Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

All exe apps not found (including cmd.exe)

Started by boltboy , Jul 26 2011 02:45 PM

This topic is locked

#1
boltboy

Posted 26 July 2011 - 02:45 PM

New Member

Member
6 posts

Upon removing fake xp virus scanner, all executable files prompt an application error. I have to search for the appropriate file to run each application. Upon startup, I got the same thing for cmd.exe I have no idea how to fix this issue. Any help?

#2
Essexboy

Posted 26 July 2011 - 02:56 PM

GeekU Moderator

Retired Staff
69,964 posts

Hi could you run this for me, it is a scr extension and so should bypass that error, if you use Firefox then right click the link and select save as...

Download OTL to your Desktop

Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
Select All Users
Under the Custom Scan box paste this in

netsvcs
%SYSTEMDRIVE%\*.exe
%USERPROFILE%\..|smtmp;true;true;true /FP
/md5start
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
/md5stop
%systemroot%\*. /mp /s
hklm\software\clients\startmenuinternet|command /rs
hklm\software\clients\startmenuinternet|command /64 /rs
CREATERESTOREPOINT
Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Post both logs

#3
boltboy

Posted 27 July 2011 - 01:43 AM

New Member

Topic Starter
Member
6 posts

I ran the scan but the notepads didn't open. Once I closed the "open with" window, the desktop appeared along with all the icons and the OTL.txt notepad file. I'm a bit leery about posting all the contents of this notepad file as it looks like everybody & their uncle would then have access to my computer. The extras file didn't appear.

#4
Essexboy

Posted 27 July 2011 - 09:45 AM

GeekU Moderator

Retired Staff
69,964 posts

There is no real problem with the data on the log, but If you wish once I have looked at it I will remove it, but without the data I can go no further

#5
boltboy

Posted 27 July 2011 - 11:14 AM

New Member

Topic Starter
Member
6 posts

Good morning (my time)! Will you need the extras file?

#6
boltboy

Posted 27 July 2011 - 11:15 AM

New Member

Topic Starter
Member
6 posts

Here's the info:

OTL logfile created on: 7/26/2011 10:51:51 PM - Run 1
OTL by OldTimer - Version 3.2.26.1 Folder = C:\Documents and Settings\Owner\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.94 Gb Total Physical Memory | 1.40 Gb Available Physical Memory | 72.13% Memory free
3.79 Gb Paging File | 3.19 Gb Available in Paging File | 84.30% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 28.47 Gb Total Space | 6.43 Gb Free Space | 22.60% Space Free | Partition Type: FAT32
Drive J: | 465.76 Gb Total Space | 446.85 Gb Free Space | 95.94% Space Free | Partition Type: NTFS

Computer Name: GARAGE | User Name: Owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/07/26 22:49:40 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Owner\Desktop\OTL.scr
PRC - [2011/06/22 23:17:18 | 000,912,344 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2011/05/02 15:09:18 | 001,306,216 | ---- | M] (McAfee, Inc.) -- c:\Program Files\McAfee.com\Agent\mcagent.exe
PRC - [2011/03/13 11:45:14 | 000,148,520 | ---- | M] (McAfee, Inc.) -- C:\WINDOWS\system32\mfevtps.exe
PRC - [2011/03/13 11:41:50 | 000,159,832 | ---- | M] (McAfee, Inc.) -- C:\Program Files\Common Files\Mcafee\SystemCore\mfefire.exe
PRC - [2011/03/13 11:41:36 | 000,165,000 | ---- | M] (McAfee, Inc.) -- C:\Program Files\Common Files\Mcafee\SystemCore\mcshield.exe
PRC - [2011/01/27 18:28:14 | 000,214,904 | ---- | M] (McAfee, Inc.) -- C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
PRC - [2010/04/13 20:11:14 | 000,229,688 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee Online Backup\MOBKbackup.exe
PRC - [2010/01/16 13:30:16 | 000,185,640 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files\Qwest\Quickcare\bin\tgsrvc.exe
PRC - [2010/01/16 13:30:10 | 000,206,120 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files\Qwest\Quickcare\bin\sprtsvc.exe
PRC - [2008/11/09 12:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
PRC - [2008/04/13 17:12:20 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe

========== Modules (SafeList) ==========

MOD - [2011/07/26 22:49:40 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Owner\Desktop\OTL.scr
MOD - [2011/04/08 16:56:28 | 000,018,176 | ---- | M] (McAfee, Inc.) -- c:\Program Files\McAfee\SiteAdvisor\sahook.dll
MOD - [2008/04/13 16:12:52 | 001,054,208 | -H-- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll

========== Win32 Services (SafeList) ==========

SRV - File not found [Auto | Stopped] -- -- (QueryExplorer Service)
SRV - [2011/03/17 16:38:42 | 000,361,712 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files\McAfee\VirusScan\mcods.exe -- (McODS)
SRV - [2011/03/13 11:45:14 | 000,148,520 | ---- | M] (McAfee, Inc.) [Unknown | Running] -- C:\WINDOWS\system32\mfevtps.exe -- (mfevtp)
SRV - [2011/03/13 11:41:50 | 000,159,832 | ---- | M] () [Unknown | Running] -- C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe -- (mfefire)
SRV - [2011/03/13 11:41:36 | 000,165,000 | ---- | M] () [Unknown | Running] -- C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe -- (McShield)
SRV - [2011/01/27 18:28:14 | 000,214,904 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe -- (MSK80Service)
SRV - [2011/01/27 18:28:14 | 000,214,904 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe -- (McProxy)
SRV - [2011/01/27 18:28:14 | 000,214,904 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe -- (McNASvc)
SRV - [2011/01/27 18:28:14 | 000,214,904 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe -- (McNaiAnn)
SRV - [2011/01/27 18:28:14 | 000,214,904 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe -- (mcmscsvc)
SRV - [2011/01/27 18:28:14 | 000,214,904 | ---- | M] (McAfee, Inc.) [Unknown | Running] -- C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe -- (McMPFSvc)
SRV - [2011/01/27 18:28:14 | 000,214,904 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe -- (McAfee SiteAdvisor Service)
SRV - [2010/04/13 20:11:14 | 000,229,688 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\McAfee Online Backup\MOBKbackup.exe -- (MOBKbackup)
SRV - [2010/01/16 13:31:40 | 000,382,320 | ---- | M] (SupportSoft, Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\supportsoft\bin\ssrc.exe -- (SupportSoft RemoteAssist)
SRV - [2010/01/16 13:30:16 | 000,185,640 | ---- | M] (SupportSoft, Inc.) [Auto | Running] -- C:\Program Files\Qwest\Quickcare\bin\tgsrvc.exe -- (tgsrvc_quickcare) SupportSoft Repair Service (quickcare)
SRV - [2010/01/16 13:30:10 | 000,206,120 | ---- | M] (SupportSoft, Inc.) [Auto | Running] -- C:\Program Files\Qwest\Quickcare\bin\sprtsvc.exe -- (sprtsvc_quickcare) SupportSoft Sprocket Service (quickcare)
SRV - [2008/11/09 12:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) [Auto | Running] -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService)
SRV - [2006/02/02 19:11:22 | 000,495,616 | -H-- | M] ( ) [On_Demand | Stopped] -- C:\WINDOWS\System32\lxcrcoms.exe -- (lxcr_device)

========== Driver Services (SafeList) ==========

DRV - [2011/03/13 11:20:10 | 000,459,728 | ---- | M] (McAfee, Inc.) [Kernel | Unknown | Running] -- C:\WINDOWS\system32\drivers\mfehidk.sys -- (mfehidk)
DRV - [2011/03/13 11:20:10 | 000,337,912 | ---- | M] (McAfee, Inc.) [Kernel | Unknown | Running] -- C:\WINDOWS\system32\drivers\mfefirek.sys -- (mfefirek)
DRV - [2011/03/13 11:20:10 | 000,179,248 | ---- | M] (McAfee, Inc.) [Kernel | Unknown | Running] -- C:\WINDOWS\system32\drivers\mfeavfk.sys -- (mfeavfk)
DRV - [2011/03/13 11:20:10 | 000,118,784 | ---- | M] (McAfee, Inc.) [Kernel | Unknown | Running] -- C:\WINDOWS\system32\drivers\mfeapfk.sys -- (mfeapfk)
DRV - [2011/03/13 11:20:10 | 000,089,368 | ---- | M] (McAfee, Inc.) [Kernel | Unknown | Running] -- C:\WINDOWS\system32\drivers\mfetdi2k.sys -- (mfetdi2k)
DRV - [2011/03/13 11:20:10 | 000,085,984 | ---- | M] (McAfee, Inc.) [Kernel | Unknown | Stopped] -- C:\WINDOWS\system32\drivers\mferkdet.sys -- (mferkdet)
DRV - [2011/03/13 11:20:10 | 000,083,688 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mfendisk.sys -- (mfendiskmp)
DRV - [2011/03/13 11:20:10 | 000,083,688 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mfendisk.sys -- (mfendisk)
DRV - [2011/03/13 11:20:10 | 000,059,288 | ---- | M] (McAfee, Inc.) [Kernel | Unknown | Running] -- C:\WINDOWS\system32\drivers\mfebopk.sys -- (mfebopk)
DRV - [2011/03/13 11:20:10 | 000,057,432 | ---- | M] (McAfee, Inc.) [Kernel | Unknown | Running] -- C:\WINDOWS\system32\drivers\cfwids.sys -- (cfwids)
DRV - [2010/04/13 20:10:22 | 000,054,776 | ---- | M] (Mozy, Inc.) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\MOBK.sys -- (MOBKFilter)
DRV - [2008/04/13 11:56:50 | 000,012,800 | -H-- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\usb8023.sys -- (USB_RNDIS)
DRV - [2008/04/13 11:56:06 | 000,088,320 | -H-- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\nwlnkipx.sys -- (NwlnkIpx)
DRV - [2008/04/13 11:39:48 | 000,023,040 | -H-- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\mouclass.sy@ -- (Mouclass)
DRV - [2004/10/07 17:16:04 | 000,035,840 | -H-- | M] (Oak Technology Inc.) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\AFS2K.SYS -- (AFS2K)
DRV - [2004/10/01 10:24:02 | 002,279,424 | -H-- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS -- (ALCXWDM) Service for Realtek AC97 Audio (WDM)
DRV - [2003/12/12 07:54:14 | 000,391,424 | -H-- | M] (Sensaura Ltd) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ALCXSENS.SYS -- (ALCXSENS)
DRV - [2003/12/06 03:13:42 | 000,429,440 | -H-- | M] (Silicon Integrated Systems Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\sisgrp.sys -- (SiS315)
DRV - [2003/12/05 17:25:54 | 000,011,392 | -H-- | M] (Silicon Integrated Systems Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\srvkp.sys -- (SiSkp)
DRV - [2003/12/02 19:23:20 | 000,142,336 | -H-- | M] (Promise Technology, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\fasttx2k.sys -- (fasttx2k)
DRV - [2003/11/10 11:24:24 | 000,039,532 | -H-- | M] (Alcor Micro Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Sunkfilt.sys -- (SunkFilt)
DRV - [2003/09/19 01:47:00 | 000,010,368 | -H-- | M] (Padus, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\pfc.sys -- (Pfc)
DRV - [2003/09/03 00:51:00 | 000,021,120 | -H-- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\nv_agp.sys -- (nv_agp)
DRV - [2003/07/18 17:58:20 | 000,036,992 | -H-- | M] (Silicon Integrated Systems Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\SISAGPX.sys -- (SISAGP)
DRV - [2003/07/02 12:42:00 | 000,027,904 | -H-- | M] (VIA Technologies, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\viaagp1.sys -- (viaagp1)
DRV - [2003/07/02 00:33:00 | 000,652,497 | -H-- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ltmdmnt.sys -- (ltmodem5)
DRV - [2003/04/21 22:18:00 | 000,054,784 | -H-- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\NVENET.sys -- (NVENET)
DRV - [2002/10/04 18:04:10 | 000,046,976 | -H-- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\R8139n51.sys -- (rtl8139)
DRV - [2002/08/29 05:00:00 | 000,063,232 | -H-- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\nwlnknb.sys -- (NwlnkNb)
DRV - [2002/08/29 05:00:00 | 000,055,936 | -H-- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\nwlnkspx.sys -- (NwlnkSpx)
DRV - [2001/08/17 14:05:44 | 000,141,056 | -H-- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Icam3.sys -- (ICAM3NT5)
DRV - [2001/06/04 14:00:00 | 000,014,112 | -H-- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\PS2.sys -- (Ps2)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us10.hpwis.com/
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie

IE - HKU\.DEFAULT\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - Reg Error: Key error. File not found
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:50370

IE - HKU\S-1-5-18\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - Reg Error: Key error. File not found
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:50370

IE - HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-802894345-1523019152-2172162635-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
IE - HKU\S-1-5-21-802894345-1523019152-2172162635-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKU\S-1-5-21-802894345-1523019152-2172162635-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.searchqu.com/406
IE - HKU\S-1-5-21-802894345-1523019152-2172162635-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-802894345-1523019152-2172162635-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKU\S-1-5-21-802894345-1523019152-2172162635-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = BA F4 A9 B7 CF 38 CC 01 [binary data]
IE - HKU\S-1-5-21-802894345-1523019152-2172162635-1003\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKU\S-1-5-21-802894345-1523019152-2172162635-1003\..\URLSearchHook: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
IE - HKU\S-1-5-21-802894345-1523019152-2172162635-1003\..\URLSearchHook: {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTNavAssist.dll (Yahoo! Inc.)
IE - HKU\S-1-5-21-802894345-1523019152-2172162635-1003\..\URLSearchHook: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files\uTorrentBar\prxtbuTor.dll (Conduit Ltd.)
IE - HKU\S-1-5-21-802894345-1523019152-2172162635-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-802894345-1523019152-2172162635-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = localhost
IE - HKU\S-1-5-21-802894345-1523019152-2172162635-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:50370

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Secure Search"
FF - prefs.js..browser.search.order.1: "Yahoo"
FF - prefs.js..browser.search.order.2: ""
FF - prefs.js..browser.search.param.yahoo-fr: "w3i&type=W3i_DS,157,0_0,Search,20110521,6902,0,16,0"
FF - prefs.js..browser.search.selectedEngine: "Secure Search"
FF - prefs.js..browser.startup.homepage: "http://www.searchqu.com/406"
FF - prefs.js..extensions.enabledItems: [email protected]:1.0
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.3.5.20110120033202
FF - prefs.js..extensions.enabledItems: {B7082FAA-CB62-4872-9106-E42DD88EDE45}:3.3.1
FF - prefs.js..extensions.enabledItems: {1266764D-FC4F-4FA7-B63B-884D53B1680F}:3.6.5
FF - prefs.js..extensions.enabledItems: {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}:5.3.0.7280
FF - prefs.js..extensions.enabledItems: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}:3.5.0.12
FF - prefs.js..extensions.enabledItems: [email protected]:3.3.3.2
FF - prefs.js..keyword.URL: "http://dts.search-re...ystemid=406&q="
FF - prefs.js..network.proxy.http: "127.0.0.1"
FF - prefs.js..network.proxy.http_port: 50370
FF - prefs.js..network.proxy.no_proxies_on: "localhost"
FF - prefs.js..network.proxy.type: 0

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@mcafee.com/MSC,version=10: c:\progra~1\mcafee\msc\npmcsn~1.dll ()
FF - HKLM\Software\MozillaPlugins\@mcafee.com/MVT: C:\Program Files\McAfee\Supportability\MVT\npmvtplugin.dll (McAfee, Inc.)
FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.0.50401.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.10.835: C:\Program Files\Real\RealOne Player\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.2.1136: C:\Program Files\Real\RealOne Player\Netscape6\nprjplug.dll (RealNetworks)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.11.847: C:\Program Files\Real\RealOne Player\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.57\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.57\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{B7082FAA-CB62-4872-9106-E42DD88EDE45}: C:\Program Files\McAfee\SiteAdvisor [2011/05/17 16:02:06 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.18\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/05/11 18:21:32 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.18\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/05/11 18:21:32 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{1266764D-FC4F-4FA7-B63B-884D53B1680F}: C:\Documents and Settings\Owner\Application Data\NetAssistant\ [2011/05/17 16:39:38 | 000,000,000 | ---D | M]

[2011/05/11 18:23:22 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Extensions
[2011/05/11 18:23:22 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\aa6d9bes.default\extensions
[2011/05/17 16:39:16 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\aa6d9bes.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2011/07/06 22:16:22 | 000,000,000 | ---D | M] (uTorrentBar Community Toolbar) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\aa6d9bes.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}
[2011/07/06 22:16:34 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\aa6d9bes.default\extensions\[email protected]
[2011/07/06 21:54:00 | 000,002,501 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\aa6d9bes.default\searchplugins\SearchResults.xml
[2011/05/11 18:21:32 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2011/06/15 19:43:36 | 000,000,000 | ---D | M] (Skype extension) -- C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2011/05/17 16:39:38 | 000,000,000 | ---D | M] (Freeze.com NetAssistant) -- C:\DOCUMENTS AND SETTINGS\OWNER\APPLICATION DATA\NETASSISTANT
[2009/01/20 01:27:56 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2011/05/17 16:02:06 | 000,000,000 | ---D | M] (McAfee SiteAdvisor) -- C:\PROGRAM FILES\MCAFEE\SITEADVISOR
[2011/07/07 17:51:32 | 000,002,015 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\McSiteAdvisor.xml
[2011/07/06 21:54:00 | 000,002,501 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\SearchResults.xml

O1 HOSTS File: ([2011/05/17 15:21:38 | 000,000,912 | -H-- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\Mcafee\SystemCore\ScriptSn.20110517160132.dll (McAfee, Inc.)
O2 - BHO: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - File not found
O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O2 - BHO: (uTorrentBar Toolbar) - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files\uTorrentBar\prxtbuTor.dll (Conduit Ltd.)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (no name) - - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - !{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - No CLSID value found.
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - File not found
O3 - HKLM\..\Toolbar: (HP View) - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\hpdtlk02.dll (Hewlett-Packard Company)
O3 - HKLM\..\Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKU\S-1-5-21-802894345-1523019152-2172162635-1003\..\Toolbar\ShellBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKU\S-1-5-21-802894345-1523019152-2172162635-1003\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O3 - HKU\S-1-5-21-802894345-1523019152-2172162635-1003\..\Toolbar\ShellBrowser: (HP View) - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\hpdtlk02.dll (Hewlett-Packard Company)
O3 - HKU\S-1-5-21-802894345-1523019152-2172162635-1003\..\Toolbar\WebBrowser: (HP View) - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\hpdtlk02.dll (Hewlett-Packard Company)
O3 - HKU\S-1-5-21-802894345-1523019152-2172162635-1003\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O4 - HKLM..\Run: [LXCRCATS] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCRtime.DLL ()
O4 - HKLM..\Run: [mcui_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [QuickCare] C:\Program Files\Qwest\Quickcare\bin\sprtcmd.exe (SupportSoft, Inc.)
O4 - HKU\S-1-5-21-802894345-1523019152-2172162635-1003..\Run: [3031633076] C:\Documents and Settings\Owner\Local Settings\Application Data\ncf.exe ()
O4 - HKU\S-1-5-21-802894345-1523019152-2172162635-1003..\Run: [BackupNotify] c:\Program Files\HP\Digital Imaging\bin\BackupNotify.exe (Hewlett-Packard Company)
O4 - HKU\S-1-5-21-802894345-1523019152-2172162635-1003..\Run: [InstallIQUpdater] C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe (W3i, LLC)
O4 - HKU\S-1-5-21-802894345-1523019152-2172162635-1003..\Run: [Messenger (Yahoo!)] C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O4 - HKU\S-1-5-21-802894345-1523019152-2172162635-1003..\Run: [RecordNow!] File not found
O4 - HKU\S-1-5-21-802894345-1523019152-2172162635-1003..\Run: [uTorrent] C:\Program Files\uTorrent\uTorrent.exe (BitTorrent, Inc.)
O4 - HKLM..\RunOnce: [AvgUninstallURL] C:\WINDOWS\System32\cmd.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-802894345-1523019152-2172162635-1003..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\System32\Macromed\Flash\FlashUtil10p_Plugin.exe (Adobe Systems, Inc.)
O4 - Startup: C:\Documents and Settings\Owner\Start Menu\Programs\Startup\OpenOffice.org 3.0.lnk = File not found
F3 - HKU\S-1-5-21-802894345-1523019152-2172162635-1003 WinNT: Load - (C:\DOCUME~1\Owner\LOCALS~1\Temp\dwm.exe) - File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-802894345-1523019152-2172162635-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation)
O15 - HKU\S-1-5-21-802894345-1523019152-2172162635-1003\..Trusted Domains: //@install.mar@ ([]msni in My Computer)
O15 - HKU\S-1-5-21-802894345-1523019152-2172162635-1003\..Trusted Domains: //@mail.mar@ ([]msni in Local intranet)
O15 - HKU\S-1-5-21-802894345-1523019152-2172162635-1003\..Trusted Domains: internet ([]about in Trusted sites)
O15 - HKU\S-1-5-21-802894345-1523019152-2172162635-1003\..Trusted Domains: mcafee.com ([]http in Trusted sites)
O15 - HKU\S-1-5-21-802894345-1523019152-2172162635-1003\..Trusted Domains: mcafee.com ([]https in Trusted sites)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.m...ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.ad...Plus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1 205.171.3.25
O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Filter\application/x-mfe-ipt {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files\McAfee\MSC\McSnIePl.dll (McAfee, Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKU\S-1-5-21-802894345-1523019152-2172162635-1003 Winlogon: Shell - (explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKU\S-1-5-21-802894345-1523019152-2172162635-1003 Winlogon: Shell - (C:\Documents and Settings\Owner\Application Data\Microsoft\Windows\shell.exe) - File not found
O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
O21 - SSODL: SwUpdate - {003541A1-3BC0-1B1C-AAF3-040114001C01} - File not found
O24 - Desktop WallPaper: C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/01/20 18:16:38 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ FAT32 ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O35 - HKU\S-1-5-21-802894345-1523019152-2172162635-1003..exefile [open] -- "C:\Documents and Settings\Owner\Local Settings\Application Data\wcc.exe" -a "%1" %*
O36 - AppCertDlls: servuota - (C:\WINDOWS\system32\pentlman.dll) - File not found
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKU\S-1-5-21-802894345-1523019152-2172162635-1003\...exe [@ = exefile] -- "C:\Documents and Settings\Owner\Local Settings\Application Data\wcc.exe" -a "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: WmdmPmSp - File not found

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2011/07/26 22:49:27 | 000,579,584 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Owner\Desktop\OTL.scr
[2011/07/26 19:28:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\McAfee
[2011/07/06 22:39:22 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\AppData
[2011/07/06 22:39:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Application Data\searchquband
[2011/07/06 22:17:04 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Local Settings\Application Data\uTorrentBar
[2011/07/06 22:16:45 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Local Settings\Application Data\Conduit
[2011/07/06 22:16:13 | 000,000,000 | ---D | C] -- C:\Program Files\uTorrentBar
[2011/07/06 22:14:47 | 000,000,000 | ---D | C] -- C:\Program Files\uTorrent
[2011/07/06 22:13:32 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Application Data\uTorrent
[2011/07/06 22:12:23 | 000,399,736 | ---- | C] (BitTorrent, Inc.) -- C:\Documents and Settings\Owner\My Documents\uTorrent.exe
[2011/07/06 22:01:31 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Application Data\vlc
[2011/07/06 21:59:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Local Settings\Application Data\Ilivid Player
[2011/07/06 21:55:29 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\All Users\Application Data\{FDD8983C-4561-4A27-BDA7-F5286E176A8F}
[2011/07/06 21:55:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\iLivid
[2011/07/06 21:55:14 | 000,000,000 | ---D | C] -- C:\Program Files\iLivid
[2011/07/06 21:53:22 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Local Settings\Application Data\PackageAware
[2011/06/30 00:53:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Application Data\McAfee
[2006/02/02 19:24:32 | 001,183,744 | -H-- | C] ( ) -- C:\WINDOWS\System32\lxcrserv.dll
[2006/02/02 19:19:36 | 000,421,888 | -H-- | C] ( ) -- C:\WINDOWS\System32\lxcrcomm.dll
[2006/02/02 19:12:32 | 000,380,928 | -H-- | C] ( ) -- C:\WINDOWS\System32\lxcrih.exe
[2006/02/02 19:12:26 | 000,536,576 | -H-- | C] ( ) -- C:\WINDOWS\System32\lxcrlmpm.dll
[2006/02/02 19:11:30 | 000,114,688 | -H-- | C] ( ) -- C:\WINDOWS\System32\lxcrpplc.dll
[2006/02/02 19:11:22 | 000,495,616 | -H-- | C] ( ) -- C:\WINDOWS\System32\lxcrcoms.exe
[2006/02/02 19:10:48 | 000,610,304 | -H-- | C] ( ) -- C:\WINDOWS\System32\lxcrcomc.dll
[2006/02/02 19:10:18 | 000,163,840 | -H-- | C] ( ) -- C:\WINDOWS\System32\lxcrprox.dll
[2006/02/02 19:06:24 | 000,995,328 | -H-- | C] ( ) -- C:\WINDOWS\System32\lxcrusb1.dll
[2006/02/02 19:01:44 | 000,393,216 | -H-- | C] ( ) -- C:\WINDOWS\System32\lxcriesc.dll
[2006/02/02 18:59:12 | 000,409,600 | -H-- | C] ( ) -- C:\WINDOWS\System32\lxcrinpa.dll
[6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/07/26 22:49:40 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Owner\Desktop\OTL.scr
[2011/07/26 22:46:36 | 000,000,334 | ---- | M] () -- C:\WINDOWS\tasks\RegCure Program Check.job
[2011/07/26 22:03:02 | 000,000,886 | -H-- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/07/26 19:28:56 | 000,001,499 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\McAfee Total Protection.lnk
[2011/07/26 19:04:02 | 000,000,472 | -H-- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Daily 1).job
[2011/07/26 17:33:02 | 000,000,946 | -H-- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1935655697-113007714-839522115-1004Core1ca5a8a3b3dd498.job
[2011/07/26 16:03:02 | 000,000,882 | -H-- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/07/26 13:04:02 | 000,000,472 | -H-- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Daily 4).job
[2011/07/26 12:10:52 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011/07/26 12:10:50 | 2079,772,672 | -HS- | M] () -- C:\hiberfil.sys
[2011/07/26 07:04:08 | 000,000,472 | -H-- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Daily 3).job
[2011/07/26 01:04:02 | 000,000,472 | -H-- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Daily 2).job
[2011/07/25 19:04:02 | 000,000,472 | -H-- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2011/07/25 00:27:00 | 000,000,316 | ---- | M] () -- C:\WINDOWS\tasks\RegCure.job
[2011/07/14 22:46:26 | 000,001,158 | -H-- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011/07/10 17:13:22 | 000,006,386 | -HS- | M] () -- C:\Documents and Settings\Owner\Local Settings\Application Data\jbedil08g1kvem22e5qg66h4i3j0ea
[2011/07/10 17:13:22 | 000,006,386 | -HS- | M] () -- C:\Documents and Settings\All Users\Application Data\jbedil08g1kvem22e5qg66h4i3j0ea
[2011/07/10 07:54:38 | 000,000,245 | RHS- | M] () -- C:\BOOT.INI
[2011/07/10 03:09:40 | 007,367,852 | ---- | M] () -- C:\Documents and Settings\Owner\My Documents\10 - Skin.mp3
[2011/07/10 02:59:08 | 000,007,626 | -HS- | M] () -- C:\Documents and Settings\Owner\My Documents\Folder.jpg
[2011/07/10 02:59:08 | 000,007,626 | -HS- | M] () -- C:\Documents and Settings\Owner\My Documents\AlbumArt_{09A96546-3621-4EC9-A2BC-2B0C041777B0}_Large.jpg
[2011/07/10 02:59:08 | 000,002,334 | -HS- | M] () -- C:\Documents and Settings\Owner\My Documents\AlbumArtSmall.jpg
[2011/07/10 02:59:08 | 000,002,334 | -HS- | M] () -- C:\Documents and Settings\Owner\My Documents\AlbumArt_{09A96546-3621-4EC9-A2BC-2B0C041777B0}_Small.jpg
[2011/07/10 02:20:24 | 000,020,992 | ---- | M] () -- C:\Documents and Settings\Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/07/10 02:03:14 | 000,339,968 | ---- | M] () -- C:\Documents and Settings\Owner\Local Settings\Application Data\ncf.exe
[2011/07/06 22:20:42 | 000,158,197 | ---- | M] () -- C:\Documents and Settings\Owner\My Documents\payton.png
[2011/07/06 22:15:00 | 000,000,552 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\µTorrent.lnk
[2011/07/06 22:15:00 | 000,000,534 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\µTorrent.lnk
[2011/07/06 22:12:58 | 000,399,736 | ---- | M] (BitTorrent, Inc.) -- C:\Documents and Settings\Owner\My Documents\uTorrent.exe
[2011/07/03 16:33:58 | 000,000,491 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\Shortcut to J wmplayer.lnk
[2011/06/30 01:22:00 | 000,001,633 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk
[2011/06/30 00:54:00 | 000,001,675 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\McAfee Virtual Technician.lnk
[6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/07/26 07:08:57 | 000,001,499 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\McAfee Total Protection.lnk
[2011/07/10 02:59:07 | 000,007,626 | -HS- | C] () -- C:\Documents and Settings\Owner\My Documents\AlbumArt_{09A96546-3621-4EC9-A2BC-2B0C041777B0}_Large.jpg
[2011/07/10 02:59:07 | 000,002,334 | -HS- | C] () -- C:\Documents and Settings\Owner\My Documents\AlbumArt_{09A96546-3621-4EC9-A2BC-2B0C041777B0}_Small.jpg
[2011/07/10 02:03:15 | 000,006,386 | -HS- | C] () -- C:\Documents and Settings\Owner\Local Settings\Application Data\jbedil08g1kvem22e5qg66h4i3j0ea
[2011/07/10 02:03:15 | 000,006,386 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\jbedil08g1kvem22e5qg66h4i3j0ea
[2011/07/10 02:03:13 | 000,339,968 | ---- | C] () -- C:\Documents and Settings\Owner\Local Settings\Application Data\ncf.exe
[2011/07/06 22:25:15 | 000,007,626 | -HS- | C] () -- C:\Documents and Settings\Owner\My Documents\Folder.jpg
[2011/07/06 22:25:15 | 000,002,334 | -HS- | C] () -- C:\Documents and Settings\Owner\My Documents\AlbumArtSmall.jpg
[2011/07/06 22:23:20 | 007,367,852 | ---- | C] () -- C:\Documents and Settings\Owner\My Documents\10 - Skin.mp3
[2011/07/06 22:20:32 | 000,158,197 | ---- | C] () -- C:\Documents and Settings\Owner\My Documents\payton.png
[2011/07/06 22:14:58 | 000,000,552 | ---- | C] () -- C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\µTorrent.lnk
[2011/07/06 22:14:58 | 000,000,534 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\µTorrent.lnk
[2011/07/06 21:57:59 | 001,524,112 | ---- | C] () -- C:\WINDOWS\System32\bandoolmx.dll
[2011/06/30 00:53:59 | 000,001,675 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\McAfee Virtual Technician.lnk
[2011/06/30 00:53:40 | 000,001,679 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\McAfee Virtual Technician.lnk
[2011/06/15 20:23:39 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat
[2011/05/11 18:22:56 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2010/08/10 18:01:11 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010/02/19 02:29:01 | 000,233,472 | -H-- | C] () -- C:\WINDOWS\System32\LXCRinst.dll
[2010/02/12 13:33:24 | 000,000,054 | -H-- | C] () -- C:\WINDOWS\System32\rp_stats.dat
[2010/02/12 13:33:24 | 000,000,039 | -H-- | C] () -- C:\WINDOWS\System32\rp_rules.dat
[2010/02/01 12:00:17 | 000,020,992 | ---- | C] () -- C:\Documents and Settings\Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/02/01 11:55:07 | 000,000,552 | -H-- | C] () -- C:\WINDOWS\System32\d3d8caps.dat
[2010/01/31 13:47:13 | 000,303,104 | RH-- | C] () -- C:\WINDOWS\System32\lxcrcoin.dll
[2010/01/31 12:11:19 | 000,004,569 | -H-- | C] () -- C:\WINDOWS\System32\secupd.dat
[2010/01/30 17:48:39 | 000,204,800 | -H-- | C] () -- C:\WINDOWS\System32\IVIresizeW7.dll
[2010/01/30 17:48:39 | 000,200,704 | -H-- | C] () -- C:\WINDOWS\System32\IVIresizeA6.dll
[2010/01/30 17:48:39 | 000,192,512 | -H-- | C] () -- C:\WINDOWS\System32\IVIresizeP6.dll
[2010/01/30 17:48:39 | 000,192,512 | -H-- | C] () -- C:\WINDOWS\System32\IVIresizeM6.dll
[2010/01/30 17:48:39 | 000,188,416 | -H-- | C] () -- C:\WINDOWS\System32\IVIresizePX.dll
[2010/01/30 17:48:39 | 000,020,480 | -H-- | C] () -- C:\WINDOWS\System32\IVIresize.dll
[2010/01/30 16:59:28 | 000,272,128 | -H-- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2010/01/30 16:59:28 | 000,028,626 | -H-- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2010/01/30 16:59:25 | 000,004,490 | -H-- | C] () -- C:\WINDOWS\System32\oembios.dat
[2010/01/30 16:59:20 | 013,107,200 | -H-- | C] () -- C:\WINDOWS\System32\oembios.bin
[2010/01/30 16:59:14 | 000,000,741 | -H-- | C] () -- C:\WINDOWS\System32\noise.dat
[2010/01/30 16:58:54 | 000,673,088 | -H-- | C] () -- C:\WINDOWS\System32\mlang.dat
[2010/01/30 16:58:53 | 000,046,258 | -H-- | C] () -- C:\WINDOWS\System32\mib.bin
[2010/01/30 16:45:06 | 000,218,003 | -H-- | C] () -- C:\WINDOWS\System32\dssec.dat
[2010/01/30 16:44:28 | 000,001,804 | -H-- | C] () -- C:\WINDOWS\System32\Dcache.bin
[2009/07/14 09:23:15 | 000,000,427 | -H-- | C] () -- C:\WINDOWS\typeinst.ini
[2009/07/14 09:23:14 | 000,000,583 | -H-- | C] () -- C:\WINDOWS\xtreme.ini
[2008/02/14 01:41:04 | 000,001,934 | -H-- | C] () -- C:\WINDOWS\wininit.ini
[2007/12/28 19:22:42 | 000,000,060 | -H-- | C] () -- C:\WINDOWS\SIERRA.INI
[2007/06/24 21:55:23 | 000,000,894 | -H-- | C] () -- C:\WINDOWS\cdplayer.ini
[2007/05/19 09:51:56 | 000,000,793 | -H-- | C] () -- C:\WINDOWS\hegames.ini
[2006/12/22 11:04:25 | 000,000,302 | -H-- | C] () -- C:\WINDOWS\EReg515.dat
[2006/12/22 11:01:32 | 000,000,824 | -H-- | C] () -- C:\WINDOWS\disney.ini
[2006/11/25 11:53:37 | 000,000,092 | -H-- | C] () -- C:\WINDOWS\ka.ini
[2006/01/22 22:43:48 | 000,065,536 | -H-- | C] () -- C:\WINDOWS\System32\lxcrcaps.dll
[2006/01/22 09:47:36 | 000,684,032 | -H-- | C] () -- C:\WINDOWS\System32\lxcrdrs.dll
[2005/12/20 08:54:04 | 000,061,440 | -H-- | C] () -- C:\WINDOWS\System32\lxcrcnv4.dll
[2005/07/08 00:11:22 | 000,040,960 | -H-- | C] () -- C:\WINDOWS\System32\lxcrvs.dll
[2004/01/22 02:26:03 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\VGAunistlog.ini
[2004/01/22 02:26:02 | 000,000,451 | -H-- | C] () -- C:\WINDOWS\VGAsetup.ini
[2004/01/21 03:04:38 | 000,000,061 | -H-- | C] () -- C:\WINDOWS\smscfg.ini
[2004/01/21 02:52:52 | 000,000,051 | -H-- | C] () -- C:\WINDOWS\System32\mshrml.ini
[2004/01/20 21:08:05 | 000,028,672 | -H-- | C] () -- C:\WINDOWS\System32\JAWTAccessBridge.dll
[2004/01/20 21:07:21 | 000,094,208 | -H-- | C] () -- C:\WINDOWS\System32\PcdrKernelModeServices.dll
[2004/01/20 21:07:21 | 000,077,824 | -H-- | C] () -- C:\WINDOWS\System32\ProgressTrace.dll
[2004/01/20 21:04:56 | 000,000,128 | ---- | C] () -- C:\Documents and Settings\Owner\Local Settings\Application Data\fusioncache.dat
[2004/01/20 21:02:24 | 000,167,936 | -H-- | C] () -- C:\WINDOWS\System32\PCDrJNI_1_1.dll
[2004/01/20 20:59:54 | 000,090,112 | RH-- | C] () -- C:\WINDOWS\bwUnin-6.2.3.66.exe
[2004/01/20 20:56:41 | 000,030,197 | -H-- | C] () -- C:\WINDOWS\System32\CHODDI.SYS
[2004/01/20 20:56:16 | 000,024,576 | -H-- | C] () -- C:\WINDOWS\System32\syscontr.dll
[2004/01/20 20:55:38 | 000,045,056 | -H-- | C] () -- C:\WINDOWS\System32\hpreg.dll
[2004/01/20 20:42:36 | 000,000,376 | -H-- | C] () -- C:\WINDOWS\ODBC.INI
[2004/01/20 20:34:02 | 000,000,889 | -H-- | C] () -- C:\WINDOWS\QUICKEN.INI
[2004/01/20 19:54:01 | 000,006,848 | -H-- | C] () -- C:\WINDOWS\System32\hphmon05.dat
[2004/01/20 19:53:56 | 000,018,341 | -H-- | C] () -- C:\WINDOWS\HPHins01.dat
[2004/01/20 19:53:56 | 000,004,308 | -H-- | C] () -- C:\WINDOWS\hphmdl01.dat
[2004/01/20 19:39:28 | 000,015,415 | -H-- | C] () -- C:\WINDOWS\hpdins01.dat
[2004/01/20 19:39:28 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\hpzmdl01.dat
[2004/01/20 19:30:23 | 000,016,306 | -H-- | C] () -- C:\WINDOWS\hpqins01.dat
[2004/01/20 19:30:23 | 000,002,673 | -H-- | C] () -- C:\WINDOWS\hpimdl01.dat
[2004/01/20 19:14:41 | 000,001,040 | -H-- | C] () -- C:\WINDOWS\System32\drivers\alcxinit.dat
[2004/01/20 19:10:22 | 000,065,536 | -H-- | C] () -- C:\WINDOWS\System32\sis760.bin
[2004/01/20 19:10:22 | 000,065,536 | -H-- | C] () -- C:\WINDOWS\System32\sis741.bin
[2004/01/20 19:10:22 | 000,065,536 | -H-- | C] () -- C:\WINDOWS\System32\sis660.bin
[2004/01/20 18:47:52 | 000,363,520 | -H-- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2004/01/20 18:38:07 | 000,299,073 | -H-- | C] () -- C:\WINDOWS\System32\PythonCOM22.dll
[2004/01/20 18:38:07 | 000,065,536 | -H-- | C] () -- C:\WINDOWS\System32\PyWinTypes22.dll
[2004/01/20 18:37:39 | 000,016,896 | -H-- | C] () -- C:\WINDOWS\System32\bcbmm.dll
[2004/01/20 18:20:37 | 000,000,802 | -H-- | C] () -- C:\WINDOWS\orun32.ini
[2004/01/20 18:18:59 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2004/01/20 18:14:17 | 000,021,640 | -H-- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2004/01/20 17:05:12 | 000,000,549 | -H-- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2004/01/20 17:04:38 | 000,381,692 | -H-- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2004/01/20 17:04:38 | 000,053,436 | -H-- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2004/01/20 10:09:43 | 000,004,161 | -H-- | C] () -- C:\WINDOWS\ODBCINST.INI
[2004/01/20 10:08:48 | 000,152,384 | -H-- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2003/09/23 01:19:42 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\px.ini
[2003/05/15 22:15:18 | 000,225,209 | -H-- | C] () -- C:\WINDOWS\System32\C9930A.bin
[2003/03/06 23:53:16 | 000,012,288 | -H-- | C] () -- C:\WINDOWS\System32\hpnvr82.dll

========== LOP Check ==========

[2004/01/20 21:29:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Default User\Application Data\SampleView
[2004/01/21 02:52:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Default User\Application Data\interMute
[2010/10/19 15:25:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2007/12/29 22:08:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\WildTangent
[2010/07/23 00:42:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2008/08/11 20:04:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SupportSoft
[2010/10/03 23:01:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\RegCure
[2010/10/29 12:19:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Applications
[2011/05/17 14:49:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Citrix
[2011/05/17 16:35:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\W3i
[2010/10/13 16:09:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\QueryExplorer
[2011/07/06 21:55:30 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\{FDD8983C-4561-4A27-BDA7-F5286E176A8F}
[2010/04/09 13:09:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\PDF Software
[2007/05/12 01:40:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Troy Smith\Application Data\OverDrive
[2008/01/27 15:19:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Troy Smith\Application Data\Snapfish
[2008/07/07 21:59:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Troy Smith\Application Data\mjusbsp
[2008/08/05 12:27:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Troy Smith\Application Data\FrostWire
[2009/01/10 01:24:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Troy Smith\Application Data\uniblue
[2009/01/20 01:51:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Troy Smith\Application Data\OpenOffice.org
[2009/03/14 17:26:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Troy Smith\Application Data\Individual Software
[2010/01/04 11:21:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Troy Smith\Application Data\Skinux
[2004/01/21 02:52:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\interMute
[2004/01/20 21:29:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\SampleView
[2010/01/30 18:15:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\MSNInstaller
[2010/02/03 00:43:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\InterVideo
[2010/02/10 00:03:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\OpenOffice.org
[2010/03/14 13:53:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\FrostWire
[2010/03/27 22:27:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Skinux
[2010/04/09 12:05:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2010/04/09 13:12:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\PDF Software
[2010/10/19 15:26:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Fuzzy Games
[2010/10/20 15:58:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Rysecy
[2010/10/20 15:58:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Ovkene
[2011/05/17 16:39:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\NetAssistant
[2011/05/17 16:40:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\VideoBuzz
[2011/05/17 16:43:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Titanium Gears
[2011/07/06 22:13:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\uTorrent
[2011/07/06 22:39:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\searchquband
[2011/07/26 19:04:02 | 000,000,472 | -H-- | M] () -- C:\WINDOWS\Tasks\Ad-Aware Update (Daily 1).job
[2011/07/26 01:04:02 | 000,000,472 | -H-- | M] () -- C:\WINDOWS\Tasks\Ad-Aware Update (Daily 2).job
[2011/07/26 07:04:08 | 000,000,472 | -H-- | M] () -- C:\WINDOWS\Tasks\Ad-Aware Update (Daily 3).job
[2011/07/26 13:04:02 | 000,000,472 | -H-- | M] () -- C:\WINDOWS\Tasks\Ad-Aware Update (Daily 4).job
[2011/07/25 19:04:02 | 000,000,472 | -H-- | M] () -- C:\WINDOWS\Tasks\Ad-Aware Update (Weekly).job
[2011/07/25 00:27:00 | 000,000,316 | ---- | M] () -- C:\WINDOWS\Tasks\RegCure.job
[2011/07/26 22:46:36 | 000,000,334 | ---- | M] () -- C:\WINDOWS\Tasks\RegCure Program Check.job
[2009/03/20 13:27:02 | 000,000,262 | -H-- | M] () -- C:\WINDOWS\Tasks\Calculator.job
[2010/01/04 11:00:16 | 000,000,446 | -H-- | M] () -- C:\WINDOWS\Tasks\EasyShare Registration Task.job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >
[2005/10/31 07:56:02 | 000,700,416 | ---- | M] (LimeWire) -- C:\StubInstaller.exe
[2010/01/12 13:34:10 | 000,000,000 | ---- | M] () -- C:\spvsw.exe

< %USERPROFILE%\..|smtmp;true;true;true /FP >

< MD5 for: EXPLORER.EXE >
[2008/04/13 17:12:20 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS\explorer.exe
[2008/04/13 17:12:20 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS\ServicePackFiles\i386\explorer.exe
[2008/04/13 17:12:20 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS\system32\dllcache\explorer.exe
[2007/06/13 04:26:04 | 001,033,216 | ---- | M] (Microsoft Corporation) MD5=7712DF0CDDE3A5AC89843E61CD5B3658 -- C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
[2004/08/04 12:00:00 | 001,032,192 | ---- | M] (Microsoft Corporation) MD5=A0732187050030AE399B241436565E64 -- C:\WINDOWS\$NtServicePackUninstall$\explorer.exe
[2004/08/04 12:00:00 | 001,032,192 | ---- | M] (Microsoft Corporation) MD5=A0732187050030AE399B241436565E64 -- C:\WINDOWS\$NtUninstallKB938828$\explorer.exe

< MD5 for: SVCHOST.EXE >
[2008/04/13 17:12:36 | 000,014,336 | -H-- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 -- C:\WINDOWS\ServicePackFiles\i386\svchost.exe
[2008/04/13 17:12:36 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 -- C:\WINDOWS\system32\dllcache\svchost.exe
[2008/04/13 17:12:36 | 000,014,336 | -H-- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 -- C:\WINDOWS\system32\svchost.exe
[2004/08/04 12:00:00 | 000,014,336 | -H-- | M] (Microsoft Corporation) MD5=8F078AE4ED187AAABC0A305146DE6716 -- C:\WINDOWS\$NtServicePackUninstall$\svchost.exe

< MD5 for: USERINIT.EXE >
[2004/08/04 12:00:00 | 000,024,576 | -H-- | M] (Microsoft Corporation) MD5=39B1FFB03C2296323832ACBAE50D2AFF -- C:\WINDOWS\$NtServicePackUninstall$\userinit.exe
[2008/04/13 17:12:38 | 000,026,112 | -H-- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe
[2008/04/13 17:12:38 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 -- C:\WINDOWS\system32\dllcache\userinit.exe
[2008/04/13 17:12:38 | 000,026,112 | -H-- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 -- C:\WINDOWS\system32\userinit.exe

< MD5 for: WINLOGON.EXE >
[2004/08/04 12:00:00 | 000,502,272 | -H-- | M] (Microsoft Corporation) MD5=01C3346C241652F43AED8E2149881BFE -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
[2008/04/13 17:12:40 | 000,507,904 | -H-- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
[2008/04/13 17:12:40 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E -- C:\WINDOWS\system32\dllcache\winlogon.exe
[2008/04/13 17:12:40 | 000,507,904 | -H-- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E -- C:\WINDOWS\system32\winlogon.exe

< %systemroot%\*. /mp /s >

< hklm\software\clients\startmenuinternet|command /rs >
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\HideIconsCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /HideShortcuts [2011/06/22 23:17:20 | 000,552,464 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\ShowIconsCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /ShowShortcuts [2011/06/22 23:17:20 | 000,552,464 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\ReinstallCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /SetAsDefaultAppGlobal [2011/06/22 23:17:20 | 000,552,464 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\open\command\\: "C:\Documents and Settings\Owner\Local Settings\Application Data\wcc.exe" -a "C:\Program Files\Mozilla Firefox\firefox.exe"
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\properties\command\\: "C:\Program Files\Mozilla Firefox\firefox.exe" -preferences [2011/06/22 23:17:18 | 000,912,344 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\safemode\command\\: "C:\Documents and Settings\Owner\Local Settings\Application Data\wcc.exe" -a "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ReinstallCommand: "C:\WINDOWS\system32\ie4uinit.exe" -reinstall [2009/03/08 04:32:54 | 000,173,056 | -H-- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\HideIconsCommand: "C:\WINDOWS\system32\ie4uinit.exe" -hide [2009/03/08 04:32:54 | 000,173,056 | -H-- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ShowIconsCommand: "C:\WINDOWS\system32\ie4uinit.exe" -show [2009/03/08 04:32:54 | 000,173,056 | -H-- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\naom\command\\: "C:\Program Files\Internet Explorer\iexplore.exe" -extoff [2009/03/08 14:09:26 | 000,638,816 | -H-- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\open\command\\: "C:\Documents and Settings\Owner\Local Settings\Application Data\wcc.exe" -a "C:\Program Files\Internet Explorer\iexplore.exe"

< hklm\software\clients\startmenuinternet|command /64 /rs >
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\HideIconsCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /HideShortcuts [2011/06/22 23:17:20 | 000,552,464 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\ShowIconsCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /ShowShortcuts [2011/06/22 23:17:20 | 000,552,464 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\ReinstallCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /SetAsDefaultAppGlobal [2011/06/22 23:17:20 | 000,552,464 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\open\command\\: "C:\Documents and Settings\Owner\Local Settings\Application Data\wcc.exe" -a "C:\Program Files\Mozilla Firefox\firefox.exe"
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\properties\command\\: "C:\Program Files\Mozilla Firefox\firefox.exe" -preferences [2011/06/22 23:17:18 | 000,912,344 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\safemode\command\\: "C:\Documents and Settings\Owner\Local Settings\Application Data\wcc.exe" -a "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ReinstallCommand: "C:\WINDOWS\system32\ie4uinit.exe" -reinstall [2009/03/08 04:32:54 | 000,173,056 | -H-- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\HideIconsCommand: "C:\WINDOWS\system32\ie4uinit.exe" -hide [2009/03/08 04:32:54 | 000,173,056 | -H-- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ShowIconsCommand: "C:\WINDOWS\system32\ie4uinit.exe" -show [2009/03/08 04:32:54 | 000,173,056 | -H-- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\naom\command\\: "C:\Program Files\Internet Explorer\iexplore.exe" -extoff [2009/03/08 14:09:26 | 000,638,816 | -H-- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\open\command\\: "C:\Documents and Settings\Owner\Local Settings\Application Data\wcc.exe" -a "C:\Program Files\Internet Explorer\iexplore.exe"

========== Files - Unicode (All) ==========
[2007/01/07 06:58:14 | 000,000,000 | ---D | M](C:\Program Files\Common Files\s?stem32) -- C:\Program Files\Common Files\sуstem32
[2007/01/07 06:58:14 | 000,000,000 | ---D | M](C:\Program Files\Common Files\s?stem32) -- C:\Program Files\Common Files\sуstem32
[2007/01/06 07:11:58 | 000,000,000 | ---D | M](C:\Program Files\Common Files\??sks) -- C:\Program Files\Common Files\Τаsks
[2007/01/06 07:11:58 | 000,000,000 | ---D | M](C:\Program Files\Common Files\??sks) -- C:\Program Files\Common Files\Τаsks
[2006/12/14 01:19:06 | 000,000,000 | ---D | M](C:\Program Files\Common Files\?ecurity) -- C:\Program Files\Common Files\ѕecurity
[2006/12/14 01:19:06 | 000,000,000 | ---D | M](C:\Program Files\Common Files\?ecurity) -- C:\Program Files\Common Files\ѕecurity
[2006/12/10 21:26:18 | 000,000,000 | ---D | M](C:\Program Files\s?curity) -- C:\Program Files\sеcurity
[2006/12/10 21:26:18 | 000,000,000 | ---D | M](C:\Program Files\s?curity) -- C:\Program Files\sеcurity
[2006/12/09 03:13:42 | 000,000,000 | -H-D | M](C:\WINDOWS\T?sks) -- C:\WINDOWS\Tаsks
[2006/12/09 03:13:41 | 000,000,000 | -H-D | C](C:\WINDOWS\T?sks) -- C:\WINDOWS\Tаsks
[2006/12/08 00:05:34 | 000,000,000 | -H-D | M](C:\WINDOWS\A?pPatch) -- C:\WINDOWS\AрpPatch
[2006/12/08 00:05:33 | 000,000,000 | -H-D | C](C:\WINDOWS\A?pPatch) -- C:\WINDOWS\AрpPatch
[2006/12/01 00:22:42 | 000,000,000 | ---D | M](C:\Program Files\W?nSxS) -- C:\Program Files\WіnSxS
[2006/12/01 00:22:42 | 000,000,000 | ---D | M](C:\Program Files\W?nSxS) -- C:\Program Files\WіnSxS
[2006/11/24 13:47:26 | 000,000,000 | ---D | M](C:\Program Files\Common Files\?dobe) -- C:\Program Files\Common Files\Аdobe
[2006/11/24 13:47:26 | 000,000,000 | ---D | M](C:\Program Files\Common Files\?dobe) -- C:\Program Files\Common Files\Аdobe
(C:\Program Files\W?nSxS) -- C:\Program Files\WіnSxS
(C:\Program Files\s?curity) -- C:\Program Files\sеcurity
(C:\Program Files\Common Files\s?stem32) -- C:\Program Files\Common Files\sуstem32
(C:\Program Files\Common Files\?ecurity) -- C:\Program Files\Common Files\ѕecurity
(C:\Program Files\Common Files\?dobe) -- C:\Program Files\Common Files\Аdobe
(C:\Program Files\Common Files\??sks) -- C:\Program Files\Common Files\Τаsks

< End of report >

#7
Essexboy

Posted 27 July 2011 - 12:17 PM

GeekU Moderator

Retired Staff
69,964 posts

OK on completion of this run can you confirm that exe files are running correctly

Run OTL

Under the Custom Scans/Fixes box at the bottom, paste in the following

:OTL
IE - HKU\.DEFAULT\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - Reg Error: Key error. File not found
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:50370
IE - HKU\S-1-5-18\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - Reg Error: Key error. File not found
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:50370
IE - HKU\S-1-5-21-802894345-1523019152-2172162635-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.searchqu.com/406
IE - HKU\S-1-5-21-802894345-1523019152-2172162635-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-802894345-1523019152-2172162635-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = localhost
IE - HKU\S-1-5-21-802894345-1523019152-2172162635-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:50370
FF - prefs.js..browser.startup.homepage: "http://www.searchqu.com/406"
FF - prefs.js..keyword.URL: "http://dts.search-re...ystemid=406&q="
FF - prefs.js..network.proxy.http: "127.0.0.1"
FF - prefs.js..network.proxy.http_port: 50370
[2011/07/06 21:54:00 | 000,002,501 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\aa6d9bes.default\searchplugins\SearchResults.xml
[2011/07/06 21:54:00 | 000,002,501 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\SearchResults.xml
O2 - BHO: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - File not found
O3 - HKLM\..\Toolbar: (no name) - - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - !{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - File not found
O3 - HKLM\..\Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKU\S-1-5-21-802894345-1523019152-2172162635-1003\..\Toolbar\ShellBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKU\S-1-5-21-802894345-1523019152-2172162635-1003\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O4 - HKU\S-1-5-21-802894345-1523019152-2172162635-1003..\Run: [3031633076] C:\Documents and Settings\Owner\Local Settings\Application Data\ncf.exe ()
F3 - HKU\S-1-5-21-802894345-1523019152-2172162635-1003 WinNT: Load - (C:\DOCUME~1\Owner\LOCALS~1\Temp\dwm.exe) - File not found
O20 - HKU\S-1-5-21-802894345-1523019152-2172162635-1003 Winlogon: Shell - (C:\Documents and Settings\Owner\Application Data\Microsoft\Windows\shell.exe) - File not found
O21 - SSODL: SwUpdate - {003541A1-3BC0-1B1C-AAF3-040114001C01} - File not found
O35 - HKU\S-1-5-21-802894345-1523019152-2172162635-1003..exefile [open] -- "C:\Documents and Settings\Owner\Local Settings\Application Data\wcc.exe" -a "%1" %*
O36 - AppCertDlls: servuota - (C:\WINDOWS\system32\pentlman.dll) - File not found
O37 - HKU\S-1-5-21-802894345-1523019152-2172162635-1003\...exe [@ = exefile] -- "C:\Documents and Settings\Owner\Local Settings\Application Data\wcc.exe" -a "%1" %*
[2011/07/06 22:39:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Application Data\searchquband
[2011/07/10 17:13:22 | 000,006,386 | -HS- | M] () -- C:\Documents and Settings\Owner\Local Settings\Application Data\jbedil08g1kvem22e5qg66h4i3j0ea
[2011/07/10 17:13:22 | 000,006,386 | -HS- | M] () -- C:\Documents and Settings\All Users\Application Data\jbedil08g1kvem22e5qg66h4i3j0ea
[2011/07/10 02:03:14 | 000,339,968 | ---- | M] () -- C:\Documents and Settings\Owner\Local Settings\Application Data\ncf.exe
[2011/07/10 02:03:15 | 000,006,386 | -HS- | C] () -- C:\Documents and Settings\Owner\Local Settings\Application Data\jbedil08g1kvem22e5qg66h4i3j0ea
[2011/07/10 02:03:15 | 000,006,386 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\jbedil08g1kvem22e5qg66h4i3j0ea
[2011/07/10 02:03:13 | 000,339,968 | ---- | C] () -- C:\Documents and Settings\Owner\Local Settings\Application Data\ncf.exe
[2011/07/06 21:57:59 | 001,524,112 | ---- | C] () -- C:\WINDOWS\System32\bandoolmx.dll
[2010/01/12 13:34:10 | 000,000,000 | ---- | M] () -- C:\spvsw.exe

:Files
ipconfig /flushdns /c

:Commands
[purity]
[resethosts]
[emptytemp]
[EMPTYFLASH]
[CREATERESTOREPOINT]
[Reboot]
Then click the Run Fix button at the top
Let the program run unhindered, reboot the PC when it is done
Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

THEN

Please download Malwarebytes' Anti-Malware from Here.

Double Click mbam-setup.exe to install the application.

Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.

#8
boltboy

Posted 27 July 2011 - 02:03 PM

New Member

Topic Starter
Member
6 posts

exe files are working!
Will dwnld mbam when I get home from work tonight.
Thanx 4 your help. Will compensate soon.
Report follows:

OTL logfile created on: 7/27/2011 11:39:35 AM - Run 2
OTL by OldTimer - Version 3.2.26.1 Folder = C:\Documents and Settings\Owner\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.94 Gb Total Physical Memory | 1.48 Gb Available Physical Memory | 76.67% Memory free
3.79 Gb Paging File | 3.32 Gb Available in Paging File | 87.62% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 28.47 Gb Total Space | 8.67 Gb Free Space | 30.45% Space Free | Partition Type: FAT32
Drive J: | 465.76 Gb Total Space | 446.85 Gb Free Space | 95.94% Space Free | Partition Type: NTFS

Computer Name: GARAGE | User Name: Owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/07/26 22:49:40 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Owner\Desktop\OTL.scr
PRC - [2011/07/06 22:14:48 | 000,399,736 | ---- | M] (BitTorrent, Inc.) -- C:\Program Files\uTorrent\uTorrent.exe
PRC - [2011/05/10 16:03:16 | 001,205,760 | ---- | M] (W3i, LLC) -- C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe
PRC - [2011/05/02 15:09:18 | 001,306,216 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee.com\Agent\mcagent.exe
PRC - [2011/03/13 11:45:14 | 000,148,520 | ---- | M] (McAfee, Inc.) -- C:\WINDOWS\system32\mfevtps.exe
PRC - [2011/03/13 11:41:50 | 000,159,832 | ---- | M] (McAfee, Inc.) -- C:\Program Files\Common Files\Mcafee\SystemCore\mfefire.exe
PRC - [2011/03/13 11:41:36 | 000,165,000 | ---- | M] (McAfee, Inc.) -- C:\Program Files\Common Files\Mcafee\SystemCore\mcshield.exe
PRC - [2011/01/27 18:28:14 | 000,214,904 | ---- | M] (McAfee, Inc.) -- C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
PRC - [2010/04/13 20:11:14 | 000,229,688 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee Online Backup\MOBKbackup.exe
PRC - [2010/01/16 13:30:16 | 000,185,640 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files\Qwest\Quickcare\bin\tgsrvc.exe
PRC - [2010/01/16 13:30:10 | 000,206,120 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files\Qwest\Quickcare\bin\sprtsvc.exe
PRC - [2010/01/16 13:30:02 | 000,206,120 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files\Qwest\Quickcare\bin\sprtcmd.exe
PRC - [2008/11/09 12:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
PRC - [2008/04/13 17:12:20 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2006/02/02 19:11:22 | 000,495,616 | -H-- | M] ( ) -- C:\WINDOWS\system32\lxcrcoms.exe

========== Modules (SafeList) ==========

MOD - [2011/07/26 22:49:40 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Owner\Desktop\OTL.scr
MOD - [2011/04/08 16:56:28 | 000,018,176 | ---- | M] (McAfee, Inc.) -- c:\Program Files\McAfee\SiteAdvisor\sahook.dll
MOD - [2010/01/16 13:30:06 | 000,116,008 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files\Qwest\Quickcare\bin\sprthook.dll
MOD - [2008/04/13 16:12:52 | 001,054,208 | -H-- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll

========== Win32 Services (SafeList) ==========

SRV - File not found [Auto | Stopped] -- -- (QueryExplorer Service)
SRV - [2011/03/17 16:38:42 | 000,361,712 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files\McAfee\VirusScan\mcods.exe -- (McODS)
SRV - [2011/03/13 11:45:14 | 000,148,520 | ---- | M] (McAfee, Inc.) [Unknown | Running] -- C:\WINDOWS\system32\mfevtps.exe -- (mfevtp)
SRV - [2011/03/13 11:41:50 | 000,159,832 | ---- | M] () [Unknown | Running] -- C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe -- (mfefire)
SRV - [2011/03/13 11:41:36 | 000,165,000 | ---- | M] () [Unknown | Running] -- C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe -- (McShield)
SRV - [2011/01/27 18:28:14 | 000,214,904 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe -- (MSK80Service)
SRV - [2011/01/27 18:28:14 | 000,214,904 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe -- (McProxy)
SRV - [2011/01/27 18:28:14 | 000,214,904 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe -- (McNASvc)
SRV - [2011/01/27 18:28:14 | 000,214,904 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe -- (McNaiAnn)
SRV - [2011/01/27 18:28:14 | 000,214,904 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe -- (mcmscsvc)
SRV - [2011/01/27 18:28:14 | 000,214,904 | ---- | M] (McAfee, Inc.) [Unknown | Running] -- C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe -- (McMPFSvc)
SRV - [2011/01/27 18:28:14 | 000,214,904 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe -- (McAfee SiteAdvisor Service)
SRV - [2010/04/13 20:11:14 | 000,229,688 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\McAfee Online Backup\MOBKbackup.exe -- (MOBKbackup)
SRV - [2010/01/16 13:31:40 | 000,382,320 | ---- | M] (SupportSoft, Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\supportsoft\bin\ssrc.exe -- (SupportSoft RemoteAssist)
SRV - [2010/01/16 13:30:16 | 000,185,640 | ---- | M] (SupportSoft, Inc.) [Auto | Running] -- C:\Program Files\Qwest\Quickcare\bin\tgsrvc.exe -- (tgsrvc_quickcare) SupportSoft Repair Service (quickcare)
SRV - [2010/01/16 13:30:10 | 000,206,120 | ---- | M] (SupportSoft, Inc.) [Auto | Running] -- C:\Program Files\Qwest\Quickcare\bin\sprtsvc.exe -- (sprtsvc_quickcare) SupportSoft Sprocket Service (quickcare)
SRV - [2008/11/09 12:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) [Auto | Running] -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService)
SRV - [2006/02/02 19:11:22 | 000,495,616 | -H-- | M] ( ) [On_Demand | Running] -- C:\WINDOWS\System32\lxcrcoms.exe -- (lxcr_device)

========== Driver Services (SafeList) ==========

DRV - [2011/03/13 11:20:10 | 000,459,728 | ---- | M] (McAfee, Inc.) [Kernel | Unknown | Running] -- C:\WINDOWS\system32\drivers\mfehidk.sys -- (mfehidk)
DRV - [2011/03/13 11:20:10 | 000,337,912 | ---- | M] (McAfee, Inc.) [Kernel | Unknown | Running] -- C:\WINDOWS\system32\drivers\mfefirek.sys -- (mfefirek)
DRV - [2011/03/13 11:20:10 | 000,179,248 | ---- | M] (McAfee, Inc.) [Kernel | Unknown | Running] -- C:\WINDOWS\system32\drivers\mfeavfk.sys -- (mfeavfk)
DRV - [2011/03/13 11:20:10 | 000,118,784 | ---- | M] (McAfee, Inc.) [Kernel | Unknown | Running] -- C:\WINDOWS\system32\drivers\mfeapfk.sys -- (mfeapfk)
DRV - [2011/03/13 11:20:10 | 000,089,368 | ---- | M] (McAfee, Inc.) [Kernel | Unknown | Running] -- C:\WINDOWS\system32\drivers\mfetdi2k.sys -- (mfetdi2k)
DRV - [2011/03/13 11:20:10 | 000,085,984 | ---- | M] (McAfee, Inc.) [Kernel | Unknown | Stopped] -- C:\WINDOWS\system32\drivers\mferkdet.sys -- (mferkdet)
DRV - [2011/03/13 11:20:10 | 000,083,688 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mfendisk.sys -- (mfendiskmp)
DRV - [2011/03/13 11:20:10 | 000,083,688 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mfendisk.sys -- (mfendisk)
DRV - [2011/03/13 11:20:10 | 000,059,288 | ---- | M] (McAfee, Inc.) [Kernel | Unknown | Running] -- C:\WINDOWS\system32\drivers\mfebopk.sys -- (mfebopk)
DRV - [2011/03/13 11:20:10 | 000,057,432 | ---- | M] (McAfee, Inc.) [Kernel | Unknown | Running] -- C:\WINDOWS\system32\drivers\cfwids.sys -- (cfwids)
DRV - [2010/04/13 20:10:22 | 000,054,776 | ---- | M] (Mozy, Inc.) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\MOBK.sys -- (MOBKFilter)
DRV - [2008/04/13 11:56:50 | 000,012,800 | -H-- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\usb8023.sys -- (USB_RNDIS)
DRV - [2008/04/13 11:56:06 | 000,088,320 | -H-- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\nwlnkipx.sys -- (NwlnkIpx)
DRV - [2008/04/13 11:39:48 | 000,023,040 | -H-- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\mouclass.sy@ -- (Mouclass)
DRV - [2004/10/07 17:16:04 | 000,035,840 | -H-- | M] (Oak Technology Inc.) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\AFS2K.SYS -- (AFS2K)
DRV - [2004/10/01 10:24:02 | 002,279,424 | -H-- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS -- (ALCXWDM) Service for Realtek AC97 Audio (WDM)
DRV - [2003/12/12 07:54:14 | 000,391,424 | -H-- | M] (Sensaura Ltd) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ALCXSENS.SYS -- (ALCXSENS)
DRV - [2003/12/06 03:13:42 | 000,429,440 | -H-- | M] (Silicon Integrated Systems Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\sisgrp.sys -- (SiS315)
DRV - [2003/12/05 17:25:54 | 000,011,392 | -H-- | M] (Silicon Integrated Systems Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\srvkp.sys -- (SiSkp)
DRV - [2003/12/02 19:23:20 | 000,142,336 | -H-- | M] (Promise Technology, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\fasttx2k.sys -- (fasttx2k)
DRV - [2003/11/10 11:24:24 | 000,039,532 | -H-- | M] (Alcor Micro Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Sunkfilt.sys -- (SunkFilt)
DRV - [2003/09/19 01:47:00 | 000,010,368 | -H-- | M] (Padus, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\pfc.sys -- (Pfc)
DRV - [2003/09/03 00:51:00 | 000,021,120 | -H-- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\nv_agp.sys -- (nv_agp)
DRV - [2003/07/18 17:58:20 | 000,036,992 | -H-- | M] (Silicon Integrated Systems Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\SISAGPX.sys -- (SISAGP)
DRV - [2003/07/02 12:42:00 | 000,027,904 | -H-- | M] (VIA Technologies, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\viaagp1.sys -- (viaagp1)
DRV - [2003/07/02 00:33:00 | 000,652,497 | -H-- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ltmdmnt.sys -- (ltmodem5)
DRV - [2003/04/21 22:18:00 | 000,054,784 | -H-- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\NVENET.sys -- (NVENET)
DRV - [2002/10/04 18:04:10 | 000,046,976 | -H-- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\R8139n51.sys -- (rtl8139)
DRV - [2002/08/29 05:00:00 | 000,063,232 | -H-- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\nwlnknb.sys -- (NwlnkNb)
DRV - [2002/08/29 05:00:00 | 000,055,936 | -H-- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\nwlnkspx.sys -- (NwlnkSpx)
DRV - [2001/08/17 14:05:44 | 000,141,056 | -H-- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Icam3.sys -- (ICAM3NT5)
DRV - [2001/06/04 14:00:00 | 000,014,112 | -H-- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\PS2.sys -- (Ps2)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us10.hpwis.com/
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 7C CB C2 B4 94 4C CC 01 [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKCU\..\URLSearchHook: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
IE - HKCU\..\URLSearchHook: {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTNavAssist.dll (Yahoo! Inc.)
IE - HKCU\..\URLSearchHook: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files\uTorrentBar\prxtbuTor.dll (Conduit Ltd.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Secure Search"
FF - prefs.js..browser.search.order.1: "Yahoo"
FF - prefs.js..browser.search.order.2: ""
FF - prefs.js..browser.search.param.yahoo-fr: "w3i&type=W3i_DS,157,0_0,Search,20110521,6902,0,16,0"
FF - prefs.js..browser.search.selectedEngine: "Secure Search"
FF - prefs.js..extensions.enabledItems: [email protected]:1.0
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.3.5.20110120033202
FF - prefs.js..extensions.enabledItems: {B7082FAA-CB62-4872-9106-E42DD88EDE45}:3.3.1
FF - prefs.js..extensions.enabledItems: {1266764D-FC4F-4FA7-B63B-884D53B1680F}:3.6.5
FF - prefs.js..extensions.enabledItems: {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}:5.3.0.7280
FF - prefs.js..extensions.enabledItems: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}:3.5.0.12
FF - prefs.js..extensions.enabledItems: [email protected]:3.3.3.2
FF - prefs.js..network.proxy.no_proxies_on: "localhost"
FF - prefs.js..network.proxy.type: 0

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@mcafee.com/MSC,version=10: c:\progra~1\mcafee\msc\npmcsn~1.dll ()
FF - HKLM\Software\MozillaPlugins\@mcafee.com/MVT: C:\Program Files\McAfee\Supportability\MVT\npmvtplugin.dll (McAfee, Inc.)
FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.0.50401.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.10.835: C:\Program Files\Real\RealOne Player\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.2.1136: C:\Program Files\Real\RealOne Player\Netscape6\nprjplug.dll (RealNetworks)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.11.847: C:\Program Files\Real\RealOne Player\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.57\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.57\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{B7082FAA-CB62-4872-9106-E42DD88EDE45}: C:\Program Files\McAfee\SiteAdvisor [2011/05/17 16:02:06 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.18\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/05/11 18:21:32 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.18\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/05/11 18:21:32 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{1266764D-FC4F-4FA7-B63B-884D53B1680F}: C:\Documents and Settings\Owner\Application Data\NetAssistant\ [2011/05/17 16:39:38 | 000,000,000 | ---D | M]

[2011/05/11 18:23:22 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Extensions
[2011/05/11 18:23:22 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\aa6d9bes.default\extensions
[2011/05/17 16:39:16 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\aa6d9bes.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2011/07/06 22:16:22 | 000,000,000 | ---D | M] (uTorrentBar Community Toolbar) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\aa6d9bes.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}
[2011/07/06 22:16:34 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\aa6d9bes.default\extensions\[email protected]
[2011/05/11 18:21:32 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2011/06/15 19:43:36 | 000,000,000 | ---D | M] (Skype extension) -- C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2011/05/17 16:39:38 | 000,000,000 | ---D | M] (Freeze.com NetAssistant) -- C:\DOCUMENTS AND SETTINGS\OWNER\APPLICATION DATA\NETASSISTANT
[2009/01/20 01:27:56 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2011/05/17 16:02:06 | 000,000,000 | ---D | M] (McAfee SiteAdvisor) -- C:\PROGRAM FILES\MCAFEE\SITEADVISOR
[2011/07/07 17:51:32 | 000,002,015 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\McSiteAdvisor.xml

O1 HOSTS File: ([2011/07/27 11:20:10 | 000,000,098 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\Mcafee\SystemCore\ScriptSn.20110517160132.dll (McAfee, Inc.)
O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O2 - BHO: (uTorrentBar Toolbar) - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files\uTorrentBar\prxtbuTor.dll (Conduit Ltd.)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (HP View) - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\hpdtlk02.dll (Hewlett-Packard Company)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\ShellBrowser: (HP View) - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\hpdtlk02.dll (Hewlett-Packard Company)
O3 - HKCU\..\Toolbar\WebBrowser: (HP View) - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\hpdtlk02.dll (Hewlett-Packard Company)
O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com)
O4 - HKLM..\Run: [LXCRCATS] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCRtime.DLL ()
O4 - HKLM..\Run: [mcui_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [QuickCare] C:\Program Files\Qwest\Quickcare\bin\sprtcmd.exe (SupportSoft, Inc.)
O4 - HKCU..\Run: [BackupNotify] c:\Program Files\HP\Digital Imaging\bin\BackupNotify.exe (Hewlett-Packard Company)
O4 - HKCU..\Run: [InstallIQUpdater] C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe (W3i, LLC)
O4 - HKCU..\Run: [Messenger (Yahoo!)] C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O4 - HKCU..\Run: [RecordNow!] File not found
O4 - HKCU..\Run: [uTorrent] C:\Program Files\uTorrent\uTorrent.exe (BitTorrent, Inc.)
O4 - HKLM..\RunOnce: [AvgUninstallURL] C:\WINDOWS\System32\cmd.exe (Microsoft Corporation)
O4 - Startup: C:\Documents and Settings\Owner\Start Menu\Programs\Startup\OpenOffice.org 3.0.lnk = File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation)
O15 - HKCU\..Trusted Domains: //@install.mar@ ([]msni in My Computer)
O15 - HKCU\..Trusted Domains: //@mail.mar@ ([]msni in Local intranet)
O15 - HKCU\..Trusted Domains: internet ([]about in Trusted sites)
O15 - HKCU\..Trusted Domains: mcafee.com ([]http in Trusted sites)
O15 - HKCU\..Trusted Domains: mcafee.com ([]https in Trusted sites)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.m...ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.ad...Plus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1 205.171.3.25
O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Filter\application/x-mfe-ipt {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files\McAfee\MSC\McSnIePl.dll (McAfee, Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKCU Winlogon: Shell - (explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/01/20 18:16:38 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ FAT32 ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/07/27 11:29:55 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\McAfee
[2011/07/27 11:19:59 | 000,000,000 | ---D | C] -- C:\_OTL
[2011/07/26 22:49:27 | 000,579,584 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Owner\Desktop\OTL.scr
[2011/07/06 22:39:22 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\AppData
[2011/07/06 22:17:04 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Local Settings\Application Data\uTorrentBar
[2011/07/06 22:16:45 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Local Settings\Application Data\Conduit
[2011/07/06 22:16:13 | 000,000,000 | ---D | C] -- C:\Program Files\uTorrentBar
[2011/07/06 22:14:47 | 000,000,000 | ---D | C] -- C:\Program Files\uTorrent
[2011/07/06 22:13:32 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Application Data\uTorrent
[2011/07/06 22:12:23 | 000,399,736 | ---- | C] (BitTorrent, Inc.) -- C:\Documents and Settings\Owner\My Documents\uTorrent.exe
[2011/07/06 22:01:31 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Application Data\vlc
[2011/07/06 21:59:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Local Settings\Application Data\Ilivid Player
[2011/07/06 21:55:29 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\All Users\Application Data\{FDD8983C-4561-4A27-BDA7-F5286E176A8F}
[2011/07/06 21:55:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\iLivid
[2011/07/06 21:55:14 | 000,000,000 | ---D | C] -- C:\Program Files\iLivid
[2011/07/06 21:53:22 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Local Settings\Application Data\PackageAware
[2011/06/30 00:53:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Application Data\McAfee
[2006/02/02 19:24:32 | 001,183,744 | -H-- | C] ( ) -- C:\WINDOWS\System32\lxcrserv.dll
[2006/02/02 19:19:36 | 000,421,888 | -H-- | C] ( ) -- C:\WINDOWS\System32\lxcrcomm.dll
[2006/02/02 19:12:32 | 000,380,928 | -H-- | C] ( ) -- C:\WINDOWS\System32\lxcrih.exe
[2006/02/02 19:12:26 | 000,536,576 | -H-- | C] ( ) -- C:\WINDOWS\System32\lxcrlmpm.dll
[2006/02/02 19:11:30 | 000,114,688 | -H-- | C] ( ) -- C:\WINDOWS\System32\lxcrpplc.dll
[2006/02/02 19:11:22 | 000,495,616 | -H-- | C] ( ) -- C:\WINDOWS\System32\lxcrcoms.exe
[2006/02/02 19:10:48 | 000,610,304 | -H-- | C] ( ) -- C:\WINDOWS\System32\lxcrcomc.dll
[2006/02/02 19:10:18 | 000,163,840 | -H-- | C] ( ) -- C:\WINDOWS\System32\lxcrprox.dll
[2006/02/02 19:06:24 | 000,995,328 | -H-- | C] ( ) -- C:\WINDOWS\System32\lxcrusb1.dll
[2006/02/02 19:01:44 | 000,393,216 | -H-- | C] ( ) -- C:\WINDOWS\System32\lxcriesc.dll
[2006/02/02 18:59:12 | 000,409,600 | -H-- | C] ( ) -- C:\WINDOWS\System32\lxcrinpa.dll

========== Files - Modified Within 30 Days ==========

[2011/07/27 11:29:56 | 000,001,499 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\McAfee Total Protection.lnk
[2011/07/27 11:29:24 | 000,000,882 | -H-- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/07/27 11:29:14 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011/07/27 11:29:12 | 2079,772,672 | -HS- | M] () -- C:\hiberfil.sys
[2011/07/27 11:03:02 | 000,000,886 | -H-- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/07/27 07:04:02 | 000,000,472 | -H-- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Daily 3).job
[2011/07/27 01:04:02 | 000,000,472 | -H-- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Daily 2).job
[2011/07/26 22:49:40 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Owner\Desktop\OTL.scr
[2011/07/26 22:46:36 | 000,000,334 | ---- | M] () -- C:\WINDOWS\tasks\RegCure Program Check.job
[2011/07/26 19:04:02 | 000,000,472 | -H-- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Daily 1).job
[2011/07/26 17:33:02 | 000,000,946 | -H-- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1935655697-113007714-839522115-1004Core1ca5a8a3b3dd498.job
[2011/07/26 13:04:02 | 000,000,472 | -H-- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Daily 4).job
[2011/07/25 19:04:02 | 000,000,472 | -H-- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2011/07/25 00:27:00 | 000,000,316 | ---- | M] () -- C:\WINDOWS\tasks\RegCure.job
[2011/07/14 22:46:26 | 000,001,158 | -H-- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011/07/10 07:54:38 | 000,000,245 | RHS- | M] () -- C:\BOOT.INI
[2011/07/10 03:09:40 | 007,367,852 | ---- | M] () -- C:\Documents and Settings\Owner\My Documents\10 - Skin.mp3
[2011/07/10 02:59:08 | 000,007,626 | -HS- | M] () -- C:\Documents and Settings\Owner\My Documents\Folder.jpg
[2011/07/10 02:59:08 | 000,007,626 | -HS- | M] () -- C:\Documents and Settings\Owner\My Documents\AlbumArt_{09A96546-3621-4EC9-A2BC-2B0C041777B0}_Large.jpg
[2011/07/10 02:59:08 | 000,002,334 | -HS- | M] () -- C:\Documents and Settings\Owner\My Documents\AlbumArtSmall.jpg
[2011/07/10 02:59:08 | 000,002,334 | -HS- | M] () -- C:\Documents and Settings\Owner\My Documents\AlbumArt_{09A96546-3621-4EC9-A2BC-2B0C041777B0}_Small.jpg
[2011/07/10 02:20:24 | 000,020,992 | ---- | M] () -- C:\Documents and Settings\Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/07/06 22:20:42 | 000,158,197 | ---- | M] () -- C:\Documents and Settings\Owner\My Documents\payton.png
[2011/07/06 22:15:00 | 000,000,552 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\µTorrent.lnk
[2011/07/06 22:15:00 | 000,000,534 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\µTorrent.lnk
[2011/07/06 22:12:58 | 000,399,736 | ---- | M] (BitTorrent, Inc.) -- C:\Documents and Settings\Owner\My Documents\uTorrent.exe
[2011/07/03 16:33:58 | 000,000,491 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\Shortcut to J wmplayer.lnk
[2011/06/30 01:22:00 | 000,001,633 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk
[2011/06/30 00:54:00 | 000,001,675 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\McAfee Virtual Technician.lnk

========== Files Created - No Company Name ==========

[2011/07/26 07:08:57 | 000,001,499 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\McAfee Total Protection.lnk
[2011/07/10 02:59:07 | 000,007,626 | -HS- | C] () -- C:\Documents and Settings\Owner\My Documents\AlbumArt_{09A96546-3621-4EC9-A2BC-2B0C041777B0}_Large.jpg
[2011/07/10 02:59:07 | 000,002,334 | -HS- | C] () -- C:\Documents and Settings\Owner\My Documents\AlbumArt_{09A96546-3621-4EC9-A2BC-2B0C041777B0}_Small.jpg
[2011/07/06 22:25:15 | 000,007,626 | -HS- | C] () -- C:\Documents and Settings\Owner\My Documents\Folder.jpg
[2011/07/06 22:25:15 | 000,002,334 | -HS- | C] () -- C:\Documents and Settings\Owner\My Documents\AlbumArtSmall.jpg
[2011/07/06 22:23:20 | 007,367,852 | ---- | C] () -- C:\Documents and Settings\Owner\My Documents\10 - Skin.mp3
[2011/07/06 22:20:32 | 000,158,197 | ---- | C] () -- C:\Documents and Settings\Owner\My Documents\payton.png
[2011/07/06 22:14:58 | 000,000,552 | ---- | C] () -- C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\µTorrent.lnk
[2011/07/06 22:14:58 | 000,000,534 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\µTorrent.lnk
[2011/06/30 00:53:59 | 000,001,675 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\McAfee Virtual Technician.lnk
[2011/06/30 00:53:40 | 000,001,679 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\McAfee Virtual Technician.lnk
[2011/06/15 20:23:39 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat
[2011/05/11 18:22:56 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2010/08/10 18:01:11 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010/02/19 02:29:01 | 000,233,472 | -H-- | C] () -- C:\WINDOWS\System32\LXCRinst.dll
[2010/02/12 13:33:24 | 000,000,054 | -H-- | C] () -- C:\WINDOWS\System32\rp_stats.dat
[2010/02/12 13:33:24 | 000,000,039 | -H-- | C] () -- C:\WINDOWS\System32\rp_rules.dat
[2010/02/01 12:00:17 | 000,020,992 | ---- | C] () -- C:\Documents and Settings\Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/02/01 11:55:07 | 000,000,552 | -H-- | C] () -- C:\WINDOWS\System32\d3d8caps.dat
[2010/01/31 13:47:13 | 000,303,104 | RH-- | C] () -- C:\WINDOWS\System32\lxcrcoin.dll
[2010/01/31 12:11:19 | 000,004,569 | -H-- | C] () -- C:\WINDOWS\System32\secupd.dat
[2010/01/30 17:48:39 | 000,204,800 | -H-- | C] () -- C:\WINDOWS\System32\IVIresizeW7.dll
[2010/01/30 17:48:39 | 000,200,704 | -H-- | C] () -- C:\WINDOWS\System32\IVIresizeA6.dll
[2010/01/30 17:48:39 | 000,192,512 | -H-- | C] () -- C:\WINDOWS\System32\IVIresizeP6.dll
[2010/01/30 17:48:39 | 000,192,512 | -H-- | C] () -- C:\WINDOWS\System32\IVIresizeM6.dll
[2010/01/30 17:48:39 | 000,188,416 | -H-- | C] () -- C:\WINDOWS\System32\IVIresizePX.dll
[2010/01/30 17:48:39 | 000,020,480 | -H-- | C] () -- C:\WINDOWS\System32\IVIresize.dll
[2010/01/30 16:59:28 | 000,272,128 | -H-- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2010/01/30 16:59:28 | 000,028,626 | -H-- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2010/01/30 16:59:25 | 000,004,490 | -H-- | C] () -- C:\WINDOWS\System32\oembios.dat
[2010/01/30 16:59:20 | 013,107,200 | -H-- | C] () -- C:\WINDOWS\System32\oembios.bin
[2010/01/30 16:59:14 | 000,000,741 | -H-- | C] () -- C:\WINDOWS\System32\noise.dat
[2010/01/30 16:58:54 | 000,673,088 | -H-- | C] () -- C:\WINDOWS\System32\mlang.dat
[2010/01/30 16:58:53 | 000,046,258 | -H-- | C] () -- C:\WINDOWS\System32\mib.bin
[2010/01/30 16:45:06 | 000,218,003 | -H-- | C] () -- C:\WINDOWS\System32\dssec.dat
[2010/01/30 16:44:28 | 000,001,804 | -H-- | C] () -- C:\WINDOWS\System32\Dcache.bin
[2009/07/14 09:23:15 | 000,000,427 | -H-- | C] () -- C:\WINDOWS\typeinst.ini
[2009/07/14 09:23:14 | 000,000,583 | -H-- | C] () -- C:\WINDOWS\xtreme.ini
[2008/02/14 01:41:04 | 000,001,934 | -H-- | C] () -- C:\WINDOWS\wininit.ini
[2007/12/28 19:22:42 | 000,000,060 | -H-- | C] () -- C:\WINDOWS\SIERRA.INI
[2007/06/24 21:55:23 | 000,000,894 | -H-- | C] () -- C:\WINDOWS\cdplayer.ini
[2007/05/19 09:51:56 | 000,000,793 | -H-- | C] () -- C:\WINDOWS\hegames.ini
[2006/12/22 11:04:25 | 000,000,302 | -H-- | C] () -- C:\WINDOWS\EReg515.dat
[2006/12/22 11:01:32 | 000,000,824 | -H-- | C] () -- C:\WINDOWS\disney.ini
[2006/11/25 11:53:37 | 000,000,092 | -H-- | C] () -- C:\WINDOWS\ka.ini
[2006/01/22 22:43:48 | 000,065,536 | -H-- | C] () -- C:\WINDOWS\System32\lxcrcaps.dll
[2006/01/22 09:47:36 | 000,684,032 | -H-- | C] () -- C:\WINDOWS\System32\lxcrdrs.dll
[2005/12/20 08:54:04 | 000,061,440 | -H-- | C] () -- C:\WINDOWS\System32\lxcrcnv4.dll
[2005/07/08 00:11:22 | 000,040,960 | -H-- | C] () -- C:\WINDOWS\System32\lxcrvs.dll
[2004/01/22 02:26:03 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\VGAunistlog.ini
[2004/01/22 02:26:02 | 000,000,451 | -H-- | C] () -- C:\WINDOWS\VGAsetup.ini
[2004/01/21 03:04:38 | 000,000,061 | -H-- | C] () -- C:\WINDOWS\smscfg.ini
[2004/01/21 02:52:52 | 000,000,051 | -H-- | C] () -- C:\WINDOWS\System32\mshrml.ini
[2004/01/20 21:08:05 | 000,028,672 | -H-- | C] () -- C:\WINDOWS\System32\JAWTAccessBridge.dll
[2004/01/20 21:07:21 | 000,094,208 | -H-- | C] () -- C:\WINDOWS\System32\PcdrKernelModeServices.dll
[2004/01/20 21:07:21 | 000,077,824 | -H-- | C] () -- C:\WINDOWS\System32\ProgressTrace.dll
[2004/01/20 21:04:56 | 000,000,128 | ---- | C] () -- C:\Documents and Settings\Owner\Local Settings\Application Data\fusioncache.dat
[2004/01/20 21:02:24 | 000,167,936 | -H-- | C] () -- C:\WINDOWS\System32\PCDrJNI_1_1.dll
[2004/01/20 20:59:54 | 000,090,112 | RH-- | C] () -- C:\WINDOWS\bwUnin-6.2.3.66.exe
[2004/01/20 20:56:41 | 000,030,197 | -H-- | C] () -- C:\WINDOWS\System32\CHODDI.SYS
[2004/01/20 20:56:16 | 000,024,576 | -H-- | C] () -- C:\WINDOWS\System32\syscontr.dll
[2004/01/20 20:55:38 | 000,045,056 | -H-- | C] () -- C:\WINDOWS\System32\hpreg.dll
[2004/01/20 20:42:36 | 000,000,376 | -H-- | C] () -- C:\WINDOWS\ODBC.INI
[2004/01/20 20:34:02 | 000,000,889 | -H-- | C] () -- C:\WINDOWS\QUICKEN.INI
[2004/01/20 19:54:01 | 000,006,848 | -H-- | C] () -- C:\WINDOWS\System32\hphmon05.dat
[2004/01/20 19:53:56 | 000,018,341 | -H-- | C] () -- C:\WINDOWS\HPHins01.dat
[2004/01/20 19:53:56 | 000,004,308 | -H-- | C] () -- C:\WINDOWS\hphmdl01.dat
[2004/01/20 19:39:28 | 000,015,415 | -H-- | C] () -- C:\WINDOWS\hpdins01.dat
[2004/01/20 19:39:28 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\hpzmdl01.dat
[2004/01/20 19:30:23 | 000,016,306 | -H-- | C] () -- C:\WINDOWS\hpqins01.dat
[2004/01/20 19:30:23 | 000,002,673 | -H-- | C] () -- C:\WINDOWS\hpimdl01.dat
[2004/01/20 19:14:41 | 000,001,040 | -H-- | C] () -- C:\WINDOWS\System32\drivers\alcxinit.dat
[2004/01/20 19:10:22 | 000,065,536 | -H-- | C] () -- C:\WINDOWS\System32\sis760.bin
[2004/01/20 19:10:22 | 000,065,536 | -H-- | C] () -- C:\WINDOWS\System32\sis741.bin
[2004/01/20 19:10:22 | 000,065,536 | -H-- | C] () -- C:\WINDOWS\System32\sis660.bin
[2004/01/20 18:47:52 | 000,363,520 | -H-- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2004/01/20 18:38:07 | 000,299,073 | -H-- | C] () -- C:\WINDOWS\System32\PythonCOM22.dll
[2004/01/20 18:38:07 | 000,065,536 | -H-- | C] () -- C:\WINDOWS\System32\PyWinTypes22.dll
[2004/01/20 18:37:39 | 000,016,896 | -H-- | C] () -- C:\WINDOWS\System32\bcbmm.dll
[2004/01/20 18:20:37 | 000,000,802 | -H-- | C] () -- C:\WINDOWS\orun32.ini
[2004/01/20 18:18:59 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2004/01/20 18:14:17 | 000,021,640 | -H-- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2004/01/20 17:05:12 | 000,000,549 | -H-- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2004/01/20 17:04:38 | 000,381,692 | -H-- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2004/01/20 17:04:38 | 000,053,436 | -H-- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2004/01/20 10:09:43 | 000,004,161 | -H-- | C] () -- C:\WINDOWS\ODBCINST.INI
[2004/01/20 10:08:48 | 000,152,384 | -H-- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2003/09/23 01:19:42 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\px.ini
[2003/05/15 22:15:18 | 000,225,209 | -H-- | C] () -- C:\WINDOWS\System32\C9930A.bin
[2003/03/06 23:53:16 | 000,012,288 | -H-- | C] () -- C:\WINDOWS\System32\hpnvr82.dll

========== LOP Check ==========

[2010/10/19 15:25:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2007/12/29 22:08:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\WildTangent
[2010/07/23 00:42:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2008/08/11 20:04:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SupportSoft
[2010/10/03 23:01:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\RegCure
[2010/10/29 12:19:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Applications
[2011/05/17 14:49:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Citrix
[2011/05/17 16:35:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\W3i
[2010/10/13 16:09:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\QueryExplorer
[2011/07/06 21:55:30 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\{FDD8983C-4561-4A27-BDA7-F5286E176A8F}
[2004/01/21 02:52:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\interMute
[2004/01/20 21:29:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\SampleView
[2010/01/30 18:15:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\MSNInstaller
[2010/02/03 00:43:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\InterVideo
[2010/02/10 00:03:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\OpenOffice.org
[2010/03/14 13:53:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\FrostWire
[2010/03/27 22:27:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Skinux
[2010/04/09 12:05:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2010/04/09 13:12:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\PDF Software
[2010/10/19 15:26:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Fuzzy Games
[2010/10/20 15:58:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Rysecy
[2010/10/20 15:58:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Ovkene
[2011/05/17 16:39:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\NetAssistant
[2011/05/17 16:40:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\VideoBuzz
[2011/05/17 16:43:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Titanium Gears
[2011/07/06 22:13:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\uTorrent
[2011/07/26 19:04:02 | 000,000,472 | -H-- | M] () -- C:\WINDOWS\Tasks\Ad-Aware Update (Daily 1).job
[2011/07/27 01:04:02 | 000,000,472 | -H-- | M] () -- C:\WINDOWS\Tasks\Ad-Aware Update (Daily 2).job
[2011/07/27 07:04:02 | 000,000,472 | -H-- | M] () -- C:\WINDOWS\Tasks\Ad-Aware Update (Daily 3).job
[2011/07/26 13:04:02 | 000,000,472 | -H-- | M] () -- C:\WINDOWS\Tasks\Ad-Aware Update (Daily 4).job
[2011/07/25 19:04:02 | 000,000,472 | -H-- | M] () -- C:\WINDOWS\Tasks\Ad-Aware Update (Weekly).job
[2011/07/25 00:27:00 | 000,000,316 | ---- | M] () -- C:\WINDOWS\Tasks\RegCure.job
[2011/07/26 22:46:36 | 000,000,334 | ---- | M] () -- C:\WINDOWS\Tasks\RegCure Program Check.job
[2009/03/20 13:27:02 | 000,000,262 | -H-- | M] () -- C:\WINDOWS\Tasks\Calculator.job
[2010/01/04 11:00:16 | 000,000,446 | -H-- | M] () -- C:\WINDOWS\Tasks\EasyShare Registration Task.job

========== Purity Check ==========

< End of report >

#9
Essexboy

Posted 27 July 2011 - 02:14 PM

GeekU Moderator

Retired Staff
69,964 posts

That looks a lot better MBAM will clear out the bits I did not see, once it has completed can you let me know if any problems remain

#10
boltboy

Posted 28 July 2011 - 03:34 AM

New Member

Topic Starter
Member
6 posts

essexboy,
No issues so far. Ran both Mbytes and spybot. 2 reports follow:
Malwarebytes' Anti-Malware 1.51.1.1800
www.malwarebytes.org

Database version: 7306

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

7/27/2011 11:19:07 PM
mbam-log-2011-07-27 (23-19-07).txt

Scan type: Quick scan
Objects scanned: 170525
Time elapsed: 7 minute(s), 56 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 15
Registry Values Infected: 1
Registry Data Items Infected: 6
Folders Infected: 3
Files Infected: 4

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\AppID\{0D82ACD6-A652-4496-A298-2BDE705F4227} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{7025E484-D4B0-441a-9F0B-69063BD679CE} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{8258B35C-05B8-4c0e-9525-9BCCC70F8F2D} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{A89256AD-EC17-4a83-BEF5-4B8BC4F39306} (Adware.ClickPotato) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{100EB1FD-D03E-47FD-81F3-EE91287F9465} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{A7CDDCDC-BEEB-4685-A062-978F5E07CEEE} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{A7CDDCDC-BEEB-4685-A062-978F5E07CEEE} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{C5428486-50A0-4A02-9D20-520B59A9F9B2} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{C5428486-50A0-4A02-9D20-520B59A9F9B3} (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\ShopperReports.Reporter (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\ShopperReports.Reporter.1 (Adware.ShopperReports) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\QueryExplorer (Adware.QueryExplorer) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\QueryExplorer (Adware.QueryExplorer) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_QUERYEXPLORER_SERVICE (Adware.QueryExplorer) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\QueryExplorer Service (Adware.QueryExplorer) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform\SRS_IT_E8790571B0765C5332AE99 (Malware.Trace) -> Value: SRS_IT_E8790571B0765C5332AE99 -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command\(default) (Hijack.StartMenuInternet) -> Bad: ("C:\Documents and Settings\Owner\Local Settings\Application Data\wcc.exe" -a "C:\Program Files\Mozilla Firefox\firefox.exe") Good: (firefox.exe) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command\(default) (Hijack.StartMenuInternet) -> Bad: ("C:\Documents and Settings\Owner\Local Settings\Application Data\wcc.exe" -a "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode) Good: (firefox.exe -safe-mode) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command\(default) (Hijack.StartMenuInternet) -> Bad: ("C:\Documents and Settings\Owner\Local Settings\Application Data\wcc.exe" -a "C:\Program Files\Internet Explorer\iexplore.exe") Good: (iexplore.exe) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
c:\documents and settings\all users\application data\queryexplorer (Adware.QueryExplorer) -> Quarantined and deleted successfully.
c:\program files\oin search (Adware.PurityScan) -> Quarantined and deleted successfully.
c:\program files\queryexplorer (Adware.QueryExplorer) -> Quarantined and deleted successfully.

Files Infected:
c:\documents and settings\Owner\application data\microsoft\stor.cfg (Malware.Trace) -> Quarantined and deleted successfully.
c:\documents and settings\Owner\Desktop\click to find and fix errors.lnk (Rogue.Link) -> Quarantined and deleted successfully.
c:\program files\oin search\oinsearch.dll (Adware.PurityScan) -> Quarantined and deleted successfully.
c:\program files\oin search\uninstall.exe (Adware.PurityScan) -> Quarantined and deleted successfully.

I don't think you want this one but here it is anyway:

23:09:45 Owner MESSAGE Protection started successfully
23:10:14 Owner MESSAGE IP Protection started successfully
23:10:56 Owner IP-BLOCK 79.135.131.155 (Type: outgoing)
23:11:10 Owner MESSAGE Scheduled update executed successfully
23:11:10 Owner MESSAGE IP Protection stopped
23:11:19 Owner MESSAGE Database updated successfully
23:11:45 Owner MESSAGE IP Protection started successfully
23:23:28 Owner MESSAGE Protection started successfully
23:23:47 Owner MESSAGE IP Protection started successfully
23:24:07 Owner IP-BLOCK 58.241.85.12 (Type: outgoing)
23:25:08 Owner IP-BLOCK 87.248.177.231 (Type: outgoing)
23:41:36 Owner IP-BLOCK 98.142.245.179 (Type: outgoing)
23:41:38 Owner IP-BLOCK 222.69.100.208 (Type: outgoing)

#11
Essexboy

Posted 28 July 2011 - 10:37 AM

GeekU Moderator

Retired Staff
69,964 posts

Hmm that suggest there is still something on your system that is not yet visible

Download and Install Combofix

Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

Double click on ComboFix.exe & follow the prompts.

As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Posted Image

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now

#12
Essexboy

Posted 01 August 2011 - 11:05 AM

GeekU Moderator

Retired Staff
69,964 posts

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.