[Clareykins]

On a whole much better, still a few problems though. It's ridiculously slow to start and Avira is still complaining of infections, if I let Avira cure the infections firefox, OTL and the HP software that was pre-installed stops working until I reinstall it, then Avira breaks it again. Could it be that Avira has gotten infected? Will the recovery console that was downloaded with one of the scans you showed me be enough to just re-format and re-install windows?

OTL.exe:-
OTL logfile created on: 28/11/2010 20:44:37 - Run 2
OTL by OldTimer - Version 3.2.17.3 Folder = C:\Documents and Settings\MS\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1,015.00 Mb Total Physical Memory | 551.00 Mb Available Physical Memory | 54.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 83.00% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 149.04 Gb Total Space | 112.48 Gb Free Space | 75.47% Space Free | Partition Type: NTFS
Drive D: | 952.97 Mb Total Space | 952.89 Mb Free Space | 99.99% Space Free | Partition Type: FAT32

Computer Name: DIONS | User Name: MS | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2010/11/27 15:40:22 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\MS\Desktop\OTL.exe
PRC - [2010/08/02 16:10:00 | 000,135,336 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe
PRC - [2010/08/02 16:09:55 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
PRC - [2010/08/02 16:09:55 | 000,267,944 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe
PRC - [2010/05/20 17:19:16 | 000,088,176 | ---- | M] (McAfee, Inc.) -- c:\Program Files\McAfee\SiteAdvisor\McSACore.exe
PRC - [2010/01/14 22:11:00 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
PRC - [2009/07/06 21:06:46 | 000,737,280 | ---- | M] (Andrea Electronics Corporation) -- C:\WINDOWS\system32\AESTFltr.exe
PRC - [2009/06/29 20:44:38 | 000,221,266 | ---- | M] (IDT, Inc.) -- c:\Program Files\IDT\WDM\stacsv.exe
PRC - [2009/06/02 18:05:58 | 000,457,200 | ---- | M] () -- C:\Program Files\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe
PRC - [2009/05/19 11:36:18 | 000,240,512 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
PRC - [2008/04/14 03:42:20 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe


========== Modules (SafeList) ==========

MOD - [2010/11/27 15:40:22 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\MS\Desktop\OTL.exe
MOD - [2010/08/23 16:12:02 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] -- C:\WINDOWS\System32\hidserv.dll -- (HidServ)
SRV - File not found [On_Demand | Stopped] -- C:\WINDOWS\System32\appmgmts.dll -- (AppMgmt)
SRV - [2010/08/02 16:10:00 | 000,135,336 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2010/08/02 16:09:55 | 000,267,944 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2010/05/20 17:19:16 | 000,088,176 | ---- | M] (McAfee, Inc.) [Auto | Running] -- c:\Program Files\McAfee\SiteAdvisor\McSACore.exe -- (McAfee SiteAdvisor Service)
SRV - [2009/06/29 20:44:38 | 000,221,266 | ---- | M] (IDT, Inc.) [Auto | Running] -- c:\Program Files\IDT\WDM\stacsv.exe -- (STacSV)
SRV - [2009/06/02 18:05:58 | 000,457,200 | ---- | M] () [Auto | Running] -- C:\Program Files\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe -- (9734BF6A-2DCD-40f0-BAB0-5AAFEEBE1269)
SRV - [2009/05/22 18:02:20 | 000,250,616 | ---- | M] (WildTangent, Inc.) [On_Demand | Stopped] -- C:\Program Files\HP Games\HP Game Console\GameConsoleService.exe -- (GameConsoleService)
SRV - [2009/05/19 11:36:18 | 000,240,512 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe -- (SeaPort)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\Rts5161ccid.sys -- (USBCCID)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\Rts516xIR.sys -- (Rts516xIR)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\Drivers\RTS5121.sys -- (RSUSBSTOR)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\ComboFix\catchme.sys -- (catchme)
DRV - [2010/11/27 14:47:41 | 000,061,960 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2010/08/02 16:10:08 | 000,126,856 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2010/06/17 15:27:22 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2010/06/17 15:27:12 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Program Files\Avira\AntiVir Desktop\avgio.sys -- (avgio)
DRV - [2009/12/27 14:39:33 | 001,746,432 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\BCMWL5.SYS -- (BCM43XX)
DRV - [2009/07/01 22:10:54 | 000,103,792 | ---- | M] (Sonic Solutions) [File_System | Boot | Running] -- C:\WINDOWS\system32\drivers\syscow32x.sys -- (SysCow)
DRV - [2009/06/29 20:44:38 | 001,642,931 | ---- | M] (IDT, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\sthda.sys -- (STHDA)
DRV - [2009/06/05 02:43:16 | 000,330,264 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\iaStor.sys -- (iaStor)
DRV - [2009/06/02 00:00:00 | 000,025,584 | ---- | M] (Sonic Solutions) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\SaibVd32.sys -- (SaibVd32)
DRV - [2009/06/02 00:00:00 | 000,021,488 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\SahdIa32.sys -- (SahdIa32)
DRV - [2009/06/02 00:00:00 | 000,015,856 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\SaibIa32.sys -- (SaibIa32)
DRV - [2009/05/07 00:01:38 | 000,047,272 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btwusb.sys -- (BTWUSB)
DRV - [2009/05/07 00:01:36 | 000,992,424 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btkrnl.sys -- (BTKRNL)
DRV - [2009/04/21 17:13:34 | 000,113,664 | ---- | M] (Andrea Electronics Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AESTAud.sys -- (AESTAud)
DRV - [2009/03/31 20:11:44 | 000,039,424 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\l1c51x86.sys -- (L1c)
DRV - [2009/03/13 16:32:18 | 001,759,616 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\snp2uvc.sys -- (SNP2UVC) USB2.0 PC Camera (SNP2UVC)
DRV - [2009/01/16 02:41:00 | 000,206,512 | ---- | M] (Synaptics, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\SynTP.sys -- (SynTP)
DRV - [2008/04/15 12:00:00 | 000,144,384 | ---- | M] (Windows ® Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus)
DRV - [2008/04/14 23:06:40 | 000,043,008 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\amdagp.sys -- (amdagp)
DRV - [2008/04/14 23:06:40 | 000,040,960 | ---- | M] (Silicon Integrated Systems Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\sisagp.sys -- (sisagp)
DRV - [2008/04/14 14:05:40 | 000,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\RTL8139.sys -- (rtl8139) Realtek RTL8139(A/B/C)
DRV - [2008/02/15 22:12:06 | 005,854,752 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\igxpmp32.sys -- (ialm)
DRV - [2001/08/18 13:07:44 | 000,019,072 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\sparrow.sys -- (Sparrow)
DRV - [2001/08/18 13:07:42 | 000,030,688 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\sym_u3.sys -- (sym_u3)
DRV - [2001/08/18 13:07:40 | 000,028,384 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\sym_hi.sys -- (sym_hi)
DRV - [2001/08/18 13:07:36 | 000,032,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\symc8xx.sys -- (symc8xx)
DRV - [2001/08/18 13:07:34 | 000,016,256 | ---- | M] (Symbios Logic Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\symc810.sys -- (symc810)
DRV - [2001/08/18 12:52:22 | 000,036,736 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\ultra.sys -- (ultra)
DRV - [2001/08/18 12:52:20 | 000,045,312 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\ql12160.sys -- (ql12160)
DRV - [2001/08/18 12:52:20 | 000,040,320 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\ql1080.sys -- (ql1080)
DRV - [2001/08/18 12:52:18 | 000,049,024 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\ql1280.sys -- (ql1280)
DRV - [2001/08/18 12:52:16 | 000,179,584 | ---- | M] (Mylex Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\dac2w2k.sys -- (dac2w2k)
DRV - [2001/08/18 12:52:12 | 000,017,280 | ---- | M] (American Megatrends Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\mraid35x.sys -- (mraid35x)
DRV - [2001/08/18 12:52:00 | 000,026,496 | ---- | M] (Advanced System Products, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\asc.sys -- (asc)
DRV - [2001/08/18 12:51:58 | 000,014,848 | ---- | M] (Advanced System Products, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\asc3550.sys -- (asc3550)
DRV - [2001/08/18 12:51:56 | 000,005,248 | ---- | M] (Acer Laboratories Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\aliide.sys -- (AliIde)
DRV - [2001/08/18 12:51:54 | 000,006,656 | ---- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\cmdide.sys -- (CmdIde)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.h...avilion&pf=cnnb

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKCU\..\URLSearchHook: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Secure Search"
FF - prefs.js..browser.search.selectedEngine: "Secure Search"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..extensions.enabledItems: [email protected]:1.0
FF - prefs.js..extensions.enabledItems: {B7082FAA-CB62-4872-9106-E42DD88EDE45}:3.2
FF - prefs.js..extensions.enabledItems: {333b42b0-9c75-11db-b606-0800200c9a66}:2.200100126
FF - prefs.js..keyword.URL: "http://uk.search.yah...h?fr=mcafee&p="


FF - HKLM\software\mozilla\Firefox\Extensions\\{F8F7074F-93F7-425B-B037-221E9E2058FB}: C:\Documents and Settings\Tamara x x\Local Settings\Application Data\{F8F7074F-93F7-425B-B037-221E9E2058FB}
FF - HKLM\software\mozilla\Firefox\Extensions\\{B7082FAA-CB62-4872-9106-E42DD88EDE45}: C:\Program Files\McAfee\SiteAdvisor [2010/11/28 01:52:04 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/11/28 01:34:42 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/11/28 01:32:55 | 000,000,000 | ---D | M]

[2010/11/28 01:34:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\MS\Application Data\Mozilla\Extensions
[2010/11/28 01:47:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\MS\Application Data\Mozilla\Firefox\Profiles\j2hwx8xn.default\extensions
[2010/11/28 01:39:58 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\MS\Application Data\Mozilla\Firefox\Profiles\j2hwx8xn.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/11/28 01:39:16 | 000,000,000 | ---D | M] (PinkHope) -- C:\Documents and Settings\MS\Application Data\Mozilla\Firefox\Profiles\j2hwx8xn.default\extensions\{333b42b0-9c75-11db-b606-0800200c9a66}
[2010/11/28 01:39:15 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\MS\Application Data\Mozilla\Firefox\Profiles\j2hwx8xn.default\extensions\{333b42b0-9c75-11db-b606-0800200c9a66}\chrome\mozapps\extensions
[2010/11/28 01:39:14 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\MS\Application Data\Mozilla\Firefox\Profiles\j2hwx8xn.default\extensions\{333b42b0-9c75-11db-b606-0800200c9a66}\chrome\mozapps\extensions\CVS
[2010/11/28 01:41:50 | 000,001,050 | ---- | M] () -- C:\Documents and Settings\MS\Application Data\Mozilla\Firefox\Profiles\j2hwx8xn.default\searchplugins\siteadvisor.xml
[2010/11/28 01:33:12 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2010/10/27 05:24:34 | 000,001,538 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazon-en-GB.xml
[2010/10/27 05:24:34 | 000,000,947 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\chambers-en-GB.xml
[2010/10/27 05:24:34 | 000,000,769 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay-en-GB.xml
[2010/11/28 15:07:54 | 000,002,027 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\McSiteAdvisor.xml
[2010/10/27 05:24:34 | 000,001,135 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: ([2010/11/28 15:31:00 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O4 - HKLM..\Run: [AESTFltr] C:\WINDOWS\System32\AESTFltr.exe (Andrea Electronics Corporation)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm File not found
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm File not found
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_14)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (c:\program files\microsoft\desktoplayer.exe) - c:\Program Files\Microsoft\DesktopLayer.exe ()
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)
O24 - Desktop Components:0 () - http://www.wix.com/dionconroy/blob
O24 - Desktop Components:1 (My Current Home Page) - About:Home
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/11/28 20:38:58 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2010/11/28 16:51:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
[2010/11/28 15:53:02 | 084,529,288 | ---- | C] ( ) -- C:\Documents and Settings\MS\Desktop\setup_9.0.0.722_28.11.2010_18-17.exe
[2010/11/28 15:29:07 | 000,000,000 | ---D | C] -- C:\WINDOWS\temp
[2010/11/28 13:40:35 | 000,000,000 | ---D | C] -- C:\Config.Msi
[2010/11/28 02:13:30 | 000,000,000 | ---D | C] -- C:\Documents and Settings\MS\Application Data\Oweqz
[2010/11/28 01:46:33 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\McAfee
[2010/11/28 01:44:50 | 000,000,000 | ---D | C] -- C:\Program Files\McAfee
[2010/11/28 01:44:49 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\McAfee
[2010/11/28 01:34:34 | 000,000,000 | ---D | C] -- C:\Documents and Settings\MS\Application Data\Mozilla
[2010/11/28 01:31:33 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2010/11/27 21:25:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Adobe
[2010/11/27 19:48:22 | 000,000,000 | ---D | C] -- C:\Documents and Settings\MS\Local Settings\Application Data\Identities
[2010/11/27 19:11:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\MS\Desktop\ClaresStuff
[2010/11/27 18:23:10 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2010/11/27 18:22:02 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2010/11/27 18:22:02 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2010/11/27 18:22:02 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2010/11/27 18:22:02 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2010/11/27 18:21:52 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2010/11/27 18:21:34 | 000,000,000 | ---D | C] -- C:\Qoobox
[2010/11/27 17:40:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\MS\DoctorWeb
[2010/11/27 17:01:47 | 000,000,000 | ---D | C] -- C:\Documents and Settings\MS\My Documents\Downloads
[2010/11/27 16:41:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\MS\Application Data\Wiucna
[2010/11/27 15:40:16 | 000,575,488 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\MS\Desktop\OTL.exe
[2010/11/27 15:37:13 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\MS\Recent
[2010/11/27 15:32:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\MS\Local Settings\Application Data\Mozilla
[2010/11/27 15:31:32 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2010/11/27 14:50:18 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\NtmsData
[2010/11/27 14:46:29 | 000,000,000 | ---D | C] -- C:\Documents and Settings\MS\Application Data\Avira
[2010/11/27 14:38:04 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\ssmdrv.sys
[2010/11/27 14:37:59 | 000,126,856 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avipbb.sys
[2010/11/27 14:37:59 | 000,061,960 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntflt.sys
[2010/11/27 14:37:59 | 000,045,416 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntdd.sys
[2010/11/27 14:37:59 | 000,022,360 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntmgr.sys
[2010/11/27 14:37:56 | 000,000,000 | ---D | C] -- C:\Program Files\Avira
[2010/11/27 14:37:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Avira
[2010/11/27 13:53:49 | 000,000,000 | ---D | C] -- C:\Documents and Settings\MS\Application Data\Owdy
[2010/11/27 11:56:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\MS\Application Data\Pydium
[2010/11/27 11:52:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\MS\Application Data\Hyomri
[2010/11/27 11:35:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\MS\Application Data\Lezuih
[2010/11/27 11:00:42 | 000,000,000 | ---D | C] -- C:\Documents and Settings\MS\Application Data\Dezali
[2010/11/27 10:49:00 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\MS\IECompatCache
[2010/11/27 10:48:45 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\MS\PrivacIE
[2010/11/27 10:48:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\MS\Local Settings\Application Data\Google
[2010/11/27 10:15:53 | 000,000,000 | ---D | C] -- C:\Documents and Settings\MS\Application Data\Vololy
[2010/11/27 09:58:24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\MS\Application Data\Malwarebytes
[2010/11/27 09:56:52 | 000,000,000 | --SD | C] -- C:\Documents and Settings\MS\Application Data\Microsoft
[2010/11/27 09:56:52 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\MS\Application Data
[2010/11/27 09:56:52 | 000,000,000 | R--D | C] -- C:\Documents and Settings\MS\Favorites
[2010/11/27 09:56:52 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\MS\IETldCache
[2010/11/27 09:56:52 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\MS\Cookies
[2010/11/27 09:56:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\MS\Application Data\Sun
[2010/11/27 09:56:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\MS\Application Data\Roxio Log Files
[2010/11/27 09:56:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\MS\Local Settings\Application Data\Microsoft Help
[2010/11/27 09:56:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\MS\Local Settings\Application Data\Microsoft
[2010/11/27 09:56:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\MS\Application Data\Macromedia
[2010/11/27 09:56:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\MS\Application Data\InstallShield
[2010/11/27 09:56:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\MS\Application Data\Identities
[2010/11/27 09:56:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\MS\Application Data\hpqLog
[2010/11/27 09:56:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\MS\Desktop
[2010/11/27 09:56:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\MS\Local Settings\Application Data\Adobe
[2010/11/27 09:56:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\MS\Application Data\Adobe
[2010/11/27 09:56:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\MS\.migoDesktop
[2010/11/27 09:56:51 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\MS\SendTo
[2010/11/27 09:56:51 | 000,000,000 | R--D | C] -- C:\Documents and Settings\MS\Start Menu
[2010/11/27 09:56:51 | 000,000,000 | R--D | C] -- C:\Documents and Settings\MS\My Documents\My Pictures
[2010/11/27 09:56:51 | 000,000,000 | R--D | C] -- C:\Documents and Settings\MS\My Documents\My Music
[2010/11/27 09:56:51 | 000,000,000 | R--D | C] -- C:\Documents and Settings\MS\My Documents
[2010/11/27 09:56:51 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\MS\Templates
[2010/11/27 09:56:51 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\MS\PrintHood
[2010/11/27 09:56:51 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\MS\NetHood
[2010/11/27 09:56:51 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\MS\Local Settings
[2010/11/27 09:56:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\MS\My Documents\HPQuickSync videos
[2010/11/27 04:37:17 | 000,633,856 | ---- | C] (OldTimer Tools) -- C:\OTLPE.exe
[2010/11/27 04:34:42 | 000,000,000 | ---D | C] -- C:\_OTL
[2010/11/27 04:30:54 | 000,000,000 | ---D | C] -- C:\replace
[2010/11/26 23:36:26 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/11/26 23:36:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2010/11/26 23:35:45 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010/11/26 23:35:40 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2009/12/27 14:38:29 | 000,196,608 | ---- | C] ( ) -- C:\WINDOWS\System32\csnp2uvc.dll
[2009/12/27 14:38:25 | 000,225,280 | ---- | C] ( ) -- C:\WINDOWS\System32\rsnp2uvc.dll

========== Files - Modified Within 30 Days ==========

[2010/11/28 20:45:58 | 000,000,016 | ---- | M] () -- C:\WINDOWS\System32\dmlconf.dat
[2010/11/28 20:33:57 | 000,000,282 | ---- | M] () -- C:\WINDOWS\tasks\BackOnTrack Instant Restore Idle.job
[2010/11/28 20:30:30 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010/11/28 20:30:24 | 1064,620,032 | -HS- | M] () -- C:\hiberfil.sys
[2010/11/28 16:53:10 | 000,003,788 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2010/11/28 16:51:13 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010/11/28 16:40:12 | 000,000,036 | ---- | M] () -- C:\WINDOWS\System32\complete.dat
[2010/11/28 16:21:18 | 000,158,378 | ---- | M] () -- C:\CF-Submit.htm
[2010/11/28 16:18:38 | 084,529,288 | ---- | M] ( ) -- C:\Documents and Settings\MS\Desktop\setup_9.0.0.722_28.11.2010_18-17.exe
[2010/11/28 15:31:00 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2010/11/28 13:52:09 | 000,246,312 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010/11/28 02:16:46 | 000,633,856 | ---- | M] (OldTimer Tools) -- C:\OTLPE.exe
[2010/11/28 01:34:22 | 000,001,624 | ---- | M] () -- C:\Documents and Settings\MS\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2010/11/27 18:23:17 | 000,000,327 | RHS- | M] () -- C:\boot.ini
[2010/11/27 17:02:06 | 000,000,112 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\2mIfUQ.dat
[2010/11/27 16:44:41 | 000,076,599 | ---- | M] () -- C:\Documents and Settings\MS\Desktop\Scan1.JPG
[2010/11/27 15:40:22 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\MS\Desktop\OTL.exe
[2010/11/27 15:33:02 | 000,000,000 | ---- | M] () -- C:\WINDOWS\nsreg.dat
[2010/11/27 14:47:41 | 000,061,960 | ---- | M] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntflt.sys
[2010/11/27 10:26:47 | 000,434,212 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010/11/27 10:26:46 | 000,068,826 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010/11/08 01:20:24 | 000,089,088 | ---- | M] () -- C:\WINDOWS\MBR.exe

========== Files Created - No Company Name ==========

[2010/11/28 16:36:33 | 1064,620,032 | -HS- | C] () -- C:\hiberfil.sys
[2010/11/28 15:31:48 | 000,000,016 | ---- | C] () -- C:\WINDOWS\System32\dmlconf.dat
[2010/11/28 15:19:51 | 000,158,378 | ---- | C] () -- C:\CF-Submit.htm
[2010/11/28 01:34:22 | 000,001,624 | ---- | C] () -- C:\Documents and Settings\MS\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2010/11/27 18:23:17 | 000,000,211 | ---- | C] () -- C:\Boot.bak
[2010/11/27 18:23:13 | 000,260,272 | RHS- | C] () -- C:\cmldr
[2010/11/27 18:22:02 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2010/11/27 18:22:02 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2010/11/27 18:22:02 | 000,089,088 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2010/11/27 18:22:02 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2010/11/27 18:22:02 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2010/11/27 17:28:28 | 000,000,036 | ---- | C] () -- C:\WINDOWS\System32\complete.dat
[2010/11/27 16:44:40 | 000,076,599 | ---- | C] () -- C:\Documents and Settings\MS\Desktop\Scan1.JPG
[2010/11/27 15:57:01 | 000,003,788 | ---- | C] () -- C:\WINDOWS\imsins.BAK
[2010/11/27 15:33:02 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2010/11/27 09:56:53 | 000,000,079 | ---- | C] () -- C:\Documents and Settings\MS\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf
[2010/09/17 17:38:34 | 000,000,112 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\2mIfUQ.dat
[2009/12/27 14:42:27 | 000,000,499 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\HPWALog.txt
[2009/12/27 14:38:29 | 001,759,616 | ---- | C] () -- C:\WINDOWS\System32\drivers\snp2uvc.sys
[2009/12/27 14:38:29 | 000,028,544 | ---- | C] () -- C:\WINDOWS\System32\drivers\sncduvc.sys
[2009/12/27 14:38:29 | 000,015,497 | ---- | C] () -- C:\WINDOWS\snp2uvc.ini
[2009/08/23 14:30:54 | 000,028,510 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2009/08/23 13:50:25 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\igfxCoIn_v4926.dll
[2009/05/05 13:00:32 | 002,854,976 | ---- | C] () -- C:\WINDOWS\System32\btwicons.dll
[2009/04/11 02:25:38 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2009/04/11 01:58:54 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2001/11/14 13:56:00 | 001,802,240 | ---- | C] () -- C:\WINDOWS\System32\lcppn21.dll

========== LOP Check ==========

[2009/08/23 14:07:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Uninstall
[2009/08/23 14:29:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\WildTangent
[2010/11/28 15:13:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\MS\Application Data\Dezali
[2010/11/28 01:29:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\MS\Application Data\Hyomri
[2010/11/28 12:11:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\MS\Application Data\Lezuih
[2010/11/28 15:13:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\MS\Application Data\Owdy
[2010/11/28 16:40:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\MS\Application Data\Oweqz
[2010/11/28 17:09:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\MS\Application Data\Pydium
[2010/11/28 11:37:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\MS\Application Data\Vololy
[2010/11/28 07:02:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\MS\Application Data\Wiucna
[2010/11/28 20:33:57 | 000,000,282 | ---- | M] () -- C:\WINDOWS\Tasks\BackOnTrack Instant Restore Idle.job

========== Purity Check ==========



< End of report >

[Advertisements]

Am pretty sure it's sorted now
After googling the list of infections Avira was showing I booted into safe mode over and over to scan with MalwareBytes, Avira and DrWeb until they stopped showing infections. Seems to have done the trick. I did have to re-install almost everything and run ChkDsk once when it stopped booting again but it's showing as clean now and running like new. It's gone back home to my 'friends' house and she will be punished in good time
Thank you so much for all of your help.

[Clareykins]

Am pretty sure it's sorted now
After googling the list of infections Avira was showing I booted into safe mode over and over to scan with MalwareBytes, Avira and DrWeb until they stopped showing infections. Seems to have done the trick. I did have to re-install almost everything and run ChkDsk once when it stopped booting again but it's showing as clean now and running like new. It's gone back home to my 'friends' house and she will be punished in good time
Thank you so much for all of your help.

[Salagubang]

Hi Clareykins,

Nice to know that everything has been sorted out.

But you are not going to miss out my clean up speech.

First, since we used a "healthy" computer to transfer tools back and forth, I would suggest running a full system scan with an antivirus tool on the alternate computer. If you do not have an antivirus tool on the secondary system, there are a few free versions listed further below. I would also suggest running MBAM on that computer as well.

We need to remove all the tools that you have used.
This is so that should you ever be re-infected, you will download updated versions. It will also remove the quarantined Malware from your computer.

Remove ComboFix

• Click the Start button
• Click Run...
• Type Combofix /Uninstall in the run dialog box and click OK

Remove Other Tools

• Download OTC to your desktop and run it
• Click CleanUp! to begin the cleanup process and remove our tools, including this application
• You may be asked to reboot the machine to finish the cleanup process - if so, choose Yes

Clean Temporary Files

• Download TFC to your desktop
• Open the file and close any other windows
• It will close all programs itself when run - make sure to let it run uninterrupted
• Click the Start button to begin the process - the program should not take long to finish its job
• Once it is finished, it should reboot your machine, if not, do this yourself to ensure the cleaning process completes

Lets Re-hide system files and folders.
Opening Windows Explorer (to get there right-click your Start button and go to "Explore"), please do the following:

• Go to Tools (drop-down menu at the top of the window)
• Go down and click Folder Options
• Click on the View tab
• Find the Hidden Files and Folders section of the box and check "Do not show hidden files and folders"
• Again under Hidden Files and Folders, find "Hide protected operating system files (Recommended)" and check it (if it's already checked)
• Click Apply, and then Ok at the bottom.
• Close the window

++++++++++++++++++++++++++++++++++++


Below are links to several programs that will help protect your computer.

Anti-Spyware
I recommend downloading and installing all of the following applications.

• SpywareBlaster keeps spyware from installing on your system - read the tutorial here
• SpywareGuard protects your browser and computer in real time - read the tutorial here
• SUPERAntiSpyware Free Edition detects and removes spyware, adware, malware, trojans, rogue software, worms, rootkits, parasites and other potentially harmful software applications - read the tutorial here

++++++++++++++++++++++++++++++++++++

Other things to keep in mind.

Windows, Java, and Adobe products should all be kept up-to-date on a regular basis so the latest security fixes are in place on your computer. Please refer to the following links on how to manage these products.

• Windows Update (2000/XP) or Windows Update (Vista)
• Java
• Adobe Reader
• Adobe Flash Player

Here are a few other applications you might consider. Keeping your temporary file area clean, your Windows registry backed up, and backing up your important data are all good techniques.

• Flush Flash - by Bobbi Flekman - cleans Flash Player cookies
• ERUNT (Emergency Recovery Utility NT) - a registry backup utility
• Cobian Backup - a very good backup utility - read the tutorial here

Please remember that just having these programs is not enough. You must use them. Running a full spyware scan weekly, a full virus scan monthly, and checking for updates and cleaning your temporary files periodically is very important in keeping your computer in tip-top shape.

Finally, please take the time to read the following articles. Applying this information will help prevent future infections:

How to prevent malware by miekiemoes
Preventing Malware and Safe Computing by Rorschach112

This article will help you understand how you may have gotten infected:
How did I get infected in the first place?

Remember, you have to be smarter than the bad guys! Be safe out there!

[Clareykins]

Again, thank you enormously!

[Essexboy]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.