Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Hijacked internet being redirected


  • Please log in to reply

#1
dmanatee

dmanatee

    New Member

  • Member
  • Pip
  • 4 posts
I hope someone can help me. I use bing or google and everytime I search say for Saltwater fish I get sent to random addresses and I think It is slowing it down.
I have run AVG, Malwarebyte, and Spy bot - search and distroy. all three of them have been running. And AVG is going nuts saying that I am covered in viruses.
Thank you for your time. I realize this time of year we are all very busy.

Here is my Data:
OTL logfile created on: 4/21/2011 5:06:45 PM - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Users\DanielleK\Downloads
Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 48.00% Memory free
5.00 Gb Paging File | 4.00 Gb Available in Paging File | 69.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 286.78 Gb Total Space | 206.64 Gb Free Space | 72.05% Space Free | Partition Type: NTFS
Drive D: | 11.12 Gb Total Space | 1.86 Gb Free Space | 16.72% Space Free | Partition Type: NTFS
Drive E: | 973.88 Mb Total Space | 254.19 Mb Free Space | 26.10% Space Free | Partition Type: FAT

Computer Name: DANIELLEK-PC | User Name: DanielleK | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/04/21 17:05:43 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\DanielleK\Downloads\OTL.exe
PRC - [2011/04/20 08:33:26 | 001,376,768 | ---- | M] (opx.bit) -- C:\ProgramData\KBDHELA232.exe
PRC - [2011/04/20 08:33:26 | 001,376,768 | ---- | M] (opx.bit) -- C:\ProgramData\apss32.exe
PRC - [2011/03/10 13:23:48 | 000,234,656 | ---- | M] (Adobe Systems, Inc.) -- C:\Windows\System32\Macromed\Flash\FlashUtil10n_ActiveX.exe
PRC - [2011/01/07 02:22:54 | 002,747,744 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\avgtray.exe
PRC - [2011/01/07 02:22:44 | 001,084,256 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\avgnsx.exe
PRC - [2011/01/07 02:22:12 | 001,052,512 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\avgemcx.exe
PRC - [2011/01/06 16:23:20 | 000,737,872 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSMonitor.exe
PRC - [2011/01/06 16:23:18 | 006,128,720 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
PRC - [2010/12/05 17:26:40 | 000,654,176 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\avgrsx.exe
PRC - [2010/12/05 17:26:12 | 000,650,592 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\avgchsvx.exe
PRC - [2010/12/01 14:07:27 | 004,765,040 | ---- | M] (BitTorrent, Inc.) -- C:\Program Files\BitTorrent\BitTorrent.exe
PRC - [2010/10/22 05:58:18 | 000,265,400 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\avgwdsvc.exe
PRC - [2010/10/22 05:56:58 | 000,845,664 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\avgcsrvx.exe
PRC - [2010/10/14 18:27:38 | 000,092,216 | ---- | M] (Hewlett-Packard Company) -- C:\Program Files\Hewlett-Packard\Shared\HPDrvMntSvc.exe
PRC - [2010/10/14 18:26:04 | 000,311,352 | ---- | M] (Hewlett-Packard Development Company L.P.) -- C:\Program Files\Hewlett-Packard\Shared\hpCaslNotification.exe
PRC - [2010/07/07 08:20:24 | 001,008,128 | ---- | M] (W3i, LLC) -- C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe
PRC - [2009/10/30 23:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009/09/04 13:43:40 | 000,795,936 | ---- | M] (Broadcom Corporation.) -- C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
PRC - [2009/09/04 13:43:38 | 002,360,608 | ---- | M] (Broadcom Corporation.) -- C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe
PRC - [2009/09/04 13:43:38 | 000,595,232 | ---- | M] (Broadcom Corporation.) -- C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
PRC - [2009/07/23 18:23:56 | 000,178,720 | ---- | M] () -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
PRC - [2009/07/23 18:23:54 | 000,387,616 | ---- | M] () -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
PRC - [2009/07/21 03:33:32 | 000,458,844 | ---- | M] (IDT, Inc.) -- C:\Program Files\IDT\WDM\sttray.exe
PRC - [2009/07/21 03:33:32 | 000,221,266 | ---- | M] (IDT, Inc.) -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_8e7d5b9d3a91d8c5\stacsv.exe
PRC - [2009/07/14 04:54:00 | 000,589,104 | ---- | M] (Hewlett-Packard) -- C:\Program Files\Hewlett-Packard\HP QuickSync\QuickSync.exe
PRC - [2009/07/14 04:54:00 | 000,135,168 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Hewlett-Packard\HP QuickSync\jre\bin\javaw.exe
PRC - [2009/07/13 19:14:42 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2009/07/13 19:14:15 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe
PRC - [2009/03/01 23:43:08 | 000,081,920 | ---- | M] (Andrea Electronics Corporation) -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_8e7d5b9d3a91d8c5\AEstSrv.exe
PRC - [2009/01/26 15:31:16 | 002,144,088 | RHS- | M] (Safer Networking Limited) -- C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
PRC - [2009/01/26 15:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) -- C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
PRC - [2000/06/29 02:45:10 | 000,052,224 | ---- | M] (Kenonic Controls Ltd.) -- C:\Windows\System32\Crypserv.exe


========== Modules (SafeList) ==========

MOD - [2011/04/21 17:05:43 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\DanielleK\Downloads\OTL.exe
MOD - [2010/08/20 23:21:32 | 001,680,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll


========== Win32 Services (SafeList) ==========

SRV - [2011/04/20 08:33:26 | 001,376,768 | ---- | M] (opx.bit) [Auto | Running] -- C:\ProgramData\KBDHELA232.exe -- (COMSysApp32)
SRV - [2011/01/06 16:23:18 | 006,128,720 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe -- (AVGIDSAgent)
SRV - [2010/10/22 05:58:18 | 000,265,400 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG10\avgwdsvc.exe -- (avgwd)
SRV - [2010/10/14 18:27:38 | 000,092,216 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Program Files\Hewlett-Packard\Shared\HPDrvMntSvc.exe -- (HPDrvMntSvc.exe)
SRV - [2010/10/12 11:59:12 | 000,206,072 | ---- | M] (WildTangent, Inc.) [On_Demand | Stopped] -- C:\Program Files\WildTangent Games\App\GamesAppService.exe -- (GamesAppService)
SRV - [2010/03/18 11:19:26 | 000,113,152 | ---- | M] (ArcSoft Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe -- (ACDaemon)
SRV - [2010/03/10 09:13:12 | 001,343,400 | ---- | M] (Microsoft Corporation) [Unknown | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc)
SRV - [2009/09/04 13:43:38 | 000,595,232 | ---- | M] (Broadcom Corporation.) [Auto | Running] -- C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe -- (btwdins)
SRV - [2009/07/23 18:23:56 | 000,178,720 | ---- | M] () [Auto | Running] -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe -- (nSvcIp)
SRV - [2009/07/23 18:23:54 | 000,387,616 | ---- | M] () [Auto | Running] -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe -- (ForceWare Intelligent Application Manager (IAM)) ForceWare Intelligent Application Manager (IAM)
SRV - [2009/07/21 03:33:32 | 000,221,266 | ---- | M] (IDT, Inc.) [Auto | Running] -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_8e7d5b9d3a91d8c5\stacsv.exe -- (STacSV)
SRV - [2009/07/13 19:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009/07/13 19:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2009/03/01 23:43:08 | 000,081,920 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_8e7d5b9d3a91d8c5\AEstSrv.exe -- (AESTFilters)
SRV - [2009/01/26 15:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) [Auto | Running] -- C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe -- (SBSDWSCService)
SRV - [2000/06/29 02:45:10 | 000,052,224 | ---- | M] (Kenonic Controls Ltd.) [Auto | Running] -- C:\Windows\System32\Crypserv.exe -- (Crypkey License)


========== Driver Services (SafeList) ==========

DRV - [2010/12/20 23:22:36 | 000,239,664 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Apfiltr.sys -- (ApfiltrService)
DRV - [2010/12/20 18:09:00 | 000,038,224 | ---- | M] (Malwarebytes Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\mbamswissarmy.sys -- (MBAMSwissArmy)
DRV - [2010/12/08 05:12:38 | 000,251,728 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\System32\drivers\avgldx86.sys -- (Avgldx86)
DRV - [2010/11/12 14:19:38 | 000,299,984 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\System32\drivers\avgtdix.sys -- (Avgtdix)
DRV - [2010/09/13 16:27:54 | 000,025,680 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\AVGIDSEH.Sys -- (AVGIDSEH)
DRV - [2010/09/07 04:48:56 | 000,034,384 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\Windows\System32\drivers\avgmfx86.sys -- (Avgmfx86)
DRV - [2010/09/07 04:48:50 | 000,026,064 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\system32\DRIVERS\avgrkx86.sys -- (Avgrkx86)
DRV - [2010/08/19 21:42:38 | 000,123,472 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AVGIDSDriver.sys -- (AVGIDSDriver)
DRV - [2010/08/19 21:42:38 | 000,030,288 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AVGIDSFilter.sys -- (AVGIDSFilter)
DRV - [2010/08/19 21:42:36 | 000,021,072 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AVGIDSShim.sys -- (AVGIDSShim)
DRV - [2009/07/23 00:01:00 | 009,791,072 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2009/07/21 03:33:32 | 000,409,088 | ---- | M] (IDT, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\stwrt.sys -- (STHDA)
DRV - [2009/07/16 21:13:30 | 000,171,008 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\RtsUStor.sys -- (RSUSBSTOR)
DRV - [2009/07/13 17:52:10 | 000,014,336 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\vwifimp.sys -- (vwifimp)
DRV - [2009/07/13 16:02:52 | 000,347,264 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nvm62x32.sys -- (NVENETFD)
DRV - [2009/06/30 22:20:54 | 000,287,392 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvmf6232.sys -- (NVNET)
DRV - [2009/06/30 03:32:54 | 000,212,000 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\nvstor32.sys -- (nvstor32)
DRV - [2009/06/28 10:36:36 | 000,017,920 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvsmu.sys -- (nvsmu)
DRV - [2009/06/26 01:55:12 | 000,066,080 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvhda32v.sys -- (NVHDA)
DRV - [2000/02/03 13:53:12 | 000,024,608 | ---- | M] () [Kernel | System | Running] -- C:\Windows\system32\ckldrv.sys -- (NetworkX)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.h...avilion&pf=cnnb
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.h...avilion&pf=cnnb
IE - HKLM\..\URLSearchHook: {88c7f2aa-f93f-432c-8f0e-b7d85967a527} - C:\Program Files\BitTorrentBar\tbBitT.dll (Conduit Ltd.)

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.h...avilion&pf=cnnb
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.bing.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = A7 9B AD 01 82 5A EC 4B AF 33 0E CC 34 A8 7C E4 [binary data]
IE - HKCU\..\URLSearchHook: {88c7f2aa-f93f-432c-8f0e-b7d85967a527} - C:\Program Files\BitTorrentBar\tbBitT.dll (Conduit Ltd.)
IE - HKCU\..\URLSearchHook: {b80f591e-fe9a-46cf-a13e-180377240586} - Reg Error: Key error. File not found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG10\Firefox\ [2010/12/31 19:09:33 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG10\Firefox4\ [2011/03/30 09:41:15 | 000,000,000 | ---D | M]


O1 HOSTS File: ([2011/04/21 14:44:12 | 000,432,840 | R--- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 127.0.0.1 123fporn.info
O1 - Hosts: 14894 more lines...
O2 - BHO: (no name) - {01AD9BA7-5A82-4BEC-AF33-0ECC34A87CE4} - C:\Windows\System32\api-ms-win-core-fibers-l1-1-032.dll (Borland Software Corporation)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG10\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (BitTorrentBar Toolbar) - {88c7f2aa-f93f-432c-8f0e-b7d85967a527} - C:\Program Files\BitTorrentBar\tbBitT.dll (Conduit Ltd.)
O2 - BHO: (Microsoft Live Search Toolbar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\Program Files\MSN\Toolbar\3.0.0560.0\msneshellx.dll (Microsoft Corp.)
O2 - BHO: (ShopAtHomeIEHelper Class) - {E8DAAA30-6CAA-4b58-9603-8E54238219E2} - File not found
O3 - HKLM\..\Toolbar: (Microsoft Live Search Toolbar) - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - c:\Program Files\MSN\Toolbar\3.0.0560.0\msneshellx.dll (Microsoft Corp.)
O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (BitTorrentBar Toolbar) - {88c7f2aa-f93f-432c-8f0e-b7d85967a527} - C:\Program Files\BitTorrentBar\tbBitT.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (ShopAtHome.com Toolbar) - {98279C38-DE4B-4bcf-93C9-8EC26069D6F4} - File not found
O3 - HKCU\..\Toolbar\WebBrowser: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (BitTorrentBar Toolbar) - {88C7F2AA-F93F-432C-8F0E-B7D85967A527} - C:\Program Files\BitTorrentBar\tbBitT.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (ShopAtHome.com Toolbar) - {98279C38-DE4B-4BCF-93C9-8EC26069D6F4} - File not found
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [HP] C:\Program Files\Hewlett-Packard\HP QuickSync\QuickSync.exe (Hewlett-Packard)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [SelectRebates] File not found
O4 - HKLM..\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray.exe (IDT, Inc.)
O4 - HKLM..\Run: [UpdatePRCShortCut] C:\Program Files\Hewlett-Packard\Recovery\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKCU..\Run: [BitTorrent] C:\Program Files\BitTorrent\BitTorrent.exe (BitTorrent, Inc.)
O4 - HKCU..\Run: [InstallIQUpdater] C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe (W3i, LLC)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer Networking Limited)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: WallpaperStyle = 2
O8 - Extra context menu item: &ieSpell Options - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O8 - Extra context menu item: Check &Spelling - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O8 - Extra context menu item: Lookup on Merriam Webster - C:\Program Files\ieSpell\Merriam Webster.HTM ()
O8 - Extra context menu item: Lookup on Wikipedia - C:\Program Files\ieSpell\wikipedia.HTM ()
O8 - Extra context menu item: Send image to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Send page to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O9 - Extra 'Tools' menuitem : ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O9 - Extra 'Tools' menuitem : ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O9 - Extra Button: @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O13 - gopher Prefix: missing
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} http://office.micros...n/ieawsdc32.cab (Microsoft Office Template and Media Control)
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} http://dlm.tools.aka...vex-2.2.5.0.cab (DLM Control)
O16 - DPF: {6218F7B5-0D3A-48BA-AE4C-49DCFA63D400} http://www.myheritag...EngineQuery.dll (CSEQueryObject Object)
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebo...oUploader55.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_24)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1 205.171.3.25
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG10\avgpp.dll (AVG Technologies CZ, s.r.o.)
O20 - AppInit_DLLs: (C:\ProgramData\api-ms-win-core-fibers-l1-1-032.dll) - C:\ProgramData\api-ms-win-core-fibers-l1-1-032.dll (Borland Software Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 15:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{223a4cf3-2f0f-11df-9156-00271348d010}\Shell - "" = AutoRun
O33 - MountPoints2\{223a4cf3-2f0f-11df-9156-00271348d010}\Shell\AutoRun\command - "" = E:\LaunchU3.exe -a
O33 - MountPoints2\E\Shell - "" = AutoRun
O33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\LaunchU3.exe -a
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgchsvx.exe /sync) - C:\Program Files\AVG\AVG10\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgrsx.exe /sync /restart) - C:\Program Files\AVG\AVG10\avgrsx.exe (AVG Technologies CZ, s.r.o.)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/04/21 12:55:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy
[2011/04/21 12:55:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy
[2011/04/21 12:55:05 | 000,000,000 | ---D | C] -- C:\Program Files\Spybot - Search & Destroy
[2011/04/21 12:02:03 | 000,000,000 | ---D | C] -- C:\Users\DanielleK\AppData\Local\{1A3018D0-06E4-4A48-9661-EED6DEE32CF5}
[2011/04/20 19:07:52 | 000,000,000 | ---D | C] -- C:\ProgramData\661972231
[2011/04/20 19:04:51 | 000,000,000 | -HSD | C] -- C:\ProgramData\SysWoW32
[2011/04/20 19:04:34 | 000,000,000 | ---D | C] -- C:\ProgramData\182523903
[2011/04/20 19:02:36 | 000,256,000 | ---- | C] (Borland Software Corporation) -- C:\ProgramData\api-ms-win-core-fibers-l1-1-032.dll
[2011/04/20 18:59:30 | 001,376,768 | ---- | C] (opx.bit) -- C:\ProgramData\KBDHELA232.exe
[2011/04/20 12:07:47 | 000,000,000 | ---D | C] -- C:\Users\DanielleK\AppData\Local\{9974F2A0-63CB-466F-A75A-12CDB392BD7F}
[2011/04/20 11:29:35 | 000,000,000 | ---D | C] -- C:\Users\DanielleK\AppData\Roaming\FreeFileViewer
[2011/04/20 11:28:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FreeFileViewer
[2011/04/20 11:23:46 | 001,376,768 | ---- | C] (opx.bit) -- C:\ProgramData\apss32.exe
[2011/04/20 11:23:20 | 000,181,248 | ---- | C] (opx.bit) -- C:\Windows\System32\apss32.exe
[2011/04/20 11:23:10 | 000,418,304 | ---- | C] (Borland Software Corporation) -- C:\Windows\System32\api-ms-win-core-fibers-l1-1-032.dll
[2011/04/20 09:34:06 | 000,000,000 | ---D | C] -- C:\Program Files\[bleep] NFO Viewer
[2011/04/18 21:20:42 | 000,000,000 | ---D | C] -- C:\Users\DanielleK\Desktop\Quilting Program and Data
[2011/04/18 20:27:52 | 000,000,000 | ---D | C] -- C:\Users\DanielleK\Desktop\QuiltAssistant
[2011/04/18 20:26:47 | 000,000,000 | ---D | C] -- C:\Users\DanielleK\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\QuiltAssistant
[2011/04/18 20:26:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuiltAssistant
[2011/04/18 20:26:47 | 000,000,000 | ---D | C] -- C:\Program Files\QuiltAssistant
[2011/04/18 09:46:57 | 000,000,000 | ---D | C] -- C:\Users\DanielleK\AppData\Local\{D0629004-5AA1-43C9-8B23-3B1049127303}
[2011/04/16 18:15:38 | 000,000,000 | -HSD | C] -- C:\ProgramData\0C3851F70202899C8D80B197D718C975
[2011/04/16 18:10:37 | 000,000,000 | ---D | C] -- C:\Program Files\File Type Assistant
[2011/04/16 18:08:26 | 000,000,000 | ---D | C] -- C:\Program Files\FreeFileViewer
[2011/04/16 15:45:55 | 000,000,000 | ---D | C] -- C:\Users\DanielleK\Incomplete
[2011/04/16 15:44:37 | 000,000,000 | ---D | C] -- C:\Users\DanielleK\AppData\Roaming\LimeWire
[2011/04/16 15:43:36 | 000,000,000 | ---D | C] -- C:\Users\DanielleK\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\360Share Pro
[2011/04/16 15:43:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\360Share Pro
[2011/04/16 15:43:03 | 000,000,000 | ---D | C] -- C:\Program Files\360Share Pro
[2011/04/16 12:43:56 | 000,000,000 | ---D | C] -- C:\Users\DanielleK\AppData\Local\{ED94CEA9-2050-423F-AB0F-BD3B5F1E6B72}
[2011/04/13 13:38:31 | 000,000,000 | ---D | C] -- C:\Users\DanielleK\AppData\Local\{C5130170-9C6D-4FF8-9198-FB55DBB92722}
[2011/04/12 17:05:02 | 000,000,000 | ---D | C] -- C:\Users\DanielleK\AppData\Local\{2A77F047-66FF-4F0D-9B00-D3DAF1329470}
[2011/04/07 20:41:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WorldOfGoo
[2011/04/07 20:40:55 | 000,000,000 | ---D | C] -- C:\Program Files\WorldOfGoo
[2011/04/07 18:44:36 | 000,000,000 | ---D | C] -- C:\Users\DanielleK\AppData\Local\2DBoy
[2011/04/07 18:44:36 | 000,000,000 | ---D | C] -- C:\ProgramData\2DBoy
[2011/04/07 18:38:08 | 000,000,000 | ---D | C] -- C:\Users\DanielleK\Desktop\Anti virus
[2011/04/07 18:37:51 | 000,000,000 | ---D | C] -- C:\Program Files\WildTangent Games
[2011/04/07 11:44:17 | 000,000,000 | ---D | C] -- C:\Users\DanielleK\AppData\Local\{E0CBEC2F-C81B-461A-A247-3D7AB1634C20}
[2011/04/06 00:01:19 | 000,000,000 | ---D | C] -- C:\Users\DanielleK\AppData\Local\{487F2F5F-A899-41A2-8FE4-BC1BD94109AF}
[2011/04/05 23:28:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StyleWriter
[2011/04/05 23:28:35 | 000,165,888 | ---- | C] (Kenonic Controls) -- C:\Windows\Ckconfig.exe
[2011/04/05 23:28:35 | 000,052,224 | ---- | C] (Kenonic Controls Ltd.) -- C:\Windows\System32\Crypserv.exe
[2011/04/05 23:28:24 | 000,000,000 | ---D | C] -- C:\SWWIN
[2011/04/05 11:26:14 | 000,000,000 | ---D | C] -- C:\Users\DanielleK\AppData\Local\{C400300B-19D6-42E8-8AF5-B44332EDD449}
[2011/04/03 11:37:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinDjView
[2011/04/03 11:37:51 | 000,000,000 | ---D | C] -- C:\Program Files\WinDjView
[2011/04/02 13:05:22 | 000,000,000 | ---D | C] -- C:\Users\DanielleK\AppData\Local\{C588F485-2EE0-4AE4-9420-F1D6BA4E9AD2}
[2011/04/01 12:49:53 | 000,000,000 | ---D | C] -- C:\Users\DanielleK\AppData\Roaming\Catalina Marketing Corp
[2011/04/01 12:49:50 | 000,000,000 | ---D | C] -- C:\Users\DanielleK\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Catalina Marketing Corp
[2011/04/01 12:27:30 | 000,000,000 | ---D | C] -- C:\Users\DanielleK\AppData\Local\{1CC22B89-8155-4EB8-AE8F-255C90988FBF}
[2011/03/31 14:23:25 | 000,000,000 | ---D | C] -- C:\Users\DanielleK\Desktop\Storybook
[2011/03/31 13:22:13 | 000,000,000 | ---D | C] -- C:\Users\DanielleK\AppData\Local\{812767E7-62A2-4CF2-8755-8481429BDB8C}
[2011/03/31 13:20:42 | 000,000,000 | R--D | C] -- C:\Users\DanielleK\Desktop\Programs I dont use
[2011/03/31 13:13:55 | 000,000,000 | ---D | C] -- C:\Users\DanielleK\Desktop\Tatting
[2011/03/31 13:13:18 | 000,000,000 | ---D | C] -- C:\Users\DanielleK\Desktop\NOVEL IDEAS
[2011/03/31 10:02:45 | 000,000,000 | ---D | C] -- C:\Users\DanielleK\AppData\Roaming\Malwarebytes
[2011/03/31 10:02:22 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2011/03/31 10:02:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/03/31 10:02:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2011/03/31 10:02:14 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2011/03/31 10:02:13 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2011/03/31 09:17:59 | 000,000,000 | ---D | C] -- C:\Users\DanielleK\Documents\MSDS
[2011/03/31 09:16:59 | 000,000,000 | ---D | C] -- C:\Users\DanielleK\Documents\Novels
[2011/03/31 09:13:40 | 000,000,000 | ---D | C] -- C:\Users\DanielleK\AppData\Local\{FD3DBFAD-0150-405A-9D94-3C3E371E5BDB}
[2011/03/30 22:19:20 | 000,000,000 | ---D | C] -- C:\Users\DanielleK\AppData\Local\{37031E00-05FB-45F7-BD6A-9A6853C2BAE1}
[2011/03/30 15:18:03 | 000,000,000 | ---D | C] -- C:\Users\DanielleK\Documents\storybook
[2011/03/30 12:21:11 | 000,000,000 | -HSD | C] -- C:\Windows\System32\%APPDATA%
[2011/03/30 12:18:50 | 000,000,000 | ---D | C] -- C:\Users\DanielleK\.storybook
[2011/03/30 12:18:12 | 000,000,000 | ---D | C] -- C:\Users\DanielleK\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Storybook
[2011/03/30 12:18:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Storybook
[2011/03/28 13:49:31 | 000,000,000 | ---D | C] -- C:\Users\DanielleK\AppData\Roaming\Acapela Group
[2011/03/28 13:46:04 | 000,000,000 | ---D | C] -- C:\Users\DanielleK\AppData\Local\Downloaded Installations
[2011/03/25 10:10:12 | 000,000,000 | ---D | C] -- C:\Program Files\ieSpell
[2011/03/24 13:46:35 | 000,000,000 | ---D | C] -- C:\ProgramData\AVS4YOU
[2011/03/24 13:46:18 | 000,000,000 | ---D | C] -- C:\Users\DanielleK\AppData\Roaming\AVS4YOU
[2011/03/24 13:37:20 | 000,000,000 | ---D | C] -- C:\Users\DanielleK\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AVS4YOU
[2011/03/24 13:35:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVS4YOU
[2011/03/24 13:34:51 | 000,000,000 | ---D | C] -- C:\Program Files\AVS4YOU
[2011/03/24 13:33:50 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\AVSMedia
[1 C:\Users\DanielleK\Desktop\*.tmp files -> C:\Users\DanielleK\Desktop\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/04/21 16:49:26 | 000,000,061 | ---- | M] () -- C:\ProgramData\6853779f
[2011/04/21 16:31:54 | 000,023,248 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011/04/21 16:31:54 | 000,023,248 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011/04/21 16:29:37 | 000,624,178 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011/04/21 16:29:37 | 000,110,746 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011/04/21 16:24:11 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011/04/21 15:19:33 | 000,000,386 | ---- | M] () -- C:\Windows\tasks\Free File Viewer Update Checker.job
[2011/04/21 15:18:17 | 2212,999,168 | -HS- | M] () -- C:\hiberfil.sys
[2011/04/21 14:44:12 | 000,432,840 | R--- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2011/04/21 12:55:55 | 000,001,200 | ---- | M] () -- C:\Users\DanielleK\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2011/04/21 10:02:08 | 112,998,864 | ---- | M] () -- C:\Windows\System32\drivers\AVG\incavi.avm
[2011/04/20 19:12:16 | 000,001,185 | ---- | M] () -- C:\ProgramData\1219038180
[2011/04/20 19:04:52 | 000,000,144 | -HS- | M] () -- C:\ProgramData\1753424072
[2011/04/20 19:04:34 | 000,203,776 | -HS- | M] () -- C:\ProgramData\unrar.exe
[2011/04/20 19:02:36 | 000,256,000 | ---- | M] (Borland Software Corporation) -- C:\ProgramData\api-ms-win-core-fibers-l1-1-032.dll
[2011/04/20 19:02:36 | 000,000,113 | ---- | M] () -- C:\Windows\System32\1115514863
[2011/04/20 11:28:38 | 000,001,021 | ---- | M] () -- C:\Users\DanielleK\Application Data\Microsoft\Internet Explorer\Quick Launch\FreeFileViewer.lnk
[2011/04/20 11:28:38 | 000,000,997 | ---- | M] () -- C:\Users\DanielleK\Desktop\FreeFileViewer.lnk
[2011/04/20 11:23:20 | 000,181,248 | ---- | M] (opx.bit) -- C:\Windows\System32\apss32.exe
[2011/04/20 11:23:10 | 000,418,304 | ---- | M] (Borland Software Corporation) -- C:\Windows\System32\api-ms-win-core-fibers-l1-1-032.dll
[2011/04/20 08:33:26 | 001,376,768 | ---- | M] (opx.bit) -- C:\ProgramData\KBDHELA232.exe
[2011/04/20 08:33:26 | 001,376,768 | ---- | M] (opx.bit) -- C:\ProgramData\apss32.exe
[2011/04/19 23:45:11 | 000,000,336 | ---- | M] () -- C:\Windows\tasks\HPCeeScheduleForDanielleK.job
[2011/04/19 23:45:05 | 000,339,384 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2011/04/07 21:17:11 | 000,004,480 | ---- | M] () -- C:\Windows\System32\esnecil.ind
[2011/04/07 20:41:25 | 000,001,823 | ---- | M] () -- C:\Users\Public\Desktop\World of Goo.lnk
[2011/04/07 18:41:41 | 000,001,969 | ---- | M] () -- C:\WildTangent Games App - hp.lnk
[2011/04/07 18:41:39 | 000,002,452 | ---- | M] () -- C:\Users\Public\Desktop\WildTangent Games App - hp.lnk
[2011/04/07 18:39:04 | 000,002,484 | ---- | M] () -- C:\Users\DanielleK\Application Data\Microsoft\Internet Explorer\Quick Launch\WildTangent Games App - hp.lnk
[2011/04/05 23:53:41 | 000,000,014 | -HS- | M] () -- C:\Users\DanielleK\Desktop\SWWIN.ent
[2011/04/05 23:53:40 | 000,004,480 | ---- | M] () -- C:\Windows\System32\esnecil.nlp
[2011/04/05 23:53:40 | 000,000,014 | -HS- | M] () -- C:\Users\DanielleK\Desktop\SWWIN.rst
[2011/04/05 23:53:40 | 000,000,014 | -HS- | M] () -- C:\Users\DanielleK\Desktop\SWWIN.key
[2011/04/05 23:53:40 | 000,000,000 | -HS- | M] () -- C:\Users\DanielleK\Desktop\SWWIN.41s
[2011/04/05 23:28:40 | 000,000,025 | ---- | M] () -- C:\Windows\Crypkey.ini
[2011/03/31 14:23:26 | 000,001,860 | ---- | M] () -- C:\Users\DanielleK\Desktop\Storybook.lnk
[2011/03/30 21:37:40 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2011/03/30 21:37:40 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[1 C:\Users\DanielleK\Desktop\*.tmp files -> C:\Users\DanielleK\Desktop\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/04/21 12:55:55 | 000,001,200 | ---- | C] () -- C:\Users\DanielleK\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2011/04/20 19:04:51 | 000,001,185 | ---- | C] () -- C:\ProgramData\1219038180
[2011/04/20 19:04:34 | 000,203,776 | -HS- | C] () -- C:\ProgramData\unrar.exe
[2011/04/20 19:04:34 | 000,000,144 | -HS- | C] () -- C:\ProgramData\1753424072
[2011/04/20 11:29:04 | 000,000,386 | ---- | C] () -- C:\Windows\tasks\Free File Viewer Update Checker.job
[2011/04/20 11:28:38 | 000,001,021 | ---- | C] () -- C:\Users\DanielleK\Application Data\Microsoft\Internet Explorer\Quick Launch\FreeFileViewer.lnk
[2011/04/20 11:28:38 | 000,000,997 | ---- | C] () -- C:\Users\DanielleK\Desktop\FreeFileViewer.lnk
[2011/04/16 18:25:33 | 000,000,061 | ---- | C] () -- C:\ProgramData\6853779f
[2011/04/16 15:53:41 | 000,000,113 | ---- | C] () -- C:\Windows\System32\1115514863
[2011/04/07 20:41:25 | 000,001,823 | ---- | C] () -- C:\Users\Public\Desktop\World of Goo.lnk
[2011/04/07 18:41:41 | 000,001,969 | ---- | C] () -- C:\WildTangent Games App - hp.lnk
[2011/04/07 18:39:01 | 000,002,484 | ---- | C] () -- C:\Users\DanielleK\Application Data\Microsoft\Internet Explorer\Quick Launch\WildTangent Games App - hp.lnk
[2011/04/07 18:38:59 | 000,002,452 | ---- | C] () -- C:\Users\Public\Desktop\WildTangent Games App - hp.lnk
[2011/04/05 23:53:40 | 000,000,014 | -HS- | C] () -- C:\Users\DanielleK\Desktop\SWWIN.rst
[2011/04/05 23:53:40 | 000,000,014 | -HS- | C] () -- C:\Users\DanielleK\Desktop\SWWIN.key
[2011/04/05 23:53:40 | 000,000,014 | -HS- | C] () -- C:\Users\DanielleK\Desktop\SWWIN.ent
[2011/04/05 23:53:40 | 000,000,000 | -HS- | C] () -- C:\Users\DanielleK\Desktop\SWWIN.41s
[2011/04/05 23:44:27 | 000,004,480 | ---- | C] () -- C:\Windows\System32\esnecil.nlp
[2011/04/05 23:44:27 | 000,004,480 | ---- | C] () -- C:\Windows\System32\esnecil.ind
[2011/04/05 23:28:40 | 000,000,025 | ---- | C] () -- C:\Windows\Crypkey.ini
[2011/04/05 23:28:35 | 000,024,608 | ---- | C] () -- C:\Windows\System32\Ckldrv.sys
[2011/04/05 23:28:35 | 000,011,776 | ---- | C] () -- C:\Windows\Ckrfresh.exe
[2011/04/05 23:28:34 | 000,027,648 | R--- | C] () -- C:\Windows\Setup_ck.exe
[2011/04/05 23:28:34 | 000,018,432 | ---- | C] () -- C:\Windows\Setup_ck.dll
[2011/03/30 21:37:40 | 000,000,000 | RHS- | C] () -- C:\MSDOS.SYS
[2011/03/30 21:37:40 | 000,000,000 | RHS- | C] () -- C:\IO.SYS
[2011/03/30 12:18:12 | 000,001,860 | ---- | C] () -- C:\Users\DanielleK\Desktop\Storybook.lnk
[2011/01/04 15:31:02 | 000,001,849 | ---- | C] () -- C:\Users\DanielleK\AppData\Roaming\GhostObjGAFix.xml
[2010/12/09 15:05:41 | 000,085,504 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll
[2010/01/07 22:33:02 | 000,000,104 | ---- | C] () -- C:\Users\DanielleK\AppData\Roaming\wklnhst.dat
[2009/08/28 03:05:08 | 000,006,656 | ---- | C] () -- C:\Windows\System32\bcmwlrc.dll
[2009/08/28 02:56:18 | 000,006,136 | ---- | C] () -- C:\Windows\System32\drivers\nvphy.bin
[2009/08/03 16:07:42 | 000,403,816 | ---- | C] () -- C:\Windows\System32\OGACheckControl.dll
[2009/08/03 16:07:42 | 000,230,768 | ---- | C] () -- C:\Windows\System32\OGAEXEC.exe
[2009/07/13 22:57:37 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009/07/13 22:33:53 | 000,339,384 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2009/07/13 20:05:48 | 000,624,178 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2009/07/13 20:05:48 | 000,291,294 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2009/07/13 20:05:48 | 000,110,746 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2009/07/13 20:05:48 | 000,031,548 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2009/07/13 20:05:05 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2009/07/13 20:04:11 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2009/07/13 17:55:01 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009/07/13 17:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll
[2009/07/13 17:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll
[2009/06/10 15:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat

========== LOP Check ==========

[2011/03/28 13:49:31 | 000,000,000 | ---D | M] -- C:\Users\DanielleK\AppData\Roaming\Acapela Group
[2009/12/27 18:00:50 | 000,000,000 | ---D | M] -- C:\Users\DanielleK\AppData\Roaming\Alawar
[2010/12/02 11:00:53 | 000,000,000 | ---D | M] -- C:\Users\DanielleK\AppData\Roaming\AVG10
[2011/04/21 17:14:14 | 000,000,000 | ---D | M] -- C:\Users\DanielleK\AppData\Roaming\BitTorrent
[2011/04/01 12:49:53 | 000,000,000 | ---D | M] -- C:\Users\DanielleK\AppData\Roaming\Catalina Marketing Corp
[2010/01/08 12:55:33 | 000,000,000 | ---D | M] -- C:\Users\DanielleK\AppData\Roaming\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2010/01/25 22:17:04 | 000,000,000 | ---D | M] -- C:\Users\DanielleK\AppData\Roaming\DriverCure
[2011/04/20 19:46:00 | 000,000,000 | ---D | M] -- C:\Users\DanielleK\AppData\Roaming\FreeFileViewer
[2011/04/16 18:32:25 | 000,000,000 | ---D | M] -- C:\Users\DanielleK\AppData\Roaming\LimeWire
[2011/02/26 13:25:57 | 000,000,000 | ---D | M] -- C:\Users\DanielleK\AppData\Roaming\PhotoScape
[2010/01/22 18:48:21 | 000,000,000 | ---D | M] -- C:\Users\DanielleK\AppData\Roaming\Template
[2011/01/05 14:54:30 | 000,000,000 | ---D | M] -- C:\Users\DanielleK\AppData\Roaming\Windows Live Writer
[2011/04/21 15:19:33 | 000,000,386 | ---- | M] () -- C:\Windows\Tasks\Free File Viewer Update Checker.job
[2011/02/21 00:27:09 | 000,032,580 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Files - Unicode (All) ==========
[2011/04/07 21:17:11 | 000,000,000 | ---D | M](C:\Windows\System32\????) -- C:\Windows\System32\ಸ眢瞸
[2011/04/07 21:17:11 | 000,000,000 | ---D | C](C:\Windows\System32\????) -- C:\Windows\System32\ಸ眢瞸

< End of report >
  • 0

Advertisements


#2
RKinner

RKinner

    Malware Expert

  • Expert
  • 23,192 posts
  • MVP
Disable Spybot's TeaTimer to make sure it won't interfere with fixes. You can re-enable it when you're clean again:

* Run Spybot-S&D in Advanced Mode
* If it is not already set to do this, go to the Mode menu
select
Advanced Mode
* On the left hand side, click on Tools
* Then click on the Resident icon in the list
* Uncheck
Resident TeaTimer
and OK any prompts.
* Restart your computer

Uninstall
Limewire,
Bit Torrent,
360Share Pro
Conduit Engine



Copy the text between the lines of stars by highlighting and Ctrl + c


********************************************************************
:Services
COMSysApp32

:OTL
PRC - [2011/04/20 08:33:26 | 001,376,768 | ---- | M] (opx.bit) -- C:\ProgramData\KBDHELA232.exe
PRC - [2011/04/20 08:33:26 | 001,376,768 | ---- | M] (opx.bit) -- C:\ProgramData\apss32.exe
SRV - [2011/04/20 08:33:26 | 001,376,768 | ---- | M] (opx.bit) [Auto | Running] -- C:\ProgramData\KBDHELA232.exe -- (COMSysApp32)
IE - HKCU\..\URLSearchHook: {88c7f2aa-f93f-432c-8f0e-b7d85967a527} - C:\Program Files\BitTorrentBar\tbBitT.dll (Conduit Ltd.)
IE - HKCU\..\URLSearchHook: {b80f591e-fe9a-46cf-a13e-180377240586} - Reg Error: Key error. File not found
O2 - BHO: (no name) - {01AD9BA7-5A82-4BEC-AF33-0ECC34A87CE4} - C:\Windows\System32\api-ms-win-core-fibers-l1-1-032.dll (Borland Software Corporation)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (BitTorrentBar Toolbar) - {88c7f2aa-f93f-432c-8f0e-b7d85967a527} - C:\Program Files\BitTorrentBar\tbBitT.dll (Conduit Ltd.)
O2 - BHO: (ShopAtHomeIEHelper Class) - {E8DAAA30-6CAA-4b58-9603-8E54238219E2} - File not found
O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (BitTorrentBar Toolbar) - {88c7f2aa-f93f-432c-8f0e-b7d85967a527} - C:\Program Files\BitTorrentBar\tbBitT.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (ShopAtHome.com Toolbar) - {98279C38-DE4B-4bcf-93C9-8EC26069D6F4} - File not found
O3 - HKCU\..\Toolbar\WebBrowser: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (BitTorrentBar Toolbar) - {88C7F2AA-F93F-432C-8F0E-B7D85967A527} - C:\Program Files\BitTorrentBar\tbBitT.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (ShopAtHome.com Toolbar) - {98279C38-DE4B-4BCF-93C9-8EC26069D6F4} - File not found
O4 - HKLM..\Run: [SelectRebates] File not found
O4 - HKCU..\Run: [BitTorrent] C:\Program Files\BitTorrent\BitTorrent.exe (BitTorrent, Inc.)
O4 - HKCU..\Run: [InstallIQUpdater] C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe (W3i, LLC)
O20 - AppInit_DLLs: (C:\ProgramData\api-ms-win-core-fibers-l1-1-032.dll) - C:\ProgramData\api-ms-win-core-fibers-l1-1-032.dll (Borland Software Corporation)

[2011/04/21 12:02:03 | 000,000,000 | ---D | C] -- C:\Users\DanielleK\AppData\Local\{1A3018D0-06E4-4A48-9661-EED6DEE32CF5}
[2011/04/20 19:07:52 | 000,000,000 | ---D | C] -- C:\ProgramData\661972231
[2011/04/20 19:04:51 | 000,000,000 | -HSD | C] -- C:\ProgramData\SysWoW32
[2011/04/20 19:04:34 | 000,000,000 | ---D | C] -- C:\ProgramData\182523903
[2011/04/20 19:02:36 | 000,256,000 | ---- | C] (Borland Software Corporation) -- C:\ProgramData\api-ms-win-core-fibers-l1-1-032.dll
[2011/04/20 18:59:30 | 001,376,768 | ---- | C] (opx.bit) -- C:\ProgramData\KBDHELA232.exe
[2011/04/20 12:07:47 | 000,000,000 | ---D | C] -- C:\Users\DanielleK\AppData\Local\{9974F2A0-63CB-466F-A75A-12CDB392BD7F}
[2011/04/20 11:29:35 | 000,000,000 | ---D | C] -- C:\Users\DanielleK\AppData\Roaming\FreeFileViewer
[2011/04/20 11:28:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FreeFileViewer
[2011/04/20 11:23:46 | 001,376,768 | ---- | C] (opx.bit) -- C:\ProgramData\apss32.exe
[2011/04/20 11:23:20 | 000,181,248 | ---- | C] (opx.bit) -- C:\Windows\System32\apss32.exe
[2011/04/20 11:23:10 | 000,418,304 | ---- | C] (Borland Software Corporation) -- C:\Windows\System32\api-ms-win-core-fibers-l1-1-032.dll
[2011/04/20 09:34:06 | 000,000,000 | ---D | C] -- C:\Program Files\[bleep] NFO Viewer
[2011/04/18 09:46:57 | 000,000,000 | ---D | C] -- C:\Users\DanielleK\AppData\Local\{D0629004-5AA1-43C9-8B23-3B1049127303}
[2011/04/16 18:15:38 | 000,000,000 | -HSD | C] -- C:\ProgramData\0C3851F70202899C8D80B197D718C975
[2011/04/16 18:10:37 | 000,000,000 | ---D | C] -- C:\Program Files\File Type Assistant
[2011/04/16 18:08:26 | 000,000,000 | ---D | C] -- C:\Program Files\FreeFileViewer
[2011/04/16 12:43:56 | 000,000,000 | ---D | C] -- C:\Users\DanielleK\AppData\Local\{ED94CEA9-2050-423F-AB0F-BD3B5F1E6B72}
[2011/04/13 13:38:31 | 000,000,000 | ---D | C] -- C:\Users\DanielleK\AppData\Local\{C5130170-9C6D-4FF8-9198-FB55DBB92722}
[2011/04/12 17:05:02 | 000,000,000 | ---D | C] -- C:\Users\DanielleK\AppData\Local\{2A77F047-66FF-4F0D-9B00-D3DAF1329470}
[2011/04/07 11:44:17 | 000,000,000 | ---D | C] -- C:\Users\DanielleK\AppData\Local\{E0CBEC2F-C81B-461A-A247-3D7AB1634C20}
[2011/04/06 00:01:19 | 000,000,000 | ---D | C] -- C:\Users\DanielleK\AppData\Local\{487F2F5F-A899-41A2-8FE4-BC1BD94109AF}
[2011/04/05 11:26:14 | 000,000,000 | ---D | C] -- C:\Users\DanielleK\AppData\Local\{C400300B-19D6-42E8-8AF5-B44332EDD449}
[2011/04/02 13:05:22 | 000,000,000 | ---D | C] -- C:\Users\DanielleK\AppData\Local\{C588F485-2EE0-4AE4-9420-F1D6BA4E9AD2}
[2011/04/01 12:27:30 | 000,000,000 | ---D | C] -- C:\Users\DanielleK\AppData\Local\{1CC22B89-8155-4EB8-AE8F-255C90988FBF}
[2011/03/31 13:22:13 | 000,000,000 | ---D | C] -- C:\Users\DanielleK\AppData\Local\{812767E7-62A2-4CF2-8755-8481429BDB8C}
[2011/03/31 09:13:40 | 000,000,000 | ---D | C] -- C:\Users\DanielleK\AppData\Local\{FD3DBFAD-0150-405A-9D94-3C3E371E5BDB}
[2011/03/30 22:19:20 | 000,000,000 | ---D | C] -- C:\Users\DanielleK\AppData\Local\{37031E00-05FB-45F7-BD6A-9A6853C2BAE1}
[2011/03/30 12:21:11 | 000,000,000 | -HSD | C] -- C:\Windows\System32\%APPDATA%
[2011/04/20 19:04:51 | 000,001,185 | ---- | C] () -- C:\ProgramData\1219038180
[2011/04/20 19:04:34 | 000,203,776 | -HS- | C] () -- C:\ProgramData\unrar.exe
[2011/04/20 19:04:34 | 000,000,144 | -HS- | C] () -- C:\ProgramData\1753424072
[2011/04/20 11:29:04 | 000,000,386 | ---- | C] () -- C:\Windows\tasks\Free File Viewer Update Checker.job
[2011/04/20 11:28:38 | 000,001,021 | ---- | C] () -- C:\Users\DanielleK\Application Data\Microsoft\Internet Explorer\Quick Launch\FreeFileViewer.lnk
[2011/04/20 11:28:38 | 000,000,997 | ---- | C] () -- C:\Users\DanielleK\Desktop\FreeFileViewer.lnk
[2011/04/16 18:25:33 | 000,000,061 | ---- | C] () -- C:\ProgramData\6853779f
[2011/04/16 15:53:41 | 000,000,113 | ---- | C] () -- C:\Windows\System32\1115514863
[2011/04/07 21:17:11 | 000,000,000 | ---D | M](C:\Windows\System32\????) -- C:\Windows\System32\ಸ眢瞸
[2011/04/07 21:17:11 | 000,000,000 | ---D | C](C:\Windows\System32\????) -- C:\Windows\System32\ಸ眢瞸

:Files
C:\ProgramData\KBDHELA232.exe
C:\ProgramData\apss32.exe
C:\ProgramData\api-ms-win-core-fibers-l1-1-032.dll

:Commands
[purity]
[emptytemp]
[Reboot]


*******************************************************************

then Rightclick on OTL and select Run As Administrator to start. Under the Custom Scans/Fixes box at the bottom, paste (ctrl +v) the text. Verify that you got it all and Then click the RUN FIX button (NOT THE QUICK SCAN button!) at the top
Let the program run unhindered, OTL will reboot the PC when it is done.

Open OTL again and select either the All option in the Extra Registry group then the Run Scan button. Post the two logs it produces in your next reply.

If one of the following will not run then just skip to the next one then go back and try the things that wouldn't run again after finishing the others.
Rightclick on Malwarebytes' Anti-Malware and select Run As Administrator to start.

* Once the program has loaded, select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.

* Be sure that everything is checked, and click Remove Selected.

* When completed, a log will open in Notepad. Please save it to a convenient location.
* The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt
* Post that log back here.



ComboFix

You must first uninstall AVG before tunning Combofix then download and run the AVG removal tool.
http://download.avg....6_2011_1322.exe

:!: If you have a previous version of Combofix.exe, delete it and download a fresh copy. :!:

:!: It must be saved to your desktop, do not run it :!:

:!: Disable your Antivirus software when downloading or running Combofix. If it has Script Blocking features, please disable these as well. See: http://www.bleepingc...opic114351.html


Download and Rename this file -- (call it george.exe ) to your Desktop -- from either of these two sources:
http://download.blee...Bs/ComboFix.exe
http://subs.geekstogo.com/ComboFix.exe

Rightclick on george and select Run As Administrator to start the program.



* :!: Important: Have no other programs running. Your Task Bar should be clear of any program entries including your Browser.


* A window may open with a series of Disclaimers. Accept the Disclaimers to start the fix. Allow it to install the Recovery Console then Continue. When the scan completes Notepad will open with with your results log open. Do a File, Exit and answer 'Yes' to save changes.


A caution - Do not run Combofix more than once. Do not touch your mouse/keyboard until the scan has completed, as this may cause the process to stall or your computer to lock. The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled. If this occurs, please reboot to restore the desktop. Even when ComboFix appears to be doing nothing, look at your Drive light. If it is flashing, Combofix is still at work.

A file will be created at => C:\Combofix.txt. I'll need to see that in your reply.


Download TDSSKiller:
http://support.kaspe.../tdsskiller.exe
Save it to your desktop then right click and Run as Administrator

If TDSSKiller alerts you that the system needs to reboot, please consent.
When done, a log file should be created on your C: drive named "TDSSKiller.txt" please copy and paste the contents in your next reply.


Download

http://ad13.geekstogo.com/MBRCheck.exe

Save it and run it by right clicking and Run As Administrator. It will produce a log MBRCheck(date).txt on your desktop. Copy and paste it into a reply.

Install the free Avast. Download and Save the install file to your desktop:

http://www.avast.com...ivirus-download

Right click and Run As Administrator

Once you have it installed and it has updated:
Click on the Avast ball. Then click on Scan Computer, then on
Boot-Time Scan then on Settings. Change the Ask at the bottom to Move to Chest. OK then Schedule Now. Reboot and let it run a scan. It may take hours.
Once it finishes it should load windows. Click on the Avast ball and then on Scan Logs, select the Boot-time scan report then View Results. How many did it find?

Are you still getting redirected?
Ron
  • 0

#3
dmanatee

dmanatee

    New Member

  • Topic Starter
  • Member
  • Pip
  • 4 posts
Sorry for the delay I ended up leaving without being able to deal with my computer.
So now on step 2:
Here is the reports generated with the extra registery all run:
OTL logfile created on: 4/24/2011 6:33:55 PM - Run 2
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Users\DanielleK\Downloads
Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 56.00% Memory free
5.00 Gb Paging File | 4.00 Gb Available in Paging File | 75.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 286.78 Gb Total Space | 206.66 Gb Free Space | 72.06% Space Free | Partition Type: NTFS
Drive D: | 11.12 Gb Total Space | 1.86 Gb Free Space | 16.72% Space Free | Partition Type: NTFS
Drive E: | 973.88 Mb Total Space | 254.19 Mb Free Space | 26.10% Space Free | Partition Type: FAT

Computer Name: DANIELLEK-PC | User Name: DanielleK | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/04/21 17:05:43 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\DanielleK\Downloads\OTL.exe
PRC - [2011/03/10 13:23:48 | 000,234,656 | ---- | M] (Adobe Systems, Inc.) -- C:\Windows\System32\Macromed\Flash\FlashUtil10n_ActiveX.exe
PRC - [2011/01/07 02:22:54 | 002,747,744 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\avgtray.exe
PRC - [2011/01/07 02:22:44 | 001,084,256 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\avgnsx.exe
PRC - [2011/01/07 02:22:12 | 001,052,512 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\avgemcx.exe
PRC - [2011/01/06 16:23:20 | 000,737,872 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSMonitor.exe
PRC - [2011/01/06 16:23:18 | 006,128,720 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
PRC - [2010/12/05 17:26:40 | 000,654,176 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\avgrsx.exe
PRC - [2010/12/05 17:26:12 | 000,650,592 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\avgchsvx.exe
PRC - [2010/10/22 05:58:18 | 000,265,400 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\avgwdsvc.exe
PRC - [2010/10/22 05:56:58 | 000,845,664 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\avgcsrvx.exe
PRC - [2010/10/14 18:27:38 | 000,092,216 | ---- | M] (Hewlett-Packard Company) -- C:\Program Files\Hewlett-Packard\Shared\HPDrvMntSvc.exe
PRC - [2010/10/14 18:26:04 | 000,311,352 | ---- | M] (Hewlett-Packard Development Company L.P.) -- C:\Program Files\Hewlett-Packard\Shared\hpCaslNotification.exe
PRC - [2009/10/30 23:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009/09/04 13:43:40 | 000,795,936 | ---- | M] (Broadcom Corporation.) -- C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
PRC - [2009/09/04 13:43:38 | 002,360,608 | ---- | M] (Broadcom Corporation.) -- C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe
PRC - [2009/09/04 13:43:38 | 000,595,232 | ---- | M] (Broadcom Corporation.) -- C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
PRC - [2009/07/23 18:23:56 | 000,178,720 | ---- | M] () -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
PRC - [2009/07/23 18:23:54 | 000,387,616 | ---- | M] () -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
PRC - [2009/07/21 03:33:32 | 000,458,844 | ---- | M] (IDT, Inc.) -- C:\Program Files\IDT\WDM\sttray.exe
PRC - [2009/07/21 03:33:32 | 000,221,266 | ---- | M] (IDT, Inc.) -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_8e7d5b9d3a91d8c5\stacsv.exe
PRC - [2009/07/14 04:54:00 | 000,589,104 | ---- | M] (Hewlett-Packard) -- C:\Program Files\Hewlett-Packard\HP QuickSync\QuickSync.exe
PRC - [2009/07/14 04:54:00 | 000,135,168 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Hewlett-Packard\HP QuickSync\jre\bin\javaw.exe
PRC - [2009/07/13 19:14:46 | 000,115,200 | ---- | M] () -- \\?\C:\Windows\System32\wbem\WMIADAP.EXE
PRC - [2009/07/13 19:14:42 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2009/07/13 19:14:15 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe
PRC - [2009/03/01 23:43:08 | 000,081,920 | ---- | M] (Andrea Electronics Corporation) -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_8e7d5b9d3a91d8c5\AEstSrv.exe
PRC - [2009/01/26 15:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) -- C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
PRC - [2000/06/29 02:45:10 | 000,052,224 | ---- | M] (Kenonic Controls Ltd.) -- C:\Windows\System32\Crypserv.exe


========== Modules (SafeList) ==========

MOD - [2011/04/21 17:05:43 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\DanielleK\Downloads\OTL.exe
MOD - [2010/08/20 23:21:32 | 001,680,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll


========== Win32 Services (SafeList) ==========

SRV - [2011/01/06 16:23:18 | 006,128,720 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe -- (AVGIDSAgent)
SRV - [2010/10/22 05:58:18 | 000,265,400 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG10\avgwdsvc.exe -- (avgwd)
SRV - [2010/10/14 18:27:38 | 000,092,216 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Program Files\Hewlett-Packard\Shared\HPDrvMntSvc.exe -- (HPDrvMntSvc.exe)
SRV - [2010/10/12 11:59:12 | 000,206,072 | ---- | M] (WildTangent, Inc.) [On_Demand | Stopped] -- C:\Program Files\WildTangent Games\App\GamesAppService.exe -- (GamesAppService)
SRV - [2010/03/18 11:19:26 | 000,113,152 | ---- | M] (ArcSoft Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe -- (ACDaemon)
SRV - [2010/03/10 09:13:12 | 001,343,400 | ---- | M] (Microsoft Corporation) [Unknown | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc)
SRV - [2009/09/04 13:43:38 | 000,595,232 | ---- | M] (Broadcom Corporation.) [Auto | Running] -- C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe -- (btwdins)
SRV - [2009/07/23 18:23:56 | 000,178,720 | ---- | M] () [Auto | Running] -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe -- (nSvcIp)
SRV - [2009/07/23 18:23:54 | 000,387,616 | ---- | M] () [Auto | Running] -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe -- (ForceWare Intelligent Application Manager (IAM)) ForceWare Intelligent Application Manager (IAM)
SRV - [2009/07/21 03:33:32 | 000,221,266 | ---- | M] (IDT, Inc.) [Auto | Running] -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_8e7d5b9d3a91d8c5\stacsv.exe -- (STacSV)
SRV - [2009/07/13 19:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009/07/13 19:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2009/03/01 23:43:08 | 000,081,920 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_8e7d5b9d3a91d8c5\AEstSrv.exe -- (AESTFilters)
SRV - [2009/01/26 15:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) [Auto | Running] -- C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe -- (SBSDWSCService)
SRV - [2000/06/29 02:45:10 | 000,052,224 | ---- | M] (Kenonic Controls Ltd.) [Auto | Running] -- C:\Windows\System32\Crypserv.exe -- (Crypkey License)


========== Driver Services (SafeList) ==========

DRV - [2010/12/20 23:22:36 | 000,239,664 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Apfiltr.sys -- (ApfiltrService)
DRV - [2010/12/20 18:09:00 | 000,038,224 | ---- | M] (Malwarebytes Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\mbamswissarmy.sys -- (MBAMSwissArmy)
DRV - [2010/12/08 05:12:38 | 000,251,728 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\System32\drivers\avgldx86.sys -- (Avgldx86)
DRV - [2010/11/12 14:19:38 | 000,299,984 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\System32\drivers\avgtdix.sys -- (Avgtdix)
DRV - [2010/09/13 16:27:54 | 000,025,680 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\AVGIDSEH.Sys -- (AVGIDSEH)
DRV - [2010/09/07 04:48:56 | 000,034,384 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\Windows\System32\drivers\avgmfx86.sys -- (Avgmfx86)
DRV - [2010/09/07 04:48:50 | 000,026,064 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\system32\DRIVERS\avgrkx86.sys -- (Avgrkx86)
DRV - [2010/08/19 21:42:38 | 000,123,472 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AVGIDSDriver.sys -- (AVGIDSDriver)
DRV - [2010/08/19 21:42:38 | 000,030,288 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AVGIDSFilter.sys -- (AVGIDSFilter)
DRV - [2010/08/19 21:42:36 | 000,021,072 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AVGIDSShim.sys -- (AVGIDSShim)
DRV - [2009/07/23 00:01:00 | 009,791,072 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2009/07/21 03:33:32 | 000,409,088 | ---- | M] (IDT, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\stwrt.sys -- (STHDA)
DRV - [2009/07/16 21:13:30 | 000,171,008 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\RtsUStor.sys -- (RSUSBSTOR)
DRV - [2009/07/13 17:52:10 | 000,014,336 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\vwifimp.sys -- (vwifimp)
DRV - [2009/07/13 16:02:52 | 000,347,264 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nvm62x32.sys -- (NVENETFD)
DRV - [2009/06/30 22:20:54 | 000,287,392 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvmf6232.sys -- (NVNET)
DRV - [2009/06/30 03:32:54 | 000,212,000 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\nvstor32.sys -- (nvstor32)
DRV - [2009/06/28 10:36:36 | 000,017,920 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvsmu.sys -- (nvsmu)
DRV - [2009/06/26 01:55:12 | 000,066,080 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvhda32v.sys -- (NVHDA)
DRV - [2000/02/03 13:53:12 | 000,024,608 | ---- | M] () [Kernel | System | Running] -- C:\Windows\system32\ckldrv.sys -- (NetworkX)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.h...avilion&pf=cnnb
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.h...avilion&pf=cnnb

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.h...avilion&pf=cnnb
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.bing.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = A7 9B AD 01 82 5A EC 4B AF 33 0E CC 34 A8 7C E4 [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG10\Firefox\ [2010/12/31 19:09:33 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG10\Firefox4\ [2011/03/30 09:41:15 | 000,000,000 | ---D | M]


O1 HOSTS File: ([2011/04/21 14:44:12 | 000,432,840 | R--- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 127.0.0.1 123fporn.info
O1 - Hosts: 14894 more lines...
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG10\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Microsoft Live Search Toolbar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\Program Files\MSN\Toolbar\3.0.0560.0\msneshellx.dll (Microsoft Corp.)
O3 - HKLM\..\Toolbar: (Microsoft Live Search Toolbar) - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - c:\Program Files\MSN\Toolbar\3.0.0560.0\msneshellx.dll (Microsoft Corp.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {B80F591E-FE9A-46CF-A13E-180377240586} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [HP] C:\Program Files\Hewlett-Packard\HP QuickSync\QuickSync.exe (Hewlett-Packard)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray.exe (IDT, Inc.)
O4 - HKLM..\Run: [UpdatePRCShortCut] C:\Program Files\Hewlett-Packard\Recovery\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: WallpaperStyle = 2
O8 - Extra context menu item: &ieSpell Options - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O8 - Extra context menu item: Check &Spelling - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O8 - Extra context menu item: Lookup on Merriam Webster - C:\Program Files\ieSpell\Merriam Webster.HTM ()
O8 - Extra context menu item: Lookup on Wikipedia - C:\Program Files\ieSpell\wikipedia.HTM ()
O8 - Extra context menu item: Send image to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Send page to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O9 - Extra 'Tools' menuitem : ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O9 - Extra 'Tools' menuitem : ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O9 - Extra Button: @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O13 - gopher Prefix: missing
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} http://office.micros...n/ieawsdc32.cab (Microsoft Office Template and Media Control)
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} http://dlm.tools.aka...vex-2.2.5.0.cab (DLM Control)
O16 - DPF: {6218F7B5-0D3A-48BA-AE4C-49DCFA63D400} http://www.myheritag...EngineQuery.dll (CSEQueryObject Object)
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebo...oUploader55.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_24)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1 205.171.3.25
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG10\avgpp.dll (AVG Technologies CZ, s.r.o.)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 15:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{223a4cf3-2f0f-11df-9156-00271348d010}\Shell - "" = AutoRun
O33 - MountPoints2\{223a4cf3-2f0f-11df-9156-00271348d010}\Shell\AutoRun\command - "" = E:\LaunchU3.exe -a
O33 - MountPoints2\E\Shell - "" = AutoRun
O33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\LaunchU3.exe -a
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgchsvx.exe /sync) - C:\Program Files\AVG\AVG10\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgrsx.exe /sync /restart) - C:\Program Files\AVG\AVG10\avgrsx.exe (AVG Technologies CZ, s.r.o.)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/04/24 18:16:00 | 000,000,000 | ---D | C] -- C:\_OTL
[2011/04/22 12:25:07 | 000,000,000 | ---D | C] -- C:\Users\DanielleK\AppData\Local\{5714C372-77CD-4346-BC34-4BCEE9F7FD34}
[2011/04/21 12:55:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy
[2011/04/21 12:55:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy
[2011/04/21 12:55:05 | 000,000,000 | ---D | C] -- C:\Program Files\Spybot - Search & Destroy
[2011/04/20 09:34:06 | 000,000,000 | ---D | C] -- C:\Program Files\[bleep] NFO Viewer
[2011/04/18 21:20:42 | 000,000,000 | ---D | C] -- C:\Users\DanielleK\Desktop\Quilting Program and Data
[2011/04/18 20:27:52 | 000,000,000 | ---D | C] -- C:\Users\DanielleK\Desktop\QuiltAssistant
[2011/04/18 20:26:47 | 000,000,000 | ---D | C] -- C:\Users\DanielleK\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\QuiltAssistant
[2011/04/18 20:26:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuiltAssistant
[2011/04/18 20:26:47 | 000,000,000 | ---D | C] -- C:\Program Files\QuiltAssistant
[2011/04/16 15:45:55 | 000,000,000 | ---D | C] -- C:\Users\DanielleK\Incomplete
[2011/04/16 15:44:37 | 000,000,000 | ---D | C] -- C:\Users\DanielleK\AppData\Roaming\LimeWire
[2011/04/16 15:43:36 | 000,000,000 | ---D | C] -- C:\Users\DanielleK\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\360Share Pro
[2011/04/16 15:43:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\360Share Pro
[2011/04/16 15:43:03 | 000,000,000 | ---D | C] -- C:\Program Files\360Share Pro
[2011/04/15 19:19:10 | 000,716,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript.dll
[2011/04/15 19:19:10 | 000,428,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\vbscript.dll
[2011/04/15 19:14:25 | 000,028,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dnscacheugc.exe
[2011/04/15 19:14:23 | 000,294,912 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\atmfd.dll
[2011/04/15 19:14:22 | 000,034,304 | ---- | C] (Adobe Systems) -- C:\Windows\System32\atmlib.dll
[2011/04/15 19:13:52 | 000,606,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mstime.dll
[2011/04/15 19:13:52 | 000,599,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2011/04/15 19:13:52 | 000,381,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll
[2011/04/15 19:13:51 | 000,185,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll
[2011/04/15 19:13:51 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2011/04/15 19:13:50 | 000,064,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll
[2011/04/15 19:13:50 | 000,044,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\licmgr10.dll
[2011/04/15 19:13:49 | 000,386,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\html.iec
[2011/04/15 19:13:49 | 000,048,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2011/04/15 19:13:49 | 000,012,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe
[2011/04/15 19:13:48 | 001,638,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2011/04/15 19:04:01 | 002,331,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2011/04/15 19:03:59 | 000,191,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\FXSCOVER.exe
[2011/04/15 19:03:55 | 000,288,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XpsGdiConverter.dll
[2011/04/15 18:56:43 | 001,137,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfc42.dll
[2011/04/15 18:56:42 | 001,164,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfc42u.dll
[2011/04/07 20:41:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WorldOfGoo
[2011/04/07 20:40:55 | 000,000,000 | ---D | C] -- C:\Program Files\WorldOfGoo
[2011/04/07 18:44:36 | 000,000,000 | ---D | C] -- C:\Users\DanielleK\AppData\Local\2DBoy
[2011/04/07 18:44:36 | 000,000,000 | ---D | C] -- C:\ProgramData\2DBoy
[2011/04/07 18:38:08 | 000,000,000 | ---D | C] -- C:\Users\DanielleK\Desktop\Anti virus
[2011/04/07 18:37:51 | 000,000,000 | ---D | C] -- C:\Program Files\WildTangent Games
[2011/04/05 23:28:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StyleWriter
[2011/04/05 23:28:35 | 000,165,888 | ---- | C] (Kenonic Controls) -- C:\Windows\Ckconfig.exe
[2011/04/05 23:28:35 | 000,052,224 | ---- | C] (Kenonic Controls Ltd.) -- C:\Windows\System32\Crypserv.exe
[2011/04/05 23:28:24 | 000,000,000 | ---D | C] -- C:\SWWIN
[2011/04/05 23:27:53 | 000,304,128 | ---- | C] (InstallShield Software Corporation) -- C:\Windows\IsUninst.exe
[2011/04/03 11:37:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinDjView
[2011/04/03 11:37:51 | 000,000,000 | ---D | C] -- C:\Program Files\WinDjView
[2011/04/01 12:49:53 | 000,000,000 | ---D | C] -- C:\Users\DanielleK\AppData\Roaming\Catalina Marketing Corp
[2011/04/01 12:49:50 | 000,000,000 | ---D | C] -- C:\Users\DanielleK\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Catalina Marketing Corp
[2011/03/31 14:23:25 | 000,000,000 | ---D | C] -- C:\Users\DanielleK\Desktop\Storybook
[2011/03/31 13:20:42 | 000,000,000 | R--D | C] -- C:\Users\DanielleK\Desktop\Programs I dont use
[2011/03/31 13:13:55 | 000,000,000 | ---D | C] -- C:\Users\DanielleK\Desktop\Tatting
[2011/03/31 13:13:18 | 000,000,000 | ---D | C] -- C:\Users\DanielleK\Desktop\NOVEL IDEAS
[2011/03/31 10:02:45 | 000,000,000 | ---D | C] -- C:\Users\DanielleK\AppData\Roaming\Malwarebytes
[2011/03/31 10:02:22 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2011/03/31 10:02:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/03/31 10:02:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2011/03/31 10:02:14 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2011/03/31 10:02:13 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2011/03/31 09:17:59 | 000,000,000 | ---D | C] -- C:\Users\DanielleK\Documents\MSDS
[2011/03/31 09:16:59 | 000,000,000 | ---D | C] -- C:\Users\DanielleK\Documents\Novels
[2011/03/30 15:18:03 | 000,000,000 | ---D | C] -- C:\Users\DanielleK\Documents\storybook
[2011/03/30 12:18:50 | 000,000,000 | ---D | C] -- C:\Users\DanielleK\.storybook
[2011/03/30 12:18:12 | 000,000,000 | ---D | C] -- C:\Users\DanielleK\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Storybook
[2011/03/30 12:18:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Storybook
[2011/03/28 13:49:31 | 000,000,000 | ---D | C] -- C:\Users\DanielleK\AppData\Roaming\Acapela Group
[2011/03/28 13:46:04 | 000,000,000 | ---D | C] -- C:\Users\DanielleK\AppData\Local\Downloaded Installations
[1 C:\Users\DanielleK\Desktop\*.tmp files -> C:\Users\DanielleK\Desktop\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/04/24 18:36:31 | 000,023,248 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011/04/24 18:36:31 | 000,023,248 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011/04/24 18:34:33 | 000,624,178 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011/04/24 18:34:33 | 000,110,746 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011/04/24 18:26:34 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011/04/24 18:26:27 | 2212,999,168 | -HS- | M] () -- C:\hiberfil.sys
[2011/04/24 17:24:17 | 113,304,509 | ---- | M] () -- C:\Windows\System32\drivers\AVG\incavi.avm
[2011/04/21 14:44:12 | 000,432,840 | R--- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2011/04/21 12:55:55 | 000,001,200 | ---- | M] () -- C:\Users\DanielleK\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2011/04/19 23:45:11 | 000,000,336 | ---- | M] () -- C:\Windows\tasks\HPCeeScheduleForDanielleK.job
[2011/04/19 23:45:05 | 000,339,384 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2011/04/07 21:17:11 | 000,004,480 | ---- | M] () -- C:\Windows\System32\esnecil.ind
[2011/04/07 20:41:25 | 000,001,823 | ---- | M] () -- C:\Users\Public\Desktop\World of Goo.lnk
[2011/04/07 18:41:41 | 000,001,969 | ---- | M] () -- C:\WildTangent Games App - hp.lnk
[2011/04/07 18:41:39 | 000,002,452 | ---- | M] () -- C:\Users\Public\Desktop\WildTangent Games App - hp.lnk
[2011/04/07 18:39:04 | 000,002,484 | ---- | M] () -- C:\Users\DanielleK\Application Data\Microsoft\Internet Explorer\Quick Launch\WildTangent Games App - hp.lnk
[2011/04/05 23:53:41 | 000,000,014 | -HS- | M] () -- C:\Users\DanielleK\Desktop\SWWIN.ent
[2011/04/05 23:53:40 | 000,004,480 | ---- | M] () -- C:\Windows\System32\esnecil.nlp
[2011/04/05 23:53:40 | 000,000,014 | -HS- | M] () -- C:\Users\DanielleK\Desktop\SWWIN.rst
[2011/04/05 23:53:40 | 000,000,014 | -HS- | M] () -- C:\Users\DanielleK\Desktop\SWWIN.key
[2011/04/05 23:53:40 | 000,000,000 | -HS- | M] () -- C:\Users\DanielleK\Desktop\SWWIN.41s
[2011/04/05 23:28:40 | 000,000,025 | ---- | M] () -- C:\Windows\Crypkey.ini
[2011/03/31 14:23:26 | 000,001,860 | ---- | M] () -- C:\Users\DanielleK\Desktop\Storybook.lnk
[2011/03/30 21:37:40 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2011/03/30 21:37:40 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[1 C:\Users\DanielleK\Desktop\*.tmp files -> C:\Users\DanielleK\Desktop\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/04/21 12:55:55 | 000,001,200 | ---- | C] () -- C:\Users\DanielleK\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2011/04/07 20:41:25 | 000,001,823 | ---- | C] () -- C:\Users\Public\Desktop\World of Goo.lnk
[2011/04/07 18:41:41 | 000,001,969 | ---- | C] () -- C:\WildTangent Games App - hp.lnk
[2011/04/07 18:39:01 | 000,002,484 | ---- | C] () -- C:\Users\DanielleK\Application Data\Microsoft\Internet Explorer\Quick Launch\WildTangent Games App - hp.lnk
[2011/04/07 18:38:59 | 000,002,452 | ---- | C] () -- C:\Users\Public\Desktop\WildTangent Games App - hp.lnk
[2011/04/05 23:53:40 | 000,000,014 | -HS- | C] () -- C:\Users\DanielleK\Desktop\SWWIN.rst
[2011/04/05 23:53:40 | 000,000,014 | -HS- | C] () -- C:\Users\DanielleK\Desktop\SWWIN.key
[2011/04/05 23:53:40 | 000,000,014 | -HS- | C] () -- C:\Users\DanielleK\Desktop\SWWIN.ent
[2011/04/05 23:53:40 | 000,000,000 | -HS- | C] () -- C:\Users\DanielleK\Desktop\SWWIN.41s
[2011/04/05 23:44:27 | 000,004,480 | ---- | C] () -- C:\Windows\System32\esnecil.nlp
[2011/04/05 23:44:27 | 000,004,480 | ---- | C] () -- C:\Windows\System32\esnecil.ind
[2011/04/05 23:28:40 | 000,000,025 | ---- | C] () -- C:\Windows\Crypkey.ini
[2011/04/05 23:28:35 | 000,024,608 | ---- | C] () -- C:\Windows\System32\Ckldrv.sys
[2011/04/05 23:28:35 | 000,011,776 | ---- | C] () -- C:\Windows\Ckrfresh.exe
[2011/04/05 23:28:34 | 000,027,648 | R--- | C] () -- C:\Windows\Setup_ck.exe
[2011/04/05 23:28:34 | 000,018,432 | ---- | C] () -- C:\Windows\Setup_ck.dll
[2011/03/30 21:37:40 | 000,000,000 | RHS- | C] () -- C:\MSDOS.SYS
[2011/03/30 21:37:40 | 000,000,000 | RHS- | C] () -- C:\IO.SYS
[2011/03/30 12:18:12 | 000,001,860 | ---- | C] () -- C:\Users\DanielleK\Desktop\Storybook.lnk
[2011/01/04 15:31:02 | 000,001,849 | ---- | C] () -- C:\Users\DanielleK\AppData\Roaming\GhostObjGAFix.xml
[2010/12/09 15:05:41 | 000,085,504 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll
[2010/01/07 22:33:02 | 000,000,104 | ---- | C] () -- C:\Users\DanielleK\AppData\Roaming\wklnhst.dat
[2009/08/28 03:05:08 | 000,006,656 | ---- | C] () -- C:\Windows\System32\bcmwlrc.dll
[2009/08/28 02:56:18 | 000,006,136 | ---- | C] () -- C:\Windows\System32\drivers\nvphy.bin
[2009/08/03 16:07:42 | 000,403,816 | ---- | C] () -- C:\Windows\System32\OGACheckControl.dll
[2009/08/03 16:07:42 | 000,230,768 | ---- | C] () -- C:\Windows\System32\OGAEXEC.exe
[2009/07/13 22:57:37 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009/07/13 22:33:53 | 000,339,384 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2009/07/13 20:05:48 | 000,624,178 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2009/07/13 20:05:48 | 000,291,294 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2009/07/13 20:05:48 | 000,110,746 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2009/07/13 20:05:48 | 000,031,548 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2009/07/13 20:05:05 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2009/07/13 20:04:11 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2009/07/13 17:55:01 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009/07/13 17:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll
[2009/07/13 17:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll
[2009/06/10 15:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat

< End of report >

OTL Extras logfile created on: 4/24/2011 6:33:55 PM - Run 2
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Users\DanielleK\Downloads
Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 56.00% Memory free
5.00 Gb Paging File | 4.00 Gb Available in Paging File | 75.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 286.78 Gb Total Space | 206.66 Gb Free Space | 72.06% Space Free | Partition Type: NTFS
Drive D: | 11.12 Gb Total Space | 1.86 Gb Free Space | 16.72% Space Free | Partition Type: NTFS
Drive E: | 973.88 Mb Total Space | 254.19 Mb Free Space | 26.10% Space Free | Partition Type: FAT

Computer Name: DANIELLEK-PC | User Name: DanielleK | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (All) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.chm [@ = chm.file] -- C:\Windows\hh.exe (Microsoft Corporation)
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.hta [@ = htafile] -- C:\Windows\System32\mshta.exe (Microsoft Corporation)
.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
.inf [@ = inffile] -- C:\Windows\System32\NOTEPAD.EXE (Microsoft Corporation)
.ini [@ = inifile] -- C:\Windows\System32\NOTEPAD.EXE (Microsoft Corporation)
.url [@ = InternetShortcut] -- C:\Windows\System32\rundll32.exe (Microsoft Corporation)
.js [@ = JSFile] -- C:\Windows\System32\WScript.exe (Microsoft Corporation)
.jse [@ = JSEFile] -- C:\Windows\System32\WScript.exe (Microsoft Corporation)
.reg [@ = regfile] -- C:\Windows\regedit.exe (Microsoft Corporation)
.txt [@ = txtfile] -- C:\Windows\System32\NOTEPAD.EXE (Microsoft Corporation)
.vbe [@ = VBEFile] -- C:\Windows\System32\WScript.exe (Microsoft Corporation)
.vbs [@ = VBSFile] -- C:\Windows\System32\WScript.exe (Microsoft Corporation)
.wsf [@ = WSFFile] -- C:\Windows\System32\WScript.exe (Microsoft Corporation)
.wsh [@ = WSHFile] -- C:\Windows\System32\WScript.exe (Microsoft Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [edit] -- %SystemRoot%\System32\NOTEPAD.EXE %1 (Microsoft Corporation)
batfile [open] -- "%1" %*
batfile [print] -- %SystemRoot%\System32\NOTEPAD.EXE /p %1 (Microsoft Corporation)
chm.file [open] -- "%SystemRoot%\hh.exe" %1 (Microsoft Corporation)
cmdfile [edit] -- %SystemRoot%\System32\NOTEPAD.EXE %1 (Microsoft Corporation)
cmdfile [open] -- "%1" %*
cmdfile [print] -- %SystemRoot%\System32\NOTEPAD.EXE /p %1 (Microsoft Corporation)
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htafile [open] -- C:\Windows\System32\mshta.exe "%1" %* (Microsoft Corporation)
htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)
https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
inffile [open] -- %SystemRoot%\system32\NOTEPAD.EXE %1 (Microsoft Corporation)
inffile [print] -- %SystemRoot%\system32\NOTEPAD.EXE /p %1 (Microsoft Corporation)
inifile [open] -- %SystemRoot%\system32\NOTEPAD.EXE %1 (Microsoft Corporation)
inifile [print] -- %SystemRoot%\system32\NOTEPAD.EXE /p %1 (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
jsfile [edit] -- C:\Windows\System32\Notepad.exe %1 (Microsoft Corporation)
jsfile [open] -- C:\Windows\System32\WScript.exe "%1" %* (Microsoft Corporation)
jsfile [print] -- C:\Windows\System32\Notepad.exe /p %1 (Microsoft Corporation)
jsefile [edit] -- C:\Windows\System32\Notepad.exe %1 (Microsoft Corporation)
jsefile [open] -- C:\Windows\System32\WScript.exe "%1" %* (Microsoft Corporation)
jsefile [print] -- C:\Windows\System32\Notepad.exe /p %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [edit] -- %SystemRoot%\system32\notepad.exe "%1" (Microsoft Corporation)
regfile [open] -- regedit.exe "%1" (Microsoft Corporation)
regfile [merge] -- Reg Error: Key error.
regfile [print] -- %SystemRoot%\system32\notepad.exe /p "%1" (Microsoft Corporation)
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
txtfile [open] -- %SystemRoot%\system32\NOTEPAD.EXE %1 (Microsoft Corporation)
txtfile [print] -- %SystemRoot%\system32\NOTEPAD.EXE /p %1 (Microsoft Corporation)
txtfile [printto] -- %SystemRoot%\system32\notepad.exe /pt "%1" "%2" "%3" "%4" (Microsoft Corporation)
vbefile [edit] -- "%SystemRoot%\System32\Notepad.exe" %1 (Microsoft Corporation)
vbefile [open] -- "%SystemRoot%\System32\WScript.exe" "%1" %* (Microsoft Corporation)
vbefile [print] -- "%SystemRoot%\System32\Notepad.exe" /p %1 (Microsoft Corporation)
vbsfile [edit] -- "%SystemRoot%\System32\Notepad.exe" %1 (Microsoft Corporation)
vbsfile [open] -- "%SystemRoot%\System32\WScript.exe" "%1" %* (Microsoft Corporation)
vbsfile [print] -- "%SystemRoot%\System32\Notepad.exe" /p %1 (Microsoft Corporation)
wsffile [edit] -- "%SystemRoot%\System32\Notepad.exe" %1 (Microsoft Corporation)
wsffile [open] -- "%SystemRoot%\System32\WScript.exe" "%1" %* (Microsoft Corporation)
wsffile [print] -- "%SystemRoot%\System32\Notepad.exe" /p %1 (Microsoft Corporation)
wshfile [open] -- "%SystemRoot%\System32\WScript.exe" "%1" %* (Microsoft Corporation)
Unknown [openas] -- "C:\Program Files\File Type Assistant\tsassist.exe" "%1"
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~1\MIF5BA~1\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{07FA4960-B038-49EB-891B-9F95930AA544}" = HP Customer Experience Enhancements
"{08DB3902-2CE0-474D-BCE3-0177766CE9F1}" = HP Support Assistant
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}" = Microsoft Works
"{17504ED4-DB08-40A8-81C2-27D8C01581DA}" = Windows Live Remote Service Resources
"{19A4A990-5343-4FF7-B3B5-6F046C091EDF}" = Windows Live Remote Client
"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{227E8782-B2F4-4E97-B0EE-49DE9CC1C0C0}" = Windows Live Remote Service
"{254C37AA-6B72-4300-84F6-98A82419187E}" = ActiveCheck component for HP Active Support Library
"{26A24AE4-039D-4CA4-87B4-2F83216014FF}" = Java™ 6 Update 24
"{287ECFA4-719A-2143-A09B-D6A12DE54E40}" = Acrobat.com
"{2902F983-B4C1-44BA-B85D-5C6D52E2C441}" = Windows Live Mesh ActiveX Control for Remote Connections
"{294BF709-D758-4363-8D75-01479AD20927}" = Windows Live Family Safety
"{2D4E1F8A-901B-4BBD-B311-B6E56059066E}" = Microsoft Live Search Toolbar
"{2FA94A64-C84E-49d1-97DD-7BF06C7BBFB2}.WildTangent Games App" = Update Installer for WildTangent Games App
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{34985F59-8F6F-46F4-9AD5-53E2714294D2}" = ArcSoft WebCam Companion 3
"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go
"{44B2A0AB-412E-4F8C-B058-D1E8AECCDFF5}" = PowerRecover
"{464B3406-A4D0-4914-910F-7CA4380DCC13}" = Windows Live Remote Client Resources
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4CBABDFD-49F8-47FD-BE7D-ECDE7270525A}" = Windows Live PIMT Platform
"{50816F92-1652-4A7C-B9BC-48F682742C4B}" = Messenger Companion
"{54CC7901-804D-4155-B353-21F0CC9112AB}" = HP Wireless Assistant
"{5EFA68C8-CFFD-407F-8B17-7D7C61D2F93A}" = InstallIQ Updater
"{61AD15B2-50DB-4686-A739-14FE180D4429}" = Windows Live ID Sign-in Assistant
"{669D4A35-146B-4314-89F1-1AC3D7B88367}" = HPAsset component for HP Active Support Library
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6A05FEDF-662E-46BF-8A25-010E3F1C9C69}" = Windows Live UX Platform Language Pack
"{70B446D1-E03B-4ab0-9B3C-0832142C9AA8}.WildTangent Games App-hp" = WildTangent Games App (HP Games)
"{74F3FA7F-233B-47DF-A0E0-28520D03B992}" = HP User Guides 0150
"{78A96B4C-A643-4D0F-98C2-A8E16A6669F9}" = Windows Live Messenger Companion Core
"{7CFA46E3-CC2F-4355-82AE-6012DC3633FD}" = NVIDIA ForceWare Network Access Manager
"{80956555-A512-4190-9CAD-B000C36D6B6B}" = Windows Live Messenger
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{96AE7E41-E34E-47D0-AC07-1091A8127911}" = Realtek USB 2.0 Card Reader
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{9E9D49A4-1DF4-4138-B7DB-5D87A893088E}" = HP Integrated Module with Bluetooth wireless technology
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = ALPS Touch Pad Driver
"{A0C91188-C88F-4E86-93E6-CD7C9A266649}" = Windows Live Mesh
"{A1BF9950-8CDB-468E-83FA-EACFB00EA7D5}" = Windows Live Sync
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer
"{AC76BA86-7AD7-FFFF-7B44-A91000000001}" = Adobe Reader 9.4.2 MUI
"{AD72CFB4-C2BF-424E-9DF0-C7BAD1F30A11}" = Adobe Shockwave Player
"{AF844339-2F8A-4593-81B3-9F4C54038C4E}" = Windows Live MIME IFilter
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B3AEF776-7FFF-4C50-A402-9119E3849EE0}" = AVG 2011
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D46D081B-F60E-467E-A7C4-117B70D76731}" = HP Update
"{D4E53304-1F6C-4111-9872-1BCD2CF5B642}" = AVG 2011
"{D642E38E-0D24-486C-9A2D-E316DD696F4B}" = Microsoft XML Parser
"{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources
"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
"{DF802C05-4660-418c-970C-B988ADB1D316}" = Microsoft Live Search Toolbar
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}" = IDT Audio
"{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}" = Microsoft Office Suite Activation Assistant
"{EB4DF488-AAEF-406F-A341-CB2AAA315B90}" = Windows Live Messenger
"{EEA95E6C-6847-49BE-83C9-ED92D8E18983}" = HP QuickSync
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F3B912F5-EB57-45AA-B3D1-EB532BCF6EF8}" = HP Setup
"{F53D678E-238F-4A71-9742-08BB6774E9DC}" = Windows Live Family Safety
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"AVG" = AVG 2011
"AVS Audio Converter 6.3_is1" = AVS Audio Converter version 6.3
"AVS Update Manager_is1" = AVS Update Manager 1.0
"AVS4YOU Software Navigator_is1" = AVS4YOU Software Navigator 1.4
"BF20603967CFDCB2BBF91950E8A56DFBC5C833FE" = Windows Driver Package - Broadcom HIDClass (07/28/2009 6.2.0.9800)
"Broadcom 802.11 Wireless LAN Adapter" = Broadcom 802.11 Wireless LAN Adapter
"ffdshow_is1" = ffdshow
"FreeFileViewer_is1" = Free File Viewer 2011
"GOM Player" = GOM Player
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"ieSpell" = ieSpell
"InstaCodecs_is1" = InstaCodecs
"Install Manager" = Install Manager
"InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite
"InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go
"InstallShield_{7CFA46E3-CC2F-4355-82AE-6012DC3633FD}" = NVIDIA ForceWare Network Access Manager
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"NVIDIA Drivers" = NVIDIA Drivers
"PhotoScape" = PhotoScape
"QuiltAssist" = QuiltAssistant
"SelectRebatesUninstall" = ShopAtHome.com Toolbar
"Storybook" = Storybook
"StyleWriter" = StyleWriter
"Trusted Software Assistant_is1" = File Type Assistant
"WildTangent hp Master Uninstall" = HP Games
"WinDjView" = WinDjView 1.0.3
"WinLiveSuite" = Windows Live Essentials
"WinRAR archiver" = WinRAR 4.00 beta 4 (32-bit)
"WT083225" = Aztec Tribe
"WTA-2086a38c-40e1-41cb-a86f-c6822c2c3068" = Snowy - Fish Frenzy

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"395afba3c6cd1307" = Famtree5
"Move Media Player" = Move Media Player

========== Last 10 Event Log Errors ==========

Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!

< End of report >

Never was able to find limewire on my computer.
Running the next set of steps will let you know how it turns out. Thankyou very much.
  • 0

#4
dmanatee

dmanatee

    New Member

  • Topic Starter
  • Member
  • Pip
  • 4 posts
next step down...
from malwarebytes log
Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 6435

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

4/24/2011 11:10:54 PM
mbam-log-2011-04-24 (23-10-54).txt

Scan type: Full scan (C:\|D:\|)
Objects scanned: 299094
Time elapsed: 1 hour(s), 54 minute(s), 21 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 4

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
c:\Windows\System32\020000008b3b29ee1253c.manifest (Malware.Trace) -> Quarantined and deleted successfully.
c:\Windows\System32\020000008b3b29ee1253o.manifest (Malware.Trace) -> Quarantined and deleted successfully.
c:\Windows\System32\020000008b3b29ee1253p.manifest (Malware.Trace) -> Quarantined and deleted successfully.
c:\Windows\System32\020000008b3b29ee1253s.manifest (Malware.Trace) -> Quarantined and deleted successfully.
  • 0

#5
dmanatee

dmanatee

    New Member

  • Topic Starter
  • Member
  • Pip
  • 4 posts
couln't get george to work but tdsskiller reported the following:
2011/04/24 23:37:26.0528 4888 TDSS rootkit removing tool 2.4.21.0 Mar 10 2011 12:26:28
2011/04/24 23:37:27.0074 4888 ================================================================================
2011/04/24 23:37:27.0074 4888 SystemInfo:
2011/04/24 23:37:27.0074 4888
2011/04/24 23:37:27.0074 4888 OS Version: 6.1.7600 ServicePack: 0.0
2011/04/24 23:37:27.0074 4888 Product type: Workstation
2011/04/24 23:37:27.0074 4888 ComputerName: DANIELLEK-PC
2011/04/24 23:37:27.0074 4888 UserName: DanielleK
2011/04/24 23:37:27.0074 4888 Windows directory: C:\Windows
2011/04/24 23:37:27.0074 4888 System windows directory: C:\Windows
2011/04/24 23:37:27.0074 4888 Processor architecture: Intel x86
2011/04/24 23:37:27.0074 4888 Number of processors: 2
2011/04/24 23:37:27.0074 4888 Page size: 0x1000
2011/04/24 23:37:27.0074 4888 Boot type: Normal boot
2011/04/24 23:37:27.0074 4888 ================================================================================
2011/04/24 23:37:27.0807 4888 Initialize success
2011/04/24 23:37:30.0209 0764 ================================================================================
2011/04/24 23:37:30.0209 0764 Scan started
2011/04/24 23:37:30.0209 0764 Mode: Manual;
2011/04/24 23:37:30.0209 0764 ================================================================================
2011/04/24 23:37:31.0785 0764 1394ohci (6d2aca41739bfe8cb86ee8e85f29697d) C:\Windows\system32\DRIVERS\1394ohci.sys
2011/04/24 23:37:31.0972 0764 ACPI (f0e07d144c8685b8774bc32fc8da4df0) C:\Windows\system32\DRIVERS\ACPI.sys
2011/04/24 23:37:32.0066 0764 AcpiPmi (98d81ca942d19f7d9153b095162ac013) C:\Windows\system32\DRIVERS\acpipmi.sys
2011/04/24 23:37:32.0206 0764 adp94xx (21e785ebd7dc90a06391141aac7892fb) C:\Windows\system32\DRIVERS\adp94xx.sys
2011/04/24 23:37:32.0347 0764 adpahci (0c676bc278d5b59ff5abd57bbe9123f2) C:\Windows\system32\DRIVERS\adpahci.sys
2011/04/24 23:37:32.0440 0764 adpu320 (7c7b5ee4b7b822ec85321fe23a27db33) C:\Windows\system32\DRIVERS\adpu320.sys
2011/04/24 23:37:32.0612 0764 AFD (ddc040fdb01ef1712a6b13e52afb104c) C:\Windows\system32\drivers\afd.sys
2011/04/24 23:37:32.0705 0764 agp440 (507812c3054c21cef746b6ee3d04dd6e) C:\Windows\system32\DRIVERS\agp440.sys
2011/04/24 23:37:32.0815 0764 aic78xx (8b30250d573a8f6b4bd23195160d8707) C:\Windows\system32\DRIVERS\djsvs.sys
2011/04/24 23:37:32.0986 0764 aliide (0d40bcf52ea90fc7df2aeab6503dea44) C:\Windows\system32\DRIVERS\aliide.sys
2011/04/24 23:37:33.0064 0764 amdagp (3c6600a0696e90a463771c7422e23ab5) C:\Windows\system32\DRIVERS\amdagp.sys
2011/04/24 23:37:33.0142 0764 amdide (cd5914170297126b6266860198d1d4f0) C:\Windows\system32\DRIVERS\amdide.sys
2011/04/24 23:37:33.0283 0764 AmdK8 (00dda200d71bac534bf56a9db5dfd666) C:\Windows\system32\DRIVERS\amdk8.sys
2011/04/24 23:37:33.0361 0764 AmdPPM (3cbf30f5370fda40dd3e87df38ea53b6) C:\Windows\system32\DRIVERS\amdppm.sys
2011/04/24 23:37:33.0423 0764 amdsata (2101a86c25c154f8314b24ef49d7fbc2) C:\Windows\system32\DRIVERS\amdsata.sys
2011/04/24 23:37:33.0501 0764 amdsbs (ea43af0c423ff267355f74e7a53bdaba) C:\Windows\system32\DRIVERS\amdsbs.sys
2011/04/24 23:37:33.0579 0764 amdxata (b81c2b5616f6420a9941ea093a92b150) C:\Windows\system32\DRIVERS\amdxata.sys
2011/04/24 23:37:33.0688 0764 ApfiltrService (11246b43e2fd8318ef5f45de3a74fbae) C:\Windows\system32\DRIVERS\Apfiltr.sys
2011/04/24 23:37:33.0797 0764 AppID (feb834c02ce1e84b6a38f953ca067706) C:\Windows\system32\drivers\appid.sys
2011/04/24 23:37:33.0938 0764 arc (2932004f49677bd84dbc72edb754ffb3) C:\Windows\system32\DRIVERS\arc.sys
2011/04/24 23:37:34.0000 0764 arcsas (5d6f36c46fd283ae1b57bd2e9feb0bc7) C:\Windows\system32\DRIVERS\arcsas.sys
2011/04/24 23:37:34.0094 0764 AsyncMac (add2ade1c2b285ab8378d2daaf991481) C:\Windows\system32\DRIVERS\asyncmac.sys
2011/04/24 23:37:34.0219 0764 atapi (338c86357871c167a96ab976519bf59e) C:\Windows\system32\DRIVERS\atapi.sys
2011/04/24 23:37:34.0468 0764 AVGIDSDriver (1ca8e5fe74efd5826bbd76c0470e6ae4) C:\Windows\system32\DRIVERS\AVGIDSDriver.Sys
2011/04/24 23:37:34.0531 0764 AVGIDSEH (b9b6e535b9b49c463f68f4bcdd232944) C:\Windows\system32\DRIVERS\AVGIDSEH.Sys
2011/04/24 23:37:34.0593 0764 AVGIDSFilter (32a76fd3fc12d09c586730ef63b4b20b) C:\Windows\system32\DRIVERS\AVGIDSFilter.Sys
2011/04/24 23:37:34.0687 0764 AVGIDSShim (84431da40330cdfd84a7b92bcf0d4a05) C:\Windows\system32\DRIVERS\AVGIDSShim.Sys
2011/04/24 23:37:34.0874 0764 Avgldx86 (5fe5a2c2330c376a1d8dcff8d2680a2d) C:\Windows\system32\DRIVERS\avgldx86.sys
2011/04/24 23:37:34.0952 0764 Avgmfx86 (54f1a9b4c9b540c2d8ac4baa171696b1) C:\Windows\system32\DRIVERS\avgmfx86.sys
2011/04/24 23:37:35.0092 0764 Avgrkx86 (8da3b77993c5f354cc2977b7ea06d03a) C:\Windows\system32\DRIVERS\avgrkx86.sys
2011/04/24 23:37:35.0217 0764 Avgtdix (660788ec46f10ece80274d564fa8b4aa) C:\Windows\system32\DRIVERS\avgtdix.sys
2011/04/24 23:37:35.0420 0764 b06bdrv (1a231abec60fd316ec54c66715543cec) C:\Windows\system32\DRIVERS\bxvbdx.sys
2011/04/24 23:37:35.0560 0764 b57nd60x (bd8869eb9cde6bbe4508d869929869ee) C:\Windows\system32\DRIVERS\b57nd60x.sys
2011/04/24 23:37:35.0794 0764 BCM43XX (3da1c04ea8c09a9f77a951d5ae4f8cfc) C:\Windows\system32\DRIVERS\bcmwl6.sys
2011/04/24 23:37:35.0935 0764 Beep (505506526a9d467307b3c393dedaf858) C:\Windows\system32\drivers\Beep.sys
2011/04/24 23:37:36.0137 0764 blbdrive (2287078ed48fcfc477b05b20cf38f36f) C:\Windows\system32\DRIVERS\blbdrive.sys
2011/04/24 23:37:36.0231 0764 bowser (9a5c671b7fbae4865149bb11f59b91b2) C:\Windows\system32\DRIVERS\bowser.sys
2011/04/24 23:37:36.0309 0764 BrFiltLo (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\DRIVERS\BrFiltLo.sys
2011/04/24 23:37:36.0390 0764 BrFiltUp (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\DRIVERS\BrFiltUp.sys
2011/04/24 23:37:36.0474 0764 Brserid (845b8ce732e67f3b4133164868c666ea) C:\Windows\System32\Drivers\Brserid.sys
2011/04/24 23:37:36.0555 0764 BrSerWdm (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\System32\Drivers\BrSerWdm.sys
2011/04/24 23:37:36.0623 0764 BrUsbMdm (bd456606156ba17e60a04e18016ae54b) C:\Windows\System32\Drivers\BrUsbMdm.sys
2011/04/24 23:37:36.0706 0764 BrUsbSer (af72ed54503f717a43268b3cc5faec2e) C:\Windows\System32\Drivers\BrUsbSer.sys
2011/04/24 23:37:36.0804 0764 BthEnum (2865a5c8e98c70c605f417908cebb3a4) C:\Windows\system32\DRIVERS\BthEnum.sys
2011/04/24 23:37:36.0882 0764 BTHMODEM (ed3df7c56ce0084eb2034432fc56565a) C:\Windows\system32\DRIVERS\bthmodem.sys
2011/04/24 23:37:36.0992 0764 BthPan (ad1872e5829e8a2c3b5b4b641c3eab0e) C:\Windows\system32\DRIVERS\bthpan.sys
2011/04/24 23:37:37.0079 0764 BTHPORT (4a34888e13224678dd062466afec4240) C:\Windows\system32\Drivers\BTHport.sys
2011/04/24 23:37:37.0212 0764 BTHUSB (fa04c63916fa221dbb91fce153d07a55) C:\Windows\system32\Drivers\BTHUSB.sys
2011/04/24 23:37:37.0349 0764 btwaudio (ce5833c144ca6623bcbde93b188aa850) C:\Windows\system32\drivers\btwaudio.sys
2011/04/24 23:37:37.0475 0764 btwavdt (af9148c3e844131ac954cb53ff43d971) C:\Windows\system32\DRIVERS\btwavdt.sys
2011/04/24 23:37:37.0678 0764 btwl2cap (aafd7cb76ba61fbb08e302da208c974a) C:\Windows\system32\DRIVERS\btwl2cap.sys
2011/04/24 23:37:37.0740 0764 btwrchid (480b3d195854b2e55299cddddc50bcf9) C:\Windows\system32\DRIVERS\btwrchid.sys
2011/04/24 23:37:37.0927 0764 cdfs (77ea11b065e0a8ab902d78145ca51e10) C:\Windows\system32\DRIVERS\cdfs.sys
2011/04/24 23:37:38.0021 0764 cdrom (ba6e70aa0e6091bc39de29477d866a77) C:\Windows\system32\DRIVERS\cdrom.sys
2011/04/24 23:37:38.0130 0764 circlass (3fe3fe94a34df6fb06e6418d0f6a0060) C:\Windows\system32\DRIVERS\circlass.sys
2011/04/24 23:37:38.0208 0764 CLFS (635181e0e9bbf16871bf5380d71db02d) C:\Windows\system32\CLFS.sys
2011/04/24 23:37:38.0380 0764 CmBatt (dea805815e587dad1dd2c502220b5616) C:\Windows\system32\DRIVERS\CmBatt.sys
2011/04/24 23:37:38.0442 0764 cmdide (c537b1db64d495b9b4717b4d6d9edbf2) C:\Windows\system32\DRIVERS\cmdide.sys
2011/04/24 23:37:38.0536 0764 CNG (1b675691ed940766149c93e8f4488d68) C:\Windows\system32\Drivers\cng.sys
2011/04/24 23:37:38.0661 0764 Compbatt (a6023d3823c37043986713f118a89bee) C:\Windows\system32\DRIVERS\compbatt.sys
2011/04/24 23:37:38.0754 0764 CompositeBus (f1724ba27e97d627f808fb0ba77a28a6) C:\Windows\system32\DRIVERS\CompositeBus.sys
2011/04/24 23:37:38.0863 0764 crcdisk (2c4ebcfc84a9b44f209dff6c6e6c61d1) C:\Windows\system32\DRIVERS\crcdisk.sys
2011/04/24 23:37:39.0144 0764 DfsC (8e09e52ee2e3ceb199ef3dd99cf9e3fb) C:\Windows\system32\Drivers\dfsc.sys
2011/04/24 23:37:39.0238 0764 discache (1a050b0274bfb3890703d490f330c0da) C:\Windows\system32\drivers\discache.sys
2011/04/24 23:37:39.0331 0764 Disk (565003f326f99802e68ca78f2a68e9ff) C:\Windows\system32\DRIVERS\disk.sys
2011/04/24 23:37:39.0441 0764 Dot4 (b5e479eb83707dd698f66953e922042c) C:\Windows\system32\DRIVERS\Dot4.sys
2011/04/24 23:37:39.0503 0764 Dot4Print (c25fea07a8e7767e8b89ab96a3b96519) C:\Windows\system32\DRIVERS\Dot4Prt.sys
2011/04/24 23:37:39.0581 0764 dot4usb (cf491ff38d62143203c065260567e2f7) C:\Windows\system32\DRIVERS\dot4usb.sys
2011/04/24 23:37:39.0706 0764 drmkaud (b918e7c5f9bf77202f89e1a9539f2eb4) C:\Windows\system32\drivers\drmkaud.sys
2011/04/24 23:37:39.0815 0764 DXGKrnl (1679a4669326cb1a67cc95658d273234) C:\Windows\System32\drivers\dxgkrnl.sys
2011/04/24 23:37:40.0033 0764 ebdrv (024e1b5cac09731e4d868e64dbfb4ab0) C:\Windows\system32\DRIVERS\evbdx.sys
2011/04/24 23:37:40.0345 0764 elxstor (0ed67910c8c326796faa00b2bf6d9d3c) C:\Windows\system32\DRIVERS\elxstor.sys
2011/04/24 23:37:40.0455 0764 ErrDev (8fc3208352dd3912c94367a206ab3f11) C:\Windows\system32\DRIVERS\errdev.sys
2011/04/24 23:37:40.0611 0764 exfat (2dc9108d74081149cc8b651d3a26207f) C:\Windows\system32\drivers\exfat.sys
2011/04/24 23:37:40.0689 0764 fastfat (7e0ab74553476622fb6ae36f73d97d35) C:\Windows\system32\drivers\fastfat.sys
2011/04/24 23:37:40.0798 0764 fdc (e817a017f82df2a1f8cfdbda29388b29) C:\Windows\system32\DRIVERS\fdc.sys
2011/04/24 23:37:40.0938 0764 FileInfo (6cf00369c97f3cf563be99be983d13d8) C:\Windows\system32\drivers\fileinfo.sys
2011/04/24 23:37:41.0001 0764 Filetrace (42c51dc94c91da21cb9196eb64c45db9) C:\Windows\system32\drivers\filetrace.sys
2011/04/24 23:37:41.0079 0764 flpydisk (87907aa70cb3c56600f1c2fb8841579b) C:\Windows\system32\DRIVERS\flpydisk.sys
2011/04/24 23:37:41.0172 0764 FltMgr (7520ec808e0c35e0ee6f841294316653) C:\Windows\system32\drivers\fltmgr.sys
2011/04/24 23:37:41.0344 0764 FsDepends (1a16b57943853e598cff37fe2b8cbf1d) C:\Windows\system32\drivers\FsDepends.sys
2011/04/24 23:37:41.0453 0764 fssfltr (d909075fa72c090f27aa926c32cb4612) C:\Windows\system32\DRIVERS\fssfltr.sys
2011/04/24 23:37:41.0547 0764 Fs_Rec (a574b4360e438977038aae4bf60d79a2) C:\Windows\system32\drivers\Fs_Rec.sys
2011/04/24 23:37:41.0640 0764 fvevol (dafbd9fe39197495aed6d51f3b85b5d2) C:\Windows\system32\DRIVERS\fvevol.sys
2011/04/24 23:37:41.0734 0764 gagp30kx (65ee0c7a58b65e74ae05637418153938) C:\Windows\system32\DRIVERS\gagp30kx.sys
2011/04/24 23:37:41.0937 0764 hcw85cir (c44e3c2bab6837db337ddee7544736db) C:\Windows\system32\drivers\hcw85cir.sys
2011/04/24 23:37:42.0046 0764 HdAudAddService (3530cad25deba7dc7de8bb51632cbc5f) C:\Windows\system32\drivers\HdAudio.sys
2011/04/24 23:37:42.0202 0764 HDAudBus (717a2207fd6f13ad3e664c7d5a43c7bf) C:\Windows\system32\DRIVERS\HDAudBus.sys
2011/04/24 23:37:42.0264 0764 HidBatt (1d58a7f3e11a9731d0eaaaa8405acc36) C:\Windows\system32\DRIVERS\HidBatt.sys
2011/04/24 23:37:42.0358 0764 HidBth (89448f40e6df260c206a193a4683ba78) C:\Windows\system32\DRIVERS\hidbth.sys
2011/04/24 23:37:42.0436 0764 HidIr (cf50b4cf4a4f229b9f3c08351f99ca5e) C:\Windows\system32\DRIVERS\hidir.sys
2011/04/24 23:37:42.0623 0764 HidUsb (25072fb35ac90b25f9e4e3bacf774102) C:\Windows\system32\DRIVERS\hidusb.sys
2011/04/24 23:37:42.0919 0764 HpSAMD (295fdc419039090eb8b49ffdbb374549) C:\Windows\system32\DRIVERS\HpSAMD.sys
2011/04/24 23:37:43.0060 0764 HTTP (c531c7fd9e8b62021112787c4e2c5a5a) C:\Windows\system32\drivers\HTTP.sys
2011/04/24 23:37:43.0169 0764 hwpolicy (8305f33cde89ad6c7a0763ed0b5a8d42) C:\Windows\system32\drivers\hwpolicy.sys
2011/04/24 23:37:43.0309 0764 i8042prt (f151f0bdc47f4a28b1b20a0818ea36d6) C:\Windows\system32\DRIVERS\i8042prt.sys
2011/04/24 23:37:43.0419 0764 iaStorV (934af4d7c5f457b9f0743f4299b77b67) C:\Windows\system32\DRIVERS\iaStorV.sys
2011/04/24 23:37:43.0590 0764 iirsp (4173ff5708f3236cf25195fecd742915) C:\Windows\system32\DRIVERS\iirsp.sys
2011/04/24 23:37:43.0731 0764 intelide (a0f12f2c9ba6c72f3987ce780e77c130) C:\Windows\system32\DRIVERS\intelide.sys
2011/04/24 23:37:43.0824 0764 intelppm (3b514d27bfc4accb4037bc6685f766e0) C:\Windows\system32\DRIVERS\intelppm.sys
2011/04/24 23:37:43.0996 0764 IpFilterDriver (709d1761d3b19a932ff0238ea6d50200) C:\Windows\system32\DRIVERS\ipfltdrv.sys
2011/04/24 23:37:44.0136 0764 IPMIDRV (e4454b6c37d7ffd5649611f6496308a7) C:\Windows\system32\DRIVERS\IPMIDrv.sys
2011/04/24 23:37:44.0214 0764 IPNAT (a5fa468d67abcdaa36264e463a7bb0cd) C:\Windows\system32\drivers\ipnat.sys
2011/04/24 23:37:44.0292 0764 IRENUM (42996cff20a3084a56017b7902307e9f) C:\Windows\system32\drivers\irenum.sys
2011/04/24 23:37:44.0370 0764 isapnp (1f32bb6b38f62f7df1a7ab7292638a35) C:\Windows\system32\DRIVERS\isapnp.sys
2011/04/24 23:37:44.0448 0764 iScsiPrt (ed46c223ae46c6866ab77cdc41c404b7) C:\Windows\system32\DRIVERS\msiscsi.sys
2011/04/24 23:37:44.0542 0764 kbdclass (adef52ca1aeae82b50df86b56413107e) C:\Windows\system32\DRIVERS\kbdclass.sys
2011/04/24 23:37:44.0667 0764 kbdhid (3d9f0ebf350edcfd6498057301455964) C:\Windows\system32\DRIVERS\kbdhid.sys
2011/04/24 23:37:44.0776 0764 KSecDD (e36a061ec11b373826905b21be10948f) C:\Windows\system32\Drivers\ksecdd.sys
2011/04/24 23:37:44.0838 0764 KSecPkg (365c6154bbbc5377173f1ca7bfb6cc59) C:\Windows\system32\Drivers\ksecpkg.sys
2011/04/24 23:37:45.0041 0764 lltdio (f7611ec07349979da9b0ae1f18ccc7a6) C:\Windows\system32\DRIVERS\lltdio.sys
2011/04/24 23:37:45.0197 0764 LSI_FC (eb119a53ccf2acc000ac71b065b78fef) C:\Windows\system32\DRIVERS\lsi_fc.sys
2011/04/24 23:37:45.0275 0764 LSI_SAS (8ade1c877256a22e49b75d1cc9161f9c) C:\Windows\system32\DRIVERS\lsi_sas.sys
2011/04/24 23:37:45.0353 0764 LSI_SAS2 (dc9dc3d3daa0e276fd2ec262e38b11e9) C:\Windows\system32\DRIVERS\lsi_sas2.sys
2011/04/24 23:37:45.0431 0764 LSI_SCSI (0a036c7d7cab643a7f07135ac47e0524) C:\Windows\system32\DRIVERS\lsi_scsi.sys
2011/04/24 23:37:45.0525 0764 luafv (6703e366cc18d3b6e534f5cf7df39cee) C:\Windows\system32\drivers\luafv.sys
2011/04/24 23:37:45.0634 0764 megasas (0fff5b045293002ab38eb1fd1fc2fb74) C:\Windows\system32\DRIVERS\megasas.sys
2011/04/24 23:37:45.0727 0764 MegaSR (dcbab2920c75f390caf1d29f675d03d6) C:\Windows\system32\DRIVERS\MegaSR.sys
2011/04/24 23:37:45.0821 0764 Modem (f001861e5700ee84e2d4e52c712f4964) C:\Windows\system32\drivers\modem.sys
2011/04/24 23:37:45.0883 0764 monitor (79d10964de86b292320e9dfe02282a23) C:\Windows\system32\DRIVERS\monitor.sys
2011/04/24 23:37:45.0977 0764 mouclass (fb18cc1d4c2e716b6b903b0ac0cc0609) C:\Windows\system32\DRIVERS\mouclass.sys
2011/04/24 23:37:46.0086 0764 mouhid (2c388d2cd01c9042596cf3c8f3c7b24d) C:\Windows\system32\DRIVERS\mouhid.sys
2011/04/24 23:37:46.0164 0764 mountmgr (921c18727c5920d6c0300736646931c2) C:\Windows\system32\drivers\mountmgr.sys
2011/04/24 23:37:46.0242 0764 mpio (2af5997438c55fb79d33d015c30e1974) C:\Windows\system32\DRIVERS\mpio.sys
2011/04/24 23:37:46.0305 0764 mpsdrv (ad2723a7b53dd1aacae6ad8c0bfbf4d0) C:\Windows\system32\drivers\mpsdrv.sys
2011/04/24 23:37:46.0383 0764 MRxDAV (b1be47008d20e43da3adc37c24cdb89d) C:\Windows\system32\drivers\mrxdav.sys
2011/04/24 23:37:46.0461 0764 mrxsmb (b4c76ef46322a9711c7b0f4e21ef6ea5) C:\Windows\system32\DRIVERS\mrxsmb.sys
2011/04/24 23:37:46.0523 0764 mrxsmb10 (e593d45024a3fdd11e93cc4a6ca91101) C:\Windows\system32\DRIVERS\mrxsmb10.sys
2011/04/24 23:37:46.0585 0764 mrxsmb20 (a9f86c82c9cc3b679cc3957e1183a30f) C:\Windows\system32\DRIVERS\mrxsmb20.sys
2011/04/24 23:37:46.0663 0764 msahci (4326d168944123f38dd3b2d9c37a0b12) C:\Windows\system32\DRIVERS\msahci.sys
2011/04/24 23:37:46.0726 0764 msdsm (455029c7174a2dbb03dba8a0d8bddd9a) C:\Windows\system32\DRIVERS\msdsm.sys
2011/04/24 23:37:46.0835 0764 Msfs (daefb28e3af5a76abcc2c3078c07327f) C:\Windows\system32\drivers\Msfs.sys
2011/04/24 23:37:46.0913 0764 mshidkmdf (3e1e5767043c5af9367f0056295e9f84) C:\Windows\System32\drivers\mshidkmdf.sys
2011/04/24 23:37:46.0975 0764 msisadrv (0a4e5757ae09fa9622e3158cc1aef114) C:\Windows\system32\DRIVERS\msisadrv.sys
2011/04/24 23:37:47.0100 0764 MSKSSRV (8c0860d6366aaffb6c5bb9df9448e631) C:\Windows\system32\drivers\MSKSSRV.sys
2011/04/24 23:37:47.0147 0764 MSPCLOCK (3ea8b949f963562cedbb549eac0c11ce) C:\Windows\system32\drivers\MSPCLOCK.sys
2011/04/24 23:37:47.0209 0764 MSPQM (f456e973590d663b1073e9c463b40932) C:\Windows\system32\drivers\MSPQM.sys
2011/04/24 23:37:47.0272 0764 MsRPC (0e008fc4819d238c51d7c93e7b41e560) C:\Windows\system32\drivers\MsRPC.sys
2011/04/24 23:37:47.0365 0764 mssmbios (fc6b9ff600cc585ea38b12589bd4e246) C:\Windows\system32\DRIVERS\mssmbios.sys
2011/04/24 23:37:47.0428 0764 MSTEE (b42c6b921f61a6e55159b8be6cd54a36) C:\Windows\system32\drivers\MSTEE.sys
2011/04/24 23:37:47.0490 0764 MTConfig (33599130f44e1f34631cea241de8ac84) C:\Windows\system32\DRIVERS\MTConfig.sys
2011/04/24 23:37:47.0537 0764 Mup (159fad02f64e6381758c990f753bcc80) C:\Windows\system32\Drivers\mup.sys
2011/04/24 23:37:47.0631 0764 NativeWifiP (26384429fcd85d83746f63e798ab1480) C:\Windows\system32\DRIVERS\nwifi.sys
2011/04/24 23:37:47.0724 0764 NDIS (23759d175a0a9baaf04d05047bc135a8) C:\Windows\system32\drivers\ndis.sys
2011/04/24 23:37:47.0849 0764 NdisCap (0e1787aa6c9191d3d319e8bafe86f80c) C:\Windows\system32\DRIVERS\ndiscap.sys
2011/04/24 23:37:47.0927 0764 NdisTapi (e4a8aec125a2e43a9e32afeea7c9c888) C:\Windows\system32\DRIVERS\ndistapi.sys
2011/04/24 23:37:48.0145 0764 Ndisuio (b30ae7f2b6d7e343b0df32e6c08fce75) C:\Windows\system32\DRIVERS\ndisuio.sys
2011/04/24 23:37:48.0223 0764 NdisWan (267c415eadcbe53c9ca873dee39cf3a4) C:\Windows\system32\DRIVERS\ndiswan.sys
2011/04/24 23:37:48.0317 0764 NDProxy (af7e7c63dcef3f8772726f86039d6eb4) C:\Windows\system32\drivers\NDProxy.sys
2011/04/24 23:37:48.0411 0764 NetBIOS (80b275b1ce3b0e79909db7b39af74d51) C:\Windows\system32\DRIVERS\netbios.sys
2011/04/24 23:37:48.0489 0764 NetBT (dd52a733bf4ca5af84562a5e2f963b91) C:\Windows\system32\DRIVERS\netbt.sys
2011/04/24 23:37:48.0723 0764 NetworkX (39fbb0815208dbe6d01a9d417815f922) C:\Windows\system32\ckldrv.sys
2011/04/24 23:37:48.0816 0764 nfrd960 (1d85c4b390b0ee09c7a46b91efb2c097) C:\Windows\system32\DRIVERS\nfrd960.sys
2011/04/24 23:37:48.0957 0764 Npfs (1db262a9f8c087e8153d89bef3d2235f) C:\Windows\system32\drivers\Npfs.sys
2011/04/24 23:37:49.0050 0764 nsiproxy (e9a0a4d07e53d8fea2bb8387a3293c58) C:\Windows\system32\drivers\nsiproxy.sys
2011/04/24 23:37:49.0237 0764 Ntfs (3795dcd21f740ee799fb7223234215af) C:\Windows\system32\drivers\Ntfs.sys
2011/04/24 23:37:49.0362 0764 Null (f9756a98d69098dca8945d62858a812c) C:\Windows\system32\drivers\Null.sys
2011/04/24 23:37:49.0471 0764 NVENETFD (b5e37e31c053bc9950455a257526514b) C:\Windows\system32\DRIVERS\nvm62x32.sys
2011/04/24 23:37:49.0627 0764 NVHDA (d2f4c4b22969236382ca853b8daa2d4e) C:\Windows\system32\drivers\nvhda32v.sys
2011/04/24 23:37:50.0017 0764 nvlddmkm (9dac05d828e56801fd6ce5fdfced64af) C:\Windows\system32\DRIVERS\nvlddmkm.sys
2011/04/24 23:37:50.0454 0764 NVNET (c9c82e1a08955fdbdf92aac55bc3a4e4) C:\Windows\system32\DRIVERS\nvmf6232.sys
2011/04/24 23:37:50.0610 0764 nvraid (3f3d04b1d08d43c16ea7963954ec768d) C:\Windows\system32\DRIVERS\nvraid.sys
2011/04/24 23:37:50.0719 0764 nvsmu (f13618f0cb1e95232f4c2401592a59e9) C:\Windows\system32\DRIVERS\nvsmu.sys
2011/04/24 23:37:50.0797 0764 nvstor (c99f251a5de63c6f129cf71933aced0f) C:\Windows\system32\DRIVERS\nvstor.sys
2011/04/24 23:37:50.0875 0764 nvstor32 (032ef66dd96692ad3a9d36160f467f67) C:\Windows\system32\DRIVERS\nvstor32.sys
2011/04/24 23:37:51.0000 0764 nv_agp (5a0983915f02bae73267cc2a041f717d) C:\Windows\system32\DRIVERS\nv_agp.sys
2011/04/24 23:37:51.0141 0764 ohci1394 (08a70a1f2cdde9bb49b885cb817a66eb) C:\Windows\system32\DRIVERS\ohci1394.sys
2011/04/24 23:37:51.0297 0764 Parport (2ea877ed5dd9713c5ac74e8ea7348d14) C:\Windows\system32\DRIVERS\parport.sys
2011/04/24 23:37:51.0359 0764 partmgr (ff4218952b51de44fe910953a3e686b9) C:\Windows\system32\drivers\partmgr.sys
2011/04/24 23:37:51.0453 0764 Parvdm (eb0a59f29c19b86479d36b35983daadc) C:\Windows\system32\DRIVERS\parvdm.sys
2011/04/24 23:37:51.0562 0764 pci (c858cb77c577780ecc456a892e7e7d0f) C:\Windows\system32\DRIVERS\pci.sys
2011/04/24 23:37:51.0624 0764 pciide (afe86f419014db4e5593f69ffe26ce0a) C:\Windows\system32\DRIVERS\pciide.sys
2011/04/24 23:37:51.0702 0764 pcmcia (f396431b31693e71e8a80687ef523506) C:\Windows\system32\DRIVERS\pcmcia.sys
2011/04/24 23:37:51.0780 0764 pcw (250f6b43d2b613172035c6747aeeb19f) C:\Windows\system32\drivers\pcw.sys
2011/04/24 23:37:51.0858 0764 PEAUTH (9e0104ba49f4e6973749a02bf41344ed) C:\Windows\system32\drivers\peauth.sys
2011/04/24 23:37:52.0217 0764 PptpMiniport (631e3e205ad6d86f2aed6a4a8e69f2db) C:\Windows\system32\DRIVERS\raspptp.sys
2011/04/24 23:37:52.0295 0764 Processor (85b1e3a0c7585bc4aae6899ec6fcf011) C:\Windows\system32\DRIVERS\processr.sys
2011/04/24 23:37:52.0482 0764 Psched (6270ccae2a86de6d146529fe55b3246a) C:\Windows\system32\DRIVERS\pacer.sys
2011/04/24 23:37:52.0591 0764 ql2300 (ab95ecf1f6659a60ddc166d8315b0751) C:\Windows\system32\DRIVERS\ql2300.sys
2011/04/24 23:37:52.0732 0764 ql40xx (b4dd51dd25182244b86737dc51af2270) C:\Windows\system32\DRIVERS\ql40xx.sys
2011/04/24 23:37:52.0825 0764 QWAVEdrv (584078ca1b95ca72df2a27c336f9719d) C:\Windows\system32\drivers\qwavedrv.sys
2011/04/24 23:37:52.0903 0764 RasAcd (30a81b53c766d0133bb86d234e5556ab) C:\Windows\system32\DRIVERS\rasacd.sys
2011/04/24 23:37:52.0997 0764 RasAgileVpn (57ec4aef73660166074d8f7f31c0d4fd) C:\Windows\system32\DRIVERS\AgileVpn.sys
2011/04/24 23:37:53.0106 0764 Rasl2tp (d9f91eafec2815365cbe6d167e4e332a) C:\Windows\system32\DRIVERS\rasl2tp.sys
2011/04/24 23:37:53.0231 0764 RasPppoe (0fe8b15916307a6ac12bfb6a63e45507) C:\Windows\system32\DRIVERS\raspppoe.sys
2011/04/24 23:37:53.0309 0764 RasSstp (44101f495a83ea6401d886e7fd70096b) C:\Windows\system32\DRIVERS\rassstp.sys
2011/04/24 23:37:53.0387 0764 rdbss (835d7e81bf517a3b72384bdcc85e1ce6) C:\Windows\system32\DRIVERS\rdbss.sys
2011/04/24 23:37:53.0465 0764 rdpbus (0d8f05481cb76e70e1da06ee9f0da9df) C:\Windows\system32\DRIVERS\rdpbus.sys
2011/04/24 23:37:53.0559 0764 RDPCDD (1e016846895b15a99f9a176a05029075) C:\Windows\system32\DRIVERS\RDPCDD.sys
2011/04/24 23:37:53.0683 0764 RDPENCDD (5a53ca1598dd4156d44196d200c94b8a) C:\Windows\system32\drivers\rdpencdd.sys
2011/04/24 23:37:53.0761 0764 RDPREFMP (44b0a53cd4f27d50ed461dae0c0b4e1f) C:\Windows\system32\drivers\rdprefmp.sys
2011/04/24 23:37:53.0839 0764 RDPWD (801371ba9782282892d00aadb08ee367) C:\Windows\system32\drivers\RDPWD.sys
2011/04/24 23:37:53.0917 0764 rdyboost (4ea225bf1cf05e158853f30a99ca29a7) C:\Windows\system32\drivers\rdyboost.sys
2011/04/24 23:37:54.0089 0764 RFCOMM (cb928d9e6daf51879dd6ba8d02f01321) C:\Windows\system32\DRIVERS\rfcomm.sys
2011/04/24 23:37:54.0245 0764 rspndr (032b0d36ad92b582d869879f5af5b928) C:\Windows\system32\DRIVERS\rspndr.sys
2011/04/24 23:37:54.0385 0764 RSUSBSTOR (07f66ca7db9608806ca2ef1970daba58) C:\Windows\system32\Drivers\RtsUStor.sys
2011/04/24 23:37:54.0635 0764 sbp2port (34ee0c44b724e3e4ce2eff29126de5b5) C:\Windows\system32\DRIVERS\sbp2port.sys
2011/04/24 23:37:54.0807 0764 scfilter (a95c54b2ac3cc9c73fcdf9e51a1d6b51) C:\Windows\system32\DRIVERS\scfilter.sys
2011/04/24 23:37:54.0947 0764 sdbus (7b48cff3a475fe849dea65ec4d35c425) C:\Windows\system32\DRIVERS\sdbus.sys
2011/04/24 23:37:55.0025 0764 secdrv (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys
2011/04/24 23:37:55.0212 0764 Serenum (9ad8b8b515e3df6acd4212ef465de2d1) C:\Windows\system32\DRIVERS\serenum.sys
2011/04/24 23:37:55.0306 0764 Serial (5fb7fcea0490d821f26f39cc5ea3d1e2) C:\Windows\system32\DRIVERS\serial.sys
2011/04/24 23:37:55.0431 0764 sermouse (79bffb520327ff916a582dfea17aa813) C:\Windows\system32\DRIVERS\sermouse.sys
2011/04/24 23:37:55.0602 0764 sffdisk (9f976e1eb233df46fce808d9dea3eb9c) C:\Windows\system32\DRIVERS\sffdisk.sys
2011/04/24 23:37:55.0680 0764 sffp_mmc (932a68ee27833cfd57c1639d375f2731) C:\Windows\system32\DRIVERS\sffp_mmc.sys
2011/04/24 23:37:55.0743 0764 sffp_sd (4f1e5b0fe7c8050668dbfade8999aefb) C:\Windows\system32\DRIVERS\sffp_sd.sys
2011/04/24 23:37:55.0836 0764 sfloppy (db96666cc8312ebc45032f30b007a547) C:\Windows\system32\DRIVERS\sfloppy.sys
2011/04/24 23:37:55.0977 0764 sisagp (2565cac0dc9fe0371bdce60832582b2e) C:\Windows\system32\DRIVERS\sisagp.sys
2011/04/24 23:37:56.0055 0764 SiSRaid2 (a9f0486851becb6dda1d89d381e71055) C:\Windows\system32\DRIVERS\SiSRaid2.sys
2011/04/24 23:37:56.0133 0764 SiSRaid4 (3727097b55738e2f554972c3be5bc1aa) C:\Windows\system32\DRIVERS\sisraid4.sys
2011/04/24 23:37:56.0226 0764 Smb (3e21c083b8a01cb70ba1f09303010fce) C:\Windows\system32\DRIVERS\smb.sys
2011/04/24 23:37:56.0383 0764 spldr (95cf1ae7527fb70f7816563cbc09d942) C:\Windows\system32\drivers\spldr.sys
2011/04/24 23:37:56.0554 0764 srv (4a9b0f215de2519e2363f91df25c1e97) C:\Windows\system32\DRIVERS\srv.sys
2011/04/24 23:37:56.0642 0764 srv2 (14c44875518ae1c982e54ea8c5f7fe28) C:\Windows\system32\DRIVERS\srv2.sys
2011/04/24 23:37:56.0736 0764 SrvHsfHDA (e00fdfaff025e94f9821153750c35a6d) C:\Windows\system32\DRIVERS\VSTAZL3.SYS
2011/04/24 23:37:56.0834 0764 SrvHsfV92 (ceb4e3b6890e1e42dca6694d9e59e1a0) C:\Windows\system32\DRIVERS\VSTDPV3.SYS
2011/04/24 23:37:56.0951 0764 SrvHsfWinac (bc0c7ea89194c299f051c24119000e17) C:\Windows\system32\DRIVERS\VSTCNXT3.SYS
2011/04/24 23:37:57.0073 0764 srvnet (07a14223b0a50e76ade003fdf95d4fec) C:\Windows\system32\DRIVERS\srvnet.sys
2011/04/24 23:37:57.0267 0764 stexstor (db32d325c192b801df274bfd12a7e72b) C:\Windows\system32\DRIVERS\stexstor.sys
2011/04/24 23:37:57.0369 0764 STHDA (e69a606872650b46de54ec15dcc93529) C:\Windows\system32\DRIVERS\stwrt.sys
2011/04/24 23:37:57.0507 0764 swenum (e58c78a848add9610a4db6d214af5224) C:\Windows\system32\DRIVERS\swenum.sys
2011/04/24 23:37:57.0834 0764 Tcpip (bb7f39c31c4a4417fd318e7cd184e225) C:\Windows\system32\drivers\tcpip.sys
2011/04/24 23:37:58.0021 0764 TCPIP6 (bb7f39c31c4a4417fd318e7cd184e225) C:\Windows\system32\DRIVERS\tcpip.sys
2011/04/24 23:37:58.0224 0764 tcpipreg (e64444523add154f86567c469bc0b17f) C:\Windows\system32\drivers\tcpipreg.sys
2011/04/24 23:37:58.0349 0764 TDPIPE (1875c1490d99e70e449e3afae9fcbadf) C:\Windows\system32\drivers\tdpipe.sys
2011/04/24 23:37:58.0427 0764 TDTCP (7551e91ea999ee9a8e9c331d5a9c31f3) C:\Windows\system32\drivers\tdtcp.sys
2011/04/24 23:37:58.0505 0764 tdx (cb39e896a2a83702d1737bfd402b3542) C:\Windows\system32\DRIVERS\tdx.sys
2011/04/24 23:37:58.0614 0764 TermDD (c36f41ee20e6999dbf4b0425963268a5) C:\Windows\system32\DRIVERS\termdd.sys
2011/04/24 23:37:58.0864 0764 tssecsrv (98ae6fa07d12cb4ec5cf4a9bfa5f4242) C:\Windows\system32\DRIVERS\tssecsrv.sys
2011/04/24 23:37:58.0942 0764 tunnel (3e461d890a97f9d4c168f5fda36e1d00) C:\Windows\system32\DRIVERS\tunnel.sys
2011/04/24 23:37:59.0020 0764 uagp35 (750fbcb269f4d7dd2e420c56b795db6d) C:\Windows\system32\DRIVERS\uagp35.sys
2011/04/24 23:37:59.0113 0764 udfs (09cc3e16f8e5ee7168e01cf8fcbe061a) C:\Windows\system32\DRIVERS\udfs.sys
2011/04/24 23:37:59.0285 0764 uliagpkx (44e8048ace47befbfdc2e9be4cbc8880) C:\Windows\system32\DRIVERS\uliagpkx.sys
2011/04/24 23:37:59.0363 0764 umbus (049b3a50b3d646baeeee9eec9b0668dc) C:\Windows\system32\DRIVERS\umbus.sys
2011/04/24 23:37:59.0441 0764 UmPass (7550ad0c6998ba1cb4843e920ee0feac) C:\Windows\system32\DRIVERS\umpass.sys
2011/04/24 23:37:59.0535 0764 usbccgp (8455c4ed038efd09e99327f9d2d48ffa) C:\Windows\system32\DRIVERS\usbccgp.sys
2011/04/24 23:37:59.0706 0764 usbcir (04ec7cec62ec3b6d9354eee93327fc82) C:\Windows\system32\DRIVERS\usbcir.sys
2011/04/24 23:37:59.0800 0764 usbehci (ff32d4f3ec3c68b2ca61782c7964f54e) C:\Windows\system32\DRIVERS\usbehci.sys
2011/04/24 23:37:59.0893 0764 usbhub (b0dfc7b484e0ca0c27bda5433b82d94a) C:\Windows\system32\DRIVERS\usbhub.sys
2011/04/24 23:37:59.0971 0764 usbohci (a6fb7957ea7afb1165991e54ce934b74) C:\Windows\system32\DRIVERS\usbohci.sys
2011/04/24 23:38:00.0081 0764 usbprint (797d862fe0875e75c7cc4c1ad7b30252) C:\Windows\system32\DRIVERS\usbprint.sys
2011/04/24 23:38:00.0174 0764 usbscan (576096ccbc07e7c4ea4f5e6686d6888f) C:\Windows\system32\DRIVERS\usbscan.sys
2011/04/24 23:38:00.0252 0764 USBSTOR (d8889d56e0d27e57ed4591837fe71d27) C:\Windows\system32\DRIVERS\USBSTOR.SYS
2011/04/24 23:38:00.0330 0764 usbuhci (78780c3ebce17405b1ccd07a3a8a7d72) C:\Windows\system32\DRIVERS\usbuhci.sys
2011/04/24 23:38:00.0424 0764 usbvideo (b5f6a992d996282b7fae7048e50af83a) C:\Windows\System32\Drivers\usbvideo.sys
2011/04/24 23:38:00.0611 0764 vdrvroot (a059c4c3edb09e07d21a8e5c0aabd3cb) C:\Windows\system32\DRIVERS\vdrvroot.sys
2011/04/24 23:38:00.0767 0764 vga (17c408214ea61696cec9c66e388b14f3) C:\Windows\system32\DRIVERS\vgapnp.sys
2011/04/24 23:38:00.0845 0764 VgaSave (8e38096ad5c8570a6f1570a61e251561) C:\Windows\System32\drivers\vga.sys
2011/04/24 23:38:00.0939 0764 vhdmp (3be6e1f3a4f1afec8cee0d7883f93583) C:\Windows\system32\DRIVERS\vhdmp.sys
2011/04/24 23:38:01.0032 0764 viaagp (c829317a37b4bea8f39735d4b076e923) C:\Windows\system32\DRIVERS\viaagp.sys
2011/04/24 23:38:01.0110 0764 ViaC7 (e02f079a6aa107f06b16549c6e5c7b74) C:\Windows\system32\DRIVERS\viac7.sys
2011/04/24 23:38:01.0157 0764 viaide (e43574f6a56a0ee11809b48c09e4fd3c) C:\Windows\system32\DRIVERS\viaide.sys
2011/04/24 23:38:01.0235 0764 volmgr (384e5a2aa49934295171e499f86ba6f3) C:\Windows\system32\DRIVERS\volmgr.sys
2011/04/24 23:38:01.0344 0764 volmgrx (b5bb72067ddddbbfb04b2f89ff8c3c87) C:\Windows\system32\drivers\volmgrx.sys
2011/04/24 23:38:01.0438 0764 volsnap (58df9d2481a56edde167e51b334d44fd) C:\Windows\system32\DRIVERS\volsnap.sys
2011/04/24 23:38:01.0516 0764 vsmraid (9dfa0cc2f8855a04816729651175b631) C:\Windows\system32\DRIVERS\vsmraid.sys
2011/04/24 23:38:01.0625 0764 vwifibus (90567b1e658001e79d7c8bbd3dde5aa6) C:\Windows\system32\DRIVERS\vwifibus.sys
2011/04/24 23:38:01.0719 0764 vwififlt (7090d3436eeb4e7da3373090a23448f7) C:\Windows\system32\DRIVERS\vwififlt.sys
2011/04/24 23:38:01.0797 0764 vwifimp (a3f04cbea6c2a10e6cb01f8b47611882) C:\Windows\system32\DRIVERS\vwifimp.sys
2011/04/24 23:38:01.0921 0764 WacomPen (de3721e89c653aa281428c8a69745d90) C:\Windows\system32\DRIVERS\wacompen.sys
2011/04/24 23:38:02.0046 0764 WANARP (692a712062146e96d28ba0b7d75de31b) C:\Windows\system32\DRIVERS\wanarp.sys
2011/04/24 23:38:02.0109 0764 Wanarpv6 (692a712062146e96d28ba0b7d75de31b) C:\Windows\system32\DRIVERS\wanarp.sys
2011/04/24 23:38:02.0343 0764 Wd (1112a9badacb47b7c0bb0392e3158dff) C:\Windows\system32\DRIVERS\wd.sys
2011/04/24 23:38:02.0436 0764 Wdf01000 (9950e3d0f08141c7e89e64456ae7dc73) C:\Windows\system32\drivers\Wdf01000.sys
2011/04/24 23:38:02.0733 0764 WfpLwf (8b9a943f3b53861f2bfaf6c186168f79) C:\Windows\system32\DRIVERS\wfplwf.sys
2011/04/24 23:38:02.0811 0764 WIMMount (5cf95b35e59e2a38023836fff31be64c) C:\Windows\system32\drivers\wimmount.sys
2011/04/24 23:38:03.0154 0764 WmiAcpi (0217679b8fca58714c3bf2726d2ca84e) C:\Windows\system32\DRIVERS\wmiacpi.sys
2011/04/24 23:38:03.0403 0764 ws2ifsl (6db3276587b853bf886b69528fdb048c) C:\Windows\system32\drivers\ws2ifsl.sys
2011/04/24 23:38:03.0591 0764 WudfPf (6f9b6c0c93232cff47d0f72d6db1d21e) C:\Windows\system32\drivers\WudfPf.sys
2011/04/24 23:38:03.0669 0764 WUDFRd (f91ff1e51fca30b3c3981db7d5924252) C:\Windows\system32\DRIVERS\WUDFRd.sys
2011/04/24 23:38:04.0230 0764 ================================================================================
2011/04/24 23:38:04.0230 0764 Scan finished
2011/04/24 23:38:04.0230 0764 ================================================================================

and MBRCheck had this report
MBRCheck, version 1.2.3
© 2010, AD

Command-line:
Windows Version: Windows 7 Home Premium Edition
Windows Information: (build 7600), 32-bit
Base Board Manufacturer: Quanta
BIOS Manufacturer: Hewlett-Packard
System Manufacturer: Hewlett-Packard
System Product Name: HP Mini 311-1000
Logical Drives Mask: 0x0000001c

Kernel Drivers (total 171):
0x82E52000 \SystemRoot\system32\ntkrnlpa.exe
0x82E1B000 \SystemRoot\system32\halmacpi.dll
0x80BD5000 \SystemRoot\system32\kdcom.dll
0x8A824000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
0x8A89C000 \SystemRoot\system32\PSHED.dll
0x8A8AD000 \SystemRoot\system32\BOOTVID.dll
0x8A8B5000 \SystemRoot\system32\CLFS.SYS
0x8A8F7000 \SystemRoot\system32\CI.dll
0x8AA1E000 \SystemRoot\system32\drivers\Wdf01000.sys
0x8AA8F000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x8AA9D000 \SystemRoot\system32\DRIVERS\ACPI.sys
0x8AAE5000 \SystemRoot\system32\DRIVERS\WMILIB.SYS
0x8AAEE000 \SystemRoot\system32\DRIVERS\msisadrv.sys
0x8AAF6000 \SystemRoot\system32\DRIVERS\pci.sys
0x8AB20000 \SystemRoot\system32\DRIVERS\vdrvroot.sys
0x8AB2B000 \SystemRoot\System32\drivers\partmgr.sys
0x8AB3C000 \SystemRoot\system32\DRIVERS\compbatt.sys
0x8AB44000 \SystemRoot\system32\DRIVERS\BATTC.SYS
0x8AB4F000 \SystemRoot\system32\DRIVERS\volmgr.sys
0x8AB5F000 \SystemRoot\System32\drivers\volmgrx.sys
0x8ABAA000 \SystemRoot\System32\drivers\mountmgr.sys
0x8ABC0000 \SystemRoot\system32\DRIVERS\atapi.sys
0x8ABC9000 \SystemRoot\system32\DRIVERS\ataport.SYS
0x8ABEC000 \SystemRoot\system32\DRIVERS\msahci.sys
0x8AA00000 \SystemRoot\system32\DRIVERS\PCIIDEX.SYS
0x8A9A2000 \SystemRoot\system32\DRIVERS\nvstor32.sys
0x8AC25000 \SystemRoot\system32\DRIVERS\storport.sys
0x8AC6C000 \SystemRoot\system32\DRIVERS\amdxata.sys
0x8AC75000 \SystemRoot\system32\drivers\fltmgr.sys
0x8ACA9000 \SystemRoot\system32\drivers\fileinfo.sys
0x8ACBA000 \SystemRoot\System32\Drivers\Ntfs.sys
0x8AE24000 \SystemRoot\System32\Drivers\msrpc.sys
0x8AE4F000 \SystemRoot\System32\Drivers\ksecdd.sys
0x8AE62000 \SystemRoot\System32\Drivers\cng.sys
0x8AEBF000 \SystemRoot\System32\drivers\pcw.sys
0x8AECD000 \SystemRoot\System32\Drivers\Fs_Rec.sys
0x8AED6000 \SystemRoot\system32\drivers\ndis.sys
0x8AF8D000 \SystemRoot\system32\drivers\NETIO.SYS
0x8AFCB000 \SystemRoot\System32\Drivers\ksecpkg.sys
0x8B001000 \SystemRoot\System32\drivers\tcpip.sys
0x8B14A000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x8B17B000 \SystemRoot\system32\DRIVERS\volsnap.sys
0x8B1BA000 \SystemRoot\System32\Drivers\spldr.sys
0x8B1C2000 \SystemRoot\System32\drivers\rdyboost.sys
0x8B1EF000 \SystemRoot\System32\Drivers\mup.sys
0x8AFF0000 \SystemRoot\System32\drivers\hwpolicy.sys
0x8B23E000 \SystemRoot\System32\DRIVERS\fvevol.sys
0x8B270000 \SystemRoot\system32\DRIVERS\disk.sys
0x8B281000 \SystemRoot\system32\DRIVERS\CLASSPNP.SYS
0x8B2A6000 \SystemRoot\system32\DRIVERS\avgrkx86.sys
0x8B2AB000 \SystemRoot\system32\DRIVERS\AVGIDSEH.Sys
0x8B332000 \SystemRoot\system32\DRIVERS\avgmfx86.sys
0x8B33E000 \SystemRoot\System32\Drivers\Null.SYS
0x8B345000 \SystemRoot\System32\Drivers\Beep.SYS
0x8B34C000 \SystemRoot\System32\drivers\vga.sys
0x8B358000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x8B379000 \SystemRoot\System32\drivers\watchdog.sys
0x8B386000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x8B38E000 \SystemRoot\system32\drivers\rdpencdd.sys
0x8B396000 \SystemRoot\system32\drivers\rdprefmp.sys
0x8B39E000 \SystemRoot\System32\Drivers\Msfs.SYS
0x8B3A9000 \SystemRoot\System32\Drivers\Npfs.SYS
0x8B3B7000 \SystemRoot\system32\DRIVERS\tdx.sys
0x8B3CE000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x90435000 \SystemRoot\system32\DRIVERS\avgtdix.sys
0x9047D000 \SystemRoot\System32\DRIVERS\netbt.sys
0x904AF000 \SystemRoot\system32\drivers\afd.sys
0x90509000 \SystemRoot\system32\DRIVERS\wfplwf.sys
0x90510000 \SystemRoot\system32\DRIVERS\pacer.sys
0x9052F000 \SystemRoot\system32\DRIVERS\vwififlt.sys
0x90540000 \SystemRoot\system32\DRIVERS\netbios.sys
0x9054E000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x90561000 \SystemRoot\system32\DRIVERS\termdd.sys
0x90571000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x905B2000 \SystemRoot\system32\drivers\nsiproxy.sys
0x905BC000 \SystemRoot\system32\ckldrv.sys
0x905C0000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0x905CA000 \SystemRoot\System32\drivers\discache.sys
0x905D6000 \SystemRoot\System32\Drivers\dfsc.sys
0x905EE000 \SystemRoot\system32\DRIVERS\blbdrive.sys
0x8B200000 \SystemRoot\system32\DRIVERS\avgldx86.sys
0x90400000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x90421000 \SystemRoot\system32\DRIVERS\intelppm.sys
0x905FC000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0x8B313000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0x8B3D9000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x9122C000 \SystemRoot\system32\DRIVERS\Apfiltr.sys
0x9126B000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x91278000 \SystemRoot\system32\DRIVERS\nvsmu.sys
0x91281000 \SystemRoot\system32\DRIVERS\usbohci.sys
0x9128B000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x912D6000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x912E5000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x91304000 \SystemRoot\system32\DRIVERS\nvmf6232.sys
0x92012000 \SystemRoot\system32\DRIVERS\nvlddmkm.sys
0x92969000 \SystemRoot\system32\DRIVERS\nvBridge.kmd
0x91349000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x9296B000 \SystemRoot\System32\drivers\dxgmms1.sys
0x9180B000 \SystemRoot\system32\DRIVERS\bcmwl6.sys
0x91AA4000 \SystemRoot\system32\DRIVERS\vwifibus.sys
0x91AAE000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
0x91AB7000 \SystemRoot\system32\DRIVERS\CompositeBus.sys
0x91AC4000 \SystemRoot\system32\DRIVERS\AgileVpn.sys
0x91AD6000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x91AEE000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x91AF9000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x91B1B000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x91B33000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x91B4A000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x91B61000 \SystemRoot\system32\DRIVERS\swenum.sys
0x91B63000 \SystemRoot\system32\DRIVERS\ks.sys
0x91B97000 \SystemRoot\system32\DRIVERS\umbus.sys
0x91BA5000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x91BE9000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x91401000 \SystemRoot\system32\DRIVERS\stwrt.sys
0x91469000 \SystemRoot\system32\DRIVERS\portcls.sys
0x91498000 \SystemRoot\system32\DRIVERS\drmk.sys
0x914B1000 \SystemRoot\system32\drivers\nvhda32v.sys
0x914C4000 \SystemRoot\System32\Drivers\RtsUStor.sys
0x914F1000 \SystemRoot\System32\Drivers\USBD.SYS
0x914F3000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0x9150A000 \SystemRoot\System32\Drivers\usbvideo.sys
0x9152E000 \SystemRoot\System32\Drivers\BTHUSB.sys
0x91540000 \SystemRoot\System32\Drivers\bthport.sys
0x99120000 \SystemRoot\System32\win32k.sys
0x915A4000 \SystemRoot\System32\drivers\Dxapi.sys
0x915AE000 \SystemRoot\System32\Drivers\crashdmp.sys
0x915BB000 \SystemRoot\System32\Drivers\dump_diskdump.sys
0x915C5000 \SystemRoot\System32\Drivers\dump_nvstor32.sys
0x929A4000 \SystemRoot\System32\Drivers\dump_dumpfve.sys
0x929B5000 \SystemRoot\system32\DRIVERS\rfcomm.sys
0x929D9000 \SystemRoot\system32\DRIVERS\BthEnum.sys
0x91200000 \SystemRoot\system32\DRIVERS\bthpan.sys
0x82006000 \SystemRoot\system32\DRIVERS\btwavdt.sys
0x82079000 \SystemRoot\system32\drivers\btwaudio.sys
0x820FA000 \SystemRoot\system32\DRIVERS\btwl2cap.sys
0x82105000 \SystemRoot\system32\DRIVERS\btwrchid.sys
0x82108000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0x8211B000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0x82122000 \SystemRoot\system32\DRIVERS\monitor.sys
0x99380000 \SystemRoot\System32\TSDDD.dll
0x99390000 \SystemRoot\System32\ATMFD.DLL
0x99000000 \SystemRoot\System32\cdd.dll
0x8212D000 \SystemRoot\system32\drivers\luafv.sys
0x82148000 \SystemRoot\system32\drivers\WudfPf.sys
0x82162000 \SystemRoot\system32\DRIVERS\lltdio.sys
0x82172000 \SystemRoot\system32\DRIVERS\nwifi.sys
0x821B8000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0x821C8000 \SystemRoot\system32\DRIVERS\rspndr.sys
0x8B2B4000 \SystemRoot\System32\Drivers\fastfat.SYS
0x9CC2B000 \SystemRoot\system32\drivers\HTTP.sys
0x9CCB0000 \SystemRoot\system32\DRIVERS\bowser.sys
0x9CCC9000 \SystemRoot\System32\drivers\mpsdrv.sys
0x9CCDB000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0x9CCFE000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0x9CD39000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0x9CD6C000 \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys
0x9CD75000 \SystemRoot\system32\DRIVERS\vwifimp.sys
0x9E63D000 \SystemRoot\system32\drivers\peauth.sys
0x9E6D4000 \SystemRoot\System32\Drivers\secdrv.SYS
0x9E6DE000 \SystemRoot\System32\DRIVERS\srvnet.sys
0x9E6FF000 \SystemRoot\System32\drivers\tcpipreg.sys
0x9E70C000 \SystemRoot\system32\DRIVERS\AVGIDSFilter.Sys
0x9E716000 \SystemRoot\System32\DRIVERS\srv2.sys
0x9E765000 \SystemRoot\system32\DRIVERS\AVGIDSDriver.Sys
0x9E78D000 \SystemRoot\System32\DRIVERS\srv.sys
0x9E7DF000 \SystemRoot\system32\DRIVERS\WUDFRd.sys
0x9CD7E000 \SystemRoot\system32\drivers\spsys.sys
0x76FF0000 \Windows\System32\ntdll.dll
0x484E0000 \Windows\System32\smss.exe
0x77230000 \Windows\System32\apisetschema.dll

Processes (total 76):
0 System Idle Process
4 System
276 C:\Windows\System32\smss.exe
544 csrss.exe
616 C:\Windows\System32\wininit.exe
624 csrss.exe
672 C:\Windows\System32\services.exe
680 C:\Windows\System32\lsass.exe
692 C:\Windows\System32\lsm.exe
808 C:\Windows\System32\svchost.exe
876 C:\Windows\System32\nvvsvc.exe
916 C:\Windows\System32\svchost.exe
968 C:\Windows\System32\svchost.exe
1016 C:\Windows\System32\svchost.exe
1044 C:\Windows\System32\svchost.exe
1076 C:\Windows\System32\winlogon.exe
1132 C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_8e7d5b9d3a91d8c5\stacsv.exe
1264 C:\Windows\System32\audiodg.exe
1444 C:\Windows\System32\svchost.exe
1496 C:\Windows\System32\nvvsvc.exe
1596 C:\Windows\System32\svchost.exe
1688 C:\Windows\System32\wlanext.exe
1696 C:\Windows\System32\conhost.exe
1792 C:\Windows\System32\spoolsv.exe
1832 C:\Windows\System32\svchost.exe
1952 C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_8e7d5b9d3a91d8c5\AEstSrv.exe
1980 C:\Program Files\AVG\AVG10\avgwdsvc.exe
2032 C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
108 C:\Windows\System32\Crypserv.exe
460 C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
512 C:\Program Files\Hewlett-Packard\Shared\HPDrvMntSvc.exe
732 C:\Windows\System32\svchost.exe
1040 C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
1404 C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
1620 C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
2056 C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
2408 C:\Windows\System32\taskhost.exe
2540 C:\Windows\System32\dwm.exe
2560 C:\Windows\explorer.exe
3468 C:\Windows\System32\svchost.exe
3520 C:\Windows\System32\svchost.exe
3764 C:\Program Files\Apoint2K\Apoint.exe
3788 C:\Program Files\IDT\WDM\sttray.exe
3860 C:\Program Files\Hewlett-Packard\HP QuickSync\QuickSync.exe
3872 C:\Program Files\Hp\HP Software Update\hpwuschd2.exe
3900 C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
3920 C:\Windows\System32\SearchIndexer.exe
3932 C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
3960 C:\Program Files\AVG\AVG10\avgtray.exe
3972 WUDFHost.exe
4016 C:\Program Files\Common Files\Java\Java Update\jusched.exe
2140 C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
2332 C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
2208 C:\Program Files\Hewlett-Packard\HP QuickSync\jre\bin\javaw.exe
3064 C:\Windows\System32\svchost.exe
3448 C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSMonitor.exe
1272 C:\Windows\System32\conhost.exe
1212 C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe
3608 C:\Program Files\Apoint2K\ApMsgFwd.exe
2764 C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe
4188 WmiPrvSE.exe
4656 C:\Program Files\Windows Media Player\wmpnetwk.exe
5348 C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
5568 C:\Program Files\Hewlett-Packard\Shared\hpCaslNotification.exe
1916 C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Service.exe
3700 C:\Windows\System32\sppsvc.exe
4264 C:\Windows\System32\taskhost.exe
5300 C:\Program Files\Internet Explorer\iexplore.exe
388 C:\Program Files\Internet Explorer\iexplore.exe
6056 C:\Windows\System32\Macromed\Flash\FlashUtil10n_ActiveX.exe
1248 C:\Program Files\Internet Explorer\iexplore.exe
4528 C:\Windows\System32\SearchProtocolHost.exe
1336 C:\Windows\System32\SearchFilterHost.exe
3628 C:\Users\DanielleK\Desktop\MBRCheck.exe
2196 C:\Windows\System32\conhost.exe
3504 C:\Windows\System32\dllhost.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`0c800000 (NTFS)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x00000047`be600000 (NTFS)

PhysicalDrive0 Model Number: ST9320325AS, Rev: 0005

Size Device Name MBR Status
--------------------------------------------
298 GB \\.\PhysicalDrive0 RE: Unknown MBR code
SHA1: A4D709AACD841FB52F9C485A18854266CEAA674A


Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:
Options:
[1] Dump the MBR of a physical disk to file.
[2] Restore the MBR of a physical disk with a standard boot code.
[3] Exit.

Enter your choice: Enter the physical disk number to dump (0-99, -1 to exit):
  • 0

#6
RKinner

RKinner

    Malware Expert

  • Expert
  • 23,192 posts
  • MVP
You must first uninstall AVG before running Combofix then download and run the AVG removal tool.
http://download.avg....6_2011_1322.exe


Appears you missed the above step since TDSSKiller reports all of these AVG drivers still present:
2011/04/24 23:37:34.0468 0764 AVGIDSDriver (1ca8e5fe74efd5826bbd76c0470e6ae4) C:\Windows\system32\DRIVERS\AVGIDSDriver.Sys
2011/04/24 23:37:34.0531 0764 AVGIDSEH (b9b6e535b9b49c463f68f4bcdd232944) C:\Windows\system32\DRIVERS\AVGIDSEH.Sys
2011/04/24 23:37:34.0593 0764 AVGIDSFilter (32a76fd3fc12d09c586730ef63b4b20b) C:\Windows\system32\DRIVERS\AVGIDSFilter.Sys
2011/04/24 23:37:34.0687 0764 AVGIDSShim (84431da40330cdfd84a7b92bcf0d4a05) C:\Windows\system32\DRIVERS\AVGIDSShim.Sys
2011/04/24 23:37:34.0874 0764 Avgldx86 (5fe5a2c2330c376a1d8dcff8d2680a2d) C:\Windows\system32\DRIVERS\avgldx86.sys
2011/04/24 23:37:34.0952 0764 Avgmfx86 (54f1a9b4c9b540c2d8ac4baa171696b1) C:\Windows\system32\DRIVERS\avgmfx86.sys
2011/04/24 23:37:35.0092 0764 Avgrkx86 (8da3b77993c5f354cc2977b7ea06d03a) C:\Windows\system32\DRIVERS\avgrkx86.sys
2011/04/24 23:37:35.0217 0764 Avgtdix (660788ec46f10ece80274d564fa8b4aa) C:\Windows\system32\DRIVERS\avgtdix.sys

George is not going to run until they are gone. For some reason AVG can cause it to make the system unbootable and it doesn't want to do that so if it sees any sign of AVG it's not going to run. In order not to be without an antivirus you can install the free Avast per the instructions at the bottom of my last post. The Avast boot-time scan is one of the best around.

Also MBRCheck is not really happy with your MBR. Run it again and when it finishes hit Y and Enter then select [1] Dump the MBR of a physical disk to file. You want disk: 0 and save it to C:\mbrdmanatee.txt. Then Attach C:\mbrdmanatee.txt to your next reply so I can look at it. (It's not really a text file but the forum software limits files we can attach to certain extensions.)

Ron
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP