Spyware / Malware / Virus Removal

[Closed] Webpages loading Extremely Slow

10 min read

Looking for the outcome? Ask AI

Gregory Topic Starter

Post #1December 27, 2009, 3:59 AM UTC

Hi, I am going to post my HJT log… Ever since about a week again, I have had extremely slow browser and computer… I have done some things in the self help, with little to no relief.

Also, I worked for a company, remotely from home, and quit, now I can't uninstall their carp** from my computer… Trying to see if I can get some help for this as well

All the help is extremely appreciated

—–

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:59:22 PM, on 12/26/2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v7.00 (7.00.6002.18005)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Intel\IntelDH\CCU\CCU_TrayIcon.exe
C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Windows\WindowsMobile\wmdSync.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Windows\sttray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Intel\IntelDH\CCU\CCU_Engine.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 174.142.104.57:3128
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.11.30.dll (file missing)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\Program Files\Java\jre1.6.0\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: Web Replay BHO - {8B57DF7C-9BF9-4D52-B94E-37ACE3893F7D} - C:\Program Files\Deskperience\Web Replay\inetie.dll (file missing)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: Avaya Web Dialer - {E6DF0B46-7D6F-407A-A6A2-62D17A021A9A} - C:\Program Files\Avaya\Avaya IP Agent\WebDialer.dll
O3 - Toolbar: Web Replay Toolbar - {756727E5-1E5C-4284-B2DA-C21D3A283A38} - C:\Program Files\Deskperience\Web Replay\inetieui.dll (file missing)
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [CCUTRAYICON] "C:\Program Files\Intel\IntelDH\CCU\CCU_TrayIcon.exe"
O4 - HKLM\..\Run: [NMSSupport] "C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe" /startup
O4 - HKLM\..\Run: [ECenter] c:\dell\E-Center\EULALauncher.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [Windows Mobile-based device management] %windir%\WindowsMobile\wmdSync.exe
O4 - HKLM\..\Run: [pwreset] C:\Program Files\Avaya\Avaya IP Agent\Service Provider\pwreset.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [SigmatelSysTrayApp] sttray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKLM\..\Run: [McENUI] C:\PROGRA~1\McAfee\MHN\McENUI.exe /hide
O4 - HKCU\..\Run: [googletalk] C:\Users\Greg\AppData\Roaming\Google\Google Talk\googletalk.exe /autostart
O4 - HKUS\S-1-5-21-3889450244-2785813946-2893821554-1000\..\Run: [Sidebar] "C:\Program Files\Windows Sidebar\Sidebar.exe" /detectMem (User 'IUSR_NMPR')
O4 - HKUS\S-1-5-21-3889450244-2785813946-2893821554-1000\..\Run: [WindowsWelcomeCenter] "rundll32.exe" oobefldr.dll,ShowWelcomeCenter (User 'IUSR_NMPR')
O4 - HKUS\S-1-5-21-3889450244-2785813946-2893821554-1000\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup (User 'IUSR_NMPR')
O4 - HKUS\S-1-5-21-3889450244-2785813946-2893821554-1000\..\Run: [Aim6] (User 'IUSR_NMPR')
O4 - HKUS\S-1-5-21-3889450244-2785813946-2893821554-1000\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background (User 'IUSR_NMPR')
O4 - HKUS\S-1-5-21-3889450244-2785813946-2893821554-1000\..\Run: [eyeBeam SIP Client] (User 'IUSR_NMPR')
O8 - Extra context menu item: &WebReplay Fill Login - res://C:\Program Files\Deskperience\Web Replay\inetieui.dll/292
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin\npjpi160.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin\npjpi160.dll
O9 - Extra button: Web Replay - {3401B8CC-95A4-4dbe-B73F-00E2D23F2B73} - C:\Program Files\Deskperience\Web Replay\ShowToolbar.dll (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Web Dialer - {A26ABCF0-1C8F-46e7-A67C-0489DC21B9CC} - C:\Program Files\Avaya\Avaya IP Agent\WebDialer.dll
O9 - Extra 'Tools' menuitem: Avaya Web Dialer - {A26ABCF0-1C8F-46e7-A67C-0489DC21B9CC} - C:\Program Files\Avaya\Avaya IP Agent\WebDialer.dll
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.1.11.30.dll/206 (file missing)
O13 - Gopher Prefix:
O18 - Protocol: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Intel® Alert Service (AlertService) - Intel® Corporation - C:\Program Files\Intel\IntelDH\CCU\AlertService.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: DQLWinService - Unknown owner - C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: iClarityQoSService - AVAYA Communication - C:\Windows\system32\\QosServM.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel® Software Services Manager (ISSM) - Intel® Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe
O23 - Service: Intel® Viiv™ Media Server (M1 Server) - Unknown owner - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe
O23 - Service: McAfee SiteAdvisor Service - McAfee, Inc. - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: Intel® Application Tracker (MCLServiceATL) - Intel® Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: Intel® Remoting Service (Remote UI Service) - Intel® Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe
O23 - Service: stllssvr - Unknown owner - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe (file missing)
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

–
End of file - 10758 bytes

Tomk

Post #2January 5, 2010, 5:46 PM UTC

Hi Gregory,

My name is Tomk. I would be glad to take a look at your log and help you with solving any malware problems. Logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
The fixes are specific to your problem and should only be used for the issues on this machine.
Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
It's often worth reading through these instructions and printing them for ease of reference.
If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
Please reply to this thread. Do not start a new topic.

Download the GMER Rootkit Scanner. Unzip it to your Desktop.

Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.

Double-click gmer.exe. The program will begin to run.

**Caution**
These types of scans can produce false positives. Do NOT take any action on any "<— ROOKIT" entries unless advised!

If possible rootkit activity is found, you will be asked if you would like to perform a full scan.

Click NO
In the right panel, you will see a bunch of boxes that have been checked … leave everything checked and ensure the Show all box is un-checked.
Now click the Scan button.
Once the scan is complete, you may receive another notice about rootkit activity.
Click OK.
GMER will produce a log. Click on the [Save..] button, and in the File name area, type in "GMER.txt"
Save it where you can easily find it, such as your desktop.

If you do not receive notice about possible rootkit activity remain on the Rootkit/Malware tab & make sure the 'Show All' button is unticked.

Click the Scan button and let the program do its work. GMER will produce a log. Click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
Save it where you can easily find it, such as your desktop

Download OTL to your desktop.

Double click on OTL.exe to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output
Check the boxes beside LOP Check and Purity Check.
Copy and paste the following bold text in to the window Under the Custom Scan box

netsvcs
%SYSTEMDRIVE%\*.exe
/md5start
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
sceclt.dll
ntelogon.dll
logevent.dll
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
/md5stop
%systemroot%\*. /mp /s
CREATERESTOREPOINT
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.

Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them all in.

Please post back with

GMER log
both OTL logs

Gregory

Post #3January 8, 2010, 6:29 AM UTC last edited January 8, 2010, 6:57 AM UTC

Here is the GMer.TXT – Please note, I had to do this twice, the first time, when I opened it, it made my computer go to a black screen… Then I was able to restart (by manually turning off the power)… Then I ran it again, I got the log, and then I got a blue screen msg saying windows had to restart…

____

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit quick scan 2010-01-08 01:38:13
Windows 6.0.6002 Service Pack 2
Running: gmer.exe; Driver: C:\Users\Greg\AppData\Local\Temp\pxldqpod.sys

—- System - GMER 1.0.15 —-

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateFile [0x8F1C879E]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateProcess [0x8F1C8738]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateProcessEx [0x8F1C874C]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwMapViewOfSection [0x8F1C87DC]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwOpenProcess [0x8F1C8710]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwOpenThread [0x8F1C8724]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwProtectVirtualMemory [0x8F1C87B2]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwSetContextThread [0x8F1C878A]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwSetInformationProcess [0x8F1C8776]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwTerminateProcess [0x8F1C880B]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwUnmapViewOfSection [0x8F1C87F2]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwYieldExecution [0x8F1C87C8]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateUserProcess [0x8F1C8762]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtCreateFile
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtMapViewOfSection
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtOpenProcess
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtOpenThread
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtSetInformationProcess

—- Devices - GMER 1.0.15 —-

Device \FileSystem\Ntfs \Ntfs 8531E1F8

AttachedDevice \FileSystem\Ntfs \Ntfs mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)

Device \FileSystem\fastfat \Fat 87FA31F8

AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\fastfat \Fat mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
AttachedDevice \Driver\tdx \Device\Ip Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)
AttachedDevice \Driver\tdx \Device\Tcp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)
AttachedDevice \Driver\tdx \Device\Udp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)
AttachedDevice \Driver\tdx \Device\RawIp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)

—- EOF - GMER 1.0.15 —-

Gregory

Post #4January 8, 2010, 6:58 AM UTC

OTL.txt

____

OTL logfile created on: 1/8/2010 1:45:01 AM - Run 1
OTL by OldTimer - Version 3.1.21.1 Folder = C:\Users\Greg\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 70.00% Memory free
6.00 Gb Paging File | 5.00 Gb Available in Paging File | 83.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 222.78 Gb Total Space | 98.56 Gb Free Space | 44.24% Space Free | Partition Type: NTFS
Drive D: | 10.00 Gb Total Space | 5.92 Gb Free Space | 59.22% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: GREG-PC
Current User Name: Greg
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Users\Greg\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe (McAfee, Inc.)
PRC - c:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
PRC - C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
PRC - C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)
PRC - C:\Program Files\McAfee\MPF\MpfSrv.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\MSC\mcmscsvc.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\VirusScan\Mcshield.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\VirusScan\mcsysmon.exe (McAfee, Inc.)
PRC - c:\Program Files\Common Files\McAfee\McProxy\McProxy.exe (McAfee, Inc.)
PRC - c:\Program Files\Common Files\McAfee\MNA\McNASvc.exe (McAfee, Inc.)
PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Windows\System32\PnkBstrA.exe ()
PRC - C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.)
PRC - C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
PRC - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe (Lavasoft)
PRC - C:\Windows\System32\Ati2evxx.exe (ATI Technologies Inc.)
PRC - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (Advanced Micro Devices Inc.)
PRC - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (ATI Technologies Inc.)
PRC - C:\Windows\sttray.exe (SigmaTel, Inc.)
PRC - C:\Program Files\Viewpoint\Common\ViewpointService.exe (Viewpoint Corporation)
PRC - C:\Program Files\Intel\IntelDH\CCU\CCU_TrayIcon.exe (Intel® Corporation)
PRC - C:\Program Files\Intel\IntelDH\CCU\CCU_Engine.exe (Intel® Corporation)
PRC - C:\Program Files\Intel\IntelDH\CCU\AlertService.exe (Intel® Corporation)
PRC - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe (Intel® Corporation)
PRC - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe (Intel® Corporation)
PRC - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\issm.exe (Intel® Corporation)
PRC - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe ()
PRC - C:\Windows\WindowsMobile\wmdSync.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe ()
PRC - C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (Macrovision Corporation)
PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
PRC - C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe (Intel Corporation)

========== Modules (SafeList) ==========

MOD - C:\Users\Greg\Downloads\OTL.exe (OldTimer Tools)
MOD - c:\Program Files\McAfee\SiteAdvisor\sahook.dll (McAfee, Inc.)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0\comctl32.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (stllssvr) – File not found
SRV - (McAfee SiteAdvisor Service) – C:\Program Files\McAfee\SiteAdvisor\McSACore.exe (McAfee, Inc.)
SRV - (iPod Service) – C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)
SRV - (MpfService) – C:\Program Files\McAfee\MPF\MPFSrv.exe (McAfee, Inc.)
SRV - (FontCache) – C:\Windows\System32\FntCache.dll (Microsoft Corporation)
SRV - (mcmscsvc) – C:\Program Files\McAfee\MSC\mcmscsvc.exe (McAfee, Inc.)
SRV - (McODS) – C:\Program Files\McAfee\VirusScan\mcods.exe (McAfee, Inc.)
SRV - (McShield) – C:\Program Files\McAfee\VirusScan\Mcshield.exe (McAfee, Inc.)
SRV - (McSysmon) – C:\Program Files\McAfee\VirusScan\mcsysmon.exe (McAfee, Inc.)
SRV - (McProxy) – c:\Program Files\Common Files\McAfee\McProxy\McProxy.exe (McAfee, Inc.)
SRV - (McNASvc) – c:\Program Files\Common Files\McAfee\MNA\McNASvc.exe (McAfee, Inc.)
SRV - (Apple Mobile Device) – C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (PnkBstrA) – C:\Windows\System32\PnkBstrA.exe ()
SRV - (Bonjour Service) – C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.)
SRV - (aawservice) – C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe (Lavasoft)
SRV - (Ati External Event Utility) – C:\Windows\System32\Ati2evxx.exe (ATI Technologies Inc.)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (WcesComm) – C:\Windows\WindowsMobile\wcescomm.dll (Microsoft Corporation)
SRV - (RapiMgr) – C:\Windows\WindowsMobile\rapimgr.dll (Microsoft Corporation)
SRV - (FLEXnet Licensing Service) – C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.)
SRV - (iClarityQoSService) – C:\Windows\System32\\QosServM.exe ()
SRV - (Viewpoint Manager Service) – C:\Program Files\Viewpoint\Common\ViewpointService.exe (Viewpoint Corporation)
SRV - (AlertService) Intel® – C:\Program Files\Intel\IntelDH\CCU\AlertService.exe (Intel® Corporation)
SRV - (Remote UI Service) Intel® – C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe (Intel® Corporation)
SRV - (MCLServiceATL) Intel® – C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe (Intel® Corporation)
SRV - (ISSM) Intel® – C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe (Intel® Corporation)
SRV - (M1 Server) Intel® Viiv™ – C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe ()
SRV - (DSBrokerService) – C:\Program Files\DellSupport\brkrsvc.exe ()
SRV - (ehstart) – C:\Windows\ehome\ehstart.dll (Microsoft Corporation)
SRV - (DQLWinService) – C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe ()
SRV - (IAANTMON) Intel® – C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
SRV - (IDriverT) – C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe (Macrovision Corporation)
SRV - (ose) – C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV - (mfehidk) – C:\Windows\System32\drivers\mfehidk.sys (McAfee, Inc.)
DRV - (mfeavfk) – C:\Windows\System32\drivers\mfeavfk.sys (McAfee, Inc.)
DRV - (mfesmfk) – C:\Windows\System32\drivers\mfesmfk.sys (McAfee, Inc.)
DRV - (mfebopk) – C:\Windows\System32\drivers\mfebopk.sys (McAfee, Inc.)
DRV - (mferkdk) – C:\Windows\System32\drivers\mferkdk.sys (McAfee, Inc.)
DRV - (MPFP) – C:\Windows\System32\drivers\Mpfp.sys (McAfee, Inc.)
DRV - (sptd) – C:\Windows\System32\Drivers\sptd.sys ()
DRV - (GEARAspiWDM) – C:\Windows\System32\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV - (usbaudio) USB Audio Driver (WDM) – C:\Windows\System32\drivers\USBAUDIO.sys (Microsoft Corporation)
DRV - (winusb) – C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (LMIRfsClientNP) – C:\Windows\System32\LMIRfsClientNP.dll (LogMeIn, Inc.)
DRV - (LMIRfsDriver) – C:\Windows\System32\drivers\LMIRfsDriver.sys (LogMeIn, Inc.)
DRV - (lmimirr) – C:\Windows\System32\drivers\lmimirr.sys (LogMeIn, Inc.)
DRV - (WMP110v2) – C:\Windows\System32\drivers\WMP110v2.sys (Ralink Technology, Corp.)
DRV - (Ad-Watch Connect Filter) – C:\Windows\System32\drivers\NSDriver.sys (Lavasoft AB)
DRV - (R300) – C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (atikmdag) – C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (e1express) Intel® – C:\Windows\System32\drivers\e1e6032.sys (Intel Corporation)
DRV - (viaide) – C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
DRV - (cmdide) – C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (aliide) – C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (IntelDH) – C:\Windows\System32\drivers\IntelDH.sys (Intel Corporation)
DRV - (STHDA) – C:\Windows\System32\drivers\stwrt.sys (SigmaTel, Inc.)
DRV - (CVirtA) – C:\Windows\System32\drivers\CVirtA.sys (Cisco Systems, Inc.)
DRV - (NuidFltr) – C:\Windows\System32\drivers\nuidfltr.sys (Microsoft Corporation)
DRV - (TSHWMDTCP) – C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\TSHWMDTCP.sys ()
DRV - (ql2300) – C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
DRV - (adp94xx) – C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
DRV - (elxstor) – C:\Windows\system32\drivers\elxstor.sys (Emulex)
DRV - (adpahci) – C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
DRV - (uliahci) – C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
DRV - (iaStorV) – C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
DRV - (adpu320) – C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
DRV - (ulsata2) – C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
DRV - (vsmraid) – C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (ql40xx) – C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
DRV - (UlSata) – C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
DRV - (adpu160m) – C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
DRV - (nvraid) – C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (nfrd960) – C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
DRV - (iirsp) – C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (SiSRaid4) – C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)
DRV - (nvstor) – C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
DRV - (aic78xx) – C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
DRV - (arcsas) – C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
DRV - (LSI_SCSI) – C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
DRV - (SiSRaid2) – C:\Windows\system32\drivers\sisraid2.sys (Silicon Integrated Systems Corp.)
DRV - (HpCISSs) – C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (arc) – C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
DRV - (iteraid) – C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)
DRV - (iteatapi) – C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)
DRV - (LSI_SAS) – C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
DRV - (Symc8xx) – C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
DRV - (LSI_FC) – C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
DRV - (Sym_u3) – C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
DRV - (Mraid35x) – C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
DRV - (Sym_hi) – C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
DRV - (megasas) – C:\Windows\system32\drivers\megasas.sys (LSI Logic Corporation)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) – C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) – C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)
DRV - (BrFiltUp) – C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
DRV - (BrFiltLo) – C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
DRV - (BrSerWdm) – C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm) – C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
DRV - (ntrigdigi) – C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)
DRV - (E1G60) Intel® – C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation)
DRV - (secdrv) – C:\Windows\System32\drivers\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
DRV - (nmsunidr) – C:\Windows\System32\drivers\nmsunidr.sys (Gteko Ltd.)
DRV - (DSproct) – C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys (Gteko Ltd.)
DRV - (iaStor) – C:\Windows\system32\drivers\iastor.sys (Intel Corporation)
DRV - (nmsgopro) – C:\Windows\System32\drivers\nmsgopro.sys (Gteko Ltd.)
DRV - (dsunidrv) – C:\Program Files\DellSupport\Drivers\dsunidrv.sys (Gteko Ltd.)
DRV - (Ser2pl) – C:\Windows\System32\drivers\ser2pl.sys (Prolific Technology Inc.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 174.142.104.57:3128

========== FireFox ==========

FF - prefs.js..browser.search.selectedEngine: "WarezBB (all terms)"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "www.google.com"
FF - prefs.js..extensions.enabledItems: {B7082FAA-CB62-4872-9106-E42DD88EDE45}:3.0
FF - prefs.js..extensions.enabledItems: {317B5128-0B0B-49b2-B2DB-1E7560E16C74}:2.5.9
FF - prefs.js..keyword.URL: "http://www.google.com/search?ie=UTF-8&oe;=UTF-8&sourceid;=navclient&gfns;=1&q;="
FF - prefs.js..network.proxy.share_proxy_settings: true

FF - HKLM\software\mozilla\Firefox\Extensions\\{B7082FAA-CB62-4872-9106-E42DD88EDE45}: C:\Program Files\McAfee\SiteAdvisor [2009/12/28 05:28:16 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.7\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/01/07 00:56:50 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.7\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/01/07 00:56:50 | 00,000,000 | —D | M]

[2009/02/04 20:50:23 | 00,000,000 | —D | M] – C:\Users\Greg\AppData\Roaming\Mozilla\Extensions
[2009/02/04 20:50:23 | 00,000,000 | —D | M] – C:\Users\Greg\AppData\Roaming\Mozilla\Extensions\[removed]
[2010/01/07 19:01:30 | 00,000,000 | —D | M] – C:\Users\Greg\AppData\Roaming\Mozilla\Firefox\Profiles\5pdxn7ey.default\extensions
[2009/11/04 13:16:21 | 00,000,000 | —D | M] (SeoQuake) – C:\Users\Greg\AppData\Roaming\Mozilla\Firefox\Profiles\5pdxn7ey.default\extensions\{317B5128-0B0B-49b2-B2DB-1E7560E16C74}
[2009/04/22 21:14:38 | 00,000,000 | —D | M] (SeoQuake) – C:\Users\Greg\AppData\Roaming\Mozilla\Firefox\Profiles\5pdxn7ey.default\extensions\{317B5128-0B0B-49b2-B2DB-1E7560E16C74}(563)
[2009/02/12 22:40:24 | 00,003,163 | —- | M] () – C:\Users\Greg\AppData\Roaming\Mozilla\Firefox\Profiles\5pdxn7ey.default\searchplugins\warezbb-all-terms.xml
[2009/02/12 22:39:49 | 00,003,161 | —- | M] () – C:\Users\Greg\AppData\Roaming\Mozilla\Firefox\Profiles\5pdxn7ey.default\searchplugins\warezbb-any-term.xml
[2009/02/24 23:09:43 | 00,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2008/10/03 22:12:57 | 00,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions\[removed]
[2008/10/03 22:03:22 | 00,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions\[removed]
[2007/04/16 12:07:12 | 00,180,293 | —- | M] () – C:\Program Files\Mozilla Firefox\plugins\npViewpoint.dll

O1 HOSTS File: (27 bytes) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (BitComet Helper) - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.11.30.dll File not found
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\Program Files\Java\jre1.6.0\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll (McAfee, Inc.)
O2 - BHO: (Web Replay BHO) - {8B57DF7C-9BF9-4D52-B94E-37ACE3893F7D} - C:\Program Files\Deskperience\Web Replay\inetie.dll File not found
O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O2 - BHO: (WebDialerBHO Class) - {E6DF0B46-7D6F-407A-A6A2-62D17A021A9A} - C:\Program Files\Avaya\Avaya IP Agent\WebDialer.dll (Avaya Inc)
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (Web Replay Toolbar) - {756727E5-1E5C-4284-B2DA-C21D3A283A38} - C:\Program Files\Deskperience\Web Replay\inetieui.dll File not found
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {B24BA06E-FB7B-4757-95C2-DC01125F750E} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {BFB5F154-9212-46F3-B547-AC6106030A54} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [CCUTRAYICON] C:\Program Files\Intel\IntelDH\CCU\CCU_TrayIcon.exe (Intel® Corporation)
O4 - HKLM..\Run: [ECenter] c:\DELL\E-Center\EULALauncher.exe ( )
O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe (Intel Corporation)
O4 - HKLM..\Run: [ISUSPM Startup] C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe (Macrovision Corporation)
O4 - HKLM..\Run: [ISUSScheduler] C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (Macrovision Corporation)
O4 - HKLM..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
O4 - HKLM..\Run: [McENUI] C:\Program Files\McAfee\MHN\McENUI.exe (McAfee, Inc.)
O4 - HKLM..\Run: [NMSSupport] C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe (Intel Corporation)
O4 - HKLM..\Run: [pwreset] C:\Program Files\Avaya\Avaya IP Agent\Service Provider\pwreset.exe (Avaya Inc.)
O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\QTTask.exe (Apple Inc.)
O4 - HKLM..\Run: [SigmatelSysTrayApp] C:\Windows\sttray.exe (SigmaTel, Inc.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [Windows Mobile-based device management] C:\Windows\WindowsMobile\wmdSync.exe (Microsoft Corporation)
O4 - HKCU..\Run: [Aim6] File not found
O4 - HKCU..\Run: [eyeBeam SIP Client] File not found
O4 - HKCU..\Run: [googletalk] C:\Users\Greg\AppData\Roaming\Google\Google Talk\googletalk.exe (Google)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin\npjpi160.dll (Sun Microsystems, Inc.)
O9 - Extra Button: Web Replay - {3401B8CC-95A4-4dbe-B73F-00E2D23F2B73} - C:\Program Files\Deskperience\Web Replay\ShowToolbar.dll File not found
O9 - Extra Button: Web Dialer - {A26ABCF0-1C8F-46e7-A67C-0489DC21B9CC} - C:\Program Files\Avaya\Avaya IP Agent\WebDialer.dll (Avaya Inc)
O9 - Extra 'Tools' menuitem : Avaya Web Dialer - {A26ABCF0-1C8F-46e7-A67C-0489DC21B9CC} - Reg Error: Value error. File not found
O9 - Extra Button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.11.30.dll File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB (PCPitstop Utility)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…t/ultrashim.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 16:43:36 | 00,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O33 - MountPoints2\{d7120ef3-9288-11dc-9d0d-0019d16aa44f}\Shell - "" = AutoRun
O33 - MountPoints2\{d7120ef3-9288-11dc-9d0d-0019d16aa44f}\Shell\AutoRun\command - "" = G:\LaunchU3.exe – File not found
O33 - MountPoints2\{d7990d8a-4b2e-11de-8667-0019d16aa44f}\Shell - "" = AutoRun
O33 - MountPoints2\{d7990d8a-4b2e-11de-8667-0019d16aa44f}\Shell\AutoRun\command - "" = F:\files\openindex.exe index.hta – File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (lsdelete) - C:\Windows\System32\lsdelete.exe ()
O35 - comfile [open] – "%1" %*
O35 - exefile [open] – "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - C:\Windows\System32\ias [2009/04/22 21:45:04 | 00,000,000 | —D | M]
NetSvcs: Irmon - C:\Windows\System32\irmon.dll (Microsoft Corporation)
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: Wmi - C:\Windows\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found
OTL cannot create restorepoints on Vista OSs!

========== Files/Folders - Created Within 30 Days ==========

[2010/01/04 16:14:48 | 00,000,000 | —D | C] – C:\Users\Greg\Desktop\OrganicsNEW
[2010/01/03 16:28:01 | 00,000,000 | —D | C] – C:\Users\Greg\AppData\Local\Apple
[2009/12/30 06:49:08 | 00,000,000 | —D | C] – C:\Users\Greg\AppData\Local\Apple Computer
[2009/12/30 04:08:38 | 00,000,000 | —D | C] – C:\Users\Greg\AppData\Local\Adobe
[2009/12/30 03:33:18 | 00,000,000 | —D | C] – C:\Users\Greg\AppData\Local\AOL OCP
[2009/12/30 03:33:17 | 00,000,000 | —D | C] – C:\Users\Greg\AppData\Local\AOL
[2009/12/29 19:21:05 | 00,000,000 | —D | C] – C:\Program Files\MeadCo Neptune
[2009/12/26 07:16:53 | 00,024,064 | —- | C] (Microsoft Corporation) – C:\Windows\System32\nshhttp.dll
[2009/12/26 07:16:50 | 00,030,720 | —- | C] (Microsoft Corporation) – C:\Windows\System32\httpapi.dll
[2009/12/23 16:28:36 | 00,000,000 | —D | C] – C:\Users\Greg\Desktop\Cig
[2009/12/09 16:53:17 | 00,180,736 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieui.dll
[2009/12/09 16:53:17 | 00,078,336 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieencode.dll
[2009/12/09 16:53:16 | 00,380,928 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieapfltr.dll
[2009/12/09 16:52:48 | 00,243,712 | —- | C] (Microsoft Corporation) – C:\Windows\System32\rastls.dll

========== Files - Modified Within 30 Days ==========

[2010/01/08 01:48:55 | 17,825,792 | -HS- | M] () – C:\Users\Greg\ntuser.dat
[2010/01/08 01:48:43 | 00,742,300 | —- | M] () – C:\Windows\System32\PerfStringBackup.INI
[2010/01/08 01:48:43 | 00,630,470 | —- | M] () – C:\Windows\System32\perfh009.dat
[2010/01/08 01:48:43 | 00,115,654 | —- | M] () – C:\Windows\System32\perfc009.dat
[2010/01/08 01:43:19 | 00,013,009 | —- | M] () – C:\Windows\System32\Config.MPF
[2010/01/08 01:41:35 | 00,000,006 | -H– | M] () – C:\Windows\tasks\SA.DAT
[2010/01/08 01:40:59 | 00,003,568 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010/01/08 01:40:59 | 00,003,568 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010/01/08 01:40:44 | 00,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2010/01/08 01:40:36 | 23,267,2795 | —- | M] () – C:\Windows\MEMORY.DMP
[2010/01/08 01:00:00 | 00,000,308 | —- | M] () – C:\Windows\tasks\vgppmssa.job
[2010/01/04 16:20:14 | 01,716,896 | —- | M] () – C:\Users\Greg\Desktop\OrganicsNEW.rar
[2010/01/01 16:31:48 | 00,524,288 | -HS- | M] () – C:\Users\Greg\ntuser.dat{5bf1019b-3a63-11de-8d59-0019d16aa44f}.TMContainer00000000000000000001.regtrans-ms
[2010/01/01 16:31:48 | 00,065,536 | -HS- | M] () – C:\Users\Greg\ntuser.dat{5bf1019b-3a63-11de-8d59-0019d16aa44f}.TM.blf
[2010/01/01 16:31:43 | 01,793,153 | -H– | M] () – C:\Users\Greg\AppData\Local\IconCache.db
[2010/01/01 16:20:28 | 00,015,084 | —- | M] () – C:\Windows\System32\Support.xml
[2010/01/01 03:56:23 | 00,015,360 | —- | M] () – C:\Users\Greg\Desktop\jan.xls
[2010/01/01 03:51:55 | 00,002,653 | —- | M] () – C:\Users\Greg\Desktop\SocialBot.lnk
[2010/01/01 01:00:27 | 00,000,316 | —- | M] () – C:\Windows\tasks\McQcTask.job
[2009/12/31 07:38:27 | 00,004,539 | —- | M] () – C:\Users\Greg\Desktop\test.html
[2009/12/30 14:55:24 | 00,038,224 | —- | M] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbamswissarmy.sys
[2009/12/30 14:54:58 | 00,019,160 | —- | M] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys
[2009/12/27 00:05:58 | 00,018,944 | —- | M] () – C:\Users\Greg\Desktop\Dec.xls
[2009/12/26 22:48:17 | 00,039,424 | —- | M] () – C:\Users\Greg\Desktop\Copy of your_report.xls
[2009/12/26 21:01:21 | 00,030,720 | —- | M] () – C:\Users\Greg\Desktop\how_to_get_backlinks2.doc
[2009/12/15 01:31:27 | 00,000,338 | —- | M] () – C:\Windows\tasks\McDefragTask.job

========== Files Created - No Company Name ==========

[2010/01/08 01:40:36 | 23,267,2795 | —- | C] () – C:\Windows\MEMORY.DMP
[2010/01/04 16:20:12 | 01,716,896 | —- | C] () – C:\Users\Greg\Desktop\OrganicsNEW.rar
[2010/01/01 01:52:27 | 00,015,360 | —- | C] () – C:\Users\Greg\Desktop\jan.xls
[2009/12/26 21:01:21 | 00,030,720 | —- | C] () – C:\Users\Greg\Desktop\how_to_get_backlinks2.doc
[2009/12/26 21:01:12 | 00,039,424 | —- | C] () – C:\Users\Greg\Desktop\Copy of your_report.xls
[2009/12/14 09:36:24 | 00,018,944 | —- | C] () – C:\Users\Greg\Desktop\Dec.xls
[2009/09/18 00:43:20 | 00,117,248 | —- | C] () – C:\Windows\System32\EhStorAuthn.dll
[2009/08/08 20:35:53 | 00,000,092 | —- | C] () – C:\Users\Greg\AppData\Local\fusioncache.dat
[2009/08/03 14:07:42 | 00,403,816 | —- | C] () – C:\Windows\System32\OGACheckControl.dll
[2009/05/27 21:24:30 | 00,721,904 | —- | C] () – C:\Windows\System32\drivers\sptd.sys
[2009/03/30 20:19:51 | 00,001,024 | —- | C] () – C:\ProgramData\1pdfdec.dll
[2009/03/30 20:19:50 | 00,000,048 | —- | C] () – C:\Windows\System32\pdfutil.ini
[2009/02/27 21:31:23 | 00,000,224 | —- | C] () – C:\Windows\System32\filerenamerred.sys
[2009/02/22 13:24:52 | 00,000,258 | RHS- | C] () – C:\ProgramData\ntuser.pol
[2009/02/01 12:48:21 | 00,000,059 | —- | C] () – C:\Windows\ANS2000.INI
[2009/02/01 12:48:21 | 00,000,020 | -H– | C] () – C:\Windows\akebook.ini
[2009/02/01 12:48:21 | 00,000,004 | -H– | C] () – C:\Windows\a3kebook.ini
[2009/02/01 12:27:25 | 00,000,052 | —- | C] () – C:\Windows\proxyclicker.ini
[2009/01/18 17:45:31 | 00,006,360 | —- | C] () – C:\Users\Greg\AppData\Roaming\PrimoPDFSet.xml
[2008/11/23 00:53:40 | 00,000,024 | —- | C] () – C:\Windows\cdplayer.ini
[2008/11/04 19:25:20 | 00,000,079 | —- | C] () – C:\Windows\Cvalocal.ini
[2008/11/04 19:25:08 | 00,000,040 | —- | C] () – C:\Windows\System32\sx5363.ini
[2008/09/23 17:26:41 | 00,000,052 | —- | C] () – C:\Windows\System32\windriver32.ini
[2008/08/12 19:07:03 | 00,888,832 | —- | C] () – C:\Windows\System32\securenet.dll
[2008/08/08 19:02:46 | 00,000,056 | -H– | C] () – C:\ProgramData\ezsidmv.dat
[2008/05/20 19:32:13 | 00,000,319 | —- | C] () – C:\Windows\game.ini
[2008/04/28 12:13:33 | 00,000,310 | —- | C] () – C:\Windows\primopdf.ini
[2007/12/18 22:01:23 | 00,001,447 | —- | C] () – C:\Windows\tsplay32.ini
[2007/10/25 22:34:08 | 00,176,235 | —- | C] () – C:\Windows\System32\Primomonnt.dll
[2007/10/25 22:17:17 | 00,000,376 | —- | C] () – C:\Windows\ODBC.INI
[2007/10/24 01:13:53 | 00,000,021 | —- | C] () – C:\Windows\atid.ini
[2007/10/21 23:19:24 | 00,010,752 | —- | C] () – C:\Windows\System32\BASSMOD.dll
[2007/10/21 23:10:43 | 00,000,358 | —- | C] () – C:\Windows\PDF2RTF.INI
[2007/10/21 22:13:49 | 00,001,024 | —- | C] () – C:\ProgramData\x8sjw.sen
[2007/09/04 22:48:25 | 00,140,216 | —- | C] () – C:\Windows\System32\drivers\PnkBstrK.sys
[2007/09/04 21:43:47 | 00,022,328 | —- | C] () – C:\Users\Greg\AppData\Roaming\PnkBstrK.sys
[2007/07/28 16:21:07 | 00,006,656 | —- | C] () – C:\Users\Greg\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007/05/22 18:14:58 | 00,008,784 | —- | C] () – C:\Windows\System32\ractrlkeyhook.dll
[2007/04/27 13:48:59 | 00,000,000 | —- | C] () – C:\Users\Greg\AppData\Roaming\wklnhst.dat
[2007/04/26 16:39:34 | 00,007,592 | —- | C] () – C:\Users\Greg\AppData\Local\d3d9caps.dat
[2007/04/23 16:28:34 | 00,159,744 | —- | C] () – C:\Windows\System32\atitmmxx.dll
[2006/11/02 07:35:32 | 00,005,632 | —- | C] () – C:\Windows\System32\sysprepMCE.dll
[2006/11/02 02:40:29 | 00,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini
[2006/06/23 08:09:34 | 00,019,968 | —- | C] () – C:\Windows\System32\cpuinf32.dll
[2006/04/29 22:34:04 | 00,049,152 | —- | C] () – C:\Windows\System32\WbxRMenu.dll
[2006/04/13 21:18:24 | 00,196,608 | —- | C] () – C:\Windows\System32\atonres.dll
[2006/04/13 21:18:24 | 00,131,072 | —- | C] () – C:\Windows\System32\WbxMSAI.dll
[2006/04/13 21:18:24 | 00,098,304 | —- | C] () – C:\Windows\System32\atonecli.dll
[2003/01/07 14:05:08 | 00,002,695 | —- | C] () – C:\Windows\System32\OUTLPERF.INI
[2002/02/01 15:00:00 | 00,620,544 | —- | C] () – C:\Windows\System32\STLPMT45.DLL

========== LOP Check ==========

[2007/05/31 14:02:28 | 00,000,000 | —D | M] – C:\Users\Greg\AppData\Roaming\acccore
[2007/09/07 10:41:59 | 00,000,000 | —D | M] – C:\Users\Greg\AppData\Roaming\AIM
[2008/08/30 19:11:48 | 00,000,000 | —D | M] – C:\Users\Greg\AppData\Roaming\Auslogics
[2008/11/04 19:25:27 | 00,000,000 | —D | M] – C:\Users\Greg\AppData\Roaming\Avaya
[2009/11/05 17:30:07 | 00,000,000 | —D | M] – C:\Users\Greg\AppData\Roaming\Azureus
[2008/05/16 19:40:12 | 00,000,000 | —D | M] – C:\Users\Greg\AppData\Roaming\backup
[2008/05/16 19:40:12 | 00,000,000 | —D | M] – C:\Users\Greg\AppData\Roaming\Butel
[2009/02/17 23:30:13 | 00,000,000 | —D | M] – C:\Users\Greg\AppData\Roaming\CoreFTP
[2009/05/27 21:29:21 | 00,000,000 | —D | M] – C:\Users\Greg\AppData\Roaming\DAEMON Tools Lite
[2007/11/16 00:34:09 | 00,000,000 | —D | M] – C:\Users\Greg\AppData\Roaming\Deskperience
[2008/11/05 15:25:24 | 00,000,000 | —D | M] – C:\Users\Greg\AppData\Roaming\Elluminate
[2009/01/24 23:43:19 | 00,000,000 | —D | M] – C:\Users\Greg\AppData\Roaming\GlobalSCAPE
[2008/12/15 21:00:48 | 00,000,000 | —D | M] – C:\Users\Greg\AppData\Roaming\gtk-2.0
[2008/11/03 22:32:50 | 00,000,000 | —D | M] – C:\Users\Greg\AppData\Roaming\Hide IP NG
[2009/02/04 14:23:15 | 00,000,000 | —D | M] – C:\Users\Greg\AppData\Roaming\IBP
[2009/02/10 22:29:25 | 00,000,000 | —D | M] – C:\Users\Greg\AppData\Roaming\LimeWire
[2009/08/08 20:35:47 | 00,000,000 | —D | M] – C:\Users\Greg\AppData\Roaming\LiveSoftware
[2009/08/09 13:19:58 | 00,000,000 | —D | M] – C:\Users\Greg\AppData\Roaming\Maxprog
[2008/02/19 23:03:59 | 00,000,000 | —D | M] – C:\Users\Greg\AppData\Roaming\OUGOMessenger
[2009/04/18 18:03:32 | 00,000,000 | —D | M] – C:\Users\Greg\AppData\Roaming\PCToolsFirewallPlus
[2008/02/13 17:16:36 | 00,000,000 | —D | M] – C:\Users\Greg\AppData\Roaming\StumbleUpon
[2007/05/09 20:13:35 | 00,000,000 | —D | M] – C:\Users\Greg\AppData\Roaming\Template
[2009/11/30 21:10:41 | 00,000,000 | —D | M] – C:\Users\Greg\AppData\Roaming\VAT-Spy
[2009/12/15 01:31:27 | 00,000,338 | —- | M] () – C:\Windows\Tasks\McDefragTask.job
[2010/01/01 01:00:27 | 00,000,316 | —- | M] () – C:\Windows\Tasks\McQcTask.job
[2010/01/01 16:31:49 | 00,032,636 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT
[2010/01/08 01:00:00 | 00,000,308 | —- | M] () – C:\Windows\Tasks\vgppmssa.job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >
[1999/06/25 09:55:30 | 00,149,504 | —- | M] () – C:\UNWISE.EXE

< MD5 for: AGP440.SYS >
[2008/01/19 02:42:25 | 00,056,376 | —- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 – C:\Windows\System32\DriverStore\FileRepository\machine.inf_51b95d75\AGP440.sys
[2008/01/19 02:42:25 | 00,056,376 | —- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 – C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys
[2008/01/19 02:42:25 | 00,056,376 | —- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 – C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys
[2008/01/19 02:42:25 | 00,056,376 | —- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 – C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys
[2007/04/23 16:27:04 | 00,053,864 | —- | M] (Microsoft Corporation) MD5=8B10CE1C1F9F1D47E4DEB1A547A00CD4 – C:\Windows\System32\drivers\AGP440.sys
[2007/04/23 16:27:04 | 00,053,864 | —- | M] (Microsoft Corporation) MD5=8B10CE1C1F9F1D47E4DEB1A547A00CD4 – C:\Windows\System32\DriverStore\FileRepository\machine.inf_8ed06b47\AGP440.sys
[2007/04/23 16:27:04 | 00,053,864 | —- | M] (Microsoft Corporation) MD5=8B10CE1C1F9F1D47E4DEB1A547A00CD4 – C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6000.16400_none_b82caac9c18a4e3b\AGP440.sys
[2007/04/23 16:27:04 | 00,053,864 | —- | M] (Microsoft Corporation) MD5=BF34B4A0E0B64440C5389AA6B902F4AD – C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6000.20496_none_b85af81edaeb8461\AGP440.sys
[2006/11/02 04:49:52 | 00,053,864 | —- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 – C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys

< MD5 for: ATAPI.SYS >
[2009/04/11 01:32:26 | 00,019,944 | —- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 – C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys
[2009/04/11 01:32:26 | 00,019,944 | —- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 – C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys
[2008/01/19 02:41:30 | 00,021,560 | —- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 – C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys
[2008/01/19 02:41:30 | 00,021,560 | —- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 – C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
[2006/11/02 04:49:36 | 00,019,048 | —- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F – C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
[2007/04/23 16:27:35 | 00,019,048 | —- | M] (Microsoft Corporation) MD5=5653737BAD8C6C10136451C195C19881 – C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20485_none_db8a029f3dbd443b\atapi.sys
[2007/04/23 16:27:28 | 00,021,688 | —- | M] (Microsoft Corporation) MD5=9E7E85EC61D1C9C3171CC08427108863 – C:\Windows\System32\drivers\atapi.sys
[2007/04/23 16:27:28 | 00,021,688 | —- | M] (Microsoft Corporation) MD5=9E7E85EC61D1C9C3171CC08427108863 – C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_5a9555b4\atapi.sys
[2007/04/23 16:27:28 | 00,021,688 | —- | M] (Microsoft Corporation) MD5=9E7E85EC61D1C9C3171CC08427108863 – C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20509_none_dbe4850d3d78c736\atapi.sys
[2007/04/23 16:27:35 | 00,019,048 | —- | M] (Microsoft Corporation) MD5=A779CA2C76DA4FCB595E692C05E8E4EB – C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_82339ef2\atapi.sys
[2007/04/23 16:27:35 | 00,019,048 | —- | M] (Microsoft Corporation) MD5=A779CA2C76DA4FCB595E692C05E8E4EB – C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16391_none_daf194c024ab5b06\atapi.sys
[2008/02/13 03:04:36 | 00,021,560 | —- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 – C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_7de13c21\atapi.sys
[2008/02/13 03:04:36 | 00,021,560 | —- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 – C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\atapi.sys
[2008/02/13 03:04:35 | 00,021,560 | —- | M] (Microsoft Corporation) MD5=E03E8C99D15D0381E02743C36AFC7C6F – C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_64dfd8ea\atapi.sys
[2008/02/13 03:04:35 | 00,021,560 | —- | M] (Microsoft Corporation) MD5=E03E8C99D15D0381E02743C36AFC7C6F – C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\atapi.sys

< MD5 for: CNGAUDIT.DLL >
[2006/11/02 04:46:03 | 00,011,776 | —- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D – C:\Windows\System32\cngaudit.dll
[2006/11/02 04:46:03 | 00,011,776 | —- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D – C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll

< MD5 for: IASTOR.SYS >
[2006/09/29 12:16:20 | 00,495,896 | —- | M] (Intel Corporation) MD5=C212BE4F068A02E54EB0CF6F5B23569B – C:\Program Files\Intel\Intel Matrix Storage Manager\Driver64\IaStor.sys
[2006/09/29 14:59:58 | 00,250,368 | —- | M] (Intel Corporation) MD5=E9F704CA833BD24BFAA3B4A59707633A – C:\Drivers\storage\R139843\iaStor.sys
[2006/09/29 10:59:58 | 00,250,368 | —- | M] (Intel Corporation) MD5=E9F704CA833BD24BFAA3B4A59707633A – C:\Program Files\Intel\Intel Matrix Storage Manager\Driver\iaStor.sys
[2006/09/29 14:59:58 | 00,250,368 | —- | M] (Intel Corporation) MD5=E9F704CA833BD24BFAA3B4A59707633A – C:\Windows\System32\drivers\iaStor.sys
[2006/09/29 14:59:58 | 00,250,368 | —- | M] (Intel Corporation) MD5=E9F704CA833BD24BFAA3B4A59707633A – C:\Windows\System32\DriverStore\FileRepository\iaahci.inf_6a23f079\iaStor.sys
[2006/09/29 14:59:58 | 00,250,368 | —- | M] (Intel Corporation) MD5=E9F704CA833BD24BFAA3B4A59707633A – C:\Windows\System32\DriverStore\FileRepository\iastor.inf_0afadd92\iaStor.sys

< MD5 for: IASTORV.SYS >
[2008/01/19 02:42:51 | 00,235,064 | —- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 – C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys
[2008/01/19 02:42:51 | 00,235,064 | —- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 – C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys
[2006/11/02 04:51:25 | 00,232,040 | —- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 – C:\Windows\System32\drivers\iaStorV.sys
[2006/11/02 04:51:25 | 00,232,040 | —- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 – C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys

< MD5 for: NETLOGON.DLL >
[2006/11/02 04:46:11 | 00,559,616 | —- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B – C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6000.16386_none_fb80f5473b0ed783\netlogon.dll
[2009/04/11 01:28:23 | 00,592,896 | —- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE – C:\Windows\System32\netlogon.dll
[2009/04/11 01:28:23 | 00,592,896 | —- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE – C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll
[2008/01/19 02:35:36 | 00,592,384 | —- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F – C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll

< MD5 for: NVSTOR.SYS >
[2006/11/02 04:50:13 | 00,040,040 | —- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC – C:\Windows\System32\drivers\nvstor.sys
[2006/11/02 04:50:13 | 00,040,040 | —- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC – C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys
[2008/01/19 02:42:09 | 00,045,112 | —- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 – C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys
[2008/01/19 02:42:09 | 00,045,112 | —- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 – C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys

< MD5 for: SCECLI.DLL >
[2008/01/19 02:36:19 | 00,177,152 | —- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 – C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll
[2006/11/02 04:46:12 | 00,176,640 | —- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 – C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6000.16386_none_35d7205fdc305e3e\scecli.dll
[2009/04/11 01:28:24 | 00,177,152 | —- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 – C:\Windows\System32\scecli.dll
[2009/04/11 01:28:24 | 00,177,152 | —- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 – C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll

< %systemroot%\*. /mp /s >

========== Alternate Data Streams ==========

@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:1CA73D29
@Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:A9662AE0
@Alternate Data Stream - 107 bytes -> C:\ProgramData\TEMP:C31F31E6
@Alternate Data Stream - 103 bytes -> C:\ProgramData\TEMP:4B7BEAFF
@Alternate Data Stream - 100 bytes -> C:\ProgramData\TEMP:66B26419
< End of report >

_____________________________________________________________________________
Extras.TXT
_____________________________________________________________________________

OTL Extras logfile created on: 1/8/2010 1:45:01 AM - Run 1
OTL by OldTimer - Version 3.1.21.1 Folder = C:\Users\Greg\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 70.00% Memory free
6.00 Gb Paging File | 5.00 Gb Available in Paging File | 83.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 222.78 Gb Total Space | 98.56 Gb Free Space | 44.24% Space Free | Partition Type: NTFS
Drive D: | 10.00 Gb Total Space | 5.92 Gb Free Space | 59.22% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: GREG-PC
Current User Name: Greg
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.hlp [@ = hlpfile] – C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = htmlfile] – C:\Program Files\Internet Explorer\IEXPLORE.EXE (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.com [@ = ComFile] – Reg Error: Key error. File not found
.exe [@ = exefile] – Reg Error: Key error. File not found
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
hlpfile [open] – %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile – "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [open] – "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome (Microsoft Corporation)
htmlfile [opennew] – "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation)
htmlfile [print] – "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" /p %1 (Microsoft Corporation)
http [open] – "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome (Microsoft Corporation)
https [open] – "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Winamp.Bookmark] – "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)
Directory [Winamp.Enqueue] – "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft)
Directory [Winamp.Play] – "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft)
Folder [open] – %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] – "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] – "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiSpyware]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type – File not found
"VistaSp2" = Reg Error: Unknown registry data type – File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\BitTorrent\bittorrent.exe" = C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent – File not found
"C:\Program Files\IBP 9\IBP.exe" = C:\Program Files\IBP 9\IBP.exe:*:Enabled:Internet Business Promoter (IBP) – File not found

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0CB66EA2-83E5-4C58-AB59-C511693C2F3A}" = lport=2869 | protocol=6 | dir=in | app=system |
"{41B8F1AC-707A-4E3C-BFA3-E5E8509202B4}" = lport=1900 | protocol=17 | dir=in | name=intel® viiv™ media server upnp discovery |
"{D00C3374-13A8-4479-9EBC-857F86B03211}" = lport=9442 | protocol=17 | dir=in | name=intel® viiv™ media server discovery |
"{F2E6D7F2-1DB9-47CB-AF49-27AD01D11C48}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0CD01DDE-4339-4237-9C65-F66D63877E16}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe |
"{10B6DC80-3070-4FC6-B59D-A2F2878962ED}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe |
"{112623F2-06E1-4575-A5D7-10B7115246E1}" = protocol=6 | dir=in | app=c:\program files\yahoo!\messenger\yserver.exe |
"{1977DC2F-1D35-4E9E-AD27-1B2AABA3A9A2}" = protocol=17 | dir=in | app=c:\program files\yahoo!\messenger\yserver.exe |
"{1AD3B3AC-1094-4921-8083-7E94D2FE3186}" = dir=in | app=c:\program files\common files\mcafee\mna\mcnasvc.exe |
"{2274DEB0-A84E-45EE-BE8D-C69AA4609CC0}" = protocol=6 | dir=in | app=c:\program files\common files\aol\loader\aolload.exe |
"{2816DF99-409D-462C-AC07-4B6EBF5DC0C6}" = dir=in | app=c:\program files\windows live\messenger\wlcsdk.exe |
"{30A02838-9746-421E-B09E-66D88B3860F1}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstra.exe |
"{32C9B139-7E93-4254-9C41-B24D6A400DBF}" = protocol=17 | dir=in | app=c:\program files\common files\aol\loader\aolload.exe |
"{371DEE0C-A2F5-4622-BAD1-63DB23269E2E}" = protocol=17 | dir=in | app=c:\program files\yahoo!\yahoo! music jukebox\yahoomusicengine.exe |
"{4308B454-9D96-4E04-844D-EC25BB63F987}" = protocol=6 | dir=in | app=c:\program files\aim6\aim6.exe |
"{4585B7F7-FB9A-41EF-8423-B390E02BB9B4}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstrb.exe |
"{463D894E-4538-4682-ADF0-48569CF6E665}" = protocol=17 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |
"{465C4111-490E-4A17-9967-32DCC6515A71}" = protocol=6 | dir=in | app=c:\program files\bittorrent\bittorrent.exe |
"{4C9142D2-0526-4591-82A4-CDC55F0BDED8}" = protocol=17 | dir=in | app=c:\program files\activision\call of duty 4 - modern warfare\iw3mp.exe |
"{4D0FC031-20DB-4E63-B3ED-BF75990DBDA3}" = protocol=6 | dir=in | app=c:\program files\intel\inteldh\intel media server\media server\bin\mediaserver.exe |
"{4DEF8122-8766-478B-9FDF-E935D4DF7288}" = protocol=17 | dir=in | app=c:\program files\intel\inteldh\intel media server\media server\bin\tshwmdtcp.exe |
"{582FA877-F1CD-479B-A4C4-9B625A58A7C5}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{5855607B-D854-4D82-980B-B740F3699633}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe |
"{5DE1F29A-86AF-475D-A0D3-0E89A1A59114}" = protocol=17 | dir=in | app=c:\program files\bittorrent\bittorrent.exe |
"{5F04B46E-E533-4492-AB51-A1994F5567A9}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{631CE520-E8DF-4AE3-86A3-72E67BFAAD32}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\left 4 dead\left4dead.exe |
"{654DC468-44D3-4FFF-A104-E633C7FAB4CF}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\left 4 dead\left4dead.exe |
"{6563E3CE-4976-4722-AA14-AEAE6E776AE9}" = protocol=17 | dir=in | app=c:\program files\aim6\aim6.exe |
"{71A45176-8BA7-4D8A-A136-75960E5AA6FC}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{82E82DCD-F02C-4804-A8A6-92C704AF88C0}" = protocol=6 | dir=in | app=c:\program files\ea games\battlefield 2\bf2.exe |
"{84078C89-7EC3-40F0-B4A0-157D0EB9B7CE}" = protocol=6 | dir=in | app=c:\program files\activision\call of duty 4 - modern warfare\iw3mp.exe |
"{8BAB697C-D40A-4D86-842F-FBB18D002A1A}" = protocol=6 | dir=in | app=c:\program files\dna\btdna.exe |
"{A12C8F03-5A40-4585-8D41-09A635B37430}" = protocol=17 | dir=in | app=c:\program files\intel\inteldh\intel media server\shells\remote ui service.exe |
"{A8F95294-5DAA-4CD2-952B-76775592E5C8}" = protocol=6 | dir=in | app=c:\program files\intel\inteldh\intel media server\media server\bin\tshwmdtcp.exe |
"{AC121FDF-4B5E-4C7D-B06D-A6E1976CC3CE}" = protocol=17 | dir=in | app=c:\program files\ea games\battlefield 2\bf2.exe |
"{AC405A6D-974B-43FA-96F9-C87850A19B08}" = protocol=6 | dir=in | app=c:\program files\yahoo!\yahoo! music jukebox\yahoomusicengine.exe |
"{B4C39CCB-7BF4-4E6F-AE48-BD1D3A3C148E}" = protocol=6 | dir=in | app=c:\program files\common files\aol\loader\aolload.exe |
"{BB74DCA2-2161-44B5-8305-E9107AD96E16}" = protocol=17 | dir=in | app=c:\program files\aim6\aim6.exe |
"{BDA211DB-8EB6-4433-B613-F992BEE21F8A}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\left 4 dead\left4dead.exe |
"{D99F8354-66AD-4BCF-BE7F-27FFFA08B9F0}" = protocol=6 | dir=in | app=c:\program files\intel\inteldh\intel media server\shells\remote ui service.exe |
"{DE6B7446-D2A2-4914-96D4-EE4367333A00}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstra.exe |
"{E1DA57F3-1E7D-48DD-B766-C124FB825DDA}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe |
"{E5AF6EB2-18F3-4230-A2D1-D1BDAC5F6CB8}" = protocol=17 | dir=in | app=c:\program files\intel\inteldh\intel media server\media server\bin\mediaserver.exe |
"{E721200E-5810-4BC9-8913-DA89461542FE}" = protocol=6 | dir=in | app=c:\program files\aim6\aim6.exe |
"{EBADDDDB-8E76-426D-9124-C0F90522630A}" = protocol=17 | dir=in | app=c:\program files\common files\aol\loader\aolload.exe |
"{EBEC1761-6E42-44E0-BA3A-2BB30BB08251}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstrb.exe |
"{F6486D75-3F9B-4F88-B71F-A9A2CBFC3F9D}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\left 4 dead\left4dead.exe |
"{F7C98697-5A32-4254-A9C5-146E4617E304}" = protocol=17 | dir=in | app=c:\program files\dna\btdna.exe |
"{FE224604-C76A-4C66-BEB8-91EC57CF51DE}" = protocol=6 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |
"TCP Query User{296A80EA-1A5B-475B-8203-78EC239C07B2}C:\program files\yahoo!\messenger\yahoomessenger.exe" = protocol=6 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |
"UDP Query User{9BF084AE-8FD6-42B1-91FF-2C8B467F4121}C:\program files\yahoo!\messenger\yahoomessenger.exe" = protocol=17 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{0046FA01-C5B9-4985-BACB-398DC480FC05}" = Adobe Photoshop CS3
"{04179174-F3AC-4CE6-BBBE-83B46D5041CB}" = SocialBot
"{04AF207D-9A77-465A-8B76-991F6AB66245}" = Adobe Help Viewer CS3
"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
"{08B32819-6EEF-4057-AEDA-5AB681A36A23}" = Adobe Bridge Start Meeting
"{0E20BC97-0C98-75D5-A95C-1BA122FA16D0}" = ccc-core-static
"{13BA7B44-B712-4DEE-A7B8-1DD564F37AE5}" = Dell System Customization Wizard
"{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}" = Adobe WinSoft Linguistics Plugin
"{1C7589DD-6D83-42A7-BD36-58E6FAF99808}" = Avaya IP Agent
"{1CA0B2FD-CE9E-44F8-8667-7E4084B47F4F}" = Avaya IP Agent
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{24D7346D-D4B4-45E8-98EA-75EC14B42DD8}" = Adobe ExtendScript Toolkit 2
"{26C610BF-761B-4209-BD6A-A0F1B73D6DDE}" = Intel® Viiv™ Software
"{29E5EA97-5F74-4A57-B8B2-D4F169117183}" = Adobe Stock Photos CS3
"{2EA870FA-585F-4187-903D-CB9FFD21E2E0}" = DHTML Editing Component
"{3248F0A8-6813-11D6-A77B-00B0D0160000}" = Java™ SE Runtime Environment 6
"{35E1EC43-D4FC-4E4A-AAB3-20DDA27E8BB0}" = Sonic Activation Module
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{3BD633E0-4BF8-4499-9149-88F0767D449C}" = Call of Duty® 4 - Modern Warfare™ 1.4 Patch
"{44CD7894-4B9A-0F27-7B3A-4C36D19FBBD0}" = ccc-utility
"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant
"{51846830-E7B2-4218-8968-B77F0FF475B8}" = Adobe Color EU Extra Settings
"{54793AA1-5001-42F4-ABB6-C364617C6078}" = Adobe Linguistics CS3
"{5A16ED74-A6B8-EBF3-911D-F669113ED7F9}" = Catalyst Control Center Graphics Previews Vista
"{5CD29180-A95E-11D3-A4EB-00C04F7BDB2C}" = User's Guides
"{6087F45E-358C-4173-8CB1-DE0AE26FFAE1}" = Catalyst Control Center - Branding
"{61D9BE89-079C-28F5-12E0-2E9E4EAA8808}" = Catalyst Control Center Graphics Full New
"{6492E083-6C10-4973-B851-D723448CA797}_is1" = ComTekk
"{64C1FA9A-FA94-4B6E-B3E4-8573738E4AD1}" = Adobe Setup
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6ABE0BEE-D572-4FE8-B434-9E72A289431B}" = Adobe Fonts All
"{6D4AC5A4-4CF9-4F90-8111-B9B53CE257BF}" = Adobe Color Common Settings
"{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}" = Adobe Asset Services CS3
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{73C8DECD-5948-F3DB-6B38-B7AF881647A6}" = ATI Catalyst Install Manager
"{76333074-2472-5945-CED7-1BA2F09FC23B}" = Catalyst Control Center Graphics Full Existing
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7879A576-810F-50F6-A919-756C23DE095F}" = CCC Help English
"{7EFA5E6F-74F7-4AFB-8AEA-AA790BD3A76D}" = DellSupport
"{802771A9-A856-4A41-ACF7-1450E523C923}" = Adobe XMP Panels CS3
"{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}" = Windows Live Essentials
"{84C9913A-C64B-F227-AB07-D04C7EC7E5F2}" = Catalyst Control Center Graphics Light
"{8503C901-85D7-4262-88D2-8D8B2A7B08B8}" = Call of Duty® 4 - Modern Warfare™ 1.5 Patch
"{8A15B7D9-908A-4EF9-BA84-5AEDE61743EE}" = Call of Duty® 4 - Modern Warfare™ 1.6 Patch
"{8CBDD204-BF4E-4284-B117-465A02883B81}" = Linksys WMP110 RangePlus Wireless PCI Adapter Driver - WMP110
"{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}" = Adobe Device Central CS3
"{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}" = Adobe Type Support
"{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90176341-0A8B-4CCC-A78D-F862228A6B95}" = Adobe Anchor Service CS3
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager
"{91F34319-08DE-457a-99C0-0BCDFAC145B9}" = CuteFTP 8 Professional
"{931C37FC-594D-43A9-B10F-A2F2B1F03498}" = Call of Duty® 4 - Modern Warfare™ 1.7 Patch
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9527A496-5DF9-412A-ADC7-168BA5379CA6}" = Microsoft Flight Simulator X
"{95655ED4-7CA5-46DF-907F-7144877A32E5}" = Adobe Color NA Recommended Settings
"{9C9824D9-9000-4373-A6A5-D0E5D4831394}" = Adobe Bridge CS3
"{A2B242BD-FF8D-4840-9DAA-9170EABEC59C}" = Adobe CMaps
"{A2D81E70-2A98-4A08-A628-94388B063C5E}" = Adobe Color - Photoshop Specific
"{A429C2AE-EBF1-4F81-A221-1C115CAADDAD}" = QuickTime
"{A462213D-EED4-42C2-9A60-7BDD4D4B0B17}" = SigmaTel Audio
"{A85FD55B-891B-4314-97A5-EA96C0BD80B5}" = Windows Live Messenger
"{A9729B90-D37B-4A69-B66A-7436AC1F7274}" = Microsoft Flight Simulator X: Acceleration
"{AADEA55D-C834-4BCB-98A3-4B8D1C18F4EE}" = Apple Mobile Device Support
"{AB2AB300-1A60-FB33-96E5-D92BA2879E16}" = Catalyst Control Center Core Implementation
"{AC5B0C19-D851-42F4-BDA0-410ECF7F70A5}" = PDF Settings
"{AC76BA86-7AD7-1033-7B44-A81300000003}" = Adobe Reader 8.1.3
"{AF5A39FE-51FB-4BA3-B399-2D1F0C65D617}_is1" = AusLogics System Information
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}" = Adobe Camera Raw 4.0
"{B3C02EC1-A7B0-4987-9A43-8789426AAA7D}" = Adobe Setup
"{B607C354-CD79-4D22-86D1-92DC94153F42}" = Apple Application Support
"{B9B35331-B7E4-4E5C-BF4C-7BC87856124D}" = Adobe Default Language CS3
"{BCD3D810-44AF-4536-ABB8-521B59D8E544}" = Learning Environment
"{C4124E95-5061-4776-8D5D-E3D931C778E1}" = Microsoft VC9 runtime libraries
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D0DFF92A-492E-4C40-B862-A74A173C25C5}" = Adobe Version Cue CS3 Client
"{D1A74FBB-CA8D-4CCA-9B89-BAAA436DB178}" = iTunes
"{D1BB4446-AE9C-4256-9A7F-4D46604D2462}" = Adobe Setup
"{D2559B88-CC9D-4B48-81BB-F492BAA9C48C}" = Adobe PDF Library Files
"{DD7DB3C5-6FA3-4FA3-8A71-C2F2940EB029}" = Adobe Color JA Extra Settings
"{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}" = Ad-Aware
"{E0E1C638-ABF4-CE43-B4EC-61FD2FDDAD06}" = Catalyst Control Center HydraVision Full
"{E2D757D9-369A-C2B2-B58E-3878FDDBA7F8}" = Catalyst Control Center Graphics Previews Common
"{E48469CC-635E-4FD5-A122-1497C286D217}" = Call of Duty® 4 - Modern Warfare™
"{E69AE897-9E0B-485C-8552-7841F48D42D8}" = Adobe Update Manager CS3
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F1357B2E-CECE-83C7-93F3-C13DDB811D4B}" = Skins
"{F5346614-B7C4-4E94-826A-E2363155233D}" = EasyCleaner
"{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call
"{FE7160F6-45DC-44E0-BC90-ED37FD16D494}" = Bristol Britannia for FSX
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11
"Adobe_2ac78060bc5856b0c1cf873bb919b58" = Adobe Photoshop CS3
"Adobe_3e054d2218e7aa282c2369d939e58ff" = Adobe ExtendScript Toolkit 2
"Adobe_6c8e2cb4fd241c55406016127a6ab2e" = Adobe Color Common Settings
"AIM_6" = AIM 6
"AV Voice Changer Software DIAMOND 6.0" = AV Voice Changer Software DIAMOND 6.0
"File And MP3 Tag Renamer_is1" = File And MP3 Tag Renamer 2.2
"FlightSim_{A9729B90-D37B-4A69-B66A-7436AC1F7274}" = Microsoft Flight Simulator X: Acceleration
"Free PDF to Word Doc Converter_is1" = Free PDF to Word Doc Converter v1.1
"HijackThis" = HijackThis 2.0.2
"InstallShield_{3BD633E0-4BF8-4499-9149-88F0767D449C}" = Call of Duty® 4 - Modern Warfare™ 1.4 Patch
"InstallShield_{8503C901-85D7-4262-88D2-8D8B2A7B08B8}" = Call of Duty® 4 - Modern Warfare™ 1.5 Multiplayer Patch
"InstallShield_{8A15B7D9-908A-4EF9-BA84-5AEDE61743EE}" = Call of Duty® 4 - Modern Warfare™ 1.6 Patch
"InstallShield_{931C37FC-594D-43A9-B10F-A2F2B1F03498}" = Call of Duty® 4 - Modern Warfare™ 1.7 Patch
"InstallShield_{9527A496-5DF9-412A-ADC7-168BA5379CA6}" = Microsoft Flight Simulator X
"InstallShield_{E48469CC-635E-4FD5-A122-1497C286D217}" = Call of Duty® 4 - Modern Warfare™
"Intel® Configuration Center" = Intel® Viiv™ Software
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.5.7)" = Mozilla Firefox (3.5.7)
"MSC" = McAfee SecurityCenter
"PrimoPDF4.1.0.9" = PrimoPDF
"PunkBusterSvc" = PunkBuster Services
"RealPlayer 6.0" = RealPlayer
"RTMshadow_{A9729B90-D37B-4A69-B66A-7436AC1F7274}" = Flight Simulator X
"SP1shadow_{A9729B90-D37B-4A69-B66A-7436AC1F7274}" = Flight Simulator X Service Pack 1
"SystemRequirementsLab" = System Requirements Lab
"UniqueContentMakerApplication_is1" = UCM
"VeryDOC PDF To Word Converter_is1" = VeryDOC PDF To Word Converter v2.5
"ViewpointMediaPlayer" = Viewpoint Media Player
"Winamp" = Winamp
"Windows Vending" = Windows Vending
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR archiver
"Yahoo! Messenger" = Yahoo! Messenger

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{226b64e8-dc75-4eea-a6c8-abcb496320f2}-Google Talk" = Google Talk (remove only)

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 12/7/2009 9:37:15 AM | Computer Name = Greg-PC | Source = Application Hang | ID = 1002
Description = The program msnmsgr.exe version 14.0.8089.726 stopped interacting
with Windows and was closed. To see if more information about the problem is available,
check the problem history in the Problem Reports and Solutions control panel. Process
ID: 19f4 Start Time: 01ca771b4df172e0 Termination Time: 16

Error - 12/10/2009 6:17:17 AM | Computer Name = Greg-PC | Source = Microsoft Office 11 | ID = 2001
Description =

Error - 12/14/2009 10:25:13 AM | Computer Name = Greg-PC | Source = Application Hang | ID = 1002
Description = The program EXCEL.EXE version 11.0.8316.0 stopped interacting with
Windows and was closed. To see if more information about the problem is available,
check the problem history in the Problem Reports and Solutions control panel. Process
ID: e58 Start Time: 01ca7cc929e88d51 Termination Time: 4378

Error - 12/14/2009 2:52:44 PM | Computer Name = Greg-PC | Source = Application Error | ID = 1000
Description = Faulting application YahooMessenger.exe, version 9.0.0.2128, time
stamp 0x498a38d0, faulting module WININET.dll, version 7.0.6002.18130, time stamp
0x4ae6ffc2, exception code 0xc0000005, fault offset 0x0003f7cf, process id 0x1368,
application start time 0x01ca7ce6a2b5c669.

Error - 12/16/2009 7:48:02 AM | Computer Name = Greg-PC | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 7.0.6002.18005, time stamp
0x49e01e78, faulting module ntdll.dll, version 6.0.6002.18005, time stamp 0x49e03821,
exception code 0xc0000374, fault offset 0x000afaf8, process id 0xbcc, application
start time 0x01ca7e44a2798249.

Error - 12/16/2009 11:17:58 AM | Computer Name = Greg-PC | Source = Application Error | ID = 1000
Description = Faulting application EasyClea.exe, version 2.0.6.380, time stamp 0x2a425e19,
faulting module shell32.dll, version 6.0.6002.18005, time stamp 0x49e037ec, exception
code 0xc0000005, fault offset 0x00093389, process id 0xde0, application start time
0x01ca7e6007ee7489.

Error - 12/16/2009 7:05:34 PM | Computer Name = Greg-PC | Source = Application Error | ID = 1000
Description = Faulting application fsx.exe, version 10.0.61637.0, time stamp 0x46fadb14,
faulting module atiumdag.dll, version 7.14.10.567, time stamp 0x47edbffa, exception
code 0xc0000005, fault offset 0x002294ea, process id 0x1424, application start time
0x01ca7ea32ba347f9.

Error - 12/16/2009 7:09:15 PM | Computer Name = Greg-PC | Source = Application Error | ID = 1000
Description = Faulting application fsx.exe, version 10.0.61637.0, time stamp 0x46fadb14,
faulting module atiumdag.dll, version 7.14.10.567, time stamp 0x47edbffa, exception
code 0xc0000005, fault offset 0x002294ea, process id 0xd08, application start time
0x01ca7ea45b0b00e9.

Error - 12/16/2009 7:19:45 PM | Computer Name = Greg-PC | Source = Application Error | ID = 1000
Description = Faulting application fsx.exe, version 10.0.61637.0, time stamp 0x46fadb14,
faulting module atiumdag.dll, version 7.14.10.567, time stamp 0x47edbffa, exception
code 0xc0000005, fault offset 0x002294ea, process id 0x16e4, application start time
0x01ca7ea4d574bdd9.

Error - 12/16/2009 7:38:14 PM | Computer Name = Greg-PC | Source = Application Hang | ID = 1002
Description = The program fsx.exe version 10.0.61637.0 stopped interacting with
Windows and was closed. To see if more information about the problem is available,
check the problem history in the Problem Reports and Solutions control panel. Process
ID: f9c Start Time: 01ca7ea73fc3a711 Termination Time: 22

[ System Events ]
Error - 12/30/2009 8:22:21 PM | Computer Name = Greg-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 1/1/2010 5:20:45 PM | Computer Name = Greg-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 1/1/2010 5:34:26 PM | Computer Name = Greg-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 1/1/2010 10:15:24 PM | Computer Name = Greg-PC | Source = netbt | ID = 4319
Description = A duplicate name has been detected on the TCP network. The IP address
of the computer that sent the message is in the data. Use nbtstat -n in a command
window to see which name is in the Conflict state.

Error - 1/1/2010 10:22:01 PM | Computer Name = Greg-PC | Source = netbt | ID = 4319
Description = A duplicate name has been detected on the TCP network. The IP address
of the computer that sent the message is in the data. Use nbtstat -n in a command
window to see which name is in the Conflict state.

Error - 1/8/2010 2:32:19 AM | Computer Name = Greg-PC | Source = Service Control Manager | ID = 7031
Description =

Error - 1/8/2010 2:34:19 AM | Computer Name = Greg-PC | Source = EventLog | ID = 6008
Description = The previous system shutdown at 1:31:52 AM on 1/8/2010 was unexpected.

Error - 1/8/2010 2:36:00 AM | Computer Name = Greg-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 1/8/2010 2:40:44 AM | Computer Name = Greg-PC | Source = EventLog | ID = 6008
Description = The previous system shutdown at 1:39:15 AM on 1/8/2010 was unexpected.

Error - 1/8/2010 2:42:26 AM | Computer Name = Greg-PC | Source = Service Control Manager | ID = 7000
Description =

< End of report >

Tomk

Post #5January 8, 2010, 5:41 PM UTC

Gregory,

Download Rooter.exe to your desktop

Then doubleclick it to start the tool
A Notepad file containing the report will open, also found at %systemdrive%\Rooter.txt. Post that here

Gregory

Post #6January 9, 2010, 10:51 PM UTC

Rooter.exe (v1.0.2) by Eric_71
.
The token does not have the SeDebugPrivilege privilege ! (error:1300)
Can not acquire SeDebugPrivilege !
Please run the tool as administrator ..
.
Windows Vista Home Edition (6.0.6002) Service Pack 2
[32_bits] - x86 Family 6 Model 15 Stepping 6, GenuineIntel
.
Error OpenService (wscsvc) : 6
Error OpenSCManager : 5
Error OpenService (MpsSvc) : 6
Windows Defender -> Disabled !
User Account Control (UAC) -> Enabled
.
Internet Explorer 7.0.6002.18005
Mozilla Firefox 3.5.7 (en-US)
.
C:\ [Fixed-NTFS] .. ( Total:222 Go - Free:99 Go )
D:\ [Fixed-NTFS] .. ( Total:9 Go - Free:5 Go )
E:\ [CD_Rom]
.
Scan : 17:50.53
Path : C:\Users\Greg\Downloads\Rooter.exe
User : Greg ( Administrator -> YES )
.
———————-\\ Processes
.
Locked [System Process] (0)
Locked System (4)
Locked smss.exe (500)
Locked csrss.exe (576)
Locked wininit.exe (636)
Locked csrss.exe (648)
Locked services.exe (680)
Locked winlogon.exe (732)
Locked lsass.exe (764)
Locked lsm.exe (772)
Locked svchost.exe (900)
Locked svchost.exe (960)
Locked Ati2evxx.exe (1092)
Locked svchost.exe (1124)
Locked svchost.exe (1180)
Locked svchost.exe (1192)
Locked audiodg.exe (1272)
Locked SLsvc.exe (1304)
Locked svchost.exe (1344)
Locked Ati2evxx.exe (1404)
Locked svchost.exe (1552)
Locked aawservice.exe (1664)
______ C:\Windows\system32\Dwm.exe (1856)
______ C:\Windows\Explorer.EXE (1880)
Locked spoolsv.exe (384)
Locked svchost.exe (420)
______ C:\Windows\system32\taskeng.exe (888)
Locked taskeng.exe (1784)
Locked AlertService.exe (1484)
Locked AppleMobileDeviceService.exe (1332)
Locked mDNSResponder.exe (1848)
Locked DQLWinService.exe (1072)
Locked IAANTmon.exe (1916)
Locked McSACore.exe (1120)
Locked McProxy.exe (1044)
Locked Mcshield.exe (2068)
Locked rundll32.exe (2108)
Locked MpfSrv.exe (2156)
Locked PnkBstrA.exe (2260)
Locked svchost.exe (2316)
Locked svchost.exe (2352)
Locked ViewpointService.exe (2392)
Locked svchost.exe (2436)
Locked SearchIndexer.exe (2480)
Locked issm.exe (2632)
Locked MCLServiceATL.exe (2692)
Locked mediaserver.exe (2952)
Locked Remote UI Service.exe (3068)
Locked mcmscsvc.exe (3544)
______ C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (3588)
______ C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (3636)
______ C:\Program Files\Intel\IntelDH\CCU\CCU_TrayIcon.exe (3676)
______ C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe (3692)
______ C:\Windows\WindowsMobile\wmdSync.exe (3748)
______ C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (3772)
______ c:\PROGRA~1\mcafee.com\agent\mcagent.exe (3780)
______ C:\Windows\sttray.exe (3856)
______ C:\Program Files\iTunes\iTunesHelper.exe (3920)
______ C:\Program Files\Intel\IntelDH\CCU\CCU_Engine.exe (3960)
Locked svchost.exe (4036)
Locked iPodService.exe (3308)
______ C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (3628)
Locked mcsysmon.exe (5568)
Locked McNASvc.exe (5860)
Locked rundll32.exe (4428)
______ C:\Program Files\Common Files\Real\Update_OB\realsched.exe (5684)
______ C:\Program Files\Mozilla Firefox\firefox.exe (2932)
______ C:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32.exe (3112)
______ C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (4408)
Locked WmiPrvSE.exe (3888)
Locked SearchProtocolHost.exe (1800)
Locked SearchFilterHost.exe (5048)
______ C:\Users\Greg\Downloads\Rooter.exe (5536)
.
———————-\\ Device\Harddisk0\
.
\Device\Harddisk0 [Sectors : 63 x 512 Bytes]
.
\Device\Harddisk0\Partition1 (Start_Offset:32256 | Length:57544704)
\Device\Harddisk0\Partition2 (Start_Offset:57671680 | Length:10737418240)
\Device\Harddisk0\Partition3 –[ MBR ]– (Start_Offset:10795089920 | Length:239203254272)
.
———————-\\ Scheduled Tasks
.
C:\Windows\Tasks\McDefragTask.job
C:\Windows\Tasks\McQcTask.job
C:\Windows\Tasks\SA.DAT
C:\Windows\Tasks\SCHEDLGU.TXT
C:\Windows\Tasks\vgppmssa.job
.
———————-\\ Registry
.
.
———————-\\ Files & Folders
.
———————-\\ Scan completed at 17:51.08
.
C:\Rooter$\Rooter_1.txt - (09/01/2010 | 17:51.08)

Tomk

Post #7January 10, 2010, 6:17 AM UTC

Gregory,

Double click on OTL

Under the Custom Scans/Fixes box at the bottom, paste in the following
Do Not copy the word CODE
please note the fix starts with the :

:Processes
explorer.exe

:OTL
SRV - (stllssvr) – File not found
FF - prefs.js..browser.search.selectedEngine: "WarezBB (all terms)"
[2009/02/12 22:40:24 | 00,003,163 | —- | M] () – C:\Users\Greg\AppData\Roaming\Mozilla\Firefox\Profiles\5pdxn7ey.default\searchplugins\warezbb-all-terms.xml
[2009/02/12 22:39:49 | 00,003,161 | —- | M] () – C:\Users\Greg\AppData\Roaming\Mozilla\Firefox\Profiles\5pdxn7ey.default\searchplugins\warezbb-any-term.xml
O2 - BHO: (BitComet Helper) - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.11.30.dll File not found
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {BFB5F154-9212-46F3-B547-AC6106030A54} - No CLSID value found.
O9 - Extra Button: Web Replay - {3401B8CC-95A4-4dbe-B73F-00E2D23F2B73} - C:\Program Files\Deskperience\Web Replay\ShowToolbar.dll File not found
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O9 - Extra 'Tools' menuitem : Avaya Web Dialer - {A26ABCF0-1C8F-46e7-A67C-0489DC21B9CC} - Reg Error: Value error. File not found
O9 - Extra Button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.11.30.dll File not found
O33 - MountPoints2\{d7120ef3-9288-11dc-9d0d-0019d16aa44f}\Shell - "" = AutoRun
O33 - MountPoints2\{d7120ef3-9288-11dc-9d0d-0019d16aa44f}\Shell\AutoRun\command - "" = G:\LaunchU3.exe – File not found
O33 - MountPoints2\{d7990d8a-4b2e-11de-8667-0019d16aa44f}\Shell - "" = AutoRun
O33 - MountPoints2\{d7990d8a-4b2e-11de-8667-0019d16aa44f}\Shell\AutoRun\command - "" = F:\files\openindex.exe index.hta – File not found
[2010/01/08 01:00:00 | 00,000,308 | —- | M] () – C:\Windows\tasks\vgppmssa.job
[2009/02/27 21:31:23 | 00,000,224 | —- | C] () – C:\Windows\System32\filerenamerred.sys


:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]

Then click the Run Fix button at the top

Let the program run unhindered
Please save the resulting log to be posted in your next reply.
Reboot your computer

Please post the OTL log.

Then

Download ComboFix from one of these locations:

Link 1
Link 2
Link 3

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link –> http://forums.whatthetech.com/How_Disable_…ams_t96260.html
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
4. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
5. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Gregory

Post #8January 10, 2010, 9:21 AM UTC

All processes killed ========== PROCESSES ========== No active process named explorer.exe was found! ========== OTL ========== Service stllssvr stopped successfully! Service stllssvr deleted successfully! File File not found not found. Prefs.js: "WarezBB (all terms)" removed from browser.search.selectedEngine C:\Users\Greg\AppData\Roaming\Mozilla\Firefox\Profiles\5pdxn7ey.default\searchplugins\warezbb-all-terms.xml moved successfully. C:\Users\Greg\AppData\Roaming\Mozilla\Firefox\Profiles\5pdxn7ey.default\searchplugins\warezbb-any-term.xml moved successfully. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{39F7E362-828A-4B5A-BCAF-5B79BFDFEA60}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{39F7E362-828A-4B5A-BCAF-5B79BFDFEA60}\ deleted successfully. Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{BFB5F154-9212-46F3-B547-AC6106030A54} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BFB5F154-9212-46F3-B547-AC6106030A54}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{3401B8CC-95A4-4dbe-B73F-00E2D23F2B73}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3401B8CC-95A4-4dbe-B73F-00E2D23F2B73}\ not found. Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{A26ABCF0-1C8F-46e7-A67C-0489DC21B9CC}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A26ABCF0-1C8F-46e7-A67C-0489DC21B9CC}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d7120ef3-9288-11dc-9d0d-0019d16aa44f}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d7120ef3-9288-11dc-9d0d-0019d16aa44f}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d7120ef3-9288-11dc-9d0d-0019d16aa44f}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d7120ef3-9288-11dc-9d0d-0019d16aa44f}\ not found. File G:\LaunchU3.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d7990d8a-4b2e-11de-8667-0019d16aa44f}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d7990d8a-4b2e-11de-8667-0019d16aa44f}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d7990d8a-4b2e-11de-8667-0019d16aa44f}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d7990d8a-4b2e-11de-8667-0019d16aa44f}\ not found. File F:\files\openindex.exe index.hta not found. C:\Windows\Tasks\vgppmssa.job moved successfully. C:\Windows\System32\filerenamerred.sys moved successfully. ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Greg ->Temp folder emptied: 2545610 bytes ->Temporary Internet Files folder emptied: 214252518 bytes ->Java cache emptied: 37684146 bytes ->FireFox cache emptied: 104201983 bytes User: IUSR_NMPR ->Temp folder emptied: 909932 bytes ->Temporary Internet Files folder emptied: 0 bytes User: LogMeInRemoteUser ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes User: LogMeInRemoteUser.Greg-PC ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Public %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 13002 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 343.00 mb OTL by OldTimer - Version 3.1.23.0 log created on 01102010_041516 Files\Folders moved on Reboot… File\Folder C:\Users\Greg\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZB0EXP0X(521)\http%253A%252F%252Fwww.aim.com%252Fredirects%252Finclient%252FAIM_UAC_v2[1].adp%253Fmagic%253D93245511%2526width%253D120%2526height%253D90%2526sn%253DCarlinUnblockMe not found! File\Folder C:\Users\Greg\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZB0EXP0X(521)\tp%253A%252F%252Fwww.aim.com%252Fredirects%252Finclient%252FAIM_UAC_v2[1].adp%253Fmagic%253D93245511%2526width%253D120%2526height%253D90%2526sn%253DGreg%2520gory0018 not found! File\Folder C:\Users\Greg\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZB0EXP0X(521)\tp%253A%252F%252Fwww.aim.com%252Fredirects%252Finclient%252FAIM_UAC_v2[2].adp%253Fmagic%253D93245511%2526width%253D120%2526height%253D90%2526sn%253DGreg%2520gory0018 not found! File\Folder C:\Users\Greg\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZB0EXP0X(521)\tp%253A%252F%252Fwww.aim.com%252Fredirects%252Finclient%252FAIM_UAC_v2[3].adp%253Fmagic%253D93245511%2526width%253D120%2526height%253D90%2526sn%253DGreg%2520gory0018 not found! File\Folder C:\Windows\temp\mcafee_DqMtDnlvuaI999I not found! File\Folder C:\Windows\temp\mcmsc_8oCahvU8AaTOmOM not found! File\Folder C:\Windows\temp\mcmsc_bfL19pZMXGUk1Y1 not found! File\Folder C:\Windows\temp\mcmsc_HAS3Itb8tbeGKCc not found! File\Folder C:\Windows\temp\mcmsc_O942pv77RQaXmdR not found! File move failed. C:\Windows\temp\nmsmc_DQLWinService.log scheduled to be moved on reboot. Registry entries deleted on Reboot… Running CF now

Gregory

Post #9January 10, 2010, 9:42 AM UTC

Combo fix did its thing!

Tomk

Post #10January 10, 2010, 5:20 PM UTC

Gregory,

Please:

Right click on START on the left end of your Windows toolbar (lower left corner of your screen)
Click on Explore
Click on Local Disk (C:) in the left-hand window pane
Look for ComboFix.txt in the right-hand window pane and right click on it
Put your cursor (arrow) on Open With
Move your cursor to the new menu that opens and click on Choose Program…
Click on Notepad

When file opens, Copy/Paste text here

Gregory

Post #11January 11, 2010, 12:04 AM UTC

Sorry, I didn't see that in your post ComboFix 10-01-04.01 - Greg 01/10/2010 4:28.3.2 - x86 Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3069.1832 [GMT -5:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe SP: Windows Defender *disabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46} * Resident AV is active . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\$recycle.bin\S-1-5-21-1400113804-1914402855-3429530994-500 c:\$recycle.bin\S-1-5-21-2152478756-3922319563-605102323-500 c:\$recycle.bin\S-1-5-21-3889450244-2785813946-2893821554-500 c:\programdata\1pdfdec.dll c:\windows\a3kebook.ini c:\windows\akebook.ini c:\windows\ANS2000.INI c:\windows\Downloaded Program Files\popcaploader.inf . ((((((((((((((((((((((((( Files Created from 2009-12-10 to 2010-01-10 ))))))))))))))))))))))))))))))) . 2010-01-10 09:38 . 2010-01-10 09:38 ——– d—–w- c:\users\Greg\AppData\Local\temp 2010-01-10 09:38 . 2010-01-10 09:38 ——– d—–w- c:\users\LogMeInRemoteUser\AppData\Local\temp 2010-01-10 09:38 . 2010-01-10 09:38 ——– d—–w- c:\users\LogMeInRemoteUser.Greg-PC\AppData\Local\temp 2010-01-10 09:38 . 2010-01-10 09:38 ——– d—–w- c:\users\IUSR_NMPR\AppData\Local\temp 2010-01-10 09:38 . 2010-01-10 09:38 ——– d—–w- c:\users\Default\AppData\Local\temp 2010-01-10 09:15 . 2010-01-10 09:15 ——– d—–w- C:\_OTL 2010-01-09 22:51 . 2010-01-09 22:51 ——– d—–w- C:\Rooter$ 2010-01-03 21:28 . 2010-01-03 21:28 ——– d—–w- c:\users\Greg\AppData\Local\Apple 2009-12-30 11:49 . 2010-01-04 23:46 ——– d—–w- c:\users\Greg\AppData\Local\Apple Computer 2009-12-30 09:08 . 2009-12-31 23:06 ——– d—–w- c:\users\Greg\AppData\Local\Adobe 2009-12-30 08:33 . 2009-12-30 08:33 ——– d—–w- c:\users\Greg\AppData\Local\AOL OCP 2009-12-30 08:33 . 2009-12-30 08:33 ——– d—–w- c:\users\Greg\AppData\Local\AOL 2009-12-30 00:21 . 2009-12-30 00:21 ——– d—–w- c:\program files\MeadCo Neptune 2009-12-26 12:16 . 2009-11-09 12:31 24064 —-a-w- c:\windows\system32\nshhttp.dll 2009-12-26 12:16 . 2009-11-09 10:36 411648 —-a-w- c:\windows\system32\drivers\http.sys 2009-12-26 12:16 . 2009-11-09 12:30 30720 —-a-w- c:\windows\system32\httpapi.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-01-09 18:04 . 2009-11-22 18:03 439816 —-a-w- c:\users\Greg\AppData\Roaming\Real\Update\setup3.09\setup.exe 2010-01-01 21:46 . 2009-01-26 05:21 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware 2010-01-01 21:45 . 2009-04-23 02:57 5061520 —-a-w- c:\programdata\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe 2009-12-30 19:55 . 2009-04-06 05:44 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2009-12-30 19:54 . 2009-04-06 05:44 19160 —-a-w- c:\windows\system32\drivers\mbam.sys 2009-12-26 12:11 . 2009-11-05 21:27 ——– d—–w- c:\program files\McAfee 2009-12-16 22:41 . 2006-11-02 12:37 ——– d—–w- c:\program files\Microsoft Games 2009-12-10 08:20 . 2009-05-30 01:48 ——– d—–w- c:\program files\SquawkBox 2009-12-10 08:19 . 2006-11-02 11:18 ——– d—–w- c:\program files\Windows Mail 2009-12-01 21:58 . 2008-11-04 02:59 ——– d—–w- c:\programdata\McAfee 2009-12-01 02:15 . 2007-04-26 12:43 ——– d—–w- c:\program files\EA GAMES 2009-12-01 02:14 . 2007-04-23 13:39 ——– d–h–w- c:\program files\InstallShield Installation Information 2009-12-01 02:12 . 2007-04-26 17:37 ——– d—–w- c:\program files\Common Files\Wise Installation Wizard 2009-12-01 02:10 . 2009-05-29 01:34 ——– d—–w- c:\users\Greg\AppData\Roaming\VAT-Spy 2009-12-01 02:10 . 2009-05-29 01:34 ——– d—–w- c:\program files\VATSpy 2009-12-01 02:04 . 2009-12-01 02:04 118784 —-a-w- c:\users\Greg\AppData\Roaming\Real\Update\setup3.09\RUP\inst_config\compat.dll 2009-11-29 14:16 . 2009-11-29 14:16 79367 —-a-w- c:\users\Greg\AppData\Roaming\Google\Google Talk\uninstall.exe 2009-11-17 18:36 . 2009-11-17 18:36 ——– d—–w- c:\program files\Windows Portable Devices 2009-11-17 18:36 . 2006-11-02 10:25 665600 —-a-w- c:\windows\inf\drvindex.dat 2009-11-17 18:36 . 2009-11-17 18:36 0 —ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf 2009-11-17 18:36 . 2009-11-17 18:36 0 —ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_07_00.Wdf 2009-11-13 22:00 . 2009-11-13 22:00 ——– d—–w- c:\program files\Submit Suite 2009-11-13 22:00 . 2009-01-26 03:26 ——– d—–w- c:\programdata\Submit Suite 2009-10-30 20:43 . 2009-10-30 20:43 79144 —-a-w- c:\programdata\Apple Computer\Installer Cache\iTunes 9.0.2.25\SetupAdmin.exe 2009-10-29 09:17 . 2009-11-25 08:01 2048 —-a-w- c:\windows\system32\tzres.dll 2009-10-27 14:11 . 2009-12-09 21:53 834048 —-a-w- c:\windows\system32\wininet.dll 2009-10-27 13:16 . 2009-12-09 21:53 78336 —-a-w- c:\windows\system32\ieencode.dll 2009-10-25 02:54 . 2009-10-25 02:54 15086 —-a-r- c:\users\Greg\AppData\Roaming\Microsoft\Installer\{04179174-F3AC-4CE6-BBBE-83B46D5041CB}\_BB07C363ADE0577D8667EF.exe 2009-10-25 02:54 . 2009-10-25 02:54 15086 —-a-r- c:\users\Greg\AppData\Roaming\Microsoft\Installer\{04179174-F3AC-4CE6-BBBE-83B46D5041CB}\_3B71B06A564C54D2701697.exe 2007-04-23 21:27 . 2007-04-23 21:27 8192 –sha-w- c:\windows\Users\Default\NTUSER.DAT . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "googletalk"="c:\users\Greg\AppData\Roaming\Google\Google Talk\googletalk.exe" [2007-01-01 3739648] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2006-09-29 151552] "ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2006-10-03 81920] "CCUTRAYICON"="c:\program files\Intel\IntelDH\CCU\CCU_TrayIcon.exe" [2006-11-18 182744] "NMSSupport"="c:\program files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe" [2006-09-26 423424] "ECenter"="c:\dell\E-Center\EULALauncher.exe" [2006-11-17 17920] "ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2006-10-03 221184] "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440] "Windows Mobile-based device management"="c:\windows\WindowsMobile\wmdSync.exe" [2006-11-02 215552] "pwreset"="c:\program files\Avaya\Avaya IP Agent\Service Provider\pwreset.exe" [2007-09-12 45056] "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-11-23 185872] "Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-12-30 1389904] "SigmatelSysTrayApp"="sttray.exe" [2007-02-08 303104] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-09-05 417792] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-10-29 141600] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792] "mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2009-10-29 1218008] "McENUI"="c:\progra~1\McAfee\MHN\McENUI.exe" [2009-07-08 1176808] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend] @="Service" [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc] "VistaSp2"=hex(

:97,63,07,9b,b8,58,ca,01 R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\System32\drivers\LMIRfsDriver.sys [9/30/2007 2:12 PM 47640] R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [11/5/2009 4:29 PM 93320] R2 nmsgopro;GoProto Protocol Driver for NMS;c:\windows\System32\drivers\nmsgopro.sys [9/27/2006 3:37 PM 28672] R2 nmsunidr;UniDriver for NMS;c:\windows\System32\drivers\nmsunidr.sys [10/19/2006 2:49 PM 7424] R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [6/15/2009 7:48 AM 24652] R3 IntelDH;IntelDH Driver;c:\windows\System32\drivers\IntelDH.sys [4/23/2007 8:49 AM 5504] R3 WMP110v2;Linksys WMP110 RangePlus Wireless PCI Adapter Driver for Windows Vista;c:\windows\System32\drivers\WMP110v2.sys [6/14/2009 9:34 PM 338432] S0 sptd;sptd;c:\windows\System32\drivers\sptd.sys [5/27/2009 9:24 PM 721904] S2 DQLWinService;DQLWinService;c:\program files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe [10/29/2006 8:03 AM 208896] S3 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [9/16/2008 10:38 PM 21504] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] WindowsMobile REG_MULTI_SZ wcescomm rapimgr LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache . Contents of the 'Scheduled Tasks' folder 2009-12-15 c:\windows\Tasks\McDefragTask.job - c:\progra~1\mcafee\mqc\QcConsol.exe [2009-11-05 17:22] 2010-01-01 c:\windows\Tasks\McQcTask.job - c:\progra~1\mcafee\mqc\QcConsol.exe [2009-11-05 17:22] . . ——- Supplementary Scan ——- . uStart Page = hxxp://www.yahoo.com/ uInternet Settings,ProxyOverride = *.local uInternet Settings,ProxyServer = 174.142.104.57:3128 IE: &WebReplay; Fill Login - c:\program files\Deskperience\Web Replay\inetieui.dll/292 IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 IE: Save YouTube Video FF - ProfilePath - c:\users\Greg\AppData\Roaming\Mozilla\Firefox\Profiles\5pdxn7ey.default\ FF - prefs.js: browser.search.selectedEngine - FF - prefs.js: browser.startup.homepage - www.google.com FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe;=UTF-8&sourceid;=navclient&gfns;=1&q;= FF - component: c:\program files\McAfee\SiteAdvisor\components\McFFPlg.dll FF - plugin: c:\progra~1\MEADCO~1\npmeadax.dll FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava11.dll FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava12.dll FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava13.dll FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava14.dll FF - plugin: c:\program files\Java\jre1.6.0\bin\npjava32.dll FF - plugin: c:\program files\Java\jre1.6.0\bin\npjpi160.dll FF - plugin: c:\program files\Java\jre1.6.0\bin\npoji610.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ . - - - - ORPHANS REMOVED - - - - HKCU-Run-eyeBeam SIP Client - (no file) HKCU-Run-Aim6 - (no file) ************************************************************************** scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: ************************************************************************** . ——————— LOCKED REGISTRY KEYS ——————— [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aac\UserChoice] @Denied: (2) (LocalSystem) "Progid"="YMP.Media" [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\UserChoice] @Denied: (2) (LocalSystem) "Progid"="YMP.Media" [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\UserChoice] @Denied: (2) (LocalSystem) "Progid"="YMP.Media" [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\UserChoice] @Denied: (2) (LocalSystem) "Progid"="YMP.Media" [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\UserChoice] @Denied: (2) (LocalSystem) "Progid"="YMP.Media" [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.flac\UserChoice] @Denied: (2) (LocalSystem) "Progid"="YMP.Media" [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\UserChoice] @Denied: (2) (LocalSystem) "Progid"="YMP.Media" [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\UserChoice] @Denied: (2) (LocalSystem) "Progid"="YMP.Media" [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\UserChoice] @Denied: (2) (LocalSystem) "Progid"="YMP.Media" [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.midi\UserChoice] @Denied: (2) (LocalSystem) "Progid"="YMP.Media" [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\UserChoice] @Denied: (2) (LocalSystem) "Progid"="YMP.Media" [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\UserChoice] @Denied: (2) (LocalSystem) "Progid"="YMP.Media" [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ogg\UserChoice] @Denied: (2) (LocalSystem) "Progid"="YMP.Media" [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pcm\UserChoice] @Denied: (2) (LocalSystem) "Progid"="YMP.Media" [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pls\UserChoice] @Denied: (2) (LocalSystem) "Progid"="YMP.Media" [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\UserChoice] @Denied: (2) (LocalSystem) "Progid"="YMP.Media" [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.spx\UserChoice] @Denied: (2) (LocalSystem) "Progid"="YMP.Media" [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\UserChoice] @Denied: (2) (LocalSystem) "Progid"="YMP.Media" [HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\UserChoice] @Denied: (2) (LocalSystem) "Progid"="YMP.Media" . Completion time: 2010-01-10 04:41:18 ComboFix-quarantined-files.txt 2010-01-10 09:41 ComboFix2.txt 2009-01-06 05:50 Pre-Run: 111,162,023,936 bytes free Post-Run: 111,105,028,096 bytes free - - End Of File - - 0421891BF13148DFF0A221F444DFF14A

Tomk

Post #12January 11, 2010, 12:29 AM UTC

Gregory,

Please go to Kaspersky website and perform an online antivirus scan.

Read through the requirements and privacy statement and click on Accept button.
It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
When the downloads have finished, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
- Spyware, Adware, Dialers, and other potentially dangerous programs
  Archives
  Mail databases
Click on My Computer under Scan.
Once the scan is complete, it will display the results. Click on View Scan Report.
You will see a list of infected items there. Click on Save Report As….
Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
Please post this log in your next reply.