[Cathy J]

I feel so stupid asking this...when you say to check the boxes down to computer do you mean including computer? I really feel silly asking that you know, but just not sure...

[Advertisements]

Hi Cathy J,

There is no stupid question. It's better to ask then sorry

Yes, check everything including Computer.

[maliprog]

Hi Cathy J,

There is no stupid question. It's better to ask then sorry

Yes, check everything including Computer.

[Cathy J]

Thank you so much...will do it now and post in next reply..

[Cathy J]

I have never been so frustrated in my life! Everytime I try to save the report so I can copy and paste it, it stops responding. I am not sure how to do it I guess...I have ran it twice and tried to copy and paste twice...

[maliprog]

Hi Cathy J

It's OK . We will try different approach..

Using Internet Explorer or Firefox, visit Kaspersky Online Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.

2. To optimize scanning time and produce a more sensible report for review:

• Close any open programs
• Turn off the real time scanner of any existing antivirus program while performing the online scan. Click HERE to see how to disable the most common antivirus programs.

3. Click Run at the Security prompt.

The program will then begin downloading and installing and will also update the database.
Please be patient as this can take quite a long time to download.

• Once the update is complete, click on Settings.
• Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
  • Spyware, adware, dialers, and other riskware
  • Archives
  • E-mail databases
• Click on My Computer under the green Scan bar to the left to start the scan.
• Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
• Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
• Click View report... at the bottom.
• Click the Save report... button.
  
  
• Change the Files of type dropdown box to Text file (.txt) and name the file KasReport.txt to save the file to your desktop so that you may post it in your next reply

[Cathy J]

It will not let me run it...it pulls up a box that says: Kaspersky 7.0 cannot be started because this computer has Kaspersky internet security 8.0(9.0) installed...I have Kaspersky 2011 installed so I guess that is what it is talking about. I think I might have done an online scan before you started working with me but I am not sure.

[Cathy J]

For some reason now when I log on to my comput er it tries to start the kaspersky virus tool keeps trying to open...also I now get a warning that pops up in the lower right toolbar that says USB device not responding. One of the USB devices attatched to this computer has malfunctioned and windows does not recognize it.

[maliprog]

Hi Cathy J,

Did you unistall AVPTool? Start AVPTool and close it. It will ask you if you want to uninstall it. Confirm and it will go away.

I don't know what is with your USB. Please try to insert it into rear USB ports. Sometimes it helps.

Let's continue:

Run ESET Online Scan

To optimize scanning time and produce a more sensible report for review:

• Close any open programs
• Turn off the real time scanner of any existing antivirus program while performing the online scan. Click HERE to see how to disable the most common antivirus programs.

• Hold down Control and click on the following link to open ESET OnlineScan in a new window.
  ESET OnlineScan
• Click the button.
• For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
  • Click on to download the ESET Smart Installer. Save it to your desktop.
  • Double click on the icon on your desktop.
• Check
• Click the button.
• Accept any security warnings from your browser.
• Check
• Push the Start button.
• ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
• When the scan completes, push
• Push , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
• Push the button.
• Push

You can refer to this animation by neomage if needed.

[Cathy J]

Hi Maliprog...here are the results from the scan

C:\SwSetup\AOLIMS\setup.exe probably a variant of Win32/Agent.HZHBURL trojan cleaned by deleting - quarantined

[maliprog]

Hi Cathy J

Let's do final scan to see if anything left...

• Run OTL.
• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
• Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
• When the scan completes, it will open notepad window. OTL.Txt. These are saved in the same location as OTL.
• Please copy (Edit->Select All, Edit->Copy) the contents of this file, and post it with your next reply.

[Cathy J]

OTL logfile created on: 2/5/2011 8:24:51 AM - Run 2
OTL by OldTimer - Version 3.2.20.5 Folder = C:\Users\Cathy\Desktop\OTL
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18999)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 60.00% Memory free
6.00 Gb Paging File | 5.00 Gb Available in Paging File | 81.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 221.04 Gb Total Space | 135.19 Gb Free Space | 61.16% Space Free | Partition Type: NTFS
Drive D: | 11.84 Gb Total Space | 1.99 Gb Free Space | 16.78% Space Free | Partition Type: NTFS

Computer Name: CATHY-LAPTOP | User Name: Cathy | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/01/24 16:22:05 | 000,603,136 | ---- | M] (OldTimer Tools) -- C:\Users\Cathy\Desktop\OTL\OTL.exe
PRC - [2010/11/02 22:06:06 | 000,365,336 | ---- | M] (Kaspersky Lab ZAO) -- C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe
PRC - [2010/09/22 12:03:38 | 000,249,136 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
PRC - [2009/04/11 00:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2008/01/20 20:23:32 | 001,008,184 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Defender\MSASCui.exe
PRC - [2007/09/05 14:09:54 | 000,727,592 | ---- | M] (Broadcom Corporation.) -- C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe


========== Modules (SafeList) ==========

MOD - [2011/01/24 16:22:05 | 000,603,136 | ---- | M] (OldTimer Tools) -- C:\Users\Cathy\Desktop\OTL\OTL.exe
MOD - [2010/08/31 09:43:52 | 001,686,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll


========== Win32 Services (SafeList) ==========

SRV - [2010/11/02 22:06:06 | 000,365,336 | ---- | M] (Kaspersky Lab ZAO) [Auto | Running] -- C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe -- (AVP)
SRV - [2010/09/22 12:03:38 | 000,249,136 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe -- (SeaPort)
SRV - [2010/03/18 12:16:28 | 000,753,504 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe -- (WPFFontCache_v0400)
SRV - [2010/03/18 12:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009/09/24 19:27:04 | 000,793,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\FntCache.dll -- (FontCache)
SRV - [2008/01/20 20:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007/03/05 11:30:06 | 000,110,592 | ---- | M] (Hewlett-Packard Development Company, L.P.) [On_Demand | Stopped] -- C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe -- (Com4Qlb)


========== Driver Services (SafeList) ==========

DRV - [2010/10/01 10:37:42 | 000,488,536 | ---- | M] (Kaspersky Lab) [File_System | System | Running] -- C:\Windows\System32\drivers\klif.sys -- (KLIF)
DRV - [2010/06/09 16:43:52 | 000,011,352 | ---- | M] (Kaspersky Lab ZAO) [Kernel | System | Running] -- C:\Windows\System32\drivers\kl2.sys -- (kl2)
DRV - [2010/06/09 16:43:50 | 000,132,184 | ---- | M] (Kaspersky Lab ZAO) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\kl1.sys -- (kl1)
DRV - [2010/04/22 18:07:34 | 000,022,104 | ---- | M] (Kaspersky Lab ZAO) [Kernel | System | Running] -- C:\Windows\System32\drivers\klim6.sys -- (KLIM6)
DRV - [2009/11/02 19:27:16 | 000,019,984 | ---- | M] (Kaspersky Lab) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\klmouflt.sys -- (klmouflt)
DRV - [2009/10/22 12:54:18 | 000,037,392 | ---- | M] (Kaspersky Lab) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\89320072.sys -- (89320072)
DRV - [2009/09/25 16:59:42 | 000,128,016 | ---- | M] (Kaspersky Lab) [Kernel | System | Running] -- C:\Windows\System32\drivers\89320071.sys -- (89320071)
DRV - [2008/01/20 20:23:27 | 000,386,616 | ---- | M] (LSI Corporation, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\megasr.sys -- (MegaSR)
DRV - [2008/01/20 20:23:27 | 000,149,560 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu320.sys -- (adpu320)
DRV - [2008/01/20 20:23:27 | 000,031,288 | ---- | M] (LSI Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\megasas.sys -- (megasas)
DRV - [2008/01/20 20:23:26 | 000,101,432 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu160m.sys -- (adpu160m)
DRV - [2008/01/20 20:23:26 | 000,074,808 | ---- | M] (Silicon Integrated Systems) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sisraid4.sys -- (SiSRaid4)
DRV - [2008/01/20 20:23:26 | 000,040,504 | ---- | M] (Hewlett-Packard Company) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\hpcisss.sys -- (HpCISSs)
DRV - [2008/01/20 20:23:25 | 000,300,600 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpahci.sys -- (adpahci)
DRV - [2008/01/20 20:23:25 | 000,089,656 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_sas.sys -- (LSI_SAS)
DRV - [2008/01/20 20:23:24 | 001,122,360 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql2300.sys -- (ql2300)
DRV - [2008/01/20 20:23:24 | 000,118,784 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\E1G60I32.sys -- (E1G60) Intel®
DRV - [2008/01/20 20:23:24 | 000,079,928 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arcsas.sys -- (arcsas)
DRV - [2008/01/20 20:23:23 | 000,235,064 | ---- | M] (Intel Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iastorv.sys -- (iaStorV)
DRV - [2008/01/20 20:23:23 | 000,130,616 | ---- | M] (VIA Technologies Inc.,Ltd) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\vsmraid.sys -- (vsmraid)
DRV - [2008/01/20 20:23:23 | 000,115,816 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata2.sys -- (ulsata2)
DRV - [2008/01/20 20:23:23 | 000,096,312 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_scsi.sys -- (LSI_SCSI)
DRV - [2008/01/20 20:23:23 | 000,096,312 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_fc.sys -- (LSI_FC)
DRV - [2008/01/20 20:23:23 | 000,079,416 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arc.sys -- (arc)
DRV - [2008/01/20 20:23:22 | 000,342,584 | ---- | M] (Emulex) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\elxstor.sys -- (elxstor)
DRV - [2008/01/20 20:23:22 | 000,200,704 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VSTAZL3.SYS -- (HSFHWAZL)
DRV - [2008/01/20 20:23:21 | 000,422,968 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adp94xx.sys -- (adp94xx)
DRV - [2008/01/20 20:23:21 | 000,102,968 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvraid.sys -- (nvraid)
DRV - [2008/01/20 20:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvstor.sys -- (nvstor)
DRV - [2008/01/20 20:23:20 | 000,238,648 | ---- | M] (ULi Electronics Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\uliahci.sys -- (uliahci)
DRV - [2008/01/20 20:23:00 | 000,020,024 | ---- | M] (VIA Technologies, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\viaide.sys -- (viaide)
DRV - [2008/01/20 20:23:00 | 000,019,000 | ---- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\cmdide.sys -- (cmdide)
DRV - [2008/01/20 20:23:00 | 000,017,464 | ---- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\aliide.sys -- (aliide)
DRV - [2007/11/17 13:39:50 | 001,040,544 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvmfdx32.sys -- (NVENETFD)
DRV - [2007/10/08 21:21:00 | 007,626,304 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2007/10/08 14:26:28 | 001,044,472 | ---- | M] (Broadcom Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\BCMWL6.SYS -- (BCM43XX)
DRV - [2007/10/08 14:26:28 | 001,044,472 | ---- | M] (Broadcom Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\BCMWL6.SYS -- (BCM43XV)
DRV - [2007/10/01 09:35:52 | 000,183,352 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\CHDART.sys -- (HdAudAddService)
DRV - [2007/09/18 07:12:28 | 000,080,936 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\btwavdt.sys -- (btwavdt)
DRV - [2007/09/18 07:12:28 | 000,080,424 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\btwaudio.sys -- (btwaudio)
DRV - [2007/09/18 07:12:28 | 000,016,168 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\btwrchid.sys -- (btwrchid)
DRV - [2007/08/08 21:42:08 | 000,045,568 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimmptsk.sys -- (rimmptsk)
DRV - [2007/07/30 12:54:02 | 000,038,400 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rixdptsk.sys -- (rismxdp)
DRV - [2007/07/30 11:42:58 | 000,043,008 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimsptsk.sys -- (rimsptsk)
DRV - [2007/07/11 11:30:22 | 000,007,168 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HpqRemHid.sys -- (HpqRemHid)
DRV - [2007/07/09 17:27:56 | 000,008,704 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\XAudio.sys -- (XAudio)
DRV - [2007/07/06 23:58:56 | 000,155,136 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\Apfiltr.sys -- (ApfiltrService)
DRV - [2007/06/19 14:29:56 | 000,984,064 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HSX_DPV.sys -- (HSF_DPV)
DRV - [2007/06/19 14:28:34 | 000,208,896 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HSXHWAZL.sys -- (HSXHWAZL)
DRV - [2007/06/19 14:28:22 | 000,660,480 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HSX_CNXT.sys -- (winachsf)
DRV - [2007/06/18 18:12:04 | 000,016,768 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HpqKbFiltr.sys -- (HpqKbFiltr)
DRV - [2007/02/16 10:50:32 | 000,012,032 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvsmu.sys -- (nvsmu)
DRV - [2006/11/02 03:50:35 | 000,106,088 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql40xx.sys -- (ql40xx)
DRV - [2006/11/02 03:50:35 | 000,098,408 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata.sys -- (UlSata)
DRV - [2006/11/02 03:50:19 | 000,045,160 | ---- | M] (IBM Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nfrd960.sys -- (nfrd960)
DRV - [2006/11/02 03:50:17 | 000,041,576 | ---- | M] (Intel Corp./ICP vortex GmbH) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iirsp.sys -- (iirsp)
DRV - [2006/11/02 03:50:11 | 000,071,272 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\djsvs.sys -- (aic78xx)
DRV - [2006/11/02 03:50:09 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteraid.sys -- (iteraid)
DRV - [2006/11/02 03:50:07 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteatapi.sys -- (iteatapi)
DRV - [2006/11/02 03:50:05 | 000,035,944 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\symc8xx.sys -- (Symc8xx)
DRV - [2006/11/02 03:50:03 | 000,034,920 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_u3.sys -- (Sym_u3)
DRV - [2006/11/02 03:49:59 | 000,033,384 | ---- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\mraid35x.sys -- (Mraid35x)
DRV - [2006/11/02 03:49:56 | 000,031,848 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_hi.sys -- (Sym_hi)
DRV - [2006/11/02 02:25:24 | 000,071,808 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserid.sys -- (Brserid) Brother MFC Serial Port Interface Driver (WDM)
DRV - [2006/11/02 02:24:47 | 000,011,904 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brusbser.sys -- (BrUsbSer)
DRV - [2006/11/02 02:24:46 | 000,005,248 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltup.sys -- (BrFiltUp)
DRV - [2006/11/02 02:24:45 | 000,013,568 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltlo.sys -- (BrFiltLo)
DRV - [2006/11/02 02:24:44 | 000,062,336 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserwdm.sys -- (BrSerWdm)
DRV - [2006/11/02 02:24:44 | 000,012,160 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brusbmdm.sys -- (BrUsbMdm)
DRV - [2006/11/02 01:36:50 | 000,020,608 | ---- | M] (N-trig Innovative Technologies) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ntrigdigi.sys -- (ntrigdigi)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.h...ilion&pf=laptop
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.h...ilion&pf=laptop

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.h...ilion&pf=laptop
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 00 3E F9 56 C2 B9 CB 01 [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.google.com/"
FF - prefs.js..extensions.enabledItems: [email protected]:7
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:1.6.5.200812101546
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: [email protected]:11.0.2.556
FF - prefs.js..extensions.enabledItems: [email protected]:11.0.2.556
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..keyword.URL: "http://www.mywebsear...tml&searchfor="


FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/12/12 17:28:20 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/12/12 17:28:20 | 000,000,000 | ---D | M]

[2008/06/17 21:41:11 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Cathy\AppData\Roaming\Mozilla\Extensions
[2011/02/04 07:43:47 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Cathy\AppData\Roaming\Mozilla\Firefox\Profiles\t282izpd.default\extensions
[2009/09/01 19:50:18 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Cathy\AppData\Roaming\Mozilla\Firefox\Profiles\t282izpd.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2009/10/29 17:43:09 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Users\Cathy\AppData\Roaming\Mozilla\Firefox\Profiles\t282izpd.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2009/11/10 13:10:39 | 000,002,171 | ---- | M] () -- C:\Users\Cathy\AppData\Roaming\Mozilla\Firefox\Profiles\t282izpd.default\searchplugins\bing.xml
[2009/04/20 20:08:10 | 000,009,895 | ---- | M] () -- C:\Users\Cathy\AppData\Roaming\Mozilla\Firefox\Profiles\t282izpd.default\searchplugins\mywebsearch.xml
[2011/01/18 09:12:50 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2010/04/29 21:16:33 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/08/22 07:46:41 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010/10/19 22:34:09 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011/01/18 09:12:50 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
[2011/01/06 22:46:17 | 000,000,000 | ---D | M] (Anti-Banner) -- C:\Program Files\Mozilla Firefox\extensions\[email protected]
[2011/01/06 22:46:17 | 000,000,000 | ---D | M] (Kaspersky URL Advisor) -- C:\Program Files\Mozilla Firefox\extensions\[email protected]
[2010/05/17 19:41:45 | 000,000,000 | ---D | M] (Move Media Player) -- C:\USERS\CATHY\APPDATA\ROAMING\MOVE NETWORKS
[2010/11/12 18:53:06 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll

O1 HOSTS File: ([2006/09/18 15:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\ievkbd.dll (Kaspersky Lab ZAO)
O2 - BHO: (no name) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - No CLSID value found.
O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
O2 - BHO: (FilterBHO Class) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll (Kaspersky Lab ZAO)
O2 - BHO: (HP Print Clips) - {FFFFFFFF-FF12-44C5-91EC-068E3AA1B2D7} - c:\Program Files\HP\Smart Web Printing\hpswp_framework.dll (Hewlett-Packard Co.)
O3 - HKLM\..\Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AVP] C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe (Kaspersky Lab ZAO)
O4 - HKLM..\Run: [HP Health Check Scheduler] File not found
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvSvc] C:\Windows\System32\nvsvc.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [UCam_Menu] C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [SUPERAntiSpyware] File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 28
O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\ie_banner_deny.htm ()
O8 - Extra context menu item: Send image to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Send page to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: &Virtual Keyboard - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll (Kaspersky Lab ZAO)
O9 - Extra Button: HP Smart Select - {58ECB495-38F0-49cb-A538-10282ABF65E7} - c:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll (Hewlett-Packard Co.)
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: URLs c&heck - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll (Kaspersky Lab ZAO)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Ranges: Range1 ([http] in Local intranet)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.m...ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.ad...Plus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 68.94.156.1 68.94.157.1
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\PROGRA~1\KASPER~1\KASPER~2\mzvkbd3.dll) - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\mzvkbd3.dll (Kaspersky Lab ZAO)
O20 - AppInit_DLLs: (C:\PROGRA~1\KASPER~1\KASPER~2\kloehk.dll) - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\kloehk.dll (Kaspersky Lab ZAO)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\klogon: DllName - C:\Windows\system32\klogon.dll - C:\Windows\System32\klogon.dll (Kaspersky Lab ZAO)
O24 - Desktop WallPaper: C:\Users\Cathy\AppData\Roaming\Mozilla\Firefox\Desktop Background.bmp
O24 - Desktop BackupWallPaper: C:\Users\Cathy\AppData\Roaming\Mozilla\Firefox\Desktop Background.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/02/28 23:04:12 | 000,000,074 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2005/09/11 09:18:54 | 000,000,340 | -HS- | M] () - D:\AUTOMODE -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/02/04 18:36:55 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2011/02/02 13:06:35 | 000,311,312 | ---- | C] (Kaspersky Lab) -- C:\Windows\System32\drivers\8932007.sys
[2011/02/02 13:06:35 | 000,128,016 | ---- | C] (Kaspersky Lab) -- C:\Windows\System32\drivers\89320071.sys
[2011/02/02 13:06:35 | 000,037,392 | ---- | C] (Kaspersky Lab) -- C:\Windows\System32\drivers\89320072.sys
[2011/02/02 13:06:34 | 000,000,000 | ---D | C] -- C:\Users\Cathy\Desktop\Virus Removal Tool
[2011/02/02 12:53:32 | 090,379,784 | ---- | C] ( ) -- C:\Users\Cathy\Desktop\setup_9.0.0.722_02.02.2011_20-50.exe
[2011/01/31 19:00:09 | 000,000,000 | ---D | C] -- C:\Users\Cathy\DoctorWeb
[2011/01/29 15:43:57 | 000,000,000 | ---D | C] -- C:\Users\Cathy\Desktop\New Folder (2)
[2011/01/28 08:59:14 | 000,000,000 | ---D | C] -- C:\_OTL
[2011/01/25 22:08:59 | 000,000,000 | ---D | C] -- C:\Users\Cathy\AppData\Roaming\SUPERAntiSpyware.com
[2011/01/25 22:08:59 | 000,000,000 | ---D | C] -- C:\ProgramData\SUPERAntiSpyware.com
[2011/01/25 22:08:40 | 000,000,000 | ---D | C] -- C:\Users\Cathy\Desktop\New Folder
[2011/01/25 22:08:15 | 000,000,000 | ---D | C] -- C:\Users\Cathy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware
[2011/01/24 16:21:48 | 000,000,000 | ---D | C] -- C:\Users\Cathy\Desktop\OTL
[2011/01/21 12:27:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Google
[2011/01/19 08:21:36 | 000,000,000 | ---D | C] -- C:\Users\Cathy\AppData\Roaming\PhotoScape
[2011/01/19 08:20:39 | 000,000,000 | ---D | C] -- C:\Users\Cathy\AppData\Local\Google
[2011/01/19 08:20:32 | 000,000,000 | ---D | C] -- C:\Program Files\Google
[2011/01/18 21:21:57 | 001,912,872 | ---- | C] (Trend Micro Inc.) -- C:\Users\Cathy\Desktop\HousecallLauncher.exe
[2011/01/18 21:21:18 | 000,000,000 | ---D | C] -- C:\Users\Cathy\Trend Micro online scanner
[2011/01/07 13:35:46 | 000,000,000 | R--D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LightScribe Direct Disc Labeling
[2011/01/07 13:33:05 | 013,354,880 | ---- | C] (LightScribe ) -- C:\Users\Cathy\Desktop\LS_Update_1.18.20.1_.exe
[2011/01/07 10:42:19 | 000,000,000 | ---D | C] -- C:\Users\Cathy\Desktop\Astrid Eileen
[2011/01/06 22:36:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky Internet Security 2011
[2011/01/06 22:10:57 | 115,832,504 | ---- | C] (Kaspersky Lab) -- C:\Users\Cathy\Desktop\kis11.0.2.556en.exe
[2011/01/06 20:17:16 | 000,000,000 | ---D | C] -- C:\Users\Cathy\AppData\Roaming\Malwarebytes
[2011/01/06 20:17:00 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2011/01/06 20:17:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/01/06 20:16:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2011/01/06 20:16:55 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2011/01/06 20:16:55 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware

========== Files - Modified Within 30 Days ==========

[2011/02/05 08:20:28 | 000,000,237 | ---- | M] () -- C:\Users\Public\Documents\hpqp.ini
[2011/02/05 08:19:38 | 000,027,335 | ---- | M] () -- C:\Users\Cathy\AppData\Roaming\nvModes.001
[2011/02/05 08:18:21 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011/02/05 08:18:21 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011/02/05 08:18:16 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011/02/05 08:18:10 | 3152,973,824 | -HS- | M] () -- C:\hiberfil.sys
[2011/02/04 23:53:54 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2011/02/04 18:36:09 | 002,672,312 | ---- | M] () -- C:\Users\Cathy\Desktop\esetsmartinstaller_enu.exe
[2011/02/03 07:13:39 | 000,001,356 | ---- | M] () -- C:\Users\Cathy\AppData\Local\d3d9caps.dat
[2011/02/02 13:04:45 | 090,379,784 | ---- | M] ( ) -- C:\Users\Cathy\Desktop\setup_9.0.0.722_02.02.2011_20-50.exe
[2011/01/31 18:57:46 | 055,686,248 | ---- | M] () -- C:\Users\Cathy\Desktop\drweb-cureit.exe
[2011/01/30 07:07:32 | 000,133,632 | ---- | M] () -- C:\Users\Cathy\Desktop\RKUnhookerLE.EXE
[2011/01/29 16:34:29 | 418,564,346 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2011/01/27 14:30:59 | 000,027,335 | ---- | M] () -- C:\Users\Cathy\AppData\Roaming\nvModes.dat
[2011/01/26 00:21:53 | 000,001,892 | ---- | M] () -- C:\Users\Cathy\AppData\Roaming\wklnhst.dat
[2011/01/25 23:56:36 | 000,001,533 | ---- | M] () -- C:\Users\Cathy\Desktop\SUPERAntiSpyware Free Edition.lnk
[2011/01/23 20:03:45 | 000,036,352 | ---- | M] () -- C:\Users\Cathy\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/01/23 07:43:20 | 000,000,000 | ---- | M] () -- C:\Users\Cathy\Documents\Image1.gif
[2011/01/20 15:11:18 | 000,001,783 | ---- | M] () -- C:\Users\Cathy\Desktop\Vulnerability Scan.lnk
[2011/01/20 15:11:14 | 000,001,767 | ---- | M] () -- C:\Users\Cathy\Desktop\Critical Areas Scan.lnk
[2011/01/20 15:11:06 | 000,001,775 | ---- | M] () -- C:\Users\Cathy\Desktop\Full Scan.lnk
[2011/01/18 21:22:19 | 000,000,036 | ---- | M] () -- C:\Users\Cathy\AppData\Local\housecall.guid.cache
[2011/01/18 21:22:01 | 001,912,872 | ---- | M] (Trend Micro Inc.) -- C:\Users\Cathy\Desktop\HousecallLauncher.exe
[2011/01/18 20:13:59 | 000,010,240 | ---- | M] () -- C:\Users\Cathy\Documents\police report.wps
[2011/01/17 21:48:06 | 000,000,322 | ---- | M] () -- C:\Windows\tasks\HPCeeScheduleForCathy.job
[2011/01/17 19:24:43 | 000,019,456 | ---- | M] () -- C:\Users\Cathy\Documents\Letter for Astrid.wps
[2011/01/07 13:35:55 | 000,001,914 | ---- | M] () -- C:\Users\Public\Desktop\LightScribe.lnk
[2011/01/07 13:33:18 | 013,354,880 | ---- | M] (LightScribe ) -- C:\Users\Cathy\Desktop\LS_Update_1.18.20.1_.exe
[2011/01/07 08:33:15 | 002,113,638 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011/01/07 08:33:15 | 000,641,732 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011/01/06 22:57:44 | 000,114,243 | ---- | M] () -- C:\Windows\System32\drivers\klin.dat
[2011/01/06 22:57:44 | 000,097,859 | ---- | M] () -- C:\Windows\System32\drivers\klick.dat
[2011/01/06 22:45:02 | 005,433,376 | -HS- | M] () -- C:\Windows\System32\drivers\fidbox.dat
[2011/01/06 22:45:02 | 001,114,144 | -HS- | M] () -- C:\Windows\System32\drivers\fidbox2.dat
[2011/01/06 22:45:02 | 000,044,576 | -HS- | M] () -- C:\Windows\System32\drivers\fidbox.idx
[2011/01/06 22:45:02 | 000,004,888 | -HS- | M] () -- C:\Windows\System32\drivers\fidbox2.idx
[2011/01/06 22:22:59 | 115,832,504 | ---- | M] (Kaspersky Lab) -- C:\Users\Cathy\Desktop\kis11.0.2.556en.exe
[2011/01/06 20:17:01 | 000,000,906 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk

========== Files Created - No Company Name ==========

[2011/02/04 18:35:59 | 002,672,312 | ---- | C] () -- C:\Users\Cathy\Desktop\esetsmartinstaller_enu.exe
[2011/01/31 18:51:30 | 055,686,248 | ---- | C] () -- C:\Users\Cathy\Desktop\drweb-cureit.exe
[2011/01/30 07:07:31 | 000,133,632 | ---- | C] () -- C:\Users\Cathy\Desktop\RKUnhookerLE.EXE
[2011/01/29 16:34:29 | 418,564,346 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2011/01/27 18:44:50 | 3152,973,824 | -HS- | C] () -- C:\hiberfil.sys
[2011/01/25 22:08:17 | 000,001,533 | ---- | C] () -- C:\Users\Cathy\Desktop\SUPERAntiSpyware Free Edition.lnk
[2011/01/23 07:43:20 | 000,000,000 | ---- | C] () -- C:\Users\Cathy\Documents\Image1.gif
[2011/01/20 15:11:18 | 000,001,783 | ---- | C] () -- C:\Users\Cathy\Desktop\Vulnerability Scan.lnk
[2011/01/20 15:11:14 | 000,001,767 | ---- | C] () -- C:\Users\Cathy\Desktop\Critical Areas Scan.lnk
[2011/01/20 15:11:06 | 000,001,775 | ---- | C] () -- C:\Users\Cathy\Desktop\Full Scan.lnk
[2011/01/18 21:22:19 | 000,000,036 | ---- | C] () -- C:\Users\Cathy\AppData\Local\housecall.guid.cache
[2011/01/18 20:13:59 | 000,010,240 | ---- | C] () -- C:\Users\Cathy\Documents\police report.wps
[2011/01/07 13:35:54 | 000,001,914 | ---- | C] () -- C:\Users\Public\Desktop\LightScribe.lnk
[2011/01/06 20:17:01 | 000,000,906 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/05/12 08:38:13 | 000,000,012 | ---- | C] () -- C:\Users\Cathy\AppData\Local\2631
[2010/05/12 08:38:12 | 000,000,012 | ---- | C] () -- C:\Users\Cathy\AppData\Roaming\9481
[2010/05/12 08:38:12 | 000,000,012 | ---- | C] () -- C:\ProgramData\1548
[2010/05/12 08:38:12 | 000,000,012 | ---- | C] () -- C:\ProgramData\1477
[2010/05/12 08:38:11 | 000,000,012 | ---- | C] () -- C:\ProgramData\0359
[2010/01/07 08:20:50 | 000,001,356 | ---- | C] () -- C:\Users\Cathy\AppData\Local\d3d9caps.dat
[2009/09/17 20:47:10 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009/08/03 14:07:42 | 000,403,816 | ---- | C] () -- C:\Windows\System32\OGACheckControl.dll
[2008/12/06 19:06:43 | 000,765,952 | ---- | C] () -- C:\Windows\System32\xvidcore.dll
[2008/12/06 19:06:43 | 000,180,224 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll
[2008/08/24 08:01:17 | 000,000,376 | ---- | C] () -- C:\Windows\ODBC.INI
[2008/08/13 13:42:13 | 000,001,892 | ---- | C] () -- C:\Users\Cathy\AppData\Roaming\wklnhst.dat
[2008/06/17 08:34:36 | 000,027,335 | ---- | C] () -- C:\Users\Cathy\AppData\Roaming\nvModes.001
[2008/06/16 17:37:52 | 000,027,335 | ---- | C] () -- C:\Users\Cathy\AppData\Roaming\nvModes.dat
[2008/06/12 23:10:07 | 000,036,352 | ---- | C] () -- C:\Users\Cathy\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/06/12 22:49:48 | 000,000,000 | ---- | C] () -- C:\Users\Cathy\AppData\Local\QSwitch.txt
[2008/06/12 22:49:48 | 000,000,000 | ---- | C] () -- C:\Users\Cathy\AppData\Local\DSwitch.txt
[2008/06/12 22:49:48 | 000,000,000 | ---- | C] () -- C:\Users\Cathy\AppData\Local\AtStart.txt
[2008/02/28 23:21:37 | 000,000,688 | ---- | C] () -- C:\ProgramData\hpzinstall.log
[2007/09/05 13:52:04 | 000,389,120 | ---- | C] () -- C:\Windows\System32\btwhidcs.dll
[2006/11/02 06:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006/11/02 01:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2001/11/14 14:56:00 | 001,802,240 | ---- | C] () -- C:\Windows\System32\lcppn21.dll

========== LOP Check ==========

[2010/06/06 14:34:40 | 000,000,000 | ---D | M] -- C:\Users\Cathy\AppData\Roaming\Facebook
[2010/05/12 08:38:14 | 000,000,000 | ---D | M] -- C:\Users\Cathy\AppData\Roaming\Imagic505N
[2010/01/03 20:31:46 | 000,000,000 | ---D | M] -- C:\Users\Cathy\AppData\Roaming\MSNInstaller
[2011/01/19 08:24:55 | 000,000,000 | ---D | M] -- C:\Users\Cathy\AppData\Roaming\PhotoScape
[2008/08/13 13:42:43 | 000,000,000 | ---D | M] -- C:\Users\Cathy\AppData\Roaming\Template
[2011/01/26 20:23:13 | 000,000,000 | ---D | M] -- C:\Users\Cathy\AppData\Roaming\uTorrent
[2010/12/23 15:08:39 | 000,000,000 | ---D | M] -- C:\Users\Cathy\AppData\Roaming\Visan
[2008/07/03 21:41:01 | 000,000,000 | ---D | M] -- C:\Users\Cathy\AppData\Roaming\WildTangent
[2011/02/04 23:53:56 | 000,032,656 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2010/08/25 19:59:01 | 000,000,392 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{C9085E99-C73A-4E94-9D89-77CB0FF6B216}.job

========== Purity Check ==========



< End of report >

[Cathy J]

Maliprog what else do we need to do?

[Cathy J]

After looking back and reviewing my Kaspersky scans there might be some things that you need to know. On 1-7-11 scan inactive: Trojen-spy. On 1-9-11 scan inactive:HUER:Trojan.Win32.generic. 1-28-11 scan suspicious: Phishing: www.spycheck.co.uk (this is on there twice). Don't know if this means anything or not but thought you might need to know.
Maliprog, Thank you so very much for helping me!!

[maliprog]

Hi Cathy J,

Phishing is the one way to loose your personal information. You can read more about phishing Here

You logs and system are clean now. We need to clean up your PC from programs we used.

Step 1

Please start OTL one more time and click CleanUp button. OTL will restart your system at the end.

General recommendations

Here are some recommendations you should follow to minimize infection risk in the future:

1. Enable Windows Update

• Click Start, click Run, type sysdm.cpl, and then press ENTER.
• Click the Automatic Updates tab, and then click to select one of the following options. We recommend that you select the Automatic (recommended) Automatically download recommended updates for my computer and install them option.
• Click OK button

2. Delete Temp files

Download TFC to your desktop

• Open the file and close any other windows.
• It will close all programs itself when run, make sure to let it run uninterrupted.
• Click the Start button to begin the process. The program should not take long to finish its job
• Once its finished it should reboot your machine, if not, do this yourself to ensure a complete clean

3. Make Backups of Important Files

Please read this article Home Computer Data Backup.


4. Regularly update your software

To eliminate design flaws and security vulnerabilities, all software needs to be updated to the latest version or the vendor’s patch installed.

You should download Update Checker from here. The program will automaticly check for newer version of software installed on your system.

[Cathy J]

Maliprog I did everything that you said to do in your last post. Sorry I have not been on to tell you thank you so much for your help. I am still not so sure that I am totally safe and paranoid to do any business transactions online. As soon as I feel secure enough to do so...I will try to set up a paypal account. Thank you again for all your help! It has meant so much to me!