This topic is locked
I am running Windows Vista w/Service pack 2.
Last night numerous windows with win 32 errors started popping up continuously.
Then my desktop turned black and all my icons dissappeared.
My current active window is also changing on me and the resolution also feels like it is being played with.
I tried running Avira but to no avail.
I booted up in safe mode and was able to restore to a previous date which made things a little better but on re-boot I am still experiencing weired behaviours.
I am hearing music in the background and have no idea where it is coming from.
Please help me.
Here is my OTL log.
OTL logfile created on: 02/10/2011 4:50:37 PM - Run 1
OTL by OldTimer - Version 3.2.29.1 Folder = C:\Users\zeev\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19120)
Locale: 00001009 | Country: Canada | Language: ENC | Date Format: dd/MM/yyyy
2.00 Gb Total Physical Memory | 0.81 Gb Available Physical Memory | 40.68% Memory free
4.23 Gb Paging File | 2.84 Gb Available in Paging File | 67.16% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 222.79 Gb Total Space | 140.55 Gb Free Space | 63.08% Space Free | Partition Type: NTFS
Drive D: | 10.00 Gb Total Space | 6.23 Gb Free Space | 62.25% Space Free | Partition Type: NTFS
Computer Name: ZEEV-PC | User Name: zeev | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - [2011/10/02 16:49:59 | 000,582,656 | ---- | M] (OldTimer Tools) -- C:\Users\zeev\Desktop\OTL.exe
PRC - [2011/08/06 07:25:14 | 000,428,200 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avwebgrd.exe
PRC - [2011/08/06 07:25:14 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe
PRC - [2011/06/23 19:44:22 | 001,386,776 | ---- | M] (Logitech, Inc.) -- C:\Program Files\Logitech\SetPointP\SetPoint.exe
PRC - [2011/06/17 03:35:24 | 000,149,784 | ---- | M] (Logitech, Inc.) -- C:\Program Files\Common Files\Logishrd\KHAL3\KHALMNPR.exe
PRC - [2011/06/11 20:08:10 | 000,669,936 | ---- | M] () -- C:\Program Files\Lavasoft\Ad-Aware\AutoLaunch.exe
PRC - [2011/04/21 07:54:05 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
PRC - [2011/04/21 07:53:48 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe
PRC - [2011/04/21 07:53:33 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
PRC - [2010/12/14 10:49:23 | 001,169,408 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\sdclt.exe
PRC - [2009/05/21 10:55:32 | 000,206,064 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files\Dell Support Center\bin\sprtcmd.exe
PRC - [2009/04/11 02:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009/03/12 10:44:32 | 000,184,968 | ---- | M] (SPAMfighter ApS) -- C:\Program Files\SPAMfighter\sfus.exe
PRC - [2008/08/13 18:32:40 | 000,201,968 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files\Dell Support Center\bin\sprtsvc.exe
PRC - [2007/11/28 20:51:10 | 000,583,048 | ---- | M] (Symantec Corporation) -- C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
PRC - [2007/09/12 18:27:24 | 000,554,352 | ---- | M] (Symantec Corporation) -- C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
PRC - [2007/07/10 03:03:42 | 000,405,504 | ---- | M] (SigmaTel, Inc.) -- C:\Program Files\Sigmatel\C-Major Audio\WDM\sttray.exe
PRC - [2007/07/10 03:03:36 | 000,094,208 | ---- | M] (SigmaTel, Inc.) -- C:\Windows\System32\stacsv.exe
PRC - [2006/10/29 09:03:30 | 000,208,896 | ---- | M] () -- C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe
PRC - [2006/09/29 12:38:50 | 000,081,920 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
========== Modules (No Company Name) ==========
MOD - [2011/09/16 03:41:38 | 005,450,752 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\4c3cda96b8f12220da20f2f8d1b9439c\System.Xml.ni.dll
MOD - [2011/09/16 03:13:21 | 007,950,848 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\b9ea0d414c4861120bfb7365d8ec0939\System.ni.dll
MOD - [2011/09/16 03:13:15 | 011,490,816 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\f6deb187f24bb3185841092b89fbfdbb\mscorlib.ni.dll
MOD - [2011/06/24 22:56:36 | 000,087,328 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2011/06/24 22:56:14 | 001,241,888 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2011/06/23 19:44:34 | 000,877,848 | ---- | M] () -- C:\Program Files\Logitech\SetPointP\Macros\MacroCore.dll
MOD - [2011/06/11 20:08:12 | 001,640,216 | ---- | M] () -- C:\Program Files\Lavasoft\Ad-Aware\Resources.dll
MOD - [2011/06/11 20:08:12 | 000,090,592 | ---- | M] () -- C:\Program Files\Lavasoft\Ad-Aware\ShellExt.dll
MOD - [2011/06/11 20:08:10 | 000,669,936 | ---- | M] () -- C:\Program Files\Lavasoft\Ad-Aware\AutoLaunch.exe
MOD - [2007/09/20 19:34:58 | 000,129,024 | ---- | M] () -- C:\Program Files\WinRAR\RarExt.dll
========== Win32 Services (SafeList) ==========
SRV - File not found [Auto | Stopped] -- -- (LiveUpdate Notice Ex)
SRV - File not found [Auto | Stopped] -- -- (CLTNetCnService)
SRV - [2011/08/06 07:25:14 | 000,428,200 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE -- (AntiVirWebService)
SRV - [2011/08/06 07:25:14 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011/06/17 03:33:46 | 000,295,192 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe -- (LBTServ)
SRV - [2011/06/11 20:08:08 | 001,036,104 | ---- | M] (Lavasoft) [Auto | Stopped] -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe -- (Lavasoft Ad-Aware Service)
SRV - [2011/04/21 07:53:48 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2009/03/12 10:44:32 | 000,184,968 | ---- | M] (SPAMfighter ApS) [Auto | Running] -- C:\Program Files\SPAMfighter\sfus.exe -- (SPAMfighter Update Service)
SRV - [2008/08/13 18:32:40 | 000,201,968 | ---- | M] (SupportSoft, Inc.) [Auto | Running] -- C:\Program Files\Dell Support Center\bin\sprtsvc.exe -- (sprtsvc_dellsupportcenter) SupportSoft Sprocket Service (dellsupportcenter)
SRV - [2008/01/19 03:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007/11/28 20:51:10 | 000,583,048 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe -- (LiveUpdate Notice Service)
SRV - [2007/09/12 18:27:24 | 002,999,664 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Program Files\Symantec\LiveUpdate\LuComServer_3_2.EXE -- (LiveUpdate)
SRV - [2007/09/12 18:27:24 | 000,554,352 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe -- (Automatic LiveUpdate Scheduler)
SRV - [2007/07/10 03:03:36 | 000,094,208 | ---- | M] (SigmaTel, Inc.) [Auto | Running] -- C:\Windows\System32\stacsv.exe -- (STacSV)
SRV - [2007/03/19 12:44:44 | 000,070,656 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\DellSupport\brkrsvc.exe -- (DSBrokerService)
SRV - [2006/11/18 07:01:26 | 000,195,032 | ---- | M] (Intel® Corporation) [On_Demand | Stopped] -- C:\Program Files\Intel\IntelDH\CCU\AlertService.exe -- (AlertService) Intel®
SRV - [2006/11/18 07:00:48 | 000,550,872 | ---- | M] (Intel® Corporation) [On_Demand | Stopped] -- C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe -- (Remote UI Service) Intel®
SRV - [2006/11/18 07:00:06 | 000,174,552 | ---- | M] (Intel® Corporation) [On_Demand | Stopped] -- C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe -- (MCLServiceATL) Intel®
SRV - [2006/11/18 06:59:38 | 000,081,880 | ---- | M] (Intel® Corporation) [On_Demand | Stopped] -- C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe -- (ISSM) Intel®
SRV - [2006/11/18 06:59:02 | 000,032,216 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe -- (M1 Server) Intel® Viiv™
SRV - [2006/10/29 09:03:30 | 000,208,896 | ---- | M] () [Auto | Running] -- C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe -- (DQLWinService)
SRV - [2006/09/29 12:38:50 | 000,081,920 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel®
========== Driver Services (SafeList) ==========
DRV - [2011/08/06 07:25:15 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2011/08/06 07:25:14 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2011/04/30 08:00:20 | 000,030,360 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\LUsbFilt.sys -- (LUsbFilt)
DRV - [2011/04/30 08:00:18 | 000,039,064 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LMouFilt.Sys -- (LMouFilt)
DRV - [2011/04/30 08:00:06 | 000,042,648 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LEqdUsb.sys -- (LEqdUsb)
DRV - [2011/04/30 08:00:06 | 000,041,240 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LHidFilt.Sys -- (LHidFilt)
DRV - [2011/04/30 08:00:06 | 000,012,184 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LHidEqd.sys -- (LHidEqd)
DRV - [2010/06/17 15:27:22 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2010/03/24 05:23:16 | 011,614,760 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2009/06/06 20:10:34 | 000,064,160 | ---- | M] (Lavasoft AB) [File_System | Boot | Running] -- C:\Windows\system32\DRIVERS\Lbd.sys -- (Lbd)
DRV - [2009/02/13 12:35:05 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Program Files\Avira\AntiVir Desktop\avgio.sys -- (avgio)
DRV - [2007/08/29 07:08:16 | 000,005,504 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\IntelDH.sys -- (IntelDH)
DRV - [2007/07/11 06:05:32 | 000,214,912 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\e1e6032.sys -- (e1express) Intel®
DRV - [2007/07/10 03:03:44 | 000,326,656 | ---- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\stwrt.sys -- (STHDA)
DRV - [2007/02/25 12:10:48 | 000,005,376 | --S- | M] (Gteko Ltd.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\dsunidrv.sys -- (dsunidrv)
DRV - [2006/11/18 07:01:08 | 000,018,904 | ---- | M] () [File_System | On_Demand | Stopped] -- C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\TSHWMDTCP.sys -- (TSHWMDTCP)
DRV - [2006/11/02 03:36:43 | 002,028,032 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\atikmdag.sys -- (R300)
DRV - [2006/10/19 15:49:48 | 000,007,424 | --S- | M] (Gteko Ltd.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\nmsunidr.sys -- (nmsunidr)
DRV - [2006/10/05 17:07:28 | 000,004,736 | ---- | M] (Gteko Ltd.) [Kernel | On_Demand | Stopped] -- C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys -- (DSproct)
DRV - [2006/09/27 16:37:24 | 000,028,672 | --S- | M] (Gteko Ltd.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\nmsgopro.sys -- (nmsgopro)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.ca...=ca&ibd=3070829
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 2
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
========== FireFox ==========
FF - prefs.js..browser.search.defaultenginename: "Yahoo"
FF - prefs.js..browser.search.defaulturl: "http://search.yahoo....r=ytff-yma3&p="
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.google.ca"
FF - prefs.js..extensions.enabledItems: {8C2374C3-4E21-43CD-A410-4B6BFE56C02C}:1.9.1
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:5.3.0.7280
FF - prefs.js..extensions.enabledItems: [email protected]:3.12.2.100006
FF - prefs.js..keyword.URL: "http://search.yahoo....r=ytff-yma3&p="
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\zeev\AppData\Local\Google\Update\1.3.21.69\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\zeev\AppData\Local\Google\Update\1.3.21.69\npGoogleUpdate3.dll (Google Inc.)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.23\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/09/28 16:27:10 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.23\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/09/28 16:27:10 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{8C2374C3-4E21-43CD-A410-4B6BFE56C02C}: C:\Users\zeev\AppData\Local\{8C2374C3-4E21-43CD-A410-4B6BFE56C02C} [2011/10/02 16:04:36 | 000,000,000 | ---D | M]
[2009/02/28 21:49:58 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\zeev\AppData\Roaming\Mozilla\Extensions
[2011/09/29 09:45:17 | 000,000,000 | ---D | M] (No name found) -- C:\Users\zeev\AppData\Roaming\Mozilla\Firefox\Profiles\5sdn7712.default\extensions
[2011/10/02 16:04:40 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\zeev\AppData\Roaming\Mozilla\Firefox\Profiles\5sdn7712.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/10/02 16:04:39 | 000,000,000 | ---D | M] ("Avira SearchFree Toolbar plus WebGuard") -- C:\Users\zeev\AppData\Roaming\Mozilla\Firefox\Profiles\5sdn7712.default\extensions\[email protected]
[2011/04/16 10:23:20 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2011/06/23 05:11:50 | 000,000,000 | ---D | M] (Skype extension) -- C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2009/02/28 21:49:48 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions\[email protected]
[2011/10/02 16:04:36 | 000,000,000 | ---D | M] (XULRunner) -- C:\USERS\ZEEV\APPDATA\LOCAL\{8C2374C3-4E21-43CD-A410-4B6BFE56C02C}
O1 HOSTS File: ([2010/03/10 04:28:38 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll File not found
O2 - BHO: (AVG Security Toolbar) - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL File not found
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll (Dell Inc.)
O2 - BHO: (Avira SearchFree Toolbar plus WebGuard) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (&Google) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL File not found
O3 - HKLM\..\Toolbar: (Avira SearchFree Toolbar plus WebGuard) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKCU\..\Toolbar\WebBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Avira SearchFree Toolbar plus WebGuard) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files\Ask.com\Updater\Updater.exe ({StringFileInfo_CompanyName})
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [DellSupportCenter] C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
O4 - HKLM..\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)
O4 - HKLM..\Run: [SigmatelSysTrayApp] C:\Program Files\Sigmatel\C-Major Audio\WDM\sttray.exe (SigmaTel, Inc.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [AROReminder] C:\Program Files\ARO 2011\ARO.exe (Support.com)
O4 - HKCU..\RunOnce: [Shockwave Updater] C:\Windows\System32\Adobe\SHOCKW~1\SWHELP~1.EXE -Update -1100465 -"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; InfoPath.2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)" -"http://www.interacti...checker_l1.htm" File not found
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)
O10 - Protocol_Catalog9\Catalog_Entries\000000000021 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: agentware.net ([]https in Trusted sites)
O15 - HKCU\..Trusted Domains: localhost ([]http in Local intranet)
O15 - HKCU\..Trusted Domains: sabre.com ([]https in Trusted sites)
O15 - HKCU\..Trusted Domains: ujafed.org ([webmail] https in Trusted sites)
O15 - HKCU\..Trusted Ranges: GD ([http] in Local intranet)
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} http://upload.facebo...toUploader5.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macr...director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\Common\Yinsthelper.dll (Installation Support)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} https://h17000.www1....loadManager.ocx (Get_ActiveX Control)
O16 - DPF: {B7C49732-4761-4A66-9945-BAF55E98E0E4} https://ve1.verint.c...lient/JDsAx.cab (COCKPIT Client)
O16 - DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: Garmin Communicator Plug-In https://static.garmi...inAxControl.CAB (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FD3A2939-7451-40E7-B6D7-CAAD955173CF}: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll File not found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL) -C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\dellwall1.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\dellwall1.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 17:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{e1bca88a-992e-11dd-94f6-0019d19185f4}\Shell\AutoRun\command - "" = H:\PMB_P.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (lsdelete)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKCU\...exe [@ = exefile] -- Reg Error: Key error. File not found
========== Files/Folders - Created Within 30 Days ==========
[2011/10/02 16:49:56 | 000,582,656 | ---- | C] (OldTimer Tools) -- C:\Users\zeev\Desktop\OTL.exe
========== Files - Modified Within 30 Days ==========
[2011/10/02 16:49:59 | 000,582,656 | ---- | M] (OldTimer Tools) -- C:\Users\zeev\Desktop\OTL.exe
[2011/10/02 16:39:10 | 000,003,568 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011/10/02 16:39:10 | 000,003,568 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011/10/02 16:14:32 | 000,000,904 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-978806049-3308876999-957044163-1001UA.job
[2011/10/02 16:13:01 | 000,000,852 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-978806049-3308876999-957044163-1001Core.job
[2011/10/02 16:11:07 | 000,000,416 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{19A89B08-65C3-4B47-B064-67D7AE5FCC06}.job
[2011/10/02 16:07:24 | 000,000,054 | ---- | M] () -- C:\Windows\System32\rp_stats.dat
[2011/10/02 16:07:24 | 000,000,039 | ---- | M] () -- C:\Windows\System32\rp_rules.dat
[2011/10/02 16:06:12 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011/10/02 15:51:39 | 000,000,680 | ---- | M] () -- C:\Users\zeev\AppData\Local\d3d9caps.dat
[2011/10/01 22:14:51 | 000,000,440 | -H-- | M] () -- C:\ProgramData\6DSS92c31Apgjk
[2011/10/01 22:11:45 | 000,000,272 | -H-- | M] () -- C:\ProgramData\~6DSS92c31Apgjk
[2011/10/01 22:11:45 | 000,000,184 | -H-- | M] () -- C:\ProgramData\~6DSS92c31Apgjkr
[2011/10/01 22:08:42 | 000,035,565 | -H-- | M] () -- C:\ProgramData\nvModes.dat
[2011/10/01 22:08:42 | 000,035,565 | -H-- | M] () -- C:\ProgramData\nvModes.001
[2011/10/01 16:46:13 | 000,001,808 | -H-- | M] () -- C:\Users\zeev\Documents\Default.rdp
[2011/09/27 17:40:48 | 000,000,117 | -H-- | M] () -- C:\Users\zeev\Desktop\Welcome to edline.net.URL
[2011/09/26 20:08:04 | 000,000,472 | ---- | M] () -- C:\Windows\tasks\Ad-Aware Update (Weekly).job
[2011/09/25 17:18:54 | 000,002,627 | ---- | M] () -- C:\Users\zeev\Desktop\Microsoft Office Word 2007.lnk
[2011/09/21 16:00:51 | 000,000,226 | -H-- | M] () -- C:\Users\zeev\Desktop\Staff Bulletin Board.url
[2011/09/21 01:14:45 | 000,002,078 | ---- | M] () -- C:\Users\zeev\Desktop\Google Chrome.lnk
[2011/09/21 01:14:45 | 000,002,040 | ---- | M] () -- C:\Users\zeev\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2011/09/16 03:10:54 | 000,598,702 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011/09/16 03:10:54 | 000,104,716 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011/09/04 19:01:12 | 000,000,138 | -H-- | M] () -- C:\Users\zeev\Desktop\Bialik Hebrew Day School Mail.url
========== Files Created - No Company Name ==========
[2011/10/02 16:07:24 | 000,000,054 | ---- | C] () -- C:\Windows\System32\rp_stats.dat
[2011/10/02 16:07:24 | 000,000,039 | ---- | C] () -- C:\Windows\System32\rp_rules.dat
[2011/10/01 22:11:45 | 000,000,184 | -H-- | C] () -- C:\ProgramData\~6DSS92c31Apgjkr
[2011/10/01 22:11:44 | 000,000,272 | -H-- | C] () -- C:\ProgramData\~6DSS92c31Apgjk
[2011/10/01 22:11:02 | 000,000,440 | -H-- | C] () -- C:\ProgramData\6DSS92c31Apgjk
[2011/09/06 15:08:07 | 000,000,226 | -H-- | C] () -- C:\Users\zeev\Desktop\Staff Bulletin Board.url
[2011/09/04 19:08:48 | 000,000,117 | -H-- | C] () -- C:\Users\zeev\Desktop\Welcome to edline.net.URL
[2011/09/04 19:01:12 | 000,000,138 | -H-- | C] () -- C:\Users\zeev\Desktop\Bialik Hebrew Day School Mail.url
[2011/04/16 10:24:16 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2010/07/27 03:43:21 | 000,035,565 | -H-- | C] () -- C:\ProgramData\nvModes.001
[2010/07/27 03:04:42 | 000,035,565 | -H-- | C] () -- C:\ProgramData\nvModes.dat
[2010/03/21 16:39:39 | 000,000,680 | ---- | C] () -- C:\Users\zeev\AppData\Local\d3d9caps.dat
[2010/03/19 18:45:46 | 000,000,120 | -H-- | C] () -- C:\Users\zeev\AppData\Local\Mzocoyem.dat
[2010/03/19 18:45:46 | 000,000,000 | -H-- | C] () -- C:\Users\zeev\AppData\Local\Rtodozaz.bin
[2010/03/19 18:42:08 | 000,011,944 | -HS- | C] () -- C:\Users\zeev\AppData\Local\48531I0
[2010/03/19 18:42:08 | 000,011,944 | -HS- | C] () -- C:\ProgramData\48531I0
[2010/03/19 18:42:06 | 000,000,016 | -H-- | C] () -- C:\Users\zeev\AppData\Roaming\jasltw.dat
[2009/09/18 06:02:35 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009/09/18 06:02:35 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2009/06/05 03:08:43 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2009/06/05 03:03:51 | 000,000,118 | ---- | C] () -- C:\Windows\System32\MRT.INI
[2009/02/28 21:52:32 | 000,008,264 | ---- | C] () -- C:\ProgramData\LUUnInstall.LiveUpdate
[2009/02/28 21:19:31 | 000,015,688 | ---- | C] () -- C:\Windows\System32\lsdelete.exe
[2008/05/02 17:18:29 | 000,000,057 | ---- | C] () -- C:\Windows\SABRE.INI
[2007/10/13 17:09:55 | 000,000,614 | -H-- | C] () -- C:\Users\zeev\AppData\Roaming\wklnhst.dat
[2007/09/08 18:09:55 | 000,002,528 | ---- | C] () -- C:\Windows\FCIC.INI
[2007/09/08 17:51:30 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2007/09/04 23:31:18 | 000,047,104 | ---- | C] () -- C:\Users\zeev\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2006/11/10 09:26:12 | 000,000,000 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat
[2006/11/07 15:25:58 | 000,000,000 | ---- | C] () -- C:\Windows\System32\px.ini
[2006/11/02 08:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006/11/02 08:47:37 | 000,436,536 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006/11/02 08:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006/11/02 06:33:01 | 000,598,702 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006/11/02 06:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006/11/02 06:33:01 | 000,104,716 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006/11/02 06:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006/11/02 06:25:44 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll
[2006/11/02 06:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006/11/02 04:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006/11/02 04:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006/11/02 03:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006/11/02 03:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2006/09/16 23:36:50 | 000,520,192 | ---- | C] () -- C:\Windows\System32\CddbPlaylist2Roxio.dll
[2006/09/16 23:36:50 | 000,204,800 | ---- | C] () -- C:\Windows\System32\CddbFileTaggerRoxio.dll
[2006/06/23 09:09:34 | 000,019,968 | R--- | C] () -- C:\Windows\System32\cpuinf32.dll
========== LOP Check ==========
[2009/02/07 21:09:41 | 000,000,000 | -H-D | M] -- C:\Users\zeev\AppData\Roaming\Amazon
[2008/03/01 19:19:05 | 000,000,000 | -H-D | M] -- C:\Users\zeev\AppData\Roaming\BitSpirit
[2009/02/28 20:47:42 | 000,000,000 | -H-D | M] -- C:\Users\zeev\AppData\Roaming\eMusic
[2010/05/30 11:57:10 | 000,000,000 | -H-D | M] -- C:\Users\zeev\AppData\Roaming\GARMIN
[2011/08/07 11:23:29 | 000,000,000 | -H-D | M] -- C:\Users\zeev\AppData\Roaming\Leadertech
[2009/11/15 13:14:44 | 000,000,000 | ---D | M] -- C:\Users\zeev\AppData\Roaming\OpenOffice.org
[2011/03/02 23:13:17 | 000,000,000 | ---D | M] -- C:\Users\zeev\AppData\Roaming\PCDr
[2011/06/23 04:56:47 | 000,000,000 | ---D | M] -- C:\Users\zeev\AppData\Roaming\Sammsoft
[2009/05/01 19:58:29 | 000,000,000 | -H-D | M] -- C:\Users\zeev\AppData\Roaming\SPAMfighter
[2007/10/13 17:09:57 | 000,000,000 | -H-D | M] -- C:\Users\zeev\AppData\Roaming\Template
[2011/09/26 20:08:04 | 000,000,472 | ---- | M] () -- C:\Windows\Tasks\Ad-Aware Update (Weekly).job
[2011/09/16 03:33:35 | 000,032,548 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2011/10/02 16:11:07 | 000,000,416 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{19A89B08-65C3-4B47-B064-67D7AE5FCC06}.job
========== Purity Check ==========
========== Files - Unicode (All) ==========
[2011/06/07 15:29:53 | 000,014,478 | -H-- | M] ()(C:\Users\zeev\Desktop\???.docx) -- C:\Users\zeev\Desktop\שרה.docx
[2011/05/22 18:58:52 | 000,014,478 | -H-- | C] ()(C:\Users\zeev\Desktop\???.docx) -- C:\Users\zeev\Desktop\שרה.docx
[2011/05/07 12:52:54 | 000,014,958 | -H-- | M] ()(C:\Users\zeev\Desktop\?? ?? ???? ???? ???? ???-2011.docx) -- C:\Users\zeev\Desktop\רק על עצמי לספר סכום שנה-2011.docx
[2011/05/07 12:52:53 | 000,014,958 | -H-- | C] ()(C:\Users\zeev\Desktop\?? ?? ???? ???? ???? ???-2011.docx) -- C:\Users\zeev\Desktop\רק על עצמי לספר סכום שנה-2011.docx
[2010/05/09 10:10:03 | 000,027,430 | -H-- | M] ()(C:\Users\zeev\Desktop\?? ???? ?.docx) -- C:\Users\zeev\Desktop\מי ידאג ל.docx
[2010/05/09 10:10:02 | 000,027,430 | -H-- | C] ()(C:\Users\zeev\Desktop\?? ???? ?.docx) -- C:\Users\zeev\Desktop\מי ידאג ל.docx
========== Alternate Data Streams ==========
@Alternate Data Stream - 76 bytes -> C:\Users\zeev\Documents\HP_Vista_Drivers:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\zeev\Documents\FirstClass:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\zeev\Documents\Downloads:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\zeev\Documents\Anat Pic:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\zeev\Desktop\REPORT CARDS 2009 2010:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\zeev\Desktop\REPORT CARDS 2008:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\zeev\Desktop\REPORT CARDS 2007:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\zeev\Desktop\OpenOffice.org 3.1 (en-US) Installation Files:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\zeev\Desktop\My eMusic:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\zeev\Desktop\GROUP EMAILS:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\zeev\Desktop\CHIDON:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\zeev\Desktop\BellSettings.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\zeev\Desktop\09-TATE'S WORLD'S.mp3:Roxio EMC Stream
< End of report >
Thanks in advance
Edited by ugrinwa, 02 October 2011 - 03:00 PM.
Sign In
Create Account
