What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] PC hitting hard drive and mem heavily without launched prog

13 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
CatByte, Below is the resulting log. How do we look? Thanks, kjstroubledpc All processes killed ========== OTL ========== Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ not found. Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}\ not found. Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7}\ not found. Starting removal of ActiveX control {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} C:\Program Files\WebEx\ieatgpc.inf moved successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E06E2E99-0AA1-11D4-ABA6-0060082AA75C}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E06E2E99-0AA1-11D4-ABA6-0060082AA75C}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E06E2E99-0AA1-11D4-ABA6-0060082AA75C}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E06E2E99-0AA1-11D4-ABA6-0060082AA75C}\ not found. Service AVP stopped successfully! Service AVP deleted successfully! File File not found not found. ========== REGISTRY ========== Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List\\C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe not found. ========== COMMANDS ========== [EMPTYTEMP] User: Administrator ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: All Users User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: Kurt ->Temp folder emptied: 96644169 bytes ->Temporary Internet Files folder emptied: 13610529 bytes ->Java cache emptied: 13724475 bytes User: LocalService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: Owner %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 696832 bytes %systemroot%\System32 .tmp files removed: 0 bytes Windows Temp folder emptied: 1066388 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 10453866 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 47630 bytes RecycleBin emptied: 1820321790 bytes Total Files Cleaned = 1866.02 mb OTL by OldTimer - Version 3.1.17.0 log created on 12132009_174408 Files\Folders moved on Reboot… File\Folder C:\WINDOWS\temp\Perflib_Perfdata_a4.dat not found! Registry entries deleted on Reboot…
Post #18
CatByte,

1) The computer is running faster now. I still see it hitting hard drive when I am not doing anything, but it is doing it much less and CPU and Mem usage much better.
2) Below is the logfile from the new OTL.

Does it look like we are good?

Thanks,

kjstroubledpc

OTL logfile created on: 12/13/2009 6:37:34 PM - Run 3
OTL by OldTimer - Version 3.1.17.0 Folder = C:\Documents and Settings\Kurt\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1023.23 Mb Total Physical Memory | 509.35 Mb Available Physical Memory | 49.78% Memory free
1.65 Gb Paging File | 1.21 Gb Available in Paging File | 73.34% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 55.83 Gb Total Space | 9.37 Gb Free Space | 16.78% Space Free | Partition Type: NTFS
Unable to calculate disk information.
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: KURTS
Current User Name: Kurt
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Kurt\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgrsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgnsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
PRC - C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)
PRC - C:\Program Files\QuickTime\QTTask.exe (Apple Inc.)
PRC - C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe (Cisco Systems, Inc.)
PRC - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe (Cisco Systems, Inc.)
PRC - C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.)
PRC - C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe ()
PRC - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe (Intel Corporation)
PRC - C:\Program Files\Intel\Wireless\Bin\ZCfgSvc.exe (Intel Corporation)
PRC - C:\Program Files\Intel\Wireless\Bin\WLKEEPER.exe (Intel® Corporation)
PRC - C:\Program Files\Intel\Wireless\Bin\iFrmewrk.exe (Intel Corporation)
PRC - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe (Intel Corporation )
PRC - C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe (Intel Corporation)
PRC - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe (Intel Corporation)
PRC - C:\Program Files\FinePixViewer\QuickDCF2.exe (FUJIFILM Corporation)
PRC - C:\WINDOWS\SYSTEM32\HPZipm12.exe (HP)
PRC - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe (Symantec Corporation)
PRC - C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe ()
PRC - C:\Program Files\Adobe\Photoshop Elements 4.0\apdproxy.exe (Adobe Systems Incorporated)
PRC - C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe (ATI Technologies, Inc.)
PRC - C:\WINDOWS\SYSTEM32\ati2evxx.exe (ATI Technologies Inc.)
PRC - C:\WINDOWS\SYSTEM32\dla\tfswctrl.exe (Sonic Solutions)
PRC - C:\Program Files\Apoint\Apoint.exe (Alps Electric Co., Ltd.)
PRC - C:\WINDOWS\BCMSMMSG.exe (Broadcom Corporation)
PRC - C:\WINDOWS\SYSTEM32\DSentry.exe (Dell - Advanced Desktop Engineering)
PRC - C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe (Microsoft Corporation)
PRC - C:\Program Files\Apoint\ApntEx.exe (Alps Electric Co., Ltd.)
PRC - C:\WINDOWS\SYSTEM32\CTSVCCDA.EXE (Creative Technology Ltd)


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Kurt\Desktop\OTL.exe (OldTimer Tools)


========== Win32 Services (SafeList) ==========

SRV - (avg9wd) – C:\Program Files\AVG\AVG9\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (iPod Service) – C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)
SRV - (JavaQuickStarterService) – C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)
SRV - (Apple Mobile Device) – C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (nmservice) – C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe (Cisco Systems, Inc.)
SRV - (Bonjour Service) – C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.)
SRV - (EvtEng) Intel® – C:\Program Files\Intel\Wireless\Bin\EvtEng.exe (Intel Corporation)
SRV - (WLANKEEPER) Intel® – C:\Program Files\Intel\Wireless\Bin\WLKEEPER.exe (Intel® Corporation)
SRV - (S24EventMonitor) Intel® – C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe (Intel Corporation )
SRV - (RegSrvc) Intel® – C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe (Intel Corporation)
SRV - (Pml Driver HPZ12) – C:\WINDOWS\SYSTEM32\HPZipm12.exe (HP)
SRV - (LiveUpdate) – C:\Program Files\Symantec\LiveUpdate\LuComServer_3_0.EXE (Symantec Corporation)
SRV - (Automatic LiveUpdate Scheduler) – C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (Symantec Corporation)
SRV - (AdobeActiveFileMonitor4.0) – C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe ()
SRV - (Ati HotKey Poller) – C:\WINDOWS\SYSTEM32\ati2evxx.exe (ATI Technologies Inc.)
SRV - (HP Port Resolver) – C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\HPBPRO.EXE (Hewlett-Packard Company)
SRV - (SymWSC) – C:\Program Files\Common Files\Symantec Shared\Security Center\symwsc.exe (Symantec Corporation)
SRV - (ose) – C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (MSSQL$MICROSOFTBCM) – C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe (Microsoft Corporation)
SRV - (SQLAgent$MICROSOFTBCM) – C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlagent.EXE (Microsoft Corporation)
SRV - (Creative Service for CDROM Access) – C:\WINDOWS\SYSTEM32\CTSVCCDA.EXE (Creative Technology Ltd)


========== Driver Services (SafeList) ==========

DRV - (AvgTdiX) – C:\WINDOWS\System32\Drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (AvgLdx86) – C:\WINDOWS\System32\Drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AvgMfx86) – C:\WINDOWS\System32\Drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (USBAAPL) – C:\WINDOWS\SYSTEM32\DRIVERS\usbaapl.sys (Apple, Inc.)
DRV - (GEARAspiWDM) – C:\WINDOWS\SYSTEM32\DRIVERS\GEARAspiWDM.sys (GEAR Software Inc.)
DRV - (purendis) – C:\WINDOWS\SYSTEM32\DRIVERS\purendis.sys (Cisco Systems, Inc.)
DRV - (pnarp) – C:\WINDOWS\SYSTEM32\DRIVERS\pnarp.sys (Cisco Systems, Inc.)
DRV - (amdagp) – C:\WINDOWS\System32\DRIVERS\amdagp.sys (Advanced Micro Devices, Inc.)
DRV - (sisagp) – C:\WINDOWS\System32\DRIVERS\sisagp.sys (Silicon Integrated Systems Corporation)
DRV - (Secdrv) – C:\WINDOWS\SYSTEM32\DRIVERS\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
DRV - (AegisP) AEGIS Protocol (IEEE 802.1x) – C:\WINDOWS\SYSTEM32\DRIVERS\AegisP.sys (Meetinghouse Data Communications)
DRV - (s24trans) – C:\WINDOWS\SYSTEM32\DRIVERS\s24trans.sys (Intel Corporation)
DRV - (w29n51) Intel® – C:\WINDOWS\SYSTEM32\DRIVERS\w29n51.sys (Intel® Corporation)
DRV - (PxHelp20) – C:\WINDOWS\System32\Drivers\PxHelp20.sys (Sonic Solutions)
DRV - (ati2mtag) – C:\WINDOWS\SYSTEM32\DRIVERS\ati2mtag.sys (ATI Technologies Inc.)
DRV - (drvmcdb) – C:\WINDOWS\system32\drivers\drvmcdb.sys (Sonic Solutions)
DRV - (drvnddm) – C:\WINDOWS\SYSTEM32\DRIVERS\drvnddm.sys (Sonic Solutions)
DRV - (tfsnudfa) – C:\WINDOWS\SYSTEM32\dla\tfsnudfa.sys (Sonic Solutions)
DRV - (tfsnudf) – C:\WINDOWS\SYSTEM32\dla\tfsnudf.sys (Sonic Solutions)
DRV - (tfsnifs) – C:\WINDOWS\SYSTEM32\dla\tfsnifs.sys (Sonic Solutions)
DRV - (tfsncofs) – C:\WINDOWS\SYSTEM32\dla\tfsncofs.sys (Sonic Solutions)
DRV - (tfsnboio) – C:\WINDOWS\SYSTEM32\dla\tfsnboio.sys (Sonic Solutions)
DRV - (tfsnopio) – C:\WINDOWS\SYSTEM32\dla\tfsnopio.sys (Sonic Solutions)
DRV - (tfsnpool) – C:\WINDOWS\SYSTEM32\dla\tfsnpool.sys (Sonic Solutions)
DRV - (tfsndrct) – C:\WINDOWS\SYSTEM32\dla\tfsndrct.sys (Sonic Solutions)
DRV - (tfsndres) – C:\WINDOWS\SYSTEM32\dla\tfsndres.sys (Sonic Solutions)
DRV - (StMp3Rec) – C:\WINDOWS\SYSTEM32\DRIVERS\StMp3Rec.sys (Microsoft Corporation)
DRV - (nv) – C:\WINDOWS\SYSTEM32\DRIVERS\nv4_mini.sys (NVIDIA Corporation)
DRV - (iAimFP4) – C:\WINDOWS\SYSTEM32\DRIVERS\wvchntxx.sys (Intel® Corporation)
DRV - (iAimFP3) – C:\WINDOWS\SYSTEM32\DRIVERS\wsiintxx.sys (Intel® Corporation)
DRV - (iAimTV4) – C:\WINDOWS\SYSTEM32\DRIVERS\wch7xxnt.sys (Intel® Corporation)
DRV - (iAimTV3) – C:\WINDOWS\SYSTEM32\DRIVERS\watv04nt.sys (Intel® Corporation)
DRV - (iAimTV1) – C:\WINDOWS\SYSTEM32\DRIVERS\watv02nt.sys (Intel® Corporation)
DRV - (iAimTV0) – C:\WINDOWS\SYSTEM32\DRIVERS\watv01nt.sys (Intel® Corporation)
DRV - (iAimFP0) – C:\WINDOWS\SYSTEM32\DRIVERS\wadv01nt.sys (Intel® Corporation)
DRV - (iAimFP1) – C:\WINDOWS\SYSTEM32\DRIVERS\wadv02nt.sys (Intel® Corporation)
DRV - (iAimFP2) – C:\WINDOWS\SYSTEM32\DRIVERS\wadv05nt.sys (Intel® Corporation)
DRV - (i81x) – C:\WINDOWS\SYSTEM32\DRIVERS\i81xnt5.sys (Intel® Corporation)
DRV - (sscdbhk5) – C:\WINDOWS\SYSTEM32\DRIVERS\sscdbhk5.sys (Sonic Solutions)
DRV - (ssrtln) – C:\WINDOWS\SYSTEM32\DRIVERS\ssrtln.sys (Sonic Solutions)
DRV - (omci) – C:\WINDOWS\SYSTEM32\DRIVERS\omci.sys (Dell Inc)
DRV - (STAC97) Audio Driver (WDM) – C:\WINDOWS\SYSTEM32\DRIVERS\stac97.sys (SigmaTel, Inc.)
DRV - (w22n51) Intel® – C:\WINDOWS\SYSTEM32\DRIVERS\w22n51.sys (Intel® Corporation)
DRV - (BCMModem) – C:\WINDOWS\SYSTEM32\DRIVERS\BCMSM.sys (Broadcom Corporation)
DRV - (ApfiltrService) – C:\WINDOWS\SYSTEM32\DRIVERS\Apfiltr.sys (Alps Electric Co., Ltd.)
DRV - (Ser2pl) – C:\WINDOWS\SYSTEM32\DRIVERS\ser2pl.sys (Prolific Technology Inc.)
DRV - (bcm4sbxp) – C:\WINDOWS\SYSTEM32\DRIVERS\bcm4sbxp.sys (Broadcom Corporation)
DRV - (gv3) – C:\WINDOWS\SYSTEM32\DRIVERS\gv3.sys (Microsoft Corporation)
DRV - (pfc) – C:\WINDOWS\SYSTEM32\DRIVERS\pfc.sys (Padus, Inc.)
DRV - (Ptilink) – C:\WINDOWS\SYSTEM32\DRIVERS\PTILINK.SYS (Parallel Technologies, Inc.)
DRV - (StillCam) – C:\WINDOWS\SYSTEM32\DRIVERS\serscan.sys (Microsoft Corporation)
DRV - (Sparrow) – C:\WINDOWS\System32\DRIVERS\sparrow.sys (Adaptec, Inc.)
DRV - (sym_u3) – C:\WINDOWS\System32\DRIVERS\sym_u3.sys (LSI Logic)
DRV - (sym_hi) – C:\WINDOWS\System32\DRIVERS\sym_hi.sys (LSI Logic)
DRV - (symc8xx) – C:\WINDOWS\System32\DRIVERS\symc8xx.sys (LSI Logic)
DRV - (symc810) – C:\WINDOWS\System32\DRIVERS\symc810.sys (Symbios Logic Inc.)
DRV - (ultra) – C:\WINDOWS\System32\DRIVERS\ultra.sys (Promise Technology, Inc.)
DRV - (ql12160) – C:\WINDOWS\System32\DRIVERS\ql12160.sys (QLogic Corporation)
DRV - (ql1080) – C:\WINDOWS\System32\DRIVERS\ql1080.sys (QLogic Corporation)
DRV - (ql1280) – C:\WINDOWS\System32\DRIVERS\ql1280.sys (QLogic Corporation)
DRV - (dac2w2k) – C:\WINDOWS\System32\DRIVERS\dac2w2k.sys (Mylex Corporation)
DRV - (mraid35x) – C:\WINDOWS\System32\DRIVERS\mraid35x.sys (American Megatrends Inc.)
DRV - (asc) – C:\WINDOWS\System32\DRIVERS\asc.sys (Advanced System Products, Inc.)
DRV - (asc3550) – C:\WINDOWS\System32\DRIVERS\asc3550.sys (Advanced System Products, Inc.)
DRV - (AliIde) – C:\WINDOWS\System32\DRIVERS\aliide.sys (Acer Laboratories Inc.)
DRV - (CmdIde) – C:\WINDOWS\System32\DRIVERS\cmdide.sys (CMD Technology, Inc.)
DRV - (EL90XBC) – C:\WINDOWS\SYSTEM32\DRIVERS\EL90XBC5.SYS (3Com Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local



O1 HOSTS File: (789 bytes) - C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: HP7982E9 HP0017A47982E9
O1 - Hosts: 192.168.1.100 HP0018715667E0
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (DriveLetterAccess) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\SYSTEM32\dla\tfswshx.dll (Sonic Solutions)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [Adobe Photo Downloader] C:\Program Files\Adobe\Photoshop Elements 4.0\apdproxy.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe (Apple Inc.)
O4 - HKLM..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe (ATI Technologies, Inc.)
O4 - HKLM..\Run: [AVG9_TRAY] C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [BCMSMMSG] C:\WINDOWS\BCMSMMSG.exe (Broadcom Corporation)
O4 - HKLM..\Run: [dla] C:\WINDOWS\SYSTEM32\dla\tfswctrl.exe (Sonic Solutions)
O4 - HKLM..\Run: [DVDSentry] C:\WINDOWS\SYSTEM32\DSentry.exe (Dell - Advanced Desktop Engineering)
O4 - HKLM..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe (Intel Corporation)
O4 - HKLM..\Run: [IntelZeroConfig] C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe (Intel Corporation)
O4 - HKLM..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
O4 - HKLM..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe (Microsoft Corporation)
O4 - HKLM..\Run: [nmctxth] C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe (Cisco Systems, Inc.)
O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\QTTask.exe (Apple Inc.)
O4 - HKLM..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE (FUJI PHOTO FILM CO., LTD.)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [UpdateManager] C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe (Sonic Solutions)
O4 - HKCU..\Run: [CTSyncU.exe] C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe ()
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ExifLauncher2.lnk = C:\Program Files\FinePixViewer\QuickDCF2.exe (FUJIFILM Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 157
O9 - Extra Button: EmpirePoker - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - c:\program files\EmpirePokerMaster\EmpirePoker\RunEPoker.exe File not found
O9 - Extra 'Tools' menuitem : EmpirePoker - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - c:\program files\EmpirePokerMaster\EmpirePoker\RunEPoker.exe File not found
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKCU\..Trusted Domains: 80 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/5/b…heckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} http://housecall65.trendmicro.com/housecal…ivex/hcImpl.cab (Trend Micro ActiveX Scan Agent 6.6)
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} http://www2.snapfish.com/SnapfishActivia.cab (Snapfish Activia)
O16 - DPF: {44990200-3C9D-426D-81DF-AAB636FA4345} http://www.symantec.com/techsupp/asa/ctrl/tgctlsi.cab (Reg Error: Key error.)
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} http://download.mcafee.com/molbin/shared/m…01/mcinsctl.cab (Reg Error: Key error.)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdat…b?1150580722040 (MUWebControl Class)
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab (WScanCtl Class)
O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} http://zone.msn.com/bingame/chnz/default/mjolauncher.cab (MJLauncherCtrl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} http://activex.webcam.nl/AxisCamControl.cab (Reg Error: Key error.)
O16 - DPF: {AED98630-0251-4E83-917D-43A23D66D507} http://activex.microgaming.com/DLhelper/ve…n7/dlhelper.cab (Reg Error: Key error.)
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} http://cdn2.zone.msn.com/binFramework/v10/…ro.cab56649.cab (MSN Games - Installer)
O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwa…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} https://register3.valueactive.com/mpp_398/w…OCX/FlashAX.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\pure-go {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files\Common Files\Pure Networks Shared\Platform\puresp4.dll (Cisco Systems, Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O20 - Winlogon\Notify\avgrsstarter: DllName - avgrsstx.dll - C:\WINDOWS\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2002/09/03 05:59:58 | 00,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - comfile [open] – "%1" %*
O35 - exefile [open] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2009/12/13 17:44:08 | 00,000,000 | —D | C] – C:\_OTL
[2009/12/13 17:00:36 | 00,000,000 | —D | C] – C:\Program Files\VS Revo Group
[2009/12/13 14:47:41 | 00,538,112 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Kurt\Desktop\OTL.exe
[2009/12/13 12:55:15 | 00,000,000 | —D | C] – C:\Documents and Settings\Kurt\Desktop\kavremover10
[2009/12/13 11:07:25 | 00,000,000 | —D | C] – C:\Documents and Settings\Kurt\Desktop\Sec-Info
[2009/12/09 19:27:01 | 00,472,064 | —- | C] ( ) – C:\Documents and Settings\Kurt\Desktop\RootRepeal.exe
[2009/12/09 15:49:11 | 00,000,000 | —D | C] – C:\WINDOWS\ERDNT
[2009/12/09 15:48:29 | 00,000,000 | —D | C] – C:\Program Files\ERUNT
[2009/12/09 15:47:14 | 00,791,393 | —- | C] (Lars Hederer ) – C:\Documents and Settings\Kurt\Desktop\erunt_setup.exe
[2009/12/09 12:14:49 | 00,000,000 | —D | C] – C:\Program Files\iPod
[2009/12/09 12:14:35 | 00,000,000 | —D | C] – C:\Program Files\iTunes
[2009/12/09 12:01:20 | 00,000,000 | -HSD | C] – C:\Config.Msi
[2009/11/23 11:59:22 | 00,000,000 | —D | C] – C:\Documents and Settings\Kurt\Local Settings\Application Data\Eraser
[2009/11/22 10:02:20 | 00,000,000 | -H-D | C] – C:\$AVG
[2009/11/22 10:01:59 | 00,012,464 | —- | C] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\avgrsstx.dll
[2009/11/22 10:01:58 | 00,360,584 | —- | C] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\drivers\avgtdix.sys
[2009/11/22 10:01:52 | 00,333,192 | —- | C] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\drivers\avgldx86.sys
[2009/11/22 10:01:48 | 00,028,424 | —- | C] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\drivers\avgmfx86.sys
[2009/11/22 10:01:33 | 00,000,000 | —D | C] – C:\WINDOWS\System32\drivers\Avg
[2009/11/22 10:00:58 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\avg9
[2009/11/22 09:58:22 | 00,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
[2009/11/22 09:58:22 | 00,000,000 | —D | M] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[2009/11/22 09:58:21 | 00,000,000 | –SD | M] – C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2009/11/22 09:58:21 | 00,000,000 | –SD | M] – C:\Documents and Settings\LocalService\Application Data\Microsoft
[2009/04/22 20:48:50 | 00,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\MediaMonkey
[2009/04/06 21:00:01 | 00,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Apple
[2007/08/08 14:48:41 | 00,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Application Data\Intel
[2007/08/08 14:48:41 | 00,000,000 | —D | M] – C:\Documents and Settings\LocalService\Application Data\Intel
[2006/02/19 02:28:56 | 00,012,288 | —- | C] (Hewlett-Packard Development Company, L.P.) – C:\WINDOWS\Fonts\RandFont.dll

========== Files - Modified Within 30 Days ==========

[2009/12/13 18:38:00 | 00,000,366 | —- | M] () – C:\WINDOWS\tasks\Symantec NetDetect.job
[2009/12/13 18:22:21 | 00,000,227 | —- | M] () – C:\WINDOWS\SYSTEM.INI
[2009/12/13 18:22:21 | 00,000,211 | RHS- | M] () – C:\BOOT.INI
[2009/12/13 18:22:21 | 00,000,112 | —- | M] () – C:\WINDOWS\WIN.INI
[2009/12/13 18:21:33 | 00,001,170 | —- | M] () – C:\WINDOWS\System32\WPA.DBL
[2009/12/13 18:20:23 | 00,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2009/12/13 18:20:17 | 00,002,048 | –S- | M] () – C:\WINDOWS\BOOTSTAT.DAT
[2009/12/13 18:20:14 | 10,730,00448 | -HS- | M] () – C:\hiberfil.sys
[2009/12/13 18:18:48 | 07,340,032 | —- | M] () – C:\Documents and Settings\Kurt\NTUSER.DAT
[2009/12/13 18:18:48 | 00,000,278 | -HS- | M] () – C:\Documents and Settings\Kurt\NTUSER.INI
[2009/12/13 17:50:56 | 46,593,199 | —- | M] () – C:\WINDOWS\System32\drivers\Avg\incavi.avm
[2009/12/13 17:50:35 | 00,123,791 | —- | M] () – C:\WINDOWS\System32\drivers\Avg\microavi.avg
[2009/12/13 17:00:36 | 00,000,917 | —- | M] () – C:\Documents and Settings\Kurt\Desktop\Revo Uninstaller.lnk
[2009/12/13 16:59:21 | 01,079,272 | —- | M] () – C:\Documents and Settings\Kurt\Desktop\revosetup.exe
[2009/12/13 14:47:44 | 00,538,112 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Kurt\Desktop\OTL.exe
[2009/12/13 12:54:07 | 00,559,330 | —- | M] () – C:\Documents and Settings\Kurt\Desktop\kavremover10.zip
[2009/12/13 11:06:14 | 00,000,699 | —- | M] () – C:\Documents and Settings\Kurt\Desktop\Sec-Info.zip
[2009/12/12 13:52:23 | 04,844,296 | —- | M] (Malwarebytes Corporation ) – C:\Documents and Settings\Kurt\Desktop\mbam-setup.exe
[2009/12/11 23:18:45 | 00,284,610 | —- | M] () – C:\Documents and Settings\Kurt\Desktop\gmer.zip
[2009/12/11 18:13:00 | 00,292,864 | —- | M] () – C:\Documents and Settings\Kurt\Desktop\gmer.exe
[2009/12/09 19:27:04 | 00,472,064 | —- | M] ( ) – C:\Documents and Settings\Kurt\Desktop\RootRepeal.exe
[2009/12/09 15:53:57 | 00,359,929 | —- | M] () – C:\Documents and Settings\Kurt\Desktop\dds.scr
[2009/12/09 15:48:34 | 00,000,611 | —- | M] () – C:\Documents and Settings\Kurt\Desktop\NTREGOPT.lnk
[2009/12/09 15:48:34 | 00,000,592 | —- | M] () – C:\Documents and Settings\Kurt\Desktop\ERUNT.lnk
[2009/12/09 15:47:22 | 00,791,393 | —- | M] (Lars Hederer ) – C:\Documents and Settings\Kurt\Desktop\erunt_setup.exe
[2009/12/09 13:50:47 | 00,000,933 | —- | M] () – C:\Documents and Settings\Kurt\Desktop\Spybot - Search & Destroy.lnk
[2009/12/09 12:15:59 | 00,001,804 | —- | M] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2009/12/09 12:10:12 | 00,001,604 | —- | M] () – C:\Documents and Settings\All Users\Desktop\QuickTime Player.lnk
[2009/12/09 12:02:53 | 00,001,854 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Safari.lnk
[2009/12/09 03:31:36 | 00,554,258 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2009/12/09 03:31:36 | 00,463,768 | —- | M] () – C:\WINDOWS\System32\PERFH009.DAT
[2009/12/09 03:31:36 | 00,080,628 | —- | M] () – C:\WINDOWS\System32\PERFC009.DAT
[2009/12/09 03:11:02 | 00,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2009/12/03 16:14:06 | 00,038,224 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/12/03 16:13:56 | 00,019,160 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2009/11/28 16:48:23 | 00,305,216 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2009/11/23 16:18:02 | 00,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2009/11/22 10:01:59 | 00,012,464 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\avgrsstx.dll
[2009/11/22 10:01:59 | 00,001,507 | —- | M] () – C:\Documents and Settings\All Users\Desktop\AVG Free 9.0.lnk
[2009/11/22 10:01:58 | 00,360,584 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\drivers\avgtdix.sys
[2009/11/22 10:01:52 | 00,333,192 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\drivers\avgldx86.sys
[2009/11/22 10:01:48 | 00,113,461 | —- | M] () – C:\WINDOWS\System32\drivers\Avg\iavichjw.avm
[2009/11/22 10:01:48 | 00,028,424 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\drivers\avgmfx86.sys
[2009/11/22 10:01:33 | 06,061,540 | —- | M] () – C:\WINDOWS\System32\drivers\Avg\avi7.avg
[2009/11/22 10:01:33 | 00,492,629 | —- | M] () – C:\WINDOWS\System32\drivers\Avg\miniavi.avg

========== Files Created - No Company Name ==========

[2009/12/13 17:00:36 | 00,000,917 | —- | C] () – C:\Documents and Settings\Kurt\Desktop\Revo Uninstaller.lnk
[2009/12/13 16:59:13 | 01,079,272 | —- | C] () – C:\Documents and Settings\Kurt\Desktop\revosetup.exe
[2009/12/13 12:54:00 | 00,559,330 | —- | C] () – C:\Documents and Settings\Kurt\Desktop\kavremover10.zip
[2009/12/13 11:06:14 | 00,000,699 | —- | C] () – C:\Documents and Settings\Kurt\Desktop\Sec-Info.zip
[2009/12/11 23:19:14 | 00,292,864 | —- | C] () – C:\Documents and Settings\Kurt\Desktop\gmer.exe
[2009/12/11 23:18:40 | 00,284,610 | —- | C] () – C:\Documents and Settings\Kurt\Desktop\gmer.zip
[2009/12/09 15:53:53 | 00,359,929 | —- | C] () – C:\Documents and Settings\Kurt\Desktop\dds.scr
[2009/12/09 15:48:34 | 00,000,611 | —- | C] () – C:\Documents and Settings\Kurt\Desktop\NTREGOPT.lnk
[2009/12/09 15:48:34 | 00,000,592 | —- | C] () – C:\Documents and Settings\Kurt\Desktop\ERUNT.lnk
[2009/12/09 13:50:47 | 00,000,933 | —- | C] () – C:\Documents and Settings\Kurt\Desktop\Spybot - Search & Destroy.lnk
[2009/12/09 12:15:59 | 00,001,804 | —- | C] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2009/12/09 12:10:12 | 00,001,604 | —- | C] () – C:\Documents and Settings\All Users\Desktop\QuickTime Player.lnk
[2009/11/22 10:01:59 | 00,001,507 | —- | C] () – C:\Documents and Settings\All Users\Desktop\AVG Free 9.0.lnk
[2009/11/22 10:01:48 | 00,113,461 | —- | C] () – C:\WINDOWS\System32\drivers\Avg\iavichjw.avm
[2009/11/22 10:01:33 | 46,593,199 | —- | C] () – C:\WINDOWS\System32\drivers\Avg\incavi.avm
[2009/11/22 10:01:33 | 06,061,540 | —- | C] () – C:\WINDOWS\System32\drivers\Avg\avi7.avg
[2009/11/22 10:01:33 | 00,492,629 | —- | C] () – C:\WINDOWS\System32\drivers\Avg\miniavi.avg
[2009/11/22 10:01:33 | 00,123,791 | —- | C] () – C:\WINDOWS\System32\drivers\Avg\microavi.avg
[2009/07/09 22:40:28 | 00,029,073 | —- | C] () – C:\Documents and Settings\Kurt\Application Data\Comma Separated Values (Windows).ADR
[2009/07/09 22:13:28 | 00,004,088 | —- | C] () – C:\Documents and Settings\Kurt\Application Data\Comma Separated Values (Windows).NOT
[2009/06/28 20:16:02 | 08,673,792 | —- | C] () – C:\Documents and Settings\All Users\Application Data\atscie.msi
[2007/10/05 14:08:30 | 00,000,022 | —- | C] () – C:\WINDOWS\iexplore.ini
[2007/02/22 07:17:50 | 00,000,071 | —- | C] () – C:\WINDOWS\pn.ini
[2007/02/22 07:17:50 | 00,000,051 | —- | C] () – C:\WINDOWS\pr.ini
[2006/10/28 10:54:27 | 00,000,822 | —- | C] () – C:\WINDOWS\hpntwksetup.ini
[2006/10/19 10:54:19 | 00,077,824 | R— | C] () – C:\WINDOWS\System32\HPZIDS01.dll
[2006/10/19 10:54:04 | 00,000,169 | —- | C] () – C:\WINDOWS\System32\AddPort.ini
[2006/10/19 10:42:23 | 00,008,289 | —- | C] () – C:\Documents and Settings\All Users\Application Data\hpzinstall.log
[2006/09/16 17:30:47 | 00,000,037 | —- | C] () – C:\WINDOWS\ipixActivex.ini
[2006/06/08 07:07:09 | 00,000,008 | —- | C] () – C:\WINDOWS\System32\winlogon.ini
[2006/06/06 15:42:27 | 00,000,216 | —- | C] () – C:\WINDOWS\Quicken.ini
[2005/12/28 19:21:03 | 00,021,840 | —- | C] () – C:\WINDOWS\System32\SIntfNT.dll
[2005/12/28 19:21:03 | 00,017,212 | —- | C] () – C:\WINDOWS\System32\SIntf32.dll
[2005/12/28 19:21:03 | 00,012,067 | —- | C] () – C:\WINDOWS\System32\SIntf16.dll
[2005/10/08 18:08:56 | 00,051,200 | —- | C] () – C:\Documents and Settings\Kurt\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2005/10/01 20:02:46 | 00,000,000 | —- | C] () – C:\WINDOWS\OpPrintServer.INI
[2005/05/11 16:23:06 | 00,000,002 | —- | C] () – C:\WINDOWS\msoffice.ini
[2004/09/11 10:42:48 | 00,017,385 | —- | C] () – C:\WINDOWS\cdPlayer.ini
[2004/06/27 07:53:40 | 00,000,127 | —- | C] () – C:\Documents and Settings\Kurt\Local Settings\Application Data\fusioncache.dat
[2004/06/20 16:19:21 | 00,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2004/06/20 16:07:55 | 00,000,488 | —- | C] () – C:\WINDOWS\ODBC.INI
[2004/06/20 15:56:26 | 00,000,262 | —- | C] () – C:\WINDOWS\wininit.ini
[2004/06/20 15:51:51 | 00,000,884 | —- | C] () – C:\WINDOWS\orun32.ini
[2004/06/20 15:35:11 | 00,363,520 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2004/06/20 15:34:52 | 00,001,793 | —- | C] () – C:\WINDOWS\System32\fxsperf.ini
[2004/06/20 15:18:54 | 00,000,546 | —- | C] () – C:\WINDOWS\System32\OEMINFO.INI
[2004/03/26 13:59:22 | 00,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini
[2003/01/07 12:05:08 | 00,002,695 | —- | C] () – C:\WINDOWS\System32\OUTLPERF.INI
[2001/07/07 02:00:00 | 00,003,399 | —- | C] () – C:\WINDOWS\System32\hptcpmon.ini
[1996/02/23 13:34:48 | 00,014,629 | —- | C] () – C:\WINDOWS\System32\Declw.dll
[1996/02/22 11:09:20 | 00,032,256 | —- | C] () – C:\WINDOWS\System32\Decln.dll

========== LOP Check ==========

[2009/11/22 10:01:03 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\avg9
[2007/08/08 13:50:52 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Citrix
[2005/10/04 08:48:46 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\espionServerData
[2007/10/05 14:08:23 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\MumboJumbo
[2007/10/08 14:35:00 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PopCap
[2009/06/14 07:36:50 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Viewpoint
[2009/09/19 00:15:39 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2009/06/28 11:27:19 | 00,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2005/11/13 10:19:22 | 00,000,000 | —D | M] – C:\Documents and Settings\Kurt\Application Data\COWON
[2009/09/04 11:42:57 | 00,000,000 | —D | M] – C:\Documents and Settings\Kurt\Application Data\FUJIFILM
[2009/06/22 22:16:07 | 00,000,000 | —D | M] – C:\Documents and Settings\Kurt\Application Data\IObit
[2005/11/06 15:02:35 | 00,000,000 | —D | M] – C:\Documents and Settings\Kurt\Application Data\Leadertech
[2005/12/28 20:17:35 | 00,000,000 | —D | M] – C:\Documents and Settings\Kurt\Application Data\Musicmatch
[2005/10/04 09:27:07 | 00,000,000 | —D | M] – C:\Documents and Settings\Kurt\Application Data\Opera
[2007/12/02 20:31:58 | 00,000,000 | —D | M] – C:\Documents and Settings\Kurt\Application Data\Snapfish
[2009/06/22 21:45:03 | 00,000,000 | —D | M] – C:\Documents and Settings\Kurt\Application Data\uniblue
[2006/04/27 20:40:53 | 00,000,000 | —D | M] – C:\Documents and Settings\Kurt\Application Data\WholeSecurity

========== Purity Check ==========


< End of report >
Post #19
Hi,

Log looks clean, I think the problem could have been even though the Kaspersky files were gone, the service was still there looking for the files to run.

Hopefully removing that service has solved the issues.

Time to clean up.


Please delete the DDS and GMER folders and logs from your desktop (right click and delete)

Keep the Malwarebytes program, it's good to have, update it and run it every now and then.


NEXT:

Clean up with OTL:
  • Double-click OTL.exe to start the program.
  • Close all other programs apart from OTL as this step will require a reboot
  • On the OTL main screen, press the CLEANUP button
  • Say Yes to the prompt and then allow the program to reboot your computer.


NEXT:

  • Double-click My Computer.
  • Click the Tools menu, and then click Folder Options.
  • Click the View tab.
  • Click the Reset Defaults button
  • Click Apply, and then click OK.


NEXT

System Restore makes regular backups of all your settings, if you ever had to use this program to restore your system to a previous date, you will be infected all over again so we need to clean out the previous Restore Points
We need to set a new system restore point:

Click Start > Run > copy and paste the following into the run box:


%SystemRoot%\System32\restore\rstrui.exe


Press OK. Choose Create a Restore Point then click Next.
Name it (something you'll remember) and click Create,
when the confirmation screen shows the restore point has been created click Close.

Now remove all previous Restore Points:

Click Start > Run > copy and paste the following into the run box:


cleanmgr


At the top, click on More Options tab. Click the Clean up button in the System Restore box.
Click on the Yes button.
When finished, click on Cancel button to exit.


NEXT

Below I have included a number of recommendations for how to protect your computer against malware infections.

  • It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
    Strong passwords: How to create and use them
    Then consider a password keeper, to keep all your passwords safe.
  • Keep Windows updated by regularly checking their website at :
    http://windowsupdate.microsoft.com/
    This will ensure your computer has always the latest security updates available installed on your computer.

  • SpywareBlaster protects against bad ActiveX, it immunizes your PC against them.

  • SpywareGuard offers realtime protection from spyware installation attempts. Make sure you are only running one real-time anti-spyware protection program ( eg : TeaTimer, Windows Defender ) or there will be a conflict.

  • Make Internet Explorer more secure
    • Click Start > Run
    • Type Inetcpl.cpl & click OK
    • Click on the Security tab
    • Click Reset all zones to default level
    • Make sure the Internet Zone is selected & Click Custom level
    • In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
    • Next Click OK, then Apply button and then OK to exit the Internet Properties page.
  • ATF Cleaner - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.

  • MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.

    WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
    • Green to go
    • Yellow for caution
    • Red to stop
    WOT has an addon available for both Firefox, IE and chrome.

  • Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more
    secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in pop up
    blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from
    Here


    If you choose to use Firefox, I highly recommend this add-on to keep your PC even more secure.
    • NoScript - for blocking ads and other potential website attacks
  • Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.
  • ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.
  • In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at these well written articles:
    Think Prevention.
    PC Safety and Security–What Do I Need?.


**Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them.


Thank you for your patience, and performing all of the procedures requested.

Please respond one last time so we can consider the thread resolved and close it, thank-you.
Post #20
CatByte, Thank you so much for your assistance. Computer is running much better. Also have switched to Firefox – quicker also. I really appreciate all the time you spent on this, and the quick, thorough responsiveness. Best regards, kjshealedpc
Post #22
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI