Spyware / Malware / Virus Removal

[Closed] WinPC Defender - I think

10 min read

Looking for the outcome? Ask AI

coldsmoke Topic Starter

Post #1April 5, 2009, 2:41 PM UTC

Windows XP PRO

My wife opened an .exe file from an e-mail sent by a friend. I immedialty ran superanti spyware. It found and deleted them, but I can't open superanti spyware now and have difficulty opening IExplorer. Web links are also hijacked.

Hijack This Log file:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:24:07 PM, on 4/4/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\PROGRA~1\MICROS~3\rapimgr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.divematrix.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [autochk] rundll32.exe C:\WINDOWS\system32\autochk.dll,_IWMPEvents@16
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [autochk] rundll32.exe C:\DOCUME~1\HLacey\protect.dll,_IWMPEvents@16
O4 - Startup: ChkDisk.dll
O4 - Startup: ChkDisk.lnk = ?
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Bluetooth.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send to &Bluetooth Device… - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://www.customdining.com
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1…toUploader5.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1181517816319
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1181564070625
O16 - DPF: {7451D317-862C-45DA-8C28-1B21ADF95877} (Hybrid WebView) - http://209.181.6.25/WebViewS.cab
O16 - DPF: {BCBC9371-595D-11D4-A96D-00105A1CEF6C} (View22RTE Class) - http://onlinedesigner.hgtv.com/images/app/view22rte.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/get/shock…ash/swflash.cab
O16 - DPF: {D6E7CFB5-C074-4D1C-B647-663D1A8D96BF} (Facebook Photo Uploader 4) - http://upload.facebook.com/controls/Facebo…Uploader4_5.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/dim2/default/popcaploader_v6.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = BigSkyBeverage.local
O17 - HKLM\Software\..\Telephony: DomainName = BigSkyBeverage.local
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = BigSkyBeverage.local
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: BabelgumUpdater - Unknown owner - C:\Program Files\Babelgum Player\babelgumupdater_service.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

–
End of file - 10414 bytes

Thanks

CatByte

Post #2April 5, 2009, 3:21 PM UTC

Hi, and

Please do the following:

Open HiJackThis
Click on Do a system scan only
Check the boxes next to ONLY the entries listed below (if still present):

O4 - HKLM\..\Run: [autochk] rundll32.exe C:\WINDOWS\system32\autochk.dll,_IWMPEvents@16
O4 - HKCU\..\Run: [autochk] rundll32.exe C:\DOCUME~1\HLacey\protect.dll,_IWMPEvents@16
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/dim2/default/popcaploader_v6.cab

Close all windows except Hijackthis and click Fix Checked
Click Yes when prompted
Close HijackThis.

NEXT

Download OTListIt2 to your desktop.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Check the boxes beside LOP Check and Purity Check.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTListIt.Txt and Extras.Txt.
Note:These logs can be located in the OTListIt2. folder on you C:\ drive if they fail to open automatically.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them both in.

coldsmoke

Post #3April 5, 2009, 4:00 PM UTC

Thanks Catbyte.

OTListIt Extras logfile created on: 4/5/2009 9:49:22 AM - Run 1
OTListIt2 by OldTimer - Version 2.0.11.0 Folder = C:\Documents and Settings\HLacey\Desktop
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.56 Gb Available Physical Memory | 78.30% Memory free
3.85 Gb Paging File | 3.59 Gb Available in Paging File | 93.32% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092;

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 72.47 Gb Total Space | 42.52 Gb Free Space | 58.66% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: HUNTER-LAPTOP
Current User Name: HLacey
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Output = Minimal
File Age = 30 Days
Company Name Whitelist: On

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.html [@ = htmlfile] – C:\Program Files\Internet Explorer\IEXPLORE.EXE (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = 1
"FirewallDisableNotify" = 1
"UpdatesDisableNotify" = 1
"AntiVirusOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile
"EnableFirewall" = 1

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"26675:TCP" = 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager (Microsoft Corporation)
C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager (Microsoft Corporation)
C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes (Apple Inc.)
C:\Program Files\InterVideo\DVD8\WinDVD.exe:*:Enabled:WinDVD File not found
C:\Program Files\Firaxis Games\Sid Meier's Civilization 4\Civilization4.exe:*:Enabled:Sid Meier's Civilization 4 (Firaxis Games)
C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager (Microsoft Corporation)
C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager (Microsoft Corporation)
C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application (Microsoft Corporation)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{075473F5-846A-448B-BCB3-104AA1760205}" = Roxio RecordNow Data
"{1206EF92-2E83-4859-ACCB-2048C3CB7DA6}" = Roxio DLA
"{15095BF3-A3D7-4DDF-B193-3A496881E003}" = Microsoft .NET Framework 3.0
"{186A63A2-4256-43C6-8061-95EF77A5CDB6}" = Sid Meier's Civilization 4
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}" = Google Earth
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{3248F0A8-6813-11D6-A77B-00B0D0150060}" = J2SE Runtime Environment 5.0 Update 6
"{3248F0A8-6813-11D6-A77B-00B0D0160010}" = Java™ SE Runtime Environment 6 Update 1
"{3248F0A8-6813-11D6-A77B-00B0D0160020}" = Java™ 6 Update 2
"{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java™ 6 Update 3
"{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java™ 6 Update 5
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java™ 6 Update 7
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3921A67A-5AB1-4E48-9444-C71814CF3027}" = VCRedistSetup
"{3F4EC965-28EF-45C3-B063-04B25D4E9679}" = WIDCOMM Bluetooth Software
"{43CAC9A1-1993-4F65-9096-7C9AFC2BBF54}" = Dell CinePlayer
"{491DD792-AD81-429C-9EB4-86DD3D22E333}" = Windows Communication Foundation
"{553E56C3-7AA1-45FE-A2FC-2C43DC27F765}" = iTunes
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{74EC78BC-B379-4E29-9006-8F161DCAABA6}" = Apple Software Update
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{7D1B85BD-AA07-48B8-808D-67A4067FC6BD}" = Windows Workflow Foundation
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{91110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{91170409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office FrontPage 2003
"{91490409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office 2003 Primary Interop Assemblies
"{91510409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Visio Professional 2003
"{95A890AA-B3B1-44B6-9C18-A8F7AB3EE7FC}" = QuickTime
"{99052DB7-9592-4522-A558-5417BBAD48EE}" = Microsoft ActiveSync
"{9C9D0F85-5658-4A5E-95A9-65F7DB2916EE}" = Broadcom 440x 10/100 Integrated Controller
"{A02ED372-22FA-448B-AB6A-1B0FC23B7D08}" = ATI Catalyst Control Center
"{A462213D-EED4-42C2-9A60-7BDD4D4B0B17}" = SigmaTel Audio
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A5FC5A28-20D4-4A43-9C27-F98FF7F33096}" = Compeat Back Office Client
"{AB708C9B-97C8-4AC9-899B-DBF226AC9382}" = Roxio RecordNow Audio
"{AC76BA86-7AD7-1033-7B44-A81200000003}" = Adobe Reader 8.1.2
"{B12665F4-4E93-4AB4-B7FC-37053B524629}" = Roxio RecordNow Copy
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B508B3F1-A24A-32C0-B310-85786919EF28}" = Microsoft .NET Framework 2.0 Service Pack 1
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{BAF78226-3200-4DB4-BE33-4D922A799840}" = Windows Presentation Foundation
"{BE282C23-5484-47FF-B2C1-EBEA5C891033}" = Nero 8 Trial
"{C5074CC4-0E26-4716-A307-960272A90040}" = QuickSet
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware Free Edition
"{CFBCE791-2D53-4FCE-B3FB-D6E01F4112E8}" = Sid Meier's Civilization 4
"{D050D7362D214723AD585B541FFB6C11}" = DivX Content Uploader
"{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}" = PL-2303 USB-to-Serial
"{FCD9CD52-7222-4672-94A0-A722BA702FD0}" = Dell Resource CD
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Photoshop 7.0" = Adobe Photoshop 7.0
"All ATI Software" = ATI - Software Uninstall Utility
"AoA DVD Copy_is1" = AoA DVD Copy
"ATI Display Driver" = ATI Display Driver
"Babelgum Player" = Babelgum
"Broadcom 802.11b Network Adapter" = Dell Wireless WLAN Card
"CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2BFA&SUBSYS_14F100C3" = Conexant HDA D110 MDC V.92 Modem
"DECCHECK" = Microsoft Windows XP Video Decoder Checkup Utility
"Google Updater" = Google Updater
"HijackThis" = HijackThis 2.0.2
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"Indeo® software" = Indeo® software
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.0" = Microsoft .NET Framework 3.0
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"PokerStars" = PokerStars
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"V-Planner_is1" = V-Planner 3.84
"WIC" = Windows Imaging Component
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows Mobile Device Handbook" = XV6800 User Manual
"Windows XP Service Pack" = Windows XP Service Pack 2
"WinRAR archiver" = WinRAR archiver
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 4/5/2009 10:15:08 AM | Computer Name = HUNTER-LAPTOP | Source = Application Error | ID = 1000
Description = Faulting application superantispyware.exe, version 4.0.0.1154, faulting
module superantispyware.exe, version 4.0.0.1154, fault address 0x00075667.

Error - 4/5/2009 10:18:37 AM | Computer Name = HUNTER-LAPTOP | Source = Userenv | ID = 1054
Description = Windows cannot obtain the domain controller name for your computer
network. (The specified domain either does not exist or could not be contacted.
). Group Policy processing aborted.

Error - 4/5/2009 10:18:49 AM | Computer Name = HUNTER-LAPTOP | Source = Application Error | ID = 1000
Description = Faulting application superantispyware.exe, version 4.0.0.1154, faulting
module superantispyware.exe, version 4.0.0.1154, fault address 0x00075667.

Error - 4/5/2009 10:19:08 AM | Computer Name = HUNTER-LAPTOP | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 7.0.6000.16791, faulting
module unknown, version 0.0.0.0, fault address 0x9331c4f6.

Error - 4/5/2009 10:19:33 AM | Computer Name = HUNTER-LAPTOP | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 7.0.6000.16791, faulting
module unknown, version 0.0.0.0, fault address 0x9059c4f6.

Error - 4/5/2009 10:19:37 AM | Computer Name = HUNTER-LAPTOP | Source = AutoEnrollment | ID = 15
Description = Automatic certificate enrollment for local system failed to contact
the active directory (0x8007054b). The specified domain either does not exist
or could not be contacted. Enrollment will not be performed.

Error - 4/5/2009 10:25:23 AM | Computer Name = HUNTER-LAPTOP | Source = Application Error | ID = 1000
Description = Faulting application superantispyware.exe, version 4.0.0.1154, faulting
module superantispyware.exe, version 4.0.0.1154, fault address 0x00075667.

Error - 4/5/2009 10:33:04 AM | Computer Name = HUNTER-LAPTOP | Source = Application Error | ID = 1000
Description = Faulting application superantispyware.exe, version 4.0.0.1154, faulting
module superantispyware.exe, version 4.0.0.1154, fault address 0x00075667.

Error - 4/5/2009 11:40:51 AM | Computer Name = HUNTER-LAPTOP | Source = Application Error | ID = 1000
Description = Faulting application superantispyware.exe, version 4.0.0.1154, faulting
module superantispyware.exe, version 4.0.0.1154, fault address 0x00075667.

Error - 4/5/2009 11:41:22 AM | Computer Name = HUNTER-LAPTOP | Source = Application Error | ID = 1000
Description = Faulting application superantispyware.exe, version 4.26.0.1000, faulting
module superantispyware.exe, version 4.26.0.1000, fault address 0x000039e0.

[ Application Events ]
Error - 4/5/2009 10:15:08 AM | Computer Name = HUNTER-LAPTOP | Source = Application Error | ID = 1000
Description = Faulting application superantispyware.exe, version 4.0.0.1154, faulting
module superantispyware.exe, version 4.0.0.1154, fault address 0x00075667.

Error - 4/5/2009 10:18:37 AM | Computer Name = HUNTER-LAPTOP | Source = Userenv | ID = 1054
Description = Windows cannot obtain the domain controller name for your computer
network. (The specified domain either does not exist or could not be contacted.
). Group Policy processing aborted.

Error - 4/5/2009 10:18:49 AM | Computer Name = HUNTER-LAPTOP | Source = Application Error | ID = 1000
Description = Faulting application superantispyware.exe, version 4.0.0.1154, faulting
module superantispyware.exe, version 4.0.0.1154, fault address 0x00075667.

Error - 4/5/2009 10:19:08 AM | Computer Name = HUNTER-LAPTOP | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 7.0.6000.16791, faulting
module unknown, version 0.0.0.0, fault address 0x9331c4f6.

Error - 4/5/2009 10:19:33 AM | Computer Name = HUNTER-LAPTOP | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 7.0.6000.16791, faulting
module unknown, version 0.0.0.0, fault address 0x9059c4f6.

Error - 4/5/2009 10:19:37 AM | Computer Name = HUNTER-LAPTOP | Source = AutoEnrollment | ID = 15
Description = Automatic certificate enrollment for local system failed to contact
the active directory (0x8007054b). The specified domain either does not exist
or could not be contacted. Enrollment will not be performed.

Error - 4/5/2009 10:25:23 AM | Computer Name = HUNTER-LAPTOP | Source = Application Error | ID = 1000
Description = Faulting application superantispyware.exe, version 4.0.0.1154, faulting
module superantispyware.exe, version 4.0.0.1154, fault address 0x00075667.

Error - 4/5/2009 10:33:04 AM | Computer Name = HUNTER-LAPTOP | Source = Application Error | ID = 1000
Description = Faulting application superantispyware.exe, version 4.0.0.1154, faulting
module superantispyware.exe, version 4.0.0.1154, fault address 0x00075667.

Error - 4/5/2009 11:40:51 AM | Computer Name = HUNTER-LAPTOP | Source = Application Error | ID = 1000
Description = Faulting application superantispyware.exe, version 4.0.0.1154, faulting
module superantispyware.exe, version 4.0.0.1154, fault address 0x00075667.

Error - 4/5/2009 11:41:22 AM | Computer Name = HUNTER-LAPTOP | Source = Application Error | ID = 1000
Description = Faulting application superantispyware.exe, version 4.26.0.1000, faulting
module superantispyware.exe, version 4.26.0.1000, fault address 0x000039e0.

[ System Events ]
Error - 4/5/2009 10:21:44 AM | Computer Name = HUNTER-LAPTOP | Source = Service Control Manager | ID = 7034
Description = The World Wide Web Publishing service terminated unexpectedly. It
has done this 1 time(s).

Error - 4/5/2009 10:21:57 AM | Computer Name = HUNTER-LAPTOP | Source = Service Control Manager | ID = 7034
Description = The BrSplService service terminated unexpectedly. It has done this
1 time(s).

Error - 4/5/2009 10:22:27 AM | Computer Name = HUNTER-LAPTOP | Source = Service Control Manager | ID = 7034
Description = The Ati HotKey Poller service terminated unexpectedly. It has done
this 1 time(s).

Error - 4/5/2009 10:22:44 AM | Computer Name = HUNTER-LAPTOP | Source = Service Control Manager | ID = 7034
Description = The Application Layer Gateway Service service terminated unexpectedly.
It has done this 1 time(s).

Error - 4/5/2009 10:22:51 AM | Computer Name = HUNTER-LAPTOP | Source = Service Control Manager | ID = 7034
Description = The PLFlash DeviceIoControl Service service terminated unexpectedly.
It has done this 1 time(s).

Error - 4/5/2009 10:22:58 AM | Computer Name = HUNTER-LAPTOP | Source = Service Control Manager | ID = 7034
Description = The NICCONFIGSVC service terminated unexpectedly. It has done this
1 time(s).

Error - 4/5/2009 10:23:13 AM | Computer Name = HUNTER-LAPTOP | Source = Service Control Manager | ID = 7034
Description = The NMIndexingService service terminated unexpectedly. It has done
this 1 time(s).

Error - 4/5/2009 10:23:32 AM | Computer Name = HUNTER-LAPTOP | Source = Service Control Manager | ID = 7031
Description = The Bluetooth Service service terminated unexpectedly. It has done
this 1 time(s). The following corrective action will be taken in 60000 milliseconds:
Restart the service.

Error - 4/5/2009 10:33:52 AM | Computer Name = HUNTER-LAPTOP | Source = W32Time | ID = 39452701
Description = The time provider NtpClient is configured to acquire time from one
or more time sources, however none of the sources are currently accessible. No attempt
to contact a source will be made for 29 minutes. NtpClient has no source of accurate
time.

Error - 4/5/2009 11:03:52 AM | Computer Name = HUNTER-LAPTOP | Source = W32Time | ID = 39452701
Description = The time provider NtpClient is configured to acquire time from one
or more time sources, however none of the sources are currently accessible. No attempt
to contact a source will be made for 60 minutes. NtpClient has no source of accurate
time.

[ System Events ]
Error - 4/5/2009 10:21:44 AM | Computer Name = HUNTER-LAPTOP | Source = Service Control Manager | ID = 7034
Description = The World Wide Web Publishing service terminated unexpectedly. It
has done this 1 time(s).

Error - 4/5/2009 10:21:57 AM | Computer Name = HUNTER-LAPTOP | Source = Service Control Manager | ID = 7034
Description = The BrSplService service terminated unexpectedly. It has done this
1 time(s).

Error - 4/5/2009 10:22:27 AM | Computer Name = HUNTER-LAPTOP | Source = Service Control Manager | ID = 7034
Description = The Ati HotKey Poller service terminated unexpectedly. It has done
this 1 time(s).

Error - 4/5/2009 10:22:44 AM | Computer Name = HUNTER-LAPTOP | Source = Service Control Manager | ID = 7034
Description = The Application Layer Gateway Service service terminated unexpectedly.
It has done this 1 time(s).

Error - 4/5/2009 10:22:51 AM | Computer Name = HUNTER-LAPTOP | Source = Service Control Manager | ID = 7034
Description = The PLFlash DeviceIoControl Service service terminated unexpectedly.
It has done this 1 time(s).

Error - 4/5/2009 10:22:58 AM | Computer Name = HUNTER-LAPTOP | Source = Service Control Manager | ID = 7034
Description = The NICCONFIGSVC service terminated unexpectedly. It has done this
1 time(s).

Error - 4/5/2009 10:23:13 AM | Computer Name = HUNTER-LAPTOP | Source = Service Control Manager | ID = 7034
Description = The NMIndexingService service terminated unexpectedly. It has done
this 1 time(s).

Error - 4/5/2009 10:23:32 AM | Computer Name = HUNTER-LAPTOP | Source = Service Control Manager | ID = 7031
Description = The Bluetooth Service service terminated unexpectedly. It has done
this 1 time(s). The following corrective action will be taken in 60000 milliseconds:
Restart the service.

Error - 4/5/2009 10:33:52 AM | Computer Name = HUNTER-LAPTOP | Source = W32Time | ID = 39452701
Description = The time provider NtpClient is configured to acquire time from one
or more time sources, however none of the sources are currently accessible. No attempt
to contact a source will be made for 29 minutes. NtpClient has no source of accurate
time.

Error - 4/5/2009 11:03:52 AM | Computer Name = HUNTER-LAPTOP | Source = W32Time | ID = 39452701
Description = The time provider NtpClient is configured to acquire time from one
or more time sources, however none of the sources are currently accessible. No attempt
to contact a source will be made for 60 minutes. NtpClient has no source of accurate
time.

< End of report >

coldsmoke

Post #4April 5, 2009, 4:01 PM UTC

OTListIt logfile created on: 4/5/2009 9:49:22 AM - Run 1
OTListIt2 by OldTimer - Version 2.0.11.0 Folder = C:\Documents and Settings\HLacey\Desktop
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.56 Gb Available Physical Memory | 78.30% Memory free
3.85 Gb Paging File | 3.59 Gb Available in Paging File | 93.32% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092;

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 72.47 Gb Total Space | 42.52 Gb Free Space | 58.66% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: HUNTER-LAPTOP
Current User Name: HLacey
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Output = Minimal
File Age = 30 Days
Company Name Whitelist: On

========== Processes (SafeList) ==========

PRC - C:\WINDOWS\System32\WLTRYSVC.EXE ()
PRC - C:\WINDOWS\Explorer.EXE (Microsoft Corporation)
PRC - C:\WINDOWS\System32\DLA\DLACTRLW.EXE (Sonic Solutions)
PRC - C:\WINDOWS\system32\inetsrv\inetinfo.exe (Microsoft Corporation)
PRC - C:\WINDOWS\System32\bcmwltry.exe (Dell Inc.)
PRC - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe (Broadcom Corporation.)
PRC - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
PRC - C:\Program Files\Internet Explorer\Iexplore.exe (Microsoft Corporation)
PRC - C:\Documents and Settings\HLacey\Desktop\OTListIt2.exe (OldTimer Tools)

========== Win32 Services (SafeList) ==========

SRV - (aspnet_state [On_Demand | Stopped]) – C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (Microsoft Corporation)
SRV - (Ati HotKey Poller [Auto | Stopped]) – C:\WINDOWS\system32\Ati2evxx.exe (ATI Technologies Inc.)
SRV - (BabelgumUpdater [Auto | Stopped]) – C:\Program Files\Babelgum Player\babelgumupdater_service.exe ()
SRV - (Brother XP spl Service [Auto | Stopped]) – C:\WINDOWS\system32\brsvc01a.exe (brother Industries Ltd)
SRV - (btwdins [Auto | Running]) – C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe (Broadcom Corporation.)
SRV - (clr_optimization_v2.0.50727_32 [On_Demand | Stopped]) – C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (FontCache3.0.0.0 [On_Demand | Stopped]) – c:\WINDOWS\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe (Microsoft Corporation)
SRV - (gusvc [Auto | Stopped]) – C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (Google)
SRV - (helpsvc [Auto | Running]) – C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll (Microsoft Corporation)
SRV - (idsvc [Unknown | Stopped]) – C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe (Microsoft Corporation)
SRV - (IISADMIN [Auto | Running]) – C:\WINDOWS\system32\inetsrv\inetinfo.exe (Microsoft Corporation)
SRV - (iPod Service [On_Demand | Stopped]) – C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)
SRV - (Nero BackItUp Scheduler 3 [Auto | Stopped]) – C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe (Nero AG)
SRV - (NetTcpPortSharing [Disabled | Stopped]) – C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe (Microsoft Corporation)
SRV - (NICCONFIGSVC [Auto | Stopped]) – C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe (Dell Inc.)
SRV - (NMIndexingService [On_Demand | Stopped]) – C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe (Nero AG)
SRV - (ose [On_Demand | Stopped]) – C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (PLFlash DeviceIoControl Service [Auto | Stopped]) – C:\WINDOWS\system32\IoctlSvc.exe (Prolific Technology Inc.)
SRV - (W3SVC [Auto | Running]) – C:\WINDOWS\system32\inetsrv\inetinfo.exe (Microsoft Corporation)
SRV - (wltrysvc [Auto | Running]) – C:\WINDOWS\System32\WLTRYSVC.EXE ()
SRV - (WMPNetworkSvc [On_Demand | Stopped]) – C:\Program Files\Windows Media Player\WMPNetwk.exe (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV - (APPDRV [System | Running]) – C:\WINDOWS\SYSTEM32\DRIVERS\APPDRV.SYS (Dell Inc)
DRV - (ati2mtag [On_Demand | Running]) – C:\WINDOWS\system32\DRIVERS\ati2mtag.sys (ATI Technologies Inc.)
DRV - (BCM43XX [On_Demand | Running]) – C:\WINDOWS\system32\DRIVERS\bcmwl5.sys (Broadcom Corporation)
DRV - (bcm4sbxp [On_Demand | Running]) – C:\WINDOWS\system32\DRIVERS\bcm4sbxp.sys (Broadcom Corporation)
DRV - (btaudio [On_Demand | Running]) – C:\WINDOWS\system32\drivers\btaudio.sys (Broadcom Corporation.)
DRV - (BTDriver [On_Demand | Stopped]) – C:\WINDOWS\system32\DRIVERS\btport.sys (Broadcom Corporation.)
DRV - (BTKRNL [On_Demand | Running]) – C:\WINDOWS\system32\DRIVERS\btkrnl.sys (Broadcom Corporation.)
DRV - (BTSERIAL [Auto | Running]) – C:\WINDOWS\system32\drivers\btserial.sys (Broadcom Corporation.)
DRV - (BTWDNDIS [On_Demand | Stopped]) – C:\WINDOWS\system32\DRIVERS\btwdndis.sys (Broadcom Corporation.)
DRV - (btwhid [On_Demand | Stopped]) – C:\WINDOWS\system32\DRIVERS\btwhid.sys (Broadcom Corporation.)
DRV - (btwmodem [On_Demand | Stopped]) – C:\WINDOWS\system32\DRIVERS\btwmodem.sys (Broadcom Corporation.)
DRV - (BTWUSB [On_Demand | Running]) – C:\WINDOWS\System32\Drivers\btwusb.sys (Broadcom Corporation.)
DRV - (catchme [On_Demand | Stopped]) – C:\WINDOWS\catchme.exe ()
DRV - (DLABOIOM [Auto | Running]) – C:\WINDOWS\System32\DLA\DLABOIOM.SYS (Sonic Solutions)
DRV - (DLACDBHM [System | Running]) – C:\WINDOWS\System32\Drivers\DLACDBHM.SYS (Sonic Solutions)
DRV - (DLADResN [Auto | Running]) – C:\WINDOWS\System32\DLA\DLADResN.SYS (Sonic Solutions)
DRV - (DLAIFS_M [Auto | Running]) – C:\WINDOWS\System32\DLA\DLAIFS_M.SYS (Sonic Solutions)
DRV - (DLAOPIOM [Auto | Running]) – C:\WINDOWS\System32\DLA\DLAOPIOM.SYS (Sonic Solutions)
DRV - (DLAPoolM [Auto | Running]) – C:\WINDOWS\System32\DLA\DLAPoolM.SYS (Sonic Solutions)
DRV - (DLARTL_N [System | Running]) – C:\WINDOWS\System32\Drivers\DLARTL_N.SYS (Sonic Solutions)
DRV - (DLAUDFAM [Auto | Running]) – C:\WINDOWS\System32\DLA\DLAUDFAM.SYS (Sonic Solutions)
DRV - (DLAUDF_M [Auto | Running]) – C:\WINDOWS\System32\DLA\DLAUDF_M.SYS (Sonic Solutions)
DRV - (DRVMCDB [Boot | Running]) – C:\WINDOWS\System32\Drivers\DRVMCDB.SYS (Sonic Solutions)
DRV - (DRVNDDM [Auto | Running]) – C:\WINDOWS\System32\Drivers\DRVNDDM.SYS (Sonic Solutions)
DRV - (GEARAspiWDM [On_Demand | Running]) – C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV - (HDAudBus [On_Demand | Running]) – C:\WINDOWS\system32\DRIVERS\HDAudBus.sys (Windows ® Server 2003 DDK provider)
DRV - (HSFHWAZL [On_Demand | Running]) – C:\WINDOWS\system32\DRIVERS\HSFHWAZL.sys (Conexant Systems, Inc.)
DRV - (HSF_DPV [On_Demand | Running]) – C:\WINDOWS\system32\DRIVERS\HSF_DPV.sys (Conexant Systems, Inc.)
DRV - (mdmxsdk [Auto | Running]) – C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys (Conexant)
DRV - (Ptilink [On_Demand | Running]) – C:\WINDOWS\System32\DRIVERS\ptilink.sys (Parallel Technologies, Inc.)
DRV - (PxHelp20 [Boot | Running]) – C:\WINDOWS\System32\Drivers\PxHelp20.sys (Sonic Solutions)
DRV - (SASDIFSV [System | Running]) – C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS ()
DRV - (SASENUM [On_Demand | Stopped]) – C:\Program Files\SUPERAntiSpyware\SASENUM.SYS (SuperAdBlocker, Inc.)
DRV - (SASKUTIL [System | Running]) – C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys ()
DRV - (Secdrv [On_Demand | Stopped]) – C:\WINDOWS\System32\DRIVERS\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
DRV - (Ser2pl [On_Demand | Stopped]) – C:\WINDOWS\system32\DRIVERS\ser2pl.sys (Prolific Technology Inc.)
DRV - (SONYPVU1 [On_Demand | Stopped]) – C:\WINDOWS\system32\DRIVERS\SONYPVU1.SYS (Sony Corporation)
DRV - (STHDA [On_Demand | Running]) – C:\WINDOWS\system32\drivers\sthda.sys (SigmaTel, Inc.)
DRV - (SynTP [On_Demand | Running]) – C:\WINDOWS\system32\DRIVERS\SynTP.sys (Synaptics, Inc.)
DRV - (tmcomm [Auto | Running]) – C:\WINDOWS\system32\drivers\tmcomm.sys (Trend Micro Inc.)
DRV - (usb_rndisx [On_Demand | Stopped]) – C:\WINDOWS\system32\DRIVERS\usb8023x.sys (Microsoft Corporation)
DRV - (wceusbsh [On_Demand | Stopped]) – C:\WINDOWS\system32\DRIVERS\wceusbsh.sys (Microsoft Corporation)
DRV - (winachsf [On_Demand | Running]) – C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys (Conexant Systems, Inc.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL =
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?p…amp;ar=iesearch
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://www.scubaboard.com/;http://www.cust…diving-forums/;
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.divematrix.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

O1 HOSTS File: (27 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (DriveLetterAccess) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL (Sonic Solutions)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll ()
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll (Google Inc.)
O2 - BHO: (Google Dictionary Compression sdch) - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (&Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll ()
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" (Adobe Systems Incorporated)
O4 - HKLM..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay (ATI Technologies Inc.)
O4 - HKLM..\Run: [autochk] rundll32.exe C:\WINDOWS\system32\autochk.dll,_IWMPEvents@16 ( )
O4 - HKLM..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe (Dell Inc.)
O4 - HKLM..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe (Dell Inc)
O4 - HKLM..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE (Sonic Solutions)
O4 - HKLM..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe ()
O4 - HKLM..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler File not found
O4 - HKLM..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup File not found
O4 - HKLM..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start (Macrovision Corporation)
O4 - HKLM..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" (Apple Inc.)
O4 - HKLM..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" (Nero AG)
O4 - HKLM..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime (Apple Inc.)
O4 - HKLM..\Run: [SigmatelSysTrayApp] stsystra.exe (SigmaTel, Inc.)
O4 - HKLM..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics, Inc.)
O4 - HKCU..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe" (Microsoft Corporation)
O4 - HKCU..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020 (Nero AG)
O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Bluetooth.lnk = C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
O4 - Startup: C:\Documents and Settings\HLacey\Start Menu\Programs\Startup\ChkDisk.dll ( )
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoWelcomeScreen = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 (Microsoft Corporation)
O8 - Extra context menu item: Send to &Bluetooth Device… - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll (Sun Microsystems, Inc.)
O9 - Extra Button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll (Microsoft Corporation)
O9 - Extra Button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe (PokerStars)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (Microsoft Corporation)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKCU\..Trusted Domains: customdining.com ([www] http in Trusted sites)
O15 - HKCU\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} http://upload.facebook.com/controls/2008.1…toUploader5.cab (Facebook Photo Uploader 5 Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/5/b…heckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/…b?1181517816319 (WUWebControl Class)
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} http://download.divx.com/player/DivXBrowserPlugin.cab (DivXBrowserPlugin Object)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdat…b?1181564070625 (MUWebControl Class)
O16 - DPF: {7451D317-862C-45DA-8C28-1B21ADF95877} http://209.181.6.25/WebViewS.cab (Hybrid WebView)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…t/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {BCBC9371-595D-11D4-A96D-00105A1CEF6C} http://onlinedesigner.hgtv.com/images/app/view22rte.cab (View22RTE Class)
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_06)
O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_01)
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_02)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_03)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_05)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/get/shock…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {D6E7CFB5-C074-4D1C-B647-663D1A8D96BF} http://upload.facebook.com/controls/Facebo…Uploader4_5.cab (Facebook Photo Uploader 4)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = BigSkyBeverage.local
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Filter: - text/xml - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\system32\Ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop Components:0 (My Current Home Page) - About:Home
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - Autorun File - C:\AUTOEXEC.BAT () - [ NTFS ]
O33 - MountPoints2\E\Shell - "" = AutoRun
O33 - MountPoints2\E\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\LaunchU3.exe – File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found

========== Files/Folders - Created Within 30 Days ==========

[2009/04/05 09:46:47 | 00,499,200 | —- | C] (OldTimer Tools) – C:\Documents and Settings\HLacey\Desktop\OTListIt2.exe
[2009/04/05 09:22:38 | 94,502,456 | —- | C] () – C:\Documents and Settings\HLacey\Desktop\20090405 reg bu.reg
[2009/04/05 08:31:43 | 06,237,728 | —- | C] () – C:\Documents and Settings\HLacey\Desktop\SUPERAntiSpyware.exe
[2009/04/05 08:18:27 | 21,458,45248 | -HS- | C] () – C:\hiberfil.sys
[2009/04/04 20:02:59 | 00,000,780 | —- | C] () – C:\Documents and Settings\All Users\Desktop\SUPERAntiSpyware Free Edition.lnk
[2009/04/04 19:39:33 | 00,024,064 | -HS- | C] ( ) – C:\WINDOWS\System32\autochk.dll
[2009/04/04 19:39:33 | 00,024,064 | -HS- | C] ( ) – C:\Documents and Settings\HLacey\Start Menu\Programs\Startup\ChkDisk.dll
[2009/04/04 19:39:33 | 00,000,651 | -HS- | C] () – C:\Documents and Settings\HLacey\Start Menu\Programs\Startup\ChkDisk.lnk
[2009/04/02 15:02:27 | 01,579,252 | —- | C] () – C:\Documents and Settings\HLacey\Desktop\2009 Easter Brunch qtr page Belgrade News.pdf
[2009/04/01 17:02:15 | 00,769,122 | —- | C] () – C:\Documents and Settings\HLacey\Desktop\2009 Easter Brunch Menu Flyer.pdf
[2009/04/01 16:59:59 | 08,076,839 | —- | C] () – C:\Documents and Settings\HLacey\Desktop\2009 Easter Brunch qtr page Belgrade News.psd
[2009/04/01 16:38:55 | 03,755,194 | —- | C] () – C:\Documents and Settings\HLacey\Desktop\2009 Easter Brunch Menu Flyer.psd
[2009/04/01 15:51:54 | 00,026,624 | —- | C] () – C:\Documents and Settings\HLacey\Desktop\2009 Easter Brunch Menu.doc
[2009/03/31 09:43:05 | 00,031,744 | —- | C] () – C:\Documents and Settings\HLacey\Desktop\Bread Recipes.doc
[2009/03/27 13:47:41 | 00,051,200 | —- | C] () – C:\Documents and Settings\HLacey\Desktop\20090331 Defendants Responses to 1st Disc. Req.doc
[2009/03/26 20:14:34 | 00,779,595 | —- | C] () – C:\Documents and Settings\HLacey\Desktop\MP061A09.EXE
[2009/03/26 16:15:51 | 00,323,147 | —- | C] () – C:\Documents and Settings\HLacey\Desktop\200903 Belg News Dining on a budget Fri buffet.pdf
[2009/03/26 15:47:47 | 00,055,038 | —- | C] () – C:\Documents and Settings\HLacey\Desktop\Publication1.jpg
[2009/03/25 18:12:55 | 00,000,868 | —- | C] () – C:\WINDOWS\tasks\Google Software Updater.job
[2009/03/24 17:59:11 | 00,024,576 | —- | C] () – C:\Documents and Settings\HLacey\Desktop\SW Questions.doc
[2009/03/24 17:37:56 | 00,000,000 | —D | C] – C:\Documents and Settings\HLacey\My Documents\Bankruptcy
[2009/03/24 16:23:01 | 00,187,926 | —- | C] () – C:\Documents and Settings\HLacey\Desktop\Equipment list.rtf
[2009/03/18 09:32:57 | 00,030,208 | —- | C] () – C:\Documents and Settings\HLacey\Desktop\Line Set.doc
[2009/03/18 08:31:23 | 00,019,968 | —- | C] () – C:\Documents and Settings\HLacey\Desktop\Schedule Template.xls
[2009/03/16 14:55:11 | 05,679,104 | —- | C] () – C:\Documents and Settings\HLacey\Desktop\200903 Inventory Counts Worksheet.xls
[2009/03/16 13:47:30 | 02,559,955 | —- | C] () – C:\Documents and Settings\HLacey\Desktop\Inventory Counts Worksheet.xls
[2009/03/14 21:50:32 | 00,036,730 | —- | C] () – C:\Documents and Settings\HLacey\Desktop\compeatXla.zip
[2009/03/14 19:49:14 | 00,024,064 | —- | C] () – C:\Documents and Settings\HLacey\Desktop\Food To get Rid of.doc
[2009/03/14 11:51:14 | 00,020,480 | —- | C] () – C:\Documents and Settings\HLacey\Desktop\Hunters CK Rules.doc
[2009/03/13 17:47:21 | 00,376,832 | —- | C] (KONICA MINOLTA BUSINESS TECHNOLOGIES, INC.) – C:\WINDOWS\System32\MLUU_CML.dll
[2009/03/13 17:47:21 | 00,080,384 | —- | C] (KONICA MINOLTA BUSINESS TECHNOLOGIES, INC.) – C:\WINDOWS\System32\MLUU_MON.dll
[2009/03/13 17:47:21 | 00,026,624 | —- | C] () – C:\WINDOWS\System32\MLUU_UNP.EXE
[2009/03/13 17:47:21 | 00,005,858 | —- | C] () – C:\WINDOWS\MLUU__WM.ini
[2009/03/13 17:47:21 | 00,000,844 | —- | C] () – C:\WINDOWS\MLUU_UNP.unf
[2009/03/13 17:47:21 | 00,000,165 | —- | C] () – C:\WINDOWS\MLUU_UNI.ini
[2009/03/10 11:14:09 | 00,000,000 | —D | C] – C:\Documents and Settings\HLacey\My Documents\Old Hard Drive Files to sort
[2008/04/23 17:57:44 | 00,000,069 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2008/02/20 20:05:44 | 03,596,288 | —- | C] () – C:\WINDOWS\System32\qt-dx331.dll
[2008/02/20 20:04:16 | 00,000,416 | —- | C] () – C:\WINDOWS\System32\dtu100.dll.manifest
[2008/02/20 20:04:16 | 00,000,416 | —- | C] () – C:\WINDOWS\System32\dpl100.dll.manifest
[2008/02/20 20:03:24 | 00,012,288 | —- | C] () – C:\WINDOWS\System32\DivXWMPExtType.dll
[2008/01/11 22:17:07 | 00,000,220 | —- | C] () – C:\WINDOWS\wininit.ini
[2007/12/14 13:37:44 | 00,000,030 | —- | C] () – C:\WINDOWS\System32\brss01a.ini
[2007/12/14 13:37:42 | 00,000,052 | —- | C] () – C:\WINDOWS\BRPP2KA.INI
[2007/10/22 13:41:27 | 00,000,040 | —- | C] () – C:\WINDOWS\opt_1440.ini
[2007/10/22 13:41:24 | 00,000,068 | —- | C] () – C:\WINDOWS\brmx2001.ini
[2007/10/22 13:38:31 | 00,000,447 | —- | C] () – C:\WINDOWS\brwmark.ini
[2007/09/08 10:56:49 | 00,056,832 | —- | C] () – C:\WINDOWS\System32\Iyvu9_32.dll
[2007/07/05 15:40:01 | 00,018,932 | —- | C] () – C:\WINDOWS\MSUMLT_B.ini
[2007/06/13 18:17:34 | 00,038,576 | —- | C] () – C:\WINDOWS\System32\w3ctrs.ini
[2007/06/13 18:17:33 | 00,010,225 | —- | C] () – C:\WINDOWS\System32\axperf.ini
[2007/06/13 18:17:29 | 00,011,435 | —- | C] () – C:\WINDOWS\System32\infoctrs.ini
[2007/06/11 05:47:31 | 00,000,720 | —- | C] () – C:\WINDOWS\ODBC.INI
[2007/06/10 17:17:09 | 00,757,760 | —- | C] () – C:\WINDOWS\System32\bcm1xsup.dll
[2007/06/10 17:17:07 | 00,086,016 | —- | C] () – C:\WINDOWS\System32\preflib.dll
[2007/06/10 16:10:30 | 00,000,000 | —- | C] () – C:\WINDOWS\control.ini
[2007/06/10 16:08:14 | 00,000,002 | —- | C] () – C:\WINDOWS\System32\desktop.ini
[2007/06/10 16:08:14 | 00,000,002 | —- | C] () – C:\WINDOWS\desktop.ini
[2007/06/10 16:06:37 | 00,000,063 | —- | C] () – C:\WINDOWS\vbaddin.ini
[2007/06/10 16:06:37 | 00,000,036 | —- | C] () – C:\WINDOWS\vb.ini
[2007/06/10 16:05:39 | 00,013,223 | —- | C] () – C:\WINDOWS\System32\tslabels.ini
[2007/06/10 16:05:36 | 00,001,931 | —- | C] () – C:\WINDOWS\System32\msdtcprf.ini
[2007/06/10 09:13:03 | 00,569,088 | —- | C] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2007/06/10 09:13:02 | 00,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2006/12/06 12:39:49 | 00,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini
[2006/05/24 18:16:22 | 00,090,112 | —- | C] () – C:\WINDOWS\System32\btprn2k.dll
[2006/01/12 17:09:14 | 00,090,112 | —- | C] () – C:\WINDOWS\System32\DXFLib.dll
[2006/01/12 17:08:06 | 00,143,360 | —- | C] () – C:\WINDOWS\System32\opcode.dll
[2005/02/17 12:41:32 | 00,000,603 | —- | C] () – C:\WINDOWS\System32\BTNeighborhood.dll.manifest
[2005/02/17 12:41:30 | 00,000,593 | —- | C] () – C:\WINDOWS\System32\btcss.dll.manifest
[2003/03/31 06:00:00 | 01,287,680 | —- | C] () – C:\WINDOWS\System32\quartz.dll
[2003/03/31 06:00:00 | 01,015,477 | —- | C] () – C:\WINDOWS\System32\esentprf.ini
[2003/03/31 06:00:00 | 00,733,696 | —- | C] () – C:\WINDOWS\System32\qedwipes.dll
[2003/03/31 06:00:00 | 00,562,176 | —- | C] () – C:\WINDOWS\System32\qedit.dll
[2003/03/31 06:00:00 | 00,498,742 | —- | C] () – C:\WINDOWS\System32\dxmasf.dll
[2003/03/31 06:00:00 | 00,385,024 | —- | C] () – C:\WINDOWS\System32\qdvd.dll
[2003/03/31 06:00:00 | 00,355,112 | —- | C] () – C:\WINDOWS\System32\msjetoledb40.dll
[2003/03/31 06:00:00 | 00,279,040 | —- | C] () – C:\WINDOWS\System32\qdv.dll
[2003/03/31 06:00:00 | 00,270,848 | —- | C] () – C:\WINDOWS\System32\sbe.dll
[2003/03/31 06:00:00 | 00,252,928 | —- | C] () – C:\WINDOWS\System32\compatui.dll
[2003/03/31 06:00:00 | 00,199,168 | —- | C] () – C:\WINDOWS\System32\Ir32_32.dll
[2003/03/31 06:00:00 | 00,192,512 | —- | C] () – C:\WINDOWS\System32\qcap.dll
[2003/03/31 06:00:00 | 00,186,368 | —- | C] () – C:\WINDOWS\System32\encdec.dll
[2003/03/31 06:00:00 | 00,094,282 | —- | C] () – C:\WINDOWS\System32\msencode.dll
[2003/03/31 06:00:00 | 00,070,656 | —- | C] () – C:\WINDOWS\System32\amstream.dll
[2003/03/31 06:00:00 | 00,059,904 | —- | C] () – C:\WINDOWS\System32\devenum.dll
[2003/03/31 06:00:00 | 00,053,478 | —- | C] () – C:\WINDOWS\System32\tcpmon.ini
[2003/03/31 06:00:00 | 00,042,809 | —- | C] () – C:\WINDOWS\System32\key01.sys
[2003/03/31 06:00:00 | 00,042,537 | —- | C] () – C:\WINDOWS\System32\keyboard.sys
[2003/03/31 06:00:00 | 00,035,648 | —- | C] () – C:\WINDOWS\System32\ntio411.sys
[2003/03/31 06:00:00 | 00,035,424 | —- | C] () – C:\WINDOWS\System32\ntio412.sys
[2003/03/31 06:00:00 | 00,035,328 | —- | C] () – C:\WINDOWS\System32\mciqtz32.dll
[2003/03/31 06:00:00 | 00,034,560 | —- | C] () – C:\WINDOWS\System32\ntio804.sys
[2003/03/31 06:00:00 | 00,034,560 | —- | C] () – C:\WINDOWS\System32\ntio404.sys
[2003/03/31 06:00:00 | 00,033,840 | —- | C] () – C:\WINDOWS\System32\ntio.sys
[2003/03/31 06:00:00 | 00,029,370 | —- | C] () – C:\WINDOWS\System32\ntdos411.sys
[2003/03/31 06:00:00 | 00,029,274 | —- | C] () – C:\WINDOWS\System32\ntdos412.sys
[2003/03/31 06:00:00 | 00,029,146 | —- | C] () – C:\WINDOWS\System32\ntdos804.sys
[2003/03/31 06:00:00 | 00,029,146 | —- | C] () – C:\WINDOWS\System32\ntdos404.sys
[2003/03/31 06:00:00 | 00,027,866 | —- | C] () – C:\WINDOWS\System32\ntdos.sys
[2003/03/31 06:00:00 | 00,027,097 | —- | C] () – C:\WINDOWS\System32\country.sys
[2003/03/31 06:00:00 | 00,015,360 | —- | C] () – C:\WINDOWS\System32\tsd32.dll
[2003/03/31 06:00:00 | 00,014,336 | —- | C] () – C:\WINDOWS\System32\msdmo.dll
[2003/03/31 06:00:00 | 00,013,312 | —- | C] () – C:\WINDOWS\System32\win87em.dll
[2003/03/31 06:00:00 | 00,012,082 | —- | C] () – C:\WINDOWS\System32\rsvp.ini
[2003/03/31 06:00:00 | 00,010,240 | —- | C] () – C:\WINDOWS\System32\scriptpw.dll
[2003/03/31 06:00:00 | 00,010,110 | —- | C] () – C:\WINDOWS\System32\mqperf.ini
[2003/03/31 06:00:00 | 00,009,029 | —- | C] () – C:\WINDOWS\System32\ansi.sys
[2003/03/31 06:00:00 | 00,006,877 | —- | C] () – C:\WINDOWS\System32\pschdprf.ini
[2003/03/31 06:00:00 | 00,004,768 | —- | C] () – C:\WINDOWS\System32\himem.sys
[2003/03/31 06:00:00 | 00,004,126 | —- | C] () – C:\WINDOWS\System32\msdxmlc.dll
[2003/03/31 06:00:00 | 00,003,458 | —- | C] () – C:\WINDOWS\System32\rasctrs.ini
[2003/03/31 06:00:00 | 00,002,891 | —- | C] () – C:\WINDOWS\System32\perfci.ini
[2003/03/31 06:00:00 | 00,002,732 | —- | C] () – C:\WINDOWS\System32\perfwci.ini
[2003/03/31 06:00:00 | 00,002,656 | —- | C] () – C:\WINDOWS\System32\netware.drv
[2003/03/31 06:00:00 | 00,001,405 | —- | C] () – C:\WINDOWS\msdfmap.ini
[2003/03/31 06:00:00 | 00,001,152 | —- | C] () – C:\WINDOWS\System32\perffilt.ini
[2003/03/31 06:00:00 | 00,000,613 | —- | C] () – C:\WINDOWS\win.ini
[2003/03/31 06:00:00 | 00,000,343 | —- | C] () – C:\WINDOWS\System32\prodspec.ini
[2003/03/31 06:00:00 | 00,000,231 | —- | C] () – C:\WINDOWS\system.ini
[2003/01/07 15:05:08 | 00,002,695 | —- | C] () – C:\WINDOWS\System32\OUTLPERF.INI
[2001/11/14 13:56:00 | 01,802,240 | —- | C] () – C:\WINDOWS\System32\lcppn21.dll
[2001/08/17 16:36:28 | 00,157,696 | —- | C] () – C:\WINDOWS\System32\paqsp.dll

========== Files - Modified Within 30 Days ==========

[1 C:\WINDOWS\System32\*.tmp files]
[4 C:\WINDOWS\*.tmp files]
[2009/04/05 09:46:51 | 00,499,200 | —- | M] (OldTimer Tools) – C:\Documents and Settings\HLacey\Desktop\OTListIt2.exe
[2009/04/05 09:23:38 | 94,502,456 | —- | M] () – C:\Documents and Settings\HLacey\Desktop\20090405 reg bu.reg
[2009/04/05 08:31:43 | 06,237,728 | —- | M] () – C:\Documents and Settings\HLacey\Desktop\SUPERAntiSpyware.exe
[2009/04/05 08:22:50 | 00,569,088 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2009/04/05 08:22:50 | 00,478,100 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2009/04/05 08:22:50 | 00,080,806 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2009/04/05 08:18:48 | 00,013,646 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2009/04/05 08:18:47 | 00,000,868 | —- | M] () – C:\WINDOWS\tasks\Google Software Updater.job
[2009/04/05 08:18:36 | 00,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2009/04/05 08:18:34 | 00,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2009/04/05 08:18:27 | 21,458,45248 | -HS- | M] () – C:\hiberfil.sys
[2009/04/05 08:02:55 | 03,786,432 | -H– | M] () – C:\Documents and Settings\HLacey\Local Settings\Application Data\IconCache.db
[2009/04/04 20:32:13 | 00,000,780 | —- | M] () – C:\Documents and Settings\All Users\Desktop\SUPERAntiSpyware Free Edition.lnk
[2009/04/04 19:48:41 | 00,024,064 | -HS- | M] ( ) – C:\WINDOWS\System32\autochk.dll
[2009/04/04 19:39:34 | 00,000,651 | -HS- | M] () – C:\Documents and Settings\HLacey\Start Menu\Programs\Startup\ChkDisk.lnk
[2009/04/04 19:39:33 | 00,024,064 | -HS- | M] ( ) – C:\Documents and Settings\HLacey\Start Menu\Programs\Startup\ChkDisk.dll
[2009/04/02 18:39:24 | 00,008,192 | —- | M] () – C:\Documents and Settings\HLacey\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/04/02 17:38:35 | 00,019,968 | —- | M] () – C:\Documents and Settings\HLacey\Desktop\Schedule Template.xls
[2009/04/02 15:02:29 | 01,579,252 | —- | M] () – C:\Documents and Settings\HLacey\Desktop\2009 Easter Brunch qtr page Belgrade News.pdf
[2009/04/02 15:02:00 | 08,076,839 | —- | M] () – C:\Documents and Settings\HLacey\Desktop\2009 Easter Brunch qtr page Belgrade News.psd
[2009/04/01 21:43:59 | 00,054,156 | -H– | M] () – C:\WINDOWS\QTFont.qfn
[2009/04/01 17:13:31 | 00,026,624 | —- | M] () – C:\Documents and Settings\HLacey\Desktop\2009 Easter Brunch Menu.doc
[2009/04/01 17:02:17 | 00,769,122 | —- | M] () – C:\Documents and Settings\HLacey\Desktop\2009 Easter Brunch Menu Flyer.pdf
[2009/04/01 17:00:38 | 03,755,194 | —- | M] () – C:\Documents and Settings\HLacey\Desktop\2009 Easter Brunch Menu Flyer.psd
[2009/03/31 17:53:58 | 00,051,200 | —- | M] () – C:\Documents and Settings\HLacey\Desktop\20090331 Defendants Responses to 1st Disc. Req.doc
[2009/03/31 09:43:06 | 00,031,744 | —- | M] () – C:\Documents and Settings\HLacey\Desktop\Bread Recipes.doc
[2009/03/28 11:06:11 | 00,001,878 | -H– | M] () – C:\Documents and Settings\HLacey\My Documents\Default.rdp
[2009/03/26 20:14:39 | 00,779,595 | —- | M] () – C:\Documents and Settings\HLacey\Desktop\MP061A09.EXE
[2009/03/26 16:15:53 | 00,323,147 | —- | M] () – C:\Documents and Settings\HLacey\Desktop\200903 Belg News Dining on a budget Fri buffet.pdf
[2009/03/26 15:47:48 | 00,055,038 | —- | M] () – C:\Documents and Settings\HLacey\Desktop\Publication1.jpg
[2009/03/24 17:59:11 | 00,024,576 | —- | M] () – C:\Documents and Settings\HLacey\Desktop\SW Questions.doc
[2009/03/24 17:02:00 | 00,187,926 | —- | M] () – C:\Documents and Settings\HLacey\Desktop\Equipment list.rtf
[2009/03/18 18:53:52 | 00,020,480 | —- | M] () – C:\Documents and Settings\HLacey\Desktop\Hunters CK Rules.doc
[2009/03/18 09:32:57 | 00,030,208 | —- | M] () – C:\Documents and Settings\HLacey\Desktop\Line Set.doc
[2009/03/16 15:54:42 | 05,679,104 | —- | M] () – C:\Documents and Settings\HLacey\Desktop\200903 Inventory Counts Worksheet.xls
[2009/03/16 14:39:38 | 02,559,955 | —- | M] () – C:\Documents and Settings\HLacey\Desktop\Inventory Counts Worksheet.xls
[2009/03/15 09:52:36 | 00,000,069 | —- | M] () – C:\WINDOWS\NeroDigital.ini
[2009/03/14 21:50:32 | 00,036,730 | —- | M] () – C:\Documents and Settings\HLacey\Desktop\compeatXla.zip
[2009/03/14 19:49:14 | 00,024,064 | —- | M] () – C:\Documents and Settings\HLacey\Desktop\Food To get Rid of.doc
[2009/03/10 21:05:17 | 00,331,512 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2009/03/10 19:51:40 | 00,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK

========== LOP Check ==========

[2009/04/05 09:45:23 | 00,000,000 | RH-D | M] – C:\Documents and Settings\All Users\Application Data
[2008/02/12 18:34:28 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Adobe
[2007/08/12 19:43:06 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Apple
[2007/06/12 18:32:06 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Apple Computer
[2009/01/05 19:41:48 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Google
[2009/04/03 18:58:35 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Google Updater
[2007/08/18 19:23:00 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Grisoft
[2008/01/11 22:17:13 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\InstallShield
[2007/08/21 08:33:23 | 00,000,000 | –SD | M] – C:\Documents and Settings\All Users\Application Data\Microsoft
[2008/04/23 17:40:51 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Nero
[2008/08/17 05:46:36 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Sonic
[2007/08/21 09:10:00 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
[2008/04/28 18:06:26 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2007/06/10 17:33:34 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
[1 C:\Documents and Settings\HLacey\Application Data\*.tmp files]
[2009/04/04 19:41:17 | 00,000,000 | RH-D | M] – C:\Documents and Settings\HLacey\Application Data
[2008/07/03 17:45:18 | 00,000,000 | —D | M] – C:\Documents and Settings\HLacey\Application Data\Adobe
[2007/06/12 18:32:21 | 00,000,000 | —D | M] – C:\Documents and Settings\HLacey\Application Data\Apple Computer
[2007/06/11 05:14:20 | 00,000,000 | —D | M] – C:\Documents and Settings\HLacey\Application Data\ATI
[2007/09/07 16:53:40 | 00,000,000 | —D | M] – C:\Documents and Settings\HLacey\Application Data\DivX
[2008/04/24 08:12:43 | 00,000,000 | —D | M] – C:\Documents and Settings\HLacey\Application Data\dvdcss
[2007/06/11 05:34:28 | 00,000,000 | —D | M] – C:\Documents and Settings\HLacey\Application Data\Google
[2007/06/10 16:14:44 | 00,000,000 | —D | M] – C:\Documents and Settings\HLacey\Application Data\Identities
[2008/03/07 13:45:09 | 00,000,000 | —D | M] – C:\Documents and Settings\HLacey\Application Data\InstallShield
[2008/01/11 22:53:37 | 00,000,000 | —D | M] – C:\Documents and Settings\HLacey\Application Data\InterVideo
[2007/06/11 16:52:04 | 00,000,000 | —D | M] – C:\Documents and Settings\HLacey\Application Data\Macromedia
[2008/11/02 21:37:10 | 00,000,000 | –SD | M] – C:\Documents and Settings\HLacey\Application Data\Microsoft
[2008/03/07 14:17:04 | 00,000,000 | —D | M] – C:\Documents and Settings\HLacey\Application Data\My Games
[2008/04/23 17:44:04 | 00,000,000 | —D | M] – C:\Documents and Settings\HLacey\Application Data\Nero
[2007/08/18 12:23:00 | 00,000,000 | —D | M] – C:\Documents and Settings\HLacey\Application Data\Sun
[2007/08/21 09:09:52 | 00,000,000 | —D | M] – C:\Documents and Settings\HLacey\Application Data\SUPERAntiSpyware.com
[2008/12/05 11:46:04 | 00,000,000 | —D | M] – C:\Documents and Settings\HLacey\Application Data\U3
[2007/10/31 19:56:21 | 00,000,000 | —D | M] – C:\Documents and Settings\HLacey\Application Data\V-Planner
[2008/09/11 21:32:29 | 00,000,000 | —D | M] – C:\Documents and Settings\HLacey\Application Data\WinRAR
[2008/05/05 23:54:00 | 00,000,284 | —- | M] () – C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
[2003/03/31 06:00:00 | 00,000,065 | RH– | M] () – C:\WINDOWS\Tasks\desktop.ini
[2009/04/05 08:18:47 | 00,000,868 | —- | M] () – C:\WINDOWS\Tasks\Google Software Updater.job
[2009/04/05 08:18:36 | 00,000,006 | -H– | M] () – C:\WINDOWS\Tasks\SA.DAT

========== Purity Check ==========

========== Alternate Data Streams ==========

@Alternate Data Stream - 131 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:8E3D07DE
< End of report >

CatByte

Post #5April 5, 2009, 4:52 PM UTC

Hi,

Please do the following:

Run OTList2.exe

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTLI2 (start with the colon in front of :OTLI - do not copy the word "code")

:OTLI
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
[2009/04/04 19:39:33 | 00,024,064 | -HS- | C] ( ) – C:\WINDOWS\System32\autochk.dll
[2009/04/04 19:39:33 | 00,024,064 | -HS- | C] ( ) – C:\Documents and Settings\HLacey\Start Menu\Programs\Startup\ChkDisk.dll
[2009/04/04 19:39:33 | 00,000,651 | -HS- | C] () – C:\Documents and Settings\HLacey\Start Menu\Programs\Startup\ChkDisk.lnk

:Services

:Reg

:Files

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Then post a new OTL2 log ( don't check the boxes beside LOP Check or Purity this time )

NEXT:

Please download ATF Cleaner by Atribune.

Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
- If you use Firefox browser
- Click Firefox at the top and choose: Select All
Click the Empty Selected button.

NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
It's normal after running ATF cleaner that the PC will be slower to boot the first time.

NEXT

Please download Malwarebytes' Anti-Malware

Double Click mbam-setup.exe to install the application.
Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish, so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected. <– very important
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.

NEXT

Go to Kaspersky website and perform an online antivirus scan.

Read through the requirements and privacy statement and click on Accept button.
It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
When the downloads have finished, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
- Spyware, Adware, Dialers, and other potentially dangerous programs
  Archives
  Mail databases
Click on My Computer under Scan.
Once the scan is complete, it will display the results. Click on View Scan Report.
You will see a list of infected items there. Click on Save Report As….
Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button. Then post it here.

In your next reply I need

OTListIt log
MBAM Log
Kaspersky report
FreshHJT Log

coldsmoke

Post #6April 6, 2009, 2:20 AM UTC

========== OTLISTIT ========== Process explorer.exe killed successfully! DllUnregisterServer procedure not found in C:\WINDOWS\System32\autochk.dll C:\WINDOWS\System32\autochk.dll NOT unregistered. C:\WINDOWS\System32\autochk.dll moved successfully. DllUnregisterServer procedure not found in C:\Documents and Settings\HLacey\Start Menu\Programs\Startup\ChkDisk.dll C:\Documents and Settings\HLacey\Start Menu\Programs\Startup\ChkDisk.dll NOT unregistered. C:\Documents and Settings\HLacey\Start Menu\Programs\Startup\ChkDisk.dll moved successfully. C:\Documents and Settings\HLacey\Start Menu\Programs\Startup\ChkDisk.lnk moved successfully. ========== SERVICES/DRIVERS ========== ========== REGISTRY ========== ========== FILES ========== ========== COMMANDS ========== User's Temp folder emptied. User's Internet Explorer cache folder emptied. File delete failed. C:\Documents and Settings\HLacey\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. User's Temporary Internet Files folder emptied. Local Service Temp folder emptied. File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. Local Service Temporary Internet Files folder emptied. Network Service Temp folder emptied. File delete failed. C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. Network Service Temporary Internet Files folder emptied. Windows Temp folder emptied. Java cache emptied. Temp folders emptied. Explorer started successfully OTListIt2 by OldTimer - Version 2.0.11.0 log created on 04052009_200311 Files moved on Reboot… Registry entries deleted on Reboot…

coldsmoke

Post #7April 6, 2009, 2:48 AM UTC

Ran ATF Cleaner. Tried to run MalwareBytes but it doesn't do anything. Hourglass comes up then just ends. I don't know if this matters but I have to use TaskManager to kill several processes before I can even get a IE to work. Anyway, I am going to run the scan now. Will post results later. Thanks for the great help.

CatByte

Post #8April 6, 2009, 9:15 AM UTC

Hi,

It's a little concerning that MalwareBytes won't run on your computer, which means you have malware which is blocking it, so we will need to look further.

Please do the following:

Download ComboFix from one of these locations:
Link 1
Link 2
Link 3

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

Double click on ComboFix.exe & follow the prompts.

As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
4. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please advise.
5. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now

coldsmoke

Post #9April 6, 2009, 1:09 PM UTC

Last night I tried to run the Kaperskys scan but couldn't because many of the link/buttons were disabled on the page. I was not able to click accept. Tried ComboFix, but it won't run either. It appears in the taskmanager but won't complete. I have tried booting into safe mode for malwarebytes but that didn't work either. I haven't tired that for combofix, but I suspect that it won't work either. Please advise. Thanks.

CatByte

Post #10April 6, 2009, 1:13 PM UTC

Try running ComboFix from safe mode Thanks

coldsmoke

Post #11April 6, 2009, 1:51 PM UTC

Nope - won't run in Safe Mode either.

After trying, when I would boot normally, pc would lock up. I got it working again by running ATF cleaner - not sure if that really was the fix, but twice the system locked so I booted into safe mode again and ran ATF cleaner. When I booted back normally, things worked fine. PC seems to be running fine, except SuperAnti Spyware is killed when it tries to start. I also can't open IE without killing every process that I can. I have tried to narrow it down as to which process it might be, but there's lots of them and if I don't get the right ones, when I try to open IE, Windows locks. Makes for a painful diagnosis since I have to restart each time. Please advise.

CatByte

Post #12April 6, 2009, 2:16 PM UTC last edited April 6, 2009, 2:41 PM UTC

Delete the copy of combo fix you have now and do the following

Try and run this fresh copy from safe mode also.

Download Combofix from any of the links below. You must rename it before saving it. Save it to your desktop.

Link 1
Link 2
Link 3

[external image: Posted Image]

[external image: Posted Image]
——————————————————————–

Double click on Combo-Fix.exe & follow the prompts.

When finished, it will produce a report for you.
Please post the C:\ComboFix.txt along with a HijackThis log so we can continue cleaning the system.

coldsmoke

Post #13April 6, 2009, 2:40 PM UTC

ComboFix 09-04-04.01 - HLacey 2009-04-06 8:29:01.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2046.1704 [GMT -6:00]
Running from: c:\documents and settings\[removed]\Desktop\Combo-Fix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\documents and settings\HLacey\protect.dll
c:\documents and settings\HLacey\Start Menu\Programs\Startup\ChkDisk.dll
c:\documents and settings\HLacey\Start Menu\Programs\Startup\ChkDisk.lnk
c:\windows\Downloaded Program Files\LiveView
c:\windows\Downloaded Program Files\LiveView\disable.jpg
c:\windows\Downloaded Program Files\LiveView\down.jpg
c:\windows\Downloaded Program Files\LiveView\Logo.tif
c:\windows\Downloaded Program Files\LiveView\mask.jpg
c:\windows\Downloaded Program Files\LiveView\normal.jpg
c:\windows\Downloaded Program Files\LiveView\over.jpg
c:\windows\Downloaded Program Files\LiveView\skin.ini
c:\windows\system32\autochk.dll
c:\windows\system32\Cache
c:\windows\system32\drivers\UAClkmotfuw.sys
c:\windows\system32\dumphive.exe
c:\windows\system32\Process.exe
c:\windows\system32\SrchSTS.exe
c:\windows\system32\tmp.reg
c:\windows\system32\UACaxdnbevq.log
c:\windows\system32\UACbiqjxtev.dll
c:\windows\system32\UACdlvnmwvj.dat
c:\windows\system32\uacinit.dll
c:\windows\system32\UACkfprrwos.dll
c:\windows\system32\UACoulweoes.log
c:\windows\system32\UACsrkuwqoe.dll
c:\windows\system32\UACsyqcwasm.dll
c:\windows\system32\UACvkkymrfl.log
c:\windows\system32\UACxtabpqxx.dll

—– BITS: Possible infected sites —–

hxxp://tubeloyaln.com
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Service_UACd.sys

((((((((((((((((((((((((( Files Created from 2009-03-06 to 2009-04-06 )))))))))))))))))))))))))))))))
.

2009-04-05 20:56 . 2009-04-05 20:56 d——– c:\program files\Malwarebytes' Anti-Malware
2009-04-05 20:56 . 2009-04-05 20:56 d——– c:\documents and settings\All Users\Application Data\Malwarebytes
2009-04-05 20:56 . 2009-03-26 16:49 38,496 –a—— c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-05 20:56 . 2009-03-26 16:49 15,504 –a—— c:\windows\system32\drivers\mbam.sys
2009-04-05 20:03 . 2009-04-05 20:03 d——– C:\_OTListIt
2009-03-13 17:47 . 2003-08-12 17:18 376,832 –a—— c:\windows\system32\MLUU_CML.dll
2009-03-13 17:47 . 2005-05-31 11:50 80,384 –a—— c:\windows\system32\MLUU_MON.dll
2009-03-13 17:47 . 2004-07-20 17:22 26,624 –a—— c:\windows\system32\MLUU_UNP.EXE
2009-03-13 17:47 . 2005-01-03 12:22 5,858 –a—— c:\windows\MLUU__WM.ini
2009-03-13 17:47 . 2005-03-23 15:03 844 –a—— c:\windows\MLUU_UNP.unf
2009-03-13 17:47 . 2005-03-15 11:39 165 –a—— c:\windows\MLUU_UNI.ini

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-04 00:58 ——— d—–w c:\documents and settings\All Users\Application Data\Google Updater
2009-02-09 10:19 1,846,272 —-a-w c:\windows\system32\win32k.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-11 68856]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-03-04 1481968]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2008-02-28 1828136]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-08 761947]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2006-11-01 1392640]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 45056]
"Dell QuickSet"="c:\program files\Dell\QuickSet\quickset.exe" [2006-08-03 1032192]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2007-06-01 257088]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-06-29 286720]
"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2006-03-20 86960]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"NeroFilterCheck"="c:\program files\Common Files\Nero\Lib\NeroCheck.exe" [2008-02-28 570664]
"NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-02-18 2221352]
"DMXLauncher"="c:\program files\Dell\Media Experience\DMXLauncher.exe" [2005-10-05 94208]
"SigmatelSysTrayApp"="stsystra.exe" [2006-03-24 c:\windows\stsystra.exe]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-06-20 113664]
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-05-24 622653]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoWelcomeScreen"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2006-12-20 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2007-04-19 13:41 294912 c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"="1"
"UpdatesDisableNotify"="1"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Civilization4.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2006-10-10 5632]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2007-02-27 51440]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2006-02-16 4096]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
\Shell\AutoRun\command - E:\LaunchU3.exe
.
Contents of the 'Scheduled Tasks' folder

2008-05-06 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-06-03 13:42]

2009-04-06 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-03-25 18:12]
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-ISUSPM Startup - c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe
HKLM-Run-ISUSPM - c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe
HKLM-Run-autochk - c:\windows\system32\autochk.dll

.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.divematrix.com/
mStart Page = about:blank
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Send to &Bluetooth Device… - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
Trusted Zone: customdining.com\www
DPF: {7451D317-862C-45DA-8C28-1B21ADF95877} - hxxp://209.181.6.25/WebViewS.cab
.

**************************************************************************

catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-06 08:32:48
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(860)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2009-04-06 8:34:05
ComboFix-quarantined-files.txt 2009-04-06 14:33:59
ComboFix2.txt 2007-08-21 16:55:00

Pre-Run: 47,400,218,624 bytes free
Post-Run: 47,387,262,976 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

161 — E O F — 2009-03-11 01:52:20

coldsmoke

Post #14April 6, 2009, 2:44 PM UTC

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:40:04 AM, on 4/6/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\imapi.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.divematrix.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Bluetooth.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send to &Bluetooth Device… - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://www.customdining.com
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1…toUploader5.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1181517816319
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1181564070625
O16 - DPF: {7451D317-862C-45DA-8C28-1B21ADF95877} (Hybrid WebView) - http://209.181.6.25/WebViewS.cab
O16 - DPF: {BCBC9371-595D-11D4-A96D-00105A1CEF6C} (View22RTE Class) - http://onlinedesigner.hgtv.com/images/app/view22rte.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/get/shock…ash/swflash.cab
O16 - DPF: {D6E7CFB5-C074-4D1C-B647-663D1A8D96BF} (Facebook Photo Uploader 4) - http://upload.facebook.com/controls/Facebo…Uploader4_5.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = BigSkyBeverage.local
O17 - HKLM\Software\..\Telephony: DomainName = BigSkyBeverage.local
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = BigSkyBeverage.local
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = BigSkyBeverage.local
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = BigSkyBeverage.local
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

–
End of file - 9213 bytes

coldsmoke

Post #15April 6, 2009, 4:03 PM UTC

Malwarebytes' Anti-Malware 1.35 Database version: 1945 Windows 5.1.2600 Service Pack 2 4/6/2009 9:56:36 AM mbam-log-2009-04-06 (09-56-31).txt Scan type: Full Scan (C:\|) Objects scanned: 138577 Time elapsed: 35 minute(s), 34 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 6 Registry Values Infected: 0 Registry Data Items Infected: 2 Folders Infected: 0 Files Infected: 11 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CLASSES_ROOT\ieocxapp.ieocx.1 (Trojan.Agent) -> No action taken. HKEY_CLASSES_ROOT\Interface\{abcdecef-4b15-11d1-abed-709549c10000} (Trojan.FakeAlert) -> No action taken. HKEY_CLASSES_ROOT\Typelib\{abcdece2-4b15-11d1-abed-709549c10000} (Trojan.FakeAlert) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{df780f87-ff2b-4df8-92d0-73db16a1543a} (Adware.PopCap) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{abcdecf0-4b15-11d1-abed-709549c10000} (Trojan.FakeAlert) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{06ec6572-7280-485a-a712-c380526bc048} (Trojan.Agent) -> No action taken. Registry Values Infected: (No malicious items detected) Registry Data Items Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken. Folders Infected: (No malicious items detected) Files Infected: C:\Program Files\Trend Micro\HijackThis\backups\backup-20090405-094522-760.dll (Adware.PopCap) -> No action taken. C:\QooBox\Quarantine\C\WINDOWS\system32\UACbiqjxtev.dll.vir (Trojan.TDSS) -> No action taken. C:\QooBox\Quarantine\C\WINDOWS\system32\UACkfprrwos.dll.vir (Trojan.TDSS) -> No action taken. C:\QooBox\Quarantine\C\WINDOWS\system32\UACsrkuwqoe.dll.vir (Trojan.TDSS) -> No action taken. C:\QooBox\Quarantine\C\WINDOWS\system32\UACxtabpqxx.dll.vir (Trojan.TDSS) -> No action taken. C:\QooBox\Quarantine\C\WINDOWS\system32\drivers\UAClkmotfuw.sys.vir (Trojan.TDSS) -> No action taken. C:\System Volume Information\_restore{52AA0CF5-4D5F-4371-89B6-9D880724294C}\RP474\A0048335.dll (Trojan.TDSS) -> No action taken. C:\System Volume Information\_restore{52AA0CF5-4D5F-4371-89B6-9D880724294C}\RP474\A0048336.dll (Trojan.TDSS) -> No action taken. C:\System Volume Information\_restore{52AA0CF5-4D5F-4371-89B6-9D880724294C}\RP474\A0048337.dll (Trojan.TDSS) -> No action taken. C:\System Volume Information\_restore{52AA0CF5-4D5F-4371-89B6-9D880724294C}\RP474\A0048338.dll (Trojan.TDSS) -> No action taken. C:\System Volume Information\_restore{52AA0CF5-4D5F-4371-89B6-9D880724294C}\RP474\A0048334.sys (Trojan.TDSS) -> No action taken.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Closed] WinPC Defender - I think

✨ Ask AI

Ask AI