[TheHx]

Hello Geeks, thanks for the help.

I have a google redirect. Seems to hijack the top item returned. sends me to these coupon sites where I can save money now! or some odd fake search engine results. I have run Malware Bytes and it finds rootkits and trojans, Avira is the same. Both say they remove the files and then it comes back. I also tried going through the guide here and when I tried to run OTM it crashes my system. Also, this bug seems to block HijackThis.

OTL logfile created on: 7/8/2011 3:48:12 PM - Run 1
OTL by OldTimer - Version 3.2.26.1 Folder = C:\Users\NPIc\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.87 Gb Total Physical Memory | 1.95 Gb Available Physical Memory | 68.00% Memory free
7.12 Gb Paging File | 6.19 Gb Available in Paging File | 86.96% Paging File free
Paging file location(s): c:\pagefile.sys 4411 4411 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 288.04 Gb Total Space | 160.40 Gb Free Space | 55.69% Space Free | Partition Type: NTFS
Drive D: | 10.00 Gb Total Space | 4.94 Gb Free Space | 49.37% Space Free | Partition Type: NTFS

Computer Name: OFFICE | User Name: NPIc | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/07/08 15:47:44 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Users\NPIc\Desktop\OTL.exe
PRC - [2011/07/08 15:16:11 | 000,185,344 | ---- | M] () -- C:\Users\NPIc\AppData\Local\Temp\csrss.exe
PRC - [2011/07/08 02:44:26 | 000,178,688 | ---- | M] () -- C:\Users\NPIc\AppData\Roaming\dwm.exe
PRC - [2011/07/07 16:06:18 | 000,315,392 | ---- | M] (Embed Extol) -- C:\Users\NPIc\AppData\Roaming\Microsoft\conhost.exe
PRC - [2011/06/28 07:48:31 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe
PRC - [2011/04/28 03:19:33 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe
PRC - [2011/03/21 14:56:16 | 001,230,704 | ---- | M] () -- C:\Program Files\DivX\DivX Update\DivXUpdate.exe
PRC - [2010/11/03 03:18:12 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
PRC - [2010/09/08 17:19:08 | 000,910,296 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2010/05/20 15:27:26 | 000,762,736 | ---- | M] (Microsoft Corporation) -- C:\Windows\vVX3000.exe
PRC - [2010/05/20 15:27:24 | 000,139,632 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft LifeCam\MSCamS32.exe
PRC - [2010/01/15 01:11:00 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
PRC - [2009/07/26 22:10:00 | 001,983,816 | ---- | M] (CANON INC.) -- C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
PRC - [2009/04/11 02:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009/04/10 09:52:40 | 001,277,952 | ---- | M] (Nuance Communications, Inc.) -- C:\Program Files\Nuance\PDF Create 5\PdfCreate5Hook.exe
PRC - [2007/05/31 19:42:30 | 000,189,440 | ---- | M] (Avid Technology, Inc.) -- C:\Windows\System32\M-AudioTaskBarIcon.exe
PRC - [2007/05/07 19:05:02 | 000,081,920 | ---- | M] (Avid Technology, Inc.) -- C:\Program Files\M-Audio\Producer USB\MAUSBProducerInst.exe


========== Modules (SafeList) ==========

MOD - [2011/07/08 15:47:44 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Users\NPIc\Desktop\OTL.exe
MOD - [2010/08/31 11:43:52 | 001,686,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll


========== Win32 Services (SafeList) ==========

SRV - [2011/06/28 07:48:31 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011/04/28 03:19:33 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2010/05/20 15:27:24 | 000,139,632 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft LifeCam\MSCamS32.exe -- (MSCamSvc)
SRV - [2010/02/19 16:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)
SRV - [2008/01/20 22:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007/05/07 19:05:02 | 000,081,920 | ---- | M] (Avid Technology, Inc.) [Auto | Running] -- C:\Program Files\M-Audio\Producer USB\MAUSBProducerInst.exe -- (MAudioProducerService)


========== Driver Services (SafeList) ==========

DRV - [2011/06/28 07:48:32 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2011/06/28 07:48:32 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2010/09/07 18:45:04 | 000,579,456 | ---- | M] (Line 6) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\L6TportK.sys -- (L6TportK)
DRV - [2010/05/20 15:27:26 | 001,961,328 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VX3000.sys -- (VX3000)
DRV - [2010/04/29 18:39:38 | 000,038,224 | ---- | M] (Malwarebytes Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\mbamswissarmy.sys -- (MBAMSwissArmy)
DRV - [2010/01/29 14:40:02 | 000,082,320 | ---- | M] (EZB Systems, Inc.) [File_System | System | Running] -- C:\Program Files\UltraISO\drivers\ISODrive.sys -- (ISODrive)
DRV - [2009/07/14 21:54:00 | 009,557,216 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2009/05/11 13:12:49 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2008/12/26 12:56:04 | 000,017,792 | ---- | M] (Avnex) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\vcsvad.sys -- (VCSVADHWSer) Avnex Virtual Audio Device (WDM)
DRV - [2008/01/20 22:23:25 | 000,251,904 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\VSTBS23.SYS -- (VSTHWBS2)
DRV - [2007/05/31 19:39:48 | 000,124,800 | ---- | M] (Avid Technology, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\mausbpr.sys -- (MAUSBML) Service for M-Audio Producer USB (WDM)
DRV - [2006/11/02 03:30:56 | 000,429,056 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvm60x32.sys -- (NVENETFD)
DRV - [2006/09/29 12:05:40 | 000,029,312 | ---- | M] (Line 6) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\l6dp.sys -- (L6DP)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:63919

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: [email protected]:0.1.2008d
FF - prefs.js..extensions.enabledItems: [email protected]:1.0
FF - prefs.js..extensions.enabledItems: [email protected]:0.1
FF - prefs.js..extensions.enabledItems: [email protected]:2.0.0
FF - prefs.js..extensions.enabledItems: [email protected]:0.9
FF - prefs.js..extensions.enabledItems: [email protected]:1.1
FF - prefs.js..extensions.enabledItems: [email protected]:1.5

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@canon.com/EPPEX: C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/GoogleTalkPlugin: C:\Users\NPIc\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/O3DPlugin: C:\Users\NPIc\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll ()
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\NPIc\AppData\Local\Google\Update\1.3.21.57\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\NPIc\AppData\Local\Google\Update\1.3.21.57\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.9\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/03/23 17:42:02 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.9\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/03/23 17:42:02 | 000,000,000 | ---D | M]

[2010/08/17 05:18:32 | 000,000,000 | ---D | M] (No name found) -- C:\Users\NPIc\AppData\Roaming\Mozilla\Extensions
[2010/08/17 05:18:32 | 000,000,000 | ---D | M] (No name found) -- C:\Users\NPIc\AppData\Roaming\Mozilla\Extensions\[email protected]
[2011/07/08 03:01:38 | 000,000,000 | ---D | M] (No name found) -- C:\Users\NPIc\AppData\Roaming\Mozilla\Firefox\Profiles\hcxy71dl.default\extensions
[2011/07/07 19:53:16 | 000,000,000 | ---D | M] (Screengrab) -- C:\Users\NPIc\AppData\Roaming\Mozilla\Firefox\Profiles\hcxy71dl.default\extensions\{02450954-cdd9-410f-b1da-db804e18c671}
[2010/06/12 04:23:34 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\NPIc\AppData\Roaming\Mozilla\Firefox\Profiles\hcxy71dl.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/07/07 16:07:14 | 000,000,000 | ---D | M] (Ad blocker) -- C:\Users\NPIc\AppData\Roaming\Mozilla\Firefox\Profiles\hcxy71dl.default\extensions\{4DC70064-89E2-4a55-8FC6-E8CDEAE3612C}
[2011/07/07 16:09:19 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Users\NPIc\AppData\Roaming\Mozilla\Firefox\Profiles\hcxy71dl.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2011/07/08 03:01:38 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2010/05/09 20:27:24 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2010/09/15 16:18:46 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/09/16 16:52:36 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010/08/17 05:14:13 | 000,000,000 | ---D | M] (Timezone Definitions for Mozilla Calendar) -- C:\PROGRAM FILES\CELTX\EXTENSIONS\[email protected]
[2010/08/17 05:14:13 | 000,000,000 | ---D | M] (Default Shot Palette) -- C:\PROGRAM FILES\CELTX\EXTENSIONS\[email protected]
[2010/08/17 05:14:13 | 000,000,000 | ---D | M] (MSN-Smileys) -- C:\PROGRAM FILES\CELTX\EXTENSIONS\[email protected]
[2010/08/17 05:14:13 | 000,000,000 | ---D | M] (DOM Inspector) -- C:\PROGRAM FILES\CELTX\EXTENSIONS\[email protected]
[2010/08/17 05:14:12 | 000,000,000 | ---D | M] (Blackened) -- C:\PROGRAM FILES\CELTX\EXTENSIONS\[email protected]
[2010/08/17 05:14:12 | 000,000,000 | ---D | M] (Depth) -- C:\PROGRAM FILES\CELTX\EXTENSIONS\[email protected]
[2010/08/17 05:14:12 | 000,000,000 | ---D | M] (Minimal) -- C:\PROGRAM FILES\CELTX\EXTENSIONS\[email protected]
[2010/07/17 05:00:04 | 000,423,656 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll

O1 HOSTS File: ([2010/05/12 17:51:03 | 000,000,791 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O1 - Hosts: 127.0.0.1 activate.adobe.com
O2 - BHO: (ContributeBHO Class) - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files\Adobe\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.)
O2 - BHO: (ZeonIEEventHelper Class) - {DA986D7D-CCAF-47B2-84FE-BFA1549BEBF9} - C:\Program Files\Nuance\PDF Create 5\bin\ZeonIEFavClient.dll (Zeon Corporation)
O3 - HKLM\..\Toolbar: (Contribute Toolbar) - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.)
O3 - HKLM\..\Toolbar: (Nuance PDF) - {E3286BF1-E654-42FF-B4A6-5E111731DF6B} - C:\Program Files\Nuance\PDF Create 5\bin\ZeonIEFavClient.dll (Zeon Corporation)
O4 - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4 - HKLM..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.)
O4 - HKLM..\Run: [conhost] C:\Users\NPIc\AppData\Roaming\Microsoft\conhost.exe (Embed Extol)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [LifeCam] C:\Program Files\Microsoft LifeCam\LifeExp.exe (Microsoft Corporation)
O4 - HKLM..\Run: [M-Audio Taskbar Icon] C:\Windows\System32\M-AudioTaskBarIcon.exe (Avid Technology, Inc.)
O4 - HKLM..\Run: [Nuance OmniPage 17-reminder] C:\Program Files\Nuance\OmniPage17\Ereg\Ereg.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [PDF5 Registry Controller] C:\Program Files\Nuance\PDF Create 5\RegistryController.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [PDFHook] C:\Program Files\Nuance\PDF Create 5\PdfCreate5Hook.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [VX3000] C:\Windows\vVX3000.exe (Microsoft Corporation)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [AdobeBridge] File not found
O4 - HKCU..\Run: [OpAgent] File not found
F3 - HKCU WinNT: Load - (C:\Users\NPIc\AppData\Local\Temp\csrss.exe) - C:\Users\NPIc\AppData\Local\Temp\csrss.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O8 - Extra context menu item: Append the content of the link to existing PDF file - C:\Program Files\Nuance\PDF Create 5\Bin\ZeonIEFavClient.dll (Zeon Corporation)
O8 - Extra context menu item: Append the content of the selected links to existing PDF file - C:\Program Files\Nuance\PDF Create 5\Bin\ZeonIEFavClient.dll (Zeon Corporation)
O8 - Extra context menu item: Append to existing PDF file - C:\Program Files\Nuance\PDF Create 5\Bin\ZeonIEFavClient.dll (Zeon Corporation)
O8 - Extra context menu item: Create PDF file - C:\Program Files\Nuance\PDF Create 5\Bin\ZeonIEFavClient.dll (Zeon Corporation)
O8 - Extra context menu item: Create PDF file from the content of the link - C:\Program Files\Nuance\PDF Create 5\Bin\ZeonIEFavClient.dll (Zeon Corporation)
O8 - Extra context menu item: Create PDF files from the selected links - C:\Program Files\Nuance\PDF Create 5\Bin\ZeonIEFavClient.dll (Zeon Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: line6.net ([]* in Trusted sites)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_21)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKCU Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKCU Winlogon: Shell - (C:\Users\NPIc\AppData\Roaming\dwm.exe) - C:\Users\NPIc\AppData\Roaming\dwm.exe ()
O24 - Desktop WallPaper: C:\Users\NPIc\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: C:\Users\NPIc\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 17:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\F\Shell - "" = AutoRun
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\Autoplay.exe -auto
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/07/08 15:47:43 | 000,579,584 | ---- | C] (OldTimer Tools) -- C:\Users\NPIc\Desktop\OTL.exe
[2011/07/08 15:30:47 | 000,000,000 | ---D | C] -- C:\_OTM
[2011/07/08 15:29:41 | 000,522,752 | ---- | C] (OldTimer Tools) -- C:\Users\NPIc\Desktop\OTM.exe
[2011/07/08 15:29:10 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2011/07/08 15:28:01 | 000,000,000 | ---D | C] -- C:\Users\NPIc\Desktop\erunt
[2011/07/02 23:04:31 | 000,000,000 | ---D | C] -- C:\Users\NPIc\AppData\Roaming\FrostWire
[2011/07/01 13:09:08 | 000,000,000 | ---D | C] -- C:\Users\NPIc\AppData\Roaming\Thunderbird
[2011/07/01 13:09:08 | 000,000,000 | ---D | C] -- C:\Users\NPIc\AppData\Local\Thunderbird
[2011/06/21 18:16:42 | 000,471,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2011/06/21 18:16:42 | 000,389,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\html.iec
[2011/06/21 18:16:42 | 000,193,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll
[2011/06/21 18:16:41 | 000,671,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mstime.dll
[2011/06/21 18:16:41 | 000,380,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dll
[2011/06/21 18:16:41 | 000,078,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieencode.dll
[2011/06/21 18:10:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Skype Extras
[2011/06/21 18:09:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2011/06/21 18:09:45 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype

========== Files - Modified Within 30 Days ==========

[2011/07/08 15:47:44 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Users\NPIc\Desktop\OTL.exe
[2011/07/08 15:44:30 | 000,003,712 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011/07/08 15:44:30 | 000,003,712 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011/07/08 15:42:15 | 000,000,000 | ---- | M] () -- C:\Users\NPIc\Desktop\hijackthis.exe
[2011/07/08 15:40:52 | 000,019,514 | ---- | M] () -- C:\Users\NPIc\AppData\Roaming\B49C.91C
[2011/07/08 15:39:50 | 000,604,264 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011/07/08 15:39:50 | 000,103,964 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011/07/08 15:37:00 | 000,000,904 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2818216045-4071373623-1326874018-1000UA.job
[2011/07/08 15:34:27 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011/07/08 15:29:42 | 000,522,752 | ---- | M] (OldTimer Tools) -- C:\Users\NPIc\Desktop\OTM.exe
[2011/07/08 09:37:00 | 000,000,852 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2818216045-4071373623-1326874018-1000Core.job
[2011/07/08 02:44:26 | 000,178,688 | ---- | M] () -- C:\Users\NPIc\AppData\Roaming\dwm.exe
[2011/07/08 01:03:30 | 004,833,894 | ---- | M] () -- C:\Users\NPIc\Desktop\tajsite.psd
[2011/07/08 00:18:43 | 000,798,248 | ---- | M] () -- C:\Users\NPIc\Desktop\tajsite.png
[2011/07/08 00:18:40 | 000,000,132 | ---- | M] () -- C:\Users\NPIc\AppData\Roaming\Adobe PNG Format CS5 Prefs
[2011/07/07 23:23:24 | 000,002,377 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk
[2011/07/07 20:01:00 | 003,611,616 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2011/07/07 19:58:56 | 001,346,389 | ---- | M] () -- C:\Users\NPIc\Desktop\tajlogo2.psd
[2011/07/07 19:55:42 | 000,023,083 | ---- | M] () -- C:\Users\NPIc\Desktop\164366_139623156094711_100001410814200_228888_2509936_n.jpg
[2011/07/07 19:39:47 | 000,236,451 | ---- | M] () -- C:\Users\NPIc\Desktop\youtube_background_template_2_by_xdarkxgirlx4everx-d2yw51k.jpg
[2011/07/07 19:31:23 | 000,008,449 | ---- | M] () -- C:\Users\NPIc\Desktop\TajYoutube.jpg
[2011/07/07 16:24:08 | 000,193,231 | ---- | M] () -- C:\Users\NPIc\Desktop\header.jpg
[2011/07/07 03:12:38 | 000,044,236 | ---- | M] () -- C:\Users\NPIc\Desktop\today.TTF
[2011/07/07 02:58:22 | 000,052,754 | ---- | M] () -- C:\Users\NPIc\Desktop\today.zip
[2011/07/07 01:56:41 | 001,054,074 | ---- | M] () -- C:\Users\NPIc\Desktop\MAJESTIKLOGO.psd
[2011/07/07 01:52:56 | 000,745,093 | ---- | M] () -- C:\Users\NPIc\Desktop\MAJESTIKLOGO.jpg
[2011/07/07 00:59:09 | 001,092,362 | ---- | M] () -- C:\Users\NPIc\Desktop\Untitled-1.eps
[2011/07/07 00:48:51 | 001,488,306 | ---- | M] () -- C:\Users\NPIc\Desktop\Untitled-1.ai
[2011/07/07 00:47:30 | 000,024,969 | ---- | M] () -- C:\Users\NPIc\Desktop\m [Converted].svg
[2011/07/07 00:43:35 | 000,000,132 | ---- | M] () -- C:\Users\NPIc\AppData\Roaming\Adobe IllExport Filter CS5 Prefs
[2011/07/06 19:59:56 | 000,029,956 | ---- | M] () -- C:\Users\NPIc\Desktop\glitter_font.zip
[2011/07/06 19:57:40 | 000,011,503 | ---- | M] () -- C:\Users\NPIc\Desktop\adrian_stars.zip
[2011/07/06 19:44:07 | 000,009,211 | ---- | M] () -- C:\Users\NPIc\Desktop\discoid.zip
[2011/07/06 19:09:54 | 000,628,934 | ---- | M] () -- C:\Users\NPIc\Desktop\tajtextlogo.png
[2011/07/06 17:32:52 | 001,884,612 | ---- | M] () -- C:\Users\NPIc\Desktop\tajtextlogo.psd
[2011/07/03 01:25:06 | 000,596,676 | ---- | M] () -- C:\Users\NPIc\Desktop\BECK.jpg
[2011/07/03 00:24:57 | 000,027,136 | ---- | M] () -- C:\Users\NPIc\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/06/28 07:48:32 | 000,138,192 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys
[2011/06/28 07:48:32 | 000,066,616 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys
[2011/06/28 00:22:35 | 000,011,409 | ---- | M] () -- C:\Users\NPIc\Desktop\rp2012.jpg
[2011/06/24 00:40:56 | 000,127,677 | ---- | M] () -- C:\Users\NPIc\Desktop\tywallpaper.jpg
[2011/06/22 22:01:10 | 000,194,944 | ---- | M] () -- C:\Users\NPIc\Desktop\AZZIE1.jpg
[2011/06/22 21:53:08 | 000,778,455 | ---- | M] () -- C:\Users\NPIc\Desktop\Archangel-Tyrael.jpg
[2011/06/21 19:10:37 | 2873,841,244 | ---- | M] () -- C:\Users\NPIc\Desktop\personal.zip

========== Files Created - No Company Name ==========

[2011/07/08 15:42:15 | 000,000,000 | ---- | C] () -- C:\Users\NPIc\Desktop\hijackthis.exe
[2011/07/08 02:44:26 | 000,178,688 | ---- | C] () -- C:\Users\NPIc\AppData\Roaming\dwm.exe
[2011/07/08 00:18:38 | 000,798,248 | ---- | C] () -- C:\Users\NPIc\Desktop\tajsite.png
[2011/07/07 19:55:41 | 000,023,083 | ---- | C] () -- C:\Users\NPIc\Desktop\164366_139623156094711_100001410814200_228888_2509936_n.jpg
[2011/07/07 19:39:47 | 000,236,451 | ---- | C] () -- C:\Users\NPIc\Desktop\youtube_background_template_2_by_xdarkxgirlx4everx-d2yw51k.jpg
[2011/07/07 19:31:23 | 000,008,449 | ---- | C] () -- C:\Users\NPIc\Desktop\TajYoutube.jpg
[2011/07/07 17:12:55 | 004,833,894 | ---- | C] () -- C:\Users\NPIc\Desktop\tajsite.psd
[2011/07/07 16:24:08 | 000,193,231 | ---- | C] () -- C:\Users\NPIc\Desktop\header.jpg
[2011/07/07 16:06:18 | 000,019,514 | ---- | C] () -- C:\Users\NPIc\AppData\Roaming\B49C.91C
[2011/07/07 03:38:54 | 001,346,389 | ---- | C] () -- C:\Users\NPIc\Desktop\tajlogo2.psd
[2011/07/07 02:58:22 | 000,052,754 | ---- | C] () -- C:\Users\NPIc\Desktop\today.zip
[2011/07/07 01:52:52 | 000,745,093 | ---- | C] () -- C:\Users\NPIc\Desktop\MAJESTIKLOGO.jpg
[2011/07/07 01:48:36 | 001,054,074 | ---- | C] () -- C:\Users\NPIc\Desktop\MAJESTIKLOGO.psd
[2011/07/07 00:58:58 | 001,092,362 | ---- | C] () -- C:\Users\NPIc\Desktop\Untitled-1.eps
[2011/07/07 00:47:22 | 000,024,969 | ---- | C] () -- C:\Users\NPIc\Desktop\m [Converted].svg
[2011/07/07 00:43:41 | 001,488,306 | ---- | C] () -- C:\Users\NPIc\Desktop\Untitled-1.ai
[2011/07/06 19:59:56 | 000,029,956 | ---- | C] () -- C:\Users\NPIc\Desktop\glitter_font.zip
[2011/07/06 19:57:40 | 000,011,503 | ---- | C] () -- C:\Users\NPIc\Desktop\adrian_stars.zip
[2011/07/06 19:44:07 | 000,009,211 | ---- | C] () -- C:\Users\NPIc\Desktop\discoid.zip
[2011/07/06 19:09:50 | 000,628,934 | ---- | C] () -- C:\Users\NPIc\Desktop\tajtextlogo.png
[2011/07/06 10:54:23 | 001,884,612 | ---- | C] () -- C:\Users\NPIc\Desktop\tajtextlogo.psd
[2011/07/03 01:25:03 | 000,596,676 | ---- | C] () -- C:\Users\NPIc\Desktop\BECK.jpg
[2011/06/28 00:22:35 | 000,011,409 | ---- | C] () -- C:\Users\NPIc\Desktop\rp2012.jpg
[2011/06/24 00:40:52 | 000,127,677 | ---- | C] () -- C:\Users\NPIc\Desktop\tywallpaper.jpg
[2011/06/22 22:01:03 | 000,194,944 | ---- | C] () -- C:\Users\NPIc\Desktop\AZZIE1.jpg
[2011/06/22 21:53:08 | 000,778,455 | ---- | C] () -- C:\Users\NPIc\Desktop\Archangel-Tyrael.jpg
[2011/06/21 18:45:43 | 2873,841,244 | ---- | C] () -- C:\Users\NPIc\Desktop\personal.zip
[2011/06/21 18:09:45 | 000,002,377 | ---- | C] () -- C:\Users\Public\Desktop\Skype.lnk
[2011/01/03 18:17:08 | 000,000,600 | ---- | C] () -- C:\Users\NPIc\AppData\Local\PUTTY.RND
[2010/12/18 01:45:39 | 000,000,132 | ---- | C] () -- C:\Users\NPIc\AppData\Roaming\Adobe BMP Format CS5 Prefs
[2010/09/28 02:46:02 | 000,000,680 | ---- | C] () -- C:\Users\NPIc\AppData\Local\d3d9caps.dat
[2010/08/27 05:50:35 | 000,000,258 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2010/08/27 05:49:31 | 000,000,391 | ---- | C] () -- C:\Windows\MAXLINK.INI
[2010/08/19 19:52:35 | 000,000,132 | ---- | C] () -- C:\Users\NPIc\AppData\Roaming\Adobe IllExport Filter CS5 Prefs
[2010/07/31 17:51:42 | 000,000,352 | ---- | C] () -- C:\Windows\GearBox.ini
[2010/05/19 23:15:50 | 000,027,136 | ---- | C] () -- C:\Users\NPIc\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/05/16 08:31:58 | 000,000,132 | ---- | C] () -- C:\Users\NPIc\AppData\Roaming\Adobe PNG Format CS5 Prefs
[2010/05/13 18:18:41 | 000,000,056 | -H-- | C] () -- C:\Windows\System32\ezsidmv.dat
[2010/05/13 00:48:15 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2010/05/13 00:48:15 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2010/05/09 06:05:58 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2009/08/03 15:07:42 | 000,403,816 | ---- | C] () -- C:\Windows\System32\OGACheckControl.dll
[2009/08/03 15:07:42 | 000,230,768 | ---- | C] () -- C:\Windows\System32\OGAEXEC.exe
[2009/06/26 17:21:02 | 000,015,498 | ---- | C] () -- C:\Windows\VX3000.ini
[2006/11/02 08:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006/11/02 08:47:37 | 003,611,616 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006/11/02 08:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006/11/02 06:33:01 | 000,604,264 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006/11/02 06:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006/11/02 06:33:01 | 000,103,964 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006/11/02 06:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006/11/02 06:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006/11/02 04:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006/11/02 04:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006/11/02 03:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006/11/02 03:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat

========== Files - Unicode (All) ==========
[2011/07/07 19:57:46 | 000,590,180 | ---- | M] ()(C:\Users\NPIc\Desktop\YouTube - ?connectedthefilm's Channel??_1310083061005.png) -- C:\Users\NPIc\Desktop\YouTube - connectedthefilm's Channel‏_1310083061005.png
[2011/07/07 19:57:45 | 000,590,180 | ---- | C] ()(C:\Users\NPIc\Desktop\YouTube - ?connectedthefilm's Channel??_1310083061005.png) -- C:\Users\NPIc\Desktop\YouTube - connectedthefilm's Channel‏_1310083061005.png

========== Alternate Data Streams ==========

@Alternate Data Stream - 135 bytes -> C:\ProgramData\TEMP:9B013599
@Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:FED912DB

< End of report >





^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^


OTL Extras logfile created on: 7/8/2011 3:48:12 PM - Run 1
OTL by OldTimer - Version 3.2.26.1 Folder = C:\Users\NPIc\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.87 Gb Total Physical Memory | 1.95 Gb Available Physical Memory | 68.00% Memory free
7.12 Gb Paging File | 6.19 Gb Available in Paging File | 86.96% Paging File free
Paging file location(s): c:\pagefile.sys 4411 4411 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 288.04 Gb Total Space | 160.40 Gb Free Space | 55.69% Space Free | Partition Type: NTFS
Drive D: | 10.00 Gb Total Space | 4.94 Gb Free Space | 49.37% Space Free | Partition Type: NTFS

Computer Name: OFFICE | User Name: NPIc | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Bridge] -- C:\Program Files\Adobe\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

========== Authorized Applications List ==========


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{00F3EC64-56B0-4908-AE71-8520540D9638}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{01A22D0C-2F67-4BE5-93B6-2A0B71F4E54C}" = protocol=6 | dir=in | app=c:\program files\microsoft lifecam\lifetray.exe |
"{0AF516EF-F0B1-4F08-9AD4-F21809A7E069}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{14C660DD-43D0-4FE1-9A3B-1CA8DECF7888}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{16587704-ED5D-4AD3-B479-05A073D5ED3F}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{18943B7C-5C7E-4A9F-9C1B-FF0A40B7A1E7}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{1B8A1B3A-F277-4954-B74A-4C2BEA043D96}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{22834A4B-4A4E-407B-9D8E-EBFC353EDD8B}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{2302DB40-0A38-4433-8DCD-1BC29CB2326E}" = protocol=17 | dir=in | app=c:\program files\microsoft lifecam\lifeexp.exe |
"{23324C11-A623-4EB1-B799-46F5FC41A813}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{277895D1-C4DC-491B-ACEC-19DD18DA7BB3}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{2E9E5346-C6BB-45C6-929A-B7EFF80BEF9C}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{31DB24AC-0D06-4F75-9A2E-5C0771E5554C}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{34010048-C25F-42D9-8899-405823D0FEB2}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{3419A23E-812B-4413-B404-1FCB58544DEF}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{3720E974-4334-4095-8CD6-6DBC031E0093}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{391F1EF1-8BD3-4FD8-89BF-F2DB057E87C7}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{41083195-2ABA-4A61-9ECE-507872B7EDC1}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{446B6A13-63B7-4011-BF36-63922DC521E8}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{44CA6C2D-8B5E-45C2-8B07-850D1F5D587F}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{4C2FECD0-1BAB-4CA8-944B-9988B13ED9E2}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{4DC9708B-DA08-4E49-A4BC-3F0ADC3203BC}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{4E4DEC5F-6C95-45B6-A422-47888993AD10}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{5141F31F-BC28-481C-8302-406C952E02A1}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{53060CD5-793C-404F-8087-B5BDC0746E12}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{53273A24-438B-45F6-B2BC-06320BAEF4E3}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{572E1377-6CB8-4623-BCE5-AB462607E99B}" = protocol=17 | dir=in | app=c:\program files\microsoft lifecam\lifeenc2.exe |
"{57EAC4BF-C902-4CDA-95E6-7EBA0771B637}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{5CDFE039-9F5E-4472-9B78-989D2526B59A}" = protocol=6 | dir=in | app=c:\program files\microsoft lifecam\lifeexp.exe |
"{5D5BC212-99A3-4E8C-BF71-0E14A98028F2}" = protocol=6 | dir=in | app=c:\program files\tightvnc\vncviewer.exe |
"{6418579A-469E-40CE-BC3B-B862FC9B38F2}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{64E4C83F-C80D-4C88-BB1C-C475B646F900}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{65BFF0C3-50E9-45BF-9B86-DD19F175650F}" = protocol=6 | dir=in | app=c:\users\npic\appdata\local\google\google talk plugin\googletalkplugin.exe |
"{6B112725-DE59-414D-996F-BC64A0C75028}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{73DF2292-8C16-4DB2-B8FB-D866ACA620B1}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{79B139A9-9C8A-43BF-8900-D0074E451952}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{7A556368-C093-4130-909C-E76BF29F69F4}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{7B7EA3F4-1948-4398-A076-3FD56E144278}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{7B930F08-3AFC-4E85-B5C4-FE3C2D664F03}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{7E2FFCB5-6FC7-402E-95C7-7C9F30624714}" = protocol=17 | dir=in | app=c:\users\npic\appdata\local\google\google talk plugin\googletalkplugin.exe |
"{7EE714CA-C6B6-49AC-8D7F-B486C980502A}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{80B7A3BC-1151-49C2-924F-512752D98554}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{81937AE3-357F-4226-9272-D41C844D7A89}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{83C1E396-A544-4BBA-8C4C-9249EDBE4A69}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{84571642-A5E3-41BD-8AA0-2BD0ECB09D2D}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{87491A60-F410-493D-8B46-140E7665C988}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{8822E093-B488-44FA-B330-E5F458517A00}" = protocol=6 | dir=in | app=c:\program files\microsoft lifecam\lifecam.exe |
"{8971E6BD-84A9-44CF-A986-685C96BAEC57}" = protocol=6 | dir=in | app=c:\program files\vuze\azureus.exe |
"{8A3694E6-3DC1-4363-9B5F-D86DCD6890AF}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{8C4DC4BB-F0A7-4CC6-AA8F-97E659DEA184}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{8CEAF119-0B4C-41E8-B251-863E807A9C23}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{8E87CEAE-5E0E-4C7F-83DC-7B4A93B578A5}" = protocol=17 | dir=in | app=c:\program files\tightvnc\vncviewer.exe |
"{9403D073-2A5D-4CBA-82EF-0B3355C2BCDA}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{98614849-16A9-4591-961C-009DE3B48120}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{9A22A4F8-7DA1-43A0-9FCE-C07B885E90C3}" = dir=in | app=c:\program files\skype\plugin manager\skypepm.exe |
"{A1416124-8471-4316-89FD-69F2FD093236}" = dir=in | app=c:\program files\itunes\itunes.exe |
"{A1B0DAA4-71E5-4C8E-AB40-D85A9E6506CF}" = protocol=17 | dir=in | app=c:\program files\vuze\azureus.exe |
"{A345247A-1E81-44DC-8074-99D7ED6DA1F0}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{B25CA1A3-E3D6-47CA-85D3-F87930E13144}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{B2C5CF31-E953-4DDD-82D9-7106907E4E21}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{BDB38BCE-2FB8-4AC8-9FFE-A229C7C42431}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{C0D6B1FF-2FAA-427F-A561-8FE5124598BA}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{C6512B68-2BAC-4FD2-9EA9-2B6CE4DF6D39}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{C92214C6-99FD-4BCD-AB4F-49CBB6090FA8}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{CA66972F-48AF-4418-A9D3-5FBFFB6ED552}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{CB170841-7948-4798-AD41-EAD19C840EED}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{DB369154-CF20-487F-A6AF-0E61F020FF45}" = protocol=6 | dir=in | app=c:\program files\frostwire\frostwire.exe |
"{E079F71A-6239-4681-8606-2DDBEB0E0F3A}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{E1BE0512-9509-4BDC-AF9E-F681FE3D124D}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{E78B04BF-ED1C-45C8-9737-06306CCF229E}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{E8A9B4DC-9A8F-4DF0-B65E-1CF909EA36A2}" = protocol=6 | dir=in | app=c:\program files\microsoft lifecam\lifeenc2.exe |
"{E8BE7714-8358-48DB-B753-9F80AEC9C8EE}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{EC04307D-35F8-4C4C-A2FD-F0E4A55AE036}" = protocol=17 | dir=in | app=c:\program files\frostwire\frostwire.exe |
"{EC9ED975-4D2E-4493-B2B9-27B2BD842D0E}" = protocol=17 | dir=in | app=c:\program files\microsoft lifecam\lifetray.exe |
"{EEB3FB36-3644-41B5-A5A2-A20FEB35DC9C}" = protocol=17 | dir=in | app=c:\program files\microsoft lifecam\lifecam.exe |
"{FD2AFEC3-6156-4FE2-AAF0-26415331DF25}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{FD931FE2-171F-4E1C-AB07-91A72384DB4E}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"TCP Query User{1EBFA00A-6CA7-43A0-AC0C-A0086B7067C5}C:\program files\java\jre6\bin\java.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\java.exe |
"TCP Query User{90BCE3DE-4095-48AD-BC63-621C38F32D49}C:\program files\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe |
"TCP Query User{C235E3F3-4071-4B0D-811F-1C0C66B7A6B5}C:\program files\bitlord\bitlord.exe" = protocol=6 | dir=in | app=c:\program files\bitlord\bitlord.exe |
"TCP Query User{EECAD633-28D0-4E5E-80D9-D730943771D3}C:\program files\adobe\adobe flash builder 4\flashbuilder.exe" = protocol=6 | dir=in | app=c:\program files\adobe\adobe flash builder 4\flashbuilder.exe |
"UDP Query User{3C73C45F-41A3-47BF-A500-406F2E401B24}C:\program files\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe |
"UDP Query User{AFA29C48-A3B5-40C8-BE66-962202D66187}C:\program files\adobe\adobe flash builder 4\flashbuilder.exe" = protocol=17 | dir=in | app=c:\program files\adobe\adobe flash builder 4\flashbuilder.exe |
"UDP Query User{B05FB408-9962-43CA-A516-F5122FF6B557}C:\program files\java\jre6\bin\java.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\java.exe |
"UDP Query User{FBA1C4B3-FB15-47F9-97C2-848B7FBEC2AC}C:\program files\bitlord\bitlord.exe" = protocol=17 | dir=in | app=c:\program files\bitlord\bitlord.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{024521CF-C07E-4F8E-8481-0D75695E03AF}" = PxMergeModule
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{068724F8-D8BE-4B43-8DDD-B9FE9E49FD76}" = Scansoft PDF Create
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0D2DBE8A-43D0-7830-7AE7-CA6C99A832E7}" = Adobe Community Help
"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP250_series" = Canon MP250 series MP Drivers
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java™ 6 Update 21
"{34AFE453-F544-4269-89C9-CAB7F0744963}" = Nuance OmniPage 17
"{353FE16B-30FE-469A-BF55-B978F4218003}" = iTunes
"{3B5B8C28-EFC6-444C-B984-DE5561A9926F}" = M-Audio Producer USB
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{503F62C9-99C2-376A-9B74-AB03E7CDB980}" = Google Talk Plugin
"{5335DADB-34BA-4AE8-A519-648D78498846}" = Skype™ 5.3
"{53C141BA-4F9E-43FB-B4F9-0C01BB716FA8}" = Adobe Audition 3.0
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{5FC7AB5C-61FC-42DF-A923-5139BCF10D42}" = Microsoft LifeCam
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{6E9EF98E-259E-416D-B5F8-0ABDB99942CE}" = Adobe Flash Player 10 ActiveX
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{851DE017-C00B-4A50-B413-4C05740AF56E}" = Nuance PDF Create! 5
"{853A4763-6643-4604-8D64-28BDD8925F4C}" = Apple Application Support
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{95120000-003F-0409-0000-0000000FF1CE}" = Microsoft Office Excel Viewer
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A78FE97A-C0C8-49CE-89D0-EDD524A17392}" = PDF Settings CS5
"{AC76BA86-7AD7-1033-7B44-A94000000001}" = Adobe Reader 9.4.3
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B3BC9DB1-0B0A-48B0-B86B-EA77CAA7F800}" = Microsoft Corporation
"{C2E4B5BD-32DB-4817-A060-341AB17C3F90}" = Bonjour
"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
"{CACAEB5F-174D-4C7C-AC56-A33289A807CA}" = Apple Mobile Device Support
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{DE3A9DC5-9A5D-6485-9662-347162C7E4CA}" = Adobe Media Player
"{FBB02B04-C034-4382-A3F6-57416E2752C4}" = Adobe Creative Suite 5 Master Collection
"Adobe AIR" = Adobe AIR
"Adobe Audition 3.0" = Adobe Audition 3.0
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"AMDAway INF" = AMDAway INF
"ASIO4ALL" = ASIO4ALL
"Audacity_is1" = Audacity 1.2.6
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"BitLord" = BitLord 1.1
"Canon MP250 series User Registration" = Canon MP250 series User Registration
"CanonMyPrinter" = Canon Utilities My Printer
"CanonSolutionMenu" = Canon Utilities Solution Menu
"Celtx (2.7)" = Celtx (2.7)
"Champions Online" = Champions Online
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player
"DivX Setup.divx.com" = DivX Setup
"Easy-PhotoPrint EX" = Canon Utilities Easy-PhotoPrint EX
"FileZilla Client" = FileZilla Client 3.3.4.1
"FL Studio 8" = FL Studio 8
"IL Download Manager" = IL Download Manager
"LAME for Audacity_is1" = LAME v3.98.3 for Audacity
"Line 6 Uninstaller" = Line 6 Uninstaller
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Mozilla Firefox (3.6.9)" = Mozilla Firefox (3.6.9)
"MP Navigator EX 3.0" = Canon MP Navigator EX 3.0
"Mumble" = Mumble and Murmur
"PoiZone" = PoiZone
"SumatraPDF" = SumatraPDF
"TightVNC" = TightVNC 2.0.2
"Toxic Biohazard" = Toxic Biohazard
"UltraISO_is1" = UltraISO Premium V9.36
"VLC media player" = VLC media player 1.1.7
"WinGimp-2.0_is1" = GIMP 2.6.8
"WinRAR archiver" = WinRAR archiver

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 6/29/2011 2:55:55 PM | Computer Name = Office | Source = WinMgmt | ID = 10
Description =

Error - 7/1/2011 1:40:46 PM | Computer Name = Office | Source = Windows Search Service | ID = 3013
Description =

Error - 7/1/2011 1:40:46 PM | Computer Name = Office | Source = Windows Search Service | ID = 3013
Description =

Error - 7/3/2011 12:50:59 AM | Computer Name = Office | Source = WinMgmt | ID = 10
Description =

Error - 7/5/2011 3:24:16 AM | Computer Name = Office | Source = Windows Search Service | ID = 3013
Description =

Error - 7/5/2011 12:56:41 PM | Computer Name = Office | Source = WinMgmt | ID = 10
Description =

Error - 7/7/2011 8:02:07 PM | Computer Name = Office | Source = WinMgmt | ID = 10
Description =

Error - 7/7/2011 11:18:07 PM | Computer Name = Office | Source = WinMgmt | ID = 10
Description =

Error - 7/8/2011 3:16:58 PM | Computer Name = Office | Source = WinMgmt | ID = 10
Description =

Error - 7/8/2011 3:36:07 PM | Computer Name = Office | Source = WinMgmt | ID = 10
Description =

[ System Events ]
Error - 9/23/2010 4:12:35 PM | Computer Name = Office | Source = Service Control Manager | ID = 7000
Description =

Error - 9/26/2010 3:53:11 PM | Computer Name = Office | Source = Service Control Manager | ID = 7000
Description =

Error - 10/8/2010 11:22:45 PM | Computer Name = Office | Source = Service Control Manager | ID = 7000
Description =

Error - 10/10/2010 4:49:27 PM | Computer Name = Office | Source = DCOM | ID = 10005
Description =

Error - 10/10/2010 4:49:27 PM | Computer Name = Office | Source = Service Control Manager | ID = 7009
Description =

Error - 10/10/2010 4:49:27 PM | Computer Name = Office | Source = Service Control Manager | ID = 7000
Description =

Error - 10/11/2010 6:50:47 PM | Computer Name = Office | Source = volmgr | ID = 262193
Description = Configuring the Page file for crash dump failed. Make sure there is
a page file on the boot partition and that is large enough to contain all physical
memory.

Error - 10/11/2010 6:50:47 PM | Computer Name = Office | Source = volmgr | ID = 262190
Description = Crash dump initialization failed!

Error - 10/11/2010 6:51:11 PM | Computer Name = Office | Source = EventLog | ID = 6008
Description = The previous system shutdown at 6:47:24 PM on 10/11/2010 was unexpected.

Error - 10/11/2010 6:52:30 PM | Computer Name = Office | Source = Service Control Manager | ID = 7000
Description =


< End of report >

[Advertisements]

Hi there two programmes to run initially

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  
  

  :OTL
  IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
  IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
  IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:63919
  O4 - HKLM..\Run: [conhost] C:\Users\NPIc\AppData\Roaming\Microsoft\conhost.exe (Embed Extol)
  F3 - HKCU WinNT: Load - (C:\Users\NPIc\AppData\Local\Temp\csrss.exe) - C:\Users\NPIc\AppData\Local\Temp\csrss.exe ()
  O20 - HKCU Winlogon: Shell - (C:\Users\NPIc\AppData\Roaming\dwm.exe) - C:\Users\NPIc\AppData\Roaming\dwm.exe ()
  [2011/07/08 15:40:52 | 000,019,514 | ---- | M] () -- C:\Users\NPIc\AppData\Roaming\B49C.91C
  [2011/07/08 02:44:26 | 000,178,688 | ---- | M] () -- C:\Users\NPIc\AppData\Roaming\dwm.exe
  
  :Files
  ipconfig /flushdns /c
  
  :Commands
  [purity]
  [resethosts]
  [emptytemp]
  [EMPTYFLASH]
  [CREATERESTOREPOINT]
  [Reboot]

• Then click the Run Fix button at the top
• Let the program run unhindered, reboot the PC when it is done
• Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

THEN

Download aswMBR.exe ( 1.8mb ) to your desktop.

Double click the aswMBR.exe to run it

Click the "Scan" button to start scan


On completion of the scan click save log, save it to your desktop and post in your next reply

[Essexboy]

Hi there two programmes to run initially

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  
  

  :OTL
  IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
  IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
  IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:63919
  O4 - HKLM..\Run: [conhost] C:\Users\NPIc\AppData\Roaming\Microsoft\conhost.exe (Embed Extol)
  F3 - HKCU WinNT: Load - (C:\Users\NPIc\AppData\Local\Temp\csrss.exe) - C:\Users\NPIc\AppData\Local\Temp\csrss.exe ()
  O20 - HKCU Winlogon: Shell - (C:\Users\NPIc\AppData\Roaming\dwm.exe) - C:\Users\NPIc\AppData\Roaming\dwm.exe ()
  [2011/07/08 15:40:52 | 000,019,514 | ---- | M] () -- C:\Users\NPIc\AppData\Roaming\B49C.91C
  [2011/07/08 02:44:26 | 000,178,688 | ---- | M] () -- C:\Users\NPIc\AppData\Roaming\dwm.exe
  
  :Files
  ipconfig /flushdns /c
  
  :Commands
  [purity]
  [resethosts]
  [emptytemp]
  [EMPTYFLASH]
  [CREATERESTOREPOINT]
  [Reboot]

• Then click the Run Fix button at the top
• Let the program run unhindered, reboot the PC when it is done
• Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

THEN

Download aswMBR.exe ( 1.8mb ) to your desktop.

Double click the aswMBR.exe to run it

Click the "Scan" button to start scan


On completion of the scan click save log, save it to your desktop and post in your next reply

[TheHx]

the OTL custom fixes step crashes me to blue screen. It does a memory dump for some reason. Did the same thing when I ran OTM as per the google hijack guide.

[Essexboy]

OK lets try a different approach

Download Combofix from any of the links below. You must rename it before saving rename it to Gotcha before saving it to your desktop.

Link 1
Link 2


==================================


Double click on the renamed ComboFix.exe & follow the prompts.

• When finished, it will produce a report for you.
• Please post the C:\ComboFix.txt so we can continue cleaning the system.

[TheHx]

ComboFix 11-07-09.02 - NPIc 07/09/2011 14:58:17.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.2942.1723 [GMT -4:00]
Running from: c:\users\NPIc\Desktop\Gotcha.exe
AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\NPIc\AppData\Roaming\dwm.exe
c:\users\NPIc\AppData\Roaming\Microsoft\conhost.exe
.
.
((((((((((((((((((((((((( Files Created from 2011-06-09 to 2011-07-09 )))))))))))))))))))))))))))))))
.
.
2011-07-09 19:03 . 2011-07-09 19:03 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-07-01 17:09 . 2011-07-01 17:09 -------- d-----w- c:\users\NPIc\AppData\Roaming\Thunderbird
2011-07-01 17:09 . 2011-07-01 17:09 -------- d-----w- c:\users\NPIc\AppData\Local\Thunderbird
2011-06-29 10:07 . 2011-04-29 15:59 276992 ----a-w- c:\windows\system32\schannel.dll
2011-06-21 22:10 . 2011-07-07 04:08 -------- d-----w- c:\programdata\Skype Extras
2011-06-21 22:09 . 2011-06-21 22:09 -------- d-----w- c:\program files\Common Files\Skype
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-06-28 11:48 . 2010-05-08 20:46 66616 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2011-06-28 11:48 . 2010-05-08 20:46 138192 ----a-w- c:\windows\system32\drivers\avipbb.sys
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-11-03 281768]
"M-Audio Taskbar Icon"="c:\windows\System32\M-AudioTaskBarIcon.exe" [2007-05-31 189440]
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208]
"AdobeCS5ServiceManager"="c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-02-22 406992]
"SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"VX3000"="c:\windows\vVX3000.exe" [2010-05-20 762736]
"LifeCam"="c:\program files\Microsoft LifeCam\LifeExp.exe" [2010-05-20 119152]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2009-07-27 1983816]
"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2009-03-18 767312]
"Nuance OmniPage 17-reminder"="c:\program files\Nuance\OmniPage17\Ereg\Ereg.exe" [2008-11-03 54560]
"PDFHook"="c:\program files\Nuance\PDF Create 5\pdfcreate5hook.exe" [2009-04-10 1277952]
"PDF5 Registry Controller"="c:\program files\Nuance\PDF Create 5\RegistryController.exe" [2008-12-13 58656]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-01-31 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-04-14 421160]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2011-03-21 1230704]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer9"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes Anti-Malware (reboot)]
2010-04-29 22:39 1090952 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbam.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2011-04-18 21:30 15146376 ----a-r- c:\program files\Skype\Phone\Skype.exe
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 L6TportK;Service - Line 6 TonePort KB37;c:\windows\system32\Drivers\L6TportK.sys [2010-09-07 579456]
R3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;c:\windows\system32\DRIVERS\ManyCam.sys [x]
R3 MAUSBML;Service for M-Audio Producer USB (WDM);c:\windows\system32\DRIVERS\mausbpr.sys [2007-05-31 124800]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2010-04-29 38224]
R3 SwitchBoard;Adobe SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2011-04-28 136360]
S2 MAudioProducerService;M-Audio Producer USB Installer;c:\program files\M-Audio\Producer USB\MAUSBProducerInst.exe [2007-05-07 81920]
S3 L6DP;L6DP;c:\windows\system32\Drivers\l6dp.sys [2006-09-29 29312]
S3 VCSVADHWSer;Avnex Virtual Audio Device (WDM);c:\windows\system32\DRIVERS\vcsvad.sys [2008-12-26 17792]
S3 VST_DPV;VST_DPV;c:\windows\system32\DRIVERS\VSTDPV3.SYS [2008-01-21 987648]
S3 VSTHWBS2;VSTHWBS2;c:\windows\system32\DRIVERS\VSTBS23.SYS [2008-01-21 251904]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder
.
2011-07-09 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2818216045-4071373623-1326874018-1000Core.job
- c:\users\NPIc\AppData\Local\Google\Update\GoogleUpdate.exe [2010-08-25 23:17]
.
2011-07-09 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2818216045-4071373623-1326874018-1000UA.job
- c:\users\NPIc\AppData\Local\Google\Update\GoogleUpdate.exe [2010-08-25 23:17]
.
.
------- Supplementary Scan -------
.
uInternet Settings,ProxyOverride = *.local
uInternet Settings,ProxyServer = http=127.0.0.1:63919
IE: Append the content of the link to existing PDF file - c:\program files\Nuance\PDF Create 5\Bin\ZeonIEFavClient.dll/ZeonIEAppend.HTML
IE: Append the content of the selected links to existing PDF file - c:\program files\Nuance\PDF Create 5\Bin\ZeonIEFavClient.dll/ZeonIEAppendSelLinks.HTML
IE: Append to existing PDF file - c:\program files\Nuance\PDF Create 5\Bin\ZeonIEFavClient.dll/ZeonIEAppend.HTML
IE: Create PDF file - c:\program files\Nuance\PDF Create 5\Bin\ZeonIEFavClient.dll/ZeonIECapture.HTML
IE: Create PDF file from the content of the link - c:\program files\Nuance\PDF Create 5\Bin\ZeonIEFavClient.dll/ZeonIECapture.HTML
IE: Create PDF files from the selected links - c:\program files\Nuance\PDF Create 5\Bin\ZeonIEFavClient.dll/ZeonIECaptureSelLinks.HTML
Trusted Zone: line6.net
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\NPIc\AppData\Roaming\Mozilla\Firefox\Profiles\hcxy71dl.default\
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Ad blocker: {4DC70064-89E2-4a55-8FC6-E8CDEAE3612C} - %profile%\extensions\{4DC70064-89E2-4a55-8FC6-E8CDEAE3612C}
FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
FF - Ext: Screengrab: {02450954-cdd9-410f-b1da-db804e18c671} - %profile%\extensions\{02450954-cdd9-410f-b1da-db804e18c671}
.
- - - - ORPHANS REMOVED - - - -
.
HKCU-Run-AdobeBridge - (no file)
HKCU-Run-OpAgent - OpAgent.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-07-09 15:03
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2011-07-09 15:04:42
ComboFix-quarantined-files.txt 2011-07-09 19:04
.
Pre-Run: 172,689,416,192 bytes free
Post-Run: 172,808,658,944 bytes free
.
- - End Of File - - 6029C7A80AFB4C5137B51E08CA0CBF85

[Essexboy]

Could you now retry OTL please as I will need to remove some remnants.

[TheHx]

with the previous commands?

[Essexboy]

Yes please

[TheHx]

wow it worked this time! Shall I continue with aswMBR.exe?



All processes killed
========== OTL ==========
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully!
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\conhost not found.
File C:\Users\NPIc\AppData\Roaming\Microsoft\conhost.exe not found.
File C:\Users\NPIc\AppData\Local\Temp\csrss.exe not found.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\Load not found.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell not found.
File C:\Users\NPIc\AppData\Roaming\dwm.exe not found.
C:\Users\NPIc\AppData\Roaming\B49C.91C moved successfully.
File C:\Users\NPIc\AppData\Roaming\dwm.exe not found.
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Users\NPIc\Desktop\cmd.bat deleted successfully.
C:\Users\NPIc\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Flash cache emptied: 41620 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: NPIc
->Temp folder emptied: 240966 bytes
->Temporary Internet Files folder emptied: 2186293 bytes
->Java cache emptied: 26442965 bytes
->FireFox cache emptied: 63151062 bytes
->Flash cache emptied: 104889 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 88.00 mb


[EMPTYFLASH]

User: All Users

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: NPIc
->Flash cache emptied: 0 bytes

User: Public

Total Flash Files Cleaned = 0.00 mb



OTL by OldTimer - Version 3.2.26.1 log created on 07092011_164550

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

Edited by TheHx, 09 July 2011 - 02:51 PM.

[Essexboy]

Yes please and could you run a fresh OTL log for me as that was the result of the fix I asked you to run first

[TheHx]

aswMBR version 0.9.7.705 Copyright© 2011 AVAST Software
Run date: 2011-07-09 16:57:38
-----------------------------
16:57:38.287 OS Version: Windows 6.0.6002 Service Pack 2
16:57:38.287 Number of processors: 2 586 0x6B02
16:57:38.287 ComputerName: OFFICE UserName: NPIc
16:57:38.958 Initialize success
16:58:17.630 AVAST engine defs: 11070900
16:58:50.640 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\0000004f
16:58:50.640 Disk 0 Vendor: WDC_WD32 01.0 Size: 305245MB BusType: 8
16:58:52.668 Disk 0 MBR read successfully
16:58:52.668 Disk 0 MBR scan
16:58:52.668 Disk 0 unknown MBR code
16:58:54.680 Disk 0 scanning sectors +625139712
16:58:54.696 Disk 0 scanning C:\Windows\system32\drivers
16:59:04.430 Service scanning
16:59:05.507 Disk 0 trace - called modules:
16:59:05.522 ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll storport.sys nvstor.sys
16:59:05.522 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x85b561f8]
16:59:05.522 3 CLASSPNP.SYS[89ba38b3] -> nt!IofCallDriver -> [0x84e40a60]
16:59:05.522 5 acpi.sys[806156bc] -> nt!IofCallDriver -> \Device\0000004f[0x84e44c90]
16:59:06.458 AVAST engine scan C:\Windows
18:06:07.530 AVAST engine scan C:\Users\NPIc
18:41:54.464 AVAST engine scan C:\ProgramData
18:50:46.892 Scan finished successfully
20:40:04.737 Disk 0 MBR has been saved successfully to "C:\Users\NPIc\Desktop\MBR.dat"
20:40:04.737 The log file has been saved successfully to "C:\Users\NPIc\Desktop\aswMBR.txt"


>>>>>>>>>>>>>>>>>>>>>>>>>>>



OTL logfile created on: 7/9/2011 8:41:38 PM - Run 2
OTL by OldTimer - Version 3.2.26.1 Folder = C:\Users\NPIc\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.87 Gb Total Physical Memory | 1.91 Gb Available Physical Memory | 66.60% Memory free
7.13 Gb Paging File | 6.03 Gb Available in Paging File | 84.51% Paging File free
Paging file location(s): c:\pagefile.sys 4411 4411 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 288.04 Gb Total Space | 160.84 Gb Free Space | 55.84% Space Free | Partition Type: NTFS
Drive D: | 10.00 Gb Total Space | 4.94 Gb Free Space | 49.37% Space Free | Partition Type: NTFS

Computer Name: OFFICE | User Name: NPIc | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/07/08 15:47:44 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Users\NPIc\Desktop\OTL.exe
PRC - [2011/06/28 07:48:31 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe
PRC - [2011/04/28 03:19:33 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe
PRC - [2011/03/21 14:56:16 | 001,230,704 | ---- | M] () -- C:\Program Files\DivX\DivX Update\DivXUpdate.exe
PRC - [2010/11/03 03:18:12 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
PRC - [2010/09/08 17:19:08 | 000,910,296 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2010/05/20 15:27:26 | 000,762,736 | ---- | M] (Microsoft Corporation) -- C:\Windows\vVX3000.exe
PRC - [2010/05/20 15:27:24 | 000,139,632 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft LifeCam\MSCamS32.exe
PRC - [2010/01/15 01:11:00 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
PRC - [2009/07/26 22:10:00 | 001,983,816 | ---- | M] (CANON INC.) -- C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
PRC - [2009/04/11 02:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009/04/10 09:52:40 | 001,277,952 | ---- | M] (Nuance Communications, Inc.) -- C:\Program Files\Nuance\PDF Create 5\PdfCreate5Hook.exe
PRC - [2007/05/31 19:42:30 | 000,189,440 | ---- | M] (Avid Technology, Inc.) -- C:\Windows\System32\M-AudioTaskBarIcon.exe
PRC - [2007/05/07 19:05:02 | 000,081,920 | ---- | M] (Avid Technology, Inc.) -- C:\Program Files\M-Audio\Producer USB\MAUSBProducerInst.exe


========== Modules (SafeList) ==========

MOD - [2011/07/08 15:47:44 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Users\NPIc\Desktop\OTL.exe
MOD - [2010/08/31 11:43:52 | 001,686,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll


========== Win32 Services (SafeList) ==========

SRV - [2011/06/28 07:48:31 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011/04/28 03:19:33 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2010/05/20 15:27:24 | 000,139,632 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft LifeCam\MSCamS32.exe -- (MSCamSvc)
SRV - [2010/02/19 16:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)
SRV - [2008/01/20 22:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007/05/07 19:05:02 | 000,081,920 | ---- | M] (Avid Technology, Inc.) [Auto | Running] -- C:\Program Files\M-Audio\Producer USB\MAUSBProducerInst.exe -- (MAudioProducerService)


========== Driver Services (SafeList) ==========

DRV - [2011/06/28 07:48:32 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2011/06/28 07:48:32 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2010/09/07 18:45:04 | 000,579,456 | ---- | M] (Line 6) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\L6TportK.sys -- (L6TportK)
DRV - [2010/05/20 15:27:26 | 001,961,328 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VX3000.sys -- (VX3000)
DRV - [2010/04/29 18:39:38 | 000,038,224 | ---- | M] (Malwarebytes Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\mbamswissarmy.sys -- (MBAMSwissArmy)
DRV - [2010/01/29 14:40:02 | 000,082,320 | ---- | M] (EZB Systems, Inc.) [File_System | System | Running] -- C:\Program Files\UltraISO\drivers\ISODrive.sys -- (ISODrive)
DRV - [2009/07/14 21:54:00 | 009,557,216 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2009/05/11 13:12:49 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2008/12/26 12:56:04 | 000,017,792 | ---- | M] (Avnex) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\vcsvad.sys -- (VCSVADHWSer) Avnex Virtual Audio Device (WDM)
DRV - [2008/01/20 22:23:25 | 000,251,904 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\VSTBS23.SYS -- (VSTHWBS2)
DRV - [2007/05/31 19:39:48 | 000,124,800 | ---- | M] (Avid Technology, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\mausbpr.sys -- (MAUSBML) Service for M-Audio Producer USB (WDM)
DRV - [2006/11/02 03:30:56 | 000,429,056 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvm60x32.sys -- (NVENETFD)
DRV - [2006/09/29 12:05:40 | 000,029,312 | ---- | M] (Line 6) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\l6dp.sys -- (L6DP)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: [email protected]:0.1.2008d
FF - prefs.js..extensions.enabledItems: [email protected]:1.0
FF - prefs.js..extensions.enabledItems: [email protected]:0.1
FF - prefs.js..extensions.enabledItems: [email protected]:2.0.0
FF - prefs.js..extensions.enabledItems: [email protected]:0.9
FF - prefs.js..extensions.enabledItems: [email protected]:1.1
FF - prefs.js..extensions.enabledItems: [email protected]:1.5

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@canon.com/EPPEX: C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/GoogleTalkPlugin: C:\Users\NPIc\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/O3DPlugin: C:\Users\NPIc\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll ()
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\NPIc\AppData\Local\Google\Update\1.3.21.57\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\NPIc\AppData\Local\Google\Update\1.3.21.57\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.9\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/03/23 17:42:02 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.9\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/03/23 17:42:02 | 000,000,000 | ---D | M]

[2010/08/17 05:18:32 | 000,000,000 | ---D | M] (No name found) -- C:\Users\NPIc\AppData\Roaming\Mozilla\Extensions
[2010/08/17 05:18:32 | 000,000,000 | ---D | M] (No name found) -- C:\Users\NPIc\AppData\Roaming\Mozilla\Extensions\[email protected]
[2011/07/09 16:57:48 | 000,000,000 | ---D | M] (No name found) -- C:\Users\NPIc\AppData\Roaming\Mozilla\Firefox\Profiles\hcxy71dl.default\extensions
[2011/07/07 19:53:16 | 000,000,000 | ---D | M] (Screengrab) -- C:\Users\NPIc\AppData\Roaming\Mozilla\Firefox\Profiles\hcxy71dl.default\extensions\{02450954-cdd9-410f-b1da-db804e18c671}
[2010/06/12 04:23:34 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\NPIc\AppData\Roaming\Mozilla\Firefox\Profiles\hcxy71dl.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/07/07 16:07:14 | 000,000,000 | ---D | M] (Ad blocker) -- C:\Users\NPIc\AppData\Roaming\Mozilla\Firefox\Profiles\hcxy71dl.default\extensions\{4DC70064-89E2-4a55-8FC6-E8CDEAE3612C}
[2011/07/07 16:09:19 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Users\NPIc\AppData\Roaming\Mozilla\Firefox\Profiles\hcxy71dl.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2011/07/09 16:57:48 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2010/05/09 20:27:24 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2010/09/15 16:18:46 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/09/16 16:52:36 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010/08/17 05:14:13 | 000,000,000 | ---D | M] (Timezone Definitions for Mozilla Calendar) -- C:\PROGRAM FILES\CELTX\EXTENSIONS\[email protected]
[2010/08/17 05:14:13 | 000,000,000 | ---D | M] (Default Shot Palette) -- C:\PROGRAM FILES\CELTX\EXTENSIONS\[email protected]
[2010/08/17 05:14:13 | 000,000,000 | ---D | M] (MSN-Smileys) -- C:\PROGRAM FILES\CELTX\EXTENSIONS\[email protected]
[2010/08/17 05:14:13 | 000,000,000 | ---D | M] (DOM Inspector) -- C:\PROGRAM FILES\CELTX\EXTENSIONS\[email protected]
[2010/08/17 05:14:12 | 000,000,000 | ---D | M] (Blackened) -- C:\PROGRAM FILES\CELTX\EXTENSIONS\[email protected]
[2010/08/17 05:14:12 | 000,000,000 | ---D | M] (Depth) -- C:\PROGRAM FILES\CELTX\EXTENSIONS\[email protected]
[2010/08/17 05:14:12 | 000,000,000 | ---D | M] (Minimal) -- C:\PROGRAM FILES\CELTX\EXTENSIONS\[email protected]
[2010/07/17 05:00:04 | 000,423,656 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll

O1 HOSTS File: ([2011/07/09 16:45:51 | 000,000,098 | ---- | M]) - C:\Windows\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (ContributeBHO Class) - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files\Adobe\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.)
O2 - BHO: (ZeonIEEventHelper Class) - {DA986D7D-CCAF-47B2-84FE-BFA1549BEBF9} - C:\Program Files\Nuance\PDF Create 5\bin\ZeonIEFavClient.dll (Zeon Corporation)
O3 - HKLM\..\Toolbar: (Contribute Toolbar) - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.)
O3 - HKLM\..\Toolbar: (Nuance PDF) - {E3286BF1-E654-42FF-B4A6-5E111731DF6B} - C:\Program Files\Nuance\PDF Create 5\bin\ZeonIEFavClient.dll (Zeon Corporation)
O4 - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4 - HKLM..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [LifeCam] C:\Program Files\Microsoft LifeCam\LifeExp.exe (Microsoft Corporation)
O4 - HKLM..\Run: [M-Audio Taskbar Icon] C:\Windows\System32\M-AudioTaskBarIcon.exe (Avid Technology, Inc.)
O4 - HKLM..\Run: [Nuance OmniPage 17-reminder] C:\Program Files\Nuance\OmniPage17\Ereg\Ereg.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [PDF5 Registry Controller] C:\Program Files\Nuance\PDF Create 5\RegistryController.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [PDFHook] C:\Program Files\Nuance\PDF Create 5\PdfCreate5Hook.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [VX3000] C:\Windows\vVX3000.exe (Microsoft Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Append the content of the link to existing PDF file - C:\Program Files\Nuance\PDF Create 5\Bin\ZeonIEFavClient.dll (Zeon Corporation)
O8 - Extra context menu item: Append the content of the selected links to existing PDF file - C:\Program Files\Nuance\PDF Create 5\Bin\ZeonIEFavClient.dll (Zeon Corporation)
O8 - Extra context menu item: Append to existing PDF file - C:\Program Files\Nuance\PDF Create 5\Bin\ZeonIEFavClient.dll (Zeon Corporation)
O8 - Extra context menu item: Create PDF file - C:\Program Files\Nuance\PDF Create 5\Bin\ZeonIEFavClient.dll (Zeon Corporation)
O8 - Extra context menu item: Create PDF file from the content of the link - C:\Program Files\Nuance\PDF Create 5\Bin\ZeonIEFavClient.dll (Zeon Corporation)
O8 - Extra context menu item: Create PDF files from the selected links - C:\Program Files\Nuance\PDF Create 5\Bin\ZeonIEFavClient.dll (Zeon Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKCU\..Trusted Domains: line6.net ([]* in Trusted sites)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_21)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\NPIc\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O24 - Desktop BackupWallPaper: C:\Users\NPIc\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 17:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/07/09 15:04:45 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2011/07/09 15:04:44 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2011/07/09 14:56:52 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2011/07/09 14:56:52 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2011/07/09 14:56:52 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2011/07/09 14:56:48 | 000,000,000 | ---D | C] -- C:\Gotcha21574G
[2011/07/09 14:56:34 | 000,000,000 | ---D | C] -- C:\Gotcha
[2011/07/09 14:54:21 | 000,000,000 | ---D | C] -- C:\Qoobox
[2011/07/09 14:53:50 | 004,138,458 | R--- | C] (Swearware) -- C:\Users\NPIc\Desktop\Gotcha.exe
[2011/07/08 19:34:31 | 000,000,000 | ---D | C] -- C:\Users\NPIc\AppData\Local\Apps
[2011/07/08 17:27:59 | 001,925,512 | ---- | C] (AVAST Software) -- C:\Users\NPIc\Desktop\aswMBR.exe
[2011/07/08 17:23:28 | 000,000,000 | ---D | C] -- C:\_OTL
[2011/07/08 15:47:43 | 000,579,584 | ---- | C] (OldTimer Tools) -- C:\Users\NPIc\Desktop\OTL.exe
[2011/07/08 15:30:47 | 000,000,000 | ---D | C] -- C:\_OTM
[2011/07/08 15:29:41 | 000,522,752 | ---- | C] (OldTimer Tools) -- C:\Users\NPIc\Desktop\OTM.exe
[2011/07/08 15:29:10 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2011/07/08 15:28:01 | 000,000,000 | ---D | C] -- C:\Users\NPIc\Desktop\erunt
[2011/07/01 13:09:08 | 000,000,000 | ---D | C] -- C:\Users\NPIc\AppData\Roaming\Thunderbird
[2011/07/01 13:09:08 | 000,000,000 | ---D | C] -- C:\Users\NPIc\AppData\Local\Thunderbird
[2011/06/21 18:10:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Skype Extras
[2011/06/21 18:09:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2011/06/21 18:09:45 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype

========== Files - Modified Within 30 Days ==========

[2011/07/09 20:40:04 | 000,000,512 | ---- | M] () -- C:\Users\NPIc\Desktop\MBR.dat
[2011/07/09 20:37:00 | 000,000,904 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2818216045-4071373623-1326874018-1000UA.job
[2011/07/09 18:47:10 | 000,003,712 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011/07/09 18:47:10 | 000,003,712 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011/07/09 16:52:59 | 000,604,264 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011/07/09 16:52:59 | 000,103,964 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011/07/09 16:47:09 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011/07/09 16:45:51 | 000,000,098 | ---- | M] () -- C:\Windows\System32\drivers\etc\Hosts
[2011/07/09 15:15:44 | 000,002,377 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk
[2011/07/09 14:53:51 | 004,138,458 | R--- | M] (Swearware) -- C:\Users\NPIc\Desktop\Gotcha.exe
[2011/07/09 09:37:00 | 000,000,852 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2818216045-4071373623-1326874018-1000Core.job
[2011/07/08 20:03:37 | 000,036,864 | ---- | M] () -- C:\Windows\System32\umstartup.etl
[2011/07/08 17:28:04 | 001,925,512 | ---- | M] (AVAST Software) -- C:\Users\NPIc\Desktop\aswMBR.exe
[2011/07/08 15:47:44 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Users\NPIc\Desktop\OTL.exe
[2011/07/08 15:42:15 | 000,000,000 | ---- | M] () -- C:\Users\NPIc\Desktop\hijackthis.exe
[2011/07/08 15:29:42 | 000,522,752 | ---- | M] (OldTimer Tools) -- C:\Users\NPIc\Desktop\OTM.exe
[2011/07/08 01:03:30 | 004,833,894 | ---- | M] () -- C:\Users\NPIc\Desktop\tajsite.psd
[2011/07/08 00:18:43 | 000,798,248 | ---- | M] () -- C:\Users\NPIc\Desktop\tajsite.png
[2011/07/08 00:18:40 | 000,000,132 | ---- | M] () -- C:\Users\NPIc\AppData\Roaming\Adobe PNG Format CS5 Prefs
[2011/07/07 20:01:00 | 003,611,616 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2011/07/07 19:58:56 | 001,346,389 | ---- | M] () -- C:\Users\NPIc\Desktop\tajlogo2.psd
[2011/07/07 19:55:42 | 000,023,083 | ---- | M] () -- C:\Users\NPIc\Desktop\164366_139623156094711_100001410814200_228888_2509936_n.jpg
[2011/07/07 19:39:47 | 000,236,451 | ---- | M] () -- C:\Users\NPIc\Desktop\youtube_background_template_2_by_xdarkxgirlx4everx-d2yw51k.jpg
[2011/07/07 19:31:23 | 000,008,449 | ---- | M] () -- C:\Users\NPIc\Desktop\TajYoutube.jpg
[2011/07/07 16:24:08 | 000,193,231 | ---- | M] () -- C:\Users\NPIc\Desktop\header.jpg
[2011/07/07 03:12:38 | 000,044,236 | ---- | M] () -- C:\Users\NPIc\Desktop\today.TTF
[2011/07/07 02:58:22 | 000,052,754 | ---- | M] () -- C:\Users\NPIc\Desktop\today.zip
[2011/07/07 01:56:41 | 001,054,074 | ---- | M] () -- C:\Users\NPIc\Desktop\MAJESTIKLOGO.psd
[2011/07/07 01:52:56 | 000,745,093 | ---- | M] () -- C:\Users\NPIc\Desktop\MAJESTIKLOGO.jpg
[2011/07/07 00:59:09 | 001,092,362 | ---- | M] () -- C:\Users\NPIc\Desktop\Untitled-1.eps
[2011/07/07 00:48:51 | 001,488,306 | ---- | M] () -- C:\Users\NPIc\Desktop\Untitled-1.ai
[2011/07/07 00:47:30 | 000,024,969 | ---- | M] () -- C:\Users\NPIc\Desktop\m [Converted].svg
[2011/07/07 00:43:35 | 000,000,132 | ---- | M] () -- C:\Users\NPIc\AppData\Roaming\Adobe IllExport Filter CS5 Prefs
[2011/07/06 19:59:56 | 000,029,956 | ---- | M] () -- C:\Users\NPIc\Desktop\glitter_font.zip
[2011/07/06 19:57:40 | 000,011,503 | ---- | M] () -- C:\Users\NPIc\Desktop\adrian_stars.zip
[2011/07/06 19:44:07 | 000,009,211 | ---- | M] () -- C:\Users\NPIc\Desktop\discoid.zip
[2011/07/06 19:09:54 | 000,628,934 | ---- | M] () -- C:\Users\NPIc\Desktop\tajtextlogo.png
[2011/07/06 17:32:52 | 001,884,612 | ---- | M] () -- C:\Users\NPIc\Desktop\tajtextlogo.psd
[2011/07/03 01:25:06 | 000,596,676 | ---- | M] () -- C:\Users\NPIc\Desktop\BECK.jpg
[2011/07/03 00:24:57 | 000,027,136 | ---- | M] () -- C:\Users\NPIc\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/06/28 07:48:32 | 000,138,192 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys
[2011/06/28 07:48:32 | 000,066,616 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys
[2011/06/28 00:22:35 | 000,011,409 | ---- | M] () -- C:\Users\NPIc\Desktop\rp2012.jpg
[2011/06/26 02:45:56 | 000,256,000 | ---- | M] () -- C:\Windows\PEV.exe
[2011/06/24 00:40:56 | 000,127,677 | ---- | M] () -- C:\Users\NPIc\Desktop\tywallpaper.jpg
[2011/06/22 22:01:10 | 000,194,944 | ---- | M] () -- C:\Users\NPIc\Desktop\AZZIE1.jpg
[2011/06/22 21:53:08 | 000,778,455 | ---- | M] () -- C:\Users\NPIc\Desktop\Archangel-Tyrael.jpg
[2011/06/21 19:10:37 | 2873,841,244 | ---- | M] () -- C:\Users\NPIc\Desktop\personal.zip

========== Files Created - No Company Name ==========

[2011/07/09 20:40:04 | 000,000,512 | ---- | C] () -- C:\Users\NPIc\Desktop\MBR.dat
[2011/07/09 14:56:52 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2011/07/09 14:56:52 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2011/07/09 14:56:52 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2011/07/09 14:56:52 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2011/07/09 14:56:52 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2011/07/08 15:42:15 | 000,000,000 | ---- | C] () -- C:\Users\NPIc\Desktop\hijackthis.exe
[2011/07/08 00:18:38 | 000,798,248 | ---- | C] () -- C:\Users\NPIc\Desktop\tajsite.png
[2011/07/07 19:55:41 | 000,023,083 | ---- | C] () -- C:\Users\NPIc\Desktop\164366_139623156094711_100001410814200_228888_2509936_n.jpg
[2011/07/07 19:39:47 | 000,236,451 | ---- | C] () -- C:\Users\NPIc\Desktop\youtube_background_template_2_by_xdarkxgirlx4everx-d2yw51k.jpg
[2011/07/07 19:31:23 | 000,008,449 | ---- | C] () -- C:\Users\NPIc\Desktop\TajYoutube.jpg
[2011/07/07 17:12:55 | 004,833,894 | ---- | C] () -- C:\Users\NPIc\Desktop\tajsite.psd
[2011/07/07 16:24:08 | 000,193,231 | ---- | C] () -- C:\Users\NPIc\Desktop\header.jpg
[2011/07/07 03:38:54 | 001,346,389 | ---- | C] () -- C:\Users\NPIc\Desktop\tajlogo2.psd
[2011/07/07 02:58:22 | 000,052,754 | ---- | C] () -- C:\Users\NPIc\Desktop\today.zip
[2011/07/07 01:52:52 | 000,745,093 | ---- | C] () -- C:\Users\NPIc\Desktop\MAJESTIKLOGO.jpg
[2011/07/07 01:48:36 | 001,054,074 | ---- | C] () -- C:\Users\NPIc\Desktop\MAJESTIKLOGO.psd
[2011/07/07 00:58:58 | 001,092,362 | ---- | C] () -- C:\Users\NPIc\Desktop\Untitled-1.eps
[2011/07/07 00:47:22 | 000,024,969 | ---- | C] () -- C:\Users\NPIc\Desktop\m [Converted].svg
[2011/07/07 00:43:41 | 001,488,306 | ---- | C] () -- C:\Users\NPIc\Desktop\Untitled-1.ai
[2011/07/06 19:59:56 | 000,029,956 | ---- | C] () -- C:\Users\NPIc\Desktop\glitter_font.zip
[2011/07/06 19:57:40 | 000,011,503 | ---- | C] () -- C:\Users\NPIc\Desktop\adrian_stars.zip
[2011/07/06 19:44:07 | 000,009,211 | ---- | C] () -- C:\Users\NPIc\Desktop\discoid.zip
[2011/07/06 19:09:50 | 000,628,934 | ---- | C] () -- C:\Users\NPIc\Desktop\tajtextlogo.png
[2011/07/06 10:54:23 | 001,884,612 | ---- | C] () -- C:\Users\NPIc\Desktop\tajtextlogo.psd
[2011/07/03 01:25:03 | 000,596,676 | ---- | C] () -- C:\Users\NPIc\Desktop\BECK.jpg
[2011/06/28 00:22:35 | 000,011,409 | ---- | C] () -- C:\Users\NPIc\Desktop\rp2012.jpg
[2011/06/24 00:40:52 | 000,127,677 | ---- | C] () -- C:\Users\NPIc\Desktop\tywallpaper.jpg
[2011/06/22 22:01:03 | 000,194,944 | ---- | C] () -- C:\Users\NPIc\Desktop\AZZIE1.jpg
[2011/06/22 21:53:08 | 000,778,455 | ---- | C] () -- C:\Users\NPIc\Desktop\Archangel-Tyrael.jpg
[2011/06/21 18:45:43 | 2873,841,244 | ---- | C] () -- C:\Users\NPIc\Desktop\personal.zip
[2011/06/21 18:09:45 | 000,002,377 | ---- | C] () -- C:\Users\Public\Desktop\Skype.lnk
[2011/01/03 18:17:08 | 000,000,600 | ---- | C] () -- C:\Users\NPIc\AppData\Local\PUTTY.RND
[2010/12/18 01:45:39 | 000,000,132 | ---- | C] () -- C:\Users\NPIc\AppData\Roaming\Adobe BMP Format CS5 Prefs
[2010/09/28 02:46:02 | 000,000,680 | ---- | C] () -- C:\Users\NPIc\AppData\Local\d3d9caps.dat
[2010/08/27 05:50:35 | 000,000,258 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2010/08/27 05:49:31 | 000,000,391 | ---- | C] () -- C:\Windows\MAXLINK.INI
[2010/08/19 19:52:35 | 000,000,132 | ---- | C] () -- C:\Users\NPIc\AppData\Roaming\Adobe IllExport Filter CS5 Prefs
[2010/07/31 17:51:42 | 000,000,352 | ---- | C] () -- C:\Windows\GearBox.ini
[2010/05/19 23:15:50 | 000,027,136 | ---- | C] () -- C:\Users\NPIc\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/05/16 08:31:58 | 000,000,132 | ---- | C] () -- C:\Users\NPIc\AppData\Roaming\Adobe PNG Format CS5 Prefs
[2010/05/13 18:18:41 | 000,000,056 | -H-- | C] () -- C:\Windows\System32\ezsidmv.dat
[2010/05/13 00:48:15 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2010/05/13 00:48:15 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2010/05/09 06:05:58 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2009/08/03 15:07:42 | 000,403,816 | ---- | C] () -- C:\Windows\System32\OGACheckControl.dll
[2009/08/03 15:07:42 | 000,230,768 | ---- | C] () -- C:\Windows\System32\OGAEXEC.exe
[2009/06/26 17:21:02 | 000,015,498 | ---- | C] () -- C:\Windows\VX3000.ini
[2006/11/02 08:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006/11/02 08:47:37 | 003,611,616 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006/11/02 08:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006/11/02 06:33:01 | 000,604,264 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006/11/02 06:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006/11/02 06:33:01 | 000,103,964 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006/11/02 06:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006/11/02 06:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006/11/02 04:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006/11/02 04:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006/11/02 03:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006/11/02 03:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat

========== LOP Check ==========

[2010/11/02 18:53:28 | 000,000,000 | ---D | M] -- C:\Users\NPIc\AppData\Roaming\Avnex
[2010/06/26 04:52:33 | 000,000,000 | ---D | M] -- C:\Users\NPIc\AppData\Roaming\Azureus
[2010/07/18 23:30:40 | 000,000,000 | ---D | M] -- C:\Users\NPIc\AppData\Roaming\Canon
[2010/07/10 00:47:10 | 000,000,000 | ---D | M] -- C:\Users\NPIc\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2010/09/22 17:45:42 | 000,000,000 | ---D | M] -- C:\Users\NPIc\AppData\Roaming\FileZilla
[2010/08/17 05:18:32 | 000,000,000 | ---D | M] -- C:\Users\NPIc\AppData\Roaming\Greyfirst
[2010/09/21 18:24:52 | 000,000,000 | ---D | M] -- C:\Users\NPIc\AppData\Roaming\gtk-2.0
[2010/07/31 17:45:42 | 000,000,000 | ---D | M] -- C:\Users\NPIc\AppData\Roaming\Line 6
[2010/05/21 19:42:25 | 000,000,000 | ---D | M] -- C:\Users\NPIc\AppData\Roaming\ManyCam
[2010/09/11 15:03:55 | 000,000,000 | ---D | M] -- C:\Users\NPIc\AppData\Roaming\Mumble
[2010/08/27 05:49:35 | 000,000,000 | ---D | M] -- C:\Users\NPIc\AppData\Roaming\Nuance
[2010/08/27 05:51:52 | 000,000,000 | ---D | M] -- C:\Users\NPIc\AppData\Roaming\ScanSoft
[2010/07/09 23:37:48 | 000,000,000 | ---D | M] -- C:\Users\NPIc\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
[2010/06/12 20:44:47 | 000,000,000 | ---D | M] -- C:\Users\NPIc\AppData\Roaming\SumatraPDF
[2011/07/01 13:09:08 | 000,000,000 | ---D | M] -- C:\Users\NPIc\AppData\Roaming\Thunderbird
[2010/12/17 21:30:36 | 000,000,000 | ---D | M] -- C:\Users\NPIc\AppData\Roaming\TightVNC
[2010/08/27 05:52:46 | 000,000,000 | ---D | M] -- C:\Users\NPIc\AppData\Roaming\Zeon
[2011/07/09 16:46:23 | 000,032,478 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Files - Unicode (All) ==========
[2011/07/07 19:57:46 | 000,590,180 | ---- | M] ()(C:\Users\NPIc\Desktop\YouTube - ?connectedthefilm's Channel??_1310083061005.png) -- C:\Users\NPIc\Desktop\YouTube - connectedthefilm's Channel‏_1310083061005.png
[2011/07/07 19:57:45 | 000,590,180 | ---- | C] ()(C:\Users\NPIc\Desktop\YouTube - ?connectedthefilm's Channel??_1310083061005.png) -- C:\Users\NPIc\Desktop\YouTube - connectedthefilm's Channel‏_1310083061005.png

========== Alternate Data Streams ==========

@Alternate Data Stream - 135 bytes -> C:\ProgramData\TEMP:9B013599
@Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:FED912DB

< End of report >

[Essexboy]

On completion of this next run could you check for redirects and let me know the result please

Please download Malwarebytes' Anti-Malware from Here.

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
• The scan may take some time to finish,so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected.
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy&Paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.

[TheHx]

no redirects that i can tell...

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4445

Windows 6.0.6002 Service Pack 2
Internet Explorer 7.0.6002.18005

7/10/2011 12:36:33 PM
mbam-log-2011-07-10 (12-36-33).txt

Scan type: Quick scan
Objects scanned: 128603
Time elapsed: 3 minute(s), 58 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

[Essexboy]

Subject to no further problems

I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems

Now the best part of the day ----- Your log now appears clean

A good workman always cleans up after himself so..The following will implement some cleanup procedures as well as reset System Restore points:

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  
  

  :Commands
  [resethosts]
  [purity]
  [emptytemp]
  [EMPTYFLASH]
  [Reboot]

• Then click the Run Fix button at the top
• Let the program run unhindered, reboot the PC when it is done

Run OTL and hit the cleanup button. It will remove all the programmes we have used plus itself.

We will now confirm that your hidden files are set to that, as some of the tools I use will change that

• Click Start.
• Open My Computer.
• Select the Tools menu and click Folder Options.
• Select the View Tab.
• Under the Hidden files and folders heading select Do not show hidden files and folders.
• Click Yes to confirm.
• Click OK.

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version of Java components and upgrade the application.

Upgrading Java:

• Go to this site and click Do I have Java
• It will check your current version and then offer to update to the latest version

SPRING CLEAN

To manually create a new Restore Point

• Go to Control Panel and select System
• Select System
• On the left select System Protection and accept the warning if you get one
• Select System Protection Tab
• Select Create at the bottom
• Type in a name i.e. Clean
• Select Create

Now we can purge the infected ones

• GoStart > All programs > Accessories > system tools
• Right click Disc cleanup an select run as administrator
• Select Your main drive and accept the warning if you get one
• For a few moments the system will make some calculations
• Select the More Options tab
• In the System Restore and Shadow Backups select Clean up
• Select Delete on the pop up
• Select OK
• Select Delete

Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:

Malwarebytes. Update and run weekly to keep your system clean

Download and install FileHippo update checker and run it monthly it will show you which programmes on your system need updating and give a download link

It is critical to have both a firewall and anti virus to protect your system and to keep them updated.

To keep your operating system up to date visit

• Microsoft Windows Update

To learn more about how to protect yourself while on the internet read our little guide How did I get infected in the first place ?
Keep safe

[Essexboy]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.