[Trey Palreiro]

I have a nasty virus on one of my PCs, its so bad all my icons are gone, and my start menu has nothing on it, not even the run key. It runs a program called "System Check", and pulls up a bunch of bogus error messages. It does the same thing in safe mode too. I would submit an OTL log but I cant run any programs.


Sorry for the lack of info. But this one is a bear.

Thanks,

[Advertisements]

Got MBAM to run, but all my start menu programs are still gone, all file folders are listed as hidden. When I am in firefox a popup window keeps coming up that just says nooo plus an ok button


Malwarebytes Anti-Malware 1.60.0.1800
www.malwarebytes.org

Database version: v2011.12.31.02

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 6.0.2900.5512
Trey :: TREY-DELL [administrator]

12/30/2011 10:10:21 PM
mbam-log-2011-12-30 (22-10-21).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 226412
Time elapsed: 6 minute(s), 14 second(s)

Memory Processes Detected: 3
C:\Documents and Settings\All Users\Application Data\ufUSmUxNMcl.exe (Trojan.FakeAlert) -> 2176 -> Delete on reboot.
C:\Documents and Settings\All Users\Application Data\TA9XzaJF8HJt1H.exe (Trojan.FakeAlert) -> 3624 -> Delete on reboot.
C:\Documents and Settings\Trey\Local Settings\Application Data\loi.exe (Trojan.FakeAV) -> 3600 -> Delete on reboot.

Memory Modules Detected: 1
C:\Documents and Settings\Trey\Application Data\dplayx.dll (Trojan.QHost.BG) -> Delete on reboot.

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 3
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|ufUSmUxNMcl.exe (Trojan.FakeAlert) -> Data: C:\Documents and Settings\All Users\Application Data\ufUSmUxNMcl.exe -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|avPYOWQgOag.exe (Rogue.FakeHDD) -> Data: C:\Documents and Settings\All Users\Application Data\avPYOWQgOag.exe -> Quarantined and deleted successfully.
HKCR\.exe\shell\open\command| (Hijack.ExeFile) -> Data: "C:\Documents and Settings\Trey\Local Settings\Application Data\loi.exe" -a "%1" %* -> Quarantined and deleted successfully.

Registry Data Items Detected: 16
HKCR\.exe| (PUM.HijackExefiles) -> Bad: (54) Good: (exefile) -> Quarantined and repaired successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowControlPanel (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and repaired successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowHelp (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and repaired successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowMyComputer (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and repaired successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowMyDocs (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and repaired successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowRun (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and repaired successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowSearch (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and repaired successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer|NoDesktop (PUM.Hidden.Desktop) -> Bad: (1) Good: (0) -> Quarantined and repaired successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System|DisableTaskMgr (PUM.Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and repaired successfully.
HKLM\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command| (Hijack.StartMenuInternet) -> Bad: ("C:\Documents and Settings\Trey\Local Settings\Application Data\loi.exe" -a "C:\Program Files\Mozilla Firefox\firefox.exe") Good: (firefox.exe) -> Quarantined and repaired successfully.
HKLM\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command| (Hijack.StartMenuInternet) -> Bad: ("C:\Documents and Settings\Trey\Local Settings\Application Data\loi.exe" -a "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode) Good: (firefox.exe -safe-mode) -> Quarantined and repaired successfully.
HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command| (Hijack.StartMenuInternet) -> Bad: ("C:\Documents and Settings\Trey\Local Settings\Application Data\loi.exe" -a "C:\Program Files\Internet Explorer\iexplore.exe") Good: (iexplore.exe) -> Quarantined and repaired successfully.
HKLM\SOFTWARE\Microsoft\Security Center|AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and repaired successfully.
HKLM\SOFTWARE\Microsoft\Security Center|FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and repaired successfully.
HKLM\SOFTWARE\Microsoft\Security Center|UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and repaired successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System|DisableTaskMgr (PUM.Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and repaired successfully.

Folders Detected: 0
(No malicious items detected)

Files Detected: 16
C:\Documents and Settings\All Users\Application Data\ufUSmUxNMcl.exe (Trojan.FakeAlert) -> Delete on reboot.
C:\Documents and Settings\All Users\Application Data\TA9XzaJF8HJt1H.exe (Trojan.FakeAlert) -> Delete on reboot.
C:\Documents and Settings\Trey\Local Settings\Application Data\loi.exe (Trojan.FakeAV) -> Delete on reboot.
C:\Documents and Settings\All Users\Application Data\avPYOWQgOag.exe (Rogue.FakeHDD) -> Quarantined and deleted successfully.
C:\Documents and Settings\Trey\Local Settings\Temp\hLPyYuTtoNvIK0.exe.tmp (Rogue.FakeHDD) -> Quarantined and deleted successfully.
C:\Documents and Settings\Trey\Local Settings\Temp\jgfhtdt.exe (Trojan.FakeMS) -> Quarantined and deleted successfully.
C:\Documents and Settings\Trey\Local Settings\Temp\jyhgje.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Trey\Local Settings\Temp\mvcbnddgf.exe (Trojan.FakeAV) -> Quarantined and deleted successfully.
C:\Documents and Settings\Trey\Local Settings\Temporary Internet Files\Content.IE5\0JEPI36N\crystmassoft3[4].htm (Trojan.FakeMS) -> Quarantined and deleted successfully.
C:\Documents and Settings\Trey\Local Settings\Temporary Internet Files\Content.IE5\4Z8NOBWP\crystmassoft3[1].htm (Trojan.FakeAV) -> Quarantined and deleted successfully.
C:\Documents and Settings\Trey\Local Settings\Temporary Internet Files\Content.IE5\4Z8NOBWP\crystmassoft3[4].htm (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Trey\Application Data\dplaysvr.exe (Trojan.QHost.Gen) -> Delete on reboot.
C:\Documents and Settings\Trey\Application Data\dplayx.dll (Trojan.QHost.BG) -> Delete on reboot.
C:\Documents and Settings\Trey\Local Settings\Temp\wera0.8991354353805008.exe (Exploit.Drop.6) -> Quarantined and deleted successfully.
C:\Documents and Settings\Trey\Local Settings\Temp\wera0.9565486163138932.exe (Exploit.Drop.6) -> Quarantined and deleted successfully.
C:\Documents and Settings\Trey\Local Settings\Temp\oiu0.7146117532500651.exe (Exploit.Drop.7) -> Quarantined and deleted successfully.

(end)

[Trey Palreiro]

Got MBAM to run, but all my start menu programs are still gone, all file folders are listed as hidden. When I am in firefox a popup window keeps coming up that just says nooo plus an ok button


Malwarebytes Anti-Malware 1.60.0.1800
www.malwarebytes.org

Database version: v2011.12.31.02

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 6.0.2900.5512
Trey :: TREY-DELL [administrator]

12/30/2011 10:10:21 PM
mbam-log-2011-12-30 (22-10-21).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 226412
Time elapsed: 6 minute(s), 14 second(s)

Memory Processes Detected: 3
C:\Documents and Settings\All Users\Application Data\ufUSmUxNMcl.exe (Trojan.FakeAlert) -> 2176 -> Delete on reboot.
C:\Documents and Settings\All Users\Application Data\TA9XzaJF8HJt1H.exe (Trojan.FakeAlert) -> 3624 -> Delete on reboot.
C:\Documents and Settings\Trey\Local Settings\Application Data\loi.exe (Trojan.FakeAV) -> 3600 -> Delete on reboot.

Memory Modules Detected: 1
C:\Documents and Settings\Trey\Application Data\dplayx.dll (Trojan.QHost.BG) -> Delete on reboot.

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 3
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|ufUSmUxNMcl.exe (Trojan.FakeAlert) -> Data: C:\Documents and Settings\All Users\Application Data\ufUSmUxNMcl.exe -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|avPYOWQgOag.exe (Rogue.FakeHDD) -> Data: C:\Documents and Settings\All Users\Application Data\avPYOWQgOag.exe -> Quarantined and deleted successfully.
HKCR\.exe\shell\open\command| (Hijack.ExeFile) -> Data: "C:\Documents and Settings\Trey\Local Settings\Application Data\loi.exe" -a "%1" %* -> Quarantined and deleted successfully.

Registry Data Items Detected: 16
HKCR\.exe| (PUM.HijackExefiles) -> Bad: (54) Good: (exefile) -> Quarantined and repaired successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowControlPanel (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and repaired successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowHelp (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and repaired successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowMyComputer (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and repaired successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowMyDocs (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and repaired successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowRun (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and repaired successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowSearch (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and repaired successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer|NoDesktop (PUM.Hidden.Desktop) -> Bad: (1) Good: (0) -> Quarantined and repaired successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System|DisableTaskMgr (PUM.Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and repaired successfully.
HKLM\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\open\command| (Hijack.StartMenuInternet) -> Bad: ("C:\Documents and Settings\Trey\Local Settings\Application Data\loi.exe" -a "C:\Program Files\Mozilla Firefox\firefox.exe") Good: (firefox.exe) -> Quarantined and repaired successfully.
HKLM\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\shell\safemode\command| (Hijack.StartMenuInternet) -> Bad: ("C:\Documents and Settings\Trey\Local Settings\Application Data\loi.exe" -a "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode) Good: (firefox.exe -safe-mode) -> Quarantined and repaired successfully.
HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command| (Hijack.StartMenuInternet) -> Bad: ("C:\Documents and Settings\Trey\Local Settings\Application Data\loi.exe" -a "C:\Program Files\Internet Explorer\iexplore.exe") Good: (iexplore.exe) -> Quarantined and repaired successfully.
HKLM\SOFTWARE\Microsoft\Security Center|AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and repaired successfully.
HKLM\SOFTWARE\Microsoft\Security Center|FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and repaired successfully.
HKLM\SOFTWARE\Microsoft\Security Center|UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and repaired successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System|DisableTaskMgr (PUM.Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and repaired successfully.

Folders Detected: 0
(No malicious items detected)

Files Detected: 16
C:\Documents and Settings\All Users\Application Data\ufUSmUxNMcl.exe (Trojan.FakeAlert) -> Delete on reboot.
C:\Documents and Settings\All Users\Application Data\TA9XzaJF8HJt1H.exe (Trojan.FakeAlert) -> Delete on reboot.
C:\Documents and Settings\Trey\Local Settings\Application Data\loi.exe (Trojan.FakeAV) -> Delete on reboot.
C:\Documents and Settings\All Users\Application Data\avPYOWQgOag.exe (Rogue.FakeHDD) -> Quarantined and deleted successfully.
C:\Documents and Settings\Trey\Local Settings\Temp\hLPyYuTtoNvIK0.exe.tmp (Rogue.FakeHDD) -> Quarantined and deleted successfully.
C:\Documents and Settings\Trey\Local Settings\Temp\jgfhtdt.exe (Trojan.FakeMS) -> Quarantined and deleted successfully.
C:\Documents and Settings\Trey\Local Settings\Temp\jyhgje.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Trey\Local Settings\Temp\mvcbnddgf.exe (Trojan.FakeAV) -> Quarantined and deleted successfully.
C:\Documents and Settings\Trey\Local Settings\Temporary Internet Files\Content.IE5\0JEPI36N\crystmassoft3[4].htm (Trojan.FakeMS) -> Quarantined and deleted successfully.
C:\Documents and Settings\Trey\Local Settings\Temporary Internet Files\Content.IE5\4Z8NOBWP\crystmassoft3[1].htm (Trojan.FakeAV) -> Quarantined and deleted successfully.
C:\Documents and Settings\Trey\Local Settings\Temporary Internet Files\Content.IE5\4Z8NOBWP\crystmassoft3[4].htm (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Trey\Application Data\dplaysvr.exe (Trojan.QHost.Gen) -> Delete on reboot.
C:\Documents and Settings\Trey\Application Data\dplayx.dll (Trojan.QHost.BG) -> Delete on reboot.
C:\Documents and Settings\Trey\Local Settings\Temp\wera0.8991354353805008.exe (Exploit.Drop.6) -> Quarantined and deleted successfully.
C:\Documents and Settings\Trey\Local Settings\Temp\wera0.9565486163138932.exe (Exploit.Drop.6) -> Quarantined and deleted successfully.
C:\Documents and Settings\Trey\Local Settings\Temp\oiu0.7146117532500651.exe (Exploit.Drop.7) -> Quarantined and deleted successfully.

(end)

[Essexboy]

Hi there lets get the files and folders back first

Download RogueKiller to your desktop

• Quit all running programs
• For Vista/Seven, right click -> run as administrator, for XP simply run RogueKiller.exe
• When prompted, type 2 and validate
• The RKreport.txt shall be generated next to the executable.
• If the program is blocked, do not hesitate to try several times. If it really does not work (it could happen), rename it to winlogon.exe

Please post the contents of the RKreport.txt in your next Reply.

THEN

Re-run RogueKiller

• Quit all running programs
• For Vista/Seven, right click -> run as administrator, for XP simply run RogueKiller.exe
• When prompted, type 6 and validate
• The RKreport.txt shall be generated next to the executable.
• If the program is blocked, do not hesitate to try several times. If it really does not work (it could happen), rename it to winlogon.exe

Please post the contents of the RKreport.txt in your next Reply.

FOLLOWED BY

Download OTL to your Desktop

• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
• Select All Users
• Under the Custom Scan box paste this in
  netsvcs
  %SYSTEMDRIVE%\*.exe
  /md5start
  consrv.dll
  explorer.exe
  winlogon.exe
  Userinit.exe
  svchost.exe
  /md5stop
  C:\Windows\assembly\tmp\U\*.* /s
  %Temp%\smtmp\1\*.*
  %Temp%\smtmp\2\*.*
  %Temp%\smtmp\3\*.*
  %Temp%\smtmp\4\*.*
  CREATERESTOREPOINT
• Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
• When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
• Post both logs

AND FINALLY

Download aswMBR.exe ( 1.8mb ) to your desktop.
Double click the aswMBR.exe to run it Click the "Scan" button to start scan



On completion of the scan click save log, save it to your desktop and post in your next reply

[Trey Palreiro]

Rogue killer 1
RogueKiller V6.2.2 [12/31/2011] by Tigzy
mail: tigzyRK<at>gmail<dot>com
Feedback: http://www.geekstogo...13-roguekiller/
Blog: http://tigzyrk.blogspot.com

Operating System: Windows XP (5.1.2600 Service Pack 3) 32 bits version
Started in : Normal mode
User: Trey [Admin rights]
Mode: Remove -- Date : 12/31/2011 16:58:43

¤¤¤ Bad processes: 0 ¤¤¤

¤¤¤ Registry Entries: 3 ¤¤¤
[SUSP PATH] HKCU\[...]\Run : Mikogo ("C:\Documents and Settings\Trey\Application Data\Mikogo\Mikogo-Host.exe") -> DELETED
[WallPP] HKCU\[...]\Desktop : Wallpaper () -> REPLACED (C:\WINDOWS\web\wallpaper\Bliss.bmp)
[HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver: [LOADED] ¤¤¤

¤¤¤ Infection : Root.MBR ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
94.63.240.133 www.google.com
94.63.240.134 www.bing.com


¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: +++++
--- User ---
[MBR] c8e0ea2447aab8981bd693656d15c143
[BSP] caf6908ad0c09d9310e3e262d1000f92 : Windows XP MBR Code
Partition table:
0 - [XXXXXX] FAT16 [HIDDEN!] Offset (sectors): 63 | Size: 73 Mo
1 - [ACTIVE] NTFS [VISIBLE] Offset (sectors): 145408 | Size: 2147 Mo
2 - [XXXXXX] UNKNW [VISIBLE] Offset (sectors): 4353615 | Size: 317833 Mo
User != LL1 ... KO!
--- LL1 ---
[MBR] 1c8e19aa4d13eb1043b654fbe2b0377f
[BSP] 34416617cc43e7993a3960cfeacdffbc : MaxSS MBR Code!
Partition table:
0 - [XXXXXX] FAT16 [HIDDEN!] Offset (sectors): 63 | Size: 73 Mo
1 - [ACTIVE] NTFS [VISIBLE] Offset (sectors): 145408 | Size: 2147 Mo
2 - [XXXXXX] UNKNW [VISIBLE] Offset (sectors): 4353615 | Size: 317833 Mo
User != LL2 ... KO!
--- LL2 ---
[MBR] 1c8e19aa4d13eb1043b654fbe2b0377f
[BSP] 34416617cc43e7993a3960cfeacdffbc : MaxSS MBR Code!
Partition table:
0 - [XXXXXX] FAT16 [HIDDEN!] Offset (sectors): 63 | Size: 73 Mo
1 - [ACTIVE] NTFS [VISIBLE] Offset (sectors): 145408 | Size: 2147 Mo
2 - [XXXXXX] UNKNW [VISIBLE] Offset (sectors): 4353615 | Size: 317833 Mo

+++++ PhysicalDrive1: +++++
--- User ---
[MBR] 0d4c5d67d852731df078e06d62ac769c
[BSP] 33a07a59d299ab4ea9f4ab0156f9d86f : Windows XP MBR Code
Partition table:
0 - [ACTIVE] FAT32 [VISIBLE] Offset (sectors): 64 | Size: 2038 Mo
User = LL1 ... OK!
Error reading LL2 MBR!

Finished : << RKreport[1].txt >>
RKreport[1].txt



rogue killer 2
RogueKiller V6.2.2 [12/31/2011] by Tigzy
mail: tigzyRK<at>gmail<dot>com
Feedback: http://www.geekstogo...13-roguekiller/
Blog: http://tigzyrk.blogspot.com

Operating System: Windows XP (5.1.2600 Service Pack 3) 32 bits version
Started in : Normal mode
User: Trey [Admin rights]
Mode: Remove -- Date : 12/31/2011 16:59:30

¤¤¤ Bad processes: 0 ¤¤¤

¤¤¤ Registry Entries: 0 ¤¤¤

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver: [LOADED] ¤¤¤

¤¤¤ Infection : Root.MBR ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
94.63.240.133 www.google.com
94.63.240.134 www.bing.com


¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: +++++
--- User ---
[MBR] c8e0ea2447aab8981bd693656d15c143
[BSP] caf6908ad0c09d9310e3e262d1000f92 : Windows XP MBR Code
Partition table:
0 - [XXXXXX] FAT16 [HIDDEN!] Offset (sectors): 63 | Size: 73 Mo
1 - [ACTIVE] NTFS [VISIBLE] Offset (sectors): 145408 | Size: 2147 Mo
2 - [XXXXXX] UNKNW [VISIBLE] Offset (sectors): 4353615 | Size: 317833 Mo
User != LL1 ... KO!
--- LL1 ---
[MBR] 1c8e19aa4d13eb1043b654fbe2b0377f
[BSP] 34416617cc43e7993a3960cfeacdffbc : MaxSS MBR Code!
Partition table:
0 - [XXXXXX] FAT16 [HIDDEN!] Offset (sectors): 63 | Size: 73 Mo
1 - [ACTIVE] NTFS [VISIBLE] Offset (sectors): 145408 | Size: 2147 Mo
2 - [XXXXXX] UNKNW [VISIBLE] Offset (sectors): 4353615 | Size: 317833 Mo
User != LL2 ... KO!
--- LL2 ---
[MBR] 1c8e19aa4d13eb1043b654fbe2b0377f
[BSP] 34416617cc43e7993a3960cfeacdffbc : MaxSS MBR Code!
Partition table:
0 - [XXXXXX] FAT16 [HIDDEN!] Offset (sectors): 63 | Size: 73 Mo
1 - [ACTIVE] NTFS [VISIBLE] Offset (sectors): 145408 | Size: 2147 Mo
2 - [XXXXXX] UNKNW [VISIBLE] Offset (sectors): 4353615 | Size: 317833 Mo

+++++ PhysicalDrive1: +++++
--- User ---
[MBR] 0d4c5d67d852731df078e06d62ac769c
[BSP] 33a07a59d299ab4ea9f4ab0156f9d86f : Windows XP MBR Code
Partition table:
0 - [ACTIVE] FAT32 [VISIBLE] Offset (sectors): 64 | Size: 2038 Mo
User = LL1 ... OK!
Error reading LL2 MBR!

Finished : << RKreport[2].txt >>
RKreport[1].txt ; RKreport[2].txt



OTL.TXT
OTL logfile created on: 12/31/2011 5:19:49 PM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Documents and Settings\Trey\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.95 Gb Total Physical Memory | 2.08 Gb Available Physical Memory | 70.62% Memory free
4.79 Gb Paging File | 4.09 Gb Available in Paging File | 85.37% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 296.01 Gb Total Space | 106.35 Gb Free Space | 35.93% Space Free | Partition Type: NTFS
Drive D: | 2.00 Gb Total Space | 1.14 Gb Free Space | 57.10% Space Free | Partition Type: NTFS
Drive E: | 1.89 Gb Total Space | 1.85 Gb Free Space | 97.74% Space Free | Partition Type: FAT32
Drive T: | 1842.88 Gb Total Space | 1700.23 Gb Free Space | 92.26% Space Free | Partition Type: NTFS
Drive U: | 1842.88 Gb Total Space | 1700.23 Gb Free Space | 92.26% Space Free | Partition Type: NTFS
Drive V: | 1842.88 Gb Total Space | 1700.23 Gb Free Space | 92.26% Space Free | Partition Type: NTFS
Drive W: | 1842.88 Gb Total Space | 1700.23 Gb Free Space | 92.26% Space Free | Partition Type: NTFS
Drive X: | 1842.88 Gb Total Space | 1700.23 Gb Free Space | 92.26% Space Free | Partition Type: NTFS
Drive Y: | 1842.88 Gb Total Space | 1700.23 Gb Free Space | 92.26% Space Free | Partition Type: NTFS
Drive Z: | 1842.88 Gb Total Space | 1700.23 Gb Free Space | 92.26% Space Free | Partition Type: NTFS

Computer Name: TREY-DELL | User Name: Trey | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/12/31 16:56:06 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Trey\Desktop\OTL.exe
PRC - [2011/11/29 18:23:53 | 000,642,424 | ---- | M] (BitTorrent, Inc.) -- C:\Program Files\uTorrent\uTorrent.exe
PRC - [2011/11/09 22:02:47 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2011/09/26 17:15:42 | 000,136,584 | ---- | M] (LogMeIn, Inc.) -- C:\Program Files\LogMeIn\x86\ramaint.exe
PRC - [2011/09/26 17:15:36 | 000,374,152 | ---- | M] (LogMeIn, Inc.) -- C:\Program Files\LogMeIn\x86\LMIGuardianSvc.exe
PRC - [2011/08/05 19:14:36 | 000,207,360 | ---- | M] (Iomega Corp) -- C:\Program Files\Iomega Storage Manager\pCloudd.exe
PRC - [2011/08/05 19:12:34 | 002,158,160 | ---- | M] (EMC) -- C:\Program Files\Iomega Storage Manager\IomegaStorageManager.exe
PRC - [2011/05/25 14:07:14 | 024,176,560 | ---- | M] (Dropbox, Inc.) -- C:\Documents and Settings\Trey\Application Data\Dropbox\bin\Dropbox.exe
PRC - [2011/01/11 18:04:04 | 000,390,528 | ---- | M] (LogMeIn, Inc.) -- C:\Program Files\LogMeIn\x86\LogMeIn.exe
PRC - [2011/01/11 18:04:04 | 000,063,048 | ---- | M] (LogMeIn, Inc.) -- C:\Program Files\LogMeIn\x86\LogMeInSystray.exe
PRC - [2010/10/29 13:49:28 | 000,505,064 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Common Files\Java\Java Update\jucheck.exe
PRC - [2010/06/29 15:15:18 | 000,073,728 | ---- | M] (Software 2000 Limited) -- C:\WINDOWS\system32\spool\drivers\w32x86\3\HP1006MC.EXE
PRC - [2010/01/15 06:49:20 | 000,255,536 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe
PRC - [2008/06/11 21:36:44 | 000,007,680 | R--- | M] (tenx) -- C:\Documents and Settings\Trey\Local Settings\Temp\Imgtask.exe
PRC - [2008/04/14 06:00:00 | 001,058,816 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe


========== Modules (No Company Name) ==========

MOD - [2011/11/09 22:02:46 | 001,989,592 | ---- | M] () -- C:\Program Files\Mozilla Firefox\mozjs.dll
MOD - [2011/09/27 06:23:00 | 000,087,912 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2011/09/27 06:22:40 | 001,242,472 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2011/08/24 07:37:34 | 006,277,280 | ---- | M] () -- C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll
MOD - [2011/08/05 19:14:40 | 006,302,208 | ---- | M] () -- C:\Program Files\Iomega Storage Manager\wxmsw28u_vc_custom.dll
MOD - [2011/03/02 11:40:51 | 000,140,288 | ---- | M] () -- C:\Program Files\WinRAR\RarExt.dll


========== Win32 Services (SafeList) ==========

SRV - [2011/09/26 17:15:42 | 000,136,584 | ---- | M] (LogMeIn, Inc.) [Auto | Running] -- C:\Program Files\LogMeIn\x86\RaMaint.exe -- (LMIMaint)
SRV - [2011/09/26 17:15:36 | 000,374,152 | ---- | M] (LogMeIn, Inc.) [Auto | Running] -- C:\Program Files\LogMeIn\x86\LMIGuardianSvc.exe -- (LMIGuardianSvc)
SRV - [2011/08/05 19:14:36 | 000,207,360 | ---- | M] (Iomega Corp) [Auto | Running] -- C:\Program Files\Iomega Storage Manager\pCloudd.exe -- (PCloudd)
SRV - [2011/01/11 18:04:04 | 000,390,528 | ---- | M] (LogMeIn, Inc.) [Auto | Running] -- C:\Program Files\LogMeIn\x86\LogMeIn.exe -- (LogMeIn)
SRV - [2010/08/27 13:31:00 | 000,185,640 | ---- | M] () [On_Demand | Stopped] -- C:\Documents and Settings\Trey\Application Data\Mikogo\B-Service.exe -- (B-Service)
SRV - [2010/02/19 12:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)
SRV - [2010/01/15 06:49:20 | 000,227,232 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe -- (McComponentHostService)


========== Driver Services (SafeList) ==========

DRV - [2011/09/26 17:16:14 | 000,083,360 | ---- | M] (LogMeIn, Inc.) [File_System | Disabled | Stopped] -- C:\WINDOWS\System32\LMIRfsClientNP.dll -- (LMIRfsClientNP)
DRV - [2011/08/05 19:14:36 | 000,017,488 | ---- | M] (Iomega Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\vNICdrv.sys -- (vNICdrv)
DRV - [2011/01/11 18:04:04 | 000,047,640 | ---- | M] (LogMeIn, Inc.) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\LMIRfsDriver.sys -- (LMIRfsDriver)
DRV - [2011/01/11 18:04:04 | 000,012,856 | ---- | M] (LogMeIn, Inc.) [Kernel | Auto | Running] -- C:\Program Files\LogMeIn\x86\rainfo.sys -- (LMIInfo)
DRV - [2010/05/06 16:35:00 | 000,829,152 | ---- | M] (Ralink Technology, Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AE1000XP.sys -- (AE1000)
DRV - [2009/08/02 18:57:00 | 000,724,736 | ---- | M] (Ralink Technology, Corp.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\rt2870.sys -- (rt2870)
DRV - [2008/06/05 10:58:18 | 000,144,480 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\e1k5132.sys -- (e1kexpress) Intel®
DRV - [2008/03/28 09:14:02 | 000,024,064 | ---- | M] (Sonic Focus, Inc) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\sfaudio.sys -- (SFAUDIO)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm


IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = about:blank
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = about:blank
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-602162358-1957994488-1801674531-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-602162358-1957994488-1801674531-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: [email protected]:1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: [email protected]:1.0.0.652
FF - prefs.js..extensions.enabledItems: {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}:5.3.0.7550

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@canon.com/EPPEX: C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Documents and Settings\Trey\Local Settings\Application Data\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Documents and Settings\Trey\Local Settings\Application Data\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/12/04 17:30:45 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/12/30 18:20:59 | 000,000,000 | ---D | M]

[2010/08/25 13:18:59 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Trey\Application Data\Mozilla\Extensions
[2011/12/30 18:23:46 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Trey\Application Data\Mozilla\Firefox\Profiles\n326t66v.default\extensions
[2010/11/02 19:38:18 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Trey\Application Data\Mozilla\Firefox\Profiles\n326t66v.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/12/30 18:23:46 | 000,000,000 | ---D | M] (FT DeepDark) -- C:\Documents and Settings\Trey\Application Data\Mozilla\Firefox\Profiles\n326t66v.default\extensions\{77d2ed30-4cd2-11e0-b8af-0800200c9a66}
[2011/06/16 20:24:01 | 000,000,000 | ---D | M] (LogMeIn, Inc. Remote Access Plugin) -- C:\Documents and Settings\Trey\Application Data\Mozilla\Firefox\Profiles\n326t66v.default\extensions\[email protected]
[2011/11/09 22:02:48 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2011/08/07 16:57:20 | 000,000,000 | ---D | M] (Skype extension) -- C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2011/01/31 21:50:17 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2011/11/09 22:02:47 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011/03/18 12:32:12 | 000,091,552 | ---- | M] (Coupons, Inc.) -- C:\Program Files\mozilla firefox\plugins\npCouponPrinter.dll
[2011/02/02 20:40:24 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2011/03/18 12:32:14 | 000,091,552 | ---- | M] (Coupons, Inc.) -- C:\Program Files\mozilla firefox\plugins\npMozCouponPrinter.dll
[2011/08/11 21:16:35 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2011/11/09 22:02:47 | 000,002,040 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\twitter.xml

O1 HOSTS File: ([2011/12/30 01:51:45 | 000,000,884 | R--- | M]) - C:\WINDOWS\system32\drivers\etc\HOSTS
O1 - Hosts: 94.63.240.133 www.google.com
O1 - Hosts: 94.63.240.134 www.bing.com
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O4 - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [hpbdfawep] C:\Program Files\HP\Dfawep\bin\hpbdfawep.exe ()
O4 - HKLM..\Run: [ImgTask] C:\Documents and Settings\Trey\Local Settings\Temp\Imgtask.exe (tenx)
O4 - HKLM..\Run: [LogMeIn GUI] C:\Program Files\LogMeIn\x86\LogMeInSystray.exe (LogMeIn, Inc.)
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKU\S-1-5-21-602162358-1957994488-1801674531-1003..\Run: [uTorrent] C:\Program Files\uTorrent\uTorrent.exe (BitTorrent, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Iomega Storage Manager.lnk = C:\Program Files\Iomega Storage Manager\IomegaStorageManager.exe (EMC)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk = C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
O4 - Startup: C:\Documents and Settings\Trey\Start Menu\Programs\Startup\Dropbox.lnk = C:\Documents and Settings\Trey\Application Data\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 1
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-602162358-1957994488-1801674531-1003\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKU\S-1-5-21-602162358-1957994488-1801674531-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macr...ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} https://us.myweather...SetupClient.cab (JuniperSetupClientControl Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.69.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0F54BACB-28DF-419C-BFB1-73545C0FEFB7}: DhcpNameServer = 192.168.69.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C86BBD1A-DF99-4ECF-914C-9D094132BE31}: DhcpNameServer = 192.168.1.254
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\LMIinit: DllName - (LMIinit.dll) - C:\WINDOWS\System32\LMIinit.dll (LogMeIn, Inc.)
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/09/03 15:12:15 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2010/02/10 23:58:48 | 000,000,128 | ---- | M] () - E:\autorun.ini -- [ FAT32 ]
O33 - MountPoints2\{05c6d1ba-e624-11df-8e8c-00259cfc3a19}\Shell\AutoRun\command - "" = F:\Setup.exe
O33 - MountPoints2\{05c6d1ba-e624-11df-8e8c-00259cfc3a19}\Shell\Install\command - "" = F:\Setup.exe
O33 - MountPoints2\{caf98d43-7306-11e0-8e9b-00259cfc3a19}\Shell - "" = AutoRun
O33 - MountPoints2\{caf98d43-7306-11e0-8e9b-00259cfc3a19}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{caf98d43-7306-11e0-8e9b-00259cfc3a19}\Shell\AutoRun\command - "" = E:\DigitalPhotoViewer.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKU\S-1-5-21-602162358-1957994488-1801674531-1003\...exe [@ = exefile] -- Reg Error: Key error. File not found

NetSvcs: 6to4 - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: 12 - File not found

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2011/12/31 16:58:24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Trey\Desktop\RK_Quarantine
[2011/12/31 16:58:23 | 004,702,720 | ---- | C] (AVAST Software) -- C:\Documents and Settings\Trey\Desktop\aswMBR.exe
[2011/12/31 16:58:23 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Trey\Desktop\OTL.exe
[2011/12/31 10:36:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Sun
[2011/12/31 10:23:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/12/30 22:14:49 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Trey\Recent
[2011/12/30 18:20:03 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2011/12/30 17:56:04 | 000,000,000 | --SD | C] -- C:\Documents and Settings\Trey\UserData
[2011/12/29 08:56:42 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Trey\Start Menu\Programs\System Check
[2011/12/04 17:30:40 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\QuickTime
[2011/12/04 17:30:29 | 000,000,000 | ---D | C] -- C:\Program Files\QuickTime
[2011/12/04 17:25:40 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\iTunes
[2011/12/04 17:25:11 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[18 C:\Documents and Settings\All Users\Application Data\*.tmp files -> C:\Documents and Settings\All Users\Application Data\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/12/31 17:19:41 | 000,000,314 | ---- | M] () -- C:\WINDOWS\tasks\HP WEP.job
[2011/12/31 17:13:55 | 000,476,760 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2011/12/31 17:13:55 | 000,077,350 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2011/12/31 17:10:01 | 000,000,974 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-602162358-1957994488-1801674531-1003UA.job
[2011/12/31 17:09:44 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011/12/31 17:09:25 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011/12/31 16:59:08 | 000,111,872 | ---- | M] () -- C:\WINDOWS\System32\drivers\TrueSight.sys
[2011/12/31 16:56:38 | 004,702,720 | ---- | M] (AVAST Software) -- C:\Documents and Settings\Trey\Desktop\aswMBR.exe
[2011/12/31 16:56:06 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Trey\Desktop\OTL.exe
[2011/12/31 16:53:36 | 000,775,168 | ---- | M] () -- C:\Documents and Settings\Trey\Desktop\RogueKiller.exe
[2011/12/31 10:10:08 | 000,000,922 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-602162358-1957994488-1801674531-1003Core.job
[2011/12/30 21:28:43 | 000,015,292 | -HS- | M] () -- C:\Documents and Settings\Trey\Local Settings\Application Data\4hi6b23cid6c68ciwcd2358eu351eeh00t8e
[2011/12/30 21:28:43 | 000,015,292 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\4hi6b23cid6c68ciwcd2358eu351eeh00t8e
[2011/12/30 19:15:57 | 000,068,608 | ---- | M] () -- C:\Documents and Settings\All Users\Documents\19792079
[2011/12/29 08:56:51 | 000,000,312 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\~TA9XzaJF8HJt1H
[2011/12/29 08:56:51 | 000,000,224 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\~TA9XzaJF8HJt1Hr
[2011/12/29 08:56:42 | 000,000,853 | ---- | M] () -- C:\Documents and Settings\Trey\Application Data\Microsoft\Internet Explorer\Quick Launch\System Check.lnk
[2011/12/29 08:56:41 | 000,000,336 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\TA9XzaJF8HJt1H
[2011/12/26 23:48:00 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2011/12/15 05:44:40 | 003,567,120 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011/12/15 03:01:49 | 000,001,393 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2011/12/13 18:11:04 | 000,002,277 | ---- | M] () -- C:\Documents and Settings\Trey\Desktop\Google Chrome.lnk
[2011/12/13 18:11:04 | 000,002,255 | ---- | M] () -- C:\Documents and Settings\Trey\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2011/12/10 15:24:06 | 000,020,464 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2011/12/05 20:41:09 | 000,068,334 | ---- | M] () -- C:\Documents and Settings\Trey\My Documents\lauras santa hat.jpg
[2011/12/05 20:33:08 | 000,054,309 | ---- | M] () -- C:\Documents and Settings\Trey\My Documents\santahat2.jpg
[2011/12/05 20:18:24 | 000,114,406 | ---- | M] () -- C:\Documents and Settings\Trey\My Documents\2 santa hats.jpg
[2011/12/05 20:15:17 | 000,026,001 | ---- | M] () -- C:\Documents and Settings\Trey\My Documents\SantaHatColorPage.jpg
[2011/12/05 12:40:38 | 000,355,265 | ---- | M] () -- C:\Documents and Settings\Trey\My Documents\dmieast.pdf
[2011/12/04 18:28:13 | 000,000,858 | ---- | M] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Iomega Storage Manager.lnk
[2011/12/04 18:27:56 | 000,000,840 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Iomega Storage Manager.lnk
[2011/12/04 17:30:40 | 000,001,604 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\QuickTime Player.lnk
[2011/12/04 17:28:02 | 000,001,854 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Safari.lnk
[2011/12/04 17:25:40 | 000,001,542 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2011/12/04 17:18:07 | 000,081,669 | ---- | M] () -- C:\Documents and Settings\Trey\My Documents\WInitialwordnaming.pdf
[2011/12/04 17:11:04 | 000,000,127 | ---- | M] () -- C:\deleteprintjobs.cmd
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[18 C:\Documents and Settings\All Users\Application Data\*.tmp files -> C:\Documents and Settings\All Users\Application Data\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/12/31 17:19:40 | 000,000,314 | ---- | C] () -- C:\WINDOWS\tasks\HP WEP.job
[2011/12/31 16:58:36 | 000,111,872 | ---- | C] () -- C:\WINDOWS\System32\drivers\TrueSight.sys
[2011/12/31 16:58:23 | 000,775,168 | ---- | C] () -- C:\Documents and Settings\Trey\Desktop\RogueKiller.exe
[2011/12/31 10:23:57 | 000,001,878 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Skype.lnk
[2011/12/31 10:23:57 | 000,001,824 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Shop for HP Supplies.lnk
[2011/12/31 10:23:57 | 000,000,630 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\µTorrent.lnk
[2011/12/31 10:23:56 | 000,001,854 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Safari.lnk
[2011/12/31 10:23:56 | 000,001,734 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Canon Easy-PhotoPrint EX.lnk
[2011/12/31 10:23:56 | 000,001,619 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\McAfee Security Scan Plus.lnk
[2011/12/31 10:23:56 | 000,001,604 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\QuickTime Player.lnk
[2011/12/31 10:23:56 | 000,001,542 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2011/12/31 10:23:56 | 000,000,840 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Iomega Storage Manager.lnk
[2011/12/31 10:23:56 | 000,000,829 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\FanDraft Football 2010.lnk
[2011/12/31 10:23:56 | 000,000,784 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/12/31 10:23:56 | 000,000,759 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Picasa 3.lnk
[2011/12/31 10:23:56 | 000,000,724 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2011/12/31 10:23:53 | 000,002,255 | ---- | C] () -- C:\Documents and Settings\Trey\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2011/12/31 10:23:53 | 000,001,862 | ---- | C] () -- C:\Documents and Settings\Trey\Application Data\Microsoft\Internet Explorer\Quick Launch\Mikogo.lnk
[2011/12/31 10:23:53 | 000,001,854 | ---- | C] () -- C:\Documents and Settings\Trey\Application Data\Microsoft\Internet Explorer\Quick Launch\Apple Safari.lnk
[2011/12/31 10:23:53 | 000,000,804 | ---- | C] () -- C:\Documents and Settings\Trey\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk
[2011/12/31 10:23:53 | 000,000,792 | ---- | C] () -- C:\Documents and Settings\Trey\Application Data\Microsoft\Internet Explorer\Quick Launch\Microsoft Office Outlook.lnk
[2011/12/31 10:23:53 | 000,000,779 | ---- | C] () -- C:\Documents and Settings\Trey\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2011/12/31 10:23:53 | 000,000,742 | ---- | C] () -- C:\Documents and Settings\Trey\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2011/12/31 10:23:53 | 000,000,079 | ---- | C] () -- C:\Documents and Settings\Trey\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf
[2011/12/31 10:23:49 | 000,001,611 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
[2011/12/31 10:23:49 | 000,000,858 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Iomega Storage Manager.lnk
[2011/12/31 10:23:48 | 000,001,986 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\MSN.lnk
[2011/12/31 10:23:48 | 000,001,854 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Safari.lnk
[2011/12/31 10:23:48 | 000,001,830 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Apple Software Update.lnk
[2011/12/31 10:23:48 | 000,001,144 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Adobe ExtendScript Toolkit CS5.lnk
[2011/12/31 10:23:48 | 000,001,000 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Adobe Extension Manager CS5.lnk
[2011/12/31 10:23:48 | 000,000,909 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Adobe Device Central CS5.lnk
[2011/12/31 10:23:48 | 000,000,854 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Adobe Photoshop CS5.lnk
[2011/12/31 10:23:48 | 000,000,816 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Adobe Bridge CS5.lnk
[2011/12/31 10:23:48 | 000,000,786 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Windows Movie Maker.lnk
[2011/12/31 10:23:48 | 000,000,730 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Mozilla Firefox.lnk
[2011/12/31 10:23:48 | 000,000,728 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Adobe Help.lnk
[2011/12/31 10:23:48 | 000,000,719 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\LogMeIn.lnk
[2011/12/31 10:23:48 | 000,000,609 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Windows Messenger.lnk
[2011/12/30 19:15:57 | 000,068,608 | ---- | C] () -- C:\Documents and Settings\All Users\Documents\19792079
[2011/12/30 18:20:24 | 000,002,347 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Adobe Reader X.lnk
[2011/12/30 18:20:24 | 000,001,734 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader X.lnk
[2011/12/30 17:26:38 | 000,015,292 | -HS- | C] () -- C:\Documents and Settings\Trey\Local Settings\Application Data\4hi6b23cid6c68ciwcd2358eu351eeh00t8e
[2011/12/30 17:26:38 | 000,015,292 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\4hi6b23cid6c68ciwcd2358eu351eeh00t8e
[2011/12/29 18:53:58 | 000,000,853 | ---- | C] () -- C:\Documents and Settings\Trey\Application Data\Microsoft\Internet Explorer\Quick Launch\System Check.lnk
[2011/12/29 08:56:51 | 000,000,224 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\~TA9XzaJF8HJt1Hr
[2011/12/29 08:56:46 | 000,000,312 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\~TA9XzaJF8HJt1H
[2011/12/29 08:56:41 | 000,000,336 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\TA9XzaJF8HJt1H
[2011/12/05 20:41:07 | 000,068,334 | ---- | C] () -- C:\Documents and Settings\Trey\My Documents\lauras santa hat.jpg
[2011/12/05 20:33:06 | 000,054,309 | ---- | C] () -- C:\Documents and Settings\Trey\My Documents\santahat2.jpg
[2011/12/05 20:18:22 | 000,114,406 | ---- | C] () -- C:\Documents and Settings\Trey\My Documents\2 santa hats.jpg
[2011/12/05 20:15:16 | 000,026,001 | ---- | C] () -- C:\Documents and Settings\Trey\My Documents\SantaHatColorPage.jpg
[2011/12/05 12:40:38 | 000,355,265 | ---- | C] () -- C:\Documents and Settings\Trey\My Documents\dmieast.pdf
[2011/12/04 17:18:07 | 000,081,669 | ---- | C] () -- C:\Documents and Settings\Trey\My Documents\WInitialwordnaming.pdf
[2011/09/04 18:20:31 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011/05/13 09:31:27 | 000,056,136 | ---- | C] () -- C:\WINDOWS\System32\mlfcache.dat
[2011/01/13 03:15:58 | 000,269,198 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat
[2011/01/13 03:15:58 | 000,269,198 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-602162358-1957994488-1801674531-1003-0.dat
[2011/01/08 16:48:27 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\HPPLVS.dll
[2011/01/08 16:48:14 | 000,000,137 | ---- | C] () -- C:\WINDOWS\System32\AddPort.ini
[2011/01/08 16:46:35 | 000,000,753 | ---- | C] () -- C:\WINDOWS\hpntwksetup.ini
[2010/11/01 20:19:02 | 000,000,056 | ---- | C] () -- C:\WINDOWS\System32\ezsidmv.dat
[2010/11/01 20:04:58 | 000,000,969 | ---- | C] () -- C:\WINDOWS\unins000.dat
[2010/10/09 19:55:40 | 000,024,576 | ---- | C] () -- C:\Documents and Settings\Trey\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/08/28 17:47:22 | 000,014,051 | ---- | C] () -- C:\WINDOWS\System32\RaCoInst.dat
[2010/08/25 13:18:56 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2010/06/18 13:40:28 | 000,180,224 | ---- | C] () -- C:\WINDOWS\System32\hpputoar.dll
[2009/09/04 08:59:23 | 002,026,604 | ---- | C] () -- C:\WINDOWS\System32\igkrng500.bin
[2009/09/04 08:59:23 | 000,442,964 | ---- | C] () -- C:\WINDOWS\System32\igcompkrng500.bin
[2009/09/04 08:59:23 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\igfxCoIn_v4977.dll
[2009/09/03 15:13:16 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2009/09/03 15:10:46 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2009/09/03 10:06:24 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2009/09/03 10:05:43 | 003,567,120 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2008/04/14 06:00:00 | 001,033,728 | ---- | C] () -- C:\WINDOWS\expl.dat
[2008/04/14 06:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2008/04/14 06:00:00 | 000,507,904 | ---- | C] () -- C:\WINDOWS\System32\winl.dat
[2008/04/14 06:00:00 | 000,476,760 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2008/04/14 06:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2008/04/14 06:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2008/04/14 06:00:00 | 000,077,350 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2008/04/14 06:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2008/04/14 06:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2008/04/14 06:00:00 | 000,014,336 | ---- | C] () -- C:\WINDOWS\System32\svch.dat
[2008/04/14 06:00:00 | 000,014,336 | ---- | C] () -- C:\WINDOWS\System32\dllc.dat
[2008/04/14 06:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2008/04/14 06:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin
[2008/04/14 06:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2008/02/07 10:05:18 | 000,163,840 | ---- | C] () -- C:\WINDOWS\System32\hppatusg01.dll
[2005/04/15 10:52:33 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2005/04/15 10:52:33 | 000,004,627 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2004/06/26 17:00:00 | 000,077,257 | ---- | C] () -- C:\WINDOWS\unins000.exe
[2001/07/07 04:00:00 | 000,003,399 | ---- | C] () -- C:\WINDOWS\System32\hptcpmon.ini

========== LOP Check ==========

[2010/10/26 18:18:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\CanonBJ
[2011/03/18 09:24:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Juniper Networks
[2011/12/31 10:12:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\LogMeIn
[2011/04/10 14:48:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\regid.1986-12.com.adobe
[2011/08/24 16:09:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\RotoWire
[2010/08/25 13:31:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2011/10/28 21:42:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Laura\Application Data\uTorrent
[2011/01/31 22:17:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Trey\Application Data\.minecraft
[2011/12/31 17:19:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Trey\Application Data\Dropbox
[2010/11/01 20:11:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Trey\Application Data\GARMIN
[2011/03/18 09:24:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Trey\Application Data\Juniper Networks
[2011/11/12 08:02:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Trey\Application Data\Mikogo
[2011/12/31 17:19:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Trey\Application Data\uTorrent

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.exe >


< MD5 for: EXPLORER.EXE >
[2008/04/14 06:00:00 | 001,058,816 | ---- | M] (Microsoft Corporation) MD5=F92D05B1C0DE946CF66B11479247FBDE -- C:\WINDOWS\explorer.exe
[2008/04/14 06:00:00 | 001,058,816 | ---- | M] (Microsoft Corporation) MD5=F92D05B1C0DE946CF66B11479247FBDE -- C:\WINDOWS\system32\dllcache\explorer.exe

< MD5 for: SVCHOST.EXE >
[2008/04/14 06:00:00 | 000,039,936 | ---- | M] (Microsoft Corporation) MD5=ECD453C1AD7D2FF9448C24A65642FE17 -- C:\WINDOWS\system32\dllcache\svchost.exe
[2008/04/14 06:00:00 | 000,039,936 | ---- | M] (Microsoft Corporation) MD5=ECD453C1AD7D2FF9448C24A65642FE17 -- C:\WINDOWS\system32\svchost.exe

< MD5 for: USERINIT.EXE >
[2008/04/14 06:00:00 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 -- C:\WINDOWS\system32\dllcache\userinit.exe
[2008/04/14 06:00:00 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 -- C:\WINDOWS\system32\userinit.exe

< MD5 for: WINLOGON.EXE >
[2008/04/14 06:00:00 | 000,545,280 | ---- | M] (Microsoft Corporation) MD5=1300F6682BEA386767AE2A7C6C2DDCA7 -- C:\WINDOWS\system32\dllcache\winlogon.exe
[2008/04/14 06:00:00 | 000,545,280 | ---- | M] (Microsoft Corporation) MD5=1300F6682BEA386767AE2A7C6C2DDCA7 -- C:\WINDOWS\system32\winlogon.exe

< C:\Windows\assembly\tmp\U\*.* /s >

< %Temp%\smtmp\1\*.* >
[2009/09/03 15:12:15 | 000,000,294 | -HS- | M] () -- C:\DOCUME~1\Trey\LOCALS~1\Temp\smtmp\1\desktop.ini
[2009/09/03 15:12:15 | 000,001,607 | ---- | M] () -- C:\DOCUME~1\Trey\LOCALS~1\Temp\smtmp\1\Set Program Access and Defaults.lnk
[2009/09/03 15:12:15 | 000,000,398 | ---- | M] () -- C:\DOCUME~1\Trey\LOCALS~1\Temp\smtmp\1\Windows Catalog.lnk
[2009/09/03 15:12:15 | 000,001,507 | ---- | M] () -- C:\DOCUME~1\Trey\LOCALS~1\Temp\smtmp\1\Windows Update.lnk
[2011/11/29 18:23:53 | 000,000,630 | ---- | M] () -- C:\DOCUME~1\Trey\LOCALS~1\Temp\smtmp\1\µTorrent.lnk

< %Temp%\smtmp\2\*.* >
[2011/10/12 10:50:04 | 000,001,854 | ---- | M] () -- C:\DOCUME~1\Trey\LOCALS~1\Temp\smtmp\2\Apple Safari.lnk
[2009/09/03 15:45:02 | 000,000,119 | -HS- | M] () -- C:\DOCUME~1\Trey\LOCALS~1\Temp\smtmp\2\desktop.ini
[2011/12/13 18:11:04 | 000,002,255 | ---- | M] () -- C:\DOCUME~1\Trey\LOCALS~1\Temp\smtmp\2\Google Chrome.lnk
[2009/09/03 15:45:02 | 000,000,779 | ---- | M] () -- C:\DOCUME~1\Trey\LOCALS~1\Temp\smtmp\2\Launch Internet Explorer Browser.lnk
[2010/10/28 18:37:19 | 000,000,792 | ---- | M] () -- C:\DOCUME~1\Trey\LOCALS~1\Temp\smtmp\2\Microsoft Office Outlook.lnk
[2010/08/27 13:30:24 | 000,001,862 | ---- | M] () -- C:\DOCUME~1\Trey\LOCALS~1\Temp\smtmp\2\Mikogo.lnk
[2011/08/24 07:33:52 | 000,000,742 | ---- | M] () -- C:\DOCUME~1\Trey\LOCALS~1\Temp\smtmp\2\Mozilla Firefox.lnk
[2009/09/03 15:45:02 | 000,000,079 | ---- | M] () -- C:\DOCUME~1\Trey\LOCALS~1\Temp\smtmp\2\Show Desktop.scf
[2011/12/29 08:56:42 | 000,000,853 | ---- | M] () -- C:\DOCUME~1\Trey\LOCALS~1\Temp\smtmp\2\System Check.lnk
[2010/12/12 18:02:58 | 000,000,804 | ---- | M] () -- C:\DOCUME~1\Trey\LOCALS~1\Temp\smtmp\2\Windows Media Player.lnk

< %Temp%\smtmp\3\*.* >

< %Temp%\smtmp\4\*.* >
[2011/04/13 13:32:11 | 000,001,734 | ---- | M] () -- C:\DOCUME~1\Trey\LOCALS~1\Temp\smtmp\4\Adobe Reader X.lnk
[2010/10/26 18:17:53 | 000,001,734 | ---- | M] () -- C:\DOCUME~1\Trey\LOCALS~1\Temp\smtmp\4\Canon Easy-PhotoPrint EX.lnk
[2010/08/27 13:26:40 | 000,000,829 | ---- | M] () -- C:\DOCUME~1\Trey\LOCALS~1\Temp\smtmp\4\FanDraft Football 2010.lnk
[2011/12/04 18:27:56 | 000,000,840 | ---- | M] () -- C:\DOCUME~1\Trey\LOCALS~1\Temp\smtmp\4\Iomega Storage Manager.lnk
[2011/12/04 17:25:40 | 000,001,542 | ---- | M] () -- C:\DOCUME~1\Trey\LOCALS~1\Temp\smtmp\4\iTunes.lnk
[2011/10/12 10:51:56 | 000,000,784 | ---- | M] () -- C:\DOCUME~1\Trey\LOCALS~1\Temp\smtmp\4\Malwarebytes' Anti-Malware.lnk
[2010/12/30 16:33:21 | 000,001,619 | ---- | M] () -- C:\DOCUME~1\Trey\LOCALS~1\Temp\smtmp\4\McAfee Security Scan Plus.lnk
[2011/08/24 07:33:52 | 000,000,724 | ---- | M] () -- C:\DOCUME~1\Trey\LOCALS~1\Temp\smtmp\4\Mozilla Firefox.lnk
[2010/10/26 16:51:27 | 000,000,759 | ---- | M] () -- C:\DOCUME~1\Trey\LOCALS~1\Temp\smtmp\4\Picasa 3.lnk
[2011/12/04 17:30:40 | 000,001,604 | ---- | M] () -- C:\DOCUME~1\Trey\LOCALS~1\Temp\smtmp\4\QuickTime Player.lnk
[2011/12/04 17:28:02 | 000,001,854 | ---- | M] () -- C:\DOCUME~1\Trey\LOCALS~1\Temp\smtmp\4\Safari.lnk
[2011/01/08 16:48:52 | 000,001,824 | ---- | M] () -- C:\DOCUME~1\Trey\LOCALS~1\Temp\smtmp\4\Shop for HP Supplies.lnk
[2011/08/07 16:56:58 | 000,001,878 | ---- | M] () -- C:\DOCUME~1\Trey\LOCALS~1\Temp\smtmp\4\Skype.lnk
[2011/11/29 18:23:53 | 000,000,630 | ---- | M] () -- C:\DOCUME~1\Trey\LOCALS~1\Temp\smtmp\4\µTorrent.lnk

< End of report >


Extras.txt
OTL Extras logfile created on: 12/31/2011 5:19:50 PM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Documents and Settings\Trey\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.95 Gb Total Physical Memory | 2.08 Gb Available Physical Memory | 70.62% Memory free
4.79 Gb Paging File | 4.09 Gb Available in Paging File | 85.37% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 296.01 Gb Total Space | 106.35 Gb Free Space | 35.93% Space Free | Partition Type: NTFS
Drive D: | 2.00 Gb Total Space | 1.14 Gb Free Space | 57.10% Space Free | Partition Type: NTFS
Drive E: | 1.89 Gb Total Space | 1.85 Gb Free Space | 97.74% Space Free | Partition Type: FAT32
Drive T: | 1842.88 Gb Total Space | 1700.23 Gb Free Space | 92.26% Space Free | Partition Type: NTFS
Drive U: | 1842.88 Gb Total Space | 1700.23 Gb Free Space | 92.26% Space Free | Partition Type: NTFS
Drive V: | 1842.88 Gb Total Space | 1700.23 Gb Free Space | 92.26% Space Free | Partition Type: NTFS
Drive W: | 1842.88 Gb Total Space | 1700.23 Gb Free Space | 92.26% Space Free | Partition Type: NTFS
Drive X: | 1842.88 Gb Total Space | 1700.23 Gb Free Space | 92.26% Space Free | Partition Type: NTFS
Drive Y: | 1842.88 Gb Total Space | 1700.23 Gb Free Space | 92.26% Space Free | Partition Type: NTFS
Drive Z: | 1842.88 Gb Total Space | 1700.23 Gb Free Space | 92.26% Space Free | Partition Type: NTFS

Computer Name: TREY-DELL | User Name: Trey | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.url [@ = InternetShortcut] -- rundll32.exe shdocvw.dll,OpenURL %l

[HKEY_USERS\S-1-5-21-602162358-1957994488-1801674531-1003\SOFTWARE\Classes\<extension>]
.exe [@ = exefile] -- Reg Error: Key error. File not found
.html [@ = htmlfile] -- Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
InternetShortcut [open] -- rundll32.exe shdocvw.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [Bridge] -- C:\Program Files\Adobe\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 1
"FirewallOverride" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\uTorrent\uTorrent.exe" = C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent -- (BitTorrent, Inc.)
"C:\Program Files\Skype\Plugin Manager\skypePM.exe" = C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager
"C:\Documents and Settings\Trey\Application Data\Dropbox\bin\Dropbox.exe" = C:\Documents and Settings\Trey\Application Data\Dropbox\bin\Dropbox.exe:*:Enabled:Dropbox -- (Dropbox, Inc.)
"C:\Program Files\Mozilla Firefox\firefox.exe" = C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox -- (Mozilla Corporation)
"C:\Program Files\Ares\Ares.exe" = C:\Program Files\Ares\Ares.exe:*:Enabled:Ares p2p for windows -- (Ares Development Group)
"C:\Program Files\Common Files\Apple\Apple Application Support\WebKit2WebProcess.exe" = C:\Program Files\Common Files\Apple\Apple Application Support\WebKit2WebProcess.exe:*:Enabled:WebKit -- (Apple Inc.)
"C:\Program Files\Iomega Storage Manager\IomegaStorageManager.exe" = C:\Program Files\Iomega Storage Manager\IomegaStorageManager.exe:*:Enabled:Iomega Storage Manager 1.2.4.48286 -- (EMC)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0D2DBE8A-43D0-7830-7AE7-CA6C99A832E7}" = Adobe Community Help
"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_iP2600_series" = Canon iP2600 series
"{15FEDA5F-141C-4127-8D7E-B962D1742728}" = Adobe Photoshop CS5
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83216023FF}" = Java™ 6 Update 24
"{3127F76D-5335-4AC7-BD1E-2F5247A23C24}" = iTunes
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{343666E2-A059-48AC-AD67-230BF74E2DB2}" = Apple Application Support
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{40F79A41-1EEC-465A-8929-6E8A4EC51511}_is1" = RotoWire Football Software 2011
"{414A373B-59DF-4102-94CA-9FE9A74CBDDA}" = Garmin Trip and Waypoint Manager v5
"{42929F0F-CE14-47AF-9FC7-FF297A603021}" = Dell Resource CD
"{42F0FD29-7EB3-4CAA-AF10-BC2619B96D80}" = MrvlUsgTracking
"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant
"{46C045BF-2B3F-4BC4-8E4C-00E0CF8BD9DB}" = Adobe AIR
"{474F25F5-BDC9-40E5-B1B6-F6BF23FC106F}" = Windows Live Essentials
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{710BF966-43C8-4216-A8EC-BC4E169FF7C1}" = MobileMe Control Panel
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7902E313-FF0F-4493-ACB1-A8147B78DCD0}" = HPSSupply
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{7B02BF60-796D-4616-908B-B31A63CFDEFB}" = HPCarePackCore
"{7BE15435-2D3E-4B58-867F-9C75BED0208C}" = QuickTime
"{803259ED-7A67-4CB5-B6D7-281ED371091B}" = LogMeIn
"{8153ED9A-C94A-426E-9880-5E6775C08B62}" = Apple Mobile Device Support
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90120000-0010-0409-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (English) 12
"{90120000-0014-0000-0000-0000000FF1CE}" = Microsoft Office Professional 2007
"{90120000-0014-0000-0000-0000000FF1CE}_PRO_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0014-0000-0000-0000000FF1CE}_PRO_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_PRO_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_PRO_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_PRO_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_PRO_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_PRO_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_PRO_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_PRO_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_PRO_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_PRO_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_PRO_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_PRO_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_PRO_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90FF23FE-0E1B-40DF-A22E-B4C0372E5936}" = Iomega Product Registration
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A78FE97A-C0C8-49CE-89D0-EDD524A17392}" = PDF Settings CS5
"{A82D052A-0806-42DF-80CD-1730A1AC0ED3}" = MrvlUsgTracking
"{A8DD74DC-14C4-4BA0-8DF7-D84524D0B0D2}" = ST Microelectronics TPM Driver Installer
"{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.1)
"{B10914FD-8812-47A4-85A1-50FCDE7F1F33}" = Windows Live Sync
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Toolbars
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C6AAD866-9E5A-47E6-A880-432226783CD0}" = iTuner
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D6F879CC-59D6-4D4B-AE9B-D761E48D25ED}" = Skype™ 5.3
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{DE3A9DC5-9A5D-6485-9662-347162C7E4CA}" = Adobe Media Player
"{ECA31632-C2AD-4774-A3CA-2813D47E4DD0}" = HPCarePackProducts
"{EE39FFBD-544E-49E4-A999-6819828EAE91}" = Windows Live Photo Gallery
"{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F2AF3E5D-9697-485C-A5AC-E2B9468C446A}" = Safari
"35858E766EFC35B58A45C301DD358D503119A8FA" = Windows Driver Package - STMicroelectronics (stmtpm) System (05/24/2007 1.00.04.15)
"Adobe AIR" = Adobe AIR
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Ares" = Ares 2.1.7
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player
"Coupon Printer for Windows5.0.0.1" = Coupon Printer for Windows
"Easy-PhotoPrint EX" = Canon Easy-PhotoPrint EX
"FanDraft Football 2010_is1" = FanDraft Football v10.17
"FanDraft Football 2011_is1" = FanDraft Football v11.25(b)
"HDMI" = Intel® Graphics Media Accelerator Driver
"HP LaserJet P1500 series" = HP LaserJet P1500 series
"Iomega Storage Manager" = Iomega Storage Manager
"LBMaps_is1" = Baja Map V1.00
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware version 1.51.2.1300
"McAfee Security Scan" = McAfee Security Scan Plus
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Mikogo" = Mikogo
"Mozilla Firefox 8.0 (x86 en-US)" = Mozilla Firefox 8.0 (x86 en-US)
"Picasa 3" = Picasa 3
"PRO" = Microsoft Office Professional 2007
"PROSet" = Intel® Network Connections Drivers
"uTorrent" = µTorrent
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR 4.00 (32-bit)

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-602162358-1957994488-1801674531-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
"Google Chrome" = Google Chrome
"Juniper_Setup_Client" = Juniper Networks Setup Client

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 1/30/2011 3:51:17 PM | Computer Name = TREY-DELL | Source = Bonjour Service | ID = 100
Description = 248: ERROR: read_msg errno 10054 (An existing connection was forcibly
closed by the remote host.)

Error - 1/30/2011 3:51:17 PM | Computer Name = TREY-DELL | Source = Bonjour Service | ID = 100
Description = 204: ERROR: read_msg errno 10054 (An existing connection was forcibly
closed by the remote host.)

Error - 1/30/2011 3:51:17 PM | Computer Name = TREY-DELL | Source = Bonjour Service | ID = 100
Description = 220: ERROR: read_msg errno 10054 (An existing connection was forcibly
closed by the remote host.)

Error - 1/30/2011 3:51:17 PM | Computer Name = TREY-DELL | Source = Bonjour Service | ID = 100
Description = 404: ERROR: read_msg errno 10054 (An existing connection was forcibly
closed by the remote host.)

Error - 1/30/2011 3:51:17 PM | Computer Name = TREY-DELL | Source = Bonjour Service | ID = 100
Description = 416: ERROR: read_msg errno 10054 (An existing connection was forcibly
closed by the remote host.)

Error - 1/30/2011 3:51:17 PM | Computer Name = TREY-DELL | Source = Bonjour Service | ID = 100
Description = 428: ERROR: read_msg errno 10054 (An existing connection was forcibly
closed by the remote host.)

Error - 4/18/2011 4:56:06 PM | Computer Name = TREY-DELL | Source = .NET Runtime Optimization Service | ID = 1103
Description = .NET Runtime Optimization Service (clr_optimization_v2.0.50727_32)
- Tried to start a service that wasn't the latest version of CLR Optimization service.
Will shutdown

Error - 5/23/2011 1:16:20 PM | Computer Name = TREY-DELL | Source = Bonjour Service | ID = 100
Description = 416: ERROR: read_msg errno 10054 (An existing connection was forcibly
closed by the remote host.)

Error - 6/7/2011 6:37:05 AM | Computer Name = TREY-DELL | Source = Application Error | ID = 1000
Description = Faulting application skype.exe, version 5.1.0.112, faulting module
skype.exe, version 5.1.0.112, fault address 0x005ff078.

[ System Events ]
Error - 4/18/2011 4:56:20 PM | Computer Name = TREY-DELL | Source = Print | ID = 54
Description = Document Target.com - Returns Center was corrupted and has been deleted.
The associated driver is: HP LaserJet P1500 Series PCL 5e.


< End of report >



aswMBR
aswMBR version 0.9.9.1124 Copyright© 2011 AVAST Software
Run date: 2011-12-31 17:48:14
-----------------------------
17:48:14.718 OS Version: Windows 5.1.2600 Service Pack 3
17:48:14.718 Number of processors: 2 586 0x170A
17:48:14.718 ComputerName: TREY-DELL UserName: Trey
17:48:15.796 Initialze error 0 - driver not loaded
17:49:11.421 Service scanning
17:49:12.171 Modules scanning
17:49:12.171 Disk 0 trace - called modules:
17:49:12.171
17:49:12.171 Scan finished successfully
17:52:25.359 The log file has been saved successfully to "C:\Documents and Settings\Trey\Desktop\aswMBR.txt"

[Essexboy]

Could you confirm that you ran Roguekiller with option 6 selected. You appear to have the latest MBR infection I will need to confirm that before I determine how to fix it

Warning This fix is only relevant for this system and no other, using on another computer may cause problems

Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  

  :OTL
  O4 - HKLM..\Run: [ImgTask] C:\Documents and Settings\Trey\Local Settings\Temp\Imgtask.exe (tenx)
  O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 1
  O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
  O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 1
  O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
  [2011/12/30 21:28:43 | 000,015,292 | -HS- | M] () -- C:\Documents and Settings\Trey\Local Settings\Application Data\4hi6b23cid6c68ciwcd2358eu351eeh00t8e
  [2011/12/30 21:28:43 | 000,015,292 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\4hi6b23cid6c68ciwcd2358eu351eeh00t8e
  [2011/12/30 19:15:57 | 000,068,608 | ---- | M] () -- C:\Documents and Settings\All Users\Documents\19792079
  [2011/12/29 08:56:51 | 000,000,312 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\~TA9XzaJF8HJt1H
  [2011/12/29 08:56:51 | 000,000,224 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\~TA9XzaJF8HJt1Hr
  [2011/12/29 08:56:42 | 000,000,853 | ---- | M] () -- C:\Documents and Settings\Trey\Application Data\Microsoft\Internet Explorer\Quick Launch\System Check.lnk
  [2011/12/29 08:56:41 | 000,000,336 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\TA9XzaJF8HJt1H
  [2011/12/30 19:15:57 | 000,068,608 | ---- | C] () -- C:\Documents and Settings\All Users\Documents\19792079
  [2011/12/30 17:26:38 | 000,015,292 | -HS- | C] () -- C:\Documents and Settings\Trey\Local Settings\Application Data\4hi6b23cid6c68ciwcd2358eu351eeh00t8e
  [2011/12/30 17:26:38 | 000,015,292 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\4hi6b23cid6c68ciwcd2358eu351eeh00t8e
  [2011/12/29 18:53:58 | 000,000,853 | ---- | C] () -- C:\Documents and Settings\Trey\Application Data\Microsoft\Internet Explorer\Quick Launch\System Check.lnk
  [2011/12/29 08:56:51 | 000,000,224 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\~TA9XzaJF8HJt1Hr
  [2011/12/29 08:56:46 | 000,000,312 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\~TA9XzaJF8HJt1H
  [2011/12/29 08:56:41 | 000,000,336 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\TA9XzaJF8HJt1H
  
  :Files
  ipconfig /flushdns /c
  xcopy %Temp%\smtmp\1 "%AllUsersProfile%\Start Menu" /H /I /S /Y /C
  xcopy %Temp%\smtmp\2 "%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch" /H /I /S /Y /C
  xcopy %Temp%\smtmp\3 "%AppData%\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar" /H /I /S /Y /C
  xcopy %Temp%\smtmp\4 "%AllUsersProfile%\Desktop" /H /I /S /Y /C
  
  :Commands
  [purity]
  [resethosts]
  [CREATERESTOREPOINT]
  [Reboot]

• Then click the Run Fix button at the top
• Let the program run unhindered, reboot the PC when it is done
• Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

THEN

Do the following:
Start -> Run
type diskmgmt.msc
Click "OK"

Disk Management will open.

Click and hold the right side of the Disk Management Window and drag it to the right until you can see all the columns.

Take a screen Shot of the Disk Management Window and attach the screen shot to your reply.

[Trey Palreiro]

I accidentally ran rouge killer on 2 twice. I reran it on 6.



OTL logfile created on: 1/2/2012 7:04:28 PM - Run 2
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Documents and Settings\Trey\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.95 Gb Total Physical Memory | 2.35 Gb Available Physical Memory | 79.74% Memory free
4.79 Gb Paging File | 4.37 Gb Available in Paging File | 91.18% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 296.01 Gb Total Space | 105.13 Gb Free Space | 35.52% Space Free | Partition Type: NTFS
Drive D: | 2.00 Gb Total Space | 1.14 Gb Free Space | 57.17% Space Free | Partition Type: NTFS
Drive E: | 1.89 Gb Total Space | 1.85 Gb Free Space | 97.74% Space Free | Partition Type: FAT32
Drive T: | 1842.88 Gb Total Space | 1700.20 Gb Free Space | 92.26% Space Free | Partition Type: NTFS
Drive U: | 1842.88 Gb Total Space | 1700.20 Gb Free Space | 92.26% Space Free | Partition Type: NTFS
Drive V: | 1842.88 Gb Total Space | 1700.20 Gb Free Space | 92.26% Space Free | Partition Type: NTFS
Drive W: | 1842.88 Gb Total Space | 1700.20 Gb Free Space | 92.26% Space Free | Partition Type: NTFS
Drive X: | 1842.88 Gb Total Space | 1700.20 Gb Free Space | 92.26% Space Free | Partition Type: NTFS
Drive Y: | 1842.88 Gb Total Space | 1700.20 Gb Free Space | 92.26% Space Free | Partition Type: NTFS
Drive Z: | 1842.88 Gb Total Space | 1700.20 Gb Free Space | 92.26% Space Free | Partition Type: NTFS

Computer Name: TREY-DELL | User Name: Trey | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/12/31 16:56:06 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Trey\Desktop\OTL.exe
PRC - [2011/11/29 18:23:53 | 000,642,424 | ---- | M] (BitTorrent, Inc.) -- C:\Program Files\uTorrent\uTorrent.exe
PRC - [2011/09/26 17:15:42 | 000,136,584 | ---- | M] (LogMeIn, Inc.) -- C:\Program Files\LogMeIn\x86\ramaint.exe
PRC - [2011/09/26 17:15:36 | 000,374,152 | ---- | M] (LogMeIn, Inc.) -- C:\Program Files\LogMeIn\x86\LMIGuardianSvc.exe
PRC - [2011/08/05 19:14:36 | 000,207,360 | ---- | M] (Iomega Corp) -- C:\Program Files\Iomega Storage Manager\pCloudd.exe
PRC - [2011/08/05 19:12:34 | 002,158,160 | ---- | M] (EMC) -- C:\Program Files\Iomega Storage Manager\IomegaStorageManager.exe
PRC - [2011/05/25 14:07:14 | 024,176,560 | ---- | M] (Dropbox, Inc.) -- C:\Documents and Settings\Trey\Application Data\Dropbox\bin\Dropbox.exe
PRC - [2011/01/11 18:04:04 | 000,390,528 | ---- | M] (LogMeIn, Inc.) -- C:\Program Files\LogMeIn\x86\LogMeIn.exe
PRC - [2011/01/11 18:04:04 | 000,063,048 | ---- | M] (LogMeIn, Inc.) -- C:\Program Files\LogMeIn\x86\LogMeInSystray.exe
PRC - [2010/06/29 15:15:18 | 000,073,728 | ---- | M] (Software 2000 Limited) -- C:\WINDOWS\system32\spool\drivers\w32x86\3\HP1006MC.EXE
PRC - [2010/01/15 06:49:20 | 000,255,536 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe
PRC - [2008/04/14 06:00:00 | 001,058,816 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007/04/25 14:28:34 | 000,954,368 | ---- | M] () -- C:\Program Files\HP\Dfawep\bin\hpbdfawep.exe


========== Modules (No Company Name) ==========

MOD - [2011/09/27 06:23:00 | 000,087,912 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2011/09/27 06:22:40 | 001,242,472 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2011/08/05 19:14:40 | 006,302,208 | ---- | M] () -- C:\Program Files\Iomega Storage Manager\wxmsw28u_vc_custom.dll
MOD - [2007/04/25 14:28:34 | 000,954,368 | ---- | M] () -- C:\Program Files\HP\Dfawep\bin\hpbdfawep.exe


========== Win32 Services (SafeList) ==========

SRV - [2011/09/26 17:15:42 | 000,136,584 | ---- | M] (LogMeIn, Inc.) [Auto | Running] -- C:\Program Files\LogMeIn\x86\RaMaint.exe -- (LMIMaint)
SRV - [2011/09/26 17:15:36 | 000,374,152 | ---- | M] (LogMeIn, Inc.) [Auto | Running] -- C:\Program Files\LogMeIn\x86\LMIGuardianSvc.exe -- (LMIGuardianSvc)
SRV - [2011/08/05 19:14:36 | 000,207,360 | ---- | M] (Iomega Corp) [Auto | Running] -- C:\Program Files\Iomega Storage Manager\pCloudd.exe -- (PCloudd)
SRV - [2011/01/11 18:04:04 | 000,390,528 | ---- | M] (LogMeIn, Inc.) [Auto | Running] -- C:\Program Files\LogMeIn\x86\LogMeIn.exe -- (LogMeIn)
SRV - [2010/08/27 13:31:00 | 000,185,640 | ---- | M] () [On_Demand | Stopped] -- C:\Documents and Settings\Trey\Application Data\Mikogo\B-Service.exe -- (B-Service)
SRV - [2010/02/19 12:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)
SRV - [2010/01/15 06:49:20 | 000,227,232 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe -- (McComponentHostService)


========== Driver Services (SafeList) ==========

DRV - [2011/09/26 17:16:14 | 000,083,360 | ---- | M] (LogMeIn, Inc.) [File_System | Disabled | Stopped] -- C:\WINDOWS\System32\LMIRfsClientNP.dll -- (LMIRfsClientNP)
DRV - [2011/08/05 19:14:36 | 000,017,488 | ---- | M] (Iomega Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\vNICdrv.sys -- (vNICdrv)
DRV - [2011/01/11 18:04:04 | 000,047,640 | ---- | M] (LogMeIn, Inc.) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\LMIRfsDriver.sys -- (LMIRfsDriver)
DRV - [2011/01/11 18:04:04 | 000,012,856 | ---- | M] (LogMeIn, Inc.) [Kernel | Auto | Running] -- C:\Program Files\LogMeIn\x86\rainfo.sys -- (LMIInfo)
DRV - [2010/05/06 16:35:00 | 000,829,152 | ---- | M] (Ralink Technology, Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AE1000XP.sys -- (AE1000)
DRV - [2009/08/02 18:57:00 | 000,724,736 | ---- | M] (Ralink Technology, Corp.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\rt2870.sys -- (rt2870)
DRV - [2008/06/05 10:58:18 | 000,144,480 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\e1k5132.sys -- (e1kexpress) Intel®
DRV - [2008/03/28 09:14:02 | 000,024,064 | ---- | M] (Sonic Focus, Inc) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\sfaudio.sys -- (SFAUDIO)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: [email protected]:1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: [email protected]:1.0.0.652
FF - prefs.js..extensions.enabledItems: {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}:5.3.0.7550

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@canon.com/EPPEX: C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Documents and Settings\Trey\Local Settings\Application Data\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Documents and Settings\Trey\Local Settings\Application Data\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/12/04 17:30:45 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/12/30 18:20:59 | 000,000,000 | ---D | M]

[2010/08/25 13:18:59 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Trey\Application Data\Mozilla\Extensions
[2011/12/30 18:23:46 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Trey\Application Data\Mozilla\Firefox\Profiles\n326t66v.default\extensions
[2010/11/02 19:38:18 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Trey\Application Data\Mozilla\Firefox\Profiles\n326t66v.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/12/30 18:23:46 | 000,000,000 | ---D | M] (FT DeepDark) -- C:\Documents and Settings\Trey\Application Data\Mozilla\Firefox\Profiles\n326t66v.default\extensions\{77d2ed30-4cd2-11e0-b8af-0800200c9a66}
[2011/06/16 20:24:01 | 000,000,000 | ---D | M] (LogMeIn, Inc. Remote Access Plugin) -- C:\Documents and Settings\Trey\Application Data\Mozilla\Firefox\Profiles\n326t66v.default\extensions\[email protected]
[2011/11/09 22:02:48 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2011/08/07 16:57:20 | 000,000,000 | ---D | M] (Skype extension) -- C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2011/01/31 21:50:17 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2011/11/09 22:02:47 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011/03/18 12:32:12 | 000,091,552 | ---- | M] (Coupons, Inc.) -- C:\Program Files\mozilla firefox\plugins\npCouponPrinter.dll
[2011/02/02 20:40:24 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2011/03/18 12:32:14 | 000,091,552 | ---- | M] (Coupons, Inc.) -- C:\Program Files\mozilla firefox\plugins\npMozCouponPrinter.dll
[2011/08/11 21:16:35 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2011/11/09 22:02:47 | 000,002,040 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
CHR - Extension: YouTube = C:\Documents and Settings\Trey\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2_0\
CHR - Extension: Google Search = C:\Documents and Settings\Trey\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.14_0\
CHR - Extension: Skype Extension = C:\Documents and Settings\Trey\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.3.0.7550_0\
CHR - Extension: Gmail = C:\Documents and Settings\Trey\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\6.1.3_0\

O1 HOSTS File: ([2012/01/02 19:00:00 | 000,000,098 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O4 - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [hpbdfawep] C:\Program Files\HP\Dfawep\bin\hpbdfawep.exe ()
O4 - HKLM..\Run: [LogMeIn GUI] C:\Program Files\LogMeIn\x86\LogMeInSystray.exe (LogMeIn, Inc.)
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKCU..\Run: [uTorrent] C:\Program Files\uTorrent\uTorrent.exe (BitTorrent, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Iomega Storage Manager.lnk = C:\Program Files\Iomega Storage Manager\IomegaStorageManager.exe (EMC)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk = C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
O4 - Startup: C:\Documents and Settings\Trey\Start Menu\Programs\Startup\Dropbox.lnk = C:\Documents and Settings\Trey\Application Data\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macr...ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} https://us.myweather...SetupClient.cab (JuniperSetupClientControl Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.69.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0F54BACB-28DF-419C-BFB1-73545C0FEFB7}: DhcpNameServer = 192.168.69.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C86BBD1A-DF99-4ECF-914C-9D094132BE31}: DhcpNameServer = 192.168.1.254
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\LMIinit: DllName - (LMIinit.dll) - C:\WINDOWS\System32\LMIinit.dll (LogMeIn, Inc.)
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/09/03 15:12:15 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2010/02/10 23:58:48 | 000,000,128 | ---- | M] () - E:\autorun.ini -- [ FAT32 ]
O33 - MountPoints2\{05c6d1ba-e624-11df-8e8c-00259cfc3a19}\Shell\AutoRun\command - "" = F:\Setup.exe
O33 - MountPoints2\{05c6d1ba-e624-11df-8e8c-00259cfc3a19}\Shell\Install\command - "" = F:\Setup.exe
O33 - MountPoints2\{caf98d43-7306-11e0-8e9b-00259cfc3a19}\Shell - "" = AutoRun
O33 - MountPoints2\{caf98d43-7306-11e0-8e9b-00259cfc3a19}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{caf98d43-7306-11e0-8e9b-00259cfc3a19}\Shell\AutoRun\command - "" = E:\DigitalPhotoViewer.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKCU\...exe [@ = exefile] -- Reg Error: Key error. File not found

========== Files/Folders - Created Within 30 Days ==========

[2012/01/02 18:59:43 | 000,000,000 | ---D | C] -- C:\_OTL
[2011/12/31 16:58:24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Trey\Desktop\RK_Quarantine
[2011/12/31 16:58:23 | 004,702,720 | ---- | C] (AVAST Software) -- C:\Documents and Settings\Trey\Desktop\aswMBR.exe
[2011/12/31 16:58:23 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Trey\Desktop\OTL.exe
[2011/12/31 10:36:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Sun
[2011/12/31 10:23:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/12/30 22:14:49 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Trey\Recent
[2011/12/30 18:20:03 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2011/12/30 17:56:04 | 000,000,000 | --SD | C] -- C:\Documents and Settings\Trey\UserData
[2011/12/29 08:56:42 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Trey\Start Menu\Programs\System Check
[2011/12/04 17:30:40 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\QuickTime
[2011/12/04 17:30:29 | 000,000,000 | ---D | C] -- C:\Program Files\QuickTime
[2011/12/04 17:25:40 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\iTunes
[2011/12/04 17:25:11 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[17 C:\Documents and Settings\All Users\Application Data\*.tmp files -> C:\Documents and Settings\All Users\Application Data\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/01/02 19:10:01 | 000,000,974 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-602162358-1957994488-1801674531-1003UA.job
[2012/01/02 19:06:18 | 000,476,760 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2012/01/02 19:06:18 | 000,077,350 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2012/01/02 19:02:08 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012/01/02 19:01:49 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012/01/02 19:00:00 | 000,000,098 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\Hosts
[2012/01/02 18:56:06 | 000,111,872 | ---- | M] () -- C:\WINDOWS\System32\drivers\TrueSight.sys
[2012/01/02 10:10:00 | 000,000,922 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-602162358-1957994488-1801674531-1003Core.job
[2011/12/31 16:56:38 | 004,702,720 | ---- | M] (AVAST Software) -- C:\Documents and Settings\Trey\Desktop\aswMBR.exe
[2011/12/31 16:56:06 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Trey\Desktop\OTL.exe
[2011/12/31 16:53:36 | 000,775,168 | ---- | M] () -- C:\Documents and Settings\Trey\Desktop\RogueKiller.exe
[2011/12/29 08:56:42 | 000,000,853 | ---- | M] () -- C:\Documents and Settings\Trey\Application Data\Microsoft\Internet Explorer\Quick Launch\System Check.lnk
[2011/12/26 23:48:00 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2011/12/15 05:44:40 | 003,567,120 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011/12/15 03:01:49 | 000,001,393 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2011/12/13 18:11:04 | 000,002,277 | ---- | M] () -- C:\Documents and Settings\Trey\Desktop\Google Chrome.lnk
[2011/12/13 18:11:04 | 000,002,255 | ---- | M] () -- C:\Documents and Settings\Trey\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2011/12/10 15:24:06 | 000,020,464 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2011/12/05 20:41:09 | 000,068,334 | ---- | M] () -- C:\Documents and Settings\Trey\My Documents\lauras santa hat.jpg
[2011/12/05 20:33:08 | 000,054,309 | ---- | M] () -- C:\Documents and Settings\Trey\My Documents\santahat2.jpg
[2011/12/05 20:18:24 | 000,114,406 | ---- | M] () -- C:\Documents and Settings\Trey\My Documents\2 santa hats.jpg
[2011/12/05 20:15:17 | 000,026,001 | ---- | M] () -- C:\Documents and Settings\Trey\My Documents\SantaHatColorPage.jpg
[2011/12/05 12:40:38 | 000,355,265 | ---- | M] () -- C:\Documents and Settings\Trey\My Documents\dmieast.pdf
[2011/12/04 18:28:13 | 000,000,858 | ---- | M] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Iomega Storage Manager.lnk
[2011/12/04 18:27:56 | 000,000,840 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Iomega Storage Manager.lnk
[2011/12/04 17:30:40 | 000,001,604 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\QuickTime Player.lnk
[2011/12/04 17:28:02 | 000,001,854 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Safari.lnk
[2011/12/04 17:25:40 | 000,001,542 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2011/12/04 17:18:07 | 000,081,669 | ---- | M] () -- C:\Documents and Settings\Trey\My Documents\WInitialwordnaming.pdf
[2011/12/04 17:11:04 | 000,000,127 | ---- | M] () -- C:\deleteprintjobs.cmd
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[17 C:\Documents and Settings\All Users\Application Data\*.tmp files -> C:\Documents and Settings\All Users\Application Data\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/12/31 16:58:36 | 000,111,872 | ---- | C] () -- C:\WINDOWS\System32\drivers\TrueSight.sys
[2011/12/31 16:58:23 | 000,775,168 | ---- | C] () -- C:\Documents and Settings\Trey\Desktop\RogueKiller.exe
[2011/12/31 10:23:57 | 000,001,878 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Skype.lnk
[2011/12/31 10:23:57 | 000,001,824 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Shop for HP Supplies.lnk
[2011/12/31 10:23:57 | 000,000,630 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\µTorrent.lnk
[2011/12/31 10:23:56 | 000,001,854 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Safari.lnk
[2011/12/31 10:23:56 | 000,001,734 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Canon Easy-PhotoPrint EX.lnk
[2011/12/31 10:23:56 | 000,001,619 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\McAfee Security Scan Plus.lnk
[2011/12/31 10:23:56 | 000,001,604 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\QuickTime Player.lnk
[2011/12/31 10:23:56 | 000,001,542 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2011/12/31 10:23:56 | 000,000,840 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Iomega Storage Manager.lnk
[2011/12/31 10:23:56 | 000,000,829 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\FanDraft Football 2010.lnk
[2011/12/31 10:23:56 | 000,000,784 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/12/31 10:23:56 | 000,000,759 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Picasa 3.lnk
[2011/12/31 10:23:56 | 000,000,724 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2011/12/31 10:23:53 | 000,002,255 | ---- | C] () -- C:\Documents and Settings\Trey\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2011/12/31 10:23:53 | 000,001,862 | ---- | C] () -- C:\Documents and Settings\Trey\Application Data\Microsoft\Internet Explorer\Quick Launch\Mikogo.lnk
[2011/12/31 10:23:53 | 000,001,854 | ---- | C] () -- C:\Documents and Settings\Trey\Application Data\Microsoft\Internet Explorer\Quick Launch\Apple Safari.lnk
[2011/12/31 10:23:53 | 000,000,804 | ---- | C] () -- C:\Documents and Settings\Trey\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk
[2011/12/31 10:23:53 | 000,000,792 | ---- | C] () -- C:\Documents and Settings\Trey\Application Data\Microsoft\Internet Explorer\Quick Launch\Microsoft Office Outlook.lnk
[2011/12/31 10:23:53 | 000,000,779 | ---- | C] () -- C:\Documents and Settings\Trey\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2011/12/31 10:23:53 | 000,000,742 | ---- | C] () -- C:\Documents and Settings\Trey\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2011/12/31 10:23:53 | 000,000,079 | ---- | C] () -- C:\Documents and Settings\Trey\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf
[2011/12/31 10:23:49 | 000,001,611 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
[2011/12/31 10:23:49 | 000,000,858 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Iomega Storage Manager.lnk
[2011/12/31 10:23:48 | 000,001,986 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\MSN.lnk
[2011/12/31 10:23:48 | 000,001,854 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Safari.lnk
[2011/12/31 10:23:48 | 000,001,830 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Apple Software Update.lnk
[2011/12/31 10:23:48 | 000,001,144 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Adobe ExtendScript Toolkit CS5.lnk
[2011/12/31 10:23:48 | 000,001,000 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Adobe Extension Manager CS5.lnk
[2011/12/31 10:23:48 | 000,000,909 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Adobe Device Central CS5.lnk
[2011/12/31 10:23:48 | 000,000,854 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Adobe Photoshop CS5.lnk
[2011/12/31 10:23:48 | 000,000,816 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Adobe Bridge CS5.lnk
[2011/12/31 10:23:48 | 000,000,786 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Windows Movie Maker.lnk
[2011/12/31 10:23:48 | 000,000,730 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Mozilla Firefox.lnk
[2011/12/31 10:23:48 | 000,000,728 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Adobe Help.lnk
[2011/12/31 10:23:48 | 000,000,719 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\LogMeIn.lnk
[2011/12/31 10:23:48 | 000,000,609 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Windows Messenger.lnk
[2011/12/30 18:20:24 | 000,002,347 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Adobe Reader X.lnk
[2011/12/30 18:20:24 | 000,001,734 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader X.lnk
[2011/12/29 18:53:58 | 000,000,853 | ---- | C] () -- C:\Documents and Settings\Trey\Application Data\Microsoft\Internet Explorer\Quick Launch\System Check.lnk
[2011/12/05 20:41:07 | 000,068,334 | ---- | C] () -- C:\Documents and Settings\Trey\My Documents\lauras santa hat.jpg
[2011/12/05 20:33:06 | 000,054,309 | ---- | C] () -- C:\Documents and Settings\Trey\My Documents\santahat2.jpg
[2011/12/05 20:18:22 | 000,114,406 | ---- | C] () -- C:\Documents and Settings\Trey\My Documents\2 santa hats.jpg
[2011/12/05 20:15:16 | 000,026,001 | ---- | C] () -- C:\Documents and Settings\Trey\My Documents\SantaHatColorPage.jpg
[2011/12/05 12:40:38 | 000,355,265 | ---- | C] () -- C:\Documents and Settings\Trey\My Documents\dmieast.pdf
[2011/12/04 17:18:07 | 000,081,669 | ---- | C] () -- C:\Documents and Settings\Trey\My Documents\WInitialwordnaming.pdf
[2011/09/04 18:20:31 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011/05/13 09:31:27 | 000,056,136 | ---- | C] () -- C:\WINDOWS\System32\mlfcache.dat
[2011/01/13 03:15:58 | 000,269,198 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat
[2011/01/13 03:15:58 | 000,269,198 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-602162358-1957994488-1801674531-1003-0.dat
[2011/01/08 16:48:27 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\HPPLVS.dll
[2011/01/08 16:48:14 | 000,000,137 | ---- | C] () -- C:\WINDOWS\System32\AddPort.ini
[2011/01/08 16:46:35 | 000,000,753 | ---- | C] () -- C:\WINDOWS\hpntwksetup.ini
[2010/11/01 20:19:02 | 000,000,056 | ---- | C] () -- C:\WINDOWS\System32\ezsidmv.dat
[2010/11/01 20:04:58 | 000,000,969 | ---- | C] () -- C:\WINDOWS\unins000.dat
[2010/10/09 19:55:40 | 000,024,576 | ---- | C] () -- C:\Documents and Settings\Trey\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/08/28 17:47:22 | 000,014,051 | ---- | C] () -- C:\WINDOWS\System32\RaCoInst.dat
[2010/08/25 13:18:56 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2010/06/18 13:40:28 | 000,180,224 | ---- | C] () -- C:\WINDOWS\System32\hpputoar.dll
[2009/09/04 08:59:23 | 002,026,604 | ---- | C] () -- C:\WINDOWS\System32\igkrng500.bin
[2009/09/04 08:59:23 | 000,442,964 | ---- | C] () -- C:\WINDOWS\System32\igcompkrng500.bin
[2009/09/04 08:59:23 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\igfxCoIn_v4977.dll
[2009/09/03 15:13:16 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2009/09/03 15:10:46 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2009/09/03 10:06:24 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2009/09/03 10:05:43 | 003,567,120 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2008/04/14 06:00:00 | 001,033,728 | ---- | C] () -- C:\WINDOWS\expl.dat
[2008/04/14 06:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2008/04/14 06:00:00 | 000,507,904 | ---- | C] () -- C:\WINDOWS\System32\winl.dat
[2008/04/14 06:00:00 | 000,476,760 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2008/04/14 06:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2008/04/14 06:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2008/04/14 06:00:00 | 000,077,350 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2008/04/14 06:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2008/04/14 06:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2008/04/14 06:00:00 | 000,014,336 | ---- | C] () -- C:\WINDOWS\System32\svch.dat
[2008/04/14 06:00:00 | 000,014,336 | ---- | C] () -- C:\WINDOWS\System32\dllc.dat
[2008/04/14 06:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2008/04/14 06:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin
[2008/04/14 06:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2008/02/07 10:05:18 | 000,163,840 | ---- | C] () -- C:\WINDOWS\System32\hppatusg01.dll
[2005/04/15 10:52:33 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2005/04/15 10:52:33 | 000,004,627 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2004/06/26 17:00:00 | 000,077,257 | ---- | C] () -- C:\WINDOWS\unins000.exe
[2001/07/07 04:00:00 | 000,003,399 | ---- | C] () -- C:\WINDOWS\System32\hptcpmon.ini

========== LOP Check ==========

[2010/10/26 18:18:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\CanonBJ
[2011/03/18 09:24:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Juniper Networks
[2012/01/02 01:20:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\LogMeIn
[2011/04/10 14:48:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\regid.1986-12.com.adobe
[2011/08/24 16:09:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\RotoWire
[2010/08/25 13:31:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2011/01/31 22:17:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Trey\Application Data\.minecraft
[2012/01/02 19:07:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Trey\Application Data\Dropbox
[2010/11/01 20:11:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Trey\Application Data\GARMIN
[2011/03/18 09:24:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Trey\Application Data\Juniper Networks
[2011/11/12 08:02:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Trey\Application Data\Mikogo
[2012/01/02 19:02:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Trey\Application Data\uTorrent

========== Purity Check ==========



< End of report >

Attached Thumbnails

• 

[Essexboy]

Hmm that is a bit inconclusive - could you delete your current copy of aswMBR please and download and run a fresh copy

What are the current problems ?

[Trey Palreiro]

It does that phony reboot in 60 seconds error. When you goto any browser a pop up comes up that says "noooo" with an ok button

I reran answer mbr and it shutoff, not before finding some more infections (I downloaded the avast definitions).

Will try to rerun, but I keep getting that NT AUTHORITY\SYSTEM reboot.

[Essexboy]

When aswMBR ran did it produce a partial report ? I am very interested in the partition data - which is this part

13:21:00.661 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-1
13:21:00.662 Disk 0 Vendor: KINGSTON_SVP100S296G CJR10202 Size: 91580MB BusType: 11
13:21:00.663 Disk 1 \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP0T0L0-0
13:21:00.664 Disk 1 Vendor: Hitachi_HDS723020BLA642 MN6OA580 Size: 1907729MB BusType: 11
13:21:02.665 Disk 0 MBR read successfully
13:21:02.666 Disk 0 MBR scan
13:21:02.668 Disk 0 Windows 7 default MBR code
13:21:02.670 Disk 0 MBR hidden
13:21:02.672 Disk 0 Partition 1 00 07 HPFS/NTFS NTFS 100 MB offset 2048
13:21:02.674 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 91222 MB offset 206848
13:21:02.676 Disk 0 Partition 3 80 (A) 17 Hidd HPFS/NTFS NTFS 257 MB offset 187029504
13:21:02.678 Disk 0 Partition 3 **INFECTED** MBR:Alureon-K [Rtk]

But lets continue to remove the bad stuff and then try and see what exactly it is

Download and Install Combofix

Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

• Double click on ComboFix.exe & follow the prompts.
• Accept the disclaimer and allow to update if it asks
• Allow the installation of the recovery console as we may need it
  
  
  
  
  
• When finished, it shall produce a log for you.
• Please include the C:\ComboFix.txt in your next reply.

Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3. If after the reboot you get errors about programmes being marked for deletion then reboot, that will cure it.



Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now

THEN

Do the following:
Start -> Run
type diskmgmt.msc
Click "OK"

Disk Management will open.

Click and hold the right side of the Disk Management Window and drag it to the right until you can see all the columns.

Take a screen Shot of the Disk Management Window and attach the screen shot to your reply.

[Essexboy]

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.