Spyware / Malware / Virus Removal

[Resolved] Slooowww computer, keeps freezing - can't get it cleane

55 min read

Looking for the outcome? Ask AI

CatByte

Post #76March 19, 2010, 1:38 PM UTC

That log is clean

Let's make sure we have everything:

Please run this tool:

Download OTL to your Desktop

Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Check the boxes beside LOP Check and Purity Check.
Under the Custom Scan box paste this in

netsvcs
%SYSTEMDRIVE%\*.exe
/md5start
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
sceclt.dll
ntelogon.dll
logevent.dll
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
nvrd32.sys
symmpi.sys
adp3132.sys
/md5stop
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
CREATERESTOREPOINT
Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them in your next reply.

Patrick's Mom

Post #77March 19, 2010, 3:26 PM UTC

This is getting exciting. It is amazing how much harm this virus can do. I was worried that I had to throw this whole computer out - it seemed like hardware failures - but now it's running perfectly.

One other question: I have an external hard drive that I disconnected when this all started happening. Could it possible carry an infection or virus also? What would you recommend that I do with that? It has a lot of data on it and back-ups of this computer, my netbook and my son's laptop.

Here are the scan output files:

OTL logfile created on: 3/19/2010 9:59:25 AM - Run 1
OTL by OldTimer - Version 3.1.37.3 Folder = C:\Documents and Settings\Sara Byron\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 74.00% Memory free
3.00 Gb Paging File | 2.00 Gb Available in Paging File | 85.00% Paging File free
Paging file location(s): C:\pagefile.sys 864 1728 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 111.72 Gb Total Space | 25.76 Gb Free Space | 23.06% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: FAMILYDELL
Current User Name: Sara Byron
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 14 Days
Output = Minimal
Quick Scan

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Sara Byron\Desktop\OTL.exe (OldTimer Tools)
PRC - c:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\MPF\MpfSrv.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\VirusScan\Mcshield.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\VirusScan\mcsysmon.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee Security Scan\1.0.150\SSScheduler.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\MSC\mcmscsvc.exe (McAfee, Inc.)
PRC - c:\Program Files\Common Files\McAfee\McProxy\McProxy.exe (McAfee, Inc.)
PRC - c:\Program Files\Common Files\McAfee\MNA\McNASvc.exe (McAfee, Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Photodex\ProShowGold\scsiaccess.exe ()
PRC - C:\Program Files\Palm\Hotsync.exe (PalmSource, Inc)
PRC - C:\WINDOWS\SYSTEM32\UAService7.exe ()
PRC - C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\HP1006MC.EXE (Software 2000 Limited)
PRC - C:\Program Files\Viewpoint\Common\ViewpointService.exe (Viewpoint Corporation)
PRC - C:\Program Files\Microsoft ActiveSync\wcescomm.exe (Microsoft Corporation)
PRC - C:\Program Files\Microsoft ActiveSync\rapimgr.exe (Microsoft Corporation)
PRC - C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\fppdis2a.exe (FinePrint Software, LLC)
PRC - C:\Program Files\Intel\Intel Application Accelerator\IAANTmon.exe (Intel)
PRC - C:\Program Files\SpywareGuard\sgmain.exe ()

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Sara Byron\Desktop\OTL.exe (OldTimer Tools)

========== Win32 Services (SafeList) ==========

SRV - (MpfService) – C:\Program Files\McAfee\MPF\MPFSrv.exe (McAfee, Inc.)
SRV - (McODS) – C:\Program Files\McAfee\VirusScan\mcods.exe (McAfee, Inc.)
SRV - (McShield) – C:\Program Files\McAfee\VirusScan\Mcshield.exe (McAfee, Inc.)
SRV - (McSysmon) – C:\Program Files\McAfee\VirusScan\mcsysmon.exe (McAfee, Inc.)
SRV - (mcmscsvc) – C:\Program Files\McAfee\MSC\mcmscsvc.exe (McAfee, Inc.)
SRV - (McProxy) – c:\Program Files\Common Files\McAfee\McProxy\McProxy.exe (McAfee, Inc.)
SRV - (McNASvc) – c:\program files\common files\mcafee\mna\mcnasvc.exe (McAfee, Inc.)
SRV - (spupdsvc) – C:\WINDOWS\SYSTEM32\spupdsvc.exe (Microsoft Corporation)
SRV - (szserver) – C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe (iS3, Inc.)
SRV - (ScsiAccess) – C:\Program Files\Photodex\ProShowGold\scsiaccess.exe ()
SRV - (UserAccess7) SecuROM User Access Service (V7) – C:\WINDOWS\SYSTEM32\UAService7.exe ()
SRV - (Viewpoint Manager Service) – C:\Program Files\Viewpoint\Common\ViewpointService.exe (Viewpoint Corporation)
SRV - (IAANTMon) – C:\Program Files\Intel\Intel Application Accelerator\IAANTmon.exe (Intel)
SRV - (WebDriveService) – C:\Program Files\NetDrive\wdService.exe ()
SRV - (NetSvc) – C:\Program Files\Intel\NCS\Sync\NetSvc.exe (Intel® Corporation)
SRV - (SQLAgent$MICROSOFTBCM) – C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlagent.EXE (Microsoft Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerm…tf8&oe;=utf8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://member.square-enix.com/na/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Live Search"
FF - prefs.js..browser.search.defaulturl: "http://search.live.com/results.aspx?FORM=IEFM1&q;="
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "https://www.ravelry.com/account/login|https://webauth.att.net/auth/webmail/login?action=Login&url;=http%3A%2F%2Fwebmail.att.net%2Fwmc%2Fv%2Fwm%2F49B4A62800082B1E00002C2F2223070362%2F%3Fcmd%3DList%26sid%3Dc0|http://www.voy.com/33031/|http://central.hinsdale86.org/Daily%20Announcements/Forms/AllItems.aspx|http://mail.google.com/mail/?source=navclient-ff&zx;=1w0tkde3j7rys&shva;=1#inbox|http://www.facebook.com/login.php?v=1.0&api;_key=e004be66908863e93f45ec5853daecba&next;=%3Faction%3Dseal%26id%3D856664843%26skip%3D856664843&canvas;|http://www.atlasquest.com/people/profile.html|http://www.hcbands.org/|http://www.fiberfarm.com/blog"
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {AE93811A-5C9A-4d34-8462-F7B864FC4696}:3.63
FF - prefs.js..keyword.URL: "http://search.live.com/results.aspx?FORM=IEFM1&q;="
FF - prefs.js..network.proxy.no_proxies_on: "*.local"

FF - HKLM\software\mozilla\Firefox\Extensions\\{1650a312-02bc-40ee-977e-83f158701739}: C:\Program Files\SiteAdvisor\4144\FF\ [2006/10/20 13:11:22 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.8\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/02/22 19:37:55 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.8\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/02/22 19:37:55 | 000,000,000 | —D | M]

[2008/08/30 14:27:33 | 000,000,000 | —D | M] – C:\Documents and Settings\Sara Byron\Application Data\Mozilla\Extensions
[2010/03/18 14:29:44 | 000,000,000 | —D | M] – C:\Documents and Settings\Sara Byron\Application Data\Mozilla\Firefox\Profiles\sayrjs30.default\extensions
[2009/09/07 12:31:14 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Sara Byron\Application Data\Mozilla\Firefox\Profiles\sayrjs30.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/02/12 16:29:16 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Sara Byron\Application Data\Mozilla\Firefox\Profiles\sayrjs30.default\extensions\{AE93811A-5C9A-4d34-8462-F7B864FC4696}
[2008/11/12 09:32:23 | 000,001,739 | —- | M] () – C:\Documents and Settings\Sara Byron\Application Data\Mozilla\Firefox\Profiles\sayrjs30.default\searchplugins\aim-search.xml
[2009/03/09 00:16:26 | 000,001,632 | —- | M] () – C:\Documents and Settings\Sara Byron\Application Data\Mozilla\Firefox\Profiles\sayrjs30.default\searchplugins\live-search.xml
[2010/03/18 14:29:44 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2007/05/11 17:41:00 | 000,200,704 | —- | M] (Ancestry.com) – C:\Program Files\Mozilla Firefox\plugins\npImgCtl.dll
[2007/04/16 12:07:12 | 000,180,293 | —- | M] () – C:\Program Files\Mozilla Firefox\plugins\npViewpoint.dll

O1 HOSTS File: ([2010/03/11 10:11:34 | 000,000,027 | —- | M]) - C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (SpywareGuardDLBLOCK.CBrowserHelper) - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll ()
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll (McAfee, Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\4608\SiteAdv.dll (McAfee, Inc.)
O3 - HKCU\..\Toolbar\ShellBrowser: (&Google; Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (&Google; Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll ()
O4 - HKLM..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe (Apple Inc.)
O4 - HKLM..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
O4 - HKLM..\Run: [pdfFactory Dispatcher v2] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fppdis2a.exe (FinePrint Software, LLC)
O4 - HKLM..\Run: [WebDriveTray] C:\Program Files\NetDrive\netdrive.exe ()
O4 - HKCU..\Run: [H/PC Connection Agent] C:\Program Files\Microsoft ActiveSync\wcescomm.exe (Microsoft Corporation)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HotSync Manager.lnk = C:\Program Files\Palm\Hotsync.exe (PalmSource, Inc)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan.lnk = C:\Program Files\McAfee Security Scan\1.0.150\SSScheduler.exe (McAfee, Inc.)
O4 - Startup: C:\Documents and Settings\Sara Byron\Start Menu\Programs\Startup\SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra Button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\Common Files\iS3\Anti-Spyware\iS3lsp.dll (iS3 & AVG Exploit Prevention Labs, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\Common Files\iS3\Anti-Spyware\iS3lsp.dll (iS3 & AVG Exploit Prevention Labs, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files\Common Files\iS3\Anti-Spyware\iS3lsp.dll (iS3 & AVG Exploit Prevention Labs, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files\Common Files\iS3\Anti-Spyware\iS3lsp.dll (iS3 & AVG Exploit Prevention Labs, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files\Common Files\iS3\Anti-Spyware\iS3lsp.dll (iS3 & AVG Exploit Prevention Labs, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\Program Files\Common Files\iS3\Anti-Spyware\iS3lsp.dll (iS3 & AVG Exploit Prevention Labs, Inc.)
O12 - Plugin for: .spop - C:\Program Files\Internet Explorer\PLUGINS\NPDocBox.dll (Intertrust Technologies, Inc.)
O15 - HKCU\..Trusted Domains: mmjbdata.com ([online] http is out of zone range - 5)
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} http://download.microsoft.com/download/e/4…/OGAControl.cab (Office Genuine Advantage Validation Tool)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} http://bin.mcafee.com/molbin/shared/mcinsc…84/mcinsctl.cab (McAfee.com Operating System Class)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://www.update.microsoft.com/windowsupd…b?1212589685328 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdat…b?1124298262359 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} http://bin.mcafee.com/molbin/shared/mcgdmg…,21/mcgdmgr.cab (DwnldGroupMgr Class)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O18 - Protocol\Handler\siteadvisor {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - C:\Program Files\SiteAdvisor\4608\SiteAdv.dll (McAfee, Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop WallPaper: C:\Documents and Settings\Sara Byron\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Sara Byron\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O28 - HKLM ShellExecuteHooks: {81559C35-8464-49F7-BB0E-07A383BEF910} - C:\Program Files\SpywareGuard\spywareguard.dll ()
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/05/11 17:07:39 | 000,000,095 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - C:\WINDOWS\SYSTEM32\IAS [2004/03/29 16:26:50 | 000,000,000 | —D | M]
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (16891891626803200)

========== Files/Folders - Created Within 14 Days ==========

[2010/03/19 09:58:05 | 000,555,520 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Sara Byron\Desktop\OTL.exe
[2010/03/18 14:19:22 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2010/03/12 00:10:42 | 000,000,000 | —D | C] – C:\HelpAsst_backup
[2010/03/11 09:50:04 | 000,000,000 | RHSD | C] – C:\cmdcons
[2009/03/07 11:35:46 | 000,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Application Data\Xfire
[2008/11/06 12:57:39 | 000,000,000 | –SD | M] – C:\Documents and Settings\LocalService\Application Data\Microsoft
[2007/08/25 10:23:01 | 000,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Apple
[2004/12/23 23:53:48 | 000,036,963 | R— | C] (Cypress Semiconductor) – C:\Program Files\Common Files\SM1updtr.dll
[2004/11/19 21:55:53 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Application Data\McAfee.com
[2004/11/06 17:39:43 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[2004/07/09 08:30:38 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Application Data\Macromedia
[2004/03/29 17:00:30 | 000,065,536 | —- | C] ( ) – C:\WINDOWS\System32\a3d.dll
[2004/03/29 16:28:46 | 000,000,000 | –SD | M] – C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2004/03/29 16:28:46 | 000,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
[6 C:\Documents and Settings\Sara Byron\My Documents\*.tmp files -> C:\Documents and Settings\Sara Byron\My Documents\*.tmp -> ]
[4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 14 Days ==========

[2010/03/19 09:58:06 | 000,555,520 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Sara Byron\Desktop\OTL.exe
[2010/03/19 09:56:15 | 000,001,729 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk
[2010/03/19 07:39:30 | 000,001,170 | —- | M] () – C:\WINDOWS\System32\WPA.DBL
[2010/03/19 07:39:20 | 000,013,637 | —- | M] () – C:\WINDOWS\System32\Config.MPF
[2010/03/19 07:36:53 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/03/19 07:36:51 | 000,002,048 | —- | M] () – C:\WINDOWS\bootstat.dat
[2010/03/19 07:36:49 | 2146,500,608 | -HS- | M] () – C:\hiberfil.sys
[2010/03/19 07:36:06 | 000,030,036 | —- | M] () – C:\WINDOWS\System32\BMXStateBkp-{00000002-00000000-00000002-00001102-00000004-10031102}.rfx
[2010/03/19 07:36:06 | 000,030,036 | —- | M] () – C:\WINDOWS\System32\BMXState-{00000002-00000000-00000002-00001102-00000004-10031102}.rfx
[2010/03/19 07:36:06 | 000,029,760 | —- | M] () – C:\WINDOWS\System32\BMXCtrlState-{00000002-00000000-00000002-00001102-00000004-10031102}.rfx
[2010/03/19 07:36:06 | 000,029,760 | —- | M] () – C:\WINDOWS\System32\BMXBkpCtrlState-{00000002-00000000-00000002-00001102-00000004-10031102}.rfx
[2010/03/19 07:36:06 | 000,001,080 | —- | M] () – C:\WINDOWS\System32\settingsbkup.sfm
[2010/03/19 07:36:06 | 000,001,080 | —- | M] () – C:\WINDOWS\System32\settings.sfm
[2010/03/19 07:36:06 | 000,000,288 | —- | M] () – C:\WINDOWS\System32\DVCStateBkp-{00000002-00000000-00000002-00001102-00000004-10031102}.dat
[2010/03/19 07:36:06 | 000,000,288 | —- | M] () – C:\WINDOWS\System32\DVCState-{00000002-00000000-00000002-00001102-00000004-10031102}.dat
[2010/03/19 07:34:50 | 009,437,184 | -H– | M] () – C:\Documents and Settings\Sara Byron\NTUSER.DAT
[2010/03/19 07:34:50 | 000,000,278 | -HS- | M] () – C:\Documents and Settings\Sara Byron\ntuser.ini
[2010/03/18 21:31:54 | 000,488,240 | —- | M] () – C:\Documents and Settings\Sara Byron\Desktop\HelpAsst_mebroot_fix.exe
[2010/03/18 14:04:46 | 000,000,402 | -H– | M] () – C:\WINDOWS\tasks\User_Feed_Synchronization-{C1000964-AA95-4E84-990A-2DFD6562E161}.job
[2010/03/15 11:21:08 | 000,383,570 | —- | M] () – C:\WINDOWS\System32\PERFH009.DAT
[2010/03/15 11:21:08 | 000,062,798 | —- | M] () – C:\WINDOWS\System32\PERFC009.DAT
[2010/03/15 11:21:07 | 000,456,086 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2010/03/14 20:52:49 | 000,002,137 | —- | M] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2010/03/11 10:12:08 | 000,000,000 | —- | M] () – C:\WINDOWS\system.ini
[2010/03/11 10:11:34 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\ETC\hosts
[2010/03/11 09:50:13 | 000,000,281 | RHS- | M] () – C:\boot.ini
[2010/03/11 09:35:23 | 003,887,257 | R— | M] () – C:\Documents and Settings\Sara Byron\Desktop\ComboFix.exe
[2010/03/10 15:06:40 | 000,000,112 | —- | M] () – C:\WINDOWS\WIN.INI
[2010/03/08 14:39:19 | 000,524,288 | —- | M] () – C:\Documents and Settings\Sara Byron\Desktop\dds.com
[2010/03/06 00:51:23 | 000,000,211 | —- | M] () – C:\Boot.bak
[6 C:\Documents and Settings\Sara Byron\My Documents\*.tmp files -> C:\Documents and Settings\Sara Byron\My Documents\*.tmp -> ]
[4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/03/18 21:31:53 | 000,488,240 | —- | C] () – C:\Documents and Settings\Sara Byron\Desktop\HelpAsst_mebroot_fix.exe
[2010/03/11 09:50:07 | 000,260,272 | —- | C] () – C:\cmldr
[2010/03/11 09:35:09 | 003,887,257 | R— | C] () – C:\Documents and Settings\Sara Byron\Desktop\ComboFix.exe
[2010/03/10 15:20:43 | 2146,500,608 | -HS- | C] () – C:\hiberfil.sys
[2010/03/08 14:40:08 | 000,293,376 | —- | C] () – C:\Documents and Settings\Sara Byron\Desktop\gmer.exe
[2010/03/08 14:39:19 | 000,524,288 | —- | C] () – C:\Documents and Settings\Sara Byron\Desktop\dds.com
[2009/08/03 16:07:42 | 000,403,816 | —- | C] () – C:\WINDOWS\System32\OGACheckControl.dll
[2009/05/14 09:20:02 | 000,000,133 | —- | C] () – C:\Documents and Settings\All Users\Application Data\Microsoft.SqlServer.Compact.351.32.bc
[2009/04/19 09:41:27 | 000,002,528 | —- | C] () – C:\Documents and Settings\Sara Byron\Application Data\$_hpcst$.hpc
[2009/03/01 12:25:06 | 000,000,094 | —- | C] () – C:\WINDOWS\family.ini
[2009/02/22 09:50:03 | 001,380,403 | —- | C] () – C:\WINDOWS\System32\avgsdk.dll
[2009/02/22 09:20:44 | 000,000,264 | —- | C] () – C:\WINDOWS\reimage.ini
[2008/05/02 13:55:37 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\HPPLVS.dll
[2008/04/21 08:25:39 | 000,000,014 | —- | C] () – C:\WINDOWS\hpmssnpjt.ini
[2008/03/31 20:28:10 | 000,043,520 | —- | C] () – C:\WINDOWS\System32\CmdLineExt03.dll
[2008/03/20 09:24:43 | 000,484,352 | —- | C] () – C:\WINDOWS\System32\lame_enc.dll
[2008/03/20 09:24:43 | 000,086,016 | —- | C] () – C:\WINDOWS\System32\DVResampleru.dll
[2008/03/19 16:19:21 | 000,194,248 | —- | C] () – C:\WINDOWS\System32\LTRFD13n.DLL
[2008/02/12 22:13:17 | 000,138,752 | —- | C] () – C:\WINDOWS\System32\mase32.dll
[2008/02/12 22:13:17 | 000,057,856 | —- | C] () – C:\WINDOWS\System32\masd32.dll
[2008/02/12 22:13:16 | 000,196,096 | —- | C] () – C:\WINDOWS\System32\macd32.dll
[2008/02/12 22:13:16 | 000,136,192 | —- | C] () – C:\WINDOWS\System32\mamc32.dll
[2008/02/12 22:13:16 | 000,027,648 | —- | C] () – C:\WINDOWS\System32\ma32.dll
[2008/01/01 19:41:39 | 000,000,020 | -H– | C] () – C:\Documents and Settings\All Users\Application Data\PKP_DLec.DAT
[2008/01/01 19:39:04 | 000,000,268 | RH– | C] () – C:\Documents and Settings\All Users\Application Data\Sci-Fi
[2008/01/01 19:39:04 | 000,000,020 | -H– | C] () – C:\Documents and Settings\All Users\Application Data\PKP_DLds.DAT
[2007/06/11 14:24:28 | 000,114,688 | —- | C] () – C:\WINDOWS\System32\hppatusg01.dll
[2007/03/27 02:55:48 | 003,596,288 | —- | C] () – C:\WINDOWS\System32\qt-dx331.dll
[2007/01/26 18:07:09 | 000,000,029 | —- | C] () – C:\WINDOWS\atid.ini
[2006/12/12 11:24:42 | 000,012,288 | —- | C] () – C:\WINDOWS\System32\DivXWMPExtType.dll
[2006/10/25 11:22:26 | 000,000,000 | —- | C] () – C:\WINDOWS\HPMProp.INI
[2006/10/25 11:21:58 | 000,094,274 | —- | C] () – C:\WINDOWS\System32\HPBHEALR.DLL
[2006/10/22 09:00:15 | 000,000,000 | —- | C] () – C:\WINDOWS\iPlayer.INI
[2006/07/14 12:01:07 | 000,003,344 | —- | C] () – C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2006/03/08 11:11:57 | 000,057,344 | —- | C] () – C:\WINDOWS\HAJEInstall.dll
[2006/02/06 14:25:47 | 000,002,890 | —- | C] () – C:\WINDOWS\fecfile.ini
[2006/02/06 13:25:47 | 000,001,186 | —- | C] () – C:\WINDOWS\FECLoad.ini
[2006/02/06 13:25:47 | 000,000,102 | —- | C] () – C:\WINDOWS\FECHECK5.INI
[2006/01/13 21:51:54 | 000,338,944 | —- | C] () – C:\WINDOWS\System32\lffpx7.dll
[2006/01/13 21:51:54 | 000,118,784 | —- | C] () – C:\WINDOWS\System32\lfkodak.dll
[2006/01/13 21:51:53 | 000,061,440 | —- | C] () – C:\WINDOWS\System32\cdTextCtl.dll
[2005/12/19 15:42:57 | 000,000,766 | —- | C] () – C:\WINDOWS\CoD.INI
[2005/11/01 16:34:13 | 000,000,074 | —- | C] () – C:\WINDOWS\MPLAYER.INI
[2005/10/29 21:28:47 | 000,000,037 | —- | C] () – C:\WINDOWS\Viewer.ini
[2005/10/28 21:41:07 | 000,000,031 | —- | C] () – C:\WINDOWS\SimPark.ini
[2005/09/23 06:20:07 | 000,221,184 | —- | C] () – C:\WINDOWS\System32\rfwdres.dll
[2005/09/23 06:20:07 | 000,126,976 | —- | C] () – C:\WINDOWS\System32\rfshext.dll
[2005/09/23 06:20:07 | 000,032,768 | —- | C] () – C:\WINDOWS\System32\rfhres.dll
[2005/09/23 06:20:07 | 000,024,576 | —- | C] () – C:\WINDOWS\System32\rfshres.dll
[2005/09/23 06:20:07 | 000,020,480 | —- | C] () – C:\WINDOWS\System32\rfstrres.dll
[2005/09/22 08:13:43 | 000,041,984 | —- | C] () – C:\Documents and Settings\Sara Byron\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2005/07/31 12:35:25 | 000,001,750 | —- | C] () – C:\WINDOWS\IDIS.INI
[2005/07/29 13:38:24 | 003,375,104 | —- | C] () – C:\WINDOWS\System32\qt-mt331.dll
[2005/06/20 21:32:15 | 000,000,000 | —- | C] () – C:\WINDOWS\QuickInstall.INI
[2005/03/05 22:55:22 | 000,000,119 | —- | C] () – C:\WINDOWS\NNS.INI
[2005/01/25 18:00:27 | 000,000,316 | —- | C] () – C:\WINDOWS\TLCAPPS.INI
[2004/12/25 19:56:13 | 000,000,248 | —- | C] () – C:\WINDOWS\RomeTW.ini
[2004/12/21 11:49:55 | 000,000,133 | —- | C] () – C:\Documents and Settings\Sara Byron\Local Settings\Application Data\fusioncache.dat
[2004/11/23 21:29:25 | 000,000,000 | —- | C] () – C:\WINDOWS\SETUP32.INI
[2004/11/20 16:43:34 | 000,000,043 | —- | C] () – C:\WINDOWS\KA.INI
[2004/11/13 18:50:28 | 000,000,449 | —- | C] () – C:\WINDOWS\JUNO.INI
[2004/10/29 21:25:35 | 000,000,675 | —- | C] () – C:\WINDOWS\Spidey.ini
[2004/10/23 21:20:18 | 000,000,041 | —- | C] () – C:\Documents and Settings\Sara Byron\Application Data\tvmcwrd.dll
[2004/10/03 11:59:06 | 000,000,029 | —- | C] () – C:\Documents and Settings\LocalService\Application Data\tvmcwrd.dll
[2004/09/28 23:25:17 | 000,000,356 | —- | C] () – C:\WINDOWS\System32\CNCASv51.ini
[2004/09/28 23:25:16 | 000,006,656 | —- | C] () – C:\WINDOWS\System32\CNMVSyf.DLL
[2004/09/28 23:25:10 | 000,000,599 | —- | C] () – C:\WINDOWS\System32\CNCMP51.INI
[2004/09/27 18:44:39 | 000,000,045 | —- | C] () – C:\WINDOWS\CGKIMOIK.ini
[2004/09/27 18:44:26 | 000,009,199 | —- | C] () – C:\WINDOWS\Xuvgkvan.ini
[2004/08/31 13:02:57 | 000,015,099 | —- | C] () – C:\WINDOWS\cdPlayer.ini
[2004/08/11 19:03:08 | 000,000,456 | —- | C] () – C:\WINDOWS\SIERRA.INI
[2004/08/01 15:29:59 | 000,000,021 | —- | C] () – C:\WINDOWS\DVDSentry.ini
[2004/07/23 20:53:44 | 000,000,026 | —- | C] () – C:\WINDOWS\WAR2R.INI
[2004/07/09 22:08:57 | 000,001,351 | —- | C] () – C:\WINDOWS\disney.ini
[2004/07/02 12:25:33 | 000,010,240 | —- | C] () – C:\WINDOWS\System32\vidx16.dll
[2004/03/29 17:18:50 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2004/03/29 17:09:45 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2004/03/29 17:00:49 | 000,000,231 | —- | C] () – C:\WINDOWS\AC3API.INI
[2004/03/29 17:00:33 | 000,066,807 | —- | C] () – C:\WINDOWS\System32\Aud2_Del.ini
[2004/03/29 17:00:33 | 000,000,030 | —- | C] () – C:\WINDOWS\System32\ctzapxx.ini
[2004/03/29 17:00:32 | 000,005,515 | —- | C] () – C:\WINDOWS\System32\ENSDEF.INI
[2004/03/29 17:00:32 | 000,000,180 | —- | C] () – C:\WINDOWS\System32\KILL.INI
[2004/03/29 17:00:08 | 000,000,136 | —- | C] () – C:\WINDOWS\SBWIN.INI
[2004/03/29 16:59:07 | 000,000,197 | —- | C] () – C:\WINDOWS\wininit.ini
[2004/03/29 16:56:11 | 000,000,791 | —- | C] () – C:\WINDOWS\orun32.ini
[2004/03/29 16:44:49 | 000,363,520 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2004/03/29 16:44:41 | 000,001,793 | —- | C] () – C:\WINDOWS\System32\fxsperf.ini
[2004/03/29 16:30:34 | 000,000,552 | —- | C] () – C:\WINDOWS\System32\OEMINFO.INI
[2003/11/20 14:18:40 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini
[2003/01/07 16:05:08 | 000,002,695 | —- | C] () – C:\WINDOWS\System32\OUTLPERF.INI
[2000/01/28 00:00:00 | 000,012,288 | —- | C] () – C:\WINDOWS\System32\HLINKPRX.DLL
[1980/01/01 01:00:00 | 000,126,976 | —- | C] () – C:\WINDOWS\System32\e1000msg.dll

========== LOP Check ==========

[2008/01/01 19:41:39 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\EnterNHelp
[2007/07/02 22:56:57 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Grisoft
[2008/10/17 11:36:13 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\hcxkzcxk
[2009/03/03 14:38:32 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\HotSync
[2010/02/25 11:29:20 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Innovative Solutions
[2007/03/04 20:27:02 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Mediafour
[2004/09/28 22:19:00 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\MSScanAppDataDir
[2005/02/27 19:43:12 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Napster
[2008/01/01 19:39:49 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Nikon
[2008/03/19 16:25:29 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Pinnacle
[2008/03/19 16:26:12 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Pinnacle Studio
[2008/10/13 14:25:08 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SITEguard
[2009/05/11 20:10:28 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SmartSound Software Inc
[2009/03/11 00:00:10 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SSScanAppDataDir
[2008/10/13 16:11:00 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\STOPzilla!
[2008/10/12 19:05:24 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2007/10/01 16:18:31 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Ulead Systems
[2008/01/01 19:41:39 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Ultima_T15
[2008/11/12 09:31:27 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Viewpoint
[2009/03/19 08:49:51 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
[2009/09/20 14:39:13 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2009/04/21 08:43:02 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2007/01/27 15:03:46 | 000,000,000 | —D | M] – C:\Documents and Settings\Sara Byron\Application Data\acccore
[2010/02/18 19:29:08 | 000,000,000 | —D | M] – C:\Documents and Settings\Sara Byron\Application Data\Aim
[2009/12/03 13:01:33 | 000,000,000 | —D | M] – C:\Documents and Settings\Sara Byron\Application Data\Amazon
[2010/02/12 16:52:31 | 000,000,000 | —D | M] – C:\Documents and Settings\Sara Byron\Application Data\Canon
[2009/05/06 08:51:58 | 000,000,000 | —D | M] – C:\Documents and Settings\Sara Byron\Application Data\DNA
[2007/03/21 18:36:50 | 000,000,000 | —D | M] – C:\Documents and Settings\Sara Byron\Application Data\Expedia
[2004/09/03 23:12:55 | 000,000,000 | —D | M] – C:\Documents and Settings\Sara Byron\Application Data\FileOpen
[2005/11/01 16:34:13 | 000,000,000 | —D | M] – C:\Documents and Settings\Sara Byron\Application Data\FTW
[2009/03/03 14:33:19 | 000,000,000 | —D | M] – C:\Documents and Settings\Sara Byron\Application Data\HotSync
[2004/07/31 22:42:11 | 000,000,000 | —D | M] – C:\Documents and Settings\Sara Byron\Application Data\Leadertech
[2007/09/20 22:04:10 | 000,000,000 | —D | M] – C:\Documents and Settings\Sara Byron\Application Data\NCH Swift Sound
[2008/05/29 08:54:17 | 000,000,000 | —D | M] – C:\Documents and Settings\Sara Byron\Application Data\Netscape
[2009/03/08 22:47:29 | 000,000,000 | —D | M] – C:\Documents and Settings\Sara Byron\Application Data\Nikon
[2008/11/24 21:30:15 | 000,000,000 | —D | M] – C:\Documents and Settings\Sara Byron\Application Data\OpenOffice.org
[2005/09/27 23:33:43 | 000,000,000 | —D | M] – C:\Documents and Settings\Sara Byron\Application Data\OurPictures
[2008/11/06 10:37:04 | 000,000,000 | —D | M] – C:\Documents and Settings\Sara Byron\Application Data\OverDrive
[2008/05/29 08:52:50 | 000,000,000 | —D | M] – C:\Documents and Settings\Sara Byron\Application Data\Photodex
[2008/01/12 11:55:09 | 000,000,000 | —D | M] – C:\Documents and Settings\Sara Byron\Application Data\SmartDraw
[2006/05/21 13:02:41 | 000,000,000 | —D | M] – C:\Documents and Settings\Sara Byron\Application Data\Snapfish
[2009/07/21 17:32:10 | 000,000,000 | —D | M] – C:\Documents and Settings\Sara Byron\Application Data\SPORE
[2008/09/13 17:14:35 | 000,000,000 | —D | M] – C:\Documents and Settings\Sara Byron\Application Data\SPORE Creature Creator
[2007/03/13 13:34:37 | 000,000,000 | —D | M] – C:\Documents and Settings\Sara Byron\Application Data\TrinityEnrollment
[2007/10/14 12:36:46 | 000,000,000 | —D | M] – C:\Documents and Settings\Sara Byron\Application Data\Ulead Systems
[2007/06/07 21:34:06 | 000,000,000 | —D | M] – C:\Documents and Settings\Sara Byron\Application Data\Viewpoint
[2004/10/08 09:57:05 | 000,000,000 | —D | M] – C:\Documents and Settings\Sara Byron\Application Data\WeatherBug
[2007/09/16 23:46:42 | 000,000,000 | —D | M] – C:\Documents and Settings\Sara Byron\Application Data\WinPatrol
[2010/02/16 09:57:05 | 000,000,270 | —- | M] () – C:\WINDOWS\Tasks\Backup.job
[2010/03/18 14:04:46 | 000,000,402 | -H– | M] () – C:\WINDOWS\Tasks\User_Feed_Synchronization-{C1000964-AA95-4E84-990A-2DFD6562E161}.job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >

< MD5 for: AGP440.SYS >
[2004/10/27 18:58:26 | 022,245,337 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\I386\sp2.cab:AGP440.sys
[2008/09/02 10:12:07 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\I386\sp3.cab:AGP440.sys
[2004/10/27 18:58:26 | 022,245,337 | —- | M] () .cab file – C:\WINDOWS\ServicePackFiles\i386\sp2.cab:AGP440.sys
[2008/09/02 10:12:07 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
[2008/04/13 13:36:38 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 – C:\WINDOWS\erdnt\cache\agp440.sys
[2008/04/13 13:36:38 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 – C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008/04/13 13:36:38 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 – C:\WINDOWS\SYSTEM32\DRIVERS\agp440.sys
[2004/08/04 01:07:41 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB – C:\WINDOWS\$NtServicePackUninstall$\agp440.sys
[2001/08/17 14:58:00 | 000,025,472 | —- | M] (Microsoft Corporation) MD5=65880045C51AA36184841CEE915A61DF – C:\I386\AGP440.SYS

< MD5 for: ATAPI.SYS >
[2002/08/29 06:00:00 | 010,158,890 | —- | M] () .cab file – C:\I386\sp1.cab:atapi.sys
[2002/08/29 06:00:00 | 010,158,890 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\I386\sp1.cab:atapi.sys
[2004/10/27 18:58:26 | 022,245,337 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\I386\sp2.cab:atapi.sys
[2008/09/02 10:12:07 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\I386\sp3.cab:atapi.sys
[2004/10/27 18:58:26 | 022,245,337 | —- | M] () .cab file – C:\WINDOWS\ServicePackFiles\i386\sp2.cab:atapi.sys
[2008/09/02 10:12:07 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2008/04/13 13:40:30 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\erdnt\cache\atapi.sys
[2008/04/13 13:40:30 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008/04/13 13:40:30 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\SYSTEM32\DRIVERS\atapi.sys
[2004/08/04 00:59:42 | 000,095,360 | —- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 – C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
[2003/04/23 10:29:54 | 000,087,296 | —- | M] (Microsoft Corporation) MD5=E52B3B3F78C9AE85806CE49DCDD80C18 – C:\I386\atapi.sys

< MD5 for: EVENTLOG.DLL >
[2008/04/13 19:11:53 | 000,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\erdnt\cache\eventlog.dll
[2008/04/13 19:11:53 | 000,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008/04/13 19:11:53 | 000,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\SYSTEM32\eventlog.dll
[2004/08/04 02:56:42 | 000,055,808 | —- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 – C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll
[2002/08/29 06:00:00 | 000,049,152 | —- | M] (Microsoft Corporation) MD5=BF3C8CF53C77B48206B39910B6D6CBCC – C:\I386\EVENTLOG.DLL

< MD5 for: IASTOR.SYS >
[2003/07/03 01:00:00 | 000,274,816 | —- | M] (Intel Corporation) MD5=50B56E7DE809BE4B8F4D24B3F0381520 – C:\DRIVERS\STORAGE\ONBOARD\IASTOR.SYS
[2003/07/03 01:00:00 | 000,274,816 | —- | M] (Intel Corporation) MD5=50B56E7DE809BE4B8F4D24B3F0381520 – C:\I386\IASTOR.SYS
[2003/07/03 01:00:00 | 000,274,816 | —- | M] (Intel Corporation) MD5=50B56E7DE809BE4B8F4D24B3F0381520 – C:\WINDOWS\SYSTEM32\DRIVERS\iaStor.sys

< MD5 for: NETLOGON.DLL >
[2008/04/13 19:12:01 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\erdnt\cache\netlogon.dll
[2008/04/13 19:12:01 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008/04/13 19:12:01 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\SYSTEM32\netlogon.dll
[2002/08/29 06:00:00 | 000,399,360 | —- | M] (Microsoft Corporation) MD5=3ADD563ED7A1C66E6F5E0F7A661AA96D – C:\I386\NETLOGON.DLL
[2004/08/04 02:56:44 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A – C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll

< MD5 for: SCECLI.DLL >
[2004/08/04 02:56:44 | 000,180,224 | —- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A – C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
[2002/08/29 06:00:00 | 000,174,592 | —- | M] (Microsoft Corporation) MD5=97418A5C642A5C748A28BD7CF6860B57 – C:\I386\SCECLI.DLL
[2008/04/13 19:12:05 | 000,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\erdnt\cache\scecli.dll
[2008/04/13 19:12:05 | 000,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008/04/13 19:12:05 | 000,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\SYSTEM32\scecli.dll

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[4 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2002/09/03 14:22:52 | 000,094,208 | —- | M] () – C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.SAV
[2002/09/03 14:22:52 | 000,626,688 | —- | M] () – C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.SAV
[2002/09/03 14:22:52 | 000,397,312 | —- | M] () – C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.SAV

========== Alternate Data Streams ==========

@Alternate Data Stream - 120 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34
@Alternate Data Stream - 102 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:27AAAD97
< End of report >

And Extras.txt:

OTL Extras logfile created on: 3/19/2010 9:59:25 AM - Run 1
OTL by OldTimer - Version 3.1.37.3 Folder = C:\Documents and Settings\Sara Byron\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 74.00% Memory free
3.00 Gb Paging File | 2.00 Gb Available in Paging File | 85.00% Paging File free
Paging file location(s): C:\pagefile.sys 864 1728 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 111.72 Gb Total Space | 25.76 Gb Free Space | 23.06% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: FAMILYDELL
Current User Name: Sara Byron
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 14 Days
Output = Minimal
Quick Scan

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
htmlfile – "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusOverride" = 0
"FirewallOverride" = 0
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"FirstRunDisabled" = 1
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"26675:TCP" = 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"26675:TCP" = 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe" = C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live Sync – (Microsoft Corporation)
"C:\Program Files\Microsoft ActiveSync\rapimgr.exe" = C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager – (Microsoft Corporation)
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe" = C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager – (Microsoft Corporation)
"C:\Program Files\Microsoft ActiveSync\WCESMgr.exe" = C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application – (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Sony\Station\Launchpad\LaunchPad.exe" = C:\Program Files\Sony\Station\Launchpad\LaunchPad.exe:*:Enabled:LaunchPad – ()
"C:\Program Files\VentSrv\ventrilo_srv.exe" = C:\Program Files\VentSrv\ventrilo_srv.exe:*:Disabled:ventrilo_srv – ()
"C:\Program Files\Pinnacle\Studio 10\programs\RM.exe" = C:\Program Files\Pinnacle\Studio 10\programs\RM.exe:*:Enabled:Render Manager – (Pinnacle Systems)
"C:\Program Files\Pinnacle\Studio 10\programs\PMSRegisterFile.exe" = C:\Program Files\Pinnacle\Studio 10\programs\PMSRegisterFile.exe:*:Enabled:PMSRegisterFile – ( )
"C:\Program Files\Pinnacle\Studio 10\programs\umi.exe" = C:\Program Files\Pinnacle\Studio 10\programs\umi.exe:*:Enabled:umi – (Pinnacle Systems)
"C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\HP1006MC.EXE" = C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\HP1006MC.EXE:*:Enabled:SMLMProxy Module - HP1006MC.EXE – (Software 2000 Limited)
"C:\Program Files\TurboTax\Home & Business 2007\32bit\ttax.exe" = C:\Program Files\TurboTax\Home & Business 2007\32bit\ttax.exe:LocalSubNet:Enabled:TurboTax – (Intuit, Inc.)
"C:\Program Files\TurboTax\Home & Business 2007\32bit\updatemgr.exe" = C:\Program Files\TurboTax\Home & Business 2007\32bit\updatemgr.exe:LocalSubNet:Enabled:TurboTax Update Manager – (Intuit, Inc.)
"C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe" = C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe:*:Enabled:Windows Live Sync – (Microsoft Corporation)
"C:\Program Files\Microsoft ActiveSync\rapimgr.exe" = C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager – (Microsoft Corporation)
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe" = C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager – (Microsoft Corporation)
"C:\Program Files\Microsoft ActiveSync\WCESMgr.exe" = C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application – (Microsoft Corporation)
"C:\Program Files\Pinnacle\Studio 10\programs\Studio.exe" = C:\Program Files\Pinnacle\Studio 10\programs\Studio.exe:*:Enabled:Studio – (Pinnacle Systems)
"C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe" = C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe:*:Enabled:McAfee Network Agent – (McAfee, Inc.)
"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes – (Apple Inc.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
"{1451DE6B-ABE1-4F62-BE9A-B363A17588A2}" = QuickTime
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{26A24AE4-039D-4CA4-87B4-2F83216013FF}" = Java™ 6 Update 13
"{39F6E2B4-CFE8-C30A-66E8-489651F0F34C}" = Adobe Media Player
"{3AC54383-31D1-4907-961B-B12CBB1D0AE8}" = MobileMe Control Panel
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{3C52E7DA-C431-4239-B66B-1BF703D5B194}" = Windows Live Photo Gallery
"{3CB05291-F546-458E-A796-B5BCF5A3CDC4}" = Studio 10
"{3FA365DF-2D68-45ED-8F83-8C8A33E65143}" = Apple Application Support
"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant
"{4A7FDA4D-F4D7-4A49-934A-066D59A43C7E}" = SmartSound Quicktracks Plugin
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}" = Choice Guard
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{91CA0409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Small Business Edition 2003
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9559F7CA-5E34-4237-A2D9-D856464AD727}" = Project64 1.6
"{99052DB7-9592-4522-A558-5417BBAD48EE}" = Microsoft ActiveSync
"{A1BF9950-8CDB-468E-83FA-EACFB00EA7D5}" = Windows Live Sync
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A5F68DC8-0278-4AD8-B413-861509B5F25B}" = ArcSoft Panorama Maker 3
"{AADEA55D-C834-4BCB-98A3-4B8D1C18F4EE}" = Apple Mobile Device Support
"{AC76BA86-7AD7-1033-7B44-A93000000001}" = Adobe Reader 9.3.1
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C6CA8874-5F22-4AF0-9BE3-016BF299C536}" = Windows Live Essentials
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D2FCC1AE-6311-47C5-8130-C6C66D77DD71}" = Nikon Message Center
"{D6E4E5D6-7693-4BB4-95BA-21F38FAFEE90}" = Safari
"{EF7E931D-DC84-471B-8DB6-A83358095474}" = EA Download Manager
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"{F439D7AF-03F3-4F8E-AEC4-571BFE977C61}" = iTunes
"{FD6034A3-655C-49F0-B496-D4CBFD74D7A7}" = Palm Desktop by ACCESS
"{FF1482CF-D19B-44DD-B887-9698CB51DFD5}" = Studio 10.8 Patch
"{FF3999BE-1A7B-4738-88AA-97BF14094A4A}" = PictureProject
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"All ATI Software" = ATI - Software Uninstall Utility
"Amazon MP3 Downloader" = Amazon MP3 Downloader 1.0.5
"AU10_is1" = Advanced Uninstaller PRO - Version 10
"BCM V.92 56K Modem" = BCM V.92 56K Modem
"CleanUp!" = CleanUp!
"Click'N Design 3D" = Click'N Design 3D
"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player
"Dell Digital Jukebox Driver" = Dell Digital Jukebox Driver
"ERUNT_is1" = ERUNT 1.1j
"FECfile" = FECfile
"FECfile5.3.1.0" = FECfile
"Free Mp3 Wma Converter_is1" = Free Mp3 Wma Converter V 1.8.0
"HandAble.com KnitAble for PalmOS" = HandAble.com KnitAble for PalmOS
"HP LaserJet P1000 series" = HP LaserJet P1000 series
"IDIS" = IDIS
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie8" = Windows Internet Explorer 8
"InstallShield_{3D047C15-C859-45F7-81CE-F2681778069B}" = iPod for Windows 2006-01-10
"InstallShield_{4A7FDA4D-F4D7-4A49-934A-066D59A43C7E}" = SmartSound Quicktracks Plugin
"InstallShield_{A642BB6B-CA1D-4142-8DD4-318C3F3DC834}" = Rome - Total War™
"InterActual Player" = InterActual Player
"Macromedia Shockwave Player" = Macromedia Shockwave Player
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"McAfee Security Scan" = McAfee Security Scan
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.5.8)" = Mozilla Firefox (3.5.8)
"MS Access 97 SP2" = MS Access 97 SP2
"MSC" = McAfee SecurityCenter
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"pdfFactory" = pdfFactory
"Photodex Presenter" = Photodex Presenter
"PictureProject In Touch Downloader" = PictureProject In Touch Downloader 1.0
"proDAD-Heroglyph-2.5" = proDAD Heroglyph 2.5
"PROSet" = Intel® PRO Network Adapters and Drivers
"ProShow Gold" = ProShow Gold
"Raining Poogles" = Raining Poogles Screen Saver
"SM1FX_AT" = USB Storage Adapter FX (SM1)
"SoftwareUpdUtility" = Download Updater (AOL LLC)
"SpywareGuard_is1" = SpywareGuard v2.2
"Switch" = Switch
"TeamSpeak 2 Server_is1" = TeamSpeak 2 Server RC2
"Viewpoint Manager" = Viewpoint Manager (Remove Only)
"ViewpointMediaPlayer" = Viewpoint Media Player
"W2 Mate (2006)_is1" = W2 Mate (2006) 2.0
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows Mobile Device Handbook" = Windows Mobile® Device Handbook
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinLiveSuite_Wave3" = Windows Live Essentials
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Move Networks Player - IE" = Move Networks Media Player for Internet Explorer

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 3/14/2010 3:00:53 PM | Computer Name = FAMILYDELL | Source = NativeWrapper | ID = 5000
Description =

Error - 3/18/2010 3:07:10 PM | Computer Name = FAMILYDELL | Source = MsiInstaller | ID = 11706
Description = Product: Microsoft .NET Framework 1.1 – Error 1706.No valid source
could be found for product Microsoft .NET Framework 1.1. The Windows installer
cannot continue.

Error - 3/18/2010 3:07:14 PM | Computer Name = FAMILYDELL | Source = MsiInstaller | ID = 1023
Description = Product: Microsoft .NET Framework 1.1 - Update '{DAA94A2A-2A8D-4D3B-9DB8-56FBECED082D}'
could not be installed. Error code 1603. Additional information is available in
the log file C:\WINDOWS\TEMP\NDP1.1sp1-KB953297-X86\NDP1.1sp1-KB953297-X86-msi.0.log.

Error - 3/18/2010 3:07:18 PM | Computer Name = FAMILYDELL | Source = NativeWrapper | ID = 5000
Description =

Error - 3/18/2010 3:14:38 PM | Computer Name = FAMILYDELL | Source = MsiInstaller | ID = 11706
Description = Product: Microsoft .NET Framework 1.1 – Error 1706.No valid source
could be found for product Microsoft .NET Framework 1.1. The Windows installer
cannot continue.

Error - 3/18/2010 3:14:40 PM | Computer Name = FAMILYDELL | Source = MsiInstaller | ID = 1023
Description = Product: Microsoft .NET Framework 1.1 - Update '{DAA94A2A-2A8D-4D3B-9DB8-56FBECED082D}'
could not be installed. Error code 1603. Additional information is available in
the log file C:\WINDOWS\TEMP\NDP1.1sp1-KB953297-X86\NDP1.1sp1-KB953297-X86-msi.0.log.

Error - 3/18/2010 3:14:46 PM | Computer Name = FAMILYDELL | Source = NativeWrapper | ID = 5000
Description =

Error - 3/19/2010 8:35:39 AM | Computer Name = FAMILYDELL | Source = MsiInstaller | ID = 11706
Description = Product: Microsoft .NET Framework 1.1 – Error 1706.No valid source
could be found for product Microsoft .NET Framework 1.1. The Windows installer
cannot continue.

Error - 3/19/2010 8:35:41 AM | Computer Name = FAMILYDELL | Source = MsiInstaller | ID = 1023
Description = Product: Microsoft .NET Framework 1.1 - Update '{DAA94A2A-2A8D-4D3B-9DB8-56FBECED082D}'
could not be installed. Error code 1603. Additional information is available in
the log file C:\WINDOWS\TEMP\NDP1.1sp1-KB953297-X86\NDP1.1sp1-KB953297-X86-msi.0.log.

Error - 3/19/2010 8:35:42 AM | Computer Name = FAMILYDELL | Source = NativeWrapper | ID = 5000
Description =

[ System Events ]
Error - 3/19/2010 8:37:12 AM | Computer Name = FAMILYDELL | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
SASKUTIL

Error - 3/19/2010 8:37:16 AM | Computer Name = FAMILYDELL | Source = Disk | ID = 458754
Description =

Error - 3/19/2010 8:37:16 AM | Computer Name = FAMILYDELL | Source = Disk | ID = 458754
Description =

Error - 3/19/2010 8:37:16 AM | Computer Name = FAMILYDELL | Source = Disk | ID = 458754
Description =

Error - 3/19/2010 8:37:16 AM | Computer Name = FAMILYDELL | Source = Disk | ID = 458754
Description =

Error - 3/19/2010 8:39:41 AM | Computer Name = FAMILYDELL | Source = Disk | ID = 458754
Description =

Error - 3/19/2010 8:39:42 AM | Computer Name = FAMILYDELL | Source = Disk | ID = 458754
Description =

Error - 3/19/2010 10:56:27 AM | Computer Name = FAMILYDELL | Source = Disk | ID = 458754
Description =

Error - 3/19/2010 10:59:25 AM | Computer Name = FAMILYDELL | Source = Disk | ID = 458754
Description =

Error - 3/19/2010 10:59:44 AM | Computer Name = FAMILYDELL | Source = Disk | ID = 458754
Description =

< End of report >

CatByte

Post #78March 19, 2010, 4:01 PM UTC last edited March 19, 2010, 4:02 PM UTC

Hi, almost there

I would delete the backups that you have from that external drive and make fresh ones. (scan the drive prior to saving fresh backups)

You can run an online Kaspersky scan - choosing only to scan the external drive to see if any threats are detected.

Please do the following:

Run OTL.exe

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

:OTL
[2008/10/17 11:36:13 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\hcxkzcxk
[2004/09/27 18:44:26 | 000,009,199 | —- | C] () – C:\WINDOWS\Xuvgkvan.ini
[2004/09/27 18:44:39 | 000,000,045 | —- | C] () – C:\WINDOWS\CGKIMOIK.ini
O15 - HKCU\..Trusted Domains: mmjbdata.com ([online] http is out of zone range - 5)

:Commands
[purity]
[emptytemp]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Then post the OTL log

NEXT

Go to Start > Run > copy/paste the bolded command into the run box > OK

helpasst -cleanup

NEXT

Please open your MalwareBytes AntiMalware Program
Click the Update Tab and search for updates
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish, so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected. <– very important
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.

NEXT

Run the Kaspersky scan on the external drive separately - make certain you do not open anything on the drive: (adjust the instructions to the proper drive letter when you go to scan the external drive)

the scan could take hours - so be patient:

Using Internet Explorer or Firefox, visit Kaspersky On-line Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.
2. To optimize scanning time and produce a more sensible report for review:

Close any open programs
Turn off the real time scanner of any existing antivirus program while performing the online scan.

3. Click Run at the Security prompt.
The program will then begin downloading and installing and will also update the database.
Please be patient as this can take quite a long time to download.

Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
Click View scan report at the bottom.

[external image: Posted Image]
Click the Save as Text button to save the file to your desktop so that you may post it in your next reply

post the results of the scan on your machine as well as on the external drive.

Patrick's Mom

Post #79March 19, 2010, 4:30 PM UTC

Everything is running wonderfully! My only outstanding question was in my last post - and that is: what should I do before or when I reconnect the external hard drive? Oh and one more - I will re-boot and see if that netservice error message is still coming up - that appeared during this clean up. User name HelpAssistant Full Name Remote Desktop Help Assistant Account Comment Account for Providing Remote Assistance User's comment Country code 000 (System Default) Account active No Account expires Never Password last set 3/18/2010 2:04 PM Password expires Never Password changeable 3/18/2010 2:04 PM Password required Yes User may change password Yes Workstations allowed All Logon script User profile Home directory Last logon 3/18/2010 2:04 PM Logon hours allowed All Local Group Memberships Global Group memberships *None The command completed successfully.

CatByte

Post #80March 19, 2010, 5:09 PM UTC

The autorun feature for your external drive will not be working at this moment (by design) so it is OK to plug it in, just don't open the drive or anything on it, then visit the Kaspersky online scanner site from my last post…choose the drive letter of the external drive, then scan it.

Patrick's Mom

Post #81March 20, 2010, 10:51 PM UTC

It took me awhile to get all that done!

But first, I want to remember to say that I still get this error message when I log in. It cropped up during all this cleanup - I am not sure what I need to re-install. Do you have any idea? The error message is: Netdrive.exe - Unable to locate component
This application has failed to start because RFHelper.dll was not found. Re-installing the application may fix this problem.

OTL log:

OTL logfile created on: 3/19/2010 9:59:25 AM - Run 1
OTL by OldTimer - Version 3.1.37.3 Folder = C:\Documents and Settings\Sara Byron\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 74.00% Memory free
3.00 Gb Paging File | 2.00 Gb Available in Paging File | 85.00% Paging File free
Paging file location(s): C:\pagefile.sys 864 1728 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 111.72 Gb Total Space | 25.76 Gb Free Space | 23.06% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: FAMILYDELL
Current User Name: Sara Byron
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 14 Days
Output = Minimal
Quick Scan

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Sara Byron\Desktop\OTL.exe (OldTimer Tools)
PRC - c:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\MPF\MpfSrv.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\VirusScan\Mcshield.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\VirusScan\mcsysmon.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee Security Scan\1.0.150\SSScheduler.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\MSC\mcmscsvc.exe (McAfee, Inc.)
PRC - c:\Program Files\Common Files\McAfee\McProxy\McProxy.exe (McAfee, Inc.)
PRC - c:\Program Files\Common Files\McAfee\MNA\McNASvc.exe (McAfee, Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Photodex\ProShowGold\scsiaccess.exe ()
PRC - C:\Program Files\Palm\Hotsync.exe (PalmSource, Inc)
PRC - C:\WINDOWS\SYSTEM32\UAService7.exe ()
PRC - C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\HP1006MC.EXE (Software 2000 Limited)
PRC - C:\Program Files\Viewpoint\Common\ViewpointService.exe (Viewpoint Corporation)
PRC - C:\Program Files\Microsoft ActiveSync\wcescomm.exe (Microsoft Corporation)
PRC - C:\Program Files\Microsoft ActiveSync\rapimgr.exe (Microsoft Corporation)
PRC - C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\fppdis2a.exe (FinePrint Software, LLC)
PRC - C:\Program Files\Intel\Intel Application Accelerator\IAANTmon.exe (Intel)
PRC - C:\Program Files\SpywareGuard\sgmain.exe ()

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Sara Byron\Desktop\OTL.exe (OldTimer Tools)

========== Win32 Services (SafeList) ==========

SRV - (MpfService) – C:\Program Files\McAfee\MPF\MPFSrv.exe (McAfee, Inc.)
SRV - (McODS) – C:\Program Files\McAfee\VirusScan\mcods.exe (McAfee, Inc.)
SRV - (McShield) – C:\Program Files\McAfee\VirusScan\Mcshield.exe (McAfee, Inc.)
SRV - (McSysmon) – C:\Program Files\McAfee\VirusScan\mcsysmon.exe (McAfee, Inc.)
SRV - (mcmscsvc) – C:\Program Files\McAfee\MSC\mcmscsvc.exe (McAfee, Inc.)
SRV - (McProxy) – c:\Program Files\Common Files\McAfee\McProxy\McProxy.exe (McAfee, Inc.)
SRV - (McNASvc) – c:\program files\common files\mcafee\mna\mcnasvc.exe (McAfee, Inc.)
SRV - (spupdsvc) – C:\WINDOWS\SYSTEM32\spupdsvc.exe (Microsoft Corporation)
SRV - (szserver) – C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe (iS3, Inc.)
SRV - (ScsiAccess) – C:\Program Files\Photodex\ProShowGold\scsiaccess.exe ()
SRV - (UserAccess7) SecuROM User Access Service (V7) – C:\WINDOWS\SYSTEM32\UAService7.exe ()
SRV - (Viewpoint Manager Service) – C:\Program Files\Viewpoint\Common\ViewpointService.exe (Viewpoint Corporation)
SRV - (IAANTMon) – C:\Program Files\Intel\Intel Application Accelerator\IAANTmon.exe (Intel)
SRV - (WebDriveService) – C:\Program Files\NetDrive\wdService.exe ()
SRV - (NetSvc) – C:\Program Files\Intel\NCS\Sync\NetSvc.exe (Intel® Corporation)
SRV - (SQLAgent$MICROSOFTBCM) – C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlagent.EXE (Microsoft Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerm…tf8&oe=utf8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://member.square-enix.com/na/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Live Search"
FF - prefs.js..browser.search.defaulturl: "http://search.live.com/results.aspx?FORM=IEFM1&q="
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "https://www.ravelry.com/account/login|https://webauth.att.net/auth/webmail/login?action=Login&url=http%3A%2F%2Fwebmail.att.net%2Fwmc%2Fv%2Fwm%2F49B4A62800082B1E00002C2F2223070362%2F%3Fcmd%3DList%26sid%3Dc0|http://www.voy.com/33031/|http://central.hinsdale86.org/Daily%20Announcements/Forms/AllItems.aspx|http://mail.google.com/mail/?source=navclient-ff&zx=1w0tkde3j7rys&shva=1#inbox|http://www.facebook.com/login.php?v=1.0&api_key=e004be66908863e93f45ec5853daecba&next=%3Faction%3Dseal%26id%3D856664843%26skip%3D856664843&canvas|http://www.atlasquest.com/people/profile.html|http://www.hcbands.org/|http://www.fiberfarm.com/blog"
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {AE93811A-5C9A-4d34-8462-F7B864FC4696}:3.63
FF - prefs.js..keyword.URL: "http://search.live.com/results.aspx?FORM=IEFM1&q="
FF - prefs.js..network.proxy.no_proxies_on: "*.local"

FF - HKLM\software\mozilla\Firefox\Extensions\\{1650a312-02bc-40ee-977e-83f158701739}: C:\Program Files\SiteAdvisor\4144\FF\ [2006/10/20 13:11:22 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.8\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/02/22 19:37:55 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.8\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/02/22 19:37:55 | 000,000,000 | —D | M]

[2008/08/30 14:27:33 | 000,000,000 | —D | M] – C:\Documents and Settings\Sara Byron\Application Data\Mozilla\Extensions
[2010/03/18 14:29:44 | 000,000,000 | —D | M] – C:\Documents and Settings\Sara Byron\Application Data\Mozilla\Firefox\Profiles\sayrjs30.default\extensions
[2009/09/07 12:31:14 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Sara Byron\Application Data\Mozilla\Firefox\Profiles\sayrjs30.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/02/12 16:29:16 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Sara Byron\Application Data\Mozilla\Firefox\Profiles\sayrjs30.default\extensions\{AE93811A-5C9A-4d34-8462-F7B864FC4696}
[2008/11/12 09:32:23 | 000,001,739 | —- | M] () – C:\Documents and Settings\Sara Byron\Application Data\Mozilla\Firefox\Profiles\sayrjs30.default\searchplugins\aim-search.xml
[2009/03/09 00:16:26 | 000,001,632 | —- | M] () – C:\Documents and Settings\Sara Byron\Application Data\Mozilla\Firefox\Profiles\sayrjs30.default\searchplugins\live-search.xml
[2010/03/18 14:29:44 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2007/05/11 17:41:00 | 000,200,704 | —- | M] (Ancestry.com) – C:\Program Files\Mozilla Firefox\plugins\npImgCtl.dll
[2007/04/16 12:07:12 | 000,180,293 | —- | M] () – C:\Program Files\Mozilla Firefox\plugins\npViewpoint.dll

O1 HOSTS File: ([2010/03/11 10:11:34 | 000,000,027 | —- | M]) - C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (SpywareGuardDLBLOCK.CBrowserHelper) - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll ()
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll (McAfee, Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\4608\SiteAdv.dll (McAfee, Inc.)
O3 - HKCU\..\Toolbar\ShellBrowser: (&Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (&Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll ()
O4 - HKLM..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe (Apple Inc.)
O4 - HKLM..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
O4 - HKLM..\Run: [pdfFactory Dispatcher v2] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fppdis2a.exe (FinePrint Software, LLC)
O4 - HKLM..\Run: [WebDriveTray] C:\Program Files\NetDrive\netdrive.exe ()
O4 - HKCU..\Run: [H/PC Connection Agent] C:\Program Files\Microsoft ActiveSync\wcescomm.exe (Microsoft Corporation)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HotSync Manager.lnk = C:\Program Files\Palm\Hotsync.exe (PalmSource, Inc)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan.lnk = C:\Program Files\McAfee Security Scan\1.0.150\SSScheduler.exe (McAfee, Inc.)
O4 - Startup: C:\Documents and Settings\Sara Byron\Start Menu\Programs\Startup\SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra Button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\Common Files\iS3\Anti-Spyware\iS3lsp.dll (iS3 & AVG Exploit Prevention Labs, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\Common Files\iS3\Anti-Spyware\iS3lsp.dll (iS3 & AVG Exploit Prevention Labs, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files\Common Files\iS3\Anti-Spyware\iS3lsp.dll (iS3 & AVG Exploit Prevention Labs, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files\Common Files\iS3\Anti-Spyware\iS3lsp.dll (iS3 & AVG Exploit Prevention Labs, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files\Common Files\iS3\Anti-Spyware\iS3lsp.dll (iS3 & AVG Exploit Prevention Labs, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\Program Files\Common Files\iS3\Anti-Spyware\iS3lsp.dll (iS3 & AVG Exploit Prevention Labs, Inc.)
O12 - Plugin for: .spop - C:\Program Files\Internet Explorer\PLUGINS\NPDocBox.dll (Intertrust Technologies, Inc.)
O15 - HKCU\..Trusted Domains: mmjbdata.com ([online] http is out of zone range - 5)
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} http://download.microsoft.com/download/e/4…/OGAControl.cab (Office Genuine Advantage Validation Tool)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} http://bin.mcafee.com/molbin/shared/mcinsc…84/mcinsctl.cab (McAfee.com Operating System Class)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://www.update.microsoft.com/windowsupd…b?1212589685328 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdat…b?1124298262359 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} http://bin.mcafee.com/molbin/shared/mcgdmg…,21/mcgdmgr.cab (DwnldGroupMgr Class)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O18 - Protocol\Handler\siteadvisor {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - C:\Program Files\SiteAdvisor\4608\SiteAdv.dll (McAfee, Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop WallPaper: C:\Documents and Settings\Sara Byron\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Sara Byron\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O28 - HKLM ShellExecuteHooks: {81559C35-8464-49F7-BB0E-07A383BEF910} - C:\Program Files\SpywareGuard\spywareguard.dll ()
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/05/11 17:07:39 | 000,000,095 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - C:\WINDOWS\SYSTEM32\IAS [2004/03/29 16:26:50 | 000,000,000 | —D | M]
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (16891891626803200)

========== Files/Folders - Created Within 14 Days ==========

[2010/03/19 09:58:05 | 000,555,520 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Sara Byron\Desktop\OTL.exe
[2010/03/18 14:19:22 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2010/03/12 00:10:42 | 000,000,000 | —D | C] – C:\HelpAsst_backup
[2010/03/11 09:50:04 | 000,000,000 | RHSD | C] – C:\cmdcons
[2009/03/07 11:35:46 | 000,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Application Data\Xfire
[2008/11/06 12:57:39 | 000,000,000 | –SD | M] – C:\Documents and Settings\LocalService\Application Data\Microsoft
[2007/08/25 10:23:01 | 000,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Apple
[2004/12/23 23:53:48 | 000,036,963 | R— | C] (Cypress Semiconductor) – C:\Program Files\Common Files\SM1updtr.dll
[2004/11/19 21:55:53 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Application Data\McAfee.com
[2004/11/06 17:39:43 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[2004/07/09 08:30:38 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Application Data\Macromedia
[2004/03/29 17:00:30 | 000,065,536 | —- | C] ( ) – C:\WINDOWS\System32\a3d.dll
[2004/03/29 16:28:46 | 000,000,000 | –SD | M] – C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2004/03/29 16:28:46 | 000,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
[6 C:\Documents and Settings\Sara Byron\My Documents\*.tmp files -> C:\Documents and Settings\Sara Byron\My Documents\*.tmp -> ]
[4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 14 Days ==========

[2010/03/19 09:58:06 | 000,555,520 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Sara Byron\Desktop\OTL.exe
[2010/03/19 09:56:15 | 000,001,729 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk
[2010/03/19 07:39:30 | 000,001,170 | —- | M] () – C:\WINDOWS\System32\WPA.DBL
[2010/03/19 07:39:20 | 000,013,637 | —- | M] () – C:\WINDOWS\System32\Config.MPF
[2010/03/19 07:36:53 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/03/19 07:36:51 | 000,002,048 | —- | M] () – C:\WINDOWS\bootstat.dat
[2010/03/19 07:36:49 | 2146,500,608 | -HS- | M] () – C:\hiberfil.sys
[2010/03/19 07:36:06 | 000,030,036 | —- | M] () – C:\WINDOWS\System32\BMXStateBkp-{00000002-00000000-00000002-00001102-00000004-10031102}.rfx
[2010/03/19 07:36:06 | 000,030,036 | —- | M] () – C:\WINDOWS\System32\BMXState-{00000002-00000000-00000002-00001102-00000004-10031102}.rfx
[2010/03/19 07:36:06 | 000,029,760 | —- | M] () – C:\WINDOWS\System32\BMXCtrlState-{00000002-00000000-00000002-00001102-00000004-10031102}.rfx
[2010/03/19 07:36:06 | 000,029,760 | —- | M] () – C:\WINDOWS\System32\BMXBkpCtrlState-{00000002-00000000-00000002-00001102-00000004-10031102}.rfx
[2010/03/19 07:36:06 | 000,001,080 | —- | M] () – C:\WINDOWS\System32\settingsbkup.sfm
[2010/03/19 07:36:06 | 000,001,080 | —- | M] () – C:\WINDOWS\System32\settings.sfm
[2010/03/19 07:36:06 | 000,000,288 | —- | M] () – C:\WINDOWS\System32\DVCStateBkp-{00000002-00000000-00000002-00001102-00000004-10031102}.dat
[2010/03/19 07:36:06 | 000,000,288 | —- | M] () – C:\WINDOWS\System32\DVCState-{00000002-00000000-00000002-00001102-00000004-10031102}.dat
[2010/03/19 07:34:50 | 009,437,184 | -H– | M] () – C:\Documents and Settings\Sara Byron\NTUSER.DAT
[2010/03/19 07:34:50 | 000,000,278 | -HS- | M] () – C:\Documents and Settings\Sara Byron\ntuser.ini
[2010/03/18 21:31:54 | 000,488,240 | —- | M] () – C:\Documents and Settings\Sara Byron\Desktop\HelpAsst_mebroot_fix.exe
[2010/03/18 14:04:46 | 000,000,402 | -H– | M] () – C:\WINDOWS\tasks\User_Feed_Synchronization-{C1000964-AA95-4E84-990A-2DFD6562E161}.job
[2010/03/15 11:21:08 | 000,383,570 | —- | M] () – C:\WINDOWS\System32\PERFH009.DAT
[2010/03/15 11:21:08 | 000,062,798 | —- | M] () – C:\WINDOWS\System32\PERFC009.DAT
[2010/03/15 11:21:07 | 000,456,086 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2010/03/14 20:52:49 | 000,002,137 | —- | M] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2010/03/11 10:12:08 | 000,000,000 | —- | M] () – C:\WINDOWS\system.ini
[2010/03/11 10:11:34 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\ETC\hosts
[2010/03/11 09:50:13 | 000,000,281 | RHS- | M] () – C:\boot.ini
[2010/03/11 09:35:23 | 003,887,257 | R— | M] () – C:\Documents and Settings\Sara Byron\Desktop\ComboFix.exe
[2010/03/10 15:06:40 | 000,000,112 | —- | M] () – C:\WINDOWS\WIN.INI
[2010/03/08 14:39:19 | 000,524,288 | —- | M] () – C:\Documents and Settings\Sara Byron\Desktop\dds.com
[2010/03/06 00:51:23 | 000,000,211 | —- | M] () – C:\Boot.bak
[6 C:\Documents and Settings\Sara Byron\My Documents\*.tmp files -> C:\Documents and Settings\Sara Byron\My Documents\*.tmp -> ]
[4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/03/18 21:31:53 | 000,488,240 | —- | C] () – C:\Documents and Settings\Sara Byron\Desktop\HelpAsst_mebroot_fix.exe
[2010/03/11 09:50:07 | 000,260,272 | —- | C] () – C:\cmldr
[2010/03/11 09:35:09 | 003,887,257 | R— | C] () – C:\Documents and Settings\Sara Byron\Desktop\ComboFix.exe
[2010/03/10 15:20:43 | 2146,500,608 | -HS- | C] () – C:\hiberfil.sys
[2010/03/08 14:40:08 | 000,293,376 | —- | C] () – C:\Documents and Settings\Sara Byron\Desktop\gmer.exe
[2010/03/08 14:39:19 | 000,524,288 | —- | C] () – C:\Documents and Settings\Sara Byron\Desktop\dds.com
[2009/08/03 16:07:42 | 000,403,816 | —- | C] () – C:\WINDOWS\System32\OGACheckControl.dll
[2009/05/14 09:20:02 | 000,000,133 | —- | C] () – C:\Documents and Settings\All Users\Application Data\Microsoft.SqlServer.Compact.351.32.bc
[2009/04/19 09:41:27 | 000,002,528 | —- | C] () – C:\Documents and Settings\Sara Byron\Application Data\$_hpcst$.hpc
[2009/03/01 12:25:06 | 000,000,094 | —- | C] () – C:\WINDOWS\family.ini
[2009/02/22 09:50:03 | 001,380,403 | —- | C] () – C:\WINDOWS\System32\avgsdk.dll
[2009/02/22 09:20:44 | 000,000,264 | —- | C] () – C:\WINDOWS\reimage.ini
[2008/05/02 13:55:37 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\HPPLVS.dll
[2008/04/21 08:25:39 | 000,000,014 | —- | C] () – C:\WINDOWS\hpmssnpjt.ini
[2008/03/31 20:28:10 | 000,043,520 | —- | C] () – C:\WINDOWS\System32\CmdLineExt03.dll
[2008/03/20 09:24:43 | 000,484,352 | —- | C] () – C:\WINDOWS\System32\lame_enc.dll
[2008/03/20 09:24:43 | 000,086,016 | —- | C] () – C:\WINDOWS\System32\DVResampleru.dll
[2008/03/19 16:19:21 | 000,194,248 | —- | C] () – C:\WINDOWS\System32\LTRFD13n.DLL
[2008/02/12 22:13:17 | 000,138,752 | —- | C] () – C:\WINDOWS\System32\mase32.dll
[2008/02/12 22:13:17 | 000,057,856 | —- | C] () – C:\WINDOWS\System32\masd32.dll
[2008/02/12 22:13:16 | 000,196,096 | —- | C] () – C:\WINDOWS\System32\macd32.dll
[2008/02/12 22:13:16 | 000,136,192 | —- | C] () – C:\WINDOWS\System32\mamc32.dll
[2008/02/12 22:13:16 | 000,027,648 | —- | C] () – C:\WINDOWS\System32\ma32.dll
[2008/01/01 19:41:39 | 000,000,020 | -H– | C] () – C:\Documents and Settings\All Users\Application Data\PKP_DLec.DAT
[2008/01/01 19:39:04 | 000,000,268 | RH– | C] () – C:\Documents and Settings\All Users\Application Data\Sci-Fi
[2008/01/01 19:39:04 | 000,000,020 | -H– | C] () – C:\Documents and Settings\All Users\Application Data\PKP_DLds.DAT
[2007/06/11 14:24:28 | 000,114,688 | —- | C] () – C:\WINDOWS\System32\hppatusg01.dll
[2007/03/27 02:55:48 | 003,596,288 | —- | C] () – C:\WINDOWS\System32\qt-dx331.dll
[2007/01/26 18:07:09 | 000,000,029 | —- | C] () – C:\WINDOWS\atid.ini
[2006/12/12 11:24:42 | 000,012,288 | —- | C] () – C:\WINDOWS\System32\DivXWMPExtType.dll
[2006/10/25 11:22:26 | 000,000,000 | —- | C] () – C:\WINDOWS\HPMProp.INI
[2006/10/25 11:21:58 | 000,094,274 | —- | C] () – C:\WINDOWS\System32\HPBHEALR.DLL
[2006/10/22 09:00:15 | 000,000,000 | —- | C] () – C:\WINDOWS\iPlayer.INI
[2006/07/14 12:01:07 | 000,003,344 | —- | C] () – C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2006/03/08 11:11:57 | 000,057,344 | —- | C] () – C:\WINDOWS\HAJEInstall.dll
[2006/02/06 14:25:47 | 000,002,890 | —- | C] () – C:\WINDOWS\fecfile.ini
[2006/02/06 13:25:47 | 000,001,186 | —- | C] () – C:\WINDOWS\FECLoad.ini
[2006/02/06 13:25:47 | 000,000,102 | —- | C] () – C:\WINDOWS\FECHECK5.INI
[2006/01/13 21:51:54 | 000,338,944 | —- | C] () – C:\WINDOWS\System32\lffpx7.dll
[2006/01/13 21:51:54 | 000,118,784 | —- | C] () – C:\WINDOWS\System32\lfkodak.dll
[2006/01/13 21:51:53 | 000,061,440 | —- | C] () – C:\WINDOWS\System32\cdTextCtl.dll
[2005/12/19 15:42:57 | 000,000,766 | —- | C] () – C:\WINDOWS\CoD.INI
[2005/11/01 16:34:13 | 000,000,074 | —- | C] () – C:\WINDOWS\MPLAYER.INI
[2005/10/29 21:28:47 | 000,000,037 | —- | C] () – C:\WINDOWS\Viewer.ini
[2005/10/28 21:41:07 | 000,000,031 | —- | C] () – C:\WINDOWS\SimPark.ini
[2005/09/23 06:20:07 | 000,221,184 | —- | C] () – C:\WINDOWS\System32\rfwdres.dll
[2005/09/23 06:20:07 | 000,126,976 | —- | C] () – C:\WINDOWS\System32\rfshext.dll
[2005/09/23 06:20:07 | 000,032,768 | —- | C] () – C:\WINDOWS\System32\rfhres.dll
[2005/09/23 06:20:07 | 000,024,576 | —- | C] () – C:\WINDOWS\System32\rfshres.dll
[2005/09/23 06:20:07 | 000,020,480 | —- | C] () – C:\WINDOWS\System32\rfstrres.dll
[2005/09/22 08:13:43 | 000,041,984 | —- | C] () – C:\Documents and Settings\Sara Byron\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2005/07/31 12:35:25 | 000,001,750 | —- | C] () – C:\WINDOWS\IDIS.INI
[2005/07/29 13:38:24 | 003,375,104 | —- | C] () – C:\WINDOWS\System32\qt-mt331.dll
[2005/06/20 21:32:15 | 000,000,000 | —- | C] () – C:\WINDOWS\QuickInstall.INI
[2005/03/05 22:55:22 | 000,000,119 | —- | C] () – C:\WINDOWS\NNS.INI
[2005/01/25 18:00:27 | 000,000,316 | —- | C] () – C:\WINDOWS\TLCAPPS.INI
[2004/12/25 19:56:13 | 000,000,248 | —- | C] () – C:\WINDOWS\RomeTW.ini
[2004/12/21 11:49:55 | 000,000,133 | —- | C] () – C:\Documents and Settings\Sara Byron\Local Settings\Application Data\fusioncache.dat
[2004/11/23 21:29:25 | 000,000,000 | —- | C] () – C:\WINDOWS\SETUP32.INI
[2004/11/20 16:43:34 | 000,000,043 | —- | C] () – C:\WINDOWS\KA.INI
[2004/11/13 18:50:28 | 000,000,449 | —- | C] () – C:\WINDOWS\JUNO.INI
[2004/10/29 21:25:35 | 000,000,675 | —- | C] () – C:\WINDOWS\Spidey.ini
[2004/10/23 21:20:18 | 000,000,041 | —- | C] () – C:\Documents and Settings\Sara Byron\Application Data\tvmcwrd.dll
[2004/10/03 11:59:06 | 000,000,029 | —- | C] () – C:\Documents and Settings\LocalService\Application Data\tvmcwrd.dll
[2004/09/28 23:25:17 | 000,000,356 | —- | C] () – C:\WINDOWS\System32\CNCASv51.ini
[2004/09/28 23:25:16 | 000,006,656 | —- | C] () – C:\WINDOWS\System32\CNMVSyf.DLL
[2004/09/28 23:25:10 | 000,000,599 | —- | C] () – C:\WINDOWS\System32\CNCMP51.INI
[2004/09/27 18:44:39 | 000,000,045 | —- | C] () – C:\WINDOWS\CGKIMOIK.ini
[2004/09/27 18:44:26 | 000,009,199 | —- | C] () – C:\WINDOWS\Xuvgkvan.ini
[2004/08/31 13:02:57 | 000,015,099 | —- | C] () – C:\WINDOWS\cdPlayer.ini
[2004/08/11 19:03:08 | 000,000,456 | —- | C] () – C:\WINDOWS\SIERRA.INI
[2004/08/01 15:29:59 | 000,000,021 | —- | C] () – C:\WINDOWS\DVDSentry.ini
[2004/07/23 20:53:44 | 000,000,026 | —- | C] () – C:\WINDOWS\WAR2R.INI
[2004/07/09 22:08:57 | 000,001,351 | —- | C] () – C:\WINDOWS\disney.ini
[2004/07/02 12:25:33 | 000,010,240 | —- | C] () – C:\WINDOWS\System32\vidx16.dll
[2004/03/29 17:18:50 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2004/03/29 17:09:45 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2004/03/29 17:00:49 | 000,000,231 | —- | C] () – C:\WINDOWS\AC3API.INI
[2004/03/29 17:00:33 | 000,066,807 | —- | C] () – C:\WINDOWS\System32\Aud2_Del.ini
[2004/03/29 17:00:33 | 000,000,030 | —- | C] () – C:\WINDOWS\System32\ctzapxx.ini
[2004/03/29 17:00:32 | 000,005,515 | —- | C] () – C:\WINDOWS\System32\ENSDEF.INI
[2004/03/29 17:00:32 | 000,000,180 | —- | C] () – C:\WINDOWS\System32\KILL.INI
[2004/03/29 17:00:08 | 000,000,136 | —- | C] () – C:\WINDOWS\SBWIN.INI
[2004/03/29 16:59:07 | 000,000,197 | —- | C] () – C:\WINDOWS\wininit.ini
[2004/03/29 16:56:11 | 000,000,791 | —- | C] () – C:\WINDOWS\orun32.ini
[2004/03/29 16:44:49 | 000,363,520 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2004/03/29 16:44:41 | 000,001,793 | —- | C] () – C:\WINDOWS\System32\fxsperf.ini
[2004/03/29 16:30:34 | 000,000,552 | —- | C] () – C:\WINDOWS\System32\OEMINFO.INI
[2003/11/20 14:18:40 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini
[2003/01/07 16:05:08 | 000,002,695 | —- | C] () – C:\WINDOWS\System32\OUTLPERF.INI
[2000/01/28 00:00:00 | 000,012,288 | —- | C] () – C:\WINDOWS\System32\HLINKPRX.DLL
[1980/01/01 01:00:00 | 000,126,976 | —- | C] () – C:\WINDOWS\System32\e1000msg.dll

========== LOP Check ==========

[2008/01/01 19:41:39 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\EnterNHelp
[2007/07/02 22:56:57 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Grisoft
[2008/10/17 11:36:13 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\hcxkzcxk
[2009/03/03 14:38:32 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\HotSync
[2010/02/25 11:29:20 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Innovative Solutions
[2007/03/04 20:27:02 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Mediafour
[2004/09/28 22:19:00 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\MSScanAppDataDir
[2005/02/27 19:43:12 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Napster
[2008/01/01 19:39:49 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Nikon
[2008/03/19 16:25:29 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Pinnacle
[2008/03/19 16:26:12 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Pinnacle Studio
[2008/10/13 14:25:08 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SITEguard
[2009/05/11 20:10:28 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SmartSound Software Inc
[2009/03/11 00:00:10 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SSScanAppDataDir
[2008/10/13 16:11:00 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\STOPzilla!
[2008/10/12 19:05:24 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2007/10/01 16:18:31 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Ulead Systems
[2008/01/01 19:41:39 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Ultima_T15
[2008/11/12 09:31:27 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Viewpoint
[2009/03/19 08:49:51 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
[2009/09/20 14:39:13 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2009/04/21 08:43:02 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2007/01/27 15:03:46 | 000,000,000 | —D | M] – C:\Documents and Settings\Sara Byron\Application Data\acccore
[2010/02/18 19:29:08 | 000,000,000 | —D | M] – C:\Documents and Settings\Sara Byron\Application Data\Aim
[2009/12/03 13:01:33 | 000,000,000 | —D | M] – C:\Documents and Settings\Sara Byron\Application Data\Amazon
[2010/02/12 16:52:31 | 000,000,000 | —D | M] – C:\Documents and Settings\Sara Byron\Application Data\Canon
[2009/05/06 08:51:58 | 000,000,000 | —D | M] – C:\Documents and Settings\Sara Byron\Application Data\DNA
[2007/03/21 18:36:50 | 000,000,000 | —D | M] – C:\Documents and Settings\Sara Byron\Application Data\Expedia
[2004/09/03 23:12:55 | 000,000,000 | —D | M] – C:\Documents and Settings\Sara Byron\Application Data\FileOpen
[2005/11/01 16:34:13 | 000,000,000 | —D | M] – C:\Documents and Settings\Sara Byron\Application Data\FTW
[2009/03/03 14:33:19 | 000,000,000 | —D | M] – C:\Documents and Settings\Sara Byron\Application Data\HotSync
[2004/07/31 22:42:11 | 000,000,000 | —D | M] – C:\Documents and Settings\Sara Byron\Application Data\Leadertech
[2007/09/20 22:04:10 | 000,000,000 | —D | M] – C:\Documents and Settings\Sara Byron\Application Data\NCH Swift Sound
[2008/05/29 08:54:17 | 000,000,000 | —D | M] – C:\Documents and Settings\Sara Byron\Application Data\Netscape
[2009/03/08 22:47:29 | 000,000,000 | —D | M] – C:\Documents and Settings\Sara Byron\Application Data\Nikon
[2008/11/24 21:30:15 | 000,000,000 | —D | M] – C:\Documents and Settings\Sara Byron\Application Data\OpenOffice.org
[2005/09/27 23:33:43 | 000,000,000 | —D | M] – C:\Documents and Settings\Sara Byron\Application Data\OurPictures
[2008/11/06 10:37:04 | 000,000,000 | —D | M] – C:\Documents and Settings\Sara Byron\Application Data\OverDrive
[2008/05/29 08:52:50 | 000,000,000 | —D | M] – C:\Documents and Settings\Sara Byron\Application Data\Photodex
[2008/01/12 11:55:09 | 000,000,000 | —D | M] – C:\Documents and Settings\Sara Byron\Application Data\SmartDraw
[2006/05/21 13:02:41 | 000,000,000 | —D | M] – C:\Documents and Settings\Sara Byron\Application Data\Snapfish
[2009/07/21 17:32:10 | 000,000,000 | —D | M] – C:\Documents and Settings\Sara Byron\Application Data\SPORE
[2008/09/13 17:14:35 | 000,000,000 | —D | M] – C:\Documents and Settings\Sara Byron\Application Data\SPORE Creature Creator
[2007/03/13 13:34:37 | 000,000,000 | —D | M] – C:\Documents and Settings\Sara Byron\Application Data\TrinityEnrollment
[2007/10/14 12:36:46 | 000,000,000 | —D | M] – C:\Documents and Settings\Sara Byron\Application Data\Ulead Systems
[2007/06/07 21:34:06 | 000,000,000 | —D | M] – C:\Documents and Settings\Sara Byron\Application Data\Viewpoint
[2004/10/08 09:57:05 | 000,000,000 | —D | M] – C:\Documents and Settings\Sara Byron\Application Data\WeatherBug
[2007/09/16 23:46:42 | 000,000,000 | —D | M] – C:\Documents and Settings\Sara Byron\Application Data\WinPatrol
[2010/02/16 09:57:05 | 000,000,270 | —- | M] () – C:\WINDOWS\Tasks\Backup.job
[2010/03/18 14:04:46 | 000,000,402 | -H– | M] () – C:\WINDOWS\Tasks\User_Feed_Synchronization-{C1000964-AA95-4E84-990A-2DFD6562E161}.job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >

< MD5 for: AGP440.SYS >
[2004/10/27 18:58:26 | 022,245,337 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\I386\sp2.cab:AGP440.sys
[2008/09/02 10:12:07 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\I386\sp3.cab:AGP440.sys
[2004/10/27 18:58:26 | 022,245,337 | —- | M] () .cab file – C:\WINDOWS\ServicePackFiles\i386\sp2.cab:AGP440.sys
[2008/09/02 10:12:07 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
[2008/04/13 13:36:38 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 – C:\WINDOWS\erdnt\cache\agp440.sys
[2008/04/13 13:36:38 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 – C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008/04/13 13:36:38 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 – C:\WINDOWS\SYSTEM32\DRIVERS\agp440.sys
[2004/08/04 01:07:41 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB – C:\WINDOWS\$NtServicePackUninstall$\agp440.sys
[2001/08/17 14:58:00 | 000,025,472 | —- | M] (Microsoft Corporation) MD5=65880045C51AA36184841CEE915A61DF – C:\I386\AGP440.SYS

< MD5 for: ATAPI.SYS >
[2002/08/29 06:00:00 | 010,158,890 | —- | M] () .cab file – C:\I386\sp1.cab:atapi.sys
[2002/08/29 06:00:00 | 010,158,890 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\I386\sp1.cab:atapi.sys
[2004/10/27 18:58:26 | 022,245,337 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\I386\sp2.cab:atapi.sys
[2008/09/02 10:12:07 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\I386\sp3.cab:atapi.sys
[2004/10/27 18:58:26 | 022,245,337 | —- | M] () .cab file – C:\WINDOWS\ServicePackFiles\i386\sp2.cab:atapi.sys
[2008/09/02 10:12:07 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2008/04/13 13:40:30 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\erdnt\cache\atapi.sys
[2008/04/13 13:40:30 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008/04/13 13:40:30 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\SYSTEM32\DRIVERS\atapi.sys
[2004/08/04 00:59:42 | 000,095,360 | —- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 – C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
[2003/04/23 10:29:54 | 000,087,296 | —- | M] (Microsoft Corporation) MD5=E52B3B3F78C9AE85806CE49DCDD80C18 – C:\I386\atapi.sys

< MD5 for: EVENTLOG.DLL >
[2008/04/13 19:11:53 | 000,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\erdnt\cache\eventlog.dll
[2008/04/13 19:11:53 | 000,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008/04/13 19:11:53 | 000,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\SYSTEM32\eventlog.dll
[2004/08/04 02:56:42 | 000,055,808 | —- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 – C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll
[2002/08/29 06:00:00 | 000,049,152 | —- | M] (Microsoft Corporation) MD5=BF3C8CF53C77B48206B39910B6D6CBCC – C:\I386\EVENTLOG.DLL

< MD5 for: IASTOR.SYS >
[2003/07/03 01:00:00 | 000,274,816 | —- | M] (Intel Corporation) MD5=50B56E7DE809BE4B8F4D24B3F0381520 – C:\DRIVERS\STORAGE\ONBOARD\IASTOR.SYS
[2003/07/03 01:00:00 | 000,274,816 | —- | M] (Intel Corporation) MD5=50B56E7DE809BE4B8F4D24B3F0381520 – C:\I386\IASTOR.SYS
[2003/07/03 01:00:00 | 000,274,816 | —- | M] (Intel Corporation) MD5=50B56E7DE809BE4B8F4D24B3F0381520 – C:\WINDOWS\SYSTEM32\DRIVERS\iaStor.sys

< MD5 for: NETLOGON.DLL >
[2008/04/13 19:12:01 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\erdnt\cache\netlogon.dll
[2008/04/13 19:12:01 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008/04/13 19:12:01 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\SYSTEM32\netlogon.dll
[2002/08/29 06:00:00 | 000,399,360 | —- | M] (Microsoft Corporation) MD5=3ADD563ED7A1C66E6F5E0F7A661AA96D – C:\I386\NETLOGON.DLL
[2004/08/04 02:56:44 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A – C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll

< MD5 for: SCECLI.DLL >
[2004/08/04 02:56:44 | 000,180,224 | —- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A – C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
[2002/08/29 06:00:00 | 000,174,592 | —- | M] (Microsoft Corporation) MD5=97418A5C642A5C748A28BD7CF6860B57 – C:\I386\SCECLI.DLL
[2008/04/13 19:12:05 | 000,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\erdnt\cache\scecli.dll
[2008/04/13 19:12:05 | 000,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008/04/13 19:12:05 | 000,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\SYSTEM32\scecli.dll

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[4 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2002/09/03 14:22:52 | 000,094,208 | —- | M] () – C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.SAV
[2002/09/03 14:22:52 | 000,626,688 | —- | M] () – C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.SAV
[2002/09/03 14:22:52 | 000,397,312 | —- | M] () – C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.SAV

========== Alternate Data Streams ==========

@Alternate Data Stream - 120 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34
@Alternate Data Stream - 102 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:27AAAD97
< End of report >

2nd OTL log

All processes killed
========== OTL ==========
C:\Documents and Settings\All Users\Application Data\hcxkzcxk folder moved successfully.
C:\WINDOWS\Xuvgkvan.ini moved successfully.
C:\WINDOWS\CGKIMOIK.ini moved successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\mmjbdata.com\online\ deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Flash cache emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32969 bytes
->Flash cache emptied: 0 bytes

User: Madeleine Jeffers
->Temp folder emptied: 7585 bytes
->Temporary Internet Files folder emptied: 46994 bytes
->Java cache emptied: 76479823 bytes
->FireFox cache emptied: 23710014 bytes
->Flash cache emptied: 99750 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Patrick Jeffers
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Java cache emptied: 47220758 bytes
->FireFox cache emptied: 18235507 bytes
->Apple Safari cache emptied: 7395677 bytes
->Flash cache emptied: 1249938 bytes

User: Robert Jeffers
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Java cache emptied: 70476266 bytes
->FireFox cache emptied: 18556644 bytes
->Flash cache emptied: 98004 bytes

User: Sara Byron
->Temp folder emptied: 618567 bytes
->Temporary Internet Files folder emptied: 3529834 bytes
->Java cache emptied: 96612601 bytes
->FireFox cache emptied: 81299159 bytes
->Flash cache emptied: 2761140 bytes

User: Travis Jeffers
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Java cache emptied: 370573 bytes
->Flash cache emptied: 34618 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 2691651 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 3646331 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 112094 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 434.00 mb

OTL by OldTimer - Version 3.1.37.3 log created on 03192010_130123

Files\Folders moved on Reboot…
File\Folder C:\WINDOWS\temp\mcafee_RbM8ntmEEgG9LDI not found!
File\Folder C:\WINDOWS\temp\mcmsc_BRtJcMnLYDmtlar not found!
File\Folder C:\WINDOWS\temp\mcmsc_fscx4eK4EVII5et not found!
File\Folder C:\WINDOWS\temp\Perflib_Perfdata_204.dat not found!

Registry entries deleted on Reboot…

MBAM Log:

Malwarebytes' Anti-Malware 1.44
Database version: 3886
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

3/19/2010 11:36:35 PM
mbam-log-2010-03-19 (23-36-35).txt

Scan type: Quick Scan
Objects scanned: 178191
Time elapsed: 10 minute(s), 45 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Ran the Kaspersky on-line scanner and there was nothing in the report screen for the computer or when I ran it against the external hard drive. Both scans said that nothing was found. I will also run it on all the USB drives that my daughter uses to take files between home and school.

The coputer is continuing to run very well. I think you did it! Anything else you'd like me to do?

CatByte

Post #82March 20, 2010, 11:20 PM UTC last edited March 20, 2010, 11:27 PM UTC

Hi,

RFHelper.dll appears to be part of a product called WebDrive which is an FTP client implemented as an Explorer shell extension.

If you do not use this program, I suggest removing it from Add/Remove programs if it is there (I don't see it in your uninstall list though?

I can remove the entries with OTL

Please do the following:

Run OTL.exe

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

:OTL
SRV - (WebDriveService) – C:\Program Files\NetDrive\wdService.exe ()
O4 - HKLM..\Run: [WebDriveTray] C:\Program Files\NetDrive\netdrive.exe ()

:Services
WebDriveFSD
RFNP32

:Files
c:\program files\NetDrive\rffsd.sys

:Commands
[purity]
[emptytemp]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Then post the OTL log

NEXT

We have some housekeeping to do now:

Go to Start > Run > copy/paste the bolded command into the run box > OK

helpasst -cleanup

NEXT

[external image: Posted Image]
Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.

Download the latest version of Java Runtime Environment (JRE) 18 and save it to your desktop.
Scroll down to where it says JDK 6 Update 18 (JDK or JRE)
Click the Download JRE button to the right
Select the Windows platform from the dropdown menu.
Read the License Agreement and then check the box that says: "I agree to the Java SE Runtime Environment 6u18 with JavaFX 1 License Agreement". Click on Continue.The page will refresh.
Click on the link to download Windows Offline Installation and save the file to your desktop.
Close any programs you may have running - especially your web browser.
Go to Start > Control Panel, double-click on Add or Remove Programs and remove all older versions of Java.
Check (highlight) any item with Java Runtime Environment (JRE or J2SE or Java™ 6) in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java versions.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-6u18-windows-i586-p.exe to install the newest version.

After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
- On the General tab, under Temporary Internet Files, click the Settings button.
- Next, click on the Delete Files button
- There are two options in the window to clear the cache - Leave BOTH CheckedApplications and Applets
  Trace and Log Files
Click OK on Delete Temporary Files Window
Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
Click OK to leave the Temporary Files Window
Click OK to leave the Java Control Panel.

NEXT:

Follow these steps to uninstall Combofix

Click START then RUN
Now copy/paste Combofix /uninstall into the runbox and click OK. Note the space between the ..X and the /U, it needs to be there.

[external image: Posted Image]

NEXT

Clean up with OTL:

Double-click OTL.exe to start the program.
Close all other programs apart from OTL as this step will require a reboot
On the OTL main screen, press the CLEANUP button
Say Yes to the prompt and then allow the program to reboot your computer.

If any other logs/tools remain on your desktop > right click and delete them.

NEXT

Below I have included a number of recommendations for how to protect your computer against malware infections.

It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
Strong passwords: How to create and use them
Then consider a password keeper, to keep all your passwords safe.
Keep Windows updated by regularly checking their website at :
http://windowsupdate.microsoft.com/
This will ensure your computer has always the latest security updates available installed on your computer.
Make Internet Explorer more secure
Click Start > Run
Type Inetcpl.cpl & click OK
Click on the Security tab
Click Reset all zones to default level
Make sure the Internet Zone is selected & Click Custom level
In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
Next Click OK, then Apply button and then OK to exit the Internet Properties page.

Download TFC to your desktop
Close any open windows.
Double click the TFC icon to run the program
TFC will close all open programs itself in order to run,
Click the Start button to begin the process.
Allow TFC to run uninterrupted.
The program should not take long to finish it's job
Once its finished it should automatically reboot your machine,
if it doesn't, manually reboot to ensure a complete clean

It's normal after running TFC cleaner that the PC will be slower to boot the first time.

WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:

Green to go
Yellow for caution
Red to stop

WOT has an addon available for both Firefox, IE and chrome.

Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.
ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.
In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at these well written articles:
Think Prevention.
PC Safety and Security–What Do I Need?.

**Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them.

It was a pleasure working with you, you did a great job in following all the directions, some of which were difficult, so great job. I'm glad you stuck with me and we were able to clean this computer:

Let me know if the error message disappeared with the last OTL fix.

Patrick's Mom

Post #83March 22, 2010, 7:09 PM UTC

Thank you for you kind words and than you for sticking with me through all this kerfuffle. The PC is working really well. The OTL script removed that error message - but somehow I lost the otl text file. It looked good to me and the PC is working. I went through all of the other steps that you recommended and had an issue with one of them. I checked for windows updates and found a security update that was not installed. I do have the automatic update option active. I tried to load the update and it failed. I looked at the log of recent updates and noticed that the update has been attempted, and failed, daily, since March 11th. Here is the update that is failing: Microsoft .NET Framework 1.1 Service Pack 1 Security Update for Windows 2000, Windows XP, Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2 (KB953297) Any suggestions? Everything else is great. That WOT thing should be interesting. I have a notebook of passwords - but I need to stop using the same one!

CatByte

Post #84March 22, 2010, 7:24 PM UTC

Hi

The update will not install because you don't have .NET Framework 1.1 Service Pack 1 on your system

you have higher versions
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1

so stop that one from trying to install:

Error - 3/18/2010 3:07:10 PM | Computer Name = FAMILYDELL | Source = MsiInstaller | ID = 11706
Description = Product: Microsoft .NET Framework 1.1 – Error 1706.No valid source
could be found for product Microsoft .NET Framework 1.1. The Windows installer
cannot continue.

Please do one more thing for me:

please show hidden files and folders;

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Clear "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Clear "Hide protected operating system files."
Click Apply, and then click OK.

now navigate to C:\ntldr > right click that file and select "properties"

under attributes is the box " read only" selected?

now press the "advanced button" beside the "read only" box

is the button beside "compress to save disk space" selected? (It should NOT be)

thanks

Patrick's Mom

Post #85March 22, 2010, 8:29 PM UTC

Thanks. I'll stop that MS update install. "under attributes is the box " read only" selected?" yes it is "is the button beside "compress to save disk space" selected? (It should NOT be)" and it is NOT

CatByte

Post #86March 22, 2010, 10:12 PM UTC last edited March 22, 2010, 10:13 PM UTC

OK, thanks You should be good now, rehide your files and folders (restore defaults) stay safe

~CB

CatByte

Post #87March 27, 2010, 2:54 PM UTC

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] Slooowww computer, keeps freezing - can't get it cleane

✨ Ask AI

Ask AI