Spyware / Malware / Virus Removal

Agonisingly slow...

15 min read

Looking for the outcome? Ask AI

Maaike Topic Starter

Post #1June 23, 2010, 5:20 AM UTC

Hi, I have a 7-year-old computer, which is incredibly slow to get up and running when turned on - about 10-15 minutes is not unusual. Also sometimes during the day, when you ask it to do something, even something as innocuous as opening a folder to get to a file, it is incredibly slow to do so. I can literally sometimes go and make a cuppa before it's done what I've asked. Having said that, it doesn't always operate that slow, although the startup is always slow. We've upgraded the RAM in it, so it now runs on 1.5Gb RAM, which has helped a little, but not with the startup. I've run HijackThis, and attached is the log file. Can anyone tell me what it is slowing it down?

Attachments:

📎hijackthis_logfile_23June10.txt

inzanity

Post #2June 24, 2010, 12:36 AM UTC

Hello and

I will be helping you on removing malwares on your computer. Log research takes time, so please be patient and I'd be grateful if you would note the following:

The fixes are specific to your problem and should only be used for the issues on this machine.
Do not install/uninstall anything on your computer unless advised.
Do not run any other scanning tools other than those instructed for you to use.
Follow the instructions on the order they are given.
Stay with this thread until advised when your computer is clean. Absence of symptoms does not necessarily mean a clean computer.
If you are being helped regarding this problem on another forum please advice us so that we can close this thread.
If you do not reply within 3 days after my last response, I will be asking you whether you still need assistance and if you still don't reply within 48 hours then the topic will be closed.
And lastly, if you have any questions, please ask before proceeding with any of the advised fixes.

_________________________________________________

Let's dig deeper.

Please download DeFogger to your desktop.
Double click DeFogger to run the tool.

The application window will appear
Click the Disable button to disable your CD Emulation drivers
Click Yes to continue
A 'Finished!' message will appear
Click OK
DeFogger will now ask to reboot the machine - click OK

IMPORTANT! If you receive an error message while running DeFogger, please post the log defogger_disable which will appear on your desktop.
Do not re-enable these drivers until otherwise instructed.

–Next–

OTL:

Download OTL to your desktop.
Double click on OTL.exe to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output
Check the boxes beside LOP Check and Purity Check.
Copy and paste the following bold text into the box under Custom Scan

netsvcs
%SYSTEMDRIVE%\*.exe
c:\windows\system32\drivers\*.sys /90
/md5start
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
sceclt.dll
ntelogon.dll
logevent.dll
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
/md5stop
CREATERESTOREPOINT
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.

Please copy (Edit->Select All, Edit->Copy) the contents of the OTL.txt and post it with your next reply along with the Extras.txt log.

–Next–

[external image: Posted Image]
Download the GMER Rootkit Scanner. Unzip it to your Desktop.

Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.

Double click GMER.exe.
[external image: Posted Image]
If it gives you a warning about rootkit activity and asks if you want to run a full scan…click on NO, then use the following settings for a more complete scan..
In the right panel, you will see several boxes that have been checked. Ensure the following are UNCHECKED …
- IAT/EAT
- Drives/Partition other than Systemdrive (typically C:\)
- Show All (don't miss this one)
  [external image: Posted Image]
  Click the image to enlarge it
Then click the Scan button & wait for it to finish.
Once done click on the [Save..] button, and in the File name area, type in "ark.txt"
Save the log where you can easily find it, such as your desktop.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries
Please copy and paste the report into your Post.

To post in your next reply (Don't attach it):
1. Defogger log.
2. OTL log.
3. GMER log.

Maaike

Post #3June 24, 2010, 7:00 AM UTC

Hi Inzanity, I did all of that,
would've been good to know the GMER scan was going to take 5 hours

Anyway, these are the results:

Defogger:

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 10:59 on 24/06/2010 (Maaike)

Checking for autostart values…
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers…

-=E.O.F=-

OTL:

OTL logfile created on: 24/06/2010 11:13:36 - Run 1
OTL by OldTimer - Version 3.2.7.0 Folder = C:\Documents and Settings\Maaike\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000C09 | Country: Australia | Language: ENU | Date Format: d/MM/yyyy

1.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 62.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 80.00% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.47 Gb Total Space | 27.73 Gb Free Space | 37.24% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: POSSERVER
Current User Name: Maaike
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Maaike\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgnsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgrsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\LogMeIn\x86\LMIGuardian.exe (LogMeIn, Inc.)
PRC - C:\WINDOWS\SYSTEM32\ntvdm.exe (Microsoft Corporation)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\ceon\PhotoLabLauncher.exe ()
PRC - C:\Program Files\LogMeIn\x86\LogMeInSystray.exe (LogMeIn, Inc.)
PRC - C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe (Adobe Systems Incorporated)
PRC - C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\Directcd.exe (Roxio)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Maaike\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\SYSTEM32\msscript.ocx (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (Apple Mobile Device) – C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (avg9wd) – C:\Program Files\AVG\AVG9\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (LMIMaint) – C:\Program Files\LogMeIn\x86\RaMaint.exe (LogMeIn, Inc.)
SRV - (LogMeIn) – C:\Program Files\LogMeIn\x86\LogMeIn.exe (LogMeIn, Inc.)
SRV - (ServiceLayer) – C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (Nokia.)
SRV - (NetSvc) – C:\Program Files\Intel\NCS\Sync\NetSvc.exe (Intel® Corporation)

========== Driver Services (SafeList) ==========

DRV - (AvgTdiX) – C:\WINDOWS\System32\Drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (AvgMfx86) – C:\WINDOWS\System32\Drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AvgLdx86) – C:\WINDOWS\System32\Drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (LMIRfsClientNP) – C:\WINDOWS\SYSTEM32\LMIRfsClientNP.dll (LogMeIn, Inc.)
DRV - (LMIRfsDriver) – C:\WINDOWS\SYSTEM32\DRIVERS\LMIRfsDriver.sys (LogMeIn, Inc.)
DRV - (LMIInfo) – C:\Program Files\LogMeIn\x86\rainfo.sys (LogMeIn, Inc.)
DRV - (amdagp) – C:\WINDOWS\System32\DRIVERS\amdagp.sys (Advanced Micro Devices, Inc.)
DRV - (sisagp) – C:\WINDOWS\System32\DRIVERS\sisagp.sys (Silicon Integrated Systems Corporation)
DRV - (s3017unic) Sony Ericsson Device 3017 USB Ethernet Emulation SEMC3017 (WDM) – C:\WINDOWS\SYSTEM32\DRIVERS\s3017unic.sys (MCCI Corporation)
DRV - (s3017obex) – C:\WINDOWS\SYSTEM32\DRIVERS\s3017obex.sys (MCCI Corporation)
DRV - (s3017mgmt) Sony Ericsson Device 3017 USB WMC Device Management Drivers (WDM) – C:\WINDOWS\SYSTEM32\DRIVERS\s3017mgmt.sys (MCCI Corporation)
DRV - (s3017nd5) Sony Ericsson Device 3017 USB Ethernet Emulation SEMC3017 (NDIS) – C:\WINDOWS\SYSTEM32\DRIVERS\s3017nd5.sys (MCCI Corporation)
DRV - (s3017mdm) – C:\WINDOWS\SYSTEM32\DRIVERS\s3017mdm.sys (MCCI Corporation)
DRV - (s3017mdfl) – C:\WINDOWS\SYSTEM32\DRIVERS\s3017mdfl.sys (MCCI Corporation)
DRV - (s3017bus) Sony Ericsson Device 3017 driver (WDM) – C:\WINDOWS\SYSTEM32\DRIVERS\s3017bus.sys (MCCI Corporation)
DRV - (s716unic) Sony Ericsson Device 716 USB Ethernet Emulation SEMC716 (WDM) – C:\WINDOWS\SYSTEM32\DRIVERS\s716unic.sys (MCCI Corporation)
DRV - (s716obex) – C:\WINDOWS\SYSTEM32\DRIVERS\s716obex.sys (MCCI Corporation)
DRV - (s716nd5) Sony Ericsson Device 716 USB Ethernet Emulation SEMC716 (NDIS) – C:\WINDOWS\SYSTEM32\DRIVERS\s716nd5.sys (MCCI Corporation)
DRV - (s716mdm) – C:\WINDOWS\SYSTEM32\DRIVERS\s716mdm.sys (MCCI Corporation)
DRV - (s716mgmt) Sony Ericsson Device 716 USB WMC Device Management Drivers (WDM) – C:\WINDOWS\SYSTEM32\DRIVERS\s716mgmt.sys (MCCI Corporation)
DRV - (s716mdfl) – C:\WINDOWS\SYSTEM32\DRIVERS\s716mdfl.sys (MCCI Corporation)
DRV - (s716bus) Sony Ericsson Device 716 driver (WDM) – C:\WINDOWS\SYSTEM32\DRIVERS\s716bus.sys (MCCI Corporation)
DRV - (Cdr4_xp) – C:\WINDOWS\SYSTEM32\DRIVERS\cdr4_xp.sys (Roxio)
DRV - (hardlock) – C:\WINDOWS\SYSTEM32\DRIVERS\hardlock.sys (Aladdin Knowledge Systems)
DRV - (Haspnt) – C:\WINDOWS\SYSTEM32\DRIVERS\Haspnt.sys (Aladdin Knowledge Systems)
DRV - (iAimFP4) – C:\WINDOWS\SYSTEM32\DRIVERS\wvchntxx.sys (Intel® Corporation)
DRV - (iAimFP3) – C:\WINDOWS\SYSTEM32\DRIVERS\wsiintxx.sys (Intel® Corporation)
DRV - (iAimTV4) – C:\WINDOWS\SYSTEM32\DRIVERS\wch7xxnt.sys (Intel® Corporation)
DRV - (iAimTV3) – C:\WINDOWS\SYSTEM32\DRIVERS\watv04nt.sys (Intel® Corporation)
DRV - (iAimTV1) – C:\WINDOWS\SYSTEM32\DRIVERS\watv02nt.sys (Intel® Corporation)
DRV - (iAimTV0) – C:\WINDOWS\SYSTEM32\DRIVERS\watv01nt.sys (Intel® Corporation)
DRV - (iAimFP0) – C:\WINDOWS\SYSTEM32\DRIVERS\wadv01nt.sys (Intel® Corporation)
DRV - (iAimFP1) – C:\WINDOWS\SYSTEM32\DRIVERS\wadv02nt.sys (Intel® Corporation)
DRV - (iAimFP2) – C:\WINDOWS\SYSTEM32\DRIVERS\wadv05nt.sys (Intel® Corporation)
DRV - (i81x) – C:\WINDOWS\SYSTEM32\DRIVERS\i81xnt5.sys (Intel® Corporation)
DRV - (nv) – C:\WINDOWS\SYSTEM32\DRIVERS\nv4_mini.sys (NVIDIA Corporation)
DRV - (U3sHlpDr) – C:\WINDOWS\SYSTEM32\DRIVERS\U3sHlpDr.sys ()
DRV - (UdfReadr_xp) – C:\WINDOWS\SYSTEM32\DRIVERS\udfreadr_xp.sys (Roxio)
DRV - (pwd_2k) – C:\WINDOWS\SYSTEM32\DRIVERS\pwd_2K.sys (Roxio)
DRV - (mmc_2K) – C:\WINDOWS\SYSTEM32\DRIVERS\Mmc_2k.sys (Roxio)
DRV - (dvd_2K) – C:\WINDOWS\SYSTEM32\DRIVERS\Dvd_2k.sys (Roxio)
DRV - (Cdralw2k) – C:\WINDOWS\SYSTEM32\DRIVERS\cdralw2k.sys (Roxio)
DRV - (cdudf_xp) – C:\WINDOWS\SYSTEM32\DRIVERS\cdudf_xp.sys (Roxio)
DRV - (omci) – C:\WINDOWS\SYSTEM32\DRIVERS\omci.sys (Dell Computer Corporation)
DRV - (Aspi32) – C:\WINDOWS\SYSTEM32\DRIVERS\ASPI32.SYS (Adaptec)
DRV - (Sparrow) – C:\WINDOWS\System32\DRIVERS\sparrow.sys (Adaptec, Inc.)
DRV - (sym_u3) – C:\WINDOWS\System32\DRIVERS\sym_u3.sys (LSI Logic)
DRV - (sym_hi) – C:\WINDOWS\System32\DRIVERS\sym_hi.sys (LSI Logic)
DRV - (symc8xx) – C:\WINDOWS\System32\DRIVERS\symc8xx.sys (LSI Logic)
DRV - (symc810) – C:\WINDOWS\System32\DRIVERS\symc810.sys (Symbios Logic Inc.)
DRV - (ultra) – C:\WINDOWS\System32\DRIVERS\ultra.sys (Promise Technology, Inc.)
DRV - (ql12160) – C:\WINDOWS\System32\DRIVERS\ql12160.sys (QLogic Corporation)
DRV - (ql1080) – C:\WINDOWS\System32\DRIVERS\ql1080.sys (QLogic Corporation)
DRV - (ql1280) – C:\WINDOWS\System32\DRIVERS\ql1280.sys (QLogic Corporation)
DRV - (dac2w2k) – C:\WINDOWS\System32\DRIVERS\dac2w2k.sys (Mylex Corporation)
DRV - (mraid35x) – C:\WINDOWS\System32\DRIVERS\mraid35x.sys (American Megatrends Inc.)
DRV - (asc) – C:\WINDOWS\System32\DRIVERS\asc.sys (Advanced System Products, Inc.)
DRV - (asc3550) – C:\WINDOWS\System32\DRIVERS\asc3550.sys (Advanced System Products, Inc.)
DRV - (AliIde) – C:\WINDOWS\System32\DRIVERS\aliide.sys (Acer Laboratories Inc.)
DRV - (CmdIde) – C:\WINDOWS\System32\DRIVERS\cmdide.sys (CMD Technology, Inc.)
DRV - (EL90XBC) – C:\WINDOWS\SYSTEM32\DRIVERS\EL90XBC5.SYS (3Com Corporation)
DRV - (Sentinel) – C:\WINDOWS\System32\Drivers\SENTINEL.SYS (Rainbow Technologies, Inc.)
DRV - (MASPINT) – C:\WINDOWS\SYSTEM32\DRIVERS\MASPINT.SYS (MicroStaff Co.,Ltd.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerm…tf8&oe;=utf8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com.au/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = ;*.local
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 192.168.1.20:80

========== FireFox ==========

FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "http://www.google.com.au/"
FF - prefs.js..extensions.enabledItems: {3e0e7d2a-070f-4a47-b019-91fe5385ba79}:3.0.1
FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:9.0.0.825
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..network.proxy.ftp: "192.168.1.20"
FF - prefs.js..network.proxy.ftp_port: 80
FF - prefs.js..network.proxy.gopher: "192.168.1.20"
FF - prefs.js..network.proxy.gopher_port: 80
FF - prefs.js..network.proxy.http: "192.168.1.20"
FF - prefs.js..network.proxy.http_port: 80
FF - prefs.js..network.proxy.no_proxies_on: "localhost,127.0.0.1"
FF - prefs.js..network.proxy.share_proxy_settings: true
FF - prefs.js..network.proxy.socks: "192.168.1.20"
FF - prefs.js..network.proxy.socks_port: 80
FF - prefs.js..network.proxy.ssl: "192.168.1.20"
FF - prefs.js..network.proxy.ssl_port: 80

FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG9\Firefox [2010/06/04 09:13:20 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.4\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/06/23 16:49:09 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.4\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/06/23 16:49:09 | 000,000,000 | —D | M]

[2008/08/29 10:40:29 | 000,000,000 | —D | M] – C:\Documents and Settings\Maaike\Application Data\Mozilla\Extensions
[2010/06/23 14:18:40 | 000,000,000 | —D | M] – C:\Documents and Settings\Maaike\Application Data\Mozilla\Firefox\Profiles\ricvu42y.default\extensions
[2010/04/28 09:21:07 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Maaike\Application Data\Mozilla\Firefox\Profiles\ricvu42y.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/03/25 11:03:22 | 000,000,000 | —D | M] (AddThis) – C:\Documents and Settings\Maaike\Application Data\Mozilla\Firefox\Profiles\ricvu42y.default\extensions\{3e0e7d2a-070f-4a47-b019-91fe5385ba79}
[2006/02/21 15:39:53 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Maaike\Application Data\Mozilla\Firefox\Profiles\ricvu42y.default\extensions\{BE087D3D-7F8B-4f69-B255-8C2D50B77230}
[2009/10/13 13:35:37 | 000,000,000 | —D | M] – C:\Documents and Settings\Maaike\Application Data\Mozilla\Firefox\Profiles\ricvu42y.default\extensions\[removed]
[2010/06/23 14:18:40 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2010/04/19 08:53:48 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/04/12 17:29:19 | 000,411,368 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll

O1 HOSTS File: ([2008/08/05 19:31:17 | 000,000,775 | —- | M]) - C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 192.168.1.20 photocentric.onpix.com
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O4 - HKLM..\Run: [AdaptecDirectCD] C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe (Roxio)
O4 - HKLM..\Run: [Adobe Photo Downloader] C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe (Apple Inc.)
O4 - HKLM..\Run: [Auto EPSON Stylus C67 Series on ACER-RNAGI95275] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAAP.EXE (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [AVG9_TRAY] C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [EPSON Stylus C67 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAAP.EXE (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [EPSON Stylus C67 Series on Maaikes] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAAP.EXE (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [KernelFaultCheck] File not found
O4 - HKLM..\Run: [LogMeIn GUI] C:\Program Files\LogMeIn\x86\LogMeInSystray.exe (LogMeIn, Inc.)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [PhotoUpload] C:\ceon\PhotoLabLauncher.exe ()
O4 - HKLM..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE (FUJI PHOTO FILM CO., LTD.)
O4 - HKLM..\Run: [UserFaultCheck] File not found
O4 - HKCU..\RunOnce: [FFTI] C:\Documents and Settings\Maaike\Application Data\Mozilla\Firefox\Profiles\ricvu42y.default\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\ffti.exe File not found
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: E&xport; to Microsoft Excel - C:\Program Files\Microsoft Office\Office10\EXCEL.EXE (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} http://office.microsoft.com/templates/ieawsdc.cab (Microsoft Office Template and Media Control)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool)
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} http://office.microsoft.com/officeupdate/content/opuc.cab (Office Update Installation Engine)
O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} http://sib1.od2.com/common/Member/ClientIn…2/OCI/setup.exe (InstallShield Setup Player 2K2)
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} http://download.bitdefender.com/resources/scan8/oscan8.cab (BDSCANONLINE Control)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdat…b?1167795106218 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CA1811B0-28B5-44AB-8DB3-DC9BEAA77D04} http://us.dl1.yimg.com/download.yahoo.com/…ropper1_3au.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} http://java.sun.com/products/plugin/autodl…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0014-0002-0005-ABCDEFFEDCBA} http://java.sun.com/products/plugin/autodl…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0015-0000-0008-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/get/shock…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} http://download.games.yahoo.com/games/popc…aploader_v5.cab (Reg Error: Key error.)
O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.20 [removed]
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\avgrsstarter: DllName - avgrsstx.dll - C:\WINDOWS\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
O20 - Winlogon\Notify\LMIinit: DllName - LMIinit.dll - C:\WINDOWS\System32\LMIinit.dll (LogMeIn, Inc.)
O24 - Desktop WallPaper: C:\Documents and Settings\Maaike\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Maaike\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2002/09/03 15:36:02 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O33 - MountPoints2\{4b1011aa-e598-11dc-9957-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{4b1011aa-e598-11dc-9957-00038a000015}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{4b1011aa-e598-11dc-9957-00038a000015}\Shell\readit\command - "" = H:\tool.exe – File not found
O33 - MountPoints2\{6614f97a-6d80-11dd-99eb-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{6614f97a-6d80-11dd-99eb-00038a000015}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{6614f97a-6d80-11dd-99eb-00038a000015}\Shell\AutoRun\command - "" = H:\LaunchU3.exe – File not found
O33 - MountPoints2\{efcc1de4-e072-11de-9b41-0007e97ea673}\Shell - "" = AutoRun
O33 - MountPoints2\{efcc1de4-e072-11de-9b41-0007e97ea673}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{efcc1de4-e072-11de-9b41-0007e97ea673}\Shell\AutoRun\command - "" = H:\Photo_Viewer.exe – File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - C:\WINDOWS\SYSTEM32\IAS [2003/06/02 14:02:56 | 000,000,000 | —D | M]
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: Ip6FwHlp - File not found

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (16902109354000384)

========== Files/Folders - Created Within 30 Days ==========

[2010/06/24 11:11:46 | 000,574,464 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Maaike\Desktop\OTL.exe
[2010/06/23 14:59:47 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Maaike\Recent
[2010/06/18 18:53:42 | 000,000,000 | —D | C] – C:\Program Files\Bonjour
[2010/06/17 17:01:19 | 000,000,000 | —D | C] – C:\Documents and Settings\Maaike\My Documents\Rosters June July 2010
[2010/06/16 09:20:59 | 000,000,000 | —D | C] – C:\Documents and Settings\Maaike\Local Settings\Application Data\PCHealth
[2010/06/15 13:31:45 | 000,000,000 | —D | C] – C:\Documents and Settings\Maaike\My Documents\Dakis
[2010/06/15 11:41:13 | 000,743,424 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iedvtool.dll
[2010/06/07 12:23:26 | 000,000,000 | —D | C] – C:\Documents and Settings\Maaike\Desktop\Rosters June July 2010
[8 C:\Documents and Settings\Maaike\My Documents\*.tmp files -> C:\Documents and Settings\Maaike\My Documents\*.tmp -> ]
[5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/06/24 11:15:00 | 000,000,428 | —- | M] () – C:\WINDOWS\tasks\Symantec NetDetect.job
[2010/06/24 11:14:24 | 000,000,006 | —- | M] () – C:\WINDOWS\Twain001.Mtx
[2010/06/24 11:14:23 | 000,000,156 | —- | M] () – C:\WINDOWS\Twunk001.MTX
[2010/06/24 11:14:01 | 000,000,886 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/06/24 11:11:47 | 000,574,464 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Maaike\Desktop\OTL.exe
[2010/06/24 11:08:06 | 000,001,170 | —- | M] () – C:\WINDOWS\System32\WPA.DBL
[2010/06/24 11:05:52 | 000,000,882 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/06/24 11:05:34 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/06/24 11:04:47 | 000,002,048 | –S- | M] () – C:\WINDOWS\BOOTSTAT.DAT
[2010/06/24 11:04:37 | 1609,633,792 | -HS- | M] () – C:\hiberfil.sys
[2010/06/24 11:02:44 | 008,388,608 | -H– | M] () – C:\Documents and Settings\Maaike\NTUSER.DAT
[2010/06/24 11:01:49 | 000,000,278 | -HS- | M] () – C:\Documents and Settings\Maaike\NTUSER.INI
[2010/06/24 11:01:00 | 000,024,064 | —- | M] () – C:\Documents and Settings\Maaike\Desktop\log url.doc
[2010/06/24 11:00:44 | 000,002,483 | —- | M] () – C:\Documents and Settings\Maaike\Desktop\Microsoft Word.lnk
[2010/06/24 10:59:10 | 000,000,000 | —- | M] () – C:\Documents and Settings\Maaike\defogger_reenable
[2010/06/24 10:57:15 | 000,050,477 | —- | M] () – C:\Documents and Settings\Maaike\Desktop\Defogger.exe
[2010/06/24 09:43:12 | 000,000,000 | —- | M] () – C:\Documents and Settings\Maaike\Local Settings\Application Data\prvlcl.dat
[2010/06/24 09:19:22 | 000,002,099 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Business Professional.lnk
[2010/06/24 09:13:46 | 061,364,738 | —- | M] () – C:\WINDOWS\System32\drivers\Avg\incavi.avm
[2010/06/23 14:52:39 | 000,001,585 | —- | M] () – C:\Documents and Settings\Maaike\Desktop\CCleaner.lnk
[2010/06/23 13:26:01 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/06/22 16:46:03 | 000,093,184 | —- | M] () – C:\Documents and Settings\Maaike\My Documents\Website content.doc
[2010/06/21 15:56:30 | 000,001,564 | —- | M] () – C:\Documents and Settings\Maaike\Desktop\WagezWindow.lnk
[2010/06/21 14:47:27 | 000,007,668 | —- | M] () – C:\Documents and Settings\Maaike\My Documents\PhotoCentric Remittance Advice.pdf
[2010/06/21 11:05:03 | 000,020,568 | —- | M] () – C:\Documents and Settings\Maaike\My Documents\Stores Statistical Report 21JUN2010.xls
[2010/06/18 13:27:14 | 000,022,483 | —- | M] () – C:\Documents and Settings\Maaike\My Documents\Store Statistical Report 18Jun10.pdf
[2010/06/16 15:33:05 | 000,148,992 | —- | M] () – C:\Documents and Settings\Maaike\My Documents\Visa breakdown for Steven.xls
[2010/06/16 15:27:22 | 000,002,481 | —- | M] () – C:\Documents and Settings\Maaike\Desktop\Microsoft Excel.lnk
[2010/06/16 09:04:25 | 000,332,280 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2010/06/09 17:32:22 | 000,049,664 | —- | M] () – C:\Documents and Settings\Maaike\My Documents\Potential Tenants.doc
[2010/06/09 17:31:38 | 000,016,896 | —- | M] () – C:\Documents and Settings\Maaike\My Documents\Dakis calculation.xls
[2010/06/09 17:18:22 | 000,011,171 | —- | M] () – C:\Documents and Settings\Maaike\My Documents\PhotoCentric Invoice.pdf
[2010/06/09 15:07:06 | 000,019,968 | —- | M] () – C:\Documents and Settings\Maaike\My Documents\With Compliments Slip.doc
[2010/06/08 16:44:23 | 000,451,584 | —- | M] () – C:\Documents and Settings\Maaike\My Documents\BPro email addresses 08June10.xls
[2010/06/07 12:23:07 | 000,034,304 | —- | M] () – C:\Documents and Settings\Maaike\My Documents\Roster adjusted.doc
[2010/06/03 09:05:55 | 000,242,896 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\drivers\avgtdix.sys
[2010/06/03 09:05:54 | 000,029,584 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\drivers\avgmfx86.sys
[2010/06/01 17:30:30 | 000,010,978 | —- | M] () – C:\Documents and Settings\Maaike\My Documents\PhotoCentric Invoice2.pdf
[2010/06/01 17:30:11 | 000,010,961 | —- | M] () – C:\Documents and Settings\Maaike\My Documents\PhotoCentric Invoice1.pdf
[2010/06/01 17:26:08 | 000,010,864 | —- | M] () – C:\Documents and Settings\Maaike\My Documents\PhotoCentric Statement.pdf
[2010/06/01 16:53:28 | 000,138,752 | —- | M] () – C:\Documents and Settings\Maaike\My Documents\Electronic Statements.doc
[2010/06/01 11:31:42 | 000,150,016 | —- | M] () – C:\Documents and Settings\Maaike\My Documents\Letterhead PhotoCentric.doc
[2010/05/27 13:33:45 | 004,674,696 | —- | M] () – C:\Documents and Settings\Maaike\My Documents\Entry Condition report unit 2 20BBR.PDF
[2010/05/25 15:52:34 | 000,148,992 | —- | M] () – C:\Documents and Settings\Maaike\My Documents\Amex breakdown for Steven.xls
[8 C:\Documents and Settings\Maaike\My Documents\*.tmp files -> C:\Documents and Settings\Maaike\My Documents\*.tmp -> ]
[5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/06/24 11:01:00 | 000,024,064 | —- | C] () – C:\Documents and Settings\Maaike\Desktop\log url.doc
[2010/06/24 10:59:10 | 000,000,000 | —- | C] () – C:\Documents and Settings\Maaike\defogger_reenable
[2010/06/24 10:57:12 | 000,050,477 | —- | C] () – C:\Documents and Settings\Maaike\Desktop\Defogger.exe
[2010/06/21 11:05:03 | 000,020,568 | —- | C] () – C:\Documents and Settings\Maaike\My Documents\Stores Statistical Report 21JUN2010.xls
[2010/06/18 13:27:13 | 000,022,483 | —- | C] () – C:\Documents and Settings\Maaike\My Documents\Store Statistical Report 18Jun10.pdf
[2010/06/09 17:31:38 | 000,016,896 | —- | C] () – C:\Documents and Settings\Maaike\My Documents\Dakis calculation.xls
[2010/06/09 16:05:15 | 000,049,664 | —- | C] () – C:\Documents and Settings\Maaike\My Documents\Potential Tenants.doc
[2010/06/08 15:49:22 | 000,451,584 | —- | C] () – C:\Documents and Settings\Maaike\My Documents\BPro email addresses 08June10.xls
[2010/05/27 13:38:48 | 004,674,696 | —- | C] () – C:\Documents and Settings\Maaike\My Documents\Entry Condition report unit 2 20BBR.PDF
[2010/02/24 16:37:15 | 000,000,502 | —- | C] () – C:\WINDOWS\System32\CNCMFP34.INI
[2009/01/06 13:14:12 | 000,000,002 | —- | C] () – C:\WINDOWS\msoffice.ini
[2007/06/29 11:18:21 | 000,000,251 | —- | C] () – C:\WINDOWS\pmontage.ini
[2007/01/04 09:02:20 | 000,087,800 | —- | C] () – C:\WINDOWS\System32\cpwmon2k.dll
[2006/09/16 08:59:55 | 000,000,197 | —- | C] () – C:\WINDOWS\WinHelp.ini
[2006/03/03 16:26:39 | 000,000,383 | —- | C] () – C:\WINDOWS\System32\haspdos.sys
[2005/12/01 10:02:43 | 000,618,496 | —- | C] () – C:\WINDOWS\System32\stlpmt45.dll
[2005/10/07 10:09:03 | 000,000,000 | —- | C] () – C:\WINDOWS\P2kRotate.ini
[2005/03/01 14:30:20 | 000,000,453 | —- | C] () – C:\WINDOWS\bdoscandellang.ini
[2004/10/08 14:21:21 | 000,363,520 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2004/04/20 04:57:03 | 000,000,526 | —- | C] () – C:\WINDOWS\picturific.ini
[2004/03/18 08:34:34 | 000,221,184 | —- | C] () – C:\WINDOWS\System32\lame_enc.dll
[2004/03/17 09:21:01 | 000,000,141 | —- | C] () – C:\WINDOWS\smr.INI
[2004/03/01 16:31:24 | 000,000,291 | —- | C] () – C:\WINDOWS\msfsetup.ini
[2004/01/27 17:35:54 | 000,000,063 | —- | C] () – C:\WINDOWS\mdm.ini
[2003/10/06 13:16:00 | 000,027,136 | —- | C] () – C:\WINDOWS\System32\nvcod.dll
[2003/08/11 14:17:31 | 000,007,551 | —- | C] () – C:\WINDOWS\System32\drivers\U3sHlpDr.sys
[2003/06/16 17:20:32 | 000,002,471 | —- | C] () – C:\WINDOWS\RBuilder.ini
[2003/06/16 17:02:41 | 000,045,056 | —- | C] () – C:\WINDOWS\System32\SenorDrawer.dll
[2003/06/02 14:37:28 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2003/06/02 14:32:12 | 000,000,784 | —- | C] () – C:\WINDOWS\lrun32.ini
[2003/06/02 14:31:00 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2003/06/02 14:27:20 | 000,000,791 | —- | C] () – C:\WINDOWS\orun32.ini
[2003/06/02 14:07:12 | 000,000,547 | —- | C] () – C:\WINDOWS\System32\OEMINFO.INI
[1980/01/01 02:00:00 | 000,012,288 | —- | C] () – C:\WINDOWS\System32\e100bmsg.dll

========== LOP Check ==========

[2009/09/23 12:30:29 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Avery
[2010/02/05 09:35:19 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\avg9
[2008/08/02 12:05:45 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\BVRP Software
[2007/11/30 14:02:23 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\ClickPhoto Print Wizard
[2006/07/11 17:05:17 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Downloaded Installations
[2008/04/12 12:52:54 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Installations
[2008/07/14 09:03:47 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\LogMeIn
[2008/11/28 10:35:22 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\NCH Swift Sound
[2007/09/25 12:28:23 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Nokia
[2006/01/27 16:37:29 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\OD2
[2006/11/30 11:32:58 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\OLYMPUS
[2007/07/26 09:39:20 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PC Suite
[2004/03/03 20:03:57 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PopCap
[2004/03/18 09:08:58 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Viewpoint
[2009/03/18 13:56:33 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
[2010/03/31 13:06:45 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2009/09/16 13:59:49 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2009/04/08 14:24:30 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2004/06/17 14:51:28 | 000,000,000 | —D | M] – C:\Documents and Settings\Maaike\Application Data\ACD Systems
[2004/04/20 04:57:10 | 000,000,000 | —D | M] – C:\Documents and Settings\Maaike\Application Data\Adorama Viewer
[2010/03/04 09:05:31 | 000,000,000 | —D | M] – C:\Documents and Settings\Maaike\Application Data\calibre
[2010/02/25 10:04:51 | 000,000,000 | —D | M] – C:\Documents and Settings\Maaike\Application Data\Canon
[2010/05/26 17:29:18 | 000,000,000 | —D | M] – C:\Documents and Settings\Maaike\Application Data\ClickPhoto Print Wizard
[2010/03/26 13:59:54 | 000,000,000 | —D | M] – C:\Documents and Settings\Maaike\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2006/07/18 14:28:17 | 000,000,000 | —D | M] – C:\Documents and Settings\Maaike\Application Data\DataLayer
[2004/03/01 16:43:05 | 000,000,000 | —D | M] – C:\Documents and Settings\Maaike\Application Data\FUJIFILM
[2004/09/09 18:28:15 | 000,000,000 | —D | M] – C:\Documents and Settings\Maaike\Application Data\Leadertech
[2008/11/28 10:34:15 | 000,000,000 | —D | M] – C:\Documents and Settings\Maaike\Application Data\NCH Swift Sound
[2007/07/26 09:39:49 | 000,000,000 | —D | M] – C:\Documents and Settings\Maaike\Application Data\Nokia
[2005/05/05 19:19:44 | 000,000,000 | —D | M] – C:\Documents and Settings\Maaike\Application Data\OD2
[2007/07/26 10:16:02 | 000,000,000 | —D | M] – C:\Documents and Settings\Maaike\Application Data\PC Suite
[2008/08/02 11:59:48 | 000,000,000 | —D | M] – C:\Documents and Settings\Maaike\Application Data\Teleca

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >

< c:\windows\system32\drivers\*.sys /90 >
[2010/06/03 09:05:54 | 000,029,584 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\SYSTEM32\DRIVERS\avgmfx86.sys
[2010/06/03 09:05:55 | 000,242,896 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\SYSTEM32\DRIVERS\avgtdix.sys

< MD5 for: AGP440.SYS >
[2003/06/19 13:05:04 | 006,553,075 | —- | M] () .cab file – C:\Documents and Settings\Maaike\Desktop\Unused Desktop Shortcuts\BPro V7\Windows 2k sp4\i386\new\sp4.cab:AGP440.sys
[2005/03/11 09:41:19 | 022,245,337 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\I386\sp2.cab:AGP440.sys
[2008/09/23 11:00:53 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\I386\sp3.cab:AGP440.sys
[2005/03/11 09:41:19 | 022,245,337 | —- | M] () .cab file – C:\WINDOWS\ServicePackFiles\i386\sp2.cab:AGP440.sys
[2008/09/23 11:00:53 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
[2008/04/14 04:36:38 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 – C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008/04/14 04:36:38 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 – C:\WINDOWS\SYSTEM32\DRIVERS\agp440.sys
[2004/08/04 16:07:41 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB – C:\WINDOWS\$NtServicePackUninstall$\agp440.sys
[2001/08/17 15:58:00 | 000,025,472 | —- | M] (Microsoft Corporation) MD5=65880045C51AA36184841CEE915A61DF – C:\I386\AGP440.SYS

< MD5 for: ATAPI.SYS >
[2003/06/19 13:05:04 | 006,553,075 | —- | M] () .cab file – C:\Documents and Settings\Maaike\Desktop\Unused Desktop Shortcuts\BPro V7\Windows 2k sp4\i386\new\sp4.cab:atapi.sys
[2002/08/29 07:00:00 | 010,158,890 | —- | M] () .cab file – C:\I386\sp1.cab:atapi.sys
[2002/08/29 07:00:00 | 010,158,890 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\I386\sp1.cab:atapi.sys
[2005/03/11 09:41:19 | 022,245,337 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\I386\sp2.cab:atapi.sys
[2008/09/23 11:00:53 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\I386\sp3.cab:atapi.sys
[2005/03/11 09:41:19 | 022,245,337 | —- | M] () .cab file – C:\WINDOWS\ServicePackFiles\i386\sp2.cab:atapi.sys
[2008/09/23 11:00:53 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2003/01/31 17:43:30 | 000,087,040 | —- | M] (Microsoft Corporation) MD5=3C33F5479520844A186C2D43ECFFD477 – C:\I386\atapi.sys
[2002/08/29 03:27:50 | 000,086,912 | —- | M] (Microsoft Corporation) MD5=95B858761A00E1D4F81F79A0DA019ACA – C:\WINDOWS\SYSTEM32\ReinstallBackups\0003\DriverFiles\i386\atapi.sys
[2002/08/29 03:27:50 | 000,086,912 | —- | M] (Microsoft Corporation) MD5=95B858761A00E1D4F81F79A0DA019ACA – C:\WINDOWS\SYSTEM32\ReinstallBackups\0007\DriverFiles\i386\atapi.sys
[2008/04/14 04:40:30 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008/04/14 04:40:30 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\SYSTEM32\DRIVERS\atapi.sys
[2004/08/04 15:59:42 | 000,095,360 | —- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 – C:\WINDOWS\$NtServicePackUninstall$\atapi.sys

< MD5 for: EVENTLOG.DLL >
[2008/04/14 10:11:53 | 000,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008/04/14 10:11:53 | 000,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\SYSTEM32\eventlog.dll
[2004/08/04 17:56:42 | 000,055,808 | —- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 – C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll
[2002/08/29 07:00:00 | 000,049,152 | —- | M] (Microsoft Corporation) MD5=BF3C8CF53C77B48206B39910B6D6CBCC – C:\I386\EVENTLOG.DLL

< MD5 for: NETLOGON.DLL >
[2008/04/14 10:12:01 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008/04/14 10:12:01 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\SYSTEM32\netlogon.dll
[2002/08/29 07:00:00 | 000,399,360 | —- | M] (Microsoft Corporation) MD5=3ADD563ED7A1C66E6F5E0F7A661AA96D – C:\I386\NETLOGON.DLL
[2004/08/04 17:56:44 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A – C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll

< MD5 for: SCECLI.DLL >
[2004/08/04 17:56:44 | 000,180,224 | —- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A – C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
[2002/08/29 07:00:00 | 000,174,592 | —- | M] (Microsoft Corporation) MD5=97418A5C642A5C748A28BD7CF6860B57 – C:\I386\SCECLI.DLL
[2008/04/14 10:12:05 | 000,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008/04/14 10:12:05 | 000,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\SYSTEM32\scecli.dll

========== Alternate Data Streams ==========

@Alternate Data Stream - 76267 bytes -> C:\Documents and Settings\Maaike\My Documents\topomap.tif:AFP_Resource
@Alternate Data Stream - 60 bytes -> C:\Documents and Settings\Maaike\My Documents\topomap.tif:AFP_AfpInfo
< End of report >

OTL Extras:

OTL Extras logfile created on: 24/06/2010 11:13:36 - Run 1
OTL by OldTimer - Version 3.2.7.0 Folder = C:\Documents and Settings\Maaike\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000C09 | Country: Australia | Language: ENU | Date Format: d/MM/yyyy

1.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 62.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 80.00% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.47 Gb Total Space | 27.73 Gb Free Space | 37.24% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: POSSERVER
Current User Name: Maaike
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
htmlfile – "C:\Program Files\Microsoft Office\Office10\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] – "C:\Program Files\Microsoft Office\Office10\msohtmed.exe" /p %1 (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
"56338:UDP" = 56338:UDP:*:Enabled:Color Network ScanGear

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"56338:UDP" = 56338:UDP:*:Enabled:Color Network ScanGear

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\MSN Messenger\msnmsgr.exe" = C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:MSN Messenger 7.0 – File not found
"C:\Program Files\Canon\Color Network ScanGear\SgTool.exe" = C:\Program Files\Canon\Color Network ScanGear\SgTool.exe:*:Enabled:Color Network ScanGear Tool – (CANON INC.)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\WINDOWS\SYSTEM32\mmc.exe" = C:\WINDOWS\SYSTEM32\mmc.exe:*:Enabled:Microsoft Management Console – (Microsoft Corporation)
"C:\Program Files\MSN Messenger\msnmsgr.exe" = C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:MSN Messenger 7.0 – File not found
"C:\Program Files\Grisoft\AVG Free\avginet.exe" = C:\Program Files\Grisoft\AVG Free\avginet.exe:*:Enabled:avginet.exe – File not found
"C:\Program Files\Grisoft\AVG Free\avgamsvr.exe" = C:\Program Files\Grisoft\AVG Free\avgamsvr.exe:*:Enabled:avgamsvr.exe – File not found
"C:\Program Files\Grisoft\AVG Free\avgcc.exe" = C:\Program Files\Grisoft\AVG Free\avgcc.exe:*:Enabled:avgcc.exe – File not found
"C:\Program Files\Nokia\Nokia Software Updater\nsu_ui_client.exe" = C:\Program Files\Nokia\Nokia Software Updater\nsu_ui_client.exe:*:Enabled:Nokia Software Updater – File not found
"C:\Program Files\Common Files\Nokia\Service Layer\A\nsl_host_process.exe" = C:\Program Files\Common Files\Nokia\Service Layer\A\nsl_host_process.exe:*:Enabled:Nokia Service Layer Host Process – File not found
"C:\Program Files\AVG\AVG8\avgupd.exe" = C:\Program Files\AVG\AVG8\avgupd.exe:*:Enabled:avgupd.exe – File not found
"C:\Program Files\Sony Ericsson\Update Service\Update Service.exe" = C:\Program Files\Sony Ericsson\Update Service\Update Service.exe:*:Enabled:Update Service – ()
"C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\SAGENT4.EXE" = C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\SAGENT4.EXE:*:Enabled:SAgent4 – (SEIKO EPSON CORPORATION)
"C:\Program Files\AVG\AVG9\avgupd.exe" = C:\Program Files\AVG\AVG9\avgupd.exe:*:Enabled:avgupd.exe – (AVG Technologies CZ, s.r.o.)
"C:\Program Files\AVG\AVG9\avgnsx.exe" = C:\Program Files\AVG\AVG9\avgnsx.exe:*:Enabled:avgnsx.exe – (AVG Technologies CZ, s.r.o.)
"C:\Program Files\Canon\Color Network ScanGear\SgTool.exe" = C:\Program Files\Canon\Color Network ScanGear\SgTool.exe:*:Enabled:Color Network ScanGear Tool – (CANON INC.)
"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes – (Apple Inc.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00010409-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 Professional
"{00040409-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 Disc 2
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{066D65EA-ED53-44E4-A96A-F81B6E409D2E}" = PC Connectivity Solution
"{06E73C0B-7DE7-4F41-860B-587033B75BD9}" = iPod Updater 2004-11-15
"{0CB9668D-F979-4F31-B8B8-67FE90F929F8}" = Bonjour
"{0D499481-22C6-4B25-8AC2-6D3F6C885FB9}" = OpenOffice.org Installer 1.0
"{11F1920A-56A2-4642-B6E0-3B31A12C9288}" = Dell Solution Center
"{146E206D-7D2C-493A-B431-1F1D16E822AF}" = MobileMe Control Panel
"{2070F79D-46BC-4EEA-8F02-9B4DCABAE7CB}" = iPod for Windows 2006-03-23
"{26A24AE4-039D-4CA4-87B4-2F83216012FF}" = Java™ 6 Update 20
"{287ECFA4-719A-2143-A09B-D6A12DE54E40}" = Acrobat.com
"{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}" = QuickTime
"{2CC982C0-7EAE-11D4-ACC3-0050568AD318}" = Avery DesignPro
"{2F8C106A-7DFC-45DE-8006-F9145AADF1D8}" = iPod Updater 2004-08-06
"{2FFE93F0-BB72-4E52-8761-354D1AAA9387}" = Sony Ericsson PC Suite 4.010.00
"{3248F0A8-6813-11D6-A77B-00B0D0150020}" = J2SE Runtime Environment 5.0 Update 2
"{3248F0A8-6813-11D6-A77B-00B0D0150040}" = J2SE Runtime Environment 5.0 Update 4
"{3248F0A8-6813-11D6-A77B-00B0D0150060}" = J2SE Runtime Environment 5.0 Update 6
"{3248F0A8-6813-11D6-A77B-00B0D0150080}" = J2SE Runtime Environment 5.0 Update 8
"{3248F0A8-6813-11D6-A77B-00B0D0150090}" = J2SE Runtime Environment 5.0 Update 9
"{3248F0A8-6813-11D6-A77B-00B0D0150100}" = J2SE Runtime Environment 5.0 Update 10
"{3248F0A8-6813-11D6-A77B-00B0D0150110}" = J2SE Runtime Environment 5.0 Update 11
"{3248F0A8-6813-11D6-A77B-00B0D0160010}" = Java™ SE Runtime Environment 6 Update 1
"{3248F0A8-6813-11D6-A77B-00B0D0160020}" = Java™ 6 Update 2
"{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java™ 6 Update 3
"{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java™ 6 Update 5
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java™ 6 Update 7
"{33C999A7-C882-48D5-86AD-0D7D5A48C64F}" = calibre
"{34F93E31-E1A0-421C-8E86-BCF7C4193A91}" = LogMeIn
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3A1EB7CF-1C31-4789-82FA-258E323FA805}" = DesignPro 5
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{5490882C-6961-11D5-BAE5-00E0188E010B}" = FUJIFILM USB Driver
"{5AFA4872-16B2-419E-ADCA-8E96E739115D}" = Music Manager
"{5E3CFCA6-C95A-47CB-A822-7FA80D423AF2}" = MapSource
"{609F7AC8-C510-11D4-A788-009027ABA5D0}" = Easy CD Creator 5 Basic
"{6767DFEE-8909-453A-B553-C7693912B2EB}" = Canon MF Toolbox 4.9.1.1.mf09
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{7148F0A8-6813-11D6-A77B-00B0D0142030}" = Java 2 Runtime Environment, SE v1.4.2_03
"{7148F0A8-6813-11D6-A77B-00B0D0142050}" = Java 2 Runtime Environment, SE v1.4.2_05
"{76E41F43-59D2-4F30-BA42-9A762EE1E8DE}" = Avanquest update
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{791CAF6C-90A3-11D4-8306-00D0B72E1DB9}" = Sentinel System Driver
"{7AB3A249-FB81-416B-917A-A2A10E74C503}" = iTunes
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{85991ED2-010C-4930-96FA-52F43C2CE98A}" = Apple Mobile Device Support
"{89B043E5-6E52-46CC-87D6-BE3CE79B21C0}" = Business Professional for SQL Server
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90300409-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Media Content
"{90D55A3F-1D99-4C94-A77E-46DC14F0BF08}" = Help and Support Customization
"{91130409-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Small Business
"{99A5569D-9F86-4f32-A227-1538B731DA42}" = Canon MF4320-4350
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A0F584A7-B0C2-4D90-9580-15456B9CF63C}" = MapSource - Trip & Waypoint Manager v2
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A654A805-41D9-40C7-AA46-4AF04F044D61}" = Adobe® Photoshop® Album Starter Edition 3.2
"{A790BEB1-BCCF-4EC6-807B-5708B36E8A79}" = Intel® PROSet
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1033-7B44-A93000000001}" = Adobe Reader 9.3.2
"{B2D328BE-45AD-4D92-96F9-2151490A203E}" = Apple Application Support
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B722A02C-4D53-4778-B3BB-7CAAC56838DA}" = ClickPhoto Print Wizard
"{C01408FC-117C-44B7-8B0C-17794E526A01}" = Disc2Phone
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C4168477-5416-4224-8BE9-E4349642595B}" = QuickBooks EasyStart: First Business 2006/07
"{C63E7C60-25EB-11D3-8EDA-00A0C911E8E5}" = Microsoft Outlook Personal Folders Backup
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D4936AAF-FFD0-44A1-A7EA-A2DB41CEB5BC}" = iPod for Windows 2005-09-23
"{D680C913-5955-469D-9D88-C1940F7506D6}" = RAW FILE CONVERTER LE
"{E5D52570-5EF1-4576-A434-6CCD92268F0F}" = Google SketchUp 7
"{F1658760-1173-4D65-B709-A0591C104AE1}" = Color Network ScanGear Ver.2.61
"{F7B0939E-58DF-11DF-B3A6-005056806466}" = Google Earth
"{FB26A501-6BA6-459B-89AA-9736730752FB}" = VoiceOver Kit
"0C5EDC3653FED5B121F464339EAC12534D253B25" = Windows Driver Package - Nokia Modem (02/15/2007 3.1)
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Photoshop Elements 2.0" = Adobe Photoshop Elements 2.0
"Adobe Shockwave Player" = Adobe Shockwave Player
"Adobe® Photoshop® Album Starter Edition 3.2" = Adobe® Photoshop® Album Starter Edition 3.2
"AVG9Uninstall" = AVG Free 9.0
"CCleaner" = CCleaner
"CutePDF Writer Installation" = CutePDF Writer 2.7
"Digital Editions" = Adobe Digital Editions
"EPSON Printer and Utilities" = EPSON Printer Software
"F064B256B4A20996EA9E333B5E0F14B61AB3333D" = Windows Driver Package - Nokia (WUDFRd) WPD (03/19/2007 6.83.31.1)
"HijackThis" = HijackThis 2.0.2
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"InstallShield_{06E73C0B-7DE7-4F41-860B-587033B75BD9}" = iPod Updater 2004-11-15
"InstallShield_{2070F79D-46BC-4EEA-8F02-9B4DCABAE7CB}" = iPod for Windows 2006-03-23
"InstallShield_{2F8C106A-7DFC-45DE-8006-F9145AADF1D8}" = iPod Updater 2004-08-06
"InstallShield_{3A1EB7CF-1C31-4789-82FA-258E323FA805}" = DesignPro 5
"InstallShield_{A0F584A7-B0C2-4D90-9580-15456B9CF63C}" = MapSource - Trip & Waypoint Manager v2
"InstallShield_{D4936AAF-FFD0-44A1-A7EA-A2DB41CEB5BC}" = iPod for Windows 2005-09-23
"Learn ReportBuilder" = Learn ReportBuilder
"LiveReg" = LiveReg (Symantec Corporation)
"LiveUpdate" = LiveUpdate 2.0 (Symantec Corporation)
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft Press Interactive Training" = Microsoft Interactive Training
"Momento" = Momento 5.2.2
"Mozilla Firefox (3.6.4)" = Mozilla Firefox (3.6.4)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"MWASPI" = MicroStaff WINASPI
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"NVIDIA" = NVIDIA Windows 2000/XP Display Drivers
"NVIDIA Display Driver" = NVIDIA Display Driver
"Power WMA Recorder_is1" = Power WMA Recorder 1.41
"PROSet" = Intel® PRO Network Adapters and Drivers
"RealPix" = RealPix
"Shockwave" = Shockwave
"Spy Cleaner 7.0 Full Version" = Spy Cleaner 7.0 Full Version
"Spybot - Search & Destroy_is1" = Spybot - Search & Destroy 1.4
"Switch" = Switch Sound File Converter
"Update Service" = Update Service
"WagezWindow" = WagezWindow
"WagezWindow TMS" = WagezWindow TMS
"WagezWindow_is1" = WagezWindow [removed]
"Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"11cff10e06d5938f" = Radlink Lite Launcher
"31f6dc6a6bad361b" = TakeFlite Ops Manager 4

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 20/06/2010 20:15:54 | Computer Name = POSSERVER | Source = Google Update | ID = 20
Description =

Error - 20/06/2010 21:15:47 | Computer Name = POSSERVER | Source = Google Update | ID = 20
Description =

Error - 21/06/2010 02:53:22 | Computer Name = POSSERVER | Source = HotFixInstaller | ID = 5000
Description = EventType visualstudio8setup, P1 microsoft .net framework 2.0-kb979909,
P2 1033, P3 1605, P4 msi, P5 f, P6 9.0.40302.0, P7 install, P8 x86, P9 xp, P10
0.

Error - 23/06/2010 00:49:32 | Computer Name = POSSERVER | Source = Application Hang | ID = 1002
Description = Hanging application MFTBOX.exe, version 1.0.8.0, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 23/06/2010 00:49:45 | Computer Name = POSSERVER | Source = Application Hang | ID = 1001
Description = Fault bucket 1281727968.

Error - 23/06/2010 19:35:05 | Computer Name = POSSERVER | Source = HotFixInstaller | ID = 5000
Description = EventType visualstudio8setup, P1 microsoft .net framework 2.0-kb979909,
P2 1033, P3 1605, P4 msi, P5 f, P6 9.0.40302.0, P7 install, P8 x86, P9 xp, P10
0.

Error - 23/06/2010 19:57:13 | Computer Name = POSSERVER | Source = HotFixInstaller | ID = 5000
Description = EventType visualstudio8setup, P1 microsoft .net framework 2.0-kb976576,
P2 1033, P3 1605, P4 msi, P5 f, P6 9.0.40302.0, P7 install, P8 x86, P9 xp, P10
0.

Error - 23/06/2010 20:14:08 | Computer Name = POSSERVER | Source = Application Hang | ID = 1002
Description = Hanging application MFTBOX.exe, version 1.0.8.0, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 23/06/2010 20:14:14 | Computer Name = POSSERVER | Source = Application Hang | ID = 1001
Description = Fault bucket 1281727968.

Error - 23/06/2010 21:02:34 | Computer Name = POSSERVER | Source = HotFixInstaller | ID = 5000
Description = EventType visualstudio8setup, P1 microsoft .net framework 2.0-kb979909,
P2 1033, P3 1605, P4 msi, P5 f, P6 9.0.40302.0, P7 install, P8 x86, P9 xp, P10
0.

[ System Events ]
Error - 22/06/2010 21:54:23 | Computer Name = POSSERVER | Source = Service Control Manager | ID = 7011
Description = Timeout (30000 milliseconds) waiting for a transaction response from
the stisvc service.

Error - 23/06/2010 00:45:37 | Computer Name = POSSERVER | Source = Service Control Manager | ID = 7011
Description = Timeout (30000 milliseconds) waiting for a transaction response from
the stisvc service.

Error - 23/06/2010 19:05:35 | Computer Name = POSSERVER | Source = atapi | ID = 262153
Description = The device, \Device\Ide\IdePort0, did not respond within the timeout
period.

Error - 23/06/2010 19:07:27 | Computer Name = POSSERVER | Source = Print | ID = 23
Description = Printer Canon LBP3200,0 failed to initialize because a suitable Canon
LBP3200 driver could not be found.

Error - 23/06/2010 19:13:22 | Computer Name = POSSERVER | Source = Service Control Manager | ID = 7011
Description = Timeout (30000 milliseconds) waiting for a transaction response from
the stisvc service.

Error - 23/06/2010 19:35:11 | Computer Name = POSSERVER | Source = Windows Update Agent | ID = 20
Description = Installation Failure: Windows failed to install the following update
with error 0x80070643: Microsoft .NET Framework 3.5 SP1 and .NET Framework 2.0
SP2 Security Update for Windows 2000, Windows Server 2003, and Windows XP x86 (KB979909).

Error - 23/06/2010 19:57:19 | Computer Name = POSSERVER | Source = Windows Update Agent | ID = 20
Description = Installation Failure: Windows failed to install the following update
with error 0x80070643: Microsoft .NET Framework 3.5 SP1 and .NET Framework 2.0
SP2 Update for Windows Server 2003 and Windows XP x86 (KB982524).

Error - 23/06/2010 20:32:34 | Computer Name = POSSERVER | Source = Service Control Manager | ID = 7011
Description = Timeout (30000 milliseconds) waiting for a transaction response from
the stisvc service.

Error - 23/06/2010 21:02:35 | Computer Name = POSSERVER | Source = Windows Update Agent | ID = 20
Description = Installation Failure: Windows failed to install the following update
with error 0x80070643: Microsoft .NET Framework 3.5 SP1 and .NET Framework 2.0
SP2 Security Update for Windows 2000, Windows Server 2003, and Windows XP x86 (KB979909).

Error - 23/06/2010 21:06:13 | Computer Name = POSSERVER | Source = Print | ID = 23
Description = Printer Canon LBP3200,0 failed to initialize because a suitable Canon
LBP3200 driver could not be found.

< End of report >

GMER log:

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-06-24 16:47:12
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:\DOCUME~1\Maaike\LOCALS~1\Temp\uflyipoc.sys

—- System - GMER 1.0.15 —-

INT 0x06 \??\C:\WINDOWS\system32\drivers\Haspnt.sys (HASP Kernel Device Driver for Windows NT/Aladdin Knowledge Systems) B685116D
INT 0x0E \??\C:\WINDOWS\system32\drivers\Haspnt.sys (HASP Kernel Device Driver for Windows NT/Aladdin Knowledge Systems) B6850FC2

—- Kernel code sections - GMER 1.0.15 —-

.text C:\WINDOWS\System32\DRIVERS\nv4_mini.sys section is writeable [0xB9EE0340, 0x121A5F, 0xF8000020]
.text C:\WINDOWS\System32\nv4_disp.dll section is writeable [0xBF012380, 0x25BA81, 0xF8000020]
.text C:\WINDOWS\system32\drivers\hardlock.sys section is writeable [0xB65F9400, 0x7EE2E, 0xE0000020]
.protectÿÿÿÿhardlockentry point in ".protectÿÿÿÿhardlockentry point in ".protectÿÿÿÿhardlockentry point in ".p" section [0xB6696A20] C:\WINDOWS\system32\drivers\hardlock.sys entry point in ".protectÿÿÿÿhardlockentry point in ".protectÿÿÿÿhardlockentry point in ".p" section [0xB6696A20]
.protectÿÿÿÿhardlockunknown last code section [0xB6696800, 0x4E48, 0xE0000020] C:\WINDOWS\system32\drivers\hardlock.sys unknown last code section [0xB6696800, 0x4E48, 0xE0000020]

—- Devices - GMER 1.0.15 —-

AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

—- EOF - GMER 1.0.15 —-

inzanity

Post #4June 24, 2010, 9:18 AM UTC

Hi,

Sorry about that. GMER is finicky at times.

Can you tell me about this file?

C:\ceon\PhotoLabLauncher.exe

Please go to VirSCAN

Click on Browse.
On the File Upload window, copy/paste the text below into the File name box:
C:\ceon\PhotoLabLauncher.exe
Click Upload. Allow the file to be scanned. If it says already scanned – click Reanalyze Now

Repeat the procedure with the following file:
C:\WINDOWS\System32\SenorDrawer.dll

Please post the results in your next reply.

inzanity

Post #5June 27, 2010, 3:14 AM UTC

Hi, It's been several days. Do you still need help on this? This thread will be closed if you don't respond within 48 hours.

Maaike

Post #6June 28, 2010, 2:44 AM UTC

Hi,
I can't seem to paste the results from the clipboard, so here's a copy and paste, but a bit messy, sorry:
BTW, PhotoLabLauncher has something to do with the software that we use in running our business (we're a photo lab). Don't ask me exactly what it does, though, but I could find out for you if it's important.

File information
File Name : PhotoLabLauncher.exe
File Size : 407040 byte
File Type : PE32 executable for MS Windows (GUI) Intel 80386 32-bit
MD5 : bb1216be044af768c0c476fe941db0a3
SHA1 : a03998619841b70900363bf68e15e2ad66f35e2a
Scanner results
Scanner results : Scanners did not find malware!
Time : 2010/06/28 12:24:54 (EST)
Scanner ↓ Engine Ver Sig Ver Sig Date Scan result Time
a-squared 5.0.0.11 20100626080606 2010-06-26
-
13.395
AhnLab V3 2010.06.18.01 2010.06.18 2010-06-18
-
1.617
AntiVir 8.2.4.2 7.10.8.191 2010-06-27
-
1.423
Antiy 2.0.18 20100628.4796407 2010-06-28
-
0.059
Arcavir 2009 201006270216 2010-06-27
-
0.274
Authentium 5.1.1 201006271203 2010-06-27
-
3.850
AVAST! 4.7.4 100627-1 2010-06-27
-
0.045
AVG 8.5.793 271.1.1/2967 2010-06-28
-
0.521
BitDefender 7.90123.6328568 7.32451 2010-06-28
-
4.036
ClamAV 0.96.1 11265 2010-06-28
-
0.089
Comodo 3.13.579 5238 2010-06-27
-
1.516
CP Secure 1.3.0.5 2010.06.26 2010-06-26
-
0.002
Dr.Web 5.0.2.3300 2010.06.28 2010-06-28
-
9.464
F-Prot 4.4.4.56 20100627 2010-06-27
-
5.689
F-Secure 7.02.73807 2010.06.27.01 2010-06-27
-
0.315
Fortinet 4.1.133 12.89 2010-06-27
-
0.581
GData 21.422/21.155 20100628 2010-06-28
-
13.977
Ikarus T3.1.01.84 2010.06.28.76152 2010-06-28
-
7.409
JiangMin 13.0.900 2010.06.27 2010-06-27
-
2.982
Kaspersky 5.5.10 2010.06.27 2010-06-27
-
0.245
KingSoft 2009.2.5.15 2010.6.28.7 2010-06-28
-
4.834
McAfee 5400.1158 6026 2010-06-27
-
23.075
Microsoft 1.5902 2010.06.28 2010-06-28
-
9.040
Norman 6.05.10 6.05.00 2010-06-27
-
6.009
nProtect 20100627.02 8805752 2010-06-27
-
10.652
Panda 9.05.01 2010.06.27 2010-06-27
-
2.364
Quick Heal 10.00 2010.06.26 2010-06-26
-
1.735
Rising 20.0 22.53.04.05 2010-06-25
-
1.474
Sophos 3.07.1 4.54 2010-06-28
-
3.692
Sunbelt 3.9.2426.2 6508 2010-06-25
-
10.624
Symantec 1.3.0.24 20100615.005 2010-06-15
-
0.098
The Hacker 6.5.2.0 v00305 2010-06-27
-
0.630
Trend Micro 9.120-1004 7.270.06 2010-06-27
-
0.042
VBA32 [removed] 20100625.0804 2010-06-25
-
3.777
ViRobot 20100626 2010.06.26 2010-06-26
-
1.366
VirusBuster 4.5.11.10 10.126.105/2040577 2010-06-27
-
5.271
■Heuristic/Suspicious ■Exact
Note: This file has been scanned before. Therefore, this file's scan result will not be stored in the database. Scanner results

This is the result for the other file:
I don't know what this is or what it does, but the results seem to indicate it's clear.

File information
File Name : SenorDrawer.dll
File Size : 45056 byte
File Type : PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bi
MD5 : 7fe12fc2decfcf8108f8c5a01d47828f
SHA1 : 4bb841ece85d3fadaf7fb0ab7576562dd76b5907

Scanner results
Scanner results : Scanners did not find malware!
Time : 2010/06/28 12:38:43 (EST)
Scanner ↓ Engine Ver Sig Ver Sig Date Scan result Time
a-squared 5.0.0.11 20100626080606 2010-06-26
-
7.841
AhnLab V3 2010.06.18.01 2010.06.18 2010-06-18
-
1.535
AntiVir 8.2.4.2 7.10.8.191 2010-06-27
-
0.265
Antiy 2.0.18 20100628.4796407 2010-06-28
-
0.018
Arcavir 2009 201006270216 2010-06-27
-
0.041
Authentium 5.1.1 201006271203 2010-06-27
-
1.472
AVAST! 4.7.4 100627-1 2010-06-27
-
0.007
AVG 8.5.793 271.1.1/2967 2010-06-28
-
0.293
BitDefender 7.90123.6328568 7.32451 2010-06-28
-
4.018
ClamAV 0.96.1 11265 2010-06-28
-
0.020
Comodo 3.13.579 5238 2010-06-27
-
1.473
CP Secure 1.3.0.5 2010.06.26 2010-06-26
-
0.002
Dr.Web 5.0.2.3300 2010.06.28 2010-06-28
-
10.149
F-Prot 4.4.4.56 20100627 2010-06-27
-
1.430
F-Secure 7.02.73807 2010.06.27.01 2010-06-27
-
0.126
Fortinet 4.1.133 12.89 2010-06-27
-
0.229
GData 21.422/21.155 20100628 2010-06-28
-
11.551
Ikarus T3.1.01.84 2010.06.28.76152 2010-06-28
-
7.097
JiangMin 13.0.900 2010.06.27 2010-06-27
-
1.987
Kaspersky 5.5.10 2010.06.27 2010-06-27
-
0.085
KingSoft 2009.2.5.15 2010.6.28.7 2010-06-28
-
1.413
McAfee 5400.1158 6026 2010-06-27
-
17.623
Microsoft 1.5902 2010.06.28 2010-06-28
-
7.759
Norman 6.05.10 6.05.00 2010-06-27
-
6.009
nProtect 20100627.02 8805752 2010-06-27
-
7.811
Panda 9.05.01 2010.06.27 2010-06-27
-
2.055
Quick Heal 10.00 2010.06.26 2010-06-26
-
1.521
Rising 20.0 22.53.04.05 2010-06-25
-
1.211
Sophos 3.07.1 4.54 2010-06-28
-
3.569
Sunbelt 3.9.2426.2 6508 2010-06-25
-
8.088
Symantec 1.3.0.24 20100615.005 2010-06-15
-
0.065
The Hacker 6.5.2.0 v00305 2010-06-27
-
0.341
Trend Micro 9.120-1004 7.270.06 2010-06-27
-
0.031
VBA32 [removed] 20100625.0804 2010-06-25
-
2.742
ViRobot 20100626 2010.06.26 2010-06-26
-
1.163
VirusBuster 4.5.11.10 10.126.105/2040577 2010-06-27
-
2.508
■Heuristic/Suspicious ■Exact
Note: This file has been scanned before. Therefore, this file's scan result will not be stored in the database.

inzanity

Post #7June 28, 2010, 3:24 AM UTC

Hi,

Is this is a company computer? Do you have a tech department or personnel that can help you with this?

Here is a quote from our Terms of Use:

We offer free computer help and tech support for home and personal use. We are not here to support others that work for profit, or to support/replace your company's IT department.

Maaike

Post #8June 28, 2010, 4:11 AM UTC

We're only a very small retail business, we do not have a tech department. If anything goes wrong it's pretty much me who needs to sort it out.

inzanity

Post #9June 28, 2010, 4:23 AM UTC

Hi,

Ok then. Please do the following:

Download TFC to your desktop

Close any open windows.
Double click the TFC icon to run the program
TFC will close all open programs itself in order to run,
Click the Start button to begin the process.
Allow TFC to run uninterrupted.
The program should not take long to finish it's job
Once its finished it should automatically reboot your machine,
if it doesn't, manually reboot to ensure a complete clean

It's normal after running TFC cleaner that the PC will be slower to boot the first time.

–Next–

Please download Malwarebytes' Anti-Malware to your desktop.

Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform quick scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected.
When completed, a log will open in Notepad. Please save it to a convenient location and post back the log.

Extra Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer, please do so immediately.

To post in your next reply:
1. Malwarebytes' log.
2. How is your computer?

Maaike

Post #10June 28, 2010, 6:35 AM UTC

Hi Inzanity, I've ran all of that, and below is the MBAM log. The computer can still be slow to open a window, and is still slow on startup, but it is not quite as bad as it was. Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Database version: 4248 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 28/06/2010 16:17:44 mbam-log-2010-06-28 (16-17-44).txt Scan type: Quick scan Objects scanned: 134399 Time elapsed: 24 minute(s), 47 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 2 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CLASSES_ROOT\popcaploader.popcaploaderctrl2 (Adware.PopCap) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\popcaploader.popcaploaderctrl2.1 (Adware.PopCap) -> Quarantined and deleted successfully. Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)

inzanity

Post #11June 28, 2010, 6:44 AM UTC

Hi,

Click on Start then Control Panel
Open Add or Remove Programs then uninstall the following:

J2SE Runtime Environment 5.0 Update 2
J2SE Runtime Environment 5.0 Update 4
J2SE Runtime Environment 5.0 Update 6
J2SE Runtime Environment 5.0 Update 8
J2SE Runtime Environment 5.0 Update 9
J2SE Runtime Environment 5.0 Update 10
J2SE Runtime Environment 5.0 Update 11
Java™ SE Runtime Environment 6 Update 1
Java™ 6 Update 2
Java™ 6 Update 3
Java™ 6 Update 5
Java™ 6 Update 7
Java 2 Runtime Environment, SE v1.4.2_03
Java 2 Runtime Environment, SE v1.4.2_05

Close Control Panel.

Do not uninstall Java™ 6 Update 20.

–Next–

Now to Clean out the Java cache:

Go into the Control Panel and double-click the Java Icon.

Under Temporary Internet Files, click the Settings… button
click the Delete Files button.
There are two options in the window to clear the cache - Leave both Checked
Applications and Applets
Trace and Log Files
Click OK on Delete Temporary Files Window
Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
Click OK to leave the Temporary Files Settings
Click OK to leave the Java Control Panel.

–Next–

This scan can take a while to complete.

Run an on-line scan with Kaspersky

Using Internet Explorer or Firefox, visit Kaspersky On-line Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.
2. To optimize scanning time and produce a more sensible report for review:

Close any open programs
Turn off the real time scanner of any existing antivirus program while performing the online scan

3. Click Run at the Security prompt.
The program will then begin downloading and installing and will also update the database.
Please be patient as this can take several minutes.

Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
Click View scan report at the bottom.

[external image: Posted Image]
Click the Save as Text button to save the file to your desktop so that you may post it in your next reply

–Next–

Open OTL.exe.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Check the boxes beside LOP Check and Purity Check.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
There will only be a single log produced. OTL.Txt.
Note:This log can be located in the OTL. folder on you C:\ drive if it fails to open automatically.
Please copy (Edit->Select All, Edit->Copy) the contents of this file and post it with your next reply.

To post in your next reply:
1. Kaspersky log.
2. OTL log.

Maaike

Post #12July 1, 2010, 3:25 AM UTC

Hi Inzanity,
I finally got around to running those scans, phew, the Kaspersky scan took 24 hours…
Here are the logs:

BTW, I will be away for a week as of tomorrow, so if you don't hear from me, please don't close the thread, I will get back to it after the 10th!
Thanks heaps

Kaspersky:

——————————————————————————–
KASPERSKY ONLINE SCANNER 7.0: scan report
Thursday, July 1, 2010
Operating system: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Tuesday, June 29, 2010 00:30:19
Records in database: 4270347
——————————————————————————–

Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes

Scan area - My Computer:
A:\
C:\
D:\

Scan statistics:
Objects scanned: 118480
Threats found: 1
Infected objects found: 2
Suspicious objects found: 0
Scan duration: 24:37:03

File name / Threat / Threats count
C:\Backup\Outlook backup.pst Infected: Trojan-Spy.HTML.Bayfraud.hn 1
C:\Documents and Settings\Maaike\Local Settings\Application Data\Microsoft\Outlook\archive.pst Infected: Trojan-Spy.HTML.Bayfraud.hn 1

Selected area has been scanned.

OTL:

OTL logfile created on: 1/07/2010 13:08:47 - Run 2
OTL by OldTimer - Version 3.2.7.0 Folder = C:\Documents and Settings\Maaike\Desktop\Malware Spyware investigation
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000C09 | Country: Australia | Language: ENU | Date Format: d/MM/yyyy

1.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 62.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 79.00% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.47 Gb Total Space | 29.57 Gb Free Space | 39.70% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: POSSERVER
Current User Name: Maaike
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Maaike\Desktop\Malware Spyware investigation\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgnsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgrsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\LogMeIn\x86\LMIGuardian.exe (LogMeIn, Inc.)
PRC - C:\WINDOWS\SYSTEM32\ntvdm.exe (Microsoft Corporation)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\ceon\PhotoLabLauncher.exe ()
PRC - C:\Program Files\LogMeIn\x86\LogMeInSystray.exe (LogMeIn, Inc.)
PRC - C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe (Adobe Systems Incorporated)
PRC - C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\Directcd.exe (Roxio)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Maaike\Desktop\Malware Spyware investigation\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\SYSTEM32\msscript.ocx (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (Apple Mobile Device) – C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (avg9wd) – C:\Program Files\AVG\AVG9\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (LMIMaint) – C:\Program Files\LogMeIn\x86\RaMaint.exe (LogMeIn, Inc.)
SRV - (LogMeIn) – C:\Program Files\LogMeIn\x86\LogMeIn.exe (LogMeIn, Inc.)
SRV - (ServiceLayer) – C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (Nokia.)
SRV - (NetSvc) – C:\Program Files\Intel\NCS\Sync\NetSvc.exe (Intel® Corporation)

========== Driver Services (SafeList) ==========

DRV - (AvgTdiX) – C:\WINDOWS\System32\Drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (AvgMfx86) – C:\WINDOWS\System32\Drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AvgLdx86) – C:\WINDOWS\System32\Drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (LMIRfsClientNP) – C:\WINDOWS\SYSTEM32\LMIRfsClientNP.dll (LogMeIn, Inc.)
DRV - (LMIRfsDriver) – C:\WINDOWS\SYSTEM32\DRIVERS\LMIRfsDriver.sys (LogMeIn, Inc.)
DRV - (LMIInfo) – C:\Program Files\LogMeIn\x86\rainfo.sys (LogMeIn, Inc.)
DRV - (amdagp) – C:\WINDOWS\System32\DRIVERS\amdagp.sys (Advanced Micro Devices, Inc.)
DRV - (sisagp) – C:\WINDOWS\System32\DRIVERS\sisagp.sys (Silicon Integrated Systems Corporation)
DRV - (s3017unic) Sony Ericsson Device 3017 USB Ethernet Emulation SEMC3017 (WDM) – C:\WINDOWS\SYSTEM32\DRIVERS\s3017unic.sys (MCCI Corporation)
DRV - (s3017obex) – C:\WINDOWS\SYSTEM32\DRIVERS\s3017obex.sys (MCCI Corporation)
DRV - (s3017mgmt) Sony Ericsson Device 3017 USB WMC Device Management Drivers (WDM) – C:\WINDOWS\SYSTEM32\DRIVERS\s3017mgmt.sys (MCCI Corporation)
DRV - (s3017nd5) Sony Ericsson Device 3017 USB Ethernet Emulation SEMC3017 (NDIS) – C:\WINDOWS\SYSTEM32\DRIVERS\s3017nd5.sys (MCCI Corporation)
DRV - (s3017mdm) – C:\WINDOWS\SYSTEM32\DRIVERS\s3017mdm.sys (MCCI Corporation)
DRV - (s3017mdfl) – C:\WINDOWS\SYSTEM32\DRIVERS\s3017mdfl.sys (MCCI Corporation)
DRV - (s3017bus) Sony Ericsson Device 3017 driver (WDM) – C:\WINDOWS\SYSTEM32\DRIVERS\s3017bus.sys (MCCI Corporation)
DRV - (s716unic) Sony Ericsson Device 716 USB Ethernet Emulation SEMC716 (WDM) – C:\WINDOWS\SYSTEM32\DRIVERS\s716unic.sys (MCCI Corporation)
DRV - (s716obex) – C:\WINDOWS\SYSTEM32\DRIVERS\s716obex.sys (MCCI Corporation)
DRV - (s716nd5) Sony Ericsson Device 716 USB Ethernet Emulation SEMC716 (NDIS) – C:\WINDOWS\SYSTEM32\DRIVERS\s716nd5.sys (MCCI Corporation)
DRV - (s716mdm) – C:\WINDOWS\SYSTEM32\DRIVERS\s716mdm.sys (MCCI Corporation)
DRV - (s716mgmt) Sony Ericsson Device 716 USB WMC Device Management Drivers (WDM) – C:\WINDOWS\SYSTEM32\DRIVERS\s716mgmt.sys (MCCI Corporation)
DRV - (s716mdfl) – C:\WINDOWS\SYSTEM32\DRIVERS\s716mdfl.sys (MCCI Corporation)
DRV - (s716bus) Sony Ericsson Device 716 driver (WDM) – C:\WINDOWS\SYSTEM32\DRIVERS\s716bus.sys (MCCI Corporation)
DRV - (Cdr4_xp) – C:\WINDOWS\SYSTEM32\DRIVERS\cdr4_xp.sys (Roxio)
DRV - (hardlock) – C:\WINDOWS\SYSTEM32\DRIVERS\hardlock.sys (Aladdin Knowledge Systems)
DRV - (Haspnt) – C:\WINDOWS\SYSTEM32\DRIVERS\Haspnt.sys (Aladdin Knowledge Systems)
DRV - (iAimFP4) – C:\WINDOWS\SYSTEM32\DRIVERS\wvchntxx.sys (Intel® Corporation)
DRV - (iAimFP3) – C:\WINDOWS\SYSTEM32\DRIVERS\wsiintxx.sys (Intel® Corporation)
DRV - (iAimTV4) – C:\WINDOWS\SYSTEM32\DRIVERS\wch7xxnt.sys (Intel® Corporation)
DRV - (iAimTV3) – C:\WINDOWS\SYSTEM32\DRIVERS\watv04nt.sys (Intel® Corporation)
DRV - (iAimTV1) – C:\WINDOWS\SYSTEM32\DRIVERS\watv02nt.sys (Intel® Corporation)
DRV - (iAimTV0) – C:\WINDOWS\SYSTEM32\DRIVERS\watv01nt.sys (Intel® Corporation)
DRV - (iAimFP0) – C:\WINDOWS\SYSTEM32\DRIVERS\wadv01nt.sys (Intel® Corporation)
DRV - (iAimFP1) – C:\WINDOWS\SYSTEM32\DRIVERS\wadv02nt.sys (Intel® Corporation)
DRV - (iAimFP2) – C:\WINDOWS\SYSTEM32\DRIVERS\wadv05nt.sys (Intel® Corporation)
DRV - (i81x) – C:\WINDOWS\SYSTEM32\DRIVERS\i81xnt5.sys (Intel® Corporation)
DRV - (nv) – C:\WINDOWS\SYSTEM32\DRIVERS\nv4_mini.sys (NVIDIA Corporation)
DRV - (U3sHlpDr) – C:\WINDOWS\SYSTEM32\DRIVERS\U3sHlpDr.sys ()
DRV - (UdfReadr_xp) – C:\WINDOWS\SYSTEM32\DRIVERS\udfreadr_xp.sys (Roxio)
DRV - (pwd_2k) – C:\WINDOWS\SYSTEM32\DRIVERS\pwd_2K.sys (Roxio)
DRV - (mmc_2K) – C:\WINDOWS\SYSTEM32\DRIVERS\Mmc_2k.sys (Roxio)
DRV - (dvd_2K) – C:\WINDOWS\SYSTEM32\DRIVERS\Dvd_2k.sys (Roxio)
DRV - (Cdralw2k) – C:\WINDOWS\SYSTEM32\DRIVERS\cdralw2k.sys (Roxio)
DRV - (cdudf_xp) – C:\WINDOWS\SYSTEM32\DRIVERS\cdudf_xp.sys (Roxio)
DRV - (omci) – C:\WINDOWS\SYSTEM32\DRIVERS\omci.sys (Dell Computer Corporation)
DRV - (Aspi32) – C:\WINDOWS\SYSTEM32\DRIVERS\ASPI32.SYS (Adaptec)
DRV - (Sparrow) – C:\WINDOWS\System32\DRIVERS\sparrow.sys (Adaptec, Inc.)
DRV - (sym_u3) – C:\WINDOWS\System32\DRIVERS\sym_u3.sys (LSI Logic)
DRV - (sym_hi) – C:\WINDOWS\System32\DRIVERS\sym_hi.sys (LSI Logic)
DRV - (symc8xx) – C:\WINDOWS\System32\DRIVERS\symc8xx.sys (LSI Logic)
DRV - (symc810) – C:\WINDOWS\System32\DRIVERS\symc810.sys (Symbios Logic Inc.)
DRV - (ultra) – C:\WINDOWS\System32\DRIVERS\ultra.sys (Promise Technology, Inc.)
DRV - (ql12160) – C:\WINDOWS\System32\DRIVERS\ql12160.sys (QLogic Corporation)
DRV - (ql1080) – C:\WINDOWS\System32\DRIVERS\ql1080.sys (QLogic Corporation)
DRV - (ql1280) – C:\WINDOWS\System32\DRIVERS\ql1280.sys (QLogic Corporation)
DRV - (dac2w2k) – C:\WINDOWS\System32\DRIVERS\dac2w2k.sys (Mylex Corporation)
DRV - (mraid35x) – C:\WINDOWS\System32\DRIVERS\mraid35x.sys (American Megatrends Inc.)
DRV - (asc) – C:\WINDOWS\System32\DRIVERS\asc.sys (Advanced System Products, Inc.)
DRV - (asc3550) – C:\WINDOWS\System32\DRIVERS\asc3550.sys (Advanced System Products, Inc.)
DRV - (AliIde) – C:\WINDOWS\System32\DRIVERS\aliide.sys (Acer Laboratories Inc.)
DRV - (CmdIde) – C:\WINDOWS\System32\DRIVERS\cmdide.sys (CMD Technology, Inc.)
DRV - (EL90XBC) – C:\WINDOWS\SYSTEM32\DRIVERS\EL90XBC5.SYS (3Com Corporation)
DRV - (Sentinel) – C:\WINDOWS\System32\Drivers\SENTINEL.SYS (Rainbow Technologies, Inc.)
DRV - (MASPINT) – C:\WINDOWS\SYSTEM32\DRIVERS\MASPINT.SYS (MicroStaff Co.,Ltd.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerm…tf8&oe;=utf8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com.au/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = ;*.local
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 192.168.1.20:80

========== FireFox ==========

FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "http://www.google.com.au/"
FF - prefs.js..extensions.enabledItems: {3e0e7d2a-070f-4a47-b019-91fe5385ba79}:3.0.1
FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:9.0.0.825
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..network.proxy.ftp: "192.168.1.20"
FF - prefs.js..network.proxy.ftp_port: 80
FF - prefs.js..network.proxy.gopher: "192.168.1.20"
FF - prefs.js..network.proxy.gopher_port: 80
FF - prefs.js..network.proxy.http: "192.168.1.20"
FF - prefs.js..network.proxy.http_port: 80
FF - prefs.js..network.proxy.no_proxies_on: "localhost,127.0.0.1"
FF - prefs.js..network.proxy.share_proxy_settings: true
FF - prefs.js..network.proxy.socks: "192.168.1.20"
FF - prefs.js..network.proxy.socks_port: 80
FF - prefs.js..network.proxy.ssl: "192.168.1.20"
FF - prefs.js..network.proxy.ssl_port: 80

FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG9\Firefox [2010/06/04 09:13:20 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.6\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/06/28 14:16:23 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.6\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/06/28 14:16:23 | 000,000,000 | —D | M]

[2008/08/29 10:40:29 | 000,000,000 | —D | M] – C:\Documents and Settings\Maaike\Application Data\Mozilla\Extensions
[2010/06/29 12:31:07 | 000,000,000 | —D | M] – C:\Documents and Settings\Maaike\Application Data\Mozilla\Firefox\Profiles\ricvu42y.default\extensions
[2010/04/28 09:21:07 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Maaike\Application Data\Mozilla\Firefox\Profiles\ricvu42y.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/03/25 11:03:22 | 000,000,000 | —D | M] (AddThis) – C:\Documents and Settings\Maaike\Application Data\Mozilla\Firefox\Profiles\ricvu42y.default\extensions\{3e0e7d2a-070f-4a47-b019-91fe5385ba79}
[2006/02/21 15:39:53 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Maaike\Application Data\Mozilla\Firefox\Profiles\ricvu42y.default\extensions\{BE087D3D-7F8B-4f69-B255-8C2D50B77230}
[2009/10/13 13:35:37 | 000,000,000 | —D | M] – C:\Documents and Settings\Maaike\Application Data\Mozilla\Firefox\Profiles\ricvu42y.default\extensions\[removed]
[2010/06/29 12:31:09 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2010/04/19 08:53:48 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/04/12 17:29:19 | 000,411,368 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll

O1 HOSTS File: ([2008/08/05 19:31:17 | 000,000,775 | —- | M]) - C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 192.168.1.20 photocentric.onpix.com
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O4 - HKLM..\Run: [AdaptecDirectCD] C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe (Roxio)
O4 - HKLM..\Run: [Adobe Photo Downloader] C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe (Apple Inc.)
O4 - HKLM..\Run: [Auto EPSON Stylus C67 Series on ACER-RNAGI95275] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAAP.EXE (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [AVG9_TRAY] C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [EPSON Stylus C67 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAAP.EXE (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [EPSON Stylus C67 Series on Maaikes] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAAP.EXE (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [KernelFaultCheck] File not found
O4 - HKLM..\Run: [LogMeIn GUI] C:\Program Files\LogMeIn\x86\LogMeInSystray.exe (LogMeIn, Inc.)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [PhotoUpload] C:\ceon\PhotoLabLauncher.exe ()
O4 - HKLM..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE (FUJI PHOTO FILM CO., LTD.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre6\bin\jusched.exe File not found
O4 - HKLM..\Run: [UserFaultCheck] File not found
O4 - HKCU..\RunOnce: [FFTI] C:\Documents and Settings\Maaike\Application Data\Mozilla\Firefox\Profiles\ricvu42y.default\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\ffti.exe File not found
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: E&xport; to Microsoft Excel - C:\Program Files\Microsoft Office\Office10\EXCEL.EXE (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} http://office.microsoft.com/templates/ieawsdc.cab (Microsoft Office Template and Media Control)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool)
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} http://office.microsoft.com/officeupdate/content/opuc.cab (Office Update Installation Engine)
O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} http://sib1.od2.com/common/Member/ClientIn…2/OCI/setup.exe (InstallShield Setup Player 2K2)
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} http://download.bitdefender.com/resources/scan8/oscan8.cab (BDSCANONLINE Control)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdat…b?1167795106218 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/products/plugin/autodl…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CA1811B0-28B5-44AB-8DB3-DC9BEAA77D04} http://us.dl1.yimg.com/download.yahoo.com/…ropper1_3au.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/products/plugin/autodl…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/get/shock…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} http://download.games.yahoo.com/games/popc…aploader_v5.cab (Reg Error: Key error.)
O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.20
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\avgrsstarter: DllName - avgrsstx.dll - C:\WINDOWS\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
O20 - Winlogon\Notify\LMIinit: DllName - LMIinit.dll - C:\WINDOWS\System32\LMIinit.dll (LogMeIn, Inc.)
O24 - Desktop WallPaper: C:\Documents and Settings\Maaike\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Maaike\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2002/09/03 15:36:02 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O33 - MountPoints2\{4b1011aa-e598-11dc-9957-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{4b1011aa-e598-11dc-9957-00038a000015}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{4b1011aa-e598-11dc-9957-00038a000015}\Shell\readit\command - "" = H:\tool.exe – File not found
O33 - MountPoints2\{6614f97a-6d80-11dd-99eb-00038a000015}\Shell - "" = AutoRun
O33 - MountPoints2\{6614f97a-6d80-11dd-99eb-00038a000015}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{6614f97a-6d80-11dd-99eb-00038a000015}\Shell\AutoRun\command - "" = H:\LaunchU3.exe – File not found
O33 - MountPoints2\{efcc1de4-e072-11de-9b41-0007e97ea673}\Shell - "" = AutoRun
O33 - MountPoints2\{efcc1de4-e072-11de-9b41-0007e97ea673}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{efcc1de4-e072-11de-9b41-0007e97ea673}\Shell\AutoRun\command - "" = H:\Photo_Viewer.exe – File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/06/29 13:17:15 | 000,000,000 | —D | C] – C:\Program Files\Citrix
[2010/06/28 15:51:27 | 000,000,000 | —D | C] – C:\Documents and Settings\Maaike\Application Data\Malwarebytes
[2010/06/28 15:51:09 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/06/28 15:51:07 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2010/06/28 15:51:06 | 000,020,952 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2010/06/28 15:51:06 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2010/06/28 11:35:14 | 000,000,000 | -H-D | C] – C:\WINDOWS\System32\CanonMF Uninstaller Information
[2010/06/28 11:31:31 | 000,000,000 | -H-D | C] – C:\CanonMF
[2010/06/24 17:12:17 | 000,000,000 | —D | C] – C:\Documents and Settings\Maaike\Desktop\Malware Spyware investigation
[2010/06/23 14:59:47 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Maaike\Recent
[2010/06/18 18:53:42 | 000,000,000 | —D | C] – C:\Program Files\Bonjour
[2010/06/17 17:01:19 | 000,000,000 | —D | C] – C:\Documents and Settings\Maaike\My Documents\Rosters June July 2010
[2010/06/16 09:20:59 | 000,000,000 | —D | C] – C:\Documents and Settings\Maaike\Local Settings\Application Data\PCHealth
[2010/06/15 13:31:45 | 000,000,000 | —D | C] – C:\Documents and Settings\Maaike\My Documents\Dakis
[2010/06/15 11:41:13 | 000,743,424 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iedvtool.dll
[2010/06/07 12:23:26 | 000,000,000 | —D | C] – C:\Documents and Settings\Maaike\Desktop\Rosters June July 2010
[8 C:\Documents and Settings\Maaike\My Documents\*.tmp files -> C:\Documents and Settings\Maaike\My Documents\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/07/01 13:10:00 | 000,000,428 | —- | M] () – C:\WINDOWS\tasks\Symantec NetDetect.job
[2010/07/01 12:34:37 | 000,000,006 | —- | M] () – C:\WINDOWS\Twain001.Mtx
[2010/07/01 12:34:06 | 000,000,156 | —- | M] () – C:\WINDOWS\Twunk001.MTX
[2010/07/01 12:28:21 | 000,010,872 | —- | M] () – C:\Documents and Settings\Maaike\My Documents\PhotoCentric Statement.pdf
[2010/07/01 12:14:05 | 000,000,886 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/07/01 11:48:43 | 000,022,601 | —- | M] () – C:\Documents and Settings\Maaike\My Documents\Stores Statistical Report 1July2010.pdf
[2010/07/01 11:33:34 | 000,002,099 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Business Professional.lnk
[2010/07/01 11:32:23 | 000,002,483 | —- | M] () – C:\Documents and Settings\Maaike\Desktop\Microsoft Word.lnk
[2010/07/01 09:56:03 | 061,550,559 | —- | M] () – C:\WINDOWS\System32\drivers\Avg\incavi.avm
[2010/06/30 15:43:57 | 000,000,000 | —- | M] () – C:\Documents and Settings\Maaike\Local Settings\Application Data\prvlcl.dat
[2010/06/30 15:14:03 | 000,000,882 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/06/30 13:26:19 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/06/29 13:16:05 | 000,108,920 | —- | M] () – C:\Documents and Settings\Maaike\g2ax_customer_downloadhelper_win32_x86.exe
[2010/06/29 09:56:34 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/06/29 09:55:35 | 000,002,048 | –S- | M] () – C:\WINDOWS\BOOTSTAT.DAT
[2010/06/29 09:55:33 | 1609,633,792 | -HS- | M] () – C:\hiberfil.sys
[2010/06/28 17:20:57 | 008,388,608 | -H– | M] () – C:\Documents and Settings\Maaike\NTUSER.DAT
[2010/06/28 17:20:52 | 000,000,278 | -HS- | M] () – C:\Documents and Settings\Maaike\NTUSER.INI
[2010/06/28 14:50:47 | 000,001,170 | —- | M] () – C:\WINDOWS\System32\WPA.DBL
[2010/06/28 11:35:43 | 000,000,856 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Canon MF Toolbox 4.9.lnk
[2010/06/28 10:59:28 | 000,066,048 | —- | M] () – C:\Documents and Settings\Maaike\My Documents\Calendar holidays.doc
[2010/06/28 10:50:35 | 000,060,416 | —- | M] () – C:\Documents and Settings\Maaike\My Documents\Calendar covering.doc
[2010/06/24 10:59:10 | 000,000,000 | —- | M] () – C:\Documents and Settings\Maaike\defogger_reenable
[2010/06/22 16:46:03 | 000,093,184 | —- | M] () – C:\Documents and Settings\Maaike\My Documents\Website content.doc
[2010/06/21 15:56:30 | 000,001,564 | —- | M] () – C:\Documents and Settings\Maaike\Desktop\WagezWindow.lnk
[2010/06/21 14:47:27 | 000,007,668 | —- | M] () – C:\Documents and Settings\Maaike\My Documents\PhotoCentric Remittance Advice.pdf
[2010/06/21 11:05:03 | 000,020,568 | —- | M] () – C:\Documents and Settings\Maaike\My Documents\Stores Statistical Report 21JUN2010.xls
[2010/06/16 15:33:05 | 000,148,992 | —- | M] () – C:\Documents and Settings\Maaike\My Documents\Visa breakdown for Steven.xls
[2010/06/16 15:27:22 | 000,002,481 | —- | M] () – C:\Documents and Settings\Maaike\Desktop\Microsoft Excel.lnk
[2010/06/16 09:04:25 | 000,332,280 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2010/06/09 17:32:22 | 000,049,664 | —- | M] () – C:\Documents and Settings\Maaike\My Documents\Potential Tenants.doc
[2010/06/09 17:31:38 | 000,016,896 | —- | M] () – C:\Documents and Settings\Maaike\My Documents\Dakis calculation.xls
[2010/06/09 17:18:22 | 000,011,171 | —- | M] () – C:\Documents and Settings\Maaike\My Documents\PhotoCentric Invoice.pdf
[2010/06/09 15:07:06 | 000,019,968 | —- | M] () – C:\Documents and Settings\Maaike\My Documents\With Compliments Slip.doc
[2010/06/08 16:44:23 | 000,451,584 | —- | M] () – C:\Documents and Settings\Maaike\My Documents\BPro email addresses 08June10.xls
[2010/06/07 12:23:07 | 000,034,304 | —- | M] () – C:\Documents and Settings\Maaike\My Documents\Roster adjusted.doc
[2010/06/03 09:05:55 | 000,242,896 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\drivers\avgtdix.sys
[2010/06/03 09:05:54 | 000,029,584 | —- | M] (AVG Technologies CZ, s.r.o.) – C:\WINDOWS\System32\drivers\avgmfx86.sys
[2010/06/01 17:30:30 | 000,010,978 | —- | M] () – C:\Documents and Settings\Maaike\My Documents\PhotoCentric Invoice2.pdf
[2010/06/01 17:30:11 | 000,010,961 | —- | M] () – C:\Documents and Settings\Maaike\My Documents\PhotoCentric Invoice1.pdf
[2010/06/01 16:53:28 | 000,138,752 | —- | M] () – C:\Documents and Settings\Maaike\My Documents\Electronic Statements.doc
[8 C:\Documents and Settings\Maaike\My Documents\*.tmp files -> C:\Documents and Settings\Maaike\My Documents\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/07/01 11:48:42 | 000,022,601 | —- | C] () – C:\Documents and Settings\Maaike\My Documents\Stores Statistical Report 1July2010.pdf
[2010/06/29 13:16:03 | 000,108,920 | —- | C] () – C:\Documents and Settings\Maaike\g2ax_customer_downloadhelper_win32_x86.exe
[2010/06/28 11:35:43 | 000,000,856 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Canon MF Toolbox 4.9.lnk
[2010/06/24 10:59:10 | 000,000,000 | —- | C] () – C:\Documents and Settings\Maaike\defogger_reenable
[2010/06/21 11:05:03 | 000,020,568 | —- | C] () – C:\Documents and Settings\Maaike\My Documents\Stores Statistical Report 21JUN2010.xls
[2010/06/09 17:31:38 | 000,016,896 | —- | C] () – C:\Documents and Settings\Maaike\My Documents\Dakis calculation.xls
[2010/06/09 16:05:15 | 000,049,664 | —- | C] () – C:\Documents and Settings\Maaike\My Documents\Potential Tenants.doc
[2010/06/08 15:49:22 | 000,451,584 | —- | C] () – C:\Documents and Settings\Maaike\My Documents\BPro email addresses 08June10.xls
[2010/02/24 16:37:15 | 000,000,502 | —- | C] () – C:\WINDOWS\System32\CNCMFP34.INI
[2009/01/06 13:14:12 | 000,000,002 | —- | C] () – C:\WINDOWS\msoffice.ini
[2007/06/29 11:18:21 | 000,000,251 | —- | C] () – C:\WINDOWS\pmontage.ini
[2007/01/04 09:02:20 | 000,087,800 | —- | C] () – C:\WINDOWS\System32\cpwmon2k.dll
[2006/09/16 08:59:55 | 000,000,197 | —- | C] () – C:\WINDOWS\WinHelp.ini
[2006/03/03 16:26:39 | 000,000,383 | —- | C] () – C:\WINDOWS\System32\haspdos.sys
[2005/12/01 10:02:43 | 000,618,496 | —- | C] () – C:\WINDOWS\System32\stlpmt45.dll
[2005/10/07 10:09:03 | 000,000,000 | —- | C] () – C:\WINDOWS\P2kRotate.ini
[2005/03/01 14:30:20 | 000,000,453 | —- | C] () – C:\WINDOWS\bdoscandellang.ini
[2004/10/08 14:21:21 | 000,363,520 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2004/04/20 04:57:03 | 000,000,526 | —- | C] () – C:\WINDOWS\picturific.ini
[2004/03/18 08:34:34 | 000,221,184 | —- | C] () – C:\WINDOWS\System32\lame_enc.dll
[2004/03/17 09:21:01 | 000,000,141 | —- | C] () – C:\WINDOWS\smr.INI
[2004/03/01 16:31:24 | 000,000,291 | —- | C] () – C:\WINDOWS\msfsetup.ini
[2004/01/27 17:35:54 | 000,000,063 | —- | C] () – C:\WINDOWS\mdm.ini
[2003/10/06 13:16:00 | 000,027,136 | —- | C] () – C:\WINDOWS\System32\nvcod.dll
[2003/08/11 14:17:31 | 000,007,551 | —- | C] () – C:\WINDOWS\System32\drivers\U3sHlpDr.sys
[2003/06/16 17:20:32 | 000,002,471 | —- | C] () – C:\WINDOWS\RBuilder.ini
[2003/06/16 17:02:41 | 000,045,056 | —- | C] () – C:\WINDOWS\System32\SenorDrawer.dll
[2003/06/02 14:37:28 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2003/06/02 14:32:12 | 000,000,784 | —- | C] () – C:\WINDOWS\lrun32.ini
[2003/06/02 14:31:00 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2003/06/02 14:27:20 | 000,000,791 | —- | C] () – C:\WINDOWS\orun32.ini
[2003/06/02 14:07:12 | 000,000,547 | —- | C] () – C:\WINDOWS\System32\OEMINFO.INI
[1980/01/01 02:00:00 | 000,012,288 | —- | C] () – C:\WINDOWS\System32\e100bmsg.dll

========== LOP Check ==========

[2009/09/23 12:30:29 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Avery
[2010/02/05 09:35:19 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\avg9
[2008/08/02 12:05:45 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\BVRP Software
[2007/11/30 14:02:23 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\ClickPhoto Print Wizard
[2006/07/11 17:05:17 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Downloaded Installations
[2008/04/12 12:52:54 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Installations
[2008/07/14 09:03:47 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\LogMeIn
[2008/11/28 10:35:22 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\NCH Swift Sound
[2007/09/25 12:28:23 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Nokia
[2006/01/27 16:37:29 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\OD2
[2006/11/30 11:32:58 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\OLYMPUS
[2007/07/26 09:39:20 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PC Suite
[2004/03/03 20:03:57 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PopCap
[2004/03/18 09:08:58 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Viewpoint
[2009/03/18 13:56:33 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
[2010/03/31 13:06:45 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2009/09/16 13:59:49 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2009/04/08 14:24:30 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2004/06/17 14:51:28 | 000,000,000 | —D | M] – C:\Documents and Settings\Maaike\Application Data\ACD Systems
[2004/04/20 04:57:10 | 000,000,000 | —D | M] – C:\Documents and Settings\Maaike\Application Data\Adorama Viewer
[2010/03/04 09:05:31 | 000,000,000 | —D | M] – C:\Documents and Settings\Maaike\Application Data\calibre
[2010/02/25 10:04:51 | 000,000,000 | —D | M] – C:\Documents and Settings\Maaike\Application Data\Canon
[2010/05/26 17:29:18 | 000,000,000 | —D | M] – C:\Documents and Settings\Maaike\Application Data\ClickPhoto Print Wizard
[2010/03/26 13:59:54 | 000,000,000 | —D | M] – C:\Documents and Settings\Maaike\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2006/07/18 14:28:17 | 000,000,000 | —D | M] – C:\Documents and Settings\Maaike\Application Data\DataLayer
[2004/03/01 16:43:05 | 000,000,000 | —D | M] – C:\Documents and Settings\Maaike\Application Data\FUJIFILM
[2004/09/09 18:28:15 | 000,000,000 | —D | M] – C:\Documents and Settings\Maaike\Application Data\Leadertech
[2008/11/28 10:34:15 | 000,000,000 | —D | M] – C:\Documents and Settings\Maaike\Application Data\NCH Swift Sound
[2007/07/26 09:39:49 | 000,000,000 | —D | M] – C:\Documents and Settings\Maaike\Application Data\Nokia
[2005/05/05 19:19:44 | 000,000,000 | —D | M] – C:\Documents and Settings\Maaike\Application Data\OD2
[2007/07/26 10:16:02 | 000,000,000 | —D | M] – C:\Documents and Settings\Maaike\Application Data\PC Suite
[2008/08/02 11:59:48 | 000,000,000 | —D | M] – C:\Documents and Settings\Maaike\Application Data\Teleca

========== Purity Check ==========

========== Alternate Data Streams ==========

@Alternate Data Stream - 76267 bytes -> C:\Documents and Settings\Maaike\My Documents\topomap.tif:AFP_Resource
@Alternate Data Stream - 60 bytes -> C:\Documents and Settings\Maaike\My Documents\topomap.tif:AFP_AfpInfo
< End of report >

inzanity

Post #13July 1, 2010, 3:51 AM UTC

Hi,

It seems that your Outlook back up is infected.

This next instruction will delete the infected back up and archive file. Please close Outlook before proceeding with the fix.

You can create a fresh back up after this. If you are OK with this then I please do the following:

Run OTL.exe

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

:OTL
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
@Alternate Data Stream - 76267 bytes -> C:\Documents and Settings\Maaike\My Documents\topomap.tif:AFP_Resource
@Alternate Data Stream - 60 bytes -> C:\Documents and Settings\Maaike\My Documents\topomap.tif:AFP_AfpInfo

:Files
C:\Backup\Outlook backup.pst
C:\Documents and Settings\Maaike\Local Settings\Application Data\Microsoft\Outlook\archive.pst

:Commands
[purity]
[emptytemp]
[emptyflash]

Then click the Run Fix button at the top.
Let the program run unhindered, reboot when it is done.
Then post the result and a new OTL log in your next reply. ( don't check the boxes beside LOP Check or Purity this time )

Maaike

Post #14July 1, 2010, 4:48 AM UTC

OK, here's the log file All processes killed ========== OTL ========== Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}\ not found. ADS C:\Documents and Settings\Maaike\My Documents\topomap.tif:AFP_Resource deleted successfully. ADS C:\Documents and Settings\Maaike\My Documents\topomap.tif:AFP_AfpInfo deleted successfully. ========== FILES ========== C:\Backup\Outlook backup.pst moved successfully. C:\Documents and Settings\Maaike\Local Settings\Application Data\Microsoft\Outlook\archive.pst moved successfully. ========== COMMANDS ========== [EMPTYTEMP] User: Administrator ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: All Users User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: LocalService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes ->FireFox cache emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Maaike ->Temp folder emptied: 109540231 bytes ->Temporary Internet Files folder emptied: 832585 bytes ->Java cache emptied: 298975 bytes ->FireFox cache emptied: 42558683 bytes ->Flash cache emptied: 5093 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 31446 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes RecycleBin emptied: 390405 bytes Total Files Cleaned = 147.00 mb [EMPTYFLASH] User: Administrator User: All Users User: Default User User: LocalService ->Flash cache emptied: 0 bytes User: Maaike ->Flash cache emptied: 0 bytes User: NetworkService Total Flash Files Cleaned = 0.00 mb OTL by OldTimer - Version 3.2.7.0 log created on 07012010_143459 Files\Folders moved on Reboot… C:\Documents and Settings\Maaike\Local Settings\Temp\[removed] moved successfully. C:\Documents and Settings\Maaike\Local Settings\Temp\[removed] moved successfully. Registry entries deleted on Reboot…

inzanity

Post #15July 2, 2010, 12:31 AM UTC

Hi,

Your computer now looks clean!

Any computer problems so far? How is your computer?

Let's do a little clean up before you go.

Delete the following:

GMER
All the logs we've created.

You can keep TFC and use it to clean your computer of some junk atleast once a week. You can also keep Malwarebytes, it is an excellent malware removal tool. Update atleast once a week then run a complete scan.

–Next–

Clean up with OTL:

Double-click OTL.exe to start the program.
Close all other programs apart from OTL as this step will require a reboot
On the OTL main screen, press the CLEANUP button
Say Yes to the prompt and then allow the program to reboot your computer.

–Next–

You need to create a new Clean restore point.
Click Start Menu > Run > copy and paste

%SystemRoot%\System32\restore\rstrui.exe

Press OK. Choose Create a Restore Point then click Next. Name it (something you'll remember) and click Create, when the confirmation screen shows the restore point has been created click Close.

Remove all previous Restore Points
Click Start Menu > Run > copy and paste

cleanmgr

At top, click on More Options tab. Click Clean up… button in the System Restore box. Click on Yes button. When finished, click on Cancel button to exit.

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Check "Hide file extensions for known file types."
Under the "Hidden files" folder, Uncheck "Show hidden files and folders."
Check "Hide protected operating system files."
Click Apply, and then click OK.

–Next–

To keep your operating system up to date visit

Secunia Software inspector to check your program update status.
Microsoft Windows Update .

Here are some tips to reduce the potential for spyware infection in the future:

1. It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
Strong passwords: How to create and use them
Then consider a password keeper, to keep all your passwords safe.

2. Make your Internet Explorer More Secure

From within Internet Explorer click on the Tools menu and then click on Options.
Click once on the Security tab.
Click once on the Internet icon so it becomes highlighted.
Click once on the Custom Level button.
- Change the Download signed ActiveX controls to Prompt.
- Change the Download unsigned ActiveX controls to Disable.
- Change the Initialise and script ActiveX controls not marked as safe to Disable.
- Change the Installation of desktop items to Prompt.
- Change the Launching programs and files in an IFRAME to Prompt.
- Change the Navigate sub-frames across different domains to Prompt.
- When all these settings have been made, click on the OK button.
- If it prompts you as to whether or not you want to save the settings, press the Yes button.
Next press the Apply button and then the OK to exit the Internet Properties page.

3. Update your Anti-Virus Software - I can not overemphasize the need for you to update your Anti-virus application on a regular basis. With the ever increasing number of new variants of malware arriving on the scene daily, you become very susceptible to an attack without updated protection.

4. Make sure you keep your Windows OS current by visiting Windows update regularly to download and install any critical updates and service packs. Without these you are leaving the back door open.

5. Consider a custom hosts file such as MVPS HOSTS. This custom hosts file effectively blocks a wide range of unwanted ads, banners, 3rd party Cookies, 3rd party page counters, web bugs, and many hijackers.
For information on how to download and install, please read this tutorial by WinHelp2002
Note: Be sure to follow the instructions to disable the DNS Client service before installing a custom hosts file.

6. Download and install the free version of WinPatrol. This program protects your computer in a variety of ways and will work well with your existing security software. Have a look at this tutorial to help you get started with the program.

7. SpywareBlaster - Download and install SpywareBlaster. This program prevents the installation of ActiveX-based spyware and other potentially unwanted programs.

8. Protect your computer from internet threats with SandboxIE. This program isolates Internet Explorer from the rest of your operating system, 'sandboxing' it away - so malicious websites can't do damage to the rest of your system. There is a Getting Started guide on their website.

9. Some excellent free firewalls. Note: Use only one firewall at a time.
Agnitum Outpost Firewall
Online Armor Personal Firewall

10. And finally, please read these excellent articles:
Malware: Help prevent the Infection by Sandi Hardmeier,
Preventing Malware - Tools and Practices for Safe Computing

For more safe computing tips please read the guide by Rorschach112 on how to prevent malware and about safe computing here.

We will keep this thread open for a couple of days. Please post back if you have any problems or questions or when you have finished so this thread can be marked as "Resolved".

Good luck, happy computing and stay clean!

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Agonisingly slow...

✨ Ask AI

Ask AI