Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

trojan horse Dropper.generic3.NWK OTL Extras logfile created on: 7/28/


  • This topic is locked This topic is locked

#1
ctpchatty

ctpchatty

    Member

  • Member
  • PipPip
  • 13 posts
I have no idea if I am doing this correctly or not. I have not been on this site for years because I have tried diligently to keep my computer clean. Now my virus scan has found 3 items and cannot remove it. Thanks
  • 0

Advertisements


#2
ali.B

ali.B

    Trusted Helper

  • Malware Removal
  • 3,086 posts
hi :)

Before we begin, I would like to make a few things clear so that we can fix your problem as efficiently as possible:
  • Be sure to follow all my instructions carefully! If there is anything you don''t understand, don't hesitate to ask.
  • Please do not do anything or perform other steps unless I have asked you to do so.
  • Please make sure you post all logs I ask you to, and make sure that the entire log gets posted.


Step 1

Download aswMBR.exe ( 1.8mb ) to your desktop.

Double click the aswMBR.exe to run it

Click the "Scan" button to start scan
Posted Image

On completion of the scan click save log, save it to your desktop and post in your next reply
Posted Image

Step 2

Download OTL to your Desktop
  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • Select All Users
  • Under the Custom Scan box paste this in

    netsvcs
    %SYSTEMDRIVE%\*.exe
    /md5start
    explorer.exe
    winlogon.exe
    Userinit.exe
    svchost.exe
    /md5stop
    %systemroot%\*. /mp /s
    hklm\software\clients\startmenuinternet|command /rs
    hklm\software\clients\startmenuinternet|command /64 /rs
    CREATERESTOREPOINT

  • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  • Post both logs

Things I would like to see in your reply:
  • aswMBR log
  • OTL.txt and Extras.txt

  • 0

#3
ctpchatty

ctpchatty

    Member

  • Topic Starter
  • Member
  • PipPip
  • 13 posts
Hello, I just completed the first step but when I saved it to my desktop it says it cannot be opened because it is a DAT file? Am I supposed to do something else, I still have this open, I did not delete it. Thanks
  • 0

#4
ali.B

ali.B

    Trusted Helper

  • Malware Removal
  • 3,086 posts
hi

you are not supposed to open the .dat file , open the .txt file instead.
  • 0

#5
ctpchatty

ctpchatty

    Member

  • Topic Starter
  • Member
  • PipPip
  • 13 posts
I'm sorry, I told you I am not sure of myself and what I am doing, I just saw the text file in another location. I will do the rest later, I have some other responsibilities I have to take care of. Thanks for getting back to me and trying to help.
  • 0

#6
ctpchatty

ctpchatty

    Member

  • Topic Starter
  • Member
  • PipPip
  • 13 posts
Phew, I think I did everything correctly, the files are attached and I thank you.

Attached Files


  • 0

#7
ali.B

ali.B

    Trusted Helper

  • Malware Removal
  • 3,086 posts
hi

post the logs, do not attach them.

Download ComboFix here :

Link 1
Link 2


* IMPORTANT !!! Save ComboFix.exe to your Desktop


  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Here is a guide on how to disable them

    Click me

  • Double click on ComboFix.exe & follow the prompts.

  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.


Posted Image



Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Posted Image


Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt log in your next reply
  • 0

#8
ctpchatty

ctpchatty

    Member

  • Topic Starter
  • Member
  • PipPip
  • 13 posts
OK, sorry this took so long, my husband is having some health issues and needed my attention:
You sent me two links so I did them both. Also I have to assume the word post means (basically) copy and paste which I am doing. Thanks for all the help and forgive me, I know enough about computers to be helpful but certainly not knowledgeable like you are. Here is the info requested:

Link 1:

ComboFix 11-08-02.02 - James&Catherine 08/02/2011 8:55.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1535.662 [GMT -4:00]
Running from: c:\documents and settings\James&Catherine\My Documents\Downloads\ComboFix.exe
AV: AVG Anti-Virus Free Edition 2011 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\Thumbs.db
c:\windows\27463468.exe
c:\windows\BackUp
c:\windows\BackUp\S\50821000.DAT
c:\windows\patch.exe
.
.
((((((((((((((((((((((((( Files Created from 2011-07-02 to 2011-08-02 )))))))))))))))))))))))))))))))
.
.
2011-07-26 20:17 . 2011-07-26 20:17 -------- d-----w- c:\program files\Common Files\Java
2011-07-26 20:16 . 2011-05-04 08:52 476904 ----a-w- c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
2011-07-26 20:16 . 2011-05-04 08:52 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-07-13 07:26 . 2011-07-13 07:26 63115 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\USERTILE.JS
2011-07-13 07:26 . 2011-07-13 07:26 4599 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\UIRESOURCE.JS
2011-07-13 07:26 . 2011-07-13 07:26 9310 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\TEXTBOX.JS
2011-07-13 07:26 . 2011-07-13 07:26 8646 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\TILEBOX.JS
2011-07-13 07:26 . 2011-07-13 07:26 6429 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\UICORE.JS
2011-07-13 07:26 . 2011-07-13 07:26 5927 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\TEXT.JS
2011-07-13 07:26 . 2011-07-13 07:26 8613 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\SAVEDUSER.JS
2011-07-13 07:26 . 2011-07-13 07:26 1651 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\QUERYSTRING.JS
2011-07-13 07:26 . 2011-07-13 07:26 6910 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\NEWUSERCOMM.JS
2011-07-13 07:26 . 2011-07-13 07:26 6208 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\LINK.JS
2011-07-13 07:26 . 2011-07-13 07:26 18541 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\LOCALIZATION.JS
2011-07-13 07:26 . 2011-07-13 07:26 8288 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\IMAGE.JS
2011-07-13 07:25 . 2011-07-13 07:25 51852 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\EXTERNALWRAPPER.JS
2011-07-13 07:25 . 2011-07-13 07:25 20719 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\DIVWRAPPER.JS
2011-07-13 07:25 . 2011-07-13 07:25 23327 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\COMBOBOX.JS
2011-07-13 07:25 . 2011-07-13 07:25 7271 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\CHECKBOX.JS
2011-07-13 07:25 . 2011-07-13 07:25 8782 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\BUTTON.JS
2011-07-07 16:37 . 2011-07-07 16:37 2106216 ----a-w- c:\program files\Mozilla Firefox\D3DCompiler_43.dll
2011-07-07 16:37 . 2011-07-07 16:37 142296 ----a-w- c:\program files\Mozilla Firefox\components\browsercomps.dll
2011-07-07 16:37 . 2011-07-07 16:37 1998168 ----a-w- c:\program files\Mozilla Firefox\d3dx9_43.dll
2011-07-07 16:37 . 2011-07-07 16:37 89048 ----a-w- c:\program files\Mozilla Firefox\libEGL.dll
2011-07-07 16:37 . 2011-07-07 16:37 465880 ----a-w- c:\program files\Mozilla Firefox\libGLESv2.dll
2011-07-07 16:37 . 2011-07-07 16:37 15832 ----a-w- c:\program files\Mozilla Firefox\mozalloc.dll
2011-07-07 16:37 . 2011-07-07 16:37 1850328 ----a-w- c:\program files\Mozilla Firefox\mozjs.dll
2011-07-07 16:37 . 2011-07-07 16:37 781272 ----a-w- c:\program files\Mozilla Firefox\mozsqlite3.dll
2011-07-06 14:19 . 2011-07-06 14:19 -------- d-----w- C:\found.000
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-06-21 12:15 . 2011-05-24 12:32 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-06-21 04:09 . 2006-10-10 20:20 200976 ----a-w- c:\windows\system32\drivers\tmcomm.sys
2011-06-02 14:02 . 2002-08-29 11:00 1858944 ----a-w- c:\windows\system32\win32k.sys
2007-01-11 18:05 . 2007-01-11 18:05 3993088 -c--a-w- c:\program files\LinksysConnectPC.exe
2011-07-07 16:37 . 2011-07-07 16:37 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
2008-12-05 21:20 333192 ----a-w- c:\program files\AskBarDis\bar\bin\askBar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-12-05 333192]
.
[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{3041D03E-FD4B-44E0-B742-2D9B88305F98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-12-05 333192]
.
[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Weather"="c:\program files\AWS\WeatherBug\Weather.exe" [2009-01-30 1347584]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-08-02 7110656]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-10-08 47904]
"Nikon Transfer Monitor"="c:\program files\Common Files\Nikon\Monitor\NkMonitor.exe" [2009-05-29 479232]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2008-12-08 54576]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-06-08 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"AVG_TRAY"="c:\program files\AVG\AVG10\avgtray.exe" [2011-04-18 2334560]
"ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-10-28 207424]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-03-07 421160]
"TkBellExe"="c:\program files\real\realplayer\update\realsched.exe" [2011-05-24 273544]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 39264]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"SRUUninstall"="c:\windows\System32\msiexec.exe" [2008-04-14 78848]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2009-11-18 275072]
Kodak EasyShare software.lnk - c:\program files\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2010-1-27 323584]
Wireless N-lite USB Adapter Utility.lnk - c:\program files\ZyXEL\N220\Common\N220.exe [2011-6-13 1990656]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG10\avgchsvx.exe /sync\0c:\progra~1\AVG\AVG10\avgrsx.exe /sync /restart
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk
backup=c:\windows\pss\Kodak EasyShare software.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2011-06-08 04:02 37296 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DMXLauncher]
2006-08-14 05:07 102400 -c--a-w- c:\program files\Roxio\Media Experience\DMXLauncher.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
2004-07-27 21:50 221184 ----a-w- c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
2004-07-27 21:50 81920 -c--a-w- c:\program files\Common Files\InstallShield\UpdateService\issch.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2011-03-07 19:33 421160 ----a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-29 21:38 421888 ----a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxioDragToDisc]
2006-07-31 13:00 1116920 -c--a-w- c:\program files\Roxio\Drag-to-Disc\DrgToDsc.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxWatchTray]
2006-08-10 16:10 221184 -c--a-w- c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WMPNetworkSvc"=3 (0x3)
"RoxLiveShare9"=2 (0x2)
"Roxio Upnp Server 9"=2 (0x2)
"Roxio UPnP Renderer 9"=3 (0x3)
"gusvc"=3 (0x3)
"Speed Disk service"=2 (0x2)
"NProtectService"=2 (0x2)
"GBPoll"=2 (0x2)
"Creative Service for CDROM Access"=2 (0x2)
"WinDefend"=2 (0x2)
"stllssvr"=3 (0x3)
"RoxWatch9"=2 (0x2)
"RoxMediaDB9"=3 (0x3)
"KodakCCS"=3 (0x3)
"gupdate1c9b60c237cda5c"=2 (0x2)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\IncrediMail\\bin\\IncMail.exe"=
"c:\\Program Files\\ClickTray Calendar\\ClickTray.exe"=
"c:\\Program Files\\Dell\\Support\\Alert\\bin\\AlertView.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\IncrediMail\\bin\\IMApp.exe"=
"c:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe"=
"c:\\WINDOWS\\SYSTEM32\\ftp.exe"=
"c:\\Program Files\\Kyodai Mahjongg\\kmj.exe"=
"c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=
"c:\\Program Files\\IncrediMail\\bin\\IncrediMail_Install.exe"=
"c:\\Program Files\\IncrediMail\\bin\\ImSc.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\SightSpeed\\SightSpeed.exe"=
"c:\\WINDOWS\\SYSTEM32\\dpvsetup.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Sony\\Media Manager for WALKMAN\\MediaManager.exe"=
"c:\\Program Files\\Google\\Google Earth\\client\\googleearth.exe"=
"c:\\Program Files\\AVG\\AVG10\\avgmfapx.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfcCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgplgtupl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgpc01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqusgm.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqusgh.exe"=
"c:\\Program Files\\HP\\HP Software Update\\HPWUCli.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\smart web printing\\SmartWebPrintExe.exe"=
"c:\\WINDOWS\\SYSTEM32\\fxsclnt.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\AVG\\AVG10\\avgdiagex.exe"=
"c:\\Program Files\\AVG\\AVG10\\avgnsx.exe"=
"c:\\Program Files\\AVG\\AVG10\\avgemcx.exe"=
.
R0 AVGIDSEH;AVGIDSEH;c:\windows\SYSTEM32\DRIVERS\AVGIDSEH.sys [9/13/2010 4:27 PM 22992]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\SYSTEM32\DRIVERS\avgrkx86.sys [9/7/2010 3:48 AM 32592]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\SYSTEM32\DRIVERS\avgldx86.sys [9/7/2010 3:48 AM 248656]
R1 Avgtdix;AVG TDI Driver;c:\windows\SYSTEM32\DRIVERS\avgtdix.sys [9/7/2010 3:49 AM 297168]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/17/2010 2:25 PM 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/10/2010 2:41 PM 67656]
R2 avgwd;AVG WatchDog;c:\program files\AVG\AVG10\avgwdsvc.exe [2/8/2011 5:33 AM 269520]
R3 AVGIDSDriver;AVGIDSDriver;c:\windows\SYSTEM32\DRIVERS\AVGIDSDriver.sys [8/19/2010 9:42 PM 134480]
R3 AVGIDSFilter;AVGIDSFilter;c:\windows\SYSTEM32\DRIVERS\AVGIDSFilter.sys [8/19/2010 9:42 PM 24144]
R3 AVGIDSShim;AVGIDSShim;c:\windows\SYSTEM32\DRIVERS\AVGIDSShim.sys [8/19/2010 9:42 PM 27216]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys --> c:\windows\system32\DRIVERS\Lbd.sys [?]
S1 SABKUTIL;SABKUTIL;\??\c:\program files\SUPERAntiSpyware\SABKUTIL.sys --> c:\program files\SUPERAntiSpyware\SABKUTIL.sys [?]
S2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe [4/18/2011 5:39 PM 7398752]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3/18/2010 2:16 PM 130384]
S2 gupdate1c9b60c237cda5c;Google Update Service (gupdate1c9b60c237cda5c);c:\program files\Google\Update\GoogleUpdate.exe [4/5/2009 12:32 PM 133104]
S3 BBSvc;Bing Bar Update Service;c:\program files\Microsoft\BingBar\BBSvc.EXE [2/28/2011 7:44 PM 183560]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [4/5/2009 12:32 PM 133104]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [3/18/2010 2:16 PM 753504]
S3 ZG760_XP;ZyXEL 802.11g XG762 1211 Driver;c:\windows\SYSTEM32\DRIVERS\WlanGZXP.sys [6/15/2011 8:24 PM 519168]
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - ASWMBR
*NewlyCreated* - JAVAQUICKSTARTERSERVICE
*Deregistered* - aswMBR
*Deregistered* - tmcomm
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
HPService REG_MULTI_SZ HPSLPSVC
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder
.
2011-07-28 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]
.
2011-08-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-05 16:32]
.
2011-08-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-05 16:32]
.
2011-08-02 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-800477755-3333981516-2174538972-1007.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-03-29 14:47]
.
2011-08-02 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-800477755-3333981516-2174538972-1007.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-03-29 14:47]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/
mSearch Bar = hxxp://ms101.mysearch.com/sa/srchlft.html
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = localhost;*.local
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office10\EXCEL.EXE/3000
IE: Read EXIF - c:\program files\ArcSoft\RAW Thumbnail Viewer\ArcEXIFM.htm
Trusted Zone: gamehouse.com
Trusted Zone: gamehouse.com\www
TCP: DhcpNameServer = 192.168.1.254
TCP: Interfaces\{FB26B797-C6FF-46EE-AA1A-9C169A0E2F84}: NameServer = 209.26.88.31,204.215.43.3
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: PackageCab - hxxp://ak.imgag.com/imgag/cp/install/AxCtp2.cab
DPF: {0585238B-9CA6-4CCB-A9B2-FE4BA495E880} - hxxp://www.smilecam.com/home/ezwebcam/eng5/common/AXWebMonProj1.cab
DPF: {31150A86-0BBA-409F-BEB4-F3922D10BF34} - hxxp://213.139.220.50/xplug.ocx
DPF: {38578BF0-0ABB-11D3-9330-0080C6F796A1} - hxxp://www.imgag.com/cp/install/AxCtp.cab
DPF: {B991DA79-51F7-4011-98D2-1F2592E82A56} - hxxp://204.118.132.145/2_0/ACNePlayer.cab
DPF: {CA11EB7C-1C85-4577-8A49-9E28EFB30184} - hxxp://www.umediaserver.net/bin/UMediaControl4.cab
FF - ProfilePath - c:\documents and settings\James&Catherine\Application Data\Mozilla\Firefox\Profiles\5glfrwhz.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-sunm&p=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
FF - user.js: yahoo.homepage.dontask - true);user_pref(yahoo.ytff.general.dontshowhpoffer, true
.
- - - - ORPHANS REMOVED - - - -
.
HKCU-RunServicesOnce-washindex - c:\program files\Washer\washidx.exe
SafeBoot-AVG Anti-Spyware Driver
SafeBoot-AVG Anti-Spyware Guard
MSConfigStartUp-osCheck - c:\program files\Norton AntiVirus\osCheck.exe
MSConfigStartUp-Windows Defender - c:\program files\Windows Defender\MSASCui.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-08-02 09:06
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-800477755-3333981516-2174538972-1007\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(704)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\WININET.dll
.
Completion time: 2011-08-02 09:11:23
ComboFix-quarantined-files.txt 2011-08-02 13:11
.
Pre-Run: 55,336,517,632 bytes free
Post-Run: 55,605,256,192 bytes free
.
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn
.
- - End Of File - - 81EA1D8776CB45F296E8ED2A123D63F5

Link 2:

ComboFix 11-08-02.02 - James&Catherine 08/02/2011 8:55.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1535.662 [GMT -4:00]
Running from: c:\documents and settings\James&Catherine\My Documents\Downloads\ComboFix.exe
AV: AVG Anti-Virus Free Edition 2011 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\Thumbs.db
c:\windows\27463468.exe
c:\windows\BackUp
c:\windows\BackUp\S\50821000.DAT
c:\windows\patch.exe
.
.
((((((((((((((((((((((((( Files Created from 2011-07-02 to 2011-08-02 )))))))))))))))))))))))))))))))
.
.
2011-07-26 20:17 . 2011-07-26 20:17 -------- d-----w- c:\program files\Common Files\Java
2011-07-26 20:16 . 2011-05-04 08:52 476904 ----a-w- c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
2011-07-26 20:16 . 2011-05-04 08:52 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-07-13 07:26 . 2011-07-13 07:26 63115 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\USERTILE.JS
2011-07-13 07:26 . 2011-07-13 07:26 4599 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\UIRESOURCE.JS
2011-07-13 07:26 . 2011-07-13 07:26 9310 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\TEXTBOX.JS
2011-07-13 07:26 . 2011-07-13 07:26 8646 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\TILEBOX.JS
2011-07-13 07:26 . 2011-07-13 07:26 6429 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\UICORE.JS
2011-07-13 07:26 . 2011-07-13 07:26 5927 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\TEXT.JS
2011-07-13 07:26 . 2011-07-13 07:26 8613 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\SAVEDUSER.JS
2011-07-13 07:26 . 2011-07-13 07:26 1651 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\QUERYSTRING.JS
2011-07-13 07:26 . 2011-07-13 07:26 6910 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\NEWUSERCOMM.JS
2011-07-13 07:26 . 2011-07-13 07:26 6208 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\LINK.JS
2011-07-13 07:26 . 2011-07-13 07:26 18541 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\LOCALIZATION.JS
2011-07-13 07:26 . 2011-07-13 07:26 8288 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\IMAGE.JS
2011-07-13 07:25 . 2011-07-13 07:25 51852 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\EXTERNALWRAPPER.JS
2011-07-13 07:25 . 2011-07-13 07:25 20719 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\DIVWRAPPER.JS
2011-07-13 07:25 . 2011-07-13 07:25 23327 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\COMBOBOX.JS
2011-07-13 07:25 . 2011-07-13 07:25 7271 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\CHECKBOX.JS
2011-07-13 07:25 . 2011-07-13 07:25 8782 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\BUTTON.JS
2011-07-07 16:37 . 2011-07-07 16:37 2106216 ----a-w- c:\program files\Mozilla Firefox\D3DCompiler_43.dll
2011-07-07 16:37 . 2011-07-07 16:37 142296 ----a-w- c:\program files\Mozilla Firefox\components\browsercomps.dll
2011-07-07 16:37 . 2011-07-07 16:37 1998168 ----a-w- c:\program files\Mozilla Firefox\d3dx9_43.dll
2011-07-07 16:37 . 2011-07-07 16:37 89048 ----a-w- c:\program files\Mozilla Firefox\libEGL.dll
2011-07-07 16:37 . 2011-07-07 16:37 465880 ----a-w- c:\program files\Mozilla Firefox\libGLESv2.dll
2011-07-07 16:37 . 2011-07-07 16:37 15832 ----a-w- c:\program files\Mozilla Firefox\mozalloc.dll
2011-07-07 16:37 . 2011-07-07 16:37 1850328 ----a-w- c:\program files\Mozilla Firefox\mozjs.dll
2011-07-07 16:37 . 2011-07-07 16:37 781272 ----a-w- c:\program files\Mozilla Firefox\mozsqlite3.dll
2011-07-06 14:19 . 2011-07-06 14:19 -------- d-----w- C:\found.000
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-06-21 12:15 . 2011-05-24 12:32 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-06-21 04:09 . 2006-10-10 20:20 200976 ----a-w- c:\windows\system32\drivers\tmcomm.sys
2011-06-02 14:02 . 2002-08-29 11:00 1858944 ----a-w- c:\windows\system32\win32k.sys
2007-01-11 18:05 . 2007-01-11 18:05 3993088 -c--a-w- c:\program files\LinksysConnectPC.exe
2011-07-07 16:37 . 2011-07-07 16:37 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
2008-12-05 21:20 333192 ----a-w- c:\program files\AskBarDis\bar\bin\askBar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-12-05 333192]
.
[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{3041D03E-FD4B-44E0-B742-2D9B88305F98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-12-05 333192]
.
[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Weather"="c:\program files\AWS\WeatherBug\Weather.exe" [2009-01-30 1347584]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-08-02 7110656]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-10-08 47904]
"Nikon Transfer Monitor"="c:\program files\Common Files\Nikon\Monitor\NkMonitor.exe" [2009-05-29 479232]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2008-12-08 54576]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-06-08 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"AVG_TRAY"="c:\program files\AVG\AVG10\avgtray.exe" [2011-04-18 2334560]
"ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-10-28 207424]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-03-07 421160]
"TkBellExe"="c:\program files\real\realplayer\update\realsched.exe" [2011-05-24 273544]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 39264]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"SRUUninstall"="c:\windows\System32\msiexec.exe" [2008-04-14 78848]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2009-11-18 275072]
Kodak EasyShare software.lnk - c:\program files\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2010-1-27 323584]
Wireless N-lite USB Adapter Utility.lnk - c:\program files\ZyXEL\N220\Common\N220.exe [2011-6-13 1990656]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG10\avgchsvx.exe /sync\0c:\progra~1\AVG\AVG10\avgrsx.exe /sync /restart
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk
backup=c:\windows\pss\Kodak EasyShare software.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2011-06-08 04:02 37296 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DMXLauncher]
2006-08-14 05:07 102400 -c--a-w- c:\program files\Roxio\Media Experience\DMXLauncher.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
2004-07-27 21:50 221184 ----a-w- c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
2004-07-27 21:50 81920 -c--a-w- c:\program files\Common Files\InstallShield\UpdateService\issch.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2011-03-07 19:33 421160 ----a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-29 21:38 421888 ----a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxioDragToDisc]
2006-07-31 13:00 1116920 -c--a-w- c:\program files\Roxio\Drag-to-Disc\DrgToDsc.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxWatchTray]
2006-08-10 16:10 221184 -c--a-w- c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WMPNetworkSvc"=3 (0x3)
"RoxLiveShare9"=2 (0x2)
"Roxio Upnp Server 9"=2 (0x2)
"Roxio UPnP Renderer 9"=3 (0x3)
"gusvc"=3 (0x3)
"Speed Disk service"=2 (0x2)
"NProtectService"=2 (0x2)
"GBPoll"=2 (0x2)
"Creative Service for CDROM Access"=2 (0x2)
"WinDefend"=2 (0x2)
"stllssvr"=3 (0x3)
"RoxWatch9"=2 (0x2)
"RoxMediaDB9"=3 (0x3)
"KodakCCS"=3 (0x3)
"gupdate1c9b60c237cda5c"=2 (0x2)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\IncrediMail\\bin\\IncMail.exe"=
"c:\\Program Files\\ClickTray Calendar\\ClickTray.exe"=
"c:\\Program Files\\Dell\\Support\\Alert\\bin\\AlertView.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\IncrediMail\\bin\\IMApp.exe"=
"c:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe"=
"c:\\WINDOWS\\SYSTEM32\\ftp.exe"=
"c:\\Program Files\\Kyodai Mahjongg\\kmj.exe"=
"c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=
"c:\\Program Files\\IncrediMail\\bin\\IncrediMail_Install.exe"=
"c:\\Program Files\\IncrediMail\\bin\\ImSc.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\SightSpeed\\SightSpeed.exe"=
"c:\\WINDOWS\\SYSTEM32\\dpvsetup.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Sony\\Media Manager for WALKMAN\\MediaManager.exe"=
"c:\\Program Files\\Google\\Google Earth\\client\\googleearth.exe"=
"c:\\Program Files\\AVG\\AVG10\\avgmfapx.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfcCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgplgtupl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgpc01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqusgm.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqusgh.exe"=
"c:\\Program Files\\HP\\HP Software Update\\HPWUCli.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\smart web printing\\SmartWebPrintExe.exe"=
"c:\\WINDOWS\\SYSTEM32\\fxsclnt.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\AVG\\AVG10\\avgdiagex.exe"=
"c:\\Program Files\\AVG\\AVG10\\avgnsx.exe"=
"c:\\Program Files\\AVG\\AVG10\\avgemcx.exe"=
.
R0 AVGIDSEH;AVGIDSEH;c:\windows\SYSTEM32\DRIVERS\AVGIDSEH.sys [9/13/2010 4:27 PM 22992]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\SYSTEM32\DRIVERS\avgrkx86.sys [9/7/2010 3:48 AM 32592]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\SYSTEM32\DRIVERS\avgldx86.sys [9/7/2010 3:48 AM 248656]
R1 Avgtdix;AVG TDI Driver;c:\windows\SYSTEM32\DRIVERS\avgtdix.sys [9/7/2010 3:49 AM 297168]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/17/2010 2:25 PM 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/10/2010 2:41 PM 67656]
R2 avgwd;AVG WatchDog;c:\program files\AVG\AVG10\avgwdsvc.exe [2/8/2011 5:33 AM 269520]
R3 AVGIDSDriver;AVGIDSDriver;c:\windows\SYSTEM32\DRIVERS\AVGIDSDriver.sys [8/19/2010 9:42 PM 134480]
R3 AVGIDSFilter;AVGIDSFilter;c:\windows\SYSTEM32\DRIVERS\AVGIDSFilter.sys [8/19/2010 9:42 PM 24144]
R3 AVGIDSShim;AVGIDSShim;c:\windows\SYSTEM32\DRIVERS\AVGIDSShim.sys [8/19/2010 9:42 PM 27216]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys --> c:\windows\system32\DRIVERS\Lbd.sys [?]
S1 SABKUTIL;SABKUTIL;\??\c:\program files\SUPERAntiSpyware\SABKUTIL.sys --> c:\program files\SUPERAntiSpyware\SABKUTIL.sys [?]
S2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe [4/18/2011 5:39 PM 7398752]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3/18/2010 2:16 PM 130384]
S2 gupdate1c9b60c237cda5c;Google Update Service (gupdate1c9b60c237cda5c);c:\program files\Google\Update\GoogleUpdate.exe [4/5/2009 12:32 PM 133104]
S3 BBSvc;Bing Bar Update Service;c:\program files\Microsoft\BingBar\BBSvc.EXE [2/28/2011 7:44 PM 183560]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [4/5/2009 12:32 PM 133104]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [3/18/2010 2:16 PM 753504]
S3 ZG760_XP;ZyXEL 802.11g XG762 1211 Driver;c:\windows\SYSTEM32\DRIVERS\WlanGZXP.sys [6/15/2011 8:24 PM 519168]
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - ASWMBR
*NewlyCreated* - JAVAQUICKSTARTERSERVICE
*Deregistered* - aswMBR
*Deregistered* - tmcomm
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
HPService REG_MULTI_SZ HPSLPSVC
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder
.
2011-07-28 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]
.
2011-08-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-05 16:32]
.
2011-08-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-05 16:32]
.
2011-08-02 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-800477755-3333981516-2174538972-1007.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-03-29 14:47]
.
2011-08-02 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-800477755-3333981516-2174538972-1007.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-03-29 14:47]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/
mSearch Bar = hxxp://ms101.mysearch.com/sa/srchlft.html
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = localhost;*.local
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office10\EXCEL.EXE/3000
IE: Read EXIF - c:\program files\ArcSoft\RAW Thumbnail Viewer\ArcEXIFM.htm
Trusted Zone: gamehouse.com
Trusted Zone: gamehouse.com\www
TCP: DhcpNameServer = 192.168.1.254
TCP: Interfaces\{FB26B797-C6FF-46EE-AA1A-9C169A0E2F84}: NameServer = 209.26.88.31,204.215.43.3
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: PackageCab - hxxp://ak.imgag.com/imgag/cp/install/AxCtp2.cab
DPF: {0585238B-9CA6-4CCB-A9B2-FE4BA495E880} - hxxp://www.smilecam.com/home/ezwebcam/eng5/common/AXWebMonProj1.cab
DPF: {31150A86-0BBA-409F-BEB4-F3922D10BF34} - hxxp://213.139.220.50/xplug.ocx
DPF: {38578BF0-0ABB-11D3-9330-0080C6F796A1} - hxxp://www.imgag.com/cp/install/AxCtp.cab
DPF: {B991DA79-51F7-4011-98D2-1F2592E82A56} - hxxp://204.118.132.145/2_0/ACNePlayer.cab
DPF: {CA11EB7C-1C85-4577-8A49-9E28EFB30184} - hxxp://www.umediaserver.net/bin/UMediaControl4.cab
FF - ProfilePath - c:\documents and settings\James&Catherine\Application Data\Mozilla\Firefox\Profiles\5glfrwhz.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-sunm&p=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
FF - user.js: yahoo.homepage.dontask - true);user_pref(yahoo.ytff.general.dontshowhpoffer, true
.
- - - - ORPHANS REMOVED - - - -
.
HKCU-RunServicesOnce-washindex - c:\program files\Washer\washidx.exe
SafeBoot-AVG Anti-Spyware Driver
SafeBoot-AVG Anti-Spyware Guard
MSConfigStartUp-osCheck - c:\program files\Norton AntiVirus\osCheck.exe
MSConfigStartUp-Windows Defender - c:\program files\Windows Defender\MSASCui.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-08-02 09:06
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-800477755-3333981516-2174538972-1007\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(704)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\WININET.dll
.
Completion time: 2011-08-02 09:11:23
ComboFix-quarantined-files.txt 2011-08-02 13:11
.
Pre-Run: 55,336,517,632 bytes free
Post-Run: 55,605,256,192 bytes free
.
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn
.
- - End Of File - - 81EA1D8776CB45F296E8ED2A123D63F5

OK, now what???

Thanks again for all the help.
  • 0

#9
ali.B

ali.B

    Trusted Helper

  • Malware Removal
  • 3,086 posts
hi

Step 1

Posted Image Please download Malwarebytes' Anti-Malware from Here.

Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.
Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediatly.

Step 2

ESET Online Scanner


  • Click on the following link to open ESET OnlineScan in a new window.
    ESET OnlineScan
  • Click the Posted Image button.
  • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
    • Click on Posted Image to download the ESET Smart Installer. Save it to your desktop.
    • Double click on the Posted Image icon on your desktop.
  • Check Posted Image
  • Click the Posted Image button.
  • Accept any security warnings from your browser.
  • Check Posted Image
  • Push the Start button.
  • ESET will then download updates for itself, install itself, and begin
    scanning your computer. Please be patient as this can take some time.
  • When the scan completes, push Posted Image
  • Push Posted Image, and save the file to your desktop using a unique name, such as
    ESETScan. Include the contents of this report in your next reply.
  • Push the Posted Image button.
  • Push Posted Image


Things i would like to see in your reply:
  • Malwarebytes Results.
  • Eset scanner report.
  • Update on how your computer is running

  • 0

#10
ctpchatty

ctpchatty

    Member

  • Topic Starter
  • Member
  • PipPip
  • 13 posts
Hi, This has been quite a journey. I could not do one thing that that was place the ESET scanner to my desktop I tried in Firefox and Explorer, the option was not there but I was able to run both scans as requested. My computer seems to be running fine at this point but I have to say I really had very little trouble with it except for the fact that it seemed too slow and now that I have a 10mg (I think that's right) DSL it should fly. Here are your reports:
MBAM: Malwarebytes' Anti-Malware 1.51.1.1800
www.malwarebytes.org

Database version: 7364

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

8/3/2011 10:04:18 AM
mbam-log-2011-08-03 (10-04-18).txt

Scan type: Quick scan
Objects scanned: 196776
Time elapsed: 7 minute(s), 29 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\Typelib\{3C2D2A1E-031F-4397-9614-87C932A848E0} (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{04A38F6B-006F-4247-BA4C-02A139D5531C} (Adware.Minibug) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

ESET:

C:\Documents and Settings\James&Catherine\Local Settings\Application Data\IM\Identities\{A059B429-1616-4966-A216-2A80F87E1D2C}\Message Store\Attachments\Adair_Buy_PermanentEnlarger.HTML JS/Redir.AH trojan cleaned by deleting - quarantined
C:\Documents and Settings\James&Catherine\Local Settings\Application Data\IM\Identities\{A059B429-1616-4966-A216-2A80F87E1D2C}\Message Store\Attachments\Aguirre_Buy_PermanentEnlarger.HTML JS/Redir.AH trojan cleaned by deleting - quarantined
C:\Documents and Settings\James&Catherine\Local Settings\Application Data\IM\Identities\{A059B429-1616-4966-A216-2A80F87E1D2C}\Message Store\Attachments\Alexander_koss_click-EXPLODING-ORGASMS.htm JS/Redir.AH trojan cleaned by deleting - quarantined
C:\Documents and Settings\James&Catherine\Local Settings\Application Data\IM\Identities\{A059B429-1616-4966-A216-2A80F87E1D2C}\Message Store\Attachments\Andgutz-Lose-10poundsIn10days.htm JS/Redir.AH trojan cleaned by deleting - quarantined
C:\Documents and Settings\James&Catherine\Local Settings\Application Data\IM\Identities\{A059B429-1616-4966-A216-2A80F87E1D2C}\Message Store\Attachments\Benavides_Buy_PermanentEnlarger.HTML JS/Redir.AH trojan cleaned by deleting - quarantined
C:\Documents and Settings\James&Catherine\Local Settings\Application Data\IM\Identities\{A059B429-1616-4966-A216-2A80F87E1D2C}\Message Store\Attachments\Bergman_Buy_PermanentEnlarger.HTML JS/Redir.AH trojan cleaned by deleting - quarantined
C:\Documents and Settings\James&Catherine\Local Settings\Application Data\IM\Identities\{A059B429-1616-4966-A216-2A80F87E1D2C}\Message Store\Attachments\BUY_DIET_SENSATION.HTM JS/Redir.AH trojan cleaned by deleting - quarantined
C:\Documents and Settings\James&Catherine\Local Settings\Application Data\IM\Identities\{A059B429-1616-4966-A216-2A80F87E1D2C}\Message Store\Attachments\BUY_HERBALVIAGRA.HTM JS/Redir.AH trojan cleaned by deleting - quarantined
C:\Documents and Settings\James&Catherine\Local Settings\Application Data\IM\Identities\{A059B429-1616-4966-A216-2A80F87E1D2C}\Message Store\Attachments\BUY_LAST_LONGER.HTML JS/Redir.AH trojan cleaned by deleting - quarantined
C:\Documents and Settings\James&Catherine\Local Settings\Application Data\IM\Identities\{A059B429-1616-4966-A216-2A80F87E1D2C}\Message Store\Attachments\BUY_PERMANENTENLARG.HTM JS/Redir.AH trojan cleaned by deleting - quarantined
C:\Documents and Settings\James&Catherine\Local Settings\Application Data\IM\Identities\{A059B429-1616-4966-A216-2A80F87E1D2C}\Message Store\Attachments\BUY_PERMANENTENLARG.HTML JS/Redir.AH trojan cleaned by deleting - quarantined
C:\Documents and Settings\James&Catherine\Local Settings\Application Data\IM\Identities\{A059B429-1616-4966-A216-2A80F87E1D2C}\Message Store\Attachments\BUY_PERMANENTGROWTH.HTML JS/Redir.AH trojan cleaned by deleting - quarantined
C:\Documents and Settings\James&Catherine\Local Settings\Application Data\IM\Identities\{A059B429-1616-4966-A216-2A80F87E1D2C}\Message Store\Attachments\BUY_SPERMCOUNT.HTML JS/Redir.AH trojan cleaned by deleting - quarantined
C:\Documents and Settings\James&Catherine\Local Settings\Application Data\IM\Identities\{A059B429-1616-4966-A216-2A80F87E1D2C}\Message Store\Attachments\Chuckbonta-Lose-10poundsIn10days.htm JS/Redir.AH trojan cleaned by deleting - quarantined
C:\Documents and Settings\James&Catherine\Local Settings\Application Data\IM\Identities\{A059B429-1616-4966-A216-2A80F87E1D2C}\Message Store\Attachments\Clairre9-Lose-10poundsIn10days.htm JS/Redir.AH trojan cleaned by deleting - quarantined
C:\Documents and Settings\James&Catherine\Local Settings\Application Data\IM\Identities\{A059B429-1616-4966-A216-2A80F87E1D2C}\Message Store\Attachments\Clairre9_click-PERMANENTENLARGER.htm JS/Redir.AH trojan cleaned by deleting - quarantined
C:\Documents and Settings\James&Catherine\Local Settings\Application Data\IM\Identities\{A059B429-1616-4966-A216-2A80F87E1D2C}\Message Store\Attachments\Click_ThisAttachment_BIGGERLOADS.htm JS/Redir.AH trojan cleaned by deleting - quarantined
C:\Documents and Settings\James&Catherine\Local Settings\Application Data\IM\Identities\{A059B429-1616-4966-A216-2A80F87E1D2C}\Message Store\Attachments\Ctpchatty_10POUNDSIN10DAYSDIET.HTML JS/Redir.AH trojan cleaned by deleting - quarantined
C:\Documents and Settings\James&Catherine\Local Settings\Application Data\IM\Identities\{A059B429-1616-4966-A216-2A80F87E1D2C}\Message Store\Attachments\Dominix666_click-BIGGERLOADS.htm JS/Redir.AH trojan cleaned by deleting - quarantined
C:\Documents and Settings\James&Catherine\Local Settings\Application Data\IM\Identities\{A059B429-1616-4966-A216-2A80F87E1D2C}\Message Store\Attachments\Gaisaren89_click-PERMANENTENLARGER.htm JS/Redir.AH trojan cleaned by deleting - quarantined
C:\Documents and Settings\James&Catherine\Local Settings\Application Data\IM\Identities\{A059B429-1616-4966-A216-2A80F87E1D2C}\Message Store\Attachments\Godovsky_click-onlineRX.htm JS/Redir.AH trojan cleaned by deleting - quarantined
C:\Documents and Settings\James&Catherine\Local Settings\Application Data\IM\Identities\{A059B429-1616-4966-A216-2A80F87E1D2C}\Message Store\Attachments\Gonzalez_Buy_HERBALVIAGRA.HTML JS/Redir.AH trojan cleaned by deleting - quarantined
C:\Documents and Settings\James&Catherine\Local Settings\Application Data\IM\Identities\{A059B429-1616-4966-A216-2A80F87E1D2C}\Message Store\Attachments\Hnewton102_click-PERMANENTENLARGER.htm JS/Redir.AH trojan cleaned by deleting - quarantined
C:\Documents and Settings\James&Catherine\Local Settings\Application Data\IM\Identities\{A059B429-1616-4966-A216-2A80F87E1D2C}\Message Store\Attachments\Kim_Buy_PermanentEnlarger.HTML JS/Redir.AH trojan cleaned by deleting - quarantined
C:\Documents and Settings\James&Catherine\Local Settings\Application Data\IM\Identities\{A059B429-1616-4966-A216-2A80F87E1D2C}\Message Store\Attachments\Kitsunedesign_click-BIGGERLOADS.htm JS/Redir.AH trojan cleaned by deleting - quarantined
C:\Documents and Settings\James&Catherine\Local Settings\Application Data\IM\Identities\{A059B429-1616-4966-A216-2A80F87E1D2C}\Message Store\Attachments\Leung888_click-PERMANENTENLARGER.htm JS/Redir.AH trojan cleaned by deleting - quarantined
C:\Documents and Settings\James&Catherine\Local Settings\Application Data\IM\Identities\{A059B429-1616-4966-A216-2A80F87E1D2C}\Message Store\Attachments\Marco1683_click-BIGGERLOADS.htm JS/Redir.AH trojan cleaned by deleting - quarantined
C:\Documents and Settings\James&Catherine\Local Settings\Application Data\IM\Identities\{A059B429-1616-4966-A216-2A80F87E1D2C}\Message Store\Attachments\Mireille_de_nijs_10POUNDSIN10DAYSDIET.HTML JS/Redir.AH trojan cleaned by deleting - quarantined
C:\Documents and Settings\James&Catherine\Local Settings\Application Data\IM\Identities\{A059B429-1616-4966-A216-2A80F87E1D2C}\Message Store\Attachments\Mireille_de_nijs_click-PERMANENTENLARGER.htm JS/Redir.AH trojan cleaned by deleting - quarantined
C:\Documents and Settings\James&Catherine\Local Settings\Application Data\IM\Identities\{A059B429-1616-4966-A216-2A80F87E1D2C}\Message Store\Attachments\Nelsonfoo_10POUNDSIN10DAYSDIET.HTML JS/Redir.AH trojan cleaned by deleting - quarantined
C:\Documents and Settings\James&Catherine\Local Settings\Application Data\IM\Identities\{A059B429-1616-4966-A216-2A80F87E1D2C}\Message Store\Attachments\OpenThisHTML_3DayDeliveryRXmed.HTM JS/Redir.AH trojan cleaned by deleting - quarantined
C:\Documents and Settings\James&Catherine\Local Settings\Application Data\IM\Identities\{A059B429-1616-4966-A216-2A80F87E1D2C}\Message Store\Attachments\Paul_Buy_PermanentEnlarger.HTML JS/Redir.AH trojan cleaned by deleting - quarantined
C:\Documents and Settings\James&Catherine\Local Settings\Application Data\IM\Identities\{A059B429-1616-4966-A216-2A80F87E1D2C}\Message Store\Attachments\Rjin26_click-PERMANENTENLARGER.htm JS/Redir.AH trojan cleaned by deleting - quarantined
C:\Documents and Settings\James&Catherine\Local Settings\Application Data\IM\Identities\{A059B429-1616-4966-A216-2A80F87E1D2C}\Message Store\Attachments\Sheppard_Buy_HERBALVIAGRA.HTML JS/Redir.AH trojan cleaned by deleting - quarantined
C:\Documents and Settings\James&Catherine\Local Settings\Application Data\IM\Identities\{A059B429-1616-4966-A216-2A80F87E1D2C}\Message Store\Attachments\Sheridan_Buy_HERBALVIAGRA.HTML JS/Redir.AH trojan cleaned by deleting - quarantined
C:\Documents and Settings\James&Catherine\Local Settings\Application Data\IM\Identities\{A059B429-1616-4966-A216-2A80F87E1D2C}\Message Store\Attachments\Talbot_Buy_PermanentEnlarger.HTML JS/Redir.AH trojan cleaned by deleting - quarantined
C:\Documents and Settings\James&Catherine\Local Settings\Application Data\IM\Identities\{A059B429-1616-4966-A216-2A80F87E1D2C}\Message Store\Attachments\The_assignor_click-PERMANENTENLARGER.htm JS/Redir.AH trojan cleaned by deleting - quarantined
C:\Documents and Settings\James&Catherine\Local Settings\Application Data\IM\Identities\{A059B429-1616-4966-A216-2A80F87E1D2C}\Message Store\Attachments\Tigergirl213_click-onlineRX.htm JS/Redir.AH trojan cleaned by deleting - quarantined
C:\Documents and Settings\James&Catherine\Local Settings\Application Data\IM\Identities\{A059B429-1616-4966-A216-2A80F87E1D2C}\Message Store\Attachments\Tsoupar_click-onlineRX.htm JS/Redir.AH trojan cleaned by deleting - quarantined
C:\Documents and Settings\James&Catherine\Local Settings\Application Data\IM\Identities\{A059B429-1616-4966-A216-2A80F87E1D2C}\Message Store\Attachments\Westbrook_Buy_HERBALVIAGRA.HTML JS/Redir.AH trojan cleaned by deleting - quarantined
C:\Documents and Settings\James&Catherine\Local Settings\Application Data\IM\Identities\{A059B429-1616-4966-A216-2A80F87E1D2C}\Message Store\Attachments\{09D87092-5A10-4E10-891F-9BC7B098AAAF}\Tigergirl213_click-onlineRX.htm JS/Redir.AH trojan cleaned by deleting - quarantined
C:\Documents and Settings\James&Catherine\Local Settings\Application Data\IM\Identities\{A059B429-1616-4966-A216-2A80F87E1D2C}\Message Store\Attachments\{0C76F9E6-92A0-4FCA-AA02-B18348294923}\Kim_Buy_PermanentEnlarger.HTML JS/Redir.AH trojan cleaned by deleting - quarantined
C:\Documents and Settings\James&Catherine\Local Settings\Application Data\IM\Identities\{A059B429-1616-4966-A216-2A80F87E1D2C}\Message Store\Attachments\{6A47A738-70F5-4932-AE25-048D77DE6660}\Kim_Buy_PermanentEnlarger.HTML JS/Redir.AH trojan cleaned by deleting - quarantined
C:\Documents and Settings\James&Catherine\Local Settings\Application Data\IM\Identities\{A059B429-1616-4966-A216-2A80F87E1D2C}\Message Store\Attachments\{79F32077-8DC3-4C53-AAF9-619E26D781E7}\Tsoupar_click-onlineRX.htm JS/Redir.AH trojan cleaned by deleting - quarantined
C:\Documents and Settings\James&Catherine\Local Settings\Application Data\IM\Identities\{A059B429-1616-4966-A216-2A80F87E1D2C}\Message Store\Attachments\{7BF644B7-73C4-4343-BB7C-E68E5F1B27A1}\BUY_PERMANENTENLARG.HTM JS/Redir.AH trojan cleaned by deleting - quarantined
C:\Documents and Settings\James&Catherine\Local Settings\Application Data\IM\Identities\{A059B429-1616-4966-A216-2A80F87E1D2C}\Message Store\Attachments\{7D08A1E4-8855-4AC7-8B7F-B13AF69C8A1D}\BUY_PERMANENTENLARG.HTM JS/Redir.AH trojan cleaned by deleting - quarantined
C:\Documents and Settings\James&Catherine\Local Settings\Application Data\IM\Identities\{A059B429-1616-4966-A216-2A80F87E1D2C}\Message Store\Attachments\{9664BE89-D883-46FB-B899-A645E668C260}\BUY_PERMANENTENLARG.HTM JS/Redir.AH trojan cleaned by deleting - quarantined
C:\Documents and Settings\James&Catherine\Local Settings\Application Data\IM\Identities\{A059B429-1616-4966-A216-2A80F87E1D2C}\Message Store\Attachments\{B8B0AA36-1AC4-47AC-8322-4469440A9110}\Mireille_de_nijs_click-PERMANENT_.htm JS/Redir.AH trojan cleaned by deleting - quarantined
C:\Documents and Settings\James&Catherine\Local Settings\Application Data\IM\Identities\{A059B429-1616-4966-A216-2A80F87E1D2C}\Message Store\Attachments\{D1DEC483-FA40-4DD7-BFEA-11C3837A4EA4}\Kim_Buy_PermanentEnlarger.HTML JS/Redir.AH trojan cleaned by deleting - quarantined
C:\Documents and Settings\James&Catherine\Local Settings\Application Data\IM\Identities\{A059B429-1616-4966-A216-2A80F87E1D2C}\Message Store\Attachments\{D5CEEB86-AF1D-41E1-9D39-6F735B6E3AFF}\Gaisaren89_click-PERMANENTENLARGER.htm JS/Redir.AH trojan cleaned by deleting - quarantined
C:\Documents and Settings\James&Catherine\Local Settings\Application Data\IM\Identities\{A059B429-1616-4966-A216-2A80F87E1D2C}\Message Store\Attachments\{DFBBA46E-DADE-4088-AF10-514CF3E826C1}\Mireille_de_nijs_click-PERMANENT_.htm JS/Redir.AH trojan cleaned by deleting - quarantined
C:\Documents and Settings\James&Catherine\Local Settings\Application Data\IM\Identities\{A059B429-1616-4966-A216-2A80F87E1D2C}\Message Store\Attachments\{F2B710C2-63C4-48D9-99DA-BA05C8848109}\BUY_PERMANENTENLARG.HTM JS/Redir.AH trojan cleaned by deleting - quarantined

I do have with might seem like a silly question could someone using a laptop on my router cause this virus to transfer to my desktop computer somehow? That even sounds wrong to me but I have to ask.
Thanks for your help.
  • 0

#11
ali.B

ali.B

    Trusted Helper

  • Malware Removal
  • 3,086 posts
it could be transmitted over the network.


Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.
  • 0

#12
ctpchatty

ctpchatty

    Member

  • Topic Starter
  • Member
  • PipPip
  • 13 posts
Well I guess my question was not so silly. Thanks so much, here is the newest log:

OTL logfile created on: 8/5/2011 10:31:13 AM - Run 4
OTL by OldTimer - Version 3.2.26.1 Folder = C:\Documents and Settings\James&Catherine\My Documents\Downloads
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.50 Gb Total Physical Memory | 0.67 Gb Available Physical Memory | 44.62% Memory free
3.60 Gb Paging File | 2.79 Gb Available in Paging File | 77.47% Paging File free
Paging file location(s): C:\pagefile.sys 2301 2301 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 111.72 Gb Total Space | 51.36 Gb Free Space | 45.97% Space Free | Partition Type: NTFS

Computer Name: PUMPHREY | User Name: James&Catherine | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/07/29 16:52:51 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\James&Catherine\My Documents\Downloads\OTL.scr
PRC - [2011/07/07 12:37:49 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2011/05/24 08:35:27 | 000,273,544 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Real\RealPlayer\Update\realsched.exe
PRC - [2011/04/18 17:40:08 | 002,334,560 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\avgtray.exe
PRC - [2011/04/18 17:39:42 | 007,398,752 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
PRC - [2011/04/14 05:36:42 | 001,080,672 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\avgnsx.exe
PRC - [2011/03/28 03:00:52 | 000,351,072 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\avgcsrvx.exe
PRC - [2011/03/16 16:05:14 | 000,656,736 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\avgchsvx.exe
PRC - [2011/02/25 11:46:22 | 000,249,648 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft\BingBar\SeaPort.EXE
PRC - [2011/02/10 07:55:18 | 001,148,256 | ---- | M] () -- C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSMonitor.exe
PRC - [2011/02/08 05:33:42 | 000,269,520 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\avgwdsvc.exe
PRC - [2011/02/08 05:33:20 | 000,658,784 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\avgrsx.exe
PRC - [2010/10/27 20:17:52 | 000,207,424 | ---- | M] (ArcSoft Inc.) -- C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
PRC - [2010/08/25 12:27:44 | 000,309,824 | ---- | M] (ArcSoft Inc.) -- C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac
PRC - [2010/03/18 12:19:26 | 000,113,152 | ---- | M] (ArcSoft Inc.) -- C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
PRC - [2010/01/27 10:40:58 | 000,323,584 | ---- | M] (Eastman Kodak Company) -- C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
PRC - [2009/05/29 17:58:46 | 000,479,232 | ---- | M] (Nikon Corporation) -- C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe
PRC - [2009/01/30 11:34:44 | 001,347,584 | ---- | M] (AWS Convergence Technologies, Inc.) -- C:\Program Files\AWS\WeatherBug\Weather.exe
PRC - [2008/04/13 20:12:28 | 000,060,416 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Outlook Express\msimn.exe
PRC - [2008/04/13 20:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007/11/01 19:12:52 | 001,252,232 | ---- | M] () -- C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
PRC - [2003/08/20 10:09:18 | 003,371,520 | ---- | M] (WASEO) -- C:\Program Files\ClickTray Calendar\ClickTray.exe


========== Modules (SafeList) ==========

MOD - [2011/07/29 16:52:51 | 000,579,584 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\James&Catherine\My Documents\Downloads\OTL.scr
MOD - [2011/05/24 08:36:22 | 000,043,520 | ---- | M] (RealNetworks, Inc.) -- C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Chrome\Hook\rpchrome10browserrecordhelper.dll
MOD - [2011/04/18 22:51:18 | 000,653,136 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.6161_x-ww_31a54e43\msvcr90.dll
MOD - [2011/04/18 22:51:18 | 000,569,680 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.6161_x-ww_31a54e43\msvcp90.dll
MOD - [2010/08/23 12:12:02 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] -- -- (HidServ)
SRV - File not found [Disabled | Stopped] -- -- (AppMgmt)
SRV - [2011/04/18 17:39:42 | 007,398,752 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe -- (AVGIDSAgent)
SRV - [2011/02/28 19:44:14 | 000,183,560 | ---- | M] (Microsoft Corporation.) [On_Demand | Stopped] -- C:\Program Files\Microsoft\BingBar\BBSvc.EXE -- (BBSvc)
SRV - [2011/02/25 11:46:22 | 000,249,648 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft\BingBar\SeaPort.EXE -- (SeaPort)
SRV - [2011/02/08 05:33:42 | 000,269,520 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG10\avgwdsvc.exe -- (avgwd)
SRV - [2010/03/18 12:19:26 | 000,113,152 | ---- | M] (ArcSoft Inc.) [Auto | Running] -- C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe -- (ACDaemon)
SRV - [2007/11/01 19:12:52 | 001,252,232 | ---- | M] () [Auto | Running] -- C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe -- (Symantec Core LC)
SRV - [2007/01/09 22:59:32 | 000,108,648 | ---- | M] (Symantec Corporation) [Auto | Stopped] -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe -- (CLTNetCnService)
SRV - [2006/08/10 04:11:14 | 000,057,344 | ---- | M] (Sonic Solutions) [Disabled | Stopped] -- C:\Program Files\Common Files\Sonic Shared\RoxioUPnPRenderer9.exe -- (Roxio UPnP Renderer 9)
SRV - [2006/08/10 04:10:50 | 000,294,912 | ---- | M] (Sonic Solutions) [Disabled | Stopped] -- C:\Program Files\Common Files\Sonic Shared\RoxioUpnpService9.exe -- (Roxio Upnp Server 9)
SRV - [2003/03/03 15:33:40 | 000,143,360 | ---- | M] (Intel® Corporation) [On_Demand | Stopped] -- C:\Program Files\Intel\NCS\Sync\NetSvc.exe -- (NetSvc)


========== Driver Services (SafeList) ==========

DRV - [2011/07/06 19:52:42 | 000,041,272 | ---- | M] (Malwarebytes Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\mbamswissarmy.sys -- (MBAMSwissArmy)
DRV - [2011/04/14 21:28:42 | 000,134,480 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\AVGIDSDriver.sys -- (AVGIDSDriver)
DRV - [2011/04/05 00:59:56 | 000,297,168 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\avgtdix.sys -- (Avgtdix)
DRV - [2011/03/16 16:03:20 | 000,032,592 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\avgrkx86.sys -- (Avgrkx86)
DRV - [2011/03/01 14:25:18 | 000,034,896 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\avgmfx86.sys -- (Avgmfx86)
DRV - [2011/02/22 08:13:02 | 000,022,992 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\AVGIDSEH.Sys -- (AVGIDSEH)
DRV - [2011/02/10 07:53:54 | 000,027,216 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\AVGIDSShim.sys -- (AVGIDSShim)
DRV - [2011/02/10 07:53:52 | 000,024,144 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\AVGIDSFilter.sys -- (AVGIDSFilter)
DRV - [2011/01/07 06:41:46 | 000,248,656 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\avgldx86.sys -- (Avgldx86)
DRV - [2010/05/10 14:41:30 | 000,067,656 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)
DRV - [2010/02/17 14:25:48 | 000,012,872 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)
DRV - [2009/11/19 01:03:18 | 000,803,328 | R--- | M] (Ralink Technology, Corp.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\rt2870.sys -- (rt2870)
DRV - [2009/04/15 07:34:00 | 000,519,168 | R--- | M] (Atheros Technology Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\WlanGZXP.sys -- (ZG760_XP)
DRV - [2008/04/13 14:45:29 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\gameenum.sys -- (gameenum)
DRV - [2007/12/05 08:34:01 | 000,123,952 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\SYMEVENT.SYS -- (SymEvent)
DRV - [2007/10/30 20:55:38 | 000,191,536 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\SYMTDI.SYS -- (SYMTDI)
DRV - [2007/10/30 20:55:34 | 000,027,696 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\Drivers\SYMREDRV.SYS -- (SYMREDRV)
DRV - [2007/10/30 20:55:28 | 000,039,856 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\Drivers\SYMIDS.SYS -- (SYMIDS)
DRV - [2007/10/30 20:55:24 | 000,035,120 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\Drivers\SYMNDIS.SYS -- (SYMNDIS)
DRV - [2007/10/30 20:55:20 | 000,145,968 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\Drivers\SYMFW.SYS -- (SYMFW)
DRV - [2007/10/30 20:55:14 | 000,012,848 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\Drivers\SYMDNS.SYS -- (SYMDNS)
DRV - [2007/08/30 04:00:00 | 000,395,312 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl)
DRV - [2007/01/11 14:10:04 | 000,029,184 | ---- | M] (Gteko Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\goprot51.sys -- (GoProto)
DRV - [2006/08/09 04:30:42 | 000,050,688 | ---- | M] (Sonic Solutions) [File_System | Disabled | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\RxFilter.sys -- (RxFilter)
DRV - [2006/08/08 09:18:50 | 000,009,432 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\SYSTEM32\DLA\DLADResM.SYS -- (DLADResM)
DRV - [2006/08/08 09:18:28 | 000,035,128 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\SYSTEM32\DLA\DLABMFSM.SYS -- (DLABMFSM)
DRV - [2006/08/08 09:18:26 | 000,097,880 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\SYSTEM32\DLA\DLAUDF_M.SYS -- (DLAUDF_M)
DRV - [2006/08/08 09:18:26 | 000,094,680 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\SYSTEM32\DLA\DLAUDFAM.SYS -- (DLAUDFAM)
DRV - [2006/08/08 09:18:24 | 000,026,136 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\SYSTEM32\DLA\DLAOPIOM.SYS -- (DLAOPIOM)
DRV - [2006/08/08 09:18:22 | 000,032,504 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\SYSTEM32\DLA\DLABOIOM.SYS -- (DLABOIOM)
DRV - [2006/08/08 09:18:20 | 000,104,504 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\SYSTEM32\DLA\DLAIFS_M.SYS -- (DLAIFS_M)
DRV - [2006/08/08 09:18:20 | 000,014,552 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\SYSTEM32\DLA\DLAPoolM.SYS -- (DLAPoolM)
DRV - [2006/08/01 20:06:20 | 000,012,952 | ---- | M] (Sonic Solutions) [File_System | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\DLACDBHM.SYS -- (DLACDBHM)
DRV - [2006/08/01 20:06:18 | 000,028,216 | ---- | M] (Sonic Solutions) [File_System | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\DLARTL_M.SYS -- (DLARTL_M)
DRV - [2006/01/07 11:46:46 | 000,010,344 | ---- | M] (Symantec Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\symlcbrd.sys -- (symlcbrd)
DRV - [2005/04/07 17:18:34 | 000,003,840 | ---- | M] () [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\BANTExt.sys -- (BANTExt)
DRV - [2004/08/04 01:29:49 | 000,019,455 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\wvchntxx.sys -- (iAimFP4)
DRV - [2004/08/04 01:29:47 | 000,012,063 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\wsiintxx.sys -- (iAimFP3)
DRV - [2004/08/04 01:29:45 | 000,023,615 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\wch7xxnt.sys -- (iAimTV4)
DRV - [2004/08/04 01:29:43 | 000,033,599 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\watv04nt.sys -- (iAimTV3)
DRV - [2004/08/04 01:29:42 | 000,019,551 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\watv02nt.sys -- (iAimTV1)
DRV - [2004/08/04 01:29:41 | 000,029,311 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\watv01nt.sys -- (iAimTV0)
DRV - [2004/08/04 01:29:37 | 000,012,415 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\wadv01nt.sys -- (iAimFP0)
DRV - [2004/08/04 01:29:37 | 000,012,127 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\wadv02nt.sys -- (iAimFP1)
DRV - [2004/08/04 01:29:37 | 000,011,775 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\wadv05nt.sys -- (iAimFP2)
DRV - [2004/08/04 01:29:36 | 000,161,020 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\i81xnt5.sys -- (i81x)
DRV - [2003/11/06 12:04:24 | 000,068,320 | ---- | M] (PACE Anti-Piracy, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\TPkd.sys -- (TPkd)
DRV - [2003/09/22 12:43:06 | 001,330,048 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\P16X.sys -- (P16X) Creative SB Live! Series (WDM)
DRV - [2003/09/22 08:48:06 | 000,130,192 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\ctsfm2k.sys -- (ctsfm2k)
DRV - [2003/09/22 08:47:38 | 000,178,672 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\ctoss2k.sys -- (ossrv)
DRV - [2003/08/29 04:59:24 | 001,101,696 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\BCMSM.sys -- (BCMModem)
DRV - [2003/03/05 12:19:28 | 000,015,840 | ---- | M] (Creative Technology Ltd.) [Kernel | Auto | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\PFMODNT.SYS -- (PfModNT)
DRV - [2002/11/08 15:45:06 | 000,017,217 | ---- | M] (Dell Computer Corporation) [Kernel | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\omci.sys -- (omci)
DRV - [2002/05/13 20:59:20 | 000,004,272 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\bvrp_pci.sys -- (bvrp_pci)
DRV - [2001/08/17 14:11:06 | 000,066,591 | ---- | M] (3Com Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\EL90XBC5.SYS -- (EL90XBC)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://ms101.mysearc...sa/srchlft.html

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = localhost;*.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "MyStart Search"
FF - prefs.js..browser.search.defaulturl: "http://search.yahoo....r=ytff-sunm&p="
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.yahoo.com/"
FF - prefs.js..extensions.enabledItems: {C0D0F6D1-9FC9-4b0a-B485-D5E13AF40D51}:2.3.54
FF - prefs.js..extensions.enabledItems: {A6A0B3F6-6D2D-4c55-96C1-7481BEA2EBF8}:2.1.73
FF - prefs.js..extensions.enabledItems: {9125C9CB-BE2B-4389-A0C7-46A4BDD46AEA}:0.6.0.3
FF - prefs.js..extensions.enabledItems: myTimeZone@smartgamez.org:1.9.0.18
FF - prefs.js..extensions.enabledItems: {d37dc5d0-431d-44e5-8c91-49419370caa1}:2.7.82
FF - prefs.js..extensions.enabledItems: {ef62e1ce-d2a4-4cdd-b7ec-92b120366b66}:2.7.2
FF - prefs.js..extensions.enabledItems: user@imagiris.txt:1.2
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: kodak-companion@mozilla.com:2.1
FF - prefs.js..extensions.enabledItems: moveplayer@movenetworks.com:7
FF - prefs.js..extensions.enabledItems: personas@christopher.beard:1.6.2
FF - prefs.js..extensions.enabledItems: foxmarks@kei.com:3.9.10
FF - prefs.js..extensions.enabledItems: {195A3098-0BD5-4e90-AE22-BA1C540AFD1E}:2.9.3.1
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:14.0.3
FF - prefs.js..extensions.enabledItems: amznUWL@amazon.com:2.12
FF - prefs.js..extensions.enabledItems: RAWThumbnailViewer@arcsoft.com.cn:2.0.0.11
FF - prefs.js..extensions.enabledItems: {1E73965B-8B48-48be-9C8D-68B920ABC1C4}:10.0.0.1387
FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.3.5.1
FF - prefs.js..network.proxy.no_proxies_on: "localhost"


FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@garmin.com/GpsControl: C:\Program Files\Garmin GPS Plugin\npGarmin.dll (GARMIN Corp.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player: C:\Documents and Settings\James&Catherine\Application Data\Move Networks\plugins\npqmp071505000011.dll (Move Networks)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=12.0.1.647: c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=12.0.1.647: c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=12.0.1.647: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=12.0.1.647: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=12.0.1.647: c:\program files\real\realplayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@real.com/RhapsodyPlayerEngine,version=1.1: C:\Program Files\Real\RhapsodyPlayerEngine\nprhapengine.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.57\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.57\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@umediaserver.net/UMediaPlayer: C:\Program Files\UnrealMediaPlayer5Plugin\npUMediaPlayer5.dll (C Systems - Creative Software Solutions since 1996)
FF - HKLM\Software\MozillaPlugins\@viewpoint.com/VMP: C:\Program Files\Viewpoint\Viewpoint Media Player\npViewpoint.dll ()
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@facebook.com/FBPlugin,version=1.0.3: C:\Documents and Settings\James&Catherine\Application Data\Facebook\npfbplugin_1_0_3.dll ( )
FF - HKCU\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player: C:\Documents and Settings\James&Catherine\Application Data\Move Networks\plugins\npqmp071505000011.dll (Move Networks)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010/11/19 13:50:30 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{B728AB94-9BC7-49b7-B76A-422BB31B2FD0}: C:\Program Files\ArcSoft\Video Downloader\Plugin_FireFox [2010/11/19 16:22:12 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\RAWThumbnailViewer@arcsoft.com.cn: C:\Program Files\ArcSoft\RAW Thumbnail Viewer\FireFox Extension [2010/11/19 16:23:21 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG10\Firefox4\ [2011/08/05 08:18:26 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011/05/24 08:36:26 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/07/07 12:37:53 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/07/26 16:16:14 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\moveplayer@movenetworks.com: C:\Documents and Settings\James&Catherine\Application Data\Move Networks [2009/11/18 12:22:47 | 000,000,000 | -H-D | M]

[2008/06/17 22:34:23 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\James&Catherine\Application Data\Mozilla\Extensions
[2011/08/03 15:28:21 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\James&Catherine\Application Data\Mozilla\Firefox\Profiles\5glfrwhz.default\extensions
[2011/06/25 10:31:54 | 000,000,000 | ---D | M] (Garmin Communicator) -- C:\Documents and Settings\James&Catherine\Application Data\Mozilla\Firefox\Profiles\5glfrwhz.default\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}
[2011/06/25 10:32:03 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\James&Catherine\Application Data\Mozilla\Firefox\Profiles\5glfrwhz.default\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}-trash
[2010/04/27 02:49:19 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\James&Catherine\Application Data\Mozilla\Firefox\Profiles\5glfrwhz.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/07/27 12:03:34 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Documents and Settings\James&Catherine\Application Data\Mozilla\Firefox\Profiles\5glfrwhz.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2009/07/22 23:10:51 | 000,000,000 | ---D | M] (Date Picker/Calendar) -- C:\Documents and Settings\James&Catherine\Application Data\Mozilla\Firefox\Profiles\5glfrwhz.default\extensions\{A6A0B3F6-6D2D-4c55-96C1-7481BEA2EBF8}
[2010/02/11 10:24:53 | 000,000,000 | ---D | M] (Answers) -- C:\Documents and Settings\James&Catherine\Application Data\Mozilla\Firefox\Profiles\5glfrwhz.default\extensions\{C0D0F6D1-9FC9-4b0a-B485-D5E13AF40D51}
[2011/07/11 12:38:05 | 000,000,000 | ---D | M] (FoxClocks) -- C:\Documents and Settings\James&Catherine\Application Data\Mozilla\Firefox\Profiles\5glfrwhz.default\extensions\{d37dc5d0-431d-44e5-8c91-49419370caa1}
[2011/07/07 12:35:17 | 000,000,000 | ---D | M] (FoxLingo) -- C:\Documents and Settings\James&Catherine\Application Data\Mozilla\Firefox\Profiles\5glfrwhz.default\extensions\{ef62e1ce-d2a4-4cdd-b7ec-92b120366b66}
[2007/03/08 21:50:08 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\James&Catherine\Application Data\Mozilla\Firefox\Profiles\5glfrwhz.default\extensions\{fa5fc832-506e-4e98-b01c-2862ce15b7f6}-trash
[2011/03/12 11:29:33 | 000,000,000 | ---D | M] ("Amazon Toolbar") -- C:\Documents and Settings\James&Catherine\Application Data\Mozilla\Firefox\Profiles\5glfrwhz.default\extensions\amznUWL@amazon.com
[2011/06/25 10:32:09 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Documents and Settings\James&Catherine\Application Data\Mozilla\Firefox\Profiles\5glfrwhz.default\extensions\engine@conduit.com
[2011/07/13 10:45:31 | 000,000,000 | ---D | M] ("Xmarks") -- C:\Documents and Settings\James&Catherine\Application Data\Mozilla\Firefox\Profiles\5glfrwhz.default\extensions\foxmarks@kei.com
[2011/03/30 09:50:12 | 000,000,000 | ---D | M] (Kodak EasyShare Gallery Companion) -- C:\Documents and Settings\James&Catherine\Application Data\Mozilla\Firefox\Profiles\5glfrwhz.default\extensions\kodak-companion@mozilla.com
[2009/09/20 16:16:15 | 000,000,000 | ---D | M] (eBay enHancer) -- C:\Documents and Settings\James&Catherine\Application Data\Mozilla\Firefox\Profiles\5glfrwhz.default\extensions\myTimeZone@smartgamez.org
[2011/03/12 11:29:37 | 000,000,000 | ---D | M] (Personas) -- C:\Documents and Settings\James&Catherine\Application Data\Mozilla\Firefox\Profiles\5glfrwhz.default\extensions\personas@christopher.beard
[2009/10/11 19:50:54 | 000,000,000 | ---D | M] (imagiris) -- C:\Documents and Settings\James&Catherine\Application Data\Mozilla\Firefox\Profiles\5glfrwhz.default\extensions\user@imagiris.txt
[2010/12/29 13:10:20 | 000,001,820 | ---- | M] () -- C:\Documents and Settings\James&Catherine\Application Data\Mozilla\Firefox\Profiles\5glfrwhz.default\searchplugins\bing.xml
[2009/07/02 22:15:45 | 000,002,246 | ---- | M] () -- C:\Documents and Settings\James&Catherine\Application Data\Mozilla\Firefox\Profiles\5glfrwhz.default\searchplugins\espn.xml
[2011/08/03 09:32:19 | 000,001,941 | ---- | M] () -- C:\Documents and Settings\James&Catherine\Application Data\Mozilla\Firefox\Profiles\5glfrwhz.default\searchplugins\goodsearch.xml
[2011/08/03 09:32:19 | 000,002,143 | ---- | M] () -- C:\Documents and Settings\James&Catherine\Application Data\Mozilla\Firefox\Profiles\5glfrwhz.default\searchplugins\marketwatch.xml
[2011/03/22 10:32:15 | 000,002,195 | ---- | M] () -- C:\Documents and Settings\James&Catherine\Application Data\Mozilla\Firefox\Profiles\5glfrwhz.default\searchplugins\MyStart Search.xml
[2011/01/16 11:38:36 | 000,001,742 | ---- | M] () -- C:\Documents and Settings\James&Catherine\Application Data\Mozilla\Firefox\Profiles\5glfrwhz.default\searchplugins\search-the-web.xml
[2009/04/10 14:51:20 | 000,002,137 | ---- | M] () -- C:\Documents and Settings\James&Catherine\Application Data\Mozilla\Firefox\Profiles\5glfrwhz.default\searchplugins\yahoo-search.xml
[2011/07/26 16:16:16 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2011/07/26 16:16:17 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
File not found (No name found) --
() (No name found) -- C:\DOCUMENTS AND SETTINGS\JAMES&CATHERINE\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\5GLFRWHZ.DEFAULT\EXTENSIONS\{9125C9CB-BE2B-4389-A0C7-46A4BDD46AEA}.XPI
[2011/08/05 08:18:26 | 000,000,000 | ---D | M] (AVG Safe Search) -- C:\PROGRAM FILES\AVG\AVG10\FIREFOX4
[2009/06/16 11:12:42 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2011/07/07 12:37:51 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2009/11/06 12:37:19 | 000,091,552 | ---- | M] (Coupons, Inc.) -- C:\Program Files\mozilla firefox\plugins\npCouponPrinter.dll
[2011/05/04 04:52:23 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2009/11/06 12:37:20 | 000,091,552 | ---- | M] (Coupons, Inc.) -- C:\Program Files\mozilla firefox\plugins\npMozCouponPrinter.dll
[2002/09/27 08:59:00 | 000,090,112 | ---- | M] () -- C:\Program Files\mozilla firefox\plugins\NpPopup.dll
[2011/07/07 12:37:45 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml

O1 HOSTS File: ([2011/08/02 09:06:06 | 000,000,027 | ---- | M]) - C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (IEPlugin Class) - {11222041-111B-46E3-BD29-EFB2449479B1} - C:\Program Files\ArcSoft\Video Downloader\ArcURLRecord.dll (ArcSoft, Inc.)
O2 - BHO: (AskBar BHO) - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (Ask.com)
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\MNYSIDE.DLL (Microsoft Corporation)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG10\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (ToolbarBHO Class) - {9519AF7E-638D-4933-BAD6-D33D23C79FE5} - C:\Program Files\ArcSoft\RAW Thumbnail Viewer\EXIFToolBar.dll (ArcSoft Inc.)
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (Ask.com)
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (RAW Thumbnail Viewer) - {F301665A-12F8-4331-804A-5BCBD379668C} - C:\Program Files\ArcSoft\RAW Thumbnail Viewer\EXIFToolBar.dll (ArcSoft Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {3041D03E-FD4B-44E0-B742-2D9B88305F98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (Ask.com)
O4 - HKLM..\Run: [ArcSoft Connection Service] C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [Nikon Transfer Monitor] C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe (Nikon Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [TkBellExe] C:\program files\real\realplayer\update\realsched.exe (RealNetworks, Inc.)
O4 - HKCU..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.exe (AWS Convergence Technologies, Inc.)
O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe (Eastman Kodak Company)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Wireless N-lite USB Adapter Utility.lnk = C:\Program Files\ZyXEL\N220\Common\N220.exe (ZyXEL Technology, Corp.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Read EXIF - C:\Program Files\ArcSoft\RAW Thumbnail Viewer\ArcEXIFM.htm ()
O9 - Extra Button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\MNYSIDE.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKCU\..Trusted Domains: ([]msn in My Computer)
O15 - HKCU\..Trusted Domains: gamehouse.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: gamehouse.com ([www] http in Trusted sites)
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} http://housecall60.t...all/xscan60.cab (Reg Error: Key error.)
O16 - DPF: {0585238B-9CA6-4CCB-A9B2-FE4BA495E880} http://www.smilecam....WebMonProj1.cab (Reg Error: Key error.)
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} http://www.pcpitstop...p/PCPitStop.CAB (Reg Error: Key error.)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://fpdownload.ma...director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft....k/?linkid=39204 (Windows Genuine Advantage Validation Tool)
O16 - DPF: {1842B0EE-B597-11D4-8997-00104BD12D94} http://www.pcpitstop...cpConnCheck.cab (Reg Error: Key error.)
O16 - DPF: {1851174C-97BD-4217-A0CC-E908F60D5B7A} https://h50203.www5....DataManager.CAB (Reg Error: Key error.)
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} http://security.syma...bin/AvSniff.cab (Reg Error: Key error.)
O16 - DPF: {31150A86-0BBA-409F-BEB4-F3922D10BF34} http://213.139.220.50/xplug.ocx (Reg Error: Key error.)
O16 - DPF: {3451DEDE-631F-421C-8127-FD793AFC6CC8} https://www-secure.s...rl/SymAData.cab (Reg Error: Key error.)
O16 - DPF: {38578BF0-0ABB-11D3-9330-0080C6F796A1} http://www.imgag.com...stall/AxCtp.cab (Create & Print ActiveX Plug-in)
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} http://office.micros...ontent/opuc.cab (Office Update Installation Engine)
O16 - DPF: {44990200-3C9D-426D-81DF-AAB636FA4345} https://www-secure.s...trl/tgctlsi.cab (Reg Error: Value error.)
O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} https://www-secure.s...trl/tgctlsr.cab (Reg Error: Value error.)
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} http://ipgweb.cce.hp...ads/sysinfo.cab (Reg Error: Key error.)
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} http://tools.ebayimg...l_v1-0-3-17.cab (Reg Error: Key error.)
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} http://security.syma...n/bin/cabsa.cab (Reg Error: Key error.)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.micros...b?1147493282437 (MUWebControl Class)
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} https://h20436.www2....re/HPDEXAXO.cab (Reg Error: Key error.)
O16 - DPF: {745395C8-D0E1-4227-8586-624CA9A10A8D} http://144.122.47.203/activex/AMC.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {90051A81-3018-4826-8B38-DD60B6B53F9C} http://www.snapfish....pfishUpload.cab (Reg Error: Key error.)
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} http://194.168.163.9...sCamControl.cab (Reg Error: Key error.)
O16 - DPF: {94B82441-A413-4E43-8422-D49930E69764} https://rtc1.webresp...p/TLIEFlash.CAB (Reg Error: Key error.)
O16 - DPF: {A93B47FD-9BF6-4DA8-97FC-9270B9D64A6C} http://www.dlink.com...in/h263ctrl.cab (Reg Error: Key error.)
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} http://zone.msn.com/...ro.cab27513.cab (Reg Error: Key error.)
O16 - DPF: {B991DA79-51F7-4011-98D2-1F2592E82A56} http://204.118.132.1.../ACNePlayer.cab (ACNPlayer2 Class)
O16 - DPF: {BB383206-6DA1-4E80-B62A-3DF950FCC697} http://di.imgag.com/...tall/AxCtp2.cab (Reg Error: Key error.)
O16 - DPF: {BD8667B7-38D8-4C77-B580-18C3E146372C} http://www.imgag.com...all/Crusher.cab (Creative Toolbox Plug-in)
O16 - DPF: {CA11EB7C-1C85-4577-8A49-9E28EFB30184} http://www.umediaser...diaControl4.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0014-0000-0000-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} https://www-secure.s...sa/SymAData.cab (Reg Error: Key error.)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macr...swflash5r42.cab (Shockwave Flash Object)
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} http://www.popcap.co...aploader_v6.cab (Reg Error: Key error.)
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} https://www-secure.s.../ActiveData.cab (Reg Error: Key error.)
O16 - DPF: {E7D2588A-7FB5-47DC-8830-832605661009} http://liveca12.cust...l/java/RntX.cab (Reg Error: Key error.)
O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} http://tools.ebayimg...ol_v1-0-3-0.cab (Reg Error: Key error.)
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} http://h30155.www3.h.../qdiagh.cab?326 (QDiagHUpdateObj Class)
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} http://www2.incredim...er/imloader.cab (IMDownloader Class)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O16 - DPF: PackageCab http://ak.imgag.com/...tall/AxCtp2.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O18 - Protocol\Handler\belarc {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files\Belarc\Advisor\System\BAVoilaX.dll (Belarc, Inc.)
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG10\avgpp.dll (AVG Technologies CZ, s.r.o.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O24 - Desktop WallPaper: C:\Documents and Settings\James&Catherine\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\James&Catherine\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005/05/09 17:49:58 | 000,000,659 | ---- | M] () - C:\autoAlbum.log -- [ NTFS ]
O32 - AutoRun File - [2002/09/03 10:59:58 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgchsvx.exe /sync) - C:\Program Files\AVG\AVG10\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgrsx.exe /sync /restart) - C:\Program Files\AVG\AVG10\avgrsx.exe (AVG Technologies CZ, s.r.o.)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/08/03 20:51:17 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2011/08/03 10:10:19 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2011/08/03 09:53:57 | 000,000,000 | ---D | C] -- C:\Documents and Settings\James&Catherine\Application Data\Malwarebytes
[2011/08/03 09:53:26 | 000,041,272 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011/08/03 09:53:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/08/03 09:53:25 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2011/08/03 09:53:20 | 000,022,712 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2011/08/03 09:53:19 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2011/08/02 08:49:47 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2011/08/02 08:47:04 | 000,518,144 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2011/08/02 08:47:04 | 000,406,528 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2011/08/02 08:47:04 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2011/08/02 08:47:04 | 000,060,416 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2011/08/02 08:46:41 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2011/08/02 08:46:30 | 000,000,000 | ---D | C] -- C:\Qoobox
[2011/07/28 10:56:37 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\James&Catherine\Recent
[2011/07/26 16:17:30 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Sun
[2011/07/26 16:17:28 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[2007/01/11 14:05:29 | 003,993,088 | ---- | C] (Linksys, a Division of Cisco Systems, Inc.) -- C:\Program Files\LinksysConnectPC.exe
[2006/07/11 14:29:00 | 000,028,672 | R--- | C] ( ) -- C:\WINDOWS\System32\DivXGraphBuilderCallback.dll
[28 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/08/05 10:19:00 | 000,000,886 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/08/05 09:51:43 | 000,000,306 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-800477755-3333981516-2174538972-1007.job
[2011/08/05 09:51:43 | 000,000,298 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-800477755-3333981516-2174538972-1007.job
[2011/08/05 08:18:27 | 000,000,690 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\AVG 2011.lnk
[2011/08/05 08:15:14 | 126,978,706 | ---- | M] () -- C:\WINDOWS\System32\drivers\AVG\incavi.avm
[2011/08/05 04:24:26 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\James&Catherine\Local Settings\Application Data\prvlcl.dat
[2011/08/04 14:19:00 | 000,000,882 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/08/04 13:51:03 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2011/08/04 11:24:27 | 000,234,259 | ---- | M] () -- C:\Documents and Settings\James&Catherine\My Documents\bingo 4.JPG
[2011/08/04 11:24:27 | 000,000,252 | -H-- | M] () -- C:\Documents and Settings\James&Catherine\My Documents\.picasa.ini
[2011/08/04 10:56:26 | 000,015,386 | ---- | M] () -- C:\Documents and Settings\James&Catherine\My Documents\bingo 10.png
[2011/08/04 10:55:56 | 000,015,386 | ---- | M] () -- C:\Documents and Settings\James&Catherine\My Documents\bingo 11.png
[2011/08/04 10:54:45 | 000,009,611 | ---- | M] () -- C:\Documents and Settings\James&Catherine\My Documents\bingo 9.jpg
[2011/08/04 10:54:11 | 000,031,794 | ---- | M] () -- C:\Documents and Settings\James&Catherine\My Documents\bingo 9.png
[2011/08/04 10:53:25 | 000,008,542 | ---- | M] () -- C:\Documents and Settings\James&Catherine\My Documents\bingo 8.jpg
[2011/08/04 10:52:14 | 000,013,093 | ---- | M] () -- C:\Documents and Settings\James&Catherine\My Documents\bingo 7.jpg
[2011/08/04 10:51:48 | 000,032,010 | ---- | M] () -- C:\Documents and Settings\James&Catherine\My Documents\bingo 6.jpg
[2011/08/04 10:45:55 | 000,057,935 | ---- | M] () -- C:\Documents and Settings\James&Catherine\My Documents\bingo 5.jpg
[2011/08/04 10:43:00 | 000,013,145 | ---- | M] () -- C:\Documents and Settings\James&Catherine\My Documents\bingo 3.jpg
[2011/08/04 10:39:32 | 000,031,173 | ---- | M] () -- C:\Documents and Settings\James&Catherine\My Documents\bingo 2.jpg
[2011/08/04 10:38:52 | 000,010,145 | ---- | M] () -- C:\Documents and Settings\James&Catherine\My Documents\Bingo 1.jpeg
[2011/08/04 10:24:25 | 000,148,480 | ---- | M] () -- C:\Documents and Settings\James&Catherine\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/08/03 09:53:27 | 000,000,784 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/08/03 00:30:01 | 000,001,170 | ---- | M] () -- C:\WINDOWS\System32\WPA.DBL
[2011/08/03 00:27:52 | 000,029,204 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
[2011/08/03 00:27:32 | 000,002,048 | --S- | M] () -- C:\WINDOWS\BOOTSTAT.DAT
[2011/08/03 00:27:24 | 1609,633,792 | -HS- | M] () -- C:\hiberfil.sys
[2011/08/02 09:06:06 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\ETC\hosts
[2011/08/02 08:49:56 | 000,000,327 | RHS- | M] () -- C:\BOOT.INI
[2011/07/29 10:45:29 | 000,000,512 | ---- | M] () -- C:\Documents and Settings\James&Catherine\My Documents\MBR.dat
[2011/07/29 10:37:28 | 000,000,512 | ---- | M] () -- C:\Documents and Settings\James&Catherine\Desktop\MBR.dat
[2011/07/28 12:30:18 | 000,172,575 | ---- | M] () -- C:\Documents and Settings\James&Catherine\Local Settings\Application Data\census.cache
[2011/07/28 12:30:13 | 000,264,193 | ---- | M] () -- C:\Documents and Settings\James&Catherine\Local Settings\Application Data\ars.cache
[2011/07/28 12:16:58 | 000,000,036 | ---- | M] () -- C:\Documents and Settings\James&Catherine\Local Settings\Application Data\housecall.guid.cache
[2011/07/19 11:07:29 | 000,000,020 | -H-- | M] () -- C:\Documents and Settings\All Users\Application Data\PKP_DLdu.DAT
[2011/07/17 12:17:18 | 000,165,646 | ---- | M] () -- C:\Documents and Settings\James&Catherine\My Documents\0717111200.jpg
[2011/07/13 03:24:06 | 000,461,232 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011/07/07 15:14:14 | 000,222,497 | ---- | M] () -- C:\WINDOWS\System32\drivers\AVG\iavichjg.avm
[2011/07/06 19:52:42 | 000,041,272 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011/07/06 19:52:42 | 000,022,712 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[28 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/08/04 11:24:27 | 000,234,259 | ---- | C] () -- C:\Documents and Settings\James&Catherine\My Documents\bingo 4.JPG
[2011/08/04 10:55:56 | 000,015,386 | ---- | C] () -- C:\Documents and Settings\James&Catherine\My Documents\bingo 11.png
[2011/08/04 10:55:30 | 000,015,386 | ---- | C] () -- C:\Documents and Settings\James&Catherine\My Documents\bingo 10.png
[2011/08/04 10:54:44 | 000,009,611 | ---- | C] () -- C:\Documents and Settings\James&Catherine\My Documents\bingo 9.jpg
[2011/08/04 10:54:10 | 000,031,794 | ---- | C] () -- C:\Documents and Settings\James&Catherine\My Documents\bingo 9.png
[2011/08/04 10:53:24 | 000,008,542 | ---- | C] () -- C:\Documents and Settings\James&Catherine\My Documents\bingo 8.jpg
[2011/08/04 10:52:14 | 000,013,093 | ---- | C] () -- C:\Documents and Settings\James&Catherine\My Documents\bingo 7.jpg
[2011/08/04 10:51:47 | 000,032,010 | ---- | C] () -- C:\Documents and Settings\James&Catherine\My Documents\bingo 6.jpg
[2011/08/04 10:45:54 | 000,057,935 | ---- | C] () -- C:\Documents and Settings\James&Catherine\My Documents\bingo 5.jpg
[2011/08/04 10:43:00 | 000,013,145 | ---- | C] () -- C:\Documents and Settings\James&Catherine\My Documents\bingo 3.jpg
[2011/08/04 10:39:31 | 000,031,173 | ---- | C] () -- C:\Documents and Settings\James&Catherine\My Documents\bingo 2.jpg
[2011/08/04 10:38:48 | 000,010,145 | ---- | C] () -- C:\Documents and Settings\James&Catherine\My Documents\Bingo 1.jpeg
[2011/08/03 09:53:27 | 000,000,784 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/08/02 08:49:56 | 000,000,211 | ---- | C] () -- C:\Boot.bak
[2011/08/02 08:49:49 | 000,260,272 | RHS- | C] () -- C:\cmldr
[2011/08/02 08:47:04 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2011/08/02 08:47:04 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2011/08/02 08:47:04 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2011/08/02 08:47:04 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2011/08/02 08:47:04 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2011/07/29 10:45:29 | 000,000,512 | ---- | C] () -- C:\Documents and Settings\James&Catherine\My Documents\MBR.dat
[2011/07/29 10:37:28 | 000,000,512 | ---- | C] () -- C:\Documents and Settings\James&Catherine\Desktop\MBR.dat
[2011/07/28 12:30:18 | 000,172,575 | ---- | C] () -- C:\Documents and Settings\James&Catherine\Local Settings\Application Data\census.cache
[2011/07/28 12:30:13 | 000,264,193 | ---- | C] () -- C:\Documents and Settings\James&Catherine\Local Settings\Application Data\ars.cache
[2011/07/28 12:16:58 | 000,000,036 | ---- | C] () -- C:\Documents and Settings\James&Catherine\Local Settings\Application Data\housecall.guid.cache
[2011/07/17 12:25:00 | 000,165,646 | ---- | C] () -- C:\Documents and Settings\James&Catherine\My Documents\0717111200.jpg
[2011/07/07 12:37:57 | 000,000,730 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Mozilla Firefox.lnk
[2011/06/13 15:41:06 | 000,013,931 | R--- | C] () -- C:\WINDOWS\System32\RaCoInst.dat
[2011/06/11 09:59:35 | 000,400,578 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-800477755-3333981516-2174538972-1007-0.dat
[2010/12/27 11:28:42 | 000,400,578 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat
[2010/11/19 13:36:41 | 000,207,001 | ---- | C] () -- C:\WINDOWS\hpoins46.dat
[2010/11/19 13:36:41 | 000,000,574 | ---- | C] () -- C:\WINDOWS\hpomdl46.dat
[2010/03/17 20:01:35 | 000,000,121 | ---- | C] () -- C:\WINDOWS\Sansa Media Converter.INI
[2010/03/06 11:15:09 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\James&Catherine\Local Settings\Application Data\prvlcl.dat
[2010/03/03 10:06:00 | 000,044,032 | ---- | C] () -- C:\WINDOWS\unwash.exe
[2008/09/14 16:04:03 | 000,269,824 | ---- | C] () -- C:\Documents and Settings\James&Catherine\Local Settings\Application Data\rx_audio.Cache
[2008/03/12 22:24:04 | 000,003,072 | ---- | C] () -- C:\Documents and Settings\James&Catherine\Application Data\DMX.bmk
[2008/03/12 18:55:24 | 000,056,056 | ---- | C] () -- C:\WINDOWS\System32\DLAAPI_W.DLL
[2008/01/14 18:47:06 | 000,099,712 | ---- | C] () -- C:\WINDOWS\HPBroker.dll
[2007/12/26 19:59:58 | 000,000,268 | RH-- | C] () -- C:\Documents and Settings\All Users\Application Data\Helper Scripts
[2007/12/26 19:59:58 | 000,000,268 | RH-- | C] () -- C:\Documents and Settings\James&Catherine\Application Data\Guitars
[2007/12/26 19:59:58 | 000,000,020 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\PKP_DLdu.DAT
[2007/12/26 19:59:58 | 000,000,012 | RH-- | C] () -- C:\Documents and Settings\All Users\Application Data\Hybrid Basic
[2007/11/15 09:47:56 | 000,000,031 | -H-- | C] () -- C:\WINDOWS\uccspecc.sys
[2007/10/11 11:17:58 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
[2007/07/19 13:25:34 | 000,000,022 | ---- | C] () -- C:\Documents and Settings\James&Catherine\Local Settings\Application Data\kodakpcd.ini
[2007/02/18 17:57:12 | 000,000,414 | ---- | C] () -- C:\WINDOWS\videoimp.ini
[2007/02/18 17:56:24 | 000,010,240 | ---- | C] () -- C:\WINDOWS\System32\vidx16.dll
[2007/02/18 17:55:14 | 000,032,528 | ---- | C] () -- C:\WINDOWS\AMCAP.EXE
[2007/02/08 13:51:43 | 000,063,730 | ---- | C] () -- C:\Program Files\viewsonicinstruct_xp.pdf
[2007/02/08 13:51:09 | 000,000,085 | ---- | C] () -- C:\WINDOWS\VSWizard.ini
[2007/01/10 14:12:34 | 000,000,214 | ---- | C] () -- C:\WINDOWS\HP_48BitScanUpdatePatch.ini
[2006/11/23 17:27:07 | 020,119,552 | ---- | C] () -- C:\Documents and Settings\James&Catherine\Local Settings\Application Data\rx_image.Cache
[2006/11/16 12:44:17 | 000,001,755 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2006/11/13 10:46:08 | 000,006,659 | ---- | C] () -- C:\WINDOWS\mozver.dat
[2006/10/27 15:42:21 | 000,002,150 | ---- | C] () -- C:\WINDOWS\System32\tmmute.ini
[2006/10/09 14:56:55 | 000,000,000 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\DRM
[2006/09/28 15:52:04 | 000,002,696 | ---- | C] () -- C:\WINDOWS\MIXDEF.INI
[2006/09/10 18:09:24 | 000,003,840 | ---- | C] () -- C:\WINDOWS\System32\drivers\BANTExt.sys
[2006/09/04 17:56:13 | 000,000,000 | ---- | C] () -- C:\WINDOWS\PROTOCOL.INI
[2006/08/16 14:47:38 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini
[2006/08/09 04:19:50 | 000,520,192 | ---- | C] () -- C:\WINDOWS\System32\CddbPlaylist2Roxio.dll
[2006/08/09 04:19:50 | 000,204,800 | ---- | C] () -- C:\WINDOWS\System32\CddbFileTaggerRoxio.dll
[2006/08/09 01:00:00 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\besch.exe
[2006/08/09 01:00:00 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\besched.dll
[2005/08/26 16:28:34 | 000,143,360 | ---- | C] () -- C:\WINDOWS\unzip.exe
[2005/08/26 16:28:20 | 000,024,576 | ---- | C] () -- C:\WINDOWS\shortcut.exe
[2005/08/26 16:27:58 | 000,045,056 | ---- | C] () -- C:\WINDOWS\devenum.exe
[2005/08/23 10:38:51 | 000,000,208 | ---- | C] () -- C:\WINDOWS\HpBestModeUpdatePatchLog.ini
[2005/08/20 22:25:52 | 000,000,004 | ---- | C] () -- C:\WINDOWS\RM_RESULT.DAT
[2005/08/20 22:25:15 | 000,000,170 | ---- | C] () -- C:\WINDOWS\GetServer.ini
[2005/08/02 17:35:00 | 001,662,976 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
[2005/08/02 17:35:00 | 001,519,616 | ---- | C] () -- C:\WINDOWS\System32\nwiz.exe
[2005/08/02 17:35:00 | 001,466,368 | ---- | C] () -- C:\WINDOWS\System32\nview.dll
[2005/08/02 17:35:00 | 001,339,392 | ---- | C] () -- C:\WINDOWS\System32\nvdspsch.exe
[2005/08/02 17:35:00 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll
[2005/08/02 17:35:00 | 000,540,672 | ---- | C] () -- C:\WINDOWS\System32\nvhwvid.dll
[2005/08/02 17:35:00 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll
[2005/08/02 17:35:00 | 000,442,368 | ---- | C] () -- C:\WINDOWS\System32\nvappbar.exe
[2005/08/02 17:35:00 | 000,393,216 | ---- | C] () -- C:\WINDOWS\System32\keystone.exe
[2005/08/02 17:35:00 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll
[2005/07/15 14:36:35 | 000,524,288 | ---- | C] () -- C:\WINDOWS\System32\DivXsm.exe
[2005/07/15 14:35:56 | 000,831,488 | ---- | C] () -- C:\WINDOWS\System32\libeay32.dll
[2005/07/15 14:35:56 | 000,159,744 | ---- | C] () -- C:\WINDOWS\System32\ssleay32.dll
[2005/07/15 14:35:24 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2005/07/10 15:37:10 | 000,189,952 | ---- | C] () -- C:\WINDOWS\System32\Qcard32.dll
[2005/05/09 18:56:38 | 000,000,000 | ---- | C] () -- C:\WINDOWS\hpqEmlSz.INI
[2005/05/09 18:29:50 | 000,104,253 | ---- | C] () -- C:\WINDOWS\hpoins04.dat.temp
[2005/05/07 13:27:03 | 000,000,044 | ---- | C] () -- C:\WINDOWS\liveup.ini
[2005/05/03 11:44:44 | 000,025,157 | ---- | C] () -- C:\WINDOWS\RMAgentOutput.dll
[2005/05/03 11:43:44 | 000,126,976 | ---- | C] () -- C:\WINDOWS\dllTSCLIBMT.dll
[2005/04/30 13:49:30 | 000,000,020 | ---- | C] () -- C:\WINDOWS\viewer.ini
[2005/04/28 14:36:22 | 000,100,724 | ---- | C] () -- C:\WINDOWS\cpeins04.dat
[2005/04/28 14:36:22 | 000,017,176 | ---- | C] () -- C:\WINDOWS\hpomdl04.dat.temp
[2005/03/19 18:13:22 | 000,000,211 | ---- | C] () -- C:\WINDOWS\btw.ini
[2005/03/19 18:13:19 | 000,111,104 | ---- | C] () -- C:\WINDOWS\System32\MVCL13N.DLL
[2005/03/19 18:11:35 | 000,000,000 | ---- | C] () -- C:\WINDOWS\Launcher.INI
[2005/03/19 18:11:20 | 000,000,384 | ---- | C] () -- C:\WINDOWS\SIERRA.INI
[2005/03/03 16:16:42 | 000,000,256 | ---- | C] () -- C:\WINDOWS\aucfg.ini
[2005/03/03 16:04:23 | 000,012,344 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
[2004/10/14 10:54:47 | 000,037,027 | ---- | C] () -- C:\WINDOWS\atmoUn.exe
[2004/10/04 20:41:04 | 000,006,550 | ---- | C] () -- C:\WINDOWS\jautoexp.dat
[2004/10/04 03:54:12 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2004/10/01 17:33:46 | 000,000,679 | ---- | C] () -- C:\WINDOWS\TSC.ini
[2004/09/21 00:51:54 | 000,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2004/08/12 16:45:02 | 000,000,051 | ---- | C] () -- C:\WINDOWS\popcinfo.dat
[2004/07/12 11:36:21 | 000,000,022 | ---- | C] () -- C:\WINDOWS\kodakpcd.James&Catherine.ini
[2004/07/10 19:55:38 | 000,252,416 | ---- | C] () -- C:\WINDOWS\System32\wsiShared.dll
[2004/03/10 23:29:34 | 000,000,138 | ---- | C] () -- C:\Documents and Settings\James&Catherine\Local Settings\Application Data\fusioncache.dat
[2004/02/11 19:26:36 | 000,000,004 | ---- | C] () -- C:\WINDOWS\uccspecb.sys
[2004/01/26 18:23:06 | 000,000,000 | ---- | C] () -- C:\WINDOWS\MSDraw.ini
[2004/01/04 22:05:04 | 000,000,002 | ---- | C] () -- C:\WINDOWS\msoffice.ini
[2003/12/31 23:28:42 | 000,148,480 | ---- | C] () -- C:\Documents and Settings\James&Catherine\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2003/12/31 18:59:42 | 000,004,272 | ---- | C] () -- C:\WINDOWS\System32\drivers\bvrp_pci.sys
[2003/12/30 00:06:02 | 000,000,174 | ---- | C] () -- C:\WINDOWS\System32\mcini.ini
[2003/12/13 04:18:27 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2003/12/13 04:14:33 | 000,149,504 | ---- | C] () -- C:\WINDOWS\UNWISE.EXE
[2003/12/13 04:11:35 | 000,000,335 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2003/12/13 04:11:28 | 001,048,576 | ---- | C] () -- C:\WINDOWS\System32\SFMAN.DAT
[2003/12/13 04:11:28 | 000,000,231 | ---- | C] () -- C:\WINDOWS\AC3API.INI
[2003/12/13 04:11:14 | 000,047,616 | ---- | C] () -- C:\WINDOWS\System32\P16X.dll
[2003/12/13 04:11:14 | 000,002,516 | ---- | C] () -- C:\WINDOWS\System32\P16X.ini
[2003/12/13 04:11:14 | 000,000,026 | ---- | C] () -- C:\WINDOWS\System32\ctzapxx.ini
[2003/12/13 04:11:13 | 000,000,064 | ---- | C] () -- C:\WINDOWS\P16x.ini
[2003/12/13 04:10:45 | 000,000,245 | ---- | C] () -- C:\WINDOWS\SBWIN.INI
[2003/12/13 04:09:34 | 000,000,928 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2003/12/13 04:05:51 | 000,000,891 | ---- | C] () -- C:\WINDOWS\orun32.ini
[2003/12/13 03:52:16 | 000,002,048 | --S- | C] () -- C:\WINDOWS\BOOTSTAT.DAT
[2003/12/13 03:50:53 | 000,363,520 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2003/12/13 03:50:08 | 000,483,004 | ---- | C] () -- C:\WINDOWS\System32\PERFH009.DAT
[2003/12/13 03:50:08 | 000,080,408 | ---- | C] () -- C:\WINDOWS\System32\PERFC009.DAT
[2003/12/13 03:38:50 | 000,000,547 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2003/10/02 01:00:00 | 000,208,896 | ---- | C] () -- C:\WINDOWS\System32\lockout.dll
[2003/10/02 01:00:00 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\lockres.dll
[2003/04/04 12:59:08 | 000,143,360 | ---- | C] () -- C:\WINDOWS\System32\ACNePlayer.dll
[2002/09/30 07:15:30 | 000,461,232 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2002/09/30 07:10:58 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2002/09/03 10:59:14 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2002/09/03 10:56:30 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2002/09/03 10:31:46 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\OEMBIOS.BIN
[2002/09/03 10:31:44 | 000,004,594 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2002/08/29 07:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\MLANG.DAT
[2002/08/29 07:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\PERFI009.DAT
[2002/08/29 07:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\DSSEC.DAT
[2002/08/29 07:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\MIB.BIN
[2002/08/29 07:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\PERFD009.DAT
[2002/08/29 07:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2002/08/29 07:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\NOISE.DAT
[2002/07/04 15:05:34 | 000,000,269 | ---- | C] () -- C:\WINDOWS\tmupdate.ini
[2002/03/14 12:00:26 | 000,038,567 | ---- | C] () -- C:\WINDOWS\System32\pcpbios.exe
[2001/12/14 13:34:46 | 000,164,864 | ---- | C] () -- C:\WINDOWS\patchw32.dll
[1999/07/23 13:46:48 | 000,000,116 | ---- | C] () -- C:\WINDOWS\AuHCcup1.ini
[1999/07/23 10:53:20 | 000,129,536 | ---- | C] () -- C:\WINDOWS\AuHCcup1.dll
[1999/05/21 21:10:00 | 000,115,200 | ---- | C] () -- C:\WINDOWS\System32\UnzDll.dll
[1999/01/22 14:46:56 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\MSRTEDIT.DLL
[1998/08/16 05:00:00 | 000,004,096 | ---- | C] () -- C:\WINDOWS\System32\sysres.dll
[1980/01/01 02:00:00 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\e100bmsg.dll

========== LOP Check ==========

[2010/10/21 09:40:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVG10
[2010/10/21 09:28:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\avg9
[2003/12/13 04:09:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\BVRP Software
[2010/10/21 09:39:39 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\Common Files
[2007/12/26 19:59:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\EnterNHelp
[2010/05/11 14:45:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\GARMIN
[2008/05/11 09:58:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Grisoft
[2007/01/21 10:52:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Hallmark
[2008/04/29 12:21:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\IM
[2008/04/29 12:19:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\IncrediMail
[2011/04/15 00:31:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MFAData
[2007/12/26 20:00:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Nikon
[2006/10/09 14:56:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PACE Anti-Piracy
[2011/03/22 10:34:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Photo Notifier and Animation Creator
[2010/04/08 08:48:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PhotoMail
[2004/08/24 14:57:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PopCap
[2008/05/03 12:43:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Sony
[2010/11/24 11:47:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2007/12/26 19:59:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Ultima_T15
[2008/03/18 17:31:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint
[2010/11/19 14:41:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Visan
[2009/04/02 14:45:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
[2010/05/06 15:47:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2009/10/12 17:10:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2009/04/09 14:19:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2005/06/04 14:32:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James&Catherine\Application Data\123 Free Solitaire
[2007/07/07 19:09:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James&Catherine\Application Data\Aim
[2010/10/21 09:40:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James&Catherine\Application Data\AVG10
[2008/10/01 10:31:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James&Catherine\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2009/04/13 18:11:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James&Catherine\Application Data\Dealio
[2008/01/09 15:43:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James&Catherine\Application Data\EA
[2006/01/05 18:29:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James&Catherine\Application Data\EarthLink
[2010/06/21 18:21:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James&Catherine\Application Data\Facebook
[2010/05/11 14:40:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James&Catherine\Application Data\GARMIN
[2006/10/06 01:56:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James&Catherine\Application Data\IrfanView
[2003/12/29 19:50:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James&Catherine\Application Data\Leadertech
[2008/05/11 12:30:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James&Catherine\Application Data\LimeWire
[2007/02/13 11:50:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James&Catherine\Application Data\MailWasherPro
[2006/03/22 14:24:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James&Catherine\Application Data\Musicmatch
[2007/12/26 20:03:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James&Catherine\Application Data\Nikon
[2006/11/08 13:48:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James&Catherine\Application Data\Ofoto
[2007/08/18 10:42:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James&Catherine\Application Data\pixelStorm
[2008/11/07 16:12:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James&Catherine\Application Data\Skinux
[2008/05/03 12:43:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James&Catherine\Application Data\Sony
[2009/11/18 19:54:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James&Catherine\Application Data\Spamihilator
[2006/12/01 11:47:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James&Catherine\Application Data\Thunderbird
[2008/02/09 11:24:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James&Catherine\Application Data\Uniblue
[2010/04/20 09:36:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James&Catherine\Application Data\Unreal Streaming
[2008/03/18 17:31:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James&Catherine\Application Data\Viewpoint
[2005/12/02 20:54:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James&Catherine\Application Data\Walgreens
[2009/07/07 09:26:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James&Catherine\Application Data\WeatherBug
[2007/01/01 11:31:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James&Catherine\Application Data\WinPatrol
[2008/02/09 11:25:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James&Catherine\Application Data\wsInspector

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 873 bytes -> C:\Documents and Settings\James&Catherine\Cookies:XYMm9uXG2BnOdoSRlodeP1
@Alternate Data Stream - 782 bytes -> C:\Documents and Settings\All Users\Application Data\DRM:13KGIHDRiVMotKR7G50Lmp
@Alternate Data Stream - 76 bytes -> C:\Documents and Settings\James&Catherine\My Documents\Back UP For CC Cleaner:Roxio EMC Stream
@Alternate Data Stream - 179 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:68E05C43
@Alternate Data Stream - 159 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:0CA18B9C
@Alternate Data Stream - 154 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:6122E243
@Alternate Data Stream - 136 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:0B4227B4

< End of report >
  • 0

#13
ali.B

ali.B

    Trusted Helper

  • Malware Removal
  • 3,086 posts
hi

Uninstall Viewpoint Manager

Congratulations your logs appear clean :)

Reset and Re-enable your System Restore

The following will implement some cleanup procedures as well as reset System Restore points:
  • Click START then RUN
  • Now type ComboFix /Uninstall in the runbox and click OK. Note the space between the X and the U, it needs to be there.

    Posted Image

NEXT

  • Open OTL to run it. (Vista users, right click on OTL and "Run as administrator")
  • Click on the CleanUp button.
  • Click Yes to begin the cleanup process and remove tools, including this application
  • You may be asked to reboot the machine to finish the cleanup process - if so, choose Yes


Recommendations

See Here for a list of recommendations for free Antivirus\AntiSpyware applications.


  • Keep Your windows up to date by regularly checking their website at:
    http://windowsupdate.microsoft.com/

  • SpywareBlaster protects against bad ActiveX, it immunizes your PC against them.

  • SpywareGuard offers realtime protection from spyware installation attempts. Make sure you are only running one real-time anti-spyware protection program ( eg : TeaTimer, Windows Defender ) or there will be a conflict.

  • Make Internet Explorer more secure
    • Click Start > Run
    • Type Inetcpl.cpl & click OK
    • Click on the Security tab
    • Click Reset all zones to default level
    • Make sure the Internet Zone is selected & Click Custom level
    • In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
    • Next Click OK, then Apply button and then OK to exit the Internet Properties page.


  • MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.

  • Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more
    secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in pop up
    blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from
    Here

    If you choose to use Firefox, I highly recommend these add-ons to keep your PC even more secure.
    • NoScript - for blocking ads and other potential website attacks
    • McAfee SiteAdvisor - this tells you whether the sites you are about to visit are safe or not. A must if you do a lot of Googling

  • Click Here to learn how to keep a backup of your important files

  • FileHippo Update Checkker is an extremely helpful program that will tell you which of your programs need to be updated. Its important to keep programs up to date so that malware doesn't exploit any old security flaws.


Stay safe :unsure:
  • 0

#14
ali.B

ali.B

    Trusted Helper

  • Malware Removal
  • 3,086 posts
Since this issue appears to be resolved ... this Topic has been closed. Glad we could help. :)

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP