What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Fakeantivirus protector virus? WRL3531

17 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I was by what the tech before on a previous virus that was different & I am now concerned my computer might be infected again with a different virus. I was on a social networking site & one of those fake screens popped up that pretends it is scanning your files & I cont/alt/del to close it. Once doing that I cleared all windows not related to that out but when I went to look at documents in "my documents" folder I noticed a file under the name ~WRL3531.tmp that was not there before. I googled that without the .tmp & saw other people bringing up the issue of viruse infections in relation to that.

I was not clear on all the instructions under the getting started as things have changed but I did run a hijack this log without attempting to do a fix & saved the log. I also ran a MBAM scan which didn't show any infections. Before trying to follow the other instructions without being sure it was correct I will just start with posting the results of the hijack this log below.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:48:59 PM, on 2010-03-06
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\GWMDMMSG.exe
C:\WINNT\system32\SK9910DM.EXE
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\support.com\bin\tgcmd.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINNT\system32\ctfmon.exe
C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe
C:\Program Files\Secunia\PSI\psi.exe
C:\WINNT\system32\devldr32.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
C:\WINNT\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Comcast
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll
O4 - HKLM\..\Run: [GWMDMMSG] GWMDMMSG.exe
O4 - HKLM\..\Run: [Hot Key Kbd 9910 Daemon] SK9910DM.EXE
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\System32\hkcmd.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\support.com\bin\tgcmd.exe" /server
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [LXDBCATS] rundll32 C:\WINNT\System32\spool\DRIVERS\W32X86\3\LXDBtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINNT\system32\ctfmon.exe
O4 - Startup: Secunia PSI.lnk = C:\Program Files\Secunia\PSI\psi.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: ymetray.lnk = C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINNT\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINNT\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\winnt\system32\nwprovau.dll
O15 - Trusted Zone: http://*.mcafee.com
O16 - DPF: bdsripcab - https://media.bdsrealtime.com/components/bdsripcab.cab
O16 - DPF: {01012101-5E80-11D8-9E86-0007E96C65AE} (SupportSoft Script Runner Class) - http://www.comcastsupport.com/OneClickFix/tgctlsr.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1247598275701
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://games.myspace.com/Gameshell/GameHos…ronGameHost.cab
O16 - DPF: {D1D98C0F-A339-42AB-BD5F-EA0FF5D0E65F} (RockYou Image Uploader Control) - http://www.rockyou.com/RockYouImageUploader.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: lxdb_device - - C:\WINNT\system32\lxdbcoms.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: PictureTaker - Unknown owner - c:\fixit\pt\PCTKRNT.SYS (file missing)

–
End of file - 8074 bytes
Post #2
Hi sweetiehlm5, welcome to the forum.

To make cleaning this machine easier
  • Please do not uninstall/install any programs unless asked to
    It is more difficult when files/programs are appearing in/disappearing from the logs.
  • Please do not run any scans other than those requested
  • Please follow all instructions in the order posted
  • All logs/reports, etc.. must be posted in Notepad. Please ensure that word wrap is unchecked. In notepad click format, uncheck word wrap if it is checked.
  • Do not attach any logs/reports, etc.. unless specifically requested to do so.
  • If you have problems with or do not understand the instructions, Please ask before continuing.
  • Please stay with this thread until given the All Clear. A absence of symptoms does not mean a clean machine.
Are you experiencing any problems?

I noticed a file under the name ~WRL3531.tmp

These are usually backups of Word documents and are hidden.

Check these settings

Open windows explorer (right click the Start button and click Explore)

At the top of windows explorer, click tools, folder options, click the
view tab
  • check Display the contents of system folders
  • Uncheck Show hidden files and folders
  • Check "Hide extensions for known file types" box
  • Check "Hide protecting operating system files" box
Click apply, click ok

Download OTL to your desktop.
  • Double click on OTL.exe to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • When the window appears, underneath Output at the top change it to Minimal Output
  • Check the boxes beside LOP Check and Purity Check.
  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.

Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them all in.

No need for a Hijackthis log this time.

Thanks
Post #3
Hello thanks for your help. Computer is a little slow & scared after that fake virus screen popped up earlier today so taking precautions. Will follow your instructions with OTL & post results.
Post #4
OTL.txt notepad log

OTL logfile created on: 2010-03-06 7:30:32 PM - Run 1
OTL by OldTimer - Version 3.1.34.0 Folder = C:\Documents and Settings\Helene Lesueur\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: yyyy-MM-dd

511.00 Mb Total Physical Memory | 247.00 Mb Available Physical Memory | 48.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 72.00% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINNT | %ProgramFiles% = C:\Program Files
Drive C: | 55.88 Gb Total Space | 34.44 Gb Free Space | 61.63% Space Free | Partition Type: FAT32
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: GUESTROOM
Current User Name: Helene Lesueur
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Helene Lesueur\Desktop\OTL.exe (OldTimer Tools)
PRC - c:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\MPF\MpfSrv.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\VirusScan\Mcshield.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\VirusScan\mcsysmon.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\MSC\mcmscsvc.exe (McAfee, Inc.)
PRC - c:\Program Files\Common Files\McAfee\McProxy\McProxy.exe (McAfee, Inc.)
PRC - c:\Program Files\Common Files\McAfee\MNA\McNASvc.exe (McAfee, Inc.)
PRC - C:\Program Files\Secunia\PSI\psi.exe (Secunia)
PRC - C:\WINNT\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe (Yahoo! Inc.)
PRC - C:\WINNT\system32\lxdbcoms.exe ( )
PRC - C:\Program Files\Canon\CAL\CALMAIN.exe (Canon Inc.)
PRC - C:\Program Files\Logitech\MouseWare\system\EM_EXEC.EXE (Logitech Inc.)
PRC - C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\Directcd.exe (Roxio)
PRC - C:\Program Files\support.com\bin\tgcmd.exe (Support.com, Inc.)
PRC - C:\WINNT\GWMDMMSG.exe (GTW)
PRC - C:\WINNT\system32\devldr32.exe (Creative Technology Ltd.)
PRC - C:\WINNT\system32\SK9910DM.EXE (Silitek Corporation)


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Helene Lesueur\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINNT\system32\msvcp60.dll (Microsoft Corporation)
MOD - C:\Program Files\Common Files\Logitech\Scrolling\LGMSGHK.DLL (Logitech Inc.)
MOD - C:\Program Files\Logitech\MouseWare\system\LgWndHk.dll (Logitech Inc.)


========== Win32 Services (SafeList) ==========

SRV - (PictureTaker) – File not found
SRV - (iPodService) – File not found
SRV - (MpfService) – C:\Program Files\McAfee\MPF\MPFSrv.exe (McAfee, Inc.)
SRV - (McODS) – C:\Program Files\McAfee\VirusScan\mcods.exe (McAfee, Inc.)
SRV - (McShield) – C:\Program Files\McAfee\VirusScan\Mcshield.exe (McAfee, Inc.)
SRV - (McSysmon) – C:\Program Files\McAfee\VirusScan\mcsysmon.exe (McAfee, Inc.)
SRV - (mcmscsvc) – C:\Program Files\McAfee\MSC\mcmscsvc.exe (McAfee, Inc.)
SRV - (McProxy) – c:\Program Files\Common Files\McAfee\McProxy\McProxy.exe (McAfee, Inc.)
SRV - (McNASvc) – c:\Program Files\Common Files\McAfee\MNA\McNASvc.exe (McAfee, Inc.)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MsMpEng.exe (Microsoft Corporation)
SRV - (lxdb_device) – C:\WINNT\System32\lxdbcoms.exe ( )
SRV - (CCALib8) – C:\Program Files\Canon\CAL\CALMAIN.exe (Canon Inc.)


========== Driver Services (SafeList) ==========

DRV - (mfehidk) – C:\WINNT\system32\drivers\mfehidk.sys (McAfee, Inc.)
DRV - (mfeavfk) – C:\WINNT\system32\drivers\mfeavfk.sys (McAfee, Inc.)
DRV - (mfesmfk) – C:\WINNT\system32\drivers\mfesmfk.sys (McAfee, Inc.)
DRV - (mfebopk) – C:\WINNT\system32\drivers\mfebopk.sys (McAfee, Inc.)
DRV - (mferkdk) – C:\WINNT\system32\drivers\mferkdk.sys (McAfee, Inc.)
DRV - (MPFP) – C:\WINNT\system32\drivers\Mpfp.sys (McAfee, Inc.)
DRV - (PSI) – C:\WINNT\system32\drivers\psi_mf.sys (Secunia)
DRV - (NwlnkIpx) – C:\WINNT\system32\drivers\nwlnkipx.sys (Microsoft Corporation)
DRV - (gameenum) – C:\WINNT\system32\drivers\gameenum.sys (Microsoft Corporation)
DRV - (usbaudio) USB Audio Driver (WDM) – C:\WINNT\system32\drivers\usbaudio.sys (Microsoft Corporation)
DRV - (Cdralw2k) – C:\WINNT\system32\drivers\cdralw2k.sys (Sonic Solutions)
DRV - (Cdr4_xp) – C:\WINNT\system32\drivers\cdr4_xp.sys (Sonic Solutions)
DRV - (ASPI32) – C:\WINNT\system32\drivers\aspi32.sys (Adaptec)
DRV - (nv) – C:\WINNT\system32\drivers\nv4_mini.sys (NVIDIA Corporation)
DRV - (ati2mtaa) – C:\WINNT\system32\drivers\ati2mtaa.sys (ATI Technologies Inc.)
DRV - (cdrbsvsd) – C:\WINNT\system32\drivers\cdrbsvsd.sys (B.H.A Corporation)
DRV - (LMouFlt2) – C:\WINNT\system32\drivers\LMouFlt2.Sys (Logitech, Inc.)
DRV - (L8042pr2) – C:\WINNT\system32\drivers\L8042pr2.Sys (Logitech, Inc.)
DRV - (LHidUsb) – C:\WINNT\system32\drivers\LHidUsb.sys (Logitech, Inc.)
DRV - (LHidFlt2) – C:\WINNT\system32\drivers\LHidFlt2.Sys (Logitech, Inc.)
DRV - (DCamUSBSQTECH) Dual-Mode DSC(2770) – C:\WINNT\system32\drivers\SQCaptur.sys (Service & Quality Technology.)
DRV - (sonypvs1) – C:\WINNT\system32\drivers\sonypvs1.sys (Sony Corporation)
DRV - (AN983) – C:\WINNT\system32\drivers\an983.sys (ADMtek Incorporated.)
DRV - (ha10kx2k) – C:\WINNT\system32\drivers\ha10kx2k.sys (Creative Technology Ltd)
DRV - (emupia) – C:\WINNT\system32\drivers\emupia2k.sys (Creative Technology Ltd)
DRV - (ctsfm2k) – C:\WINNT\system32\drivers\ctsfm2k.sys (Creative Technology Ltd)
DRV - (ctprxy2k) – C:\WINNT\system32\drivers\ctprxy2k.sys (Creative Technology Ltd)
DRV - (ossrv) – C:\WINNT\system32\drivers\ctoss2k.sys (Creative Technology Ltd.)
DRV - (ctaud2k) Creative Audio Driver (WDM) – C:\WINNT\system32\drivers\ctaud2k.sys (Creative Technology Ltd)
DRV - (ctac32k) – C:\WINNT\system32\drivers\ctac32k.sys (Creative Technology Ltd)
DRV - (MR97310_VGA_DUAL_CAMERA) – C:\WINNT\system32\drivers\MR97310v.sys (Mars Semiconductor Corp.)
DRV - (dvd_2K) – C:\WINNT\system32\drivers\Dvd_2k.sys (Roxio)
DRV - (mmc_2K) – C:\WINNT\system32\drivers\Mmc_2k.sys (Roxio)
DRV - (pwd_2k) – C:\WINNT\system32\drivers\pwd_2K.sys (Roxio)
DRV - (cdudf_xp) – C:\WINNT\system32\drivers\cdudf_xp.sys (Roxio)
DRV - (UdfReadr_xp) – C:\WINNT\system32\drivers\udfreadr_xp.sys (Roxio)
DRV - (GTWModem) – C:\WINNT\system32\drivers\GWMDM.sys (GTW)
DRV - (NwlnkNb) – C:\WINNT\system32\drivers\nwlnknb.sys (Microsoft Corporation)
DRV - (NwlnkSpx) – C:\WINNT\system32\drivers\nwlnkspx.sys (Microsoft Corporation)
DRV - (ms_mpu401) – C:\WINNT\system32\drivers\msmpu401.sys (Microsoft Corporation)
DRV - (MODEMCSA) – C:\WINNT\system32\drivers\MODEMCSA.sys (Microsoft Corporation)
DRV - (ultra) – C:\WINNT\System32\DRIVERS\ultra.sys (Promise Technology, Inc.)
DRV - (BCMModem) – C:\WINNT\system32\drivers\BCMDM.sys (BCM)
DRV - (ati2mpaa) – C:\WINNT\system32\drivers\ati2mpaa.sys (ATI Technologies Inc.)
DRV - (ac97intc) Intel® 82801 Audio Driver Install Service (WDM) – C:\WINNT\system32\drivers\ac97intc.sys (Intel Corporation)
DRV - (sfman) Creative SoundFont Manager Driver (WDM) – C:\WINNT\system32\drivers\sfmanm.sys (Creative Technology Ltd.)
DRV - (emu10k1) Creative Interface Manager Driver (WDM) – C:\WINNT\system32\drivers\ctlfacem.sys (Creative Technology Ltd.)
DRV - (emu10k) Creative SB Live! (WDM) – C:\WINNT\system32\drivers\emu10k1m.sys (Creative Technology Ltd.)
DRV - (ctljystk) – C:\WINNT\system32\drivers\ctljystk.sys (Creative Technology Ltd.)
DRV - (EL90XBC) – C:\WINNT\system32\drivers\el90xbc5.sys (3Com Corporation)
DRV - (Eplpdx02) – C:\WINNT\system32\drivers\EPLPDX02.SYS (MK Systems CO., LTD.)
DRV - (wandrv) – C:\WINNT\system32\drivers\wandrv.sys (America Online, Inc.)
DRV - (Sk9920nt) – C:\WINNT\system32\drivers\Sk9920nt.sys (Silitek Corp.)
DRV - (Sk99202k) – C:\WINNT\system32\drivers\Sk99202k.sys (Silitek Corp.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINNT\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINNT\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Yahoo! Search
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://search.yahoo.com/search?p={searchTe…-8&fr=b1ie7
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll (Yahoo! Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Google"
FF - prefs.js..browser.search.defaulturl: "http://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q="
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "http://www.comcast.net/comcast.html"



[2006-07-17 20:02:48 | 000,000,000 | —D | M] – C:\Documents and Settings\Helene Lesueur\Application Data\Mozilla\Firefox\Profiles\5mmw5ggf.default\extensions

O1 HOSTS File: ([2009-03-29 11:11:18 | 000,000,027 | —- | M]) - C:\WINNT\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Yahoo! Toolbar Helper) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll (Yahoo! Inc.)
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [AdaptecDirectCD] C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe (Roxio)
O4 - HKLM..\Run: [Adobe Photo Downloader] C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [GWMDMMSG] C:\WINNT\GWMDMMSG.exe (GTW)
O4 - HKLM..\Run: [Hot Key Kbd 9910 Daemon] C:\WINNT\System32\SK9910DM.EXE (Silitek Corporation)
O4 - HKLM..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe File not found
O4 - HKLM..\Run: [Logitech Utility] C:\WINNT\LOGI_MWX.EXE (Logitech Inc.)
O4 - HKLM..\Run: [LXDBCATS] C:\WINNT\System32\spool\DRIVERS\W32X86\3\LXDBtime.DLL ()
O4 - HKLM..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
O4 - HKLM..\Run: [tgcmd] C:\Program Files\support.com\bin\tgcmd.exe (Support.com, Inc.)
O4 - HKCU..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe (Logitech)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ymetray.lnk = C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe (Yahoo! Inc.)
O4 - Startup: C:\Documents and Settings\Helene Lesueur\Start Menu\Programs\Startup\Secunia PSI.lnk = C:\Program Files\Secunia\PSI\psi.exe (Secunia)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINNT\system32\nwprovau.dll (Microsoft Corporation)
O15 - HKCU\..Trusted Domains: internet ([]about in Trusted sites)
O15 - HKCU\..Trusted Domains: mcafee.com ([]http in Trusted sites)
O15 - HKCU\..Trusted Domains: mcafee.com ([]https in Trusted sites)
O16 - DPF: {01012101-5E80-11D8-9E86-0007E96C65AE} http://www.comcastsupport.com/OneClickFix/tgctlsr.cab (SupportSoft Script Runner Class)
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} http://office.microsoft.com/templates/ieawsdc.cab (Microsoft Office Template and Media Control)
O16 - DPF: {0DB074F0-617E-4EE9-912C-2965CF2AA5A4} http://download.microsoft.com/download/0/f…tualEarth3D.cab (Reg Error: Key error.)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/C/0…heckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\Common\Yinsthelper.dll (Installation Support)
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} http://www.eset.eu/buxus/docs/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdat…b?1247598275701 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} http://games.myspace.com/Gameshell/GameHos…ronGameHost.cab (Oberon Flash Game Host)
O16 - DPF: {D1D98C0F-A339-42AB-BD5F-EA0FF5D0E65F} http://www.rockyou.com/RockYouImageUploader.cab (RockYou Image Uploader Control)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/get/flash…ent/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: bdsripcab https://media.bdsrealtime.com/components/bdsripcab.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINNT\Java\classes\xmldso.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\ic32pp {BBCA9F81-8F4F-11D2-90FF-0080C83D3571} - C:\WINNT\wc98pp.dll ()
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINNT\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINNT\System32\igfxsrvc.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Helene Lesueur\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Helene Lesueur\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - C:\Program Files\Windows Defender\MpShHook.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - comfile [open] – "%1" %*
O35 - exefile [open] – "%1" %*
Post #5
second part of OTL.txt notepad log

========== Files/Folders - Created Within 30 Days ==========

[2010-03-06 19:26:20 | 000,553,984 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Helene Lesueur\Desktop\OTL.exe
[2010-02-06 10:59:44 | 000,000,000 | —D | C] – C:\Program Files\MSECache
[2010-02-06 10:57:50 | 038,808,920 | —- | C] (Microsoft Corporation) – C:\Documents and Settings\Helene Lesueur\Desktop\FileFormatConverters.exe
[2009-04-13 13:12:32 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Help
[2009-04-13 13:12:32 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Application Data\Help
[2007-07-08 17:22:00 | 000,409,600 | —- | C] ( ) – C:\WINNT\System32\lxdbinpa.dll
[2007-07-08 17:22:00 | 000,393,216 | —- | C] ( ) – C:\WINNT\System32\lxdbiesc.dll
[2007-07-08 17:21:57 | 001,183,744 | —- | C] ( ) – C:\WINNT\System32\lxdbserv.dll
[2007-07-08 17:21:57 | 000,995,328 | —- | C] ( ) – C:\WINNT\System32\lxdbusb1.dll
[2007-07-08 17:21:57 | 000,696,320 | —- | C] ( ) – C:\WINNT\System32\lxdbhbn3.dll
[2007-07-08 17:21:57 | 000,610,304 | —- | C] ( ) – C:\WINNT\System32\lxdbcomc.dll
[2007-07-08 17:21:57 | 000,536,576 | —- | C] ( ) – C:\WINNT\System32\lxdblmpm.dll
[2007-07-08 17:21:57 | 000,421,888 | —- | C] ( ) – C:\WINNT\System32\lxdbcomm.dll
[2007-07-08 17:21:57 | 000,163,840 | —- | C] ( ) – C:\WINNT\System32\lxdbprox.dll
[2007-07-08 17:21:57 | 000,114,688 | —- | C] ( ) – C:\WINNT\System32\lxdbpplc.dll
[2006-08-01 18:55:00 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Application Data\Macromedia
[2006-03-29 18:47:35 | 021,254,280 | —- | C] ( ) – C:\Program Files\AdbeRdr707_en_US.exe
[2006-03-29 18:47:15 | 007,050,552 | —- | C] (Adobe Systems, Inc. ) – C:\Program Files\psa30se_en_us.exe
[2005-07-30 19:40:02 | 000,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Application Data\Symantec
[2005-04-08 21:32:58 | 000,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2001-09-08 09:12:08 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[2001-09-08 09:12:06 | 000,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
[2001-09-08 08:56:28 | 000,000,000 | –SD | M] – C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2001-09-08 08:56:28 | 000,000,000 | –SD | M] – C:\Documents and Settings\LocalService\Application Data\Microsoft
[3 C:\WINNT\*.tmp files -> C:\WINNT\*.tmp -> ]
[10 C:\Documents and Settings\Helene Lesueur\My Documents\*.tmp files -> C:\Documents and Settings\Helene Lesueur\My Documents\*.tmp -> ]
[1 C:\WINNT\System32\*.tmp files -> C:\WINNT\System32\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]
Post #6
third OTL.txt notepad

OTL logfile created on: 2010-03-06 7:30:32 PM - Run 1
OTL by OldTimer - Version 3.1.34.0 Folder = C:\Documents and Settings\Helene Lesueur\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: yyyy-MM-dd

511.00 Mb Total Physical Memory | 247.00 Mb Available Physical Memory | 48.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 72.00% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINNT | %ProgramFiles% = C:\Program Files
Drive C: | 55.88 Gb Total Space | 34.44 Gb Free Space | 61.63% Space Free | Partition Type: FAT32
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: GUESTROOM
Current User Name: Helene Lesueur
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Helene Lesueur\Desktop\OTL.exe (OldTimer Tools)
PRC - c:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\MPF\MpfSrv.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\VirusScan\Mcshield.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\VirusScan\mcsysmon.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\MSC\mcmscsvc.exe (McAfee, Inc.)
PRC - c:\Program Files\Common Files\McAfee\McProxy\McProxy.exe (McAfee, Inc.)
PRC - c:\Program Files\Common Files\McAfee\MNA\McNASvc.exe (McAfee, Inc.)
PRC - C:\Program Files\Secunia\PSI\psi.exe (Secunia)
PRC - C:\WINNT\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe (Yahoo! Inc.)
PRC - C:\WINNT\system32\lxdbcoms.exe ( )
PRC - C:\Program Files\Canon\CAL\CALMAIN.exe (Canon Inc.)
PRC - C:\Program Files\Logitech\MouseWare\system\EM_EXEC.EXE (Logitech Inc.)
PRC - C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\Directcd.exe (Roxio)
PRC - C:\Program Files\support.com\bin\tgcmd.exe (Support.com, Inc.)
PRC - C:\WINNT\GWMDMMSG.exe (GTW)
PRC - C:\WINNT\system32\devldr32.exe (Creative Technology Ltd.)
PRC - C:\WINNT\system32\SK9910DM.EXE (Silitek Corporation)


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Helene Lesueur\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINNT\system32\msvcp60.dll (Microsoft Corporation)
MOD - C:\Program Files\Common Files\Logitech\Scrolling\LGMSGHK.DLL (Logitech Inc.)
MOD - C:\Program Files\Logitech\MouseWare\system\LgWndHk.dll (Logitech Inc.)


========== Win32 Services (SafeList) ==========

SRV - (PictureTaker) – File not found
SRV - (iPodService) – File not found
SRV - (MpfService) – C:\Program Files\McAfee\MPF\MPFSrv.exe (McAfee, Inc.)
SRV - (McODS) – C:\Program Files\McAfee\VirusScan\mcods.exe (McAfee, Inc.)
SRV - (McShield) – C:\Program Files\McAfee\VirusScan\Mcshield.exe (McAfee, Inc.)
SRV - (McSysmon) – C:\Program Files\McAfee\VirusScan\mcsysmon.exe (McAfee, Inc.)
SRV - (mcmscsvc) – C:\Program Files\McAfee\MSC\mcmscsvc.exe (McAfee, Inc.)
SRV - (McProxy) – c:\Program Files\Common Files\McAfee\McProxy\McProxy.exe (McAfee, Inc.)
SRV - (McNASvc) – c:\Program Files\Common Files\McAfee\MNA\McNASvc.exe (McAfee, Inc.)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MsMpEng.exe (Microsoft Corporation)
SRV - (lxdb_device) – C:\WINNT\System32\lxdbcoms.exe ( )
SRV - (CCALib8) – C:\Program Files\Canon\CAL\CALMAIN.exe (Canon Inc.)


========== Driver Services (SafeList) ==========

DRV - (mfehidk) – C:\WINNT\system32\drivers\mfehidk.sys (McAfee, Inc.)
DRV - (mfeavfk) – C:\WINNT\system32\drivers\mfeavfk.sys (McAfee, Inc.)
DRV - (mfesmfk) – C:\WINNT\system32\drivers\mfesmfk.sys (McAfee, Inc.)
DRV - (mfebopk) – C:\WINNT\system32\drivers\mfebopk.sys (McAfee, Inc.)
DRV - (mferkdk) – C:\WINNT\system32\drivers\mferkdk.sys (McAfee, Inc.)
DRV - (MPFP) – C:\WINNT\system32\drivers\Mpfp.sys (McAfee, Inc.)
DRV - (PSI) – C:\WINNT\system32\drivers\psi_mf.sys (Secunia)
DRV - (NwlnkIpx) – C:\WINNT\system32\drivers\nwlnkipx.sys (Microsoft Corporation)
DRV - (gameenum) – C:\WINNT\system32\drivers\gameenum.sys (Microsoft Corporation)
DRV - (usbaudio) USB Audio Driver (WDM) – C:\WINNT\system32\drivers\usbaudio.sys (Microsoft Corporation)
DRV - (Cdralw2k) – C:\WINNT\system32\drivers\cdralw2k.sys (Sonic Solutions)
DRV - (Cdr4_xp) – C:\WINNT\system32\drivers\cdr4_xp.sys (Sonic Solutions)
DRV - (ASPI32) – C:\WINNT\system32\drivers\aspi32.sys (Adaptec)
DRV - (nv) – C:\WINNT\system32\drivers\nv4_mini.sys (NVIDIA Corporation)
DRV - (ati2mtaa) – C:\WINNT\system32\drivers\ati2mtaa.sys (ATI Technologies Inc.)
DRV - (cdrbsvsd) – C:\WINNT\system32\drivers\cdrbsvsd.sys (B.H.A Corporation)
DRV - (LMouFlt2) – C:\WINNT\system32\drivers\LMouFlt2.Sys (Logitech, Inc.)
DRV - (L8042pr2) – C:\WINNT\system32\drivers\L8042pr2.Sys (Logitech, Inc.)
DRV - (LHidUsb) – C:\WINNT\system32\drivers\LHidUsb.sys (Logitech, Inc.)
DRV - (LHidFlt2) – C:\WINNT\system32\drivers\LHidFlt2.Sys (Logitech, Inc.)
DRV - (DCamUSBSQTECH) Dual-Mode DSC(2770) – C:\WINNT\system32\drivers\SQCaptur.sys (Service & Quality Technology.)
DRV - (sonypvs1) – C:\WINNT\system32\drivers\sonypvs1.sys (Sony Corporation)
DRV - (AN983) – C:\WINNT\system32\drivers\an983.sys (ADMtek Incorporated.)
DRV - (ha10kx2k) – C:\WINNT\system32\drivers\ha10kx2k.sys (Creative Technology Ltd)
DRV - (emupia) – C:\WINNT\system32\drivers\emupia2k.sys (Creative Technology Ltd)
DRV - (ctsfm2k) – C:\WINNT\system32\drivers\ctsfm2k.sys (Creative Technology Ltd)
DRV - (ctprxy2k) – C:\WINNT\system32\drivers\ctprxy2k.sys (Creative Technology Ltd)
DRV - (ossrv) – C:\WINNT\system32\drivers\ctoss2k.sys (Creative Technology Ltd.)
DRV - (ctaud2k) Creative Audio Driver (WDM) – C:\WINNT\system32\drivers\ctaud2k.sys (Creative Technology Ltd)
DRV - (ctac32k) – C:\WINNT\system32\drivers\ctac32k.sys (Creative Technology Ltd)
DRV - (MR97310_VGA_DUAL_CAMERA) – C:\WINNT\system32\drivers\MR97310v.sys (Mars Semiconductor Corp.)
DRV - (dvd_2K) – C:\WINNT\system32\drivers\Dvd_2k.sys (Roxio)
DRV - (mmc_2K) – C:\WINNT\system32\drivers\Mmc_2k.sys (Roxio)
DRV - (pwd_2k) – C:\WINNT\system32\drivers\pwd_2K.sys (Roxio)
DRV - (cdudf_xp) – C:\WINNT\system32\drivers\cdudf_xp.sys (Roxio)
DRV - (UdfReadr_xp) – C:\WINNT\system32\drivers\udfreadr_xp.sys (Roxio)
DRV - (GTWModem) – C:\WINNT\system32\drivers\GWMDM.sys (GTW)
DRV - (NwlnkNb) – C:\WINNT\system32\drivers\nwlnknb.sys (Microsoft Corporation)
DRV - (NwlnkSpx) – C:\WINNT\system32\drivers\nwlnkspx.sys (Microsoft Corporation)
DRV - (ms_mpu401) – C:\WINNT\system32\drivers\msmpu401.sys (Microsoft Corporation)
DRV - (MODEMCSA) – C:\WINNT\system32\drivers\MODEMCSA.sys (Microsoft Corporation)
DRV - (ultra) – C:\WINNT\System32\DRIVERS\ultra.sys (Promise Technology, Inc.)
DRV - (BCMModem) – C:\WINNT\system32\drivers\BCMDM.sys (BCM)
DRV - (ati2mpaa) – C:\WINNT\system32\drivers\ati2mpaa.sys (ATI Technologies Inc.)
DRV - (ac97intc) Intel® 82801 Audio Driver Install Service (WDM) – C:\WINNT\system32\drivers\ac97intc.sys (Intel Corporation)
DRV - (sfman) Creative SoundFont Manager Driver (WDM) – C:\WINNT\system32\drivers\sfmanm.sys (Creative Technology Ltd.)
DRV - (emu10k1) Creative Interface Manager Driver (WDM) – C:\WINNT\system32\drivers\ctlfacem.sys (Creative Technology Ltd.)
DRV - (emu10k) Creative SB Live! (WDM) – C:\WINNT\system32\drivers\emu10k1m.sys (Creative Technology Ltd.)
DRV - (ctljystk) – C:\WINNT\system32\drivers\ctljystk.sys (Creative Technology Ltd.)
DRV - (EL90XBC) – C:\WINNT\system32\drivers\el90xbc5.sys (3Com Corporation)
DRV - (Eplpdx02) – C:\WINNT\system32\drivers\EPLPDX02.SYS (MK Systems CO., LTD.)
DRV - (wandrv) – C:\WINNT\system32\drivers\wandrv.sys (America Online, Inc.)
DRV - (Sk9920nt) – C:\WINNT\system32\drivers\Sk9920nt.sys (Silitek Corp.)
DRV - (Sk99202k) – C:\WINNT\system32\drivers\Sk99202k.sys (Silitek Corp.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINNT\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINNT\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Yahoo! Search
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://search.yahoo.com/search?p={searchTe…-8&fr=b1ie7
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll (Yahoo! Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Google"
FF - prefs.js..browser.search.defaulturl: "http://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q="
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "http://www.comcast.net/comcast.html"



[2006-07-17 20:02:48 | 000,000,000 | —D | M] – C:\Documents and Settings\Helene Lesueur\Application Data\Mozilla\Firefox\Profiles\5mmw5ggf.default\extensions

O1 HOSTS File: ([2009-03-29 11:11:18 | 000,000,027 | —- | M]) - C:\WINNT\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Yahoo! Toolbar Helper) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll (Yahoo! Inc.)
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [AdaptecDirectCD] C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe (Roxio)
O4 - HKLM..\Run: [Adobe Photo Downloader] C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [GWMDMMSG] C:\WINNT\GWMDMMSG.exe (GTW)
O4 - HKLM..\Run: [Hot Key Kbd 9910 Daemon] C:\WINNT\System32\SK9910DM.EXE (Silitek Corporation)
O4 - HKLM..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe File not found
O4 - HKLM..\Run: [Logitech Utility] C:\WINNT\LOGI_MWX.EXE (Logitech Inc.)
O4 - HKLM..\Run: [LXDBCATS] C:\WINNT\System32\spool\DRIVERS\W32X86\3\LXDBtime.DLL ()
O4 - HKLM..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
O4 - HKLM..\Run: [tgcmd] C:\Program Files\support.com\bin\tgcmd.exe (Support.com, Inc.)
O4 - HKCU..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe (Logitech)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ymetray.lnk = C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe (Yahoo! Inc.)
O4 - Startup: C:\Documents and Settings\Helene Lesueur\Start Menu\Programs\Startup\Secunia PSI.lnk = C:\Program Files\Secunia\PSI\psi.exe (Secunia)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINNT\system32\nwprovau.dll (Microsoft Corporation)
O15 - HKCU\..Trusted Domains: internet ([]about in Trusted sites)
O15 - HKCU\..Trusted Domains: mcafee.com ([]http in Trusted sites)
O15 - HKCU\..Trusted Domains: mcafee.com ([]https in Trusted sites)
O16 - DPF: {01012101-5E80-11D8-9E86-0007E96C65AE} http://www.comcastsupport.com/OneClickFix/tgctlsr.cab (SupportSoft Script Runner Class)
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} http://office.microsoft.com/templates/ieawsdc.cab (Microsoft Office Template and Media Control)
O16 - DPF: {0DB074F0-617E-4EE9-912C-2965CF2AA5A4} http://download.microsoft.com/download/0/f…tualEarth3D.cab (Reg Error: Key error.)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/C/0…heckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\Common\Yinsthelper.dll (Installation Support)
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} http://www.eset.eu/buxus/docs/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdat…b?1247598275701 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} http://games.myspace.com/Gameshell/GameHos…ronGameHost.cab (Oberon Flash Game Host)
O16 - DPF: {D1D98C0F-A339-42AB-BD5F-EA0FF5D0E65F} http://www.rockyou.com/RockYouImageUploader.cab (RockYou Image Uploader Control)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/get/flash…ent/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: bdsripcab https://media.bdsrealtime.com/components/bdsripcab.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINNT\Java\classes\xmldso.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\ic32pp {BBCA9F81-8F4F-11D2-90FF-0080C83D3571} - C:\WINNT\wc98pp.dll ()
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINNT\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINNT\System32\igfxsrvc.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Helene Lesueur\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Helene Lesueur\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - C:\Program Files\Windows Defender\MpShHook.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - comfile [open] – "%1" %*
O35 - exefile [open] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010-03-06 19:26:20 | 000,553,984 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Helene Lesueur\Desktop\OTL.exe
[2010-02-06 10:59:44 | 000,000,000 | —D | C] – C:\Program Files\MSECache
[2010-02-06 10:57:50 | 038,808,920 | —- | C] (Microsoft Corporation) – C:\Documents and Settings\Helene Lesueur\Desktop\FileFormatConverters.exe
[2009-04-13 13:12:32 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Help
[2009-04-13 13:12:32 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Application Data\Help
[2007-07-08 17:22:00 | 000,409,600 | —- | C] ( ) – C:\WINNT\System32\lxdbinpa.dll
[2007-07-08 17:22:00 | 000,393,216 | —- | C] ( ) – C:\WINNT\System32\lxdbiesc.dll
[2007-07-08 17:21:57 | 001,183,744 | —- | C] ( ) – C:\WINNT\System32\lxdbserv.dll
[2007-07-08 17:21:57 | 000,995,328 | —- | C] ( ) – C:\WINNT\System32\lxdbusb1.dll
[2007-07-08 17:21:57 | 000,696,320 | —- | C] ( ) – C:\WINNT\System32\lxdbhbn3.dll
[2007-07-08 17:21:57 | 000,610,304 | —- | C] ( ) – C:\WINNT\System32\lxdbcomc.dll
[2007-07-08 17:21:57 | 000,536,576 | —- | C] ( ) – C:\WINNT\System32\lxdblmpm.dll
[2007-07-08 17:21:57 | 000,421,888 | —- | C] ( ) – C:\WINNT\System32\lxdbcomm.dll
[2007-07-08 17:21:57 | 000,163,840 | —- | C] ( ) – C:\WINNT\System32\lxdbprox.dll
[2007-07-08 17:21:57 | 000,114,688 | —- | C] ( ) – C:\WINNT\System32\lxdbpplc.dll
[2006-08-01 18:55:00 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Application Data\Macromedia
[2006-03-29 18:47:35 | 021,254,280 | —- | C] ( ) – C:\Program Files\AdbeRdr707_en_US.exe
[2006-03-29 18:47:15 | 007,050,552 | —- | C] (Adobe Systems, Inc. ) – C:\Program Files\psa30se_en_us.exe
[2005-07-30 19:40:02 | 000,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Application Data\Symantec
[2005-04-08 21:32:58 | 000,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2001-09-08 09:12:08 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[2001-09-08 09:12:06 | 000,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
[2001-09-08 08:56:28 | 000,000,000 | –SD | M] – C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2001-09-08 08:56:28 | 000,000,000 | –SD | M] – C:\Documents and Settings\LocalService\Application Data\Microsoft
[3 C:\WINNT\*.tmp files -> C:\WINNT\*.tmp -> ]
[10 C:\Documents and Settings\Helene Lesueur\My Documents\*.tmp files -> C:\Documents and Settings\Helene Lesueur\My Documents\*.tmp -> ]
[1 C:\WINNT\System32\*.tmp files -> C:\WINNT\System32\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]
Post #8
Extras.txt Notepad results

OTL Extras logfile created on: 2010-03-06 7:30:32 PM - Run 1
OTL by OldTimer - Version 3.1.34.0 Folder = C:\Documents and Settings\Helene Lesueur\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: yyyy-MM-dd

511.00 Mb Total Physical Memory | 247.00 Mb Available Physical Memory | 48.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 72.00% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINNT | %ProgramFiles% = C:\Program Files
Drive C: | 55.88 Gb Total Space | 34.44 Gb Free Space | 61.63% Space Free | Partition Type: FAT32
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: GUESTROOM
Current User Name: Helene Lesueur
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
htmlfile – "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] – "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" /p %1 (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusOverride" = 0
"FirewallOverride" = 0
"UpdatesDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\NetMeeting\conf.exe" = C:\Program Files\NetMeeting\conf.exe:*:Enabled:Windows® NetMeeting® – (Microsoft Corporation)
"C:\Program Files\Yahoo!\Messenger\YServer.exe" = C:\Program Files\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server – (Yahoo! Inc.)
"C:\Program Files\Windows Media Player\WMPLAYER.EXE" = C:\Program Files\Windows Media Player\WMPLAYER.EXE:*:Enabled:wmplayer – (Microsoft Corporation)
"C:\Program Files\Replay Radio 5\ReplayRadio.exe" = C:\Program Files\Replay Radio 5\ReplayRadio.exe:*:Enabled:Replay Radio 5.2 – (Applian Technologies Inc.)
"C:\Program Files\Replay Player\Replay Player.exe" = C:\Program Files\Replay Player\Replay Player.exe:*:Enabled:Replay Player – ()
"C:\Program Files\Radio Wizard\RadioWizard.exe" = C:\Program Files\Radio Wizard\RadioWizard.exe:*:Enabled:Radio Wizard – ()
"C:\Program Files\MP3 Magic\MP3Magic.exe" = C:\Program Files\MP3 Magic\MP3Magic.exe:*:Enabled:MP3 Magic – (Yaosoft)
"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes – File not found
"C:\Program Files\Yahoo!\Yahoo! Music Jukebox\YahooMusicEngine.exe" = C:\Program Files\Yahoo!\Yahoo! Music Jukebox\YahooMusicEngine.exe:*:Enabled:Yahoo! Music Jukebox – (Yahoo! Inc.)
"C:\Program Files\SUPPORT.COM\BIN\TGCMD.EXE" = C:\Program Files\SUPPORT.COM\BIN\TGCMD.EXE:*:Enabled:Support.com Scheduler and Command Dispatcher – (Support.com, Inc.)
"C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe" = C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe:*:Enabled:McAfee Network Agent – (McAfee, Inc.)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{172423F9-522A-483A-AD65-03600CE4CA4F}" = Microsoft Works 6-9 Converter
"{1FABA7C7-6DC0-11D6-9EAB-0050BAE317E1}" = VideoLive Mail
"{225AF9A1-B556-88D5-94AA-0010B5426419}" = My DSC
"{26A24AE4-039D-4CA4-87B4-2F83216013FF}" = Java™ 6 Update 18
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4BDFD2CE-6329-42E4-9801-9B3D1F10D79B}" = Adobe® Photoshop® Album Starter Edition 3.0
"{54C0D94A-F467-4ABC-9D02-6E58748668D4}" = iTunes
"{5809E7CF-4DCF-11D4-9875-00105ACE7734}" = Logitech MouseWare 9.79
"{5C29CB8B-AC1E-4114-8D68-9CD080140D4A}" = Sony USB Driver
"{609F7AC8-C510-11D4-A788-009027ABA5D0}" = Easy CD Creator 5 Basic
"{6BC2C9ED-FD77-4A7A-BF2B-B4E7C073F66E}" = LEADTOOLS ePrint IV EVAL
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel® 845G Chipset Graphics Driver Software
"{900B1197-53F5-4F46-A882-2CFFFE2EEDCB}" = Logitech Desktop Messenger
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90840409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Excel Viewer 2003
"{90850409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Word Viewer 2003
"{911B0409-6000-11D3-8CFE-0050048383C9}" = Microsoft Word 2002
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9A3EABC0-CA06-11D4-BF77-00104B130C19}" = EPSON TWAIN 5
"{A06275F4-324B-4E85-95E6-87B2CD729401}" = Windows Defender
"{A0CF60B8-5156-11D5-A970-0050DA0F190F}" = SoundClick MP3 Player
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A8A3862C-3280-11D6-B2EA-0050BA18806B}" = Camera Driver
"{AC76BA86-7AD7-1033-7B44-A82000000003}" = Adobe Reader 8.2.1
"{B423A661-0726-405A-AFE9-C44CCB8036BA}" = DV 4100M
"{BD3DCAB0-3FE5-44FB-90DA-EFB0A2CD1387}" = Works Synchronization
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C1939820-A945-11D4-86F6-0001031E5712}" = DVD Player
"{C3A439E4-7303-491F-A678-CEA36A87D517}" = Microsoft Works Suite Add-in for Microsoft Word
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{DC19E750-988B-4005-A355-85EF66055EFE}" = Works Suite OS Pack
"{EBAE381B-60A6-4863-AA9F-FCAB755BC9E5}" = ScanToWeb
"{EC3B8CA2-49B8-4D38-BE9C-ABD0F6029168}" = Yahoo! Music Jukebox
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"ArcSoft PhotoImpression 3.0" = ArcSoft PhotoImpression 3.0
"CAL" = Canon Camera Access Library
"CameraWindowDVC5" = Canon Camera Window DC_DV 5 for ZoomBrowser EX
"CameraWindowDVC6" = Canon Camera Window DC_DV 6 for ZoomBrowser EX
"CameraWindowMC" = Canon Camera Window MC 6 for ZoomBrowser EX
"Canon G.726 WMP-Decoder" = Canon G.726 WMP-Decoder
"Click'N Design 3D (V5)" = Click'N Design 3D (V5)
"Copy Utility" = Copy Utility
"Creative Driver" = Creative Driver
"CSCLIB" = Canon Camera Support Core Library
"CutePDF Writer Installation" = CutePDF Writer 2.7
"EOS Utility" = Canon Utilities EOS Utility
"EsetOnlineScanner" = ESET Online Scanner
"Focus Magic_is1" = Focus Magic 3.02
"GTW V.92 Voice Modem" = GTW V.92 Voice Modem
"HijackThis" = HijackThis 2.0.2
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"IMSI Utilities" = IMSI Utilities
"Inkscape" = Inkscape 0.45.1
"kSolo" = kSolo Recorder
"Lexmark 840 Series" = Lexmark 840 Series
"Logitech Resource Center" = Logitech Resource Center
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Masque Slots II" = Masque Slots II
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"MovieEditTask" = Canon MovieEdit Task for ZoomBrowser EX
"MP3_Magic_1.0" = MP3 Magic 1.21
"MSC" = McAfee SecurityCenter
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"Network Play System (Patching)" = Network Play System (Patching)
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"OmniFormat" = OmniFormat
"Pdf995" = Pdf995
"PROSet" = Intel® PRO Ethernet Adapter and Software
"Radio_Wizard_1" = Radio Wizard 1.0
"RAW Image Task" = Canon RAW Image Task for ZoomBrowser EX
"RemoteCaptureTask" = Canon RemoteCapture Task for ZoomBrowser EX
"Replay_Player_for_the_PC_1.0" = Replay Player
"Secunia PSI" = Secunia PSI
"SK_PS2MillenniumKeyboard" = PS/2 Millennium Keyboard
"SonicShack Design Studio_is1" = SonicShack Designer Adobe AIR version
"VB Runtime" = VB Runtime
"Wdf01007" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wondershare DVD to WMV Converter_is1" = Wondershare DVD to WMV Converter(Build 3.2.47)
"Works2002Setup" = Microsoft Works 2002 Setup Launcher
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"Yahoo! Companion" = Yahoo! Toolbar
"Yahoo! Customizations" = Yahoo! extras
"Yahoo! Internet Mail" = Yahoo! Internet Mail
"Yahoo! Messenger" = Yahoo! Messenger
"Yahoo! Messenger Explorer Bar" = Yahoo! Messenger Explorer Bar
"Yahoo! Toolbar" = Yahoo! Toolbar
"YInstHelper" = Yahoo! Install Manager
"ZoomBrowser EX" = Canon Utilities ZoomBrowser EX

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Abacast Client" = Abacast Client
"Octoshape add-in for Adobe Flash Player" = Octoshape add-in for Adobe Flash Player

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 2010-01-27 12:24:08 PM | Computer Name = GUESTROOM | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 8.0.6001.18702, faulting
module fldbg10d.ocx, version 10.0.42.34, fault address 0x0020fe8a.

Error - 2010-01-30 1:31:04 AM | Computer Name = GUESTROOM | Source = McLogEvent | ID = 5051
Description = A thread in process C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe took
longer than 90000 ms to complete a request. The process will be terminated. Thread
id : 2868 (0xb34) Thread address : 0x021E1CB0 Thread message : Build VSCORE.14.0.0.435
/ 5301.4018 Object being scanned = \Device\HarddiskVolume1\WINNT\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.6001.22319_x-ww_f0b4c2df\gdiplus.dll

by C:\Program Files\Internet Explorer\iexplore.exe 4(70)(0) 4(0)(0) 7200(0)(0)
7595(0)(0) 7005(0)(0) 7004(0)(0) 5006(0)(0) 5004(0)(0)

Error - 2010-01-30 12:04:14 PM | Computer Name = GUESTROOM | Source = McLogEvent | ID = 5051
Description = A thread in process C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe took
longer than 90000 ms to complete a request. The process will be terminated. Thread
id : 2924 (0xb6c) Thread address : 0x02271CB0 Thread message : Build VSCORE.14.0.0.435
/ 5301.4018 Object being scanned = \Device\HarddiskVolume1\WINNT\system32\taskmgr.exe

by \??\C:\WINNT\system32\winlogon.exe 4(0)(0) 4(0)(0) 7200(0)(0) 7595(0)(0) 7005(0)(0)

7004(0)(0) 5006(0)(0) 5004(0)(0)

Error - 2010-01-31 1:25:14 PM | Computer Name = GUESTROOM | Source = MsiInstaller | ID = 11706
Description = Product: Microsoft Word 2002 – Error 1706. Setup cannot find the
required files. Check your connection to the network, or CD-ROM drive. For other
potential solutions to this problem, see C:\Program Files\Microsoft Office\Office10\1033\SETUP.HLP.

Error - 2010-02-08 1:31:22 PM | Computer Name = GUESTROOM | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 8.0.6001.18702, faulting
module fldbg10d.ocx, version 10.0.42.34, fault address 0x00150ecb.

Error - 2010-02-11 10:41:31 PM | Computer Name = GUESTROOM | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 8.0.6001.18702, faulting
module mshtml.dll, version 8.0.6001.18876, fault address 0x00253482.

Error - 2010-02-12 1:44:09 PM | Computer Name = GUESTROOM | Source = Application Error | ID = 1000
Description = Faulting application winword.exe, version 10.0.6856.0, faulting module
winword.exe, version 10.0.6856.0, fault address 0x00129903.

Error - 2010-02-15 11:27:54 PM | Computer Name = GUESTROOM | Source = McLogEvent | ID = 5051
Description = A thread in process C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe took
longer than 90000 ms to complete a request. The process will be terminated. Thread
id : 2744 (0xab8) Thread address : 0x7C90E514 Thread message : Build VSCORE.14.0.0.435
/ 5301.4018 Object being scanned = \Device\HarddiskVolume1\Documents and Settings\Helene
Lesueur\Desktop\FileFormatConverters.exe by C:\WINNT\Explorer.EXE 4(0)(0) 4(0)(0)

7200(0)(0) 7595(0)(0) 7005(0)(0) 7004(0)(0) 5006(0)(0) 5004(0)(0)

Error - 2010-02-23 10:38:23 AM | Computer Name = GUESTROOM | Source = McLogEvent | ID = 5051
Description = A thread in process C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe took
longer than 90000 ms to complete a request. The process will be terminated. Thread
id : 2196 (0x894) Thread address : 0x7C90E514 Thread message : Build VSCORE.14.0.0.435
/ 5301.4018 Object being scanned = \Device\HarddiskVolume1\Documents and Settings\Helene
Lesueur\Desktop\FileFormatConverters.exe by C:\WINNT\Explorer.EXE 4(0)(0) 4(0)(0)

7200(0)(0) 7595(0)(0) 7005(0)(0) 7004(0)(0) 5006(0)(0) 5004(0)(0)

Error - 2010-03-03 9:43:32 AM | Computer Name = GUESTROOM | Source = McLogEvent | ID = 5051
Description = A thread in process C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe took
longer than 90000 ms to complete a request. The process will be terminated. Thread
id : 2112 (0x840) Thread address : 0x7C90E514 Thread message : Build VSCORE.14.0.0.435
/ 5301.4018 Object being scanned = \Device\HarddiskVolume1\WINNT\system32\mrt.exe

by C:\WINNT\System32\svchost.exe 4(0)(0) 4(0)(0) 7200(0)(0) 7595(0)(0) 7005(0)(0)

7004(0)(0) 5006(0)(0) 5004(0)(0)

[ System Events ]
Error - 2010-03-06 5:10:15 PM | Computer Name = GUESTROOM | Source = Print | ID = 23
Description = Printer Export To Web failed to initialize because a suitable Web
Export driver could not be found.

Error - 2010-03-06 7:26:54 PM | Computer Name = GUESTROOM | Source = DCOM | ID = 10005
Description = DCOM got error "%1053" attempting to start the service lxdb_device
with arguments "" in order to run the server: {323CE21C-A448-40AA-BA74-7FCF1E441097}

Error - 2010-03-06 7:26:55 PM | Computer Name = GUESTROOM | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the lxdb_device service to
connect.

Error - 2010-03-06 7:26:55 PM | Computer Name = GUESTROOM | Source = Service Control Manager | ID = 7000
Description = The lxdb_device service failed to start due to the following error:
%%1053

Error - 2010-03-06 7:27:24 PM | Computer Name = GUESTROOM | Source = DCOM | ID = 10005
Description = DCOM got error "%1053" attempting to start the service lxdb_device
with arguments "" in order to run the server: {323CE21C-A448-40AA-BA74-7FCF1E441097}

Error - 2010-03-06 7:27:24 PM | Computer Name = GUESTROOM | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the lxdb_device service to
connect.

Error - 2010-03-06 7:27:24 PM | Computer Name = GUESTROOM | Source = Service Control Manager | ID = 7000
Description = The lxdb_device service failed to start due to the following error:
%%1053

Error - 2010-03-06 7:53:41 PM | Computer Name = GUESTROOM | Source = Service Control Manager | ID = 7000
Description = The Zune Bus Enumerator Driver service failed to start due to the
following error: %%2

Error - 2010-03-06 7:53:41 PM | Computer Name = GUESTROOM | Source = Service Control Manager | ID = 7000
Description = The Concord EyeQ Duo 1300 USB Video Capture V1.01 service failed to
start due to the following error: %%2

Error - 2010-03-06 7:55:11 PM | Computer Name = GUESTROOM | Source = Print | ID = 23
Description = Printer Export To Web failed to initialize because a suitable Web
Export driver could not be found.


< End of report >
Post #9
Hi sweetiehlm5,

A little bit showing.

Next, Double click on OTL.exe
  • Under the Custom Scans/Fixes box at the bottom, paste in the following
  • Do Not copy the word CODE
  • please note the fix starts with the :
:Services

:OTL
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O15 - HKCU\..Trusted Domains: internet ([]about in Trusted sites)
O16 - DPF: bdsripcab https://media.bdsrealtime.com/components/bdsripcab.cab (Reg Error: Key error.)
O18 - Protocol\Handler\ic32pp {BBCA9F81-8F4F-11D2-90FF-0080C83D3571} - C:\WINNT\wc98pp.dll ()
3 C:\WINNT\*.tmp files -> C:\WINNT\*.tmp -> ]
[10 C:\Documents and Settings\Helene Lesueur\My Documents\*.tmp files -> C:\Documents and Settings\Helene Lesueur\My Documents\*.tmp -> ]
[1 C:\WINNT\System32\*.tmp files -> C:\WINNT\System32\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]

:Commands
[emptytemp]
[reboot]

Then click the Run Fix button at the top
  • Let the program run unhindered
  • Please save the resulting log to be posted in your next reply.




You have this program installed, Malwarebytes' Anti-Malware (MBAM). Please update it and run a scan.

Open MBAM

  • Click the Update tab
  • Click Check for Updates
  • If an update is found, it will download and install the latest version.
  • The program will close to update and reopen.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

Please post back with
  • OTL fix log
  • MBAM log
  • new OTL scan log taken after all other sreps. There will only ne an OTL.txt this time
How is the computer now?

Thanks
Post #10
OTL Fix Log All processes killed ========== SERVICES/DRIVERS ========== ========== OTL ========== Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\internet\ deleted successfully. Starting removal of ActiveX control bdsripcab Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\bdsripcab\DownloadInformation\\INF . Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\bdsripcab\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\bdsripcab\ not found. C:\WINNT\wc98pp.dll moved successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\ic32pp\ deleted successfully. Invalid CLSID key: C:\WINNT\wc98pp.dll File C:\WINNT\wc98pp.dll not found. C:\Documents and Settings\Helene Lesueur\My Documents\~WRL0635.tmp deleted successfully. C:\Documents and Settings\Helene Lesueur\My Documents\~WRL3702.tmp deleted successfully. C:\Documents and Settings\Helene Lesueur\My Documents\~WRL2953.tmp deleted successfully. C:\Documents and Settings\Helene Lesueur\My Documents\~WRL2452.tmp deleted successfully. C:\Documents and Settings\Helene Lesueur\My Documents\~WRL1273.tmp deleted successfully. C:\Documents and Settings\Helene Lesueur\My Documents\~WRL2843.tmp deleted successfully. C:\Documents and Settings\Helene Lesueur\My Documents\~WRL1222.tmp deleted successfully. C:\Documents and Settings\Helene Lesueur\My Documents\~WRL0751.tmp deleted successfully. C:\Documents and Settings\Helene Lesueur\My Documents\~WRL3610.tmp deleted successfully. C:\Documents and Settings\Helene Lesueur\My Documents\~WRL1235.tmp deleted successfully. C:\WINNT\System32\CONFIG.TMP deleted successfully. C:\32788R22FWJFW.0.tmp\swreg.exe deleted successfully. C:\32788R22FWJFW.0.tmp\ffdefstr.dll deleted successfully. C:\32788R22FWJFW.0.tmp\Combo-Fix.sys deleted successfully. C:\32788R22FWJFW.0.tmp\badclsid deleted successfully. C:\32788R22FWJFW.0.tmp\BootSect deleted successfully. C:\32788R22FWJFW.0.tmp\mynul deleted successfully. C:\32788R22FWJFW.0.tmp\RCLink deleted successfully. C:\32788R22FWJFW.0.tmp\appinit.bad deleted successfully. C:\32788R22FWJFW.0.tmp\BON.cfexe deleted successfully. C:\32788R22FWJFW.0.tmp\catchme.cfexe deleted successfully. C:\32788R22FWJFW.0.tmp\ComboFix-Download.cfexe deleted successfully. C:\32788R22FWJFW.0.tmp\dd.cfexe deleted successfully. C:\32788R22FWJFW.0.tmp\dumphive.cfexe deleted successfully. C:\32788R22FWJFW.0.tmp\ERUNT.cfexe deleted successfully. C:\32788R22FWJFW.0.tmp\extract.cfexe deleted successfully. C:\32788R22FWJFW.0.tmp\fdsv.cfexe deleted successfully. C:\32788R22FWJFW.0.tmp\fi.cfexe deleted successfully. C:\32788R22FWJFW.0.tmp\grep.cfexe deleted successfully. C:\32788R22FWJFW.0.tmp\gsar.cfexe deleted successfully. C:\32788R22FWJFW.0.tmp\handle.cfexe deleted successfully. C:\32788R22FWJFW.0.tmp\md5deep.cfexe deleted successfully. C:\32788R22FWJFW.0.tmp\moveex.cfexe deleted successfully. C:\32788R22FWJFW.0.tmp\mtee.cfexe deleted successfully. C:\32788R22FWJFW.0.tmp\NirCmd.cfexe deleted successfully. C:\32788R22FWJFW.0.tmp\NirCmdC.cfexe deleted successfully. C:\32788R22FWJFW.0.tmp\psexec.cfexe deleted successfully. C:\32788R22FWJFW.0.tmp\pv.cfexe deleted successfully. C:\32788R22FWJFW.0.tmp\sed.cfexe deleted successfully. C:\32788R22FWJFW.0.tmp\setcsum.cfexe deleted successfully. C:\32788R22FWJFW.0.tmp\setpath.cfexe deleted successfully. C:\32788R22FWJFW.0.tmp\SF.cfexe deleted successfully. C:\32788R22FWJFW.0.tmp\swsc.cfexe deleted successfully. C:\32788R22FWJFW.0.tmp\swxcacls.cfexe deleted successfully. C:\32788R22FWJFW.0.tmp\tail.cfexe deleted successfully. C:\32788R22FWJFW.0.tmp\unzip.cfexe deleted successfully. C:\32788R22FWJFW.0.tmp\vFind.cfexe deleted successfully. C:\32788R22FWJFW.0.tmp\WRP.cfexe deleted successfully. C:\32788R22FWJFW.0.tmp\zip.cfexe deleted successfully. C:\32788R22FWJFW.0.tmp\023.dat deleted successfully. C:\32788R22FWJFW.0.tmp\023v.dat deleted successfully. C:\32788R22FWJFW.0.tmp\Creg.dat deleted successfully. C:\32788R22FWJFW.0.tmp\CregC.dat deleted successfully. C:\32788R22FWJFW.0.tmp\Fin.dat deleted successfully. C:\32788R22FWJFW.0.tmp\LocalService.dat deleted successfully. C:\32788R22FWJFW.0.tmp\LocalServiceNetworkRestricted.dat deleted successfully. C:\32788R22FWJFW.0.tmp\LocalSystemNetworkRestricted.dat deleted successfully. C:\32788R22FWJFW.0.tmp\ndis_combofix.dat deleted successfully. C:\32788R22FWJFW.0.tmp\netsvc.bad.dat deleted successfully. C:\32788R22FWJFW.0.tmp\netsvc.dat deleted successfully. C:\32788R22FWJFW.0.tmp\netsvc.vista.dat deleted successfully. C:\32788R22FWJFW.0.tmp\netsvc.xp.dat deleted successfully. C:\32788R22FWJFW.0.tmp\NetworkService.dat deleted successfully. C:\32788R22FWJFW.0.tmp\Policies.dat deleted successfully. C:\32788R22FWJFW.0.tmp\Purity.dat deleted successfully. C:\32788R22FWJFW.0.tmp\region.dat deleted successfully. C:\32788R22FWJFW.0.tmp\rogues.dat deleted successfully. C:\32788R22FWJFW.0.tmp\safeboot.dat deleted successfully. C:\32788R22FWJFW.0.tmp\safeboot.def.dat deleted successfully. C:\32788R22FWJFW.0.tmp\safeboot.def.vista.dat deleted successfully. C:\32788R22FWJFW.0.tmp\svc_wht.dat deleted successfully. C:\32788R22FWJFW.0.tmp\svchost.dat deleted successfully. C:\32788R22FWJFW.0.tmp\svchost.vista.dat deleted successfully. C:\32788R22FWJFW.0.tmp\system_ini.dat deleted successfully. C:\32788R22FWJFW.0.tmp\vistareg.dat deleted successfully. C:\32788R22FWJFW.0.tmp\w2kreg.dat deleted successfully. C:\32788R22FWJFW.0.tmp\xpreg.dat deleted successfully. C:\32788R22FWJFW.0.tmp\zDomain.dat deleted successfully. C:\32788R22FWJFW.0.tmp\zhsvc.dat deleted successfully. C:\32788R22FWJFW.0.tmp\ERDNT.e_e deleted successfully. C:\32788R22FWJFW.0.tmp\ERDNTDOS.LOC deleted successfully. C:\32788R22FWJFW.0.tmp\ERDNTWIN.LOC deleted successfully. C:\32788R22FWJFW.0.tmp\ERUNT.LOC deleted successfully. C:\32788R22FWJFW.0.tmp\srizbi.md5 deleted successfully. C:\32788R22FWJFW.0.tmp\Exe.reg deleted successfully. C:\32788R22FWJFW.0.tmp\ddsDo.sed deleted successfully. C:\32788R22FWJFW.0.tmp\embedded.sed deleted successfully. C:\32788R22FWJFW.0.tmp\REGDACL.sed deleted successfully. C:\32788R22FWJFW.0.tmp\RegDo.sed deleted successfully. C:\32788R22FWJFW.0.tmp\run2.sed deleted successfully. C:\32788R22FWJFW.0.tmp\toolbar.sed deleted successfully. C:\32788R22FWJFW.0.tmp\DPF.str deleted successfully. C:\32788R22FWJFW.0.tmp\av.vbs deleted successfully. C:\32788R22FWJFW.0.tmp\FProps.vbs deleted successfully. C:\32788R22FWJFW.0.tmp\lnkread.vbs deleted successfully. C:\32788R22FWJFW.0.tmp\OSid.vbs deleted successfully. C:\32788R22FWJFW.0.tmp\restore_pt.vbs deleted successfully. C:\32788R22FWJFW.0.tmp\SvcDrv.vbs deleted successfully. C:\32788R22FWJFW.0.tmp\image001.gif deleted successfully. C:\32788R22FWJFW.0.tmp folder deleted successfully. ========== COMMANDS ========== [EMPTYTEMP] User: Default User ->Temp folder emptied: 73214639 bytes ->Temporary Internet Files folder emptied: 4455246 bytes User: All Users User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes ->Flash cache emptied: 451 bytes User: LocalService ->Temp folder emptied: 66016 bytes ->Temporary Internet Files folder emptied: 32969 bytes ->Flash cache emptied: 53 bytes User: Helene Lesueur ->Temp folder emptied: 937684 bytes ->Temporary Internet Files folder emptied: 24439977 bytes ->Java cache emptied: 41522099 bytes ->FireFox cache emptied: 0 bytes ->Flash cache emptied: 2190083 bytes User: Ella Lesueur ->Temp folder emptied: 19048771 bytes ->Temporary Internet Files folder emptied: 854636410 bytes ->Java cache emptied: 38590051 bytes ->Flash cache emptied: 161342 bytes User: Owner %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 58371 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 373939 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 4210598 bytes RecycleBin emptied: 20480 bytes Total Files Cleaned = 1,015.00 mb OTL by OldTimer - Version 3.1.34.0 log created on 03072010_080243 Files\Folders moved on Reboot… File\Folder C:\Documents and Settings\Helene Lesueur\Local Settings\Temp\~DF4B63.tmp not found! File\Folder C:\Documents and Settings\Helene Lesueur\Local Settings\Temp\~DF4B6E.tmp not found! File\Folder C:\Documents and Settings\Helene Lesueur\Local Settings\Temp\~DF4C2E.tmp not found! File\Folder C:\Documents and Settings\Helene Lesueur\Local Settings\Temp\~DF4C39.tmp not found! File\Folder C:\Documents and Settings\Helene Lesueur\Local Settings\Temp\~DF4D18.tmp not found! File\Folder C:\Documents and Settings\Helene Lesueur\Local Settings\Temp\~DF4D23.tmp not found! C:\Documents and Settings\Helene Lesueur\Local Settings\Temporary Internet Files\Content.IE5\9BPAU015\Fakeantivirus_protector_virus_WRL3531_t110744[2].html moved successfully. C:\Documents and Settings\Helene Lesueur\Local Settings\Temporary Internet Files\Content.IE5\CKB77IX8\iframe[1].htm moved successfully. C:\Documents and Settings\Helene Lesueur\Local Settings\Temporary Internet Files\Content.IE5\8KVVHIMS\welcome[1].htm moved successfully. File\Folder C:\WINNT\temp\mcmsc_0as1DUSXpTxdGLm not found! File\Folder C:\WINNT\temp\mcmsc_lJ3lQAspNNJ227Z not found! Registry entries deleted on Reboot…
Post #11
MBAM Scan Log results Malwarebytes' Anti-Malware 1.44 Database version: 3831 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 2010-03-07 8:39:33 AM mbam-log-2010-03-07 (08-39-33).txt Scan type: Quick Scan Objects scanned: 132111 Time elapsed: 15 minute(s), 7 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)
Post #12
The computer is running nice, faster now.

OTL.txt Notepad log

OTL logfile created on: 2010-03-07 8:43:38 AM - Run 2
OTL by OldTimer - Version 3.1.34.0 Folder = C:\Documents and Settings\Helene Lesueur\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: yyyy-MM-dd

511.00 Mb Total Physical Memory | 243.00 Mb Available Physical Memory | 48.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 72.00% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINNT | %ProgramFiles% = C:\Program Files
Drive C: | 55.88 Gb Total Space | 36.47 Gb Free Space | 65.26% Space Free | Partition Type: FAT32
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: GUESTROOM
Current User Name: Helene Lesueur
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Helene Lesueur\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\MPF\MpfSrv.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\VirusScan\Mcshield.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\VirusScan\mcsysmon.exe (McAfee, Inc.)
PRC - C:\Program Files\McAfee\MSC\mcmscsvc.exe (McAfee, Inc.)
PRC - c:\Program Files\Common Files\McAfee\McProxy\McProxy.exe (McAfee, Inc.)
PRC - c:\Program Files\Common Files\McAfee\MNA\McNASvc.exe (McAfee, Inc.)
PRC - C:\Program Files\Secunia\PSI\psi.exe (Secunia)
PRC - C:\WINNT\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe (Yahoo! Inc.)
PRC - C:\Program Files\Canon\CAL\CALMAIN.exe (Canon Inc.)
PRC - C:\Program Files\Logitech\MouseWare\system\EM_EXEC.EXE (Logitech Inc.)
PRC - C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\Directcd.exe (Roxio)
PRC - C:\Program Files\support.com\bin\tgcmd.exe (Support.com, Inc.)
PRC - C:\WINNT\GWMDMMSG.exe (GTW)
PRC - C:\WINNT\system32\devldr32.exe (Creative Technology Ltd.)
PRC - C:\WINNT\system32\SK9910DM.EXE (Silitek Corporation)


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Helene Lesueur\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINNT\system32\msvcp60.dll (Microsoft Corporation)
MOD - C:\Program Files\Common Files\Logitech\Scrolling\LGMSGHK.DLL (Logitech Inc.)
MOD - C:\Program Files\Logitech\MouseWare\system\LgWndHk.dll (Logitech Inc.)


========== Win32 Services (SafeList) ==========

SRV - (PictureTaker) – File not found
SRV - (iPodService) – File not found
SRV - (MpfService) – C:\Program Files\McAfee\MPF\MPFSrv.exe (McAfee, Inc.)
SRV - (McODS) – C:\Program Files\McAfee\VirusScan\mcods.exe (McAfee, Inc.)
SRV - (McShield) – C:\Program Files\McAfee\VirusScan\Mcshield.exe (McAfee, Inc.)
SRV - (McSysmon) – C:\Program Files\McAfee\VirusScan\mcsysmon.exe (McAfee, Inc.)
SRV - (mcmscsvc) – C:\Program Files\McAfee\MSC\mcmscsvc.exe (McAfee, Inc.)
SRV - (McProxy) – c:\Program Files\Common Files\McAfee\McProxy\McProxy.exe (McAfee, Inc.)
SRV - (McNASvc) – c:\Program Files\Common Files\McAfee\MNA\McNASvc.exe (McAfee, Inc.)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MsMpEng.exe (Microsoft Corporation)
SRV - (lxdb_device) – C:\WINNT\System32\lxdbcoms.exe ( )
SRV - (CCALib8) – C:\Program Files\Canon\CAL\CALMAIN.exe (Canon Inc.)


========== Driver Services (SafeList) ==========

DRV - (mfehidk) – C:\WINNT\system32\drivers\mfehidk.sys (McAfee, Inc.)
DRV - (mfeavfk) – C:\WINNT\system32\drivers\mfeavfk.sys (McAfee, Inc.)
DRV - (mfesmfk) – C:\WINNT\system32\drivers\mfesmfk.sys (McAfee, Inc.)
DRV - (mfebopk) – C:\WINNT\system32\drivers\mfebopk.sys (McAfee, Inc.)
DRV - (mferkdk) – C:\WINNT\system32\drivers\mferkdk.sys (McAfee, Inc.)
DRV - (MPFP) – C:\WINNT\system32\drivers\Mpfp.sys (McAfee, Inc.)
DRV - (PSI) – C:\WINNT\system32\drivers\psi_mf.sys (Secunia)
DRV - (NwlnkIpx) – C:\WINNT\system32\drivers\nwlnkipx.sys (Microsoft Corporation)
DRV - (gameenum) – C:\WINNT\system32\drivers\gameenum.sys (Microsoft Corporation)
DRV - (usbaudio) USB Audio Driver (WDM) – C:\WINNT\system32\drivers\usbaudio.sys (Microsoft Corporation)
DRV - (Cdralw2k) – C:\WINNT\system32\drivers\cdralw2k.sys (Sonic Solutions)
DRV - (Cdr4_xp) – C:\WINNT\system32\drivers\cdr4_xp.sys (Sonic Solutions)
DRV - (ASPI32) – C:\WINNT\system32\drivers\aspi32.sys (Adaptec)
DRV - (nv) – C:\WINNT\system32\drivers\nv4_mini.sys (NVIDIA Corporation)
DRV - (ati2mtaa) – C:\WINNT\system32\drivers\ati2mtaa.sys (ATI Technologies Inc.)
DRV - (cdrbsvsd) – C:\WINNT\system32\drivers\cdrbsvsd.sys (B.H.A Corporation)
DRV - (LMouFlt2) – C:\WINNT\system32\drivers\LMouFlt2.Sys (Logitech, Inc.)
DRV - (L8042pr2) – C:\WINNT\system32\drivers\L8042pr2.Sys (Logitech, Inc.)
DRV - (LHidUsb) – C:\WINNT\system32\drivers\LHidUsb.sys (Logitech, Inc.)
DRV - (LHidFlt2) – C:\WINNT\system32\drivers\LHidFlt2.Sys (Logitech, Inc.)
DRV - (DCamUSBSQTECH) Dual-Mode DSC(2770) – C:\WINNT\system32\drivers\SQCaptur.sys (Service & Quality Technology.)
DRV - (sonypvs1) – C:\WINNT\system32\drivers\sonypvs1.sys (Sony Corporation)
DRV - (AN983) – C:\WINNT\system32\drivers\an983.sys (ADMtek Incorporated.)
DRV - (ha10kx2k) – C:\WINNT\system32\drivers\ha10kx2k.sys (Creative Technology Ltd)
DRV - (emupia) – C:\WINNT\system32\drivers\emupia2k.sys (Creative Technology Ltd)
DRV - (ctsfm2k) – C:\WINNT\system32\drivers\ctsfm2k.sys (Creative Technology Ltd)
DRV - (ctprxy2k) – C:\WINNT\system32\drivers\ctprxy2k.sys (Creative Technology Ltd)
DRV - (ossrv) – C:\WINNT\system32\drivers\ctoss2k.sys (Creative Technology Ltd.)
DRV - (ctaud2k) Creative Audio Driver (WDM) – C:\WINNT\system32\drivers\ctaud2k.sys (Creative Technology Ltd)
DRV - (ctac32k) – C:\WINNT\system32\drivers\ctac32k.sys (Creative Technology Ltd)
DRV - (MR97310_VGA_DUAL_CAMERA) – C:\WINNT\system32\drivers\MR97310v.sys (Mars Semiconductor Corp.)
DRV - (dvd_2K) – C:\WINNT\system32\drivers\Dvd_2k.sys (Roxio)
DRV - (mmc_2K) – C:\WINNT\system32\drivers\Mmc_2k.sys (Roxio)
DRV - (pwd_2k) – C:\WINNT\system32\drivers\pwd_2K.sys (Roxio)
DRV - (cdudf_xp) – C:\WINNT\system32\drivers\cdudf_xp.sys (Roxio)
DRV - (UdfReadr_xp) – C:\WINNT\system32\drivers\udfreadr_xp.sys (Roxio)
DRV - (GTWModem) – C:\WINNT\system32\drivers\GWMDM.sys (GTW)
DRV - (NwlnkNb) – C:\WINNT\system32\drivers\nwlnknb.sys (Microsoft Corporation)
DRV - (NwlnkSpx) – C:\WINNT\system32\drivers\nwlnkspx.sys (Microsoft Corporation)
DRV - (ms_mpu401) – C:\WINNT\system32\drivers\msmpu401.sys (Microsoft Corporation)
DRV - (MODEMCSA) – C:\WINNT\system32\drivers\MODEMCSA.sys (Microsoft Corporation)
DRV - (ultra) – C:\WINNT\System32\DRIVERS\ultra.sys (Promise Technology, Inc.)
DRV - (BCMModem) – C:\WINNT\system32\drivers\BCMDM.sys (BCM)
DRV - (ati2mpaa) – C:\WINNT\system32\drivers\ati2mpaa.sys (ATI Technologies Inc.)
DRV - (ac97intc) Intel® 82801 Audio Driver Install Service (WDM) – C:\WINNT\system32\drivers\ac97intc.sys (Intel Corporation)
DRV - (sfman) Creative SoundFont Manager Driver (WDM) – C:\WINNT\system32\drivers\sfmanm.sys (Creative Technology Ltd.)
DRV - (emu10k1) Creative Interface Manager Driver (WDM) – C:\WINNT\system32\drivers\ctlfacem.sys (Creative Technology Ltd.)
DRV - (emu10k) Creative SB Live! (WDM) – C:\WINNT\system32\drivers\emu10k1m.sys (Creative Technology Ltd.)
DRV - (ctljystk) – C:\WINNT\system32\drivers\ctljystk.sys (Creative Technology Ltd.)
DRV - (EL90XBC) – C:\WINNT\system32\drivers\el90xbc5.sys (3Com Corporation)
DRV - (Eplpdx02) – C:\WINNT\system32\drivers\EPLPDX02.SYS (MK Systems CO., LTD.)
DRV - (wandrv) – C:\WINNT\system32\drivers\wandrv.sys (America Online, Inc.)
DRV - (Sk9920nt) – C:\WINNT\system32\drivers\Sk9920nt.sys (Silitek Corp.)
DRV - (Sk99202k) – C:\WINNT\system32\drivers\Sk99202k.sys (Silitek Corp.)
Post #13
OTL.txt notepad log continued

========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINNT\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINNT\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Yahoo! Search
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://search.yahoo.com/search?p={searchTe…-8&fr=b1ie7
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll (Yahoo! Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Google"
FF - prefs.js..browser.search.defaulturl: "http://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q="
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "http://www.comcast.net/comcast.html"



[2006-07-17 20:02:48 | 000,000,000 | —D | M] – C:\Documents and Settings\Helene Lesueur\Application Data\Mozilla\Firefox\Profiles\5mmw5ggf.default\extensions

O1 HOSTS File: ([2009-03-29 11:11:18 | 000,000,027 | —- | M]) - C:\WINNT\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Yahoo! Toolbar Helper) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll (Yahoo! Inc.)
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [AdaptecDirectCD] C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe (Roxio)
O4 - HKLM..\Run: [Adobe Photo Downloader] C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [GWMDMMSG] C:\WINNT\GWMDMMSG.exe (GTW)
O4 - HKLM..\Run: [Hot Key Kbd 9910 Daemon] C:\WINNT\System32\SK9910DM.EXE (Silitek Corporation)
O4 - HKLM..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe File not found
O4 - HKLM..\Run: [Logitech Utility] C:\WINNT\LOGI_MWX.EXE (Logitech Inc.)
O4 - HKLM..\Run: [LXDBCATS] C:\WINNT\System32\spool\DRIVERS\W32X86\3\LXDBtime.DLL ()
O4 - HKLM..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
O4 - HKLM..\Run: [tgcmd] C:\Program Files\support.com\bin\tgcmd.exe (Support.com, Inc.)
O4 - HKCU..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe (Logitech)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ymetray.lnk = C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe (Yahoo! Inc.)
O4 - Startup: C:\Documents and Settings\Helene Lesueur\Start Menu\Programs\Startup\Secunia PSI.lnk = C:\Program Files\Secunia\PSI\psi.exe (Secunia)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINNT\system32\nwprovau.dll (Microsoft Corporation)
O15 - HKCU\..Trusted Domains: mcafee.com ([]http in Trusted sites)
O15 - HKCU\..Trusted Domains: mcafee.com ([]https in Trusted sites)
O16 - DPF: {01012101-5E80-11D8-9E86-0007E96C65AE} http://www.comcastsupport.com/OneClickFix/tgctlsr.cab (SupportSoft Script Runner Class)
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} http://office.microsoft.com/templates/ieawsdc.cab (Microsoft Office Template and Media Control)
O16 - DPF: {0DB074F0-617E-4EE9-912C-2965CF2AA5A4} http://download.microsoft.com/download/0/f…tualEarth3D.cab (Reg Error: Key error.)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/C/0…heckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\Common\Yinsthelper.dll (Installation Support)
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} http://www.eset.eu/buxus/docs/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdat…b?1247598275701 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} http://games.myspace.com/Gameshell/GameHos…ronGameHost.cab (Oberon Flash Game Host)
O16 - DPF: {D1D98C0F-A339-42AB-BD5F-EA0FF5D0E65F} http://www.rockyou.com/RockYouImageUploader.cab (RockYou Image Uploader Control)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/get/flash…ent/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINNT\Java\classes\xmldso.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINNT\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINNT\System32\igfxsrvc.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Helene Lesueur\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Helene Lesueur\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - C:\Program Files\Windows Defender\MpShHook.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - comfile [open] – "%1" %*
O35 - exefile [open] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010-03-07 08:02:43 | 000,000,000 | —D | C] – C:\_OTL
[2010-03-06 19:26:20 | 000,553,984 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Helene Lesueur\Desktop\OTL.exe
[2010-02-06 10:59:44 | 000,000,000 | —D | C] – C:\Program Files\MSECache
[2010-02-06 10:57:50 | 038,808,920 | —- | C] (Microsoft Corporation) – C:\Documents and Settings\Helene Lesueur\Desktop\FileFormatConverters.exe
[2009-04-13 13:12:32 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Help
[2009-04-13 13:12:32 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Application Data\Help
[2007-07-08 17:22:00 | 000,409,600 | —- | C] ( ) – C:\WINNT\System32\lxdbinpa.dll
[2007-07-08 17:22:00 | 000,393,216 | —- | C] ( ) – C:\WINNT\System32\lxdbiesc.dll
[2007-07-08 17:21:57 | 001,183,744 | —- | C] ( ) – C:\WINNT\System32\lxdbserv.dll
[2007-07-08 17:21:57 | 000,995,328 | —- | C] ( ) – C:\WINNT\System32\lxdbusb1.dll
[2007-07-08 17:21:57 | 000,696,320 | —- | C] ( ) – C:\WINNT\System32\lxdbhbn3.dll
[2007-07-08 17:21:57 | 000,610,304 | —- | C] ( ) – C:\WINNT\System32\lxdbcomc.dll
[2007-07-08 17:21:57 | 000,536,576 | —- | C] ( ) – C:\WINNT\System32\lxdblmpm.dll
[2007-07-08 17:21:57 | 000,421,888 | —- | C] ( ) – C:\WINNT\System32\lxdbcomm.dll
[2007-07-08 17:21:57 | 000,163,840 | —- | C] ( ) – C:\WINNT\System32\lxdbprox.dll
[2007-07-08 17:21:57 | 000,114,688 | —- | C] ( ) – C:\WINNT\System32\lxdbpplc.dll
[2006-08-01 18:55:00 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Application Data\Macromedia
[2006-03-29 18:47:35 | 021,254,280 | —- | C] ( ) – C:\Program Files\AdbeRdr707_en_US.exe
[2006-03-29 18:47:15 | 007,050,552 | —- | C] (Adobe Systems, Inc. ) – C:\Program Files\psa30se_en_us.exe
[2005-07-30 19:40:02 | 000,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Application Data\Symantec
[2005-04-08 21:32:58 | 000,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2001-09-08 09:12:08 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[2001-09-08 09:12:06 | 000,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
[2001-09-08 08:56:28 | 000,000,000 | –SD | M] – C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2001-09-08 08:56:28 | 000,000,000 | –SD | M] – C:\Documents and Settings\LocalService\Application Data\Microsoft
Post #14
again I am having problems including the last part of the OTL.txt results. Can I send them another way?

formsmusic rights.doc
[2010-03-05 23:08:56 | 000,034,816 | —- | M] () – C:\Documents and Settings\Helene Lesueur\My Documents\Hi Freddie.doc
[2010-03-05 21:22:24 | 000,039,424 | —- | M] () – C:\Documents and Settings\Helene Lesueur\My Documents\Consulting-PromotionServicesAgreement.doc
[2010-03-04 21:41:54 | 000,026,624 | —- | M] () – C:\Documents and Settings\Helene Lesueur\My Documents\Label seeks.doc
[2010-03-04 14:13:42 | 000,710,144 | —- | M] () – C:\Documents and Settings\Helene Lesueur\My Documents\Different PWs & WSnew.doc
[2010-03-02 23:53:00 | 000,046,592 | —- | M] () – C:\Documents and Settings\Helene Lesueur\My Documents\miscstsilv.doc
[2010-03-02 17:42:24 | 000,027,648 | —- | M] () – C:\Documents and Settings\Helene Lesueur\My Documents\Production Company Looking for Bands.doc
[2010-03-01 23:22:02 | 000,051,712 | —- | M] () – C:\Documents and Settings\Helene Lesueur\My Documents\HeartThrobEntertainment Invoice.doc
[2010-03-01 23:12:48 | 000,103,344 | —- | M] () – C:\Documents and Settings\Helene Lesueur\Application Data\GDIPFONTCACHEV1.DAT
[2010-03-01 12:20:24 | 000,029,696 | —- | M] () – C:\Documents and Settings\Helene Lesueur\My Documents\the generator.doc
[2010-02-28 14:00:30 | 000,039,424 | —- | M] () – C:\Documents and Settings\Helene Lesueur\My Documents\Interestedbio.doc
[2010-02-26 22:31:52 | 000,027,136 | —- | M] () – C:\Documents and Settings\Helene Lesueur\My Documents\craigslistinfo.doc
[2010-02-24 12:52:18 | 000,030,720 | —- | M] () – C:\Documents and Settings\Helene Lesueur\My Documents\biopricing.doc
[2010-02-24 10:50:04 | 000,001,374 | —- | M] () – C:\WINNT\imsins.BAK
[2010-02-22 23:45:08 | 000,025,600 | —- | M] () – C:\Documents and Settings\Helene Lesueur\My Documents\promotionblue07.doc
[2010-02-21 13:46:38 | 000,022,016 | —- | M] () – C:\Documents and Settings\Helene Lesueur\My Documents\fredbooking.doc
[2010-02-21 13:31:52 | 000,042,496 | —- | M] () – C:\Documents and Settings\Helene Lesueur\My Documents\TROOP Rider-All In.doc
[2010-02-20 18:58:32 | 000,020,480 | —- | M] () – C:\Documents and Settings\Helene Lesueur\My Documents\blogtalkradio.doc
[2010-02-19 10:29:08 | 000,029,184 | —- | M] () – C:\Documents and Settings\Helene Lesueur\My Documents\bioinquiry.doc
[2010-02-17 17:36:00 | 000,028,672 | —- | M] () – C:\Documents and Settings\Helene Lesueur\My
Documents\simavirevisedbios.doc
[2010-02-17 11:34:34 | 000,001,629 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Adobe Reader 8.lnk
[2010-02-16 22:04:46 | 000,131,072 | —- | M] () – C:\Documents and Settings\Helene Lesueur\My Documents\ALLEN
MCNEILBIO.doc
[2010-02-16 16:09:16 | 000,044,032 | —- | M] () – C:\Documents and Settings\Helene Lesueur\My Documents\HIGHA MEDZ BIO.doc
[2010-02-16 16:04:58 | 000,026,112 | —- | M] () – C:\Documents and Settings\Helene Lesueur\My Documents\Higha Medz includes Richard Farquharson.doc
[2010-02-15 10:50:44 | 000,093,696 | —- | M] () – C:\Documents and Settings\Helene Lesueur\My Documents\How to Work From Home.doc
[2010-02-14 20:35:20 | 000,028,672 | —- | M] () – C:\Documents and Settings\Helene Lesueur\My Documents\Simavibios.doc
[2010-02-14 20:31:56 | 000,042,496 | —- | M] () – C:\Documents and Settings\Helene Lesueur\My Documents\TROOP Rider-1.doc
[2010-02-11 18:58:18 | 000,024,576 | —- | M] () – C:\Documents and Settings\Helene Lesueur\My Documents\Heden.doc
[2010-02-11 18:57:58 | 000,030,208 | —- | M] () – C:\Documents and Settings\Helene Lesueur\My Documents\HauntingEden.doc
[2010-02-11 18:27:50 | 000,024,576 | —- | M] () – C:\Documents and Settings\Helene Lesueur\My Documents\HAUNTING EDEN BIO.doc
[2010-02-10 23:26:42 | 000,084,992 | —- | M] () – C:\Documents and Settings\Helene Lesueur\My Documents\clientservicesmediabase.doc
[2010-02-09 20:57:08 | 000,039,936 | —- | M] () – C:\Documents and Settings\Helene Lesueur\My Documents\resumeinfo1.doc
[2010-02-09 20:25:50 | 000,034,304 | —- | M] () – C:\Documents and Settings\Helene Lesueur\My Documents\HeleneLesueurCoverletter.doc
[2010-02-09 10:03:52 | 000,041,984 | —- | M] () – C:\Documents and Settings\Helene Lesueur\My Documents\Helene%20Lesueur%20new[1]111.doc
[2010-02-07 23:30:14 | 000,031,744 | —- | M] () – C:\Documents and Settings\Helene Lesueur\My Documents\ArtistAgreement[1]
highlight.doc
[2010-02-07 23:10:08 | 000,040,448 | —- | M] () – C:\Documents and Settings\Helene Lesueur\My Documents\Helene%20Lesueur%20new[1]1.doc
[2010-02-07 21:24:08 | 000,022,255 | —- | M] () – C:\Documents and Settings\Helene Lesueur\My Documents\TROOPRiderPasadenaCityCollege.docx
[2010-02-06 12:08:50 | 000,021,965 | —- | M] () – C:\Documents and Settings\Helene Lesueur\My Documents\Troop%20Event%20rider-Pasadena%20City%20College[1].docx
[2010-02-06 11:02:48 | 000,345,808 | —- | M] () – C:\WINNT\System32\FNTCACHE.DAT
[2010-02-06 10:57:52 | 038,808,920 | —- | M] (Microsoft Corporation) – C:\Documents and Settings\Helene Lesueur\Desktop\FileFormatConverters.exe
[2010-02-06 10:43:26 | 000,024,576 | —- | M] () – C:\Documents and Settings\Helene Lesueur\My Documents\converter.doc
[2010-02-05 21:49:32 | 000,035,328 | —- | M] () – C:\Documents and Settings\Helene Lesueur\My Documents\label_producer_contract[1].doc
========== Files Created - No Company Name ==========

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI