,000,884 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2009/10/18 21:17:37 | 00,000,868 | ---- | M] () -- C:\Windows\tasks\Google Software Updater.job
[2009/10/18 17:15:41 | 00,015,712 | ---- | M] () -- C:\Users\nick and michelle\Documents\window clean letter.odt
[2009/10/18 16:49:02 | 00,016,146 | ---- | M] () -- C:\Windows\System32\AVR09.exe
[2009/10/18 16:49:01 | 00,009,573 | ---- | M] () -- C:\Windows\System32\winhelper.dll
[2009/10/18 16:48:58 | 00,072,192 | ---- | M] () -- C:\yjixhlb.exe
[2009/10/18 16:48:56 | 00,044,032 | ---- | M] (Microsoft Corporation) -- C:\biabqjx.exe
[2009/10/18 16:48:56 | 00,011,333 | ---- | M] () -- C:\ixqriv.exe
[2009/10/18 16:40:11 | 00,000,100 | ---- | M] () -- C:\Users\nick and michelle\AppData\Local\cucec.bat
[2009/10/18 16:39:38 | 00,000,880 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2009/10/18 16:39:36 | 00,000,416 | ---- | M] () -- C:\Windows\tasks\PCConfidential.job
[2009/10/18 16:39:14 | 00,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2009/10/18 16:39:06 | 00,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2009/10/18 16:38:51 | 31,817,60512 | -HS- | M] () -- C:\hiberfil.sys
[2009/10/18 16:37:50 | 00,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2009/10/18 16:37:47 | 03,149,345 | -H-- | M] () -- C:\Users\nick and michelle\AppData\Local\IconCache.db
[2009/10/18 15:23:28 | 00,282,465 | ---- | M] () -- C:\Users\nick and michelle\Documents\window cleaning flyer.sbpf
[2009/10/18 14:01:52 | 00,000,000 | ---- | M] () -- C:\iieldyt.exe
[2009/10/18 14:01:51 | 00,024,576 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\winupdate.exe
[2009/10/18 14:01:25 | 43,219,952 | ---- | M] () -- C:\Windows\System32\drivers\Avg\incavi.avm
[2009/10/18 13:52:06 | 00,000,867 | ---- | M] () -- C:\Users\nick and michelle\Desktop\Belltech Small Business Publisher.lnk
[2009/10/17 17:41:20 | 00,690,960 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI
[2009/10/17 17:41:20 | 00,601,008 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2009/10/17 17:41:20 | 00,106,498 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2009/10/16 21:49:25 | 00,289,590 | ---- | M] () -- C:\Users\nick and michelle\AppData\Local\wgpfp_nav.dat
[2009/10/16 03:27:39 | 00,033,037 | ---- | M] () -- C:\Windows\System32\drivers\Avg\microavi.avg
[2009/10/14 15:28:01 | 00,020,215 | ---- | M] () -- C:\Users\nick and michelle\Documents\ang ps.odt
[2009/10/14 13:42:23 | 08,601,114 | ---- | M] () -- C:\Users\nick and michelle\Documents\01 Watch The Sun Come Up.mp3
[2009/10/14 00:01:06 | 00,058,368 | ---- | M] () -- C:\Users\nick and michelle\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/10/06 11:32:03 | 00,001,817 | ---- | M] () -- C:\Users\nick and michelle\Desktop\Demand Five Player.lnk
[2009/10/03 08:31:41 | 00,001,889 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader 9.lnk
[2009/10/02 21:32:48 | 00,013,748 | ---- | M] () -- C:\Users\nick and michelle\Documents\sia.odt
[2009/10/02 17:28:02 | 00,425,984 | ---- | M] () -- C:\Users\nick and michelle\AppData\Local\wgpfp.exe
[2009/10/01 09:59:59 | 00,492,629 | ---- | M] () -- C:\Windows\System32\drivers\Avg\miniavi.avg
[2009/09/24 04:45:50 | 00,211,964 | ---- | M] () -- C:\Users\nick and michelle\Desktop\NORWICH%20Red%20Exclusion%20Order%20Cards.pdf

========== Files - No Company Name ==========
[2009/10/18 17:15:40 | 00,015,712 | ---- | C] () -- C:\Users\nick and michelle\Documents\window clean letter.odt
[2009/10/18 15:16:10 | 00,282,465 | ---- | C] () -- C:\Users\nick and michelle\Documents\window cleaning flyer.sbpf
[2009/10/18 14:01:57 | 00,016,146 | ---- | C] () -- C:\Windows\System32\AVR09.exe
[2009/10/18 14:01:56 | 00,009,573 | ---- | C] () -- C:\Windows\System32\winhelper.dll
[2009/10/18 14:01:52 | 00,000,000 | ---- | C] () -- C:\iieldyt.exe
[2009/10/18 14:01:51 | 00,072,192 | ---- | C] () -- C:\yjixhlb.exe
[2009/10/18 14:01:51 | 00,011,333 | ---- | C] () -- C:\ixqriv.exe
[2009/10/18 13:52:06 | 00,000,867 | ---- | C] () -- C:\Users\nick and michelle\Desktop\Belltech Small Business Publisher.lnk
[2009/10/15 11:36:39 | 05,207,648 | ---- | C] () -- C:\Pink - So What.mp3
[2009/10/15 11:36:38 | 05,385,822 | ---- | C] () -- C:\Phill Collins Genesis - In The Air Tonight.mp3
[2009/10/15 11:36:38 | 03,391,738 | ---- | C] () -- C:\Mungo Jerry - In The Summertime(1970).mp3
[2009/10/15 11:36:37 | 05,446,668 | ---- | C] () -- C:\Mika - Relax, Take It Easy.mp3
[2009/10/15 11:36:37 | 04,933,843 | ---- | C] () -- C:\Metro Station - Shake it.mp3
[2009/10/15 11:36:37 | 02,993,100 | ---- | C] () -- C:\Mika - Grace Kelly.mp3
[2009/10/15 11:36:37 | 00,001,880 | ---- | C] () -- C:\main.ini
[2009/10/15 11:36:36 | 05,161,847 | ---- | C] () -- C:\Lady GaGa - Pokerface.mp3
[2009/10/15 11:36:36 | 02,053,712 | ---- | C] () -- C:\La Roux- In For The Kill.mp3
[2009/10/15 11:36:35 | 07,583,872 | ---- | C] () -- C:\Kanye West - Graduation - Stronger.mp3
[2009/10/15 11:36:35 | 05,222,108 | ---- | C] () -- C:\Keri Hilson - Knock You Down ft. Kanye West & Ne-Yo.mp3
[2009/10/15 11:36:34 | 05,872,879 | ---- | C] () -- C:\Estelle - American Boy ft Kanye West.mp3
[2009/10/15 11:36:34 | 05,150,093 | ---- | C] () -- C:\Justin Timberlake ft. Beyonce - Until The End Of Time (Remix).mp3
[2009/10/15 11:36:33 | 05,856,564 | ---- | C] () -- C:\David Guetta ft. Akon - Sexy [bleep].mp3
[2009/10/15 11:36:33 | 05,839,157 | ---- | C] () -- C:\Ercola feat. Daniella - Every Word.mp3
[2009/10/15 11:36:33 | 03,745,242 | ---- | C] () -- C:\Dizzee Rascal - Bonkers.mp3
[2009/10/15 11:36:32 | 05,605,807 | ---- | C] () -- C:\Bonnie Tyler - I Need A Hero.mp3
[2009/10/15 11:36:32 | 03,608,617 | ---- | C] () -- C:\Bob Marley - Girl I Want To Make You Sweat.mp3
[2009/10/15 11:36:31 | 07,829,782 | ---- | C] () -- C:\Beyonce - Single Ladies (Put a Ring on it)(1).mp3
[2009/10/15 11:36:31 | 07,427,179 | ---- | C] () -- C:\Blackeyed Peas - I Gotta Feeling.mp3
[2009/10/15 11:36:30 | 07,829,782 | ---- | C] () -- C:\Beyonce - Single Ladies (Put a Ring on it).mp3
[2009/10/15 11:36:30 | 03,482,322 | ---- | C] () -- C:\Beyonce - If I Were A Boy.mp3
[2009/10/15 11:36:29 | 10,523,461 | ---- | C] () -- C:\Beyonce - Halo.mp3
[2009/10/15 11:36:29 | 00,030,415 | ---- | C] () -- C:\Ucp dayshift.odt
[2009/10/15 11:36:29 | 00,027,658 | ---- | C] () -- C:\ucp night shift.odt
[2009/10/15 11:36:29 | 00,020,770 | ---- | C] () -- C:\UCP KEY LIST 30-04-09.odt
[2009/10/15 11:36:29 | 00,000,296 | ---- | C] () -- C:\WMPInfo.xml
[2009/10/15 11:36:28 | 08,534,811 | ---- | C] () -- C:\snow patrol - run.mp3
[2009/10/15 11:36:28 | 03,235,297 | ---- | C] () -- C:\t-shirt chantelle - best track ever.wma
[2009/10/15 11:36:28 | 00,017,032 | ---- | C] () -- C:\technican course.odt
[2009/10/15 11:36:27 | 05,366,107 | ---- | C] () -- C:\Snow Patrol - Chasing Cars.mp3
[2009/10/15 11:36:27 | 04,442,488 | ---- | C] () -- C:\Savage Garden - Truly Madly Deeply.mp3
[2009/10/15 11:36:27 | 03,759,681 | ---- | C] () -- C:\Shontelle - T-Shirt.mp3
[2009/10/15 11:36:26 | 03,112,960 | ---- | C] () -- C:\Ronan Keating & Boyzone - When You Say Nothing At All (Notting Hill).mp3
[2009/10/15 11:36:25 | 09,549,920 | ---- | C] () -- C:\Rihanna-Disturbia.mp3
[2009/10/15 11:36:25 | 05,471,082 | ---- | C] () -- C:\Rihanna - Take a bow.mp3
[2009/10/15 11:36:24 | 06,181,248 | ---- | C] () -- C:\Rihanna - Pon De Replay .mp3
[2009/10/15 11:36:24 | 03,876,392 | ---- | C] () -- C:\Pitbull - 02 - I Know You Want Me.mp3
[2009/10/15 11:36:24 | 03,358,858 | ---- | C] () -- C:\Queen - Don't Stop Me Now.mp3
[2009/10/15 11:36:24 | 03,325,859 | ---- | C] () -- C:\Pixie Lott - Mama Do (Uh Oh Uh Oh).mp3
[2009/10/14 15:22:38 | 00,020,215 | ---- | C] () -- C:\Users\nick and michelle\Documents\ang ps.odt
[2009/10/14 13:41:03 | 08,601,114 | ---- | C] () -- C:\Users\nick and michelle\Documents\01 Watch The Sun Come Up.mp3
[2009/10/06 11:32:03 | 00,001,817 | ---- | C] () -- C:\Users\nick and michelle\Desktop\Demand Five Player.lnk
[2009/10/02 21:32:48 | 00,013,748 | ---- | C] () -- C:\Users\nick and michelle\Documents\sia.odt
[2009/10/02 17:28:06 | 00,289,590 | ---- | C] () -- C:\Users\nick and michelle\AppData\Local\wgpfp_nav.dat
[2009/10/02 17:28:06 | 00,005,948 | ---- | C] () -- C:\Users\nick and michelle\AppData\Local\wgpfp_navps.dat
[2009/10/02 17:28:06 | 00,004,199 | ---- | C] () -- C:\Users\nick and michelle\AppData\Local\wgpfp.dat
[2009/10/02 17:28:02 | 00,425,984 | ---- | C] () -- C:\Users\nick and michelle\AppData\Local\wgpfp.exe
[2009/09/24 04:45:50 | 00,211,964 | ---- | C] () -- C:\Users\nick and michelle\Desktop\NORWICH%20Red%20Exclusion%20Order%20Cards.pdf
[2009/08/29 19:29:17 | 18,015,723 | ---- | C] () -- C:\ProgramData\vlc-1.0.1-win32.exe
[2009/05/10 15:57:13 | 16,742,799 | ---- | C] () -- C:\ProgramData\vlc-0.9.9-win32.exe
[2009/03/29 10:03:00 | 00,000,034 | ---- | C] () -- C:\Users\nick and michelle\AppData\Roaming\pcouffin.log
[2009/03/29 10:02:32 | 00,087,608 | ---- | C] () -- C:\Users\nick and michelle\AppData\Roaming\inst.exe
[2009/03/29 10:02:32 | 00,007,887 | ---- | C] () -- C:\Users\nick and michelle\AppData\Roaming\pcouffin.cat
[2009/03/29 10:02:32 | 00,001,144 | ---- | C] () -- C:\Users\nick and michelle\AppData\Roaming\pcouffin.inf
[2009/03/29 10:00:09 | 00,000,668 | ---- | C] () -- C:\Users\nick and michelle\AppData\Roaming\vso_ts_preview.xml
[2009/03/04 20:54:46 | 00,000,067 | ---- | C] () -- C:\Windows\Easy Avi Divx Xvid to DVD Burner.INI
[2009/03/02 02:09:16 | 00,007,273 | ---- | C] () -- C:\ProgramData\N360BUOptions.ini
[2009/03/02 00:20:18 | 00,002,560 | ---- | C] () -- C:\Windows\System32\drivers\mchInjDrv.sys
[2009/01/22 22:04:30 | 00,000,100 | ---- | C] () -- C:\Users\nick and michelle\AppData\Local\cucec.bat
[2009/01/03 21:59:23 | 00,000,104 | ---- | C] () -- C:\Users\nick and michelle\AppData\Local\mcgflzx.bat
[2008/12/27 15:53:20 | 00,000,136 | ---- | C] () -- C:\Users\nick and michelle\AppData\Roaming\wklnhst.dat
[2008/12/24 23:48:00 | 00,058,368 | ---- | C] () -- C:\Users\nick and michelle\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/12/24 18:20:18 | 03,149,345 | -H-- | C] () -- C:\Users\nick and michelle\AppData\Local\IconCache.db
[2008/12/24 14:18:39 | 00,000,006 | -HS- | C] () -- C:\Users\nick and michelle\AppData\Roaming\desktop.ini
[2008/12/24 14:18:36 | 00,000,006 | -HS- | C] () -- C:\Users\nick and michelle\AppData\Local\desktop.ini
[2008/12/24 14:08:57 | 00,075,192 | ---- | C] () -- C:\Users\nick and michelle\AppData\Local\GDIPFONTCACHEV1.DAT
[2008/12/01 14:37:24 | 00,147,456 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1489.dll
[2008/12/01 12:58:00 | 00,055,808 | ---- | C] () -- C:\Windows\System32\bcmwlrmt.dll
[2008/03/07 16:43:56 | 00,084,734 | R--- | C] () -- C:\ProgramData\DeviceManager.xml.rc4
[2008/03/07 13:47:30 | 00,020,270 | ---- | C] () -- C:\ProgramData\DeviceInstaller.xml
[2008/01/21 03:24:21 | 00,049,152 | ---- | C] () -- C:\Users\nick and michelle\AppData\Local\Sqlspnlg.dll
[2006/11/02 13:50:50 | 00,000,174 | -HS- | C] () -- C:\Program Files\desktop.ini
[2006/11/02 13:35:32 | 00,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006/11/02 11:25:44 | 00,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll
[2006/11/02 11:23:31 | 00,000,219 | ---- | C] () -- C:\Windows\system.ini
[2006/11/02 11:23:31 | 00,000,144 | ---- | C] () -- C:\Windows\win.ini
[2006/11/02 08:40:29 | 00,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini

========== LOP Check ==========

[2009/03/29 10:03:00 | 00,000,000 | ---D | M] -- C:\Users\nick and michelle\AppData\Roaming
[2009/02/12 18:13:02 | 00,000,000 | ---D | M] -- C:\Users\nick and michelle\AppData\Roaming\AVS4YOU
[2009/08/03 12:05:38 | 00,000,000 | ---D | M] -- C:\Users\nick and michelle\AppData\Roaming\CasinoOnNet
[2008/12/24 14:09:01 | 00,000,000 | ---D | M] -- C:\Users\nick and michelle\AppData\Roaming\Dell
[2009/10/16 03:00:29 | 00,000,000 | ---D | M] -- C:\Users\nick and michelle\AppData\Roaming\LimeWire
[2006/11/02 13:37:34 | 00,000,000 | ---D | M] -- C:\Users\nick and michelle\AppData\Roaming\Media Center Programs
[2009/01/21 20:28:05 | 00,000,000 | ---D | M] -- C:\Users\nick and michelle\AppData\Roaming\NCH Swift Sound
[2009/02/11 12:23:04 | 00,000,000 | ---D | M] -- C:\Users\nick and michelle\AppData\Roaming\Nokia
[2008/12/27 01:47:01 | 00,000,000 | ---D | M] -- C:\Users\nick and michelle\AppData\Roaming\OpenOffice.org
[2009/02/12 19:05:12 | 00,000,000 | ---D | M] -- C:\Users\nick and michelle\AppData\Roaming\PC Suite
[2008/12/27 15:53:22 | 00,000,000 | ---D | M] -- C:\Users\nick and michelle\AppData\Roaming\Template
[2008/12/24 14:18:53 | 00,000,000 | ---D | M] -- C:\Users\nick and michelle\AppData\Roaming\Vodafone
[2009/06/16 23:31:17 | 00,000,000 | ---D | M] -- C:\Users\nick and michelle\AppData\Roaming\Vso
[2009/10/18 21:17:37 | 00,000,868 | ---- | M] () -- C:\Windows\Tasks\Google Software Updater.job
[2009/10/18 16:39:38 | 00,000,880 | ---- | M] () -- C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
[2009/10/18 22:18:04 | 00,000,884 | ---- | M] () -- C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
[2009/10/18 16:39:36 | 00,000,416 | ---- | M] () -- C:\Windows\Tasks\PCConfidential.job
[2009/10/18 16:39:14 | 00,000,006 | -H-- | M] () -- C:\Windows\Tasks\SA.DAT
[2009/10/18 16:37:50 | 00,032,572 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:DFC5A2B2
< End of report >

OTL Extras logfile created on: 18/10/2009 22:08:05 - Run 1
OTL by OldTimer - Version 3.0.21.0 Folder = C:\Users\nick and michelle\Downloads
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18828)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

2.00 Gb Total Physical Memory | 1.37 Gb Available Physical Memory | 68.44% Memory free
4.00 Gb Paging File | 4.00 Gb Available in Paging File | 100.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 223.08 Gb Total Space | 152.30 Gb Free Space | 68.27% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
Drive E: | 9.77 Gb Total Space | 4.72 Gb Free Space | 48.35% Space Free | Partition Type: NTFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: NICKANDMICH-PC
Current User Name: nick and michelle
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.chm [@ = chm.file] -- C:\Windows\hh.exe (Microsoft Corporation)
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.hta [@ = htafile] -- Reg Error: Value error. File not found
.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %* File not found
chm.file [open] -- "%SystemRoot%\hh.exe" %1 (Microsoft Corporation)
cmdfile [open] -- "%1" %* File not found
comfile [open] -- "%1" %* File not found
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %* File not found
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htafile [open] -- Reg Error: Value error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)
https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %* File not found
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1" File not found
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S File not found
txtfile [edit] -- Reg Error: Key error.
Directory [AddToPlaylistVLC] -- C:\Program Files\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- C:\Program Files\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Windows\system32\winlogon.exe" = C:\Windows\system32\winlogon.exe:*:enabled:@shell32.dll,-1 -- (Microsoft Corporation)


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{084B87B8-296A-4DF6-8926-B9A72DB7FCC1}" = rport=10243 | protocol=6 | dir=out | app=system |
"{136F867E-BE57-4EEA-BE0F-DD16B733348F}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{6B716220-8E36-4E02-A72E-1BBD04C9CEA4}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{7BF756E5-CDE4-470B-841D-B246EC92C087}" = lport=10243 | protocol=6 | dir=in | app=system |
"{82F5E5F4-DD41-4E71-9F31-A318BC902C65}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{91A3588B-B1C9-4EDE-9815-A1DCDA866441}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{94C26FDF-A25F-4529-9EF4-9FFE9F58BF75}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{99B0CC13-2790-4A73-8999-ADC32B2198E4}" = lport=2869 | protocol=6 | dir=in | app=system |
"{AF5EE2C6-C646-429F-835F-BEF882CFFEB1}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{B36AE72C-A4AC-4CB8-AE47-13CE36DDDDCD}" = lport=2869 | protocol=6 | dir=in | app=system |
"{C12C0E36-A8D7-47FC-918F-03AE31412DAF}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{083598A8-A06C-4E02-A90E-C5EBC4C3BAAB}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{0ADFF66C-6061-4B06-91D0-7B2C7101873D}" = protocol=6 | dir=in | app=c:\program files\bitlord2\bitlord.exe |
"{14DE5918-3AE5-4B45-8F48-34D7B5265DBA}" = dir=in | app=c:\program files\cyberlink\powerdvd dx\pdvddxsrv.exe |
"{20BCC62D-DCCC-4925-AB65-3CB8FEE3C103}" = protocol=6 | dir=in | app=c:\users\nick and michelle\appdata\local\temp\jmstart.exe |
"{29B5F708-4133-48AC-85A5-E92CE9D68C19}" = dir=in | app=c:\program files\cyberlink\powerdvd dx\powerdvd.exe |
"{2DB8CB4A-561D-46C6-BA2D-A9323E5124B2}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{3497A6EB-0BCF-48C8-ABC1-681D7ACC688C}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{39538B6F-9BB9-4DA5-96E2-845A1DCCC050}" = protocol=6 | dir=out | app=system |
"{3B7EA868-E74F-4105-BEF3-78732042506D}" = protocol=6 | dir=in | app=c:\program files\kontiki\kservice.exe |
"{3C53DF1D-7892-4D9F-9CB0-0BBDA76BED5C}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{4034B6F5-904F-442A-95F3-6806657B1544}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{4CE17D67-51E8-4D7A-8D6B-D88AFB3E0C90}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{5473D6B6-4465-4791-A4E2-BDB95D9A8844}" = protocol=6 | dir=in | app=c:\program files\limewire\limewire.exe |
"{5EE27233-474C-4EBB-9FEC-BF356558F723}" = protocol=6 | dir=in | app=c:\users\nick and michelle\appdata\local\temp\jmstart.exe |
"{6013BDC6-9A4B-4B91-A0F2-61FCF6E22F5D}" = protocol=17 | dir=in | app=c:\users\nick and michelle\appdata\local\temp\jmstart.exe |
"{62866010-E9CE-4C6D-82A6-1137E3F5764B}" = dir=in | app=c:\program files\avg\avg8\avgam.exe |
"{802135DF-7C22-421F-A584-C500D3BC9F0D}" = protocol=17 | dir=in | app=c:\users\nick and michelle\appdata\local\temp\dologin.exe |
"{83E6D0B0-1EBF-4F3F-ACB4-CB0E925536F1}" = protocol=17 | dir=in | app=c:\program files\limewire\limewire.exe |
"{932E33CA-3E72-41E2-9065-F1A54F377312}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{9AB59E8B-3FA2-4E7C-951E-BFC22F0A420D}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{BA3E2B14-8CD6-476B-BCD7-1A60F9E1E67C}" = dir=in | app=c:\program files\avg\avg8\avgnsx.exe |
"{BB796242-BFEB-4F02-ABF4-C34BEB9295AA}" = protocol=17 | dir=in | app=c:\program files\bitlord2\bitlord.exe |
"{BFBBDB30-1FF2-4E76-9ABC-67BC2622354B}" = protocol=17 | dir=in | app=c:\program files\ivt corporation\bluesoleil\bluesoleil.exe |
"{C34FEC84-E46A-49C0-AFD6-64EC90925DFC}" = protocol=6 | dir=in | app=c:\program files\ivt corporation\bluesoleil\bluesoleil.exe |
"{CB49998E-479A-4E42-8870-5AE51F965AFD}" = protocol=6 | dir=in | app=c:\users\nick and michelle\appdata\local\temp\dologin.exe |
"{D0FC8F21-1A34-4E14-B07D-ABECE63D45BB}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{DCD7EFE4-B700-427F-A288-DCD185E6353E}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe |
"{DF554FDC-0B92-4F11-A5E4-1EC7B7F3E5EC}" = protocol=17 | dir=in | app=c:\users\nick and michelle\appdata\local\temp\jmstart.exe |
"{E5647653-48FE-4AA1-9645-61E121BE5818}" = protocol=17 | dir=in | app=c:\program files\ivt corporation\bluesoleil\bluesoleil.exe |
"{E5C5FA54-423C-4155-ADF5-2B90CD423E22}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{E68A9CA0-B276-4403-A79F-804878E8872E}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{ED44C3F7-B573-4633-ABEA-EEDA4AE6B087}" = protocol=6 | dir=in | app=c:\program files\ivt corporation\bluesoleil\bluesoleil.exe |
"{ED52B75D-E725-4116-9CF2-55CF30D6C2AB}" = dir=in | app=c:\program files\avg\avg8\avgemc.exe |
"{FB162527-1F90-455A-AEE2-75A21EA2DD3F}" = dir=in | app=c:\program files\avg\avg8\avgupd.exe |
"{FC032988-D3AE-427B-8734-1F5127B5CED4}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{FDE5B93E-9C98-4F6C-9931-5F998C81B0E9}" = protocol=17 | dir=in | app=c:\program files\kontiki\kservice.exe |
"TCP Query User{10CD7A77-C7A5-4B4A-AE9E-9D3A4CAAB84D}C:\program files\kontiki\khost.exe" = protocol=6 | dir=in | app=c:\program files\kontiki\khost.exe |
"TCP Query User{2EEC682F-0B0D-4665-86B0-01DD83C26124}C:\program files\limewire\limewire.exe" = protocol=6 | dir=in | app=c:\program files\limewire\limewire.exe |
"TCP Query User{2F3BC4CF-D9EE-4B1F-B998-62AB14A6C38B}C:\program files\kontiki\khost.exe" = protocol=6 | dir=in | app=c:\program files\kontiki\khost.exe |
"TCP Query User{350CC813-120A-42EE-A9AE-294D124DB5E2}C:\program files\bitlord2\bitlord.exe" = protocol=6 | dir=in | app=c:\program files\bitlord2\bitlord.exe |
"TCP Query User{885F34A5-87EF-4AE0-BD8C-FCFD95531FAE}C:\program files\bitlord\bitlord.exe" = protocol=6 | dir=in | app=c:\program files\bitlord\bitlord.exe |
"TCP Query User{B99B2F07-69DB-4135-9178-CA1E50E148BB}C:\program files\bitlord\bitlord.exe" = protocol=6 | dir=in | app=c:\program files\bitlord\bitlord.exe |
"UDP Query User{2B306BB5-9360-487D-9192-62A561667502}C:\program files\kontiki\khost.exe" = protocol=17 | dir=in | app=c:\program files\kontiki\khost.exe |
"UDP Query User{40D7F76A-15C6-4C15-B2B9-2C78E1FE7F1D}C:\program files\limewire\limewire.exe" = protocol=17 | dir=in | app=c:\program files\limewire\limewire.exe |
"UDP Query User{7A84E924-6E8E-4082-8FF5-B218D3FD1771}C:\program files\bitlord\bitlord.exe" = protocol=17 | dir=in | app=c:\program files\bitlord\bitlord.exe |
"UDP Query User{A0A0058E-68DE-4A2E-B656-4C2720AD3A94}C:\program files\kontiki\khost.exe" = protocol=17 | dir=in | app=c:\program files\kontiki\khost.exe |
"UDP Query User{B3A97F9F-4A90-42DA-AB5F-DBABB923DBB1}C:\program files\bitlord\bitlord.exe" = protocol=17 | dir=in | app=c:\program files\bitlord\bitlord.exe |
"UDP Query User{F8F1B5B3-5CCF-4713-BC7D-455DE527E04C}C:\program files\bitlord2\bitlord.exe" = protocol=17 | dir=in | app=c:\program files\bitlord2\bitlord.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00203668-8170-44A0-BE44-B632FA4D780F}" = Adobe AIR
"{03528A01-7E5E-4C5F-94DF-1D8012E969EF}" = Nokia Map Loader
"{08E81ABD-79F7-49C2-881F-FD6CB0975693}" = Roxio Creator Data
"{09760D42-E223-42AD-8C3E-55B47D0DDAC3}" = Roxio Creator DE
"{0AAA9C97-74D4-47CE-B089-0B147EF3553C}" = Windows Live Messenger
"{0C973594-7DDF-4BD0-84ED-3517F7622037}" = PC Connectivity Solution
"{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}" = Microsoft Works
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{1F54DAFA-9261-4A62-B59D-6C9F26B48FE4}" = Roxio Creator Tools
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{2FA28330-2028-4033-BD10-425C87EB4D54}" = Nokia Software Updater
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Roxio Update Manager
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java™ 6 Update 7
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{3C52E7DA-C431-4239-B66B-1BF703D5B194}" = Windows Live Photo Gallery
"{42B74521-4706-412A-9A27-AED12B83E886}" = Nokia Ovi Application Installer
"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant
"{48FF6DE6-0619-4562-B4B1-21F161FE0DE0}" = Symantec Technical Support Advanced Chat Controls
"{4AE48A64-6C6A-4E5A-95FA-55F5131DECF9}" = Nokia Ovi One Touch Access
"{4CBA3D4C-8F51-4D60-B27E-F6B641C571E7}" = Microsoft Search Enhancement Pack
"{4DE3E3D9-AE81-45DE-9195-3015F7B1DBF3}" = Junk Mail filter update
"{62230596-37E5-4618-A329-0D21F529A86F}" = Browser Address Error Redirector
"{63C1109E-D977-49ED-BCE3-D00D0BF187D6}" = Windows Live Mail
"{6442DEDF-AC2F-4CBA-85DE-42E459C5006C}" = Nokia Ovi Content Copier
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler 3
"{669C7BD8-DAA2-49B6-966C-F1E2AAE6B17E}" = Cisco PEAP Module
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{6A92E5C5-0578-443D-91F3-92ECE5F2CAE2}" = Windows Live Writer
"{6B7B6D4D-8F9B-4CB3-8CA4-BCA9CC4C1A22}" = EDocs
"{6D3963B0-E13B-4FC3-B0FF-506A304BB043}" = Cisco EAP-FAST Module
"{6EB6C056-02BB-453E-8448-EC90B9794180}" = Nokia Multimedia Common Components 2.4
"{6FFB40A5-7F7D-4A32-8905-3CDF962EE1E4}" = Internet From BT
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{73A4F29F-31AC-4EBD-AA1B-0CC5F18C8F83}" = Roxio Creator Audio
"{76C24F39-B161-498F-BD8B-C64789812D13}_is1" = ConvertXtoDVD 3.0.0.1
"{76CD2979-09C0-493A-84B3-8FD97EF4BCEA}" = Windows Live Family Safety
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com
"{7DB9F1E5-9ACB-410D-A7DC-7A3D023CE045}" = Dell Getting Started Guide
"{83770D14-21B9-44B3-8689-F7B523F94560}" = Cisco LEAP Module
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)
"{8B7443F5-E141-42A0-AB61-ED2331AAD606}" = 4oD
"{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}" = Choice Guard
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager
"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{995F1E2E-F542-4310-8E1D-9926F5A279B3}" = Windows Live Toolbar
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = Dell Touchpad
"{A1BF9950-8CDB-468E-83FA-EACFB00EA7D5}" = Windows Live Sync
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1033-7B44-A91000000001}" = Adobe Reader 9.1.3
"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9
"{AE977FE5-F014-4F1E-83F7-B4FD143B5EEF}" = Nokia Photos
"{B6A26DE5-F2B5-4D58-9570-4FC760E00FCD}" = Roxio Creator Copy
"{B935C985-A17F-484B-8470-09E4FC27DC26}" = Dell-eBay
"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)
"{C39A4E1F-9AF1-4FE1-A80E-A5B867FABB42}" = Dell Best of Web
"{C4972073-2BFE-475D-8441-564EA97DA161}" = QuickSet
"{C6CA8874-5F22-4AF0-9BE3-016BF299C536}" = Windows Live Essentials
"{CB84F0F2-927B-458D-9DC5-87832E3DC653}" = GearDrvs
"{CC016F21-3970-11DE-B878-005056806466}" = Google Earth
"{CCF31747-7D4C-4F77-9FF8-60DA9B49B353}" = Nokia Ovi Suite
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{E3BFEE55-39E2-4BE0-B966-89FE583822C1}" = Dell Support Center (Support Software)
"{E81A68BF-6F5F-4F20-A2EA-AE429736A017}" = Nokia Ovi System Utilities
"{ED439A64-F018-4DD4-8BA5-328D85AB09AB}" = Roxio Creator DE
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F44DA61E-720D-4E79-871F-F6E628B33242}" = OpenOffice.org 3.0
"{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call
"{F6CB42B9-F033-4152-8813-FF11DA8E6A78}" = Dell Dock
"{F7C0163D-9CD8-4F5F-BAC8-3E45A0000AFF}" = Vodafone Mobile Connect Lite Huawei
"4oD" = 4oD
"504244733D18C8F63FF584AEB290E3904E791693" = Windows Driver Package - Nokia pccsmcfd (08/22/2008 7.0.0.0)
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"AVG8Uninstall" = AVG 8.5
"Belltech Small Business Publisher 5.1.1_is1" = Belltech Small Business Publisher 5.1.1
"BitLord" = BitLord 1.1
"Broadcom 802.11b Network Adapter" = Dell Wireless WLAN Card Utility
"CCleaner" = CCleaner (remove only)
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"Demand Five Player_is1" = Demand Five Player
"Dziobas Rar Player_is1" = Dziobas Rar Player 0.009.35
"Entriq MediaSphere_is1" = Uninstall Entriq MediaSphere
"Google Desktop" = Google Desktop
"Google Updater" = Google Updater
"GoToAssist" = GoToAssist 8.0.0.514
"Hurrican_is1" = Hurrican 1.0.0.4
"LimeWire" = LimeWire PRO 4.18.8
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Nokia Ovi Application Installer" = Nokia Ovi Application Installer 6.85.3011
"Nokia Ovi Content Copier" = Nokia Ovi Content Copier 6.85.3011
"Nokia Ovi One Touch Access" = Nokia Ovi One Touch Access 6.85.3011
"Nokia Ovi System Utilities" = Nokia Ovi System Utilities 6.85.3011
"OrangeSiemens" = Orange Siemens Router
"ThePirateBayVIO Toolbar" = ThePirateBayVIO Toolbar
"VLC media player" = VLC media player 0.9.2
"wgpfp" = Favorit
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR archiver

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 18/09/2009 03:14:39 | Computer Name = nickandmich-PC | Source = VSS | ID = 8194
Description =

Error - 21/09/2009 16:27:12 | Computer Name = nickandmich-PC | Source = WinMgmt | ID = 10
Description =

Error - 22/09/2009 02:59:07 | Computer Name = nickandmich-PC | Source = WinMgmt | ID = 10
Description =

Error - 23/09/2009 09:41:01 | Computer Name = nickandmich-PC | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 8.0.6001.18813, time stamp
0x4a6621ae, faulting module mshtml.dll, version 8.0.6001.18813, time stamp 0x4a66380c,
exception code 0xc0000005, fault offset 0x00085cfc, process id 0x1cb8, application
start time 0x01ca3c5306d292c0.

Error - 01/10/2009 04:59:04 | Computer Name = nickandmich-PC | Source = VSS | ID = 8194
Description =

Error - 01/10/2009 05:00:03 | Computer Name = nickandmich-PC | Source = VSS | ID = 8194
Description =

Error - 04/10/2009 03:12:30 | Computer Name = nickandmich-PC | Source = WinMgmt | ID = 10
Description =

Error - 07/10/2009 08:15:06 | Computer Name = nickandmich-PC | Source = WinMgmt | ID = 10
Description =

Error - 07/10/2009 08:16:54 | Computer Name = nickandmich-PC | Source = VSS | ID = 8194
Description =

Error - 09/10/2009 03:44:44 | Computer Name = nickandmich-PC | Source = WinMgmt | ID = 10
Description =

[ Broadcom Wireless LAN Events ]
Error - 09/09/2009 05:53:07 | Computer Name = nickandmich-PC | Source = WLAN-Tray | ID = 0
Description = 10:53:07, Wed, Sep 09, 09 Error - Unable to gain access to user store


Error - 21/09/2009 16:28:17 | Computer Name = nickandmich-PC | Source = WLAN-Tray | ID = 0
Description = 21:28:17, Mon, Sep 21, 09 Error - Unable to gain access to user store


Error - 09/10/2009 16:56:27 | Computer Name = nickandmich-PC | Source = WLAN-Tray | ID = 0
Description = 21:56:27, Fri, Oct 09, 09 Error - Unable to gain access to user store


Error - 18/10/2009 11:37:47 | Computer Name = nickandmich-PC | Source = WLAN-Tray | ID = 0
Description = 16:37:47, Sun, Oct 18, 09 Error - User "" does not have administrative
privileges on this system

Error - 18/10/2009 11:37:47 | Computer Name = nickandmich-PC | Source = WLAN-Tray | ID = 0
Description = 16:37:47, Sun, Oct 18, 09 Error - User "" does not have administrative
privileges on this system

[ System Events ]
Error - 16/06/2009 06:06:34 | Computer Name = nickandmich-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 16/06/2009 06:06:34 | Computer Name = nickandmich-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 16/06/2009 06:06:34 | Computer Name = nickandmich-PC | Source = Service Control Manager | ID = 7026
Description =

Error - 16/06/2009 06:08:58 | Computer Name = nickandmich-PC | Source = Service Control Manager | ID = 7009
Description =

Error - 17/06/2009 17:39:04 | Computer Name = nickandmich-PC | Source = EventLog | ID = 6008
Description = The previous system shutdown at 22:37:04 on 17/06/2009 was unexpected.

Error - 17/06/2009 17:39:09 | Computer Name = nickandmich-PC | Source = HTTP | ID = 15016
Description =

Error - 17/06/2009 17:39:50 | Computer Name = nickandmich-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 17/06/2009 17:39:50 | Computer Name = nickandmich-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 17/06/2009 17:39:50 | Computer Name = nickandmich-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 17/06/2009 17:39:50 | Computer Name = nickandmich-PC | Source = Service Control Manager | ID = 7000
Description =


< End of report >

[kahdah]

First temporarily disable any antivirus program or any real time shields that are present:
If you do not know how then you can refer to this link:
http://www.bleepingc...opic114351.html
================
Then Download Combofix from any of the links below. You must rename it before saving it. Rename it to kahdah then save it to your desktop.
Link 1
Link 2
--------------------------------------------------------------------

Double click on kahdah.exe & follow the prompts.

• When finished, it will produce a report for you.
  
• Please post the C:\ComboFix.txt

[nick6318]

Hi thanks again for the help. I followed the instructins but when i tried to run kahdah it came up error unsafe to continue. file may be corrupted with virut. the dissapears from screen. tried to copy/paste to show you but wouldnt do it. Tried link2 but just comes up unable to display page etc. Ps all fire walls and malware protection currently turned off now

[kahdah]

VIRUT

Your System is infected with Virut!!
Virut is a file infecting virus which is able to modify itself each and every time it runs. In addition, when it infects, sometimes it will destroy the file it tries to latch onto.
For these reasons, you really can't truly fix Virut. You will need to format/reinstall the operating system on this machine.

More information:
https://forums2.symantec.com/t5/Malicious-C...age/ba-p/388834
http://free.avg.com/66558

AVG Technologies said:

There are bugs in the viral code. When the virus produces infected files, it also creates non-functional files that also contain the virus.

http://home.mcafee.com/VirusInfo/VirusProf...aspx?key=143034

Network Associates said:

W32/Virut.h is a polymorphic, entry point obscuring (EPO) file infector with IRC bot functionality. It can accept commands to download other malware on the compromised machine.
It appends to the end of the last section of executable (PE) files an encrypted copy of its code. The decryptor is polymorphic and can be located either:
Immediately before the encrypted code at the end of the last section
At the end of the code section of the infected host in 'slack-space' (assuming there is any)
At the original entry point of the host (overwriting the original host code)

What this means is we cannot proceed with any sort of fix as your legitimate files have already been corrupted and this action is, unfortunately, irreversible. I apologize but there is nothing else I can do or advise to completely clear your machine. You must reformat your pc to rid yourself of this deadly virus.