Spyware / Malware / Virus Removal

Infected with something that keeps running

32 min read

Looking for the outcome? Ask AI

LastPaladin Topic Starter

Post #1June 29, 2010, 10:10 AM UTC

"Autoplay" keeps popping up on my screen and the bottom occasionally says that it has opened up to 10 windows. As I'm typing this I have to keep my left hand on my mouse to keep clicking on the screen so I can keep on typing, if I didn't I would still be trying to type the first 3 words. Here are the notepad messages: DDS (Ver_09-06-26.01) - NTFSx86 Run by [removed] at 23:39:37.45 on Mon 06/28/2010 Internet Explorer: 8.0.6001.18702 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.895.222 [GMT -10:00] AV: Norton Internet Security *On-access scanning enabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8} FW: Norton Internet Security *enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220} ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe svchost.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Norton Internet Security\Engine\17.7.0.12\ccSvcHst.exe C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe C:\WINDOWS\ALCXMNTR.EXE C:\Program Files\QuickTime\qttask.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Norton Utilities 14\nu.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe C:\Program Files\Ocucom\PreCast\tmon.exe C:\WINDOWS\system32\sistray.exe C:\Program Files\Norton Internet Security\Engine\17.7.0.12\ccSvcHst.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\InterMute\SpySubtract\SpySub.exe C:\HP\KBD\KBD.EXE C:\WINDOWS\AGRSMMSG.exe c:\windows\system\hpsysdrv.exe C:\Program Files\Java\jre1.5.0\bin\jusched.exe C:\Program Files\Java\jre1.5.0\bin\jucheck.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\Desktop\dds.scr ============== Pseudo HJT Report =============== uStart Page = hxxp://www.yahoo.com/?fr=fp-sem uSearch Page = hxxp://us.rd.yahoo.com/customize/ycomp/defaults/sp/*http://www.yahoo.com uSearch Bar = hxxp://us.rd.yahoo.com/customize/ycomp/defaults/sb/*http://www.yahoo.com/search/ie.html uDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q305&bd=presario&pf=desktop uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q305&bd=presario&pf=desktop mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q305&bd=presario&pf=desktop uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com mSearchAssistant = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q305&bd=presario&pf=desktop uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn17\yt.dll BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn17\yt.dll BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 6.0\reader\activex\AcroIEHelper.dll BHO: Yahooo Search Protection: {25bc7718-0bfa-40ea-b381-4b2d9732d686} - c:\program files\yahoo!\search protection\ysp.dll BHO: Symantec NCO BHO: {602adb0e-4aff-4217-8aa1-95dac4dfa408} - c:\program files\norton internet security\engine\17.7.0.12\coIEPlg.dll BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - c:\program files\norton internet security\engine\17.7.0.12\IPSBHO.DLL BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\googletoolbar1.dll BHO: CNavExtBho Class: {bdf3e430-b101-42ad-a544-fadc6b084872} - c:\program files\norton internet security\norton antivirus\NavShExt.dll BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn17\YTSingleInstance.dll TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar1.dll TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn17\yt.dll TB: Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - c:\program files\norton internet security\engine\17.7.0.12\coIEPlg.dll TB: Norton AntiVirus: {42cdd1bf-3ffb-4238-8ad1-7859df00b1d6} - c:\program files\norton internet security\norton antivirus\NavShExt.dll uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRun: [YSearchProtection] c:\program files\yahoo!\search protection\YspService.exe uRun: [NortonUtilities] c:\program files\norton utilities 14\nu.exe /S mRun: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent mRun: [HPBootOp] "c:\program files\hewlett-packard\hp boot optimizer\HPBootOp.exe" /run mRun: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe mRun: [regcmdcons] c:\hp\bin\cloaker.exe c:\hp\bin\cmdcons.cmd mRun: [AlcxMonitor] ALCXMNTR.EXE mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot mRunOnce: [Uninstall Adobe Download Manager] "c:\windows\system32\rundll32.exe" "c:\program files\nos\bin\getPlus_Helper.dll",Uninstall /IE2883E8F-472F-4fb0-9522-AC9BF37916A7 /Get1noarp StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hppsc2~1.lnk - c:\program files\hewlett-packard\digital imaging\bin\hpobnz08.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpoddt~1.lnk - c:\program files\hewlett-packard\digital imaging\bin\hpotdd01.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\precas~1.lnk - c:\program files\ocucom\precast\tmon.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\spysub~1.lnk - c:\program files\intermute\spysubtract\sslaunch.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\utilit~1.lnk - c:\windows\system32\sistray.exe IE: &Google Search - c:\program files\google\GoogleToolbar1.dll/cmsearch.html IE: Backward Links - c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html IE: Cached Snapshot of Page - c:\program files\google\GoogleToolbar1.dll/cmcache.html IE: E&xport to Microsoft Excel - c:\progra~1\mi1933~1\office11\EXCEL.EXE/3000 IE: Similar Pages - c:\program files\google\GoogleToolbar1.dll/cmsimilar.html IE: Translate into English - c:\program files\google\GoogleToolbar1.dll/cmtrans.html IE: {E2D4D26B-0180-43a4-B05F-462D6D54C789} - c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\iebutton\support.htm IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0015-0000-0000-ABCDEFFEDCBC} - c:\program files\java\jre1.5.0\bin\npjpi150.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\mi1933~1\office11\REFIEBAR.DLL DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper.dll DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0-windows-i586.cab DPF: {CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0-windows-i586.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab SEH: {FA010552-4A27-4cb1-A1BB-3E2D697F1639} - No File ============= SERVICES / DRIVERS =============== R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\nis\1107000.00c\symds.sys [2010-6-28 328752] R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\nis\1107000.00c\symefa.sys [2010-6-28 173104] R1 BHDrvx86;BHDrvx86;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nis_17.6.0.32\definitions\bashdefs\20100619.001\BHDrvx86.sys [2010-6-19 691248] R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\nis\1107000.00c\cchpx86.sys [2010-6-28 501888] R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\nis\1107000.00c\ironx86.sys [2010-6-28 116784] R2 NIS;Norton Internet Security;c:\program files\norton internet security\engine\17.7.0.12\ccsvchst.exe [2010-6-28 126392] R2 YahooAUService;Yahoo! Updater;c:\program files\yahoo!\softwareupdate\YahooAUService.exe [2008-11-9 602392] R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2010-6-28 102448] R3 IDSxpx86;IDSxpx86;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nis_17.6.0.32\definitions\ipsdefs\20100625.001\IDSXpx86.sys [2010-6-28 331640] R3 NAVENG;NAVENG;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nis_17.6.0.32\definitions\virusdefs\20100628.040\NAVENG.SYS [2010-6-28 85552] R3 NAVEX15;NAVEX15;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nis_17.6.0.32\definitions\virusdefs\20100628.040\NAVEX15.SYS [2010-6-28 1347504] S3 getPlusHelper;getPlus® Helper;c:\windows\system32\svchost.exe -k getPlusHelper [2004-8-4 14336] =============== Created Last 30 ================ 2010-06-28 10:43 –dsh— c:\documents and settings\compaq_owner.your-f78bf48ce2.005\IECompatCache 2010-06-28 10:38 –dsh— c:\documents and settings\compaq_owner.your-f78bf48ce2.005\PrivacIE 2010-06-28 10:35 –dsh— c:\documents and settings\compaq_owner.your-f78bf48ce2.005\IETldCache 2010-06-28 10:28 12,800 ——– c:\windows\system32\dllcache\xpshims.dll 2010-06-28 10:28 55,296 ——– c:\windows\system32\dllcache\msfeedsbs.dll 2010-06-28 10:28 599,040 ——– c:\windows\system32\dllcache\msfeeds.dll 2010-06-28 10:28 1,985,536 ——– c:\windows\system32\dllcache\iertutil.dll 2010-06-28 10:28 247,808 ——– c:\windows\system32\dllcache\ieproxy.dll 2010-06-28 10:28 11,076,096 ——– c:\windows\system32\dllcache\ieframe.dll 2010-06-28 10:28 743,424 ——– c:\windows\system32\dllcache\iedvtool.dll 2010-06-28 10:24 41,984 ——– c:\windows\system32\dllcache\iecompat.dll 2010-06-28 10:00 –d—– c:\docume~1\compaq~1.005\applic~1\Norton Utilities 14 2010-06-28 09:53 1,101,824 a——- c:\windows\system32\UniBox210.ocx 2010-06-28 09:53 880,640 a——- c:\windows\system32\UniBox10.ocx 2010-06-28 09:53 212,992 a——- c:\windows\system32\UniBoxVB12.ocx 2010-06-28 09:25 124,976 a——- c:\windows\system32\drivers\SYMEVENT.SYS 2010-06-28 09:25 60,808 a——- c:\windows\system32\S32EVNT1.DLL 2010-06-28 09:25 7,443 a——- c:\windows\system32\drivers\SYMEVENT.CAT 2010-06-28 09:25 805 a——- c:\windows\system32\drivers\SYMEVENT.INF 2010-06-28 09:24 –d—– c:\windows\system32\drivers\NIS 2010-06-28 09:24 –d—– c:\program files\Norton Internet Security 2010-06-28 09:23 –d—– c:\program files\NortonInstaller 2010-06-28 09:08 0 a—h— c:\windows\system32\drivers\Msft_Kernel_NuidFltr_01005.Wdf 2010-06-28 09:08 0 a—h— c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf 2010-06-28 09:07 21,504 a——- c:\windows\system32\drivers\hidserv.dll 2010-06-28 00:26 –d—– c:\windows\system32\CatRoot_bak 2010-06-28 00:22 454,016 ——– c:\windows\system32\dllcache\mrxsmb.sys 2010-06-28 00:22 48,128 ——– c:\windows\system32\dllcache\iyuv_32.dll 2010-06-28 00:22 8,704 ——– c:\windows\system32\dllcache\tsbyuv.dll 2010-06-28 00:21 17,920 ——– c:\windows\system32\dllcache\msyuv.dll 2010-06-28 00:19 272,128 ——– c:\windows\system32\drivers\bthport.sys 2010-06-28 00:19 272,128 ——– c:\windows\system32\dllcache\bthport.sys 2010-06-28 00:17 –dshr– C:\cmdcons 2010-06-28 00:17 –d—– c:\windows\setupupd 2010-06-27 23:51 –d—– c:\windows\system32\PreInstall 2010-06-27 23:51 26,144 a——- c:\windows\system32\spupdsvc.exe 2010-06-27 20:39 –dsh— c:\documents and settings\compaq_owner.your-f78bf48ce2.005\UserData 2010-06-27 20:39 2,181,376 ——– c:\windows\system32\dllcache\ntoskrnl.exe 2010-06-27 20:39 2,137,088 ——– c:\windows\system32\dllcache\ntkrnlmp.exe 2010-06-27 20:39 2,058,368 ——– c:\windows\system32\dllcache\ntkrnlpa.exe 2010-06-27 20:39 2,016,768 ——– c:\windows\system32\dllcache\ntkrpamp.exe 2010-06-27 20:38 –d—– c:\docume~1\compaq~1.005\applic~1\PreCast 2010-06-27 20:36 221,184 a——- c:\windows\system32\wmpns.dll 2010-06-27 20:36 1,852 a–shr– c:\windows\system32\drivers\103C_HP_CPC_PX807AA-ABA SR1575CL NA530_YC_0Pres_QCNH523_E53NAheRED2_47_ISalmon_SASUSTek Computer INC._V1.04_B3.15_T051019_WXH2_L409_M896_J200_7AMD_8Athlon 64_92.41_#050908_N10390900_Z11C1048C_G10396330.MRK 2010-06-27 20:36 –d—– c:\documents and settings\compaq_owner.your-f78bf48ce2.005\WINDOWS 2010-06-27 20:36 –d—– c:\documents and settings\Compaq_Owner.YOUR-F78BF48CE2.005 2010-06-27 20:30 –d—– c:\windows\system32\SoftwareDistribution 2010-06-27 20:28 21,504 a——- c:\windows\system32\hidserv.dll 2010-06-27 20:28 12,160 a——- c:\windows\system32\drivers\mouhid.sys 2010-06-27 20:28 9,600 a——- c:\windows\system32\drivers\hidusb.sys 2010-06-27 19:50 –dshr– c:\windows\system32\dllcache 2010-06-26 12:50 –d—– c:\docume~1\alluse~1\applic~1\NortonInstaller 2010-06-26 12:47 –d—– c:\docume~1\alluse~1\applic~1\Norton 2010-06-26 10:55 –d—– c:\docume~1\alluse~1\applic~1\Norton Installer 2010-06-26 10:53 –d—– c:\program files\Norton Utilities 14 2010-06-25 22:51 –d—– C:\e10946a8e70c4d3cdb21 2010-06-24 23:34 19,569 a——- c:\windows\005189_.tmp 2010-06-24 23:34 1,033,728 a——- c:\windows\SET434D.tmp 2010-06-20 12:31 –d—– c:\windows\ie8updates 2010-06-20 11:30 -cd-h— c:\windows\ie8 2010-06-20 11:25 –d—– c:\docume~1\alluse~1\applic~1\Autorun Eater 2010-06-20 11:25 –d—– c:\program files\Autorun Eater ==================== Find3M ==================== 2010-05-06 00:41 916,480 a——- c:\windows\system32\wininet.dll 2010-05-06 00:41 916,480 ——– c:\windows\system32\dllcache\wininet.dll 2010-05-06 00:41 5,950,976 ——– c:\windows\system32\dllcache\mshtml.dll 2010-05-06 00:41 1,209,344 ——– c:\windows\system32\dllcache\urlmon.dll 2010-05-06 00:41 611,840 ——– c:\windows\system32\dllcache\mstime.dll 2010-05-06 00:41 206,848 ——– c:\windows\system32\dllcache\occache.dll 2010-05-06 00:41 25,600 ——– c:\windows\system32\dllcache\jsproxy.dll 2010-05-06 00:41 184,320 ——– c:\windows\system32\dllcache\iepeers.dll 2010-05-06 00:41 387,584 ——– c:\windows\system32\dllcache\iedkcs32.dll 2010-05-05 03:30 173,056 ——– c:\windows\system32\dllcache\ie4uinit.exe 2010-05-01 19:56 1,850,880 a——- c:\windows\system32\win32k.sys 2010-05-01 19:56 1,850,880 a——- c:\windows\system32\dllcache\win32k.sys 2010-04-19 19:51 285,696 a——- c:\windows\system32\dllcache\atmfd.dll 2010-04-19 19:51 285,696 a——- c:\windows\system32\atmfd.dll 2010-04-16 05:36 1,506,304 a——- c:\windows\system32\dllcache\shdocvw.dll 2010-04-16 05:36 474,112 a——- c:\windows\system32\dllcache\shlwapi.dll 2010-04-16 05:36 1,054,208 a——- c:\windows\system32\dllcache\danim.dll 2010-04-16 05:36 55,808 a——- c:\windows\system32\dllcache\extmgr.dll 2010-04-16 05:36 1,023,488 a——- c:\windows\system32\dllcache\browseui.dll 2010-04-16 05:36 151,040 a——- c:\windows\system32\dllcache\cdfview.dll 2010-04-16 03:36 18,432 a——- c:\windows\system32\dllcache\iedw.exe 2010-04-03 03:33 2,365,288 a——- c:\windows\system32\dllcache\WMVCore.dll 2010-01-11 12:57 2,516 a–sh— c:\docume~1\alluse~1\applic~1\KGyGaAvL.sys 2010-01-11 12:57 88 —shr– c:\docume~1\alluse~1\applic~1\70075C2739.sys ============= FINISH: 23:40:36.90 =============== UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT DDS (Ver_09-06-26.01) Microsoft Windows XP Home Edition Boot Device: \Device\HarddiskVolume2 Install Date: 6/27/2010 8:34:19 PM System Uptime: 6/28/2010 9:56:29 AM (14 hours ago) Motherboard: ASUSTek Computer INC. | | Salmon Processor: AMD Athlon™ 64 Processor 3400+ | Socket 754 | 1808/200mhz ==== Disk Partitions ========================= C: is FIXED (NTFS) - 180 GiB total, 125.025 GiB free. D: is FIXED (FAT32) - 6 GiB total, 0.983 GiB free. E: is CDROM () F: is Removable G: is Removable H: is Removable I: is Removable ==== Disabled Device Manager Items ============= ==== System Restore Points =================== RP1: 6/27/2010 8:49:52 PM - Software Distribution Service 3.0 RP2: 6/28/2010 8:51:55 AM - Software Distribution Service 3.0 RP3: 6/28/2010 9:18:55 AM - Software Distribution Service 3.0 RP4: 6/28/2010 9:58:56 AM - Software Distribution Service 3.0 ==== Installed Programs ====================== Adobe Acrobat - Reader 6.0.2 Update Adobe Download Manager Adobe Flash Player 10 ActiveX Adobe Reader 6.0.1 Agere Systems PCI Soft Modem Blackhawk Striker 2 from Compaq (remove only) Blasterball 2 from Compaq (remove only) Blasterball 2 Holidays from Compaq (remove only) Blasterball 2 Remix from Compaq (remove only) Bounce Symphony from Compaq (remove only) Compaq Connections Compaq Organize Crystal Maze from Compaq (remove only) Easy Internet Sign-up Final Drive Nitro from Compaq (remove only) Google Toolbar for Internet Explorer Help and Support Additions Hotfix for Windows XP (KB952287) Hotfix for Windows XP (KB981793) HP Boot Optimizer HP Help and Support 4.0 HpSdpAppCoreApp InterVideo WinDVD Player iTunes J2SE Runtime Environment 5.0 KBD Lexibox Deluxe from Compaq (remove only) Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Security Update (KB979906) Microsoft Kernel-Mode Driver Framework Feature Pack 1.5 Microsoft Office Standard Edition 2003 Microsoft Plus! Dancer LE Microsoft Plus! Digital Media Edition Installer Microsoft Plus! Photo Story 2 LE Microsoft Works MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) Norton Internet Security Norton Utilities Overball from Compaq (remove only) PC-Doctor for Windows Phoenix Assault from Compaq (remove only) Polar Bowler from Compaq (remove only) Polar Golfer from Compaq (remove only) PS2 Python 2.2 pywin32 extensions (build 203) Python 2.2.3 QuickTime RealPlayer Remove Adobe Photoshop Album 2.0 Starter Edition installer Remove Microsoft Money 2005 installer Remove Quicken New User Edition installer Remove WeatherBug installer Security Update for Step By Step Interactive Training (KB923723) Security Update for Windows Internet Explorer 8 (KB982381) Security Update for Windows Media Player (KB952069) Security Update for Windows Media Player (KB954155) Security Update for Windows Media Player (KB973540) Security Update for Windows Media Player (KB978695) Security Update for Windows XP (KB923561) Security Update for Windows XP (KB941569) Security Update for Windows XP (KB944338-v2) Security Update for Windows XP (KB946648) Security Update for Windows XP (KB950760) Security Update for Windows XP (KB950762) Security Update for Windows XP (KB950974) Security Update for Windows XP (KB951376-v2) Security Update for Windows XP (KB951748) Security Update for Windows XP (KB952004) Security Update for Windows XP (KB952954) Security Update for Windows XP (KB955069) Security Update for Windows XP (KB956572) Security Update for Windows XP (KB956802) Security Update for Windows XP (KB956803) Security Update for Windows XP (KB956844) Security Update for Windows XP (KB958470) Security Update for Windows XP (KB958644) Security Update for Windows XP (KB958869) Security Update for Windows XP (KB959426) Security Update for Windows XP (KB960225) Security Update for Windows XP (KB960803) Security Update for Windows XP (KB960859) Security Update for Windows XP (KB961501) Security Update for Windows XP (KB969059) Security Update for Windows XP (KB970238) Security Update for Windows XP (KB971468) Security Update for Windows XP (KB971657) Security Update for Windows XP (KB971961) Security Update for Windows XP (KB972270) Security Update for Windows XP (KB973507) Security Update for Windows XP (KB973869) Security Update for Windows XP (KB973904) Security Update for Windows XP (KB974112) Security Update for Windows XP (KB974318) Security Update for Windows XP (KB974392) Security Update for Windows XP (KB974571) Security Update for Windows XP (KB975025) Security Update for Windows XP (KB975467) Security Update for Windows XP (KB975560) Security Update for Windows XP (KB975561) Security Update for Windows XP (KB975562) Security Update for Windows XP (KB975713) Security Update for Windows XP (KB977816) Security Update for Windows XP (KB977914) Security Update for Windows XP (KB978037) Security Update for Windows XP (KB978338) Security Update for Windows XP (KB978542) Security Update for Windows XP (KB978601) Security Update for Windows XP (KB978706) Security Update for Windows XP (KB979309) Security Update for Windows XP (KB979482) Security Update for Windows XP (KB979559) Security Update for Windows XP (KB979683) Security Update for Windows XP (KB980195) Security Update for Windows XP (KB980218) Security Update for Windows XP (KB980232) Security Update for Windows XP (KB981350) Security Update for Windows XP (KB982381) Shooting Stars Pool from Compaq (remove only) SiS VGA Utilities Slyder from Compaq (remove only) Sonic Express Labeler Sonic MyDVD Plus Sonic RecordNow Audio Sonic RecordNow Copy Sonic RecordNow Data Sonic Update Manager SpySubtract Super Granny from Compaq (remove only) Tradewinds from Compaq (remove only) Update for Windows Internet Explorer 8 (KB982632) Update for Windows XP (KB898461) Update for Windows XP (KB955759) Update for Windows XP (KB967715) Update for Windows XP (KB968389) Update for Windows XP (KB973687) Update for Windows XP (KB973815) WebFldrs XP Windows Installer 3.1 (KB893803) Windows Internet Explorer 8 Windows Media Format Runtime Windows Media Player 10 Windows XP Hotfix - KB867282 Windows XP Hotfix - KB873339 Windows XP Hotfix - KB883667 Windows XP Hotfix - KB885250 Windows XP Hotfix - KB885835 Windows XP Hotfix - KB885836 Windows XP Hotfix - KB887472 Windows XP Hotfix - KB887742 Windows XP Hotfix - KB888113 Windows XP Hotfix - KB888239 Windows XP Hotfix - KB890175 Windows XP Hotfix - KB891781 Yahoo! Install Manager Yahoo! Search Protection Yahoo! Software Update Yahoo! Toolbar ==== Event Viewer Messages From Past Week ======== 6/28/2010 8:49:50 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Yahoo! Updater service to connect. 6/28/2010 8:49:50 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Automatic LiveUpdate Scheduler service to connect. 6/28/2010 8:49:50 AM, error: Service Control Manager [7000] - The Yahoo! Updater service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion. 6/28/2010 8:49:50 AM, error: Service Control Manager [7000] - The Automatic LiveUpdate Scheduler service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion. ==== End Of File ===========================

Jack&Jill

Post #2June 29, 2010, 4:37 PM UTC

Hello and welcome to What The Tech.

I am currently assessing your situation and will be back with a fix for your problem as soon as possible.

Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this, click Options, then click Track this topic. Please select Immediate Email Notification for the topic subscription, then click Proceed.

Please be patient with me during this time.

Jack&Jill

Post #3June 30, 2010, 2:00 AM UTC

Hello LastPaladin :),

Welcome to What The Tech. I am Jack&Jill, and I will be helping you out.

Before we go further, there are a few things that I would like to make clear so that we are share the same understanding.

Please observe and follow these Terms of Use and the rules in Are you Infected? Getting Started: How To Get Help.
Any advice is for your computer only and is taken at your own risk. Fixes sometimes will cause unexpected results, but I will do my best to assist you.
Please read the instructions carefully and follow them closely, in the order they are presented to you.
If you have any doubts or problems during the fix, please stop and ask.
All the tools that I will ask you to download and use are safe. Please allow if prompted by any of your security softwares.
Do not use or run any malware cleaning tools without supervision as they may cause more harm if improperly used.
Refrain from installing any new programs except those that I request during the fix to prevent interference to my diagnosis of the problem.
Lack of malware symptoms does not mean your computer is clean. Stick to this topic until I give the All Clear.
If you do not reply within 3 days, this topic will be closed.

If you are agreeable to the above, then everything should go smoothly

. We may begin.

——————–

I do not see anything major from your log. Did your problem occur after you deleted or removed something? Anything out of the ordinary that you do before the symptoms appear? Does it begin as soon as Windows is started? Do you experience any other problems?

We need to look deeper.

——————–

Please download OTL© by OldTimer and save it to your desktop. Click here.

Double click on OTL.exe to run it.
Make sure all the Use SafeList options is checked (ticked). There are six of them.
Check Scan All Users.
At the lower right corner, check LOP Check and Purity Check.
Click on Run Scan at the top left hand corner. This might take a while.
When done, two Notepad files will open. Please post the contents of these 2 Notepad files in your next reply. One log per reply please.
Note: These files are saved as OTL.txt and Extras.txt on the desktop.

——————–

Please post back:
1. the answers to my questions
2. OTL logs (OTL.txt and Extras.txt)

LastPaladin

Post #4June 30, 2010, 9:25 AM UTC

Answers to questions:

1. I did delete several files that I never use. Mostly the games that came with the computer (Polar bowler, Polar golfer, etc.) and a few others. However the problem didn't start until two to three days later.

2. I've deleted these items before so it wasn't out of the ordinary. They usually get re-installed when I have to do a system restore. That's why they're there now.

3. Yes, it now starts before I even get the chance to click on anything or push any buttons.

4. No, it's only this and what it may be affecting. I.E.: I can't watch videos "full screen" because this thing puts it back into the small window when it pops up.

1st Log:

OTL logfile created on: 6/29/2010 11:01:52 PM - Run 1
OTL by OldTimer - Version 3.2.7.0 Folder = C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\Desktop
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

895.00 Mb Total Physical Memory | 358.00 Mb Available Physical Memory | 40.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 74.00% Paging File free
Paging file location(s): C:\pagefile.sys 1344 2688 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 180.31 Gb Total Space | 124.48 Gb Free Space | 69.04% Space Free | Partition Type: NTFS
Drive D: | 5.99 Gb Total Space | 0.98 Gb Free Space | 16.42% Space Free | Partition Type: FAT32
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: YOUR-F78BF48CE2
Current User Name: Compaq_Owner
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Processes (SafeList) ==========

PRC - [2010/06/29 23:00:04 | 000,574,464 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\Desktop\OTL.exe
PRC - [2010/06/28 09:57:27 | 004,105,576 | —- | M] (Symantec Corporation) – C:\Program Files\Norton Utilities 14\nu.exe
PRC - [2010/06/02 14:50:58 | 001,144,104 | —- | M] () – C:\Program Files\DivX\DivX Update\DivXUpdate.exe
PRC - [2010/02/25 14:21:50 | 000,126,392 | R— | M] (Symantec Corporation) – C:\Program Files\Norton Internet Security\Engine\17.7.0.12\ccsvchst.exe
PRC - [2008/11/09 10:48:14 | 000,602,392 | —- | M] (Yahoo! Inc.) – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
PRC - [2008/02/12 07:24:26 | 001,811,120 | —- | M] () – C:\Program Files\Ocucom\PreCast\tmon.exe
PRC - [2005/05/14 02:30:01 | 001,191,936 | —- | M] (InterMute, Inc.) – C:\Program Files\InterMute\SpySubtract\SpySub.exe
PRC - [2005/05/14 02:04:04 | 000,036,972 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Java\jre1.5.0\bin\jusched.exe
PRC - [2005/01/04 20:52:52 | 000,331,776 | —- | M] (Silicon Integrated Systems Corporation) – C:\WINDOWS\system32\sistray.exe
PRC - [2004/08/04 02:00:00 | 001,032,192 | —- | M] (Microsoft Corporation) – C:\WINDOWS\explorer.exe
PRC - [2003/04/09 18:11:12 | 000,028,672 | —- | M] (Hewlett-Packard) – C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
PRC - [2003/04/09 17:41:38 | 000,323,646 | —- | M] (Hewlett-Packard Co.) – C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe

========== Modules (SafeList) ==========

MOD - [2010/06/29 23:00:04 | 000,574,464 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\Desktop\OTL.exe
MOD - [2010/05/13 19:35:01 | 000,415,088 | R— | M] (Symantec Corporation) – C:\Program Files\Norton Internet Security\Engine\17.7.0.12\asoehook.dll
MOD - [2009/07/11 21:02:02 | 000,653,120 | R— | M] (Microsoft Corporation) – C:\Program Files\Norton Internet Security\Engine\17.7.0.12\microsoft.vc90.crt\msvcr90.dll
MOD - [2009/07/11 21:02:00 | 000,569,664 | R— | M] (Microsoft Corporation) – C:\Program Files\Norton Internet Security\Engine\17.7.0.12\microsoft.vc90.crt\msvcp90.dll
MOD - [2004/08/04 08:00:00 | 001,050,624 | —- | M] (Microsoft Corporation) – C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll
MOD - [2004/08/04 02:00:00 | 000,102,400 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\msscript.ocx

========== Win32 Services (SafeList) ==========

SRV - [2010/02/25 14:21:50 | 000,126,392 | R— | M] (Symantec Corporation) [Unknown | Running] – C:\Program Files\Norton Internet Security\Engine\17.7.0.12\ccSvcHst.exe – (NIS)
SRV - [2008/11/09 10:48:14 | 000,602,392 | —- | M] (Yahoo! Inc.) [Auto | Running] – C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe – (YahooAUService)

========== Driver Services (SafeList) ==========

DRV - [2010/06/28 09:27:52 | 001,347,504 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.6.0.32\Definitions\VirusDefs\20100629.020\NAVEX15.SYS – (NAVEX15)
DRV - [2010/06/28 09:27:52 | 000,085,552 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.6.0.32\Definitions\VirusDefs\20100629.020\NAVENG.SYS – (NAVENG)
DRV - [2010/06/28 09:27:51 | 000,371,248 | —- | M] (Symantec Corporation) [Kernel | System | Running] – C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys – (eeCtrl)
DRV - [2010/06/28 09:27:51 | 000,102,448 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys – (EraserUtilRebootDrv)
DRV - [2010/06/28 09:25:14 | 000,124,976 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\SYMEVENT.SYS – (SymEvent)
DRV - [2010/06/19 00:46:00 | 000,691,248 | —- | M] (Symantec Corporation) [Kernel | System | Running] – C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.6.0.32\Definitions\BASHDefs\20100619.001\BHDrvx86.sys – (BHDrvx86)
DRV - [2010/05/28 09:33:19 | 000,331,640 | —- | M] (Symantec Corporation) [Kernel | On_Demand | Running] – C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.6.0.32\Definitions\IPSDefs\20100629.001\IDSXpx86.sys – (IDSxpx86)
DRV - [2010/05/05 18:01:59 | 000,361,904 | —- | M] (Symantec Corporation) [Kernel | System | Running] – C:\WINDOWS\System32\Drivers\NIS\1107000.00C\SYMTDI.SYS – (SYMTDI)
DRV - [2010/04/28 19:03:51 | 000,116,784 | —- | M] (Symantec Corporation) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\NIS\1107000.00C\Ironx86.SYS – (SymIRON)
DRV - [2010/04/21 17:02:20 | 000,173,104 | —- | M] (Symantec Corporation) [File_System | Boot | Running] – C:\WINDOWS\system32\drivers\NIS\1107000.00C\SYMEFA.SYS – (SymEFA)
DRV - [2010/04/21 16:29:50 | 000,325,680 | —- | M] (Symantec Corporation) [File_System | System | Running] – C:\WINDOWS\System32\Drivers\NIS\1107000.00C\SRTSP.SYS – (SRTSP)
DRV - [2010/04/21 16:29:50 | 000,043,696 | —- | M] (Symantec Corporation) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\NIS\1107000.00C\SRTSPX.SYS – (SRTSPX) Symantec Real Time Storage Protection (PEL)
DRV - [2010/02/25 14:22:57 | 000,501,888 | —- | M] (Symantec Corporation) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\NIS\1107000.00C\ccHPx86.sys – (ccHP)
DRV - [2010/02/03 15:40:47 | 000,328,752 | R— | M] (Symantec Corporation) [Kernel | Boot | Running] – C:\WINDOWS\system32\drivers\NIS\1107000.00C\SYMDS.SYS – (SymDS)
DRV - [2009/05/09 01:14:20 | 000,014,736 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\nuidfltr.sys – (NuidFltr)
DRV - [2005/04/20 11:00:56 | 002,317,696 | —- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\ALCXWDM.SYS – (ALCXWDM) Service for Realtek AC97 Audio (WDM)
DRV - [2005/04/12 11:42:16 | 000,011,904 | —- | M] (Silicon Integrated Systems Corporation) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\srvkp.sys – (SiSkp)
DRV - [2005/04/12 11:08:44 | 000,247,296 | —- | M] (Silicon Integrated Systems Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\sisgrp.sys – (SiS315)
DRV - [2005/03/09 11:53:00 | 000,036,352 | —- | M] (Advanced Micro Devices) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\AmdK8.sys – (AmdK8)
DRV - [2005/01/19 14:21:56 | 000,012,416 | —- | M] (Windows ® 2000 DDK provider) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\PcdrNdisuio.sys – (PcdrNdisuio)
DRV - [2004/08/03 18:31:34 | 000,020,992 | —- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\RTL8139.sys – (rtl8139) Realtek RTL8139(A/B/C)
DRV - [2004/06/29 07:07:18 | 001,268,204 | —- | M] (Agere Systems) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\AGRSM.sys – (AgereSoftModem)
DRV - [2003/12/02 15:23:20 | 000,142,336 | —- | M] (Promise Technology, Inc.) [Kernel | Boot | Running] – C:\WINDOWS\system32\DRIVERS\fasttx2k.sys – (fasttx2k)
DRV - [2003/07/11 12:28:56 | 000,032,768 | —- | M] (SiS Corporation) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\sisnic.sys – (SISNIC)
DRV - [2002/07/29 11:43:50 | 000,023,808 | —- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Running] – C:\WINDOWS\system32\drivers\PS2.sys – (Ps2)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf;=desktop

IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…arm1=seconduser
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…arm1=seconduser
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…arm1=seconduser
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…arm1=seconduser
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…arm1=seconduser
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…arm1=seconduser
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…arm1=seconduser
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…arm1=seconduser
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-181441672-238794695-2266662844-1009\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf;=desktop
IE - HKU\S-1-5-21-181441672-238794695-2266662844-1009\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf;=desktop
IE - HKU\S-1-5-21-181441672-238794695-2266662844-1009\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ycomp/def…//www.yahoo.com
IE - HKU\S-1-5-21-181441672-238794695-2266662844-1009\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/?fr=fp-sem
IE - HKU\S-1-5-21-181441672-238794695-2266662844-1009\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn17\yt.dll (Yahoo! Inc.)
IE - HKU\S-1-5-21-181441672-238794695-2266662844-1009\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.6.0.32\IPSFFPlgn\ [2010/06/28 09:34:28 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.6.0.32\coFFPlgn\ [2010/06/28 09:25:38 | 000,000,000 | —D | M]

O1 HOSTS File: ([2004/08/04 08:00:00 | 000,000,734 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (&Yahoo;! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn17\yt.dll (Yahoo! Inc.)
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Yahooo Search Protection) - {25BC7718-0BFA-40EA-B381-4B2D9732D686} - C:\Program Files\Yahoo!\Search Protection\ysp.dll (Yahoo! Inc.)
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\17.7.0.12\coieplg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\17.7.0.12\ipsbho.dll (Symantec Corporation)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O2 - BHO: (CNavExtBho Class) - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll File not found
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn17\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (&Google;) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\17.7.0.12\coieplg.dll (Symantec Corporation)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn17\yt.dll (Yahoo! Inc.)
O3 - HKU\S-1-5-21-181441672-238794695-2266662844-1009\..\Toolbar\WebBrowser: (&Google;) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O3 - HKU\S-1-5-21-181441672-238794695-2266662844-1009\..\Toolbar\WebBrowser: (Norton AntiVirus) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll File not found
O3 - HKU\S-1-5-21-181441672-238794695-2266662844-1009\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\17.7.0.12\coieplg.dll (Symantec Corporation)
O3 - HKU\S-1-5-21-181441672-238794695-2266662844-1009\..\Toolbar\WebBrowser: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn17\yt.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [HPBootOp] C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\LSBurnWatcher.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [regcmdcons] c:\hp\bin\cloaker.exe (Hewlett-Packard Co.)
O4 - HKLM..\Run: [SiSPower] C:\WINDOWS\System32\SiSPower.dll (Silicon Integrated Systems Corporation)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKU\S-1-5-21-181441672-238794695-2266662844-1009..\Run: [NortonUtilities] C:\Program Files\Norton Utilities 14\nu.exe (Symantec Corporation)
O4 - HKU\S-1-5-21-181441672-238794695-2266662844-1009..\Run: [YSearchProtection] C:\Program Files\Yahoo!\Search Protection\YspService.exe (Yahoo! Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe (Hewlett-Packard Co.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hpoddt01.exe.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe (Hewlett-Packard)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\PreCast Monitor.lnk = C:\Program Files\Ocucom\PreCast\tmon.exe ()
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\SpySubtract.lnk = C:\Program Files\InterMute\SpySubtract\sslaunch.exe (InterMute, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe (Silicon Integrated Systems Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-181441672-238794695-2266662844-1009\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: &Google; Search - C:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O8 - Extra context menu item: Backward Links - C:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O8 - Extra context menu item: Cached Snapshot of Page - C:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O8 - Extra context menu item: Similar Pages - C:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O8 - Extra context menu item: Translate into English - C:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\NPJPI150.dll (Sun Microsystems, Inc.)
O9 - Extra Button: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm ()
O9 - Extra 'Tools' menuitem : Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm ()
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\Common\Yinsthelper.dll (Installation Support)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0)
O16 - DPF: {CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed] [removed]
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\Local Settings\Application Data\Microsoft\Wallpaper2.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\Local Settings\Application Data\Microsoft\Wallpaper2.bmp
O28 - HKLM ShellExecuteHooks: {FA010552-4A27-4cb1-A1BB-3E2D697F1639} - Reg Error: Key error. File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005/01/26 18:53:38 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2001/07/28 07:07:38 | 000,000,000 | -HS- | M] () - D:\AUTOEXEC.BAT – [ FAT32 ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/06/29 23:00:01 | 000,574,464 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\Desktop\OTL.exe
[2010/06/29 10:56:37 | 000,000,000 | —D | C] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\Application Data\Sun
[2010/06/29 10:50:09 | 000,000,000 | —D | C] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\Application Data\DivX
[2010/06/29 10:49:34 | 000,133,616 | —- | C] (Sonic Solutions) – C:\WINDOWS\System32\pxafs.dll
[2010/06/29 10:49:34 | 000,126,448 | —- | C] (Sonic Solutions) – C:\WINDOWS\System32\pxinsi64.exe
[2010/06/29 10:49:34 | 000,123,888 | —- | C] (Sonic Solutions) – C:\WINDOWS\System32\pxcpyi64.exe
[2010/06/29 10:49:34 | 000,072,176 | —- | C] (Sonic Solutions) – C:\WINDOWS\System32\pxhpinst.exe
[2010/06/29 10:49:34 | 000,068,592 | —- | C] (Sonic Solutions) – C:\WINDOWS\System32\pxinsa64.exe
[2010/06/29 10:49:34 | 000,068,080 | —- | C] (Sonic Solutions) – C:\WINDOWS\System32\pxcpya64.exe
[2010/06/29 10:49:34 | 000,009,200 | —- | C] (Sonic Solutions) – C:\WINDOWS\System32\drivers\cdralw2k.sys
[2010/06/29 10:49:34 | 000,009,072 | —- | C] (Sonic Solutions) – C:\WINDOWS\System32\drivers\cdr4_xp.sys
[2010/06/29 10:45:30 | 000,895,256 | —- | C] (DivX, Inc. ) – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\Desktop\DivXInstaller.exe
[2010/06/29 08:46:30 | 000,000,000 | —D | C] – C:\WINDOWS\LastGood
[2010/06/28 10:50:25 | 000,000,000 | —D | C] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\Application Data\Adobe
[2010/06/28 10:43:23 | 000,000,000 | -HSD | C] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\IECompatCache
[2010/06/28 10:38:36 | 000,000,000 | -HSD | C] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\PrivacIE
[2010/06/28 10:35:46 | 000,000,000 | -HSD | C] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\IETldCache
[2010/06/28 10:28:41 | 000,055,296 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msfeedsbs.dll
[2010/06/28 10:28:40 | 000,599,040 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msfeeds.dll
[2010/06/28 10:28:39 | 001,985,536 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iertutil.dll
[2010/06/28 10:28:37 | 011,076,096 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ieframe.dll
[2010/06/28 10:28:37 | 000,743,424 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iedvtool.dll
[2010/06/28 10:17:47 | 000,000,000 | —D | C] – C:\WINDOWS\System32\en-US
[2010/06/28 10:00:38 | 000,000,000 | —D | C] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\Application Data\Norton Utilities 14
[2010/06/28 09:53:52 | 001,101,824 | —- | C] (Woodbury Associates Limited) – C:\WINDOWS\System32\UniBox210.ocx
[2010/06/28 09:53:52 | 000,880,640 | —- | C] (Woodbury Associates Limited) – C:\WINDOWS\System32\UniBox10.ocx
[2010/06/28 09:53:52 | 000,212,992 | —- | C] (Woodbury Associates Limited) – C:\WINDOWS\System32\UniBoxVB12.ocx
[2010/06/28 09:30:34 | 000,361,904 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\NIS\1107000.00C\symtdi.sys
[2010/06/28 09:30:34 | 000,339,504 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\NIS\1107000.00C\symtdiv.sys
[2010/06/28 09:30:34 | 000,173,104 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\NIS\1107000.00C\symefa.sys
[2010/06/28 09:30:33 | 000,501,888 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\NIS\1107000.00C\cchpx86.sys
[2010/06/28 09:30:33 | 000,328,752 | R— | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\NIS\1107000.00C\symds.sys
[2010/06/28 09:30:33 | 000,325,680 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\NIS\1107000.00C\srtsp.sys
[2010/06/28 09:30:33 | 000,116,784 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\NIS\1107000.00C\ironx86.sys
[2010/06/28 09:30:33 | 000,043,696 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\NIS\1107000.00C\srtspx.sys
[2010/06/28 09:30:04 | 000,000,000 | —D | C] – C:\WINDOWS\System32\drivers\NIS\1107000.00C
[2010/06/28 09:25:14 | 000,124,976 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\drivers\SYMEVENT.SYS
[2010/06/28 09:25:14 | 000,060,808 | —- | C] (Symantec Corporation) – C:\WINDOWS\System32\S32EVNT1.DLL
[2010/06/28 09:24:30 | 000,000,000 | —D | C] – C:\WINDOWS\System32\drivers\NIS
[2010/06/28 09:24:26 | 000,000,000 | —D | C] – C:\Program Files\Norton Internet Security
[2010/06/28 09:23:50 | 000,000,000 | —D | C] – C:\Program Files\NortonInstaller
[2010/06/28 09:07:40 | 000,021,504 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\drivers\hidserv.dll
[2010/06/28 00:26:49 | 000,000,000 | —D | C] – C:\WINDOWS\System32\CatRoot_bak
[2010/06/28 00:23:36 | 000,000,000 | —D | C] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\Local Settings\Application Data\Yahoo
[2010/06/28 00:22:25 | 000,000,000 | —D | C] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\Application Data\Yahoo!
[2010/06/28 00:22:07 | 000,454,016 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mrxsmb.sys
[2010/06/28 00:22:01 | 000,048,128 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\iyuv_32.dll
[2010/06/28 00:22:01 | 000,008,704 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\tsbyuv.dll
[2010/06/28 00:21:41 | 000,017,920 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\msyuv.dll
[2010/06/28 00:19:59 | 000,272,128 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\bthport.sys
[2010/06/28 00:18:38 | 000,352,768 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\xpsp3res.dll
[2010/06/28 00:17:20 | 000,000,000 | RHSD | C] – C:\cmdcons
[2010/06/28 00:17:01 | 000,000,000 | —D | C] – C:\WINDOWS\setupupd
[2010/06/27 23:51:30 | 000,000,000 | —D | C] – C:\WINDOWS\System32\PreInstall
[2010/06/27 23:51:26 | 000,026,144 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\spupdsvc.exe
[2010/06/27 20:39:56 | 000,000,000 | -HSD | C] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\UserData
[2010/06/27 20:39:52 | 000,000,000 | —D | C] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\Application Data\Macromedia
[2010/06/27 20:39:04 | 002,181,376 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ntoskrnl.exe
[2010/06/27 20:39:03 | 002,137,088 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ntkrnlmp.exe
[2010/06/27 20:39:03 | 002,058,368 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ntkrnlpa.exe
[2010/06/27 20:39:03 | 002,016,768 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\ntkrpamp.exe
[2010/06/27 20:38:16 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\Recent
[2010/06/27 20:38:15 | 000,000,000 | —D | C] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\Application Data\PreCast
[2010/06/27 20:36:12 | 000,000,000 | –SD | C] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\Application Data\Microsoft
[2010/06/27 20:36:12 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\Application Data
[2010/06/27 20:36:12 | 000,000,000 | R–D | C] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\Favorites
[2010/06/27 20:36:12 | 000,000,000 | -HSD | C] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\Cookies
[2010/06/27 20:36:12 | 000,000,000 | —D | C] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\Application Data\SampleView
[2010/06/27 20:36:12 | 000,000,000 | —D | C] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\Application Data\Real
[2010/06/27 20:36:12 | 000,000,000 | —D | C] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\Local Settings\Application Data\Microsoft
[2010/06/27 20:36:12 | 000,000,000 | —D | C] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\Application Data\InterMute
[2010/06/27 20:36:12 | 000,000,000 | —D | C] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\Application Data\Identities
[2010/06/27 20:36:12 | 000,000,000 | —D | C] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\Local Settings\Application Data\Google
[2010/06/27 20:36:12 | 000,000,000 | —D | C] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\Desktop
[2010/06/27 20:36:12 | 000,000,000 | —D | C] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\Local Settings\Application Data\ApplicationHistory
[2010/06/27 20:36:12 | 000,000,000 | —D | C] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\Local Settings\Application Data\Apple Computer
[2010/06/27 20:36:12 | 000,000,000 | —D | C] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\Application Data\Apple Computer
[2010/06/27 20:36:12 | 000,000,000 | —D | C] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\Local Settings\Application Data\{3248F0A6-6813-11D6-A77B-00B0D0150000}
[2010/06/27 20:36:11 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\SendTo
[2010/06/27 20:36:11 | 000,000,000 | R–D | C] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\My Documents\My Videos
[2010/06/27 20:36:11 | 000,000,000 | R–D | C] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\My Documents\My Pictures
[2010/06/27 20:36:11 | 000,000,000 | R–D | C] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\My Documents\My Music
[2010/06/27 20:36:11 | 000,000,000 | R–D | C] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\My Documents
[2010/06/27 20:36:11 | 000,000,000 | -H-D | C] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\PrintHood
[2010/06/27 20:36:11 | 000,000,000 | -H-D | C] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\NetHood
[2010/06/27 20:36:11 | 000,000,000 | -H-D | C] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\Local Settings
[2010/06/27 20:36:10 | 000,000,000 | R–D | C] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\Start Menu
[2010/06/27 20:36:10 | 000,000,000 | -H-D | C] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\Templates
[2010/06/27 20:36:10 | 000,000,000 | —D | C] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\WINDOWS
[2010/06/27 20:30:49 | 000,000,000 | —D | C] – C:\WINDOWS\System32\SoftwareDistribution
[2010/06/27 20:30:21 | 000,000,000 | —D | C] – C:\WINDOWS\Prefetch
[2010/06/27 19:50:52 | 000,000,000 | RHSD | C] – C:\WINDOWS\System32\dllcache
[2010/06/26 13:22:32 | 000,000,000 | —D | C] – C:\Program Files\Windows Sidebar
[2010/06/26 12:50:53 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\NortonInstaller
[2010/06/26 12:47:59 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Documents\Norton
[2010/06/26 12:47:58 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Norton
[2010/06/26 10:55:33 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Norton Installer
[2010/06/26 10:53:46 | 000,000,000 | —D | C] – C:\Program Files\Norton Utilities 14
[2010/06/25 22:51:49 | 000,000,000 | —D | C] – C:\e10946a8e70c4d3cdb21
[2010/06/20 12:31:47 | 000,000,000 | —D | C] – C:\WINDOWS\ie8updates
[2010/06/20 11:30:53 | 000,000,000 | -H-D | C] – C:\WINDOWS\ie8
[2010/06/20 11:25:50 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Autorun Eater
[2010/06/20 11:25:46 | 000,000,000 | —D | C] – C:\Program Files\Autorun Eater
[24 C:\WINDOWS\Fonts\*.tmp files -> C:\WINDOWS\Fonts\*.tmp -> ]
[10 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/06/29 23:00:04 | 000,574,464 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\Desktop\OTL.exe
[2010/06/29 22:59:53 | 001,310,720 | -H– | M] () – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\NTUSER.DAT
[2010/06/29 22:16:00 | 000,000,886 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/06/29 18:00:00 | 000,000,456 | —- | M] () – C:\WINDOWS\tasks\ParetoLogic Registration.job
[2010/06/29 12:21:00 | 000,000,404 | —- | M] () – C:\WINDOWS\tasks\FRU Task #Hewlett-Packard#hp psc 2170 series#1230934797.job
[2010/06/29 12:10:49 | 001,032,742 | —- | M] () – C:\WINDOWS\System32\drivers\NIS\1107000.00C\Cat.DB
[2010/06/29 10:50:30 | 000,001,504 | —- | M] () – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\Desktop\DivX Movies.lnk
[2010/06/29 10:50:00 | 000,000,785 | —- | M] () – C:\Documents and Settings\All Users\Desktop\DivX Plus Player.lnk
[2010/06/29 10:48:55 | 000,000,825 | —- | M] () – C:\Documents and Settings\All Users\Desktop\DivX Plus Converter.lnk
[2010/06/29 10:45:31 | 000,895,256 | —- | M] (DivX, Inc. ) – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\Desktop\DivXInstaller.exe
[2010/06/29 09:19:00 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/06/29 09:12:00 | 000,000,404 | —- | M] () – C:\WINDOWS\tasks\FRU Task #Hewlett-Packard#hp psc 2170 series#1131995486.job
[2010/06/29 08:46:58 | 000,001,158 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/06/29 08:21:17 | 000,003,072 | —- | M] () – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\Cache.db
[2010/06/29 08:16:00 | 000,000,882 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/06/29 03:00:00 | 000,000,330 | -H– | M] () – C:\WINDOWS\tasks\MP Scheduled Scan.job
[2010/06/29 01:06:30 | 000,000,248 | —- | M] () – C:\WINDOWS\System\hpsysdrv.dat
[2010/06/29 00:33:00 | 000,000,430 | —- | M] () – C:\WINDOWS\tasks\ParetoLogic Update Version2.job
[2010/06/29 00:26:21 | 000,000,292 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-1737049430-1430350790-2627329290-1009.job
[2010/06/29 00:26:14 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/06/29 00:26:08 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/06/29 00:26:06 | 939,053,056 | -HS- | M] () – C:\hiberfil.sys
[2010/06/29 00:24:25 | 000,000,178 | -HS- | M] () – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\ntuser.ini
[2010/06/28 10:35:53 | 000,000,823 | —- | M] () – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2010/06/28 10:28:34 | 000,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2010/06/28 09:55:38 | 000,000,731 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Norton Utilities.lnk
[2010/06/28 09:33:03 | 000,001,981 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Norton Internet Security.LNK
[2010/06/28 09:26:41 | 000,441,626 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2010/06/28 09:26:41 | 000,382,022 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/06/28 09:26:41 | 000,053,640 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2010/06/28 09:25:14 | 000,124,976 | —- | M] (Symantec Corporation) – C:\WINDOWS\System32\drivers\SYMEVENT.SYS
[2010/06/28 09:25:14 | 000,060,808 | —- | M] (Symantec Corporation) – C:\WINDOWS\System32\S32EVNT1.DLL
[2010/06/28 09:25:14 | 000,007,443 | —- | M] () – C:\WINDOWS\System32\drivers\SYMEVENT.CAT
[2010/06/28 09:25:14 | 000,000,805 | —- | M] () – C:\WINDOWS\System32\drivers\SYMEVENT.INF
[2010/06/28 09:22:20 | 000,000,783 | —- | M] () – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\Desktop\Norton Installation Files.lnk
[2010/06/28 09:21:43 | 000,169,896 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2010/06/28 09:08:14 | 000,000,000 | -H– | M] () – C:\WINDOWS\System32\drivers\Msft_Kernel_NuidFltr_01005.Wdf
[2010/06/28 09:08:12 | 000,000,000 | -H– | M] () – C:\WINDOWS\System32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
[2010/06/28 00:17:53 | 000,000,283 | RHS- | M] () – C:\boot.ini
[2010/06/27 20:39:40 | 000,002,158 | —- | M] () – C:\WINDOWS\System32\ssmute.ini
[2010/06/27 20:38:50 | 000,000,286 | —- | M] () – C:\WINDOWS\tasks\Easy Internet Sign-up.job
[2010/06/27 20:38:39 | 000,000,742 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Easy Internet Sign-up.lnk
[2010/06/27 20:38:12 | 000,000,601 | —- | M] () – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\Desktop\Register with HP.url
[2010/06/27 20:36:52 | 000,001,852 | RHS- | M] () – C:\WINDOWS\System32\drivers\103C_HP_CPC_PX807AA-ABA SR1575CL NA530_YC_0Pres_QCNH523_E53NAheRED2_47_ISalmon_SASUSTek Computer INC._V1.04_B3.15_T051019_WXH2_L409_M896_J200_7AMD_8Athlon 64_92.41_#050908_N10390900_Z11C1048C_G10396330.MRK
[2010/06/27 20:34:19 | 000,000,993 | —- | M] () – C:\WINDOWS\System32\$winnt$.inf
[2010/06/27 20:34:12 | 000,262,144 | —- | M] () – C:\Documents and Settings\All Users\NTUSER.DAT
[2010/06/27 20:33:14 | 000,000,213 | RHS- | M] () – C:\BOOT.BAK
[2010/06/27 20:29:00 | 000,000,231 | —- | M] () – C:\WINDOWS\system.ini
[2010/06/27 07:36:01 | 000,000,300 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-1737049430-1430350790-2627329290-1009.job
[2010/06/27 04:44:00 | 000,000,394 | —- | M] () – C:\WINDOWS\tasks\DriverCure.job
[2010/06/26 10:20:01 | 000,000,770 | —- | M] () – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\Desktop\F+E (2).lnk
[2010/06/21 06:59:00 | 000,000,304 | —- | M] () – C:\WINDOWS\tasks\Defraggler Volume C Task.job
[2010/06/20 11:25:47 | 000,000,678 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Autorun Eater.lnk
[10 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/06/29 10:50:30 | 000,001,504 | —- | C] () – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\Desktop\DivX Movies.lnk
[2010/06/29 10:50:00 | 000,000,785 | —- | C] () – C:\Documents and Settings\All Users\Desktop\DivX Plus Player.lnk
[2010/06/28 10:36:42 | 000,003,072 | —- | C] () – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\Cache.db
[2010/06/28 09:55:37 | 000,000,731 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Norton Utilities.lnk
[2010/06/28 09:32:17 | 001,032,742 | —- | C] () – C:\WINDOWS\System32\drivers\NIS\1107000.00C\Cat.DB
[2010/06/28 09:30:34 | 000,007,787 | —- | C] () – C:\WINDOWS\System32\drivers\NIS\1107000.00C\symnetv.cat
[2010/06/28 09:30:34 | 000,007,368 | —- | C] () – C:\WINDOWS\System32\drivers\NIS\1107000.00C\symnet.cat
[2010/06/28 09:30:34 | 000,003,373 | —- | C] () – C:\WINDOWS\System32\drivers\NIS\1107000.00C\symefa.inf
[2010/06/28 09:30:34 | 000,001,473 | —- | C] () – C:\WINDOWS\System32\drivers\NIS\1107000.00C\symnetv.inf
[2010/06/28 09:30:34 | 000,001,445 | —- | C] () – C:\WINDOWS\System32\drivers\NIS\1107000.00C\symnet.inf
[2010/06/28 09:30:33 | 000,007,873 | —- | C] () – C:\WINDOWS\System32\drivers\NIS\1107000.00C\symefa.cat
[2010/06/28 09:30:33 | 000,007,442 | —- | C] () – C:\WINDOWS\System32\drivers\NIS\1107000.00C\srtspx.cat
[2010/06/28 09:30:33 | 000,007,438 | —- | C] () – C:\WINDOWS\System32\drivers\NIS\1107000.00C\srtsp.cat
[2010/06/28 09:30:33 | 000,007,438 | —- | C] () – C:\WINDOWS\System32\drivers\NIS\1107000.00C\iron.cat
[2010/06/28 09:30:33 | 000,007,425 | —- | C] () – C:\WINDOWS\System32\drivers\NIS\1107000.00C\symds.cat
[2010/06/28 09:30:33 | 000,002,793 | R— | C] () – C:\WINDOWS\System32\drivers\NIS\1107000.00C\symds.inf
[2010/06/28 09:30:33 | 000,001,754 | —- | C] () – C:\WINDOWS\System32\drivers\NIS\1107000.00C\cchpx86.inf
[2010/06/28 09:30:33 | 000,001,388 | —- | C] () – C:\WINDOWS\System32\drivers\NIS\1107000.00C\srtspx.inf
[2010/06/28 09:30:33 | 000,001,382 | —- | C] () – C:\WINDOWS\System32\drivers\NIS\1107000.00C\srtsp.inf
[2010/06/28 09:30:33 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\drivers\NIS\1107000.00C\iron.inf
[2010/06/28 09:30:32 | 000,007,396 | —- | C] () – C:\WINDOWS\System32\drivers\NIS\1107000.00C\cchpx86.cat
[2010/06/28 09:30:04 | 000,000,172 | —- | C] () – C:\WINDOWS\System32\drivers\NIS\1107000.00C\isolate.ini
[2010/06/28 09:25:14 | 000,007,443 | —- | C] () – C:\WINDOWS\System32\drivers\SYMEVENT.CAT
[2010/06/28 09:25:14 | 000,000,805 | —- | C] () – C:\WINDOWS\System32\drivers\SYMEVENT.INF
[2010/06/28 09:25:04 | 000,001,981 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Norton Internet Security.LNK
[2010/06/28 09:08:14 | 000,000,000 | -H– | C] () – C:\WINDOWS\System32\drivers\Msft_Kernel_NuidFltr_01005.Wdf
[2010/06/28 09:08:12 | 000,000,000 | -H– | C] () – C:\WINDOWS\System32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
[2010/06/28 09:07:21 | 000,000,783 | —- | C] () – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\Desktop\Norton Installation Files.lnk
[2010/06/27 20:38:39 | 000,000,286 | —- | C] () – C:\WINDOWS\tasks\Easy Internet Sign-up.job
[2010/06/27 20:38:11 | 000,000,601 | —- | C] () – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\Desktop\Register with HP.url
[2010/06/27 20:36:30 | 000,001,852 | RHS- | C] () – C:\WINDOWS\System32\drivers\103C_HP_CPC_PX807AA-ABA SR1575CL NA530_YC_0Pres_QCNH523_E53NAheRED2_47_ISalmon_SASUSTek Computer INC._V1.04_B3.15_T051019_WXH2_L409_M896_J200_7AMD_8Athlon 64_92.41_#050908_N10390900_Z11C1048C_G10396330.MRK
[2010/06/27 20:36:23 | 939,053,056 | -HS- | C] () – C:\hiberfil.sys
[2010/06/27 20:36:14 | 000,001,640 | —- | C] () – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\Application Data\Microsoft\Internet Explorer\Quick Launch\iTunes.lnk
[2010/06/27 20:36:14 | 000,001,132 | —- | C] () – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\Desktop\Help and Support.lnk
[2010/06/27 20:36:14 | 000,000,923 | —- | C] () – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\Application Data\Microsoft\Internet Explorer\Quick Launch\RealPlayer.lnk
[2010/06/27 20:36:14 | 000,000,823 | —- | C] () – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2010/06/27 20:36:14 | 000,000,750 | —- | C] () – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\Application Data\Microsoft\Internet Explorer\Quick Launch\QuickTime Player.lnk
[2010/06/27 20:36:14 | 000,000,079 | —- | C] () – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf
[2010/06/27 20:36:10 | 000,053,248 | -H– | C] () – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\ntuser.dat.LOG
[2010/06/27 20:36:10 | 000,000,178 | -HS- | C] () – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\ntuser.ini
[2010/06/27 20:36:09 | 001,310,720 | -H– | C] () – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\NTUSER.DAT
[2010/06/20 11:25:47 | 000,000,678 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Autorun Eater.lnk
[2010/02/09 23:20:20 | 000,767,952 | —- | C] () – C:\WINDOWS\BDTSupport.dll.old
[2010/02/09 23:20:20 | 000,767,952 | —- | C] () – C:\WINDOWS\BDTSupport.dll
[2009/01/02 12:27:06 | 000,000,206 | —- | C] () – C:\WINDOWS\HPGdiPlus.ini
[2008/08/24 21:51:22 | 000,000,037 | —- | C] () – C:\WINDOWS\wwwbatch.ini
[2006/09/05 21:13:42 | 000,000,000 | —- | C] () – C:\WINDOWS\hpqEmlSz.INI
[2005/10/06 22:55:30 | 000,000,081 | —- | C] () – C:\WINDOWS\ImportClient.INI
[2005/10/06 22:33:13 | 000,000,751 | —- | C] () – C:\WINDOWS\Bti.ini
[2005/09/27 20:43:34 | 000,000,246 | —- | C] () – C:\WINDOWS\wininit.ini
[2005/09/08 11:13:06 | 000,000,037 | —- | C] () – C:\WINDOWS\Acroread.ini
[2005/05/14 03:00:54 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2005/05/14 02:58:41 | 000,204,800 | —- | C] () – C:\WINDOWS\System32\IVIresizeW7.dll
[2005/05/14 02:58:41 | 000,200,704 | —- | C] () – C:\WINDOWS\System32\IVIresizeA6.dll
[2005/05/14 02:58:41 | 000,192,512 | —- | C] () – C:\WINDOWS\System32\IVIresizeP6.dll
[2005/05/14 02:58:41 | 000,192,512 | —- | C] () – C:\WINDOWS\System32\IVIresizeM6.dll
[2005/05/14 02:58:41 | 000,188,416 | —- | C] () – C:\WINDOWS\System32\IVIresizePX.dll
[2005/05/14 02:58:41 | 000,020,480 | —- | C] () – C:\WINDOWS\System32\IVIresize.dll
[2005/05/14 02:30:27 | 000,013,975 | —- | C] () – C:\WINDOWS\System32\CHODDI.SYS
[2005/05/14 02:30:22 | 000,045,056 | —- | C] () – C:\WINDOWS\System32\hpreg.dll
[2005/05/14 02:30:02 | 000,002,158 | —- | C] () – C:\WINDOWS\System32\ssmute.ini
[2005/05/14 02:27:33 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2005/05/14 02:14:55 | 000,001,793 | —- | C] () – C:\WINDOWS\System32\fxsperf.ini
[2005/05/14 02:09:14 | 000,094,143 | —- | C] () – C:\WINDOWS\System32\VGAunistlog.ini
[2005/05/14 02:09:14 | 000,083,779 | —- | C] () – C:\WINDOWS\VGAsetup.ini
[2005/05/14 02:00:10 | 000,000,780 | —- | C] () – C:\WINDOWS\orun32.ini
[2005/05/14 01:58:20 | 000,323,584 | —- | C] () – C:\WINDOWS\System32\pythoncom22.dll
[2005/05/14 01:58:20 | 000,094,208 | —- | C] () – C:\WINDOWS\System32\pywintypes22.dll
[2005/05/14 01:57:59 | 000,016,896 | —- | C] () – C:\WINDOWS\System32\bcbmm.dll
[2005/02/18 07:56:18 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini
[2005/01/19 19:45:40 | 000,090,112 | —- | C] () – C:\WINDOWS\System32\PcdrKernelModeServices.dll
[2005/01/19 19:45:40 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\ProgressTrace.dll
[2004/08/04 02:00:00 | 000,027,440 | —- | C] () – C:\WINDOWS\System32\drivers\secdrv.sys
[2004/06/29 14:47:28 | 000,003,072 | —- | C] () – C:\WINDOWS\WinIo.sys
[2004/06/15 18:38:00 | 000,000,592 | —- | C] () – C:\WINDOWS\System32\oeminfo.ini
[2003/04/10 19:04:00 | 000,028,672 | —- | C] () – C:\WINDOWS\System32\JAWTAccessBridge.dll
[2003/01/07 19:05:08 | 000,002,695 | —- | C] () – C:\WINDOWS\System32\OUTLPERF.INI

========== LOP Check ==========

[2010/01/14 16:11:45 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\5600-6600 Series
[2010/06/20 11:26:22 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Autorun Eater
[2010/03/07 19:13:38 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AVG Security Toolbar
[2010/03/07 19:05:37 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\avg9
[2010/04/15 10:19:11 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\DriverCure
[2010/01/15 08:57:55 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Lexmark 5600-6600 Series
[2008/09/15 09:02:39 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\MSScanAppDataDir
[2010/04/03 08:00:38 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\ParetoLogic
[2008/08/25 23:45:55 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PC Drivers HeadQuarters
[2007/06/02 09:02:43 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Quintech
[2010/06/29 08:46:05 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2005/09/23 12:31:57 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Viewpoint
[2008/11/27 16:27:43 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
[2009/11/13 12:15:04 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2005/09/23 12:30:24 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner\Application Data\Aim
[2008/03/23 20:51:21 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner\Application Data\GetRightToGo
[2005/05/14 02:47:13 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner\Application Data\InterMute
[2005/09/08 11:12:51 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner\Application Data\InterTrust
[2005/10/23 03:39:00 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner\Application Data\InterVideo
[2007/05/20 19:53:09 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner\Application Data\Juniper Networks
[2006/08/22 20:31:46 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner\Application Data\Leadertech
[2008/05/17 04:13:26 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner\Application Data\LimeWire
[2007/08/15 00:28:20 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner\Application Data\My Games
[2010/05/02 12:02:33 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner\Application Data\PreCast
[2005/09/23 12:29:57 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner\Application Data\Proof
[2005/05/14 02:42:46 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner\Application Data\SampleView
[2005/09/23 12:30:28 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner\Application Data\Template
[2008/04/01 00:26:14 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner\Application Data\Terrapin
[2010/06/27 11:31:47 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner\Application Data\Tific
[2008/08/28 13:04:22 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2\Application Data\GetRightToGo
[2005/05/14 02:47:13 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2\Application Data\InterMute
[2008/10/03 01:20:47 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2\Application Data\InterVideo
[2008/08/29 06:34:13 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2\Application Data\Leadertech
[2008/08/25 14:18:16 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2\Application Data\PreCast
[2005/05/14 02:42:46 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2\Application Data\SampleView
[2008/10/30 10:59:19 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2\Application Data\Template
[2009/01/04 14:58:13 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.000\Application Data\GetRightToGo
[2005/05/14 02:47:13 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.000\Application Data\InterMute
[2009/01/01 12:55:06 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.000\Application Data\PreCast
[2005/05/14 02:42:46 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.000\Application Data\SampleView
[2010/01/15 08:56:28 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.001\Application Data\5600-6600 Series
[2009/10/07 16:24:37 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.001\Application Data\GetRightToGo
[2005/05/14 02:47:13 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.001\Application Data\InterMute
[2009/12/14 14:38:29 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.001\Application Data\InterVideo
[2010/01/11 12:19:27 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.001\Application Data\Leadertech
[2010/01/15 08:56:48 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.001\Application Data\Lexmark Productivity Studio
[2009/01/08 13:15:11 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.001\Application Data\PreCast
[2010/02/20 07:47:48 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.001\Application Data\Registry Mechanic
[2005/05/14 02:42:46 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.001\Application Data\SampleView
[2009/03/15 16:57:19 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.001\Application Data\Template
[2005/05/14 02:47:13 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.002\Application Data\InterMute
[2010/03/13 18:22:21 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.002\Application Data\PreCast
[2005/05/14 02:42:46 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.002\Application Data\SampleView
[2010/04/03 08:01:14 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.003\Application Data\DriverCure
[2010/05/17 05:32:01 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.003\Application Data\E5E962481DE05DDC6421D0AE2F15A524
[2010/04/30 08:35:37 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.003\Application Data\ezLife
[2005/05/14 02:47:13 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.003\Application Data\InterMute
[2010/03/31 10:46:16 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.003\Application Data\Lexmark Productivity Studio
[2010/03/15 14:19:31 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.003\Application Data\PreCast
[2005/05/14 02:42:46 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.003\Application Data\SampleView
[2010/05/01 21:21:02 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.003\Application Data\Smart-Ads-Solutions
[2010/05/11 10:10:58 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.004\Application Data\ATManager
[2010/05/17 05:31:58 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.004\Application Data\E5E962481DE05DDC6421D0AE2F15A524
[2010/05/11 10:11:03 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.004\Application Data\ezLife
[2005/05/14 02:47:13 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.004\Application Data\InterMute
[2010/05/07 06:23:49 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.004\Application Data\PreCast
[2005/05/14 02:42:46 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.004\Application Data\SampleView
[2010/05/11 10:11:34 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.004\Application Data\Smart-Ads-Solutions
[2005/05/14 02:47:13 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\Application Data\InterMute
[2010/06/27 20:38:16 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\Application Data\PreCast
[2005/05/14 02:42:46 | 000,000,000 | —D | M] – C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\Application Data\SampleView
[2005/05/14 02:47:13 | 000,000,000 | —D | M] – C:\Documents and Settings\Default User\Application Data\InterMute
[2005/05/14 02:42:46 | 000,000,000 | —D | M] – C:\Documents and Settings\Default User\Application Data\SampleView
[2007/07/11 12:12:30 | 000,000,000 | —D | M] – C:\Documents and Settings\LocalService\Application Data\Juniper Networks
[2007/10/26 21:01:28 | 000,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Application Data\Juniper Networks
[2010/06/21 06:59:00 | 000,000,304 | —- | M] () – C:\WINDOWS\Tasks\Defraggler Volume C Task.job
[2010/06/27 04:44:00 | 000,000,394 | —- | M] () – C:\WINDOWS\Tasks\DriverCure.job
[2010/06/27 20:38:50 | 000,000,286 | —- | M] () – C:\WINDOWS\Tasks\Easy Internet Sign-up.job
[2010/06/29 09:12:00 | 000,000,404 | —- | M] () – C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 2170 series#1131995486.job
[2008/11/26 04:01:34 | 000,000,356 | —- | M] () – C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 2170 series#1219755942.job
[2010/06/29 12:21:00 | 000,000,404 | —- | M] () – C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 2170 series#1230934797.job
[2009/04/10 18:06:07 | 000,000,356 | —- | M] () – C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 2170 series#1231462530.job
[2010/01/15 01:00:00 | 000,000,354 | —- | M] () – C:\WINDOWS\Tasks\McDefragTask.job
[2010/05/01 01:00:00 | 000,000,346 | —- | M] () – C:\WINDOWS\Tasks\McQcTask.job
[2010/06/29 03:00:00 | 000,000,330 | -H– | M] () – C:\WINDOWS\Tasks\MP Scheduled Scan.job
[2010/06/29 18:00:00 | 000,000,456 | —- | M] () – C:\WINDOWS\Tasks\ParetoLogic Registration.job
[2010/06/29 00:33:00 | 000,000,430 | —- | M] () – C:\WINDOWS\Tasks\ParetoLogic Update Version2.job

========== Purity Check ==========

========== Alternate Data Streams ==========

@Alternate Data Stream - 163 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2
@Alternate Data Stream - 145 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D1B5B4F1
@Alternate Data Stream - 135 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D287FACF
@Alternate Data Stream - 1221 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:C3A66529
@Alternate Data Stream - 1213 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:AC0758F4
@Alternate Data Stream - 109 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A8ADE5D8
< End of report >

LastPaladin

Post #5June 30, 2010, 9:29 AM UTC

2nd Log:

OTL Extras logfile created on: 6/29/2010 11:01:54 PM - Run 1
OTL by OldTimer - Version 3.2.7.0 Folder = C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\Desktop
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

895.00 Mb Total Physical Memory | 358.00 Mb Available Physical Memory | 40.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 74.00% Paging File free
Paging file location(s): C:\pagefile.sys 1344 2688 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 180.31 Gb Total Space | 124.48 Gb Free Space | 69.04% Space Free | Partition Type: NTFS
Drive D: | 5.99 Gb Total Space | 0.98 Gb Free Space | 16.42% Space Free | Partition Type: FAT32
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: YOUR-F78BF48CE2
Current User Name: Compaq_Owner
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
htmlfile – "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Scan with SpySubtract…] – "C:\Program Files\InterMute\SpySubtract\SpySub.exe" "-sc" "%1" (InterMute, Inc.)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 1
"FirewallDisableNotify" = 1
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%ProgramFiles%\iTunes\iTunes.exe" = %ProgramFiles%\iTunes\iTunes.exe:*:enabled:iTunes – (Apple Computer, Inc.)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes – (Apple Computer, Inc.)
"C:\Program Files\Compaq Connections\6750491\Program\Compaq Connections.exe" = C:\Program Files\Compaq Connections\6750491\Program\Compaq Connections.exe:*:Enabled:BackWeb for Presario – (Hewlett-Packard)
"C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" = C:\Program Files\EarthLink TotalAccess\TaskPanl.exe:*:Enabled:Earthlink – File not found

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{075473F5-846A-448B-BCB3-104AA1760205}" = Sonic RecordNow Data
"{0EB5D9B7-8E6C-4A9E-B74F-16B7EE89A67B}" = Microsoft Plus! Photo Story 2 LE
"{19C989C4-50AE-43A4-B06E-8C70FFFF852F}" = PC-Doctor for Windows
"{1A103D70-5C9B-4E1A-B306-5106C68F9914}" = Microsoft Plus! Dancer LE
"{21657574-BD54-48A2-9450-EB03B2C7FC29}" = Sonic MyDVD Plus
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Sonic Update Manager
"{3248F0A8-6813-11D6-A77B-00B0D0150000}" = J2SE Runtime Environment 5.0
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3912A629-0020-0005-3757-2FBA74D4DF0A}" = InterVideo WinDVD Player
"{3BA95526-6AE0-4B87-A62D-17187EF565FC}" = HP Boot Optimizer
"{416D80BA-6F6D-4672-B7CF-F54DA2F80B44}" = Microsoft Works
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Sonic Express Labeler
"{6E45BA47-383C-4C1E-8ED0-0D4845C293D7}" = Microsoft Plus! Digital Media Edition Installer
"{8105684D-8CA6-440D-8F58-7E5FD67A499D}" = Easy Internet Sign-up
"{91120409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Standard Edition 2003
"{91810AFC-A4F8-4EBA-A5AA-B198BBC81144}" = InterVideo WinDVD Player
"{A93C4E94-1005-489D-BEAA-B873C1AA6CFC}" = HP Help and Support 4.0
"{AB708C9B-97C8-4AC9-899B-DBF226AC9382}" = Sonic RecordNow Audio
"{AC76BA86-0000-0000-0000-6028747ADE01}" = Adobe Acrobat - Reader 6.0.2 Update
"{AC76BA86-7AD7-1033-7B44-A00000000001}" = Adobe Reader 6.0.1
"{B12665F4-4E93-4AB4-B7FC-37053B524629}" = Sonic RecordNow Copy
"{BE20E2F5-1903-4AAE-B1AF-2046E586C925}" = iTunes
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{D0122362-6333-4DE4-93F6-A5A2F3CC101A}" = Compaq Organize
"{DB518BA6-CB74-4EB6-9ABD-880B6D6E1F38}" = HpSdpAppCoreApp
"045C89A0-CA37-443C-8826-F750227DE69C" = Shooting Stars Pool from Compaq (remove only)
"05E21449-3BA3-42BF-BBDA-95205F4EA40A" = Polar Bowler from Compaq (remove only)
"29FF6D07-4A15-41F1-9D5E-E0F3A58012C6" = Bounce Symphony from Compaq (remove only)
"3330A279-CC39-4A17-AE19-DA464B26AD9A" = Polar Golfer from Compaq (remove only)
"657A0149-EEC7-4FB2-AB4F-CB7AA027748E" = Final Drive Nitro from Compaq (remove only)
"66195170-D19D-46C5-8FB7-8A4630071ADC" = Tradewinds from Compaq (remove only)
"75528D5F-DD82-402E-BA7C-045B7DC6A712" = Blasterball 2 from Compaq (remove only)
"8BA6F58B-7A91-461F-95F8-E34F8BD8AA4E" = Slyder from Compaq (remove only)
"9D7E7CDA-051E-4B0D-8CEE-58F41F449CF9" = Blasterball 2 Remix from Compaq (remove only)
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe_PhotoShop_Album" = Remove Adobe Photoshop Album 2.0 Starter Edition installer
"Agere Systems Soft Modem" = Agere Systems PCI Soft Modem
"BackWeb-6750491 Uninstaller" = Compaq Connections
"BFAF1EEC-E987-415B-BCB8-80CDB0BC6CDF" = Blackhawk Striker 2 from Compaq (remove only)
"C43D84CD-EBFC-48D3-A330-7868C8AD415A" = Crystal Maze from Compaq (remove only)
"CCCDE323-C76D-44DA-BB5B-B8ABE767756E" = Phoenix Assault from Compaq (remove only)
"D06AB82F-D68E-405A-9886-AB8804291B6D" = Blasterball 2 Holidays from Compaq (remove only)
"DE87FA96-7840-420C-86F9-33F3B7B3CED1" = Super Granny from Compaq (remove only)
"DivX Setup.divx.com" = DivX Setup
"F05A08BF-E600-4FBD-A53A-3D47296B1275" = Lexibox Deluxe from Compaq (remove only)
"FA7F5211-C629-4711-BD82-7DFFB08CB518" = Overball from Compaq (remove only)
"Help and Support Additions" = Help and Support Additions
"ie8" = Windows Internet Explorer 8
"InstallShield_{19C989C4-50AE-43A4-B06E-8C70FFFF852F}" = PC-Doctor for Windows
"InstallShield_{8105684D-8CA6-440D-8F58-7E5FD67A499D}" = Easy Internet Sign-up
"InstallShield_{BE20E2F5-1903-4AAE-B1AF-2046E586C925}" = iTunes
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Money" = Remove Microsoft Money 2005 installer
"NIS" = Norton Internet Security
"Norton Utilities_is1" = Norton Utilities
"PS2" = PS2
"Python 2.2.3" = Python 2.2.3
"pywin32-py2.2" = Python 2.2 pywin32 extensions (build 203)
"Quicken_NUE" = Remove Quicken New User Edition installer
"QuickTime" = QuickTime
"RealPlayer 6.0" = RealPlayer
"SiS VGA Driver" = SiS VGA Utilities
"SpySubtract" = SpySubtract
"Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
"WeatherBug" = Remove WeatherBug installer
"Windows Media Format Runtime" = Windows Media Format Runtime
"Windows Media Player" = Windows Media Player 10
"Yahoo! Companion" = Yahoo! Toolbar
"Yahoo! Search Defender" = Yahoo! Search Protection
"Yahoo! Software Update" = Yahoo! Software Update
"YInstHelper" = Yahoo! Install Manager

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 6/28/2010 2:49:46 PM | Computer Name = YOUR-F78BF48CE2 | Source = Automatic LiveUpdate Scheduler | ID = 101
Description =

Error - 6/28/2010 3:25:31 PM | Computer Name = YOUR-F78BF48CE2 | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: A connection with the server could not be established

Error - 6/28/2010 4:40:58 PM | Computer Name = YOUR-F78BF48CE2 | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 6/28/2010 4:41:24 PM | Computer Name = YOUR-F78BF48CE2 | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

[ System Events ]
Error - 6/29/2010 4:48:44 PM | Computer Name = YOUR-F78BF48CE2 | Source = SideBySide | ID = 16842811
Description = Generate Activation Context failed for C:\Program Files\DivX\DivX
Transcode Engine\gzHF330.ddc. Reference error message: The operation completed successfully.
.

Error - 6/29/2010 4:48:44 PM | Computer Name = YOUR-F78BF48CE2 | Source = SideBySide | ID = 16842784
Description = Dependent Assembly Microsoft.VC80.ATL could not be found and Last
Error was The referenced assembly is not installed on your system.

Error - 6/29/2010 4:48:44 PM | Computer Name = YOUR-F78BF48CE2 | Source = SideBySide | ID = 16842811
Description = Resolve Partial Assembly failed for Microsoft.VC80.ATL. Reference error
message: The referenced assembly is not installed on your system. .

Error - 6/29/2010 4:48:44 PM | Computer Name = YOUR-F78BF48CE2 | Source = SideBySide | ID = 16842811
Description = Generate Activation Context failed for C:\Program Files\DivX\DivX
Transcode Engine\mtw178.ddc. Reference error message: The operation completed successfully.
.

Error - 6/29/2010 4:48:45 PM | Computer Name = YOUR-F78BF48CE2 | Source = SideBySide | ID = 16842784
Description = Dependent Assembly Microsoft.VC80.ATL could not be found and Last
Error was The referenced assembly is not installed on your system.

Error - 6/29/2010 4:48:45 PM | Computer Name = YOUR-F78BF48CE2 | Source = SideBySide | ID = 16842811
Description = Resolve Partial Assembly failed for Microsoft.VC80.ATL. Reference error
message: The referenced assembly is not installed on your system. .

Error - 6/29/2010 4:48:45 PM | Computer Name = YOUR-F78BF48CE2 | Source = SideBySide | ID = 16842811
Description = Generate Activation Context failed for C:\Program Files\DivX\DivX
Transcode Engine\gzHF330.ddc. Reference error message: The operation completed successfully.
.

Error - 6/29/2010 4:48:45 PM | Computer Name = YOUR-F78BF48CE2 | Source = SideBySide | ID = 16842784
Description = Dependent Assembly Microsoft.VC80.ATL could not be found and Last
Error was The referenced assembly is not installed on your system.

Error - 6/29/2010 4:48:45 PM | Computer Name = YOUR-F78BF48CE2 | Source = SideBySide | ID = 16842811
Description = Resolve Partial Assembly failed for Microsoft.VC80.ATL. Reference error
message: The referenced assembly is not installed on your system. .

Error - 6/29/2010 4:48:45 PM | Computer Name = YOUR-F78BF48CE2 | Source = SideBySide | ID = 16842811
Description = Generate Activation Context failed for C:\Program Files\DivX\DivX
Transcode Engine\mtw178.ddc. Reference error message: The operation completed successfully.
.

< End of report >

Jack&Jill

Post #6June 30, 2010, 3:52 PM UTC

Hello LastPaladin :), Possible to pinpoint the date when your problem started?

LastPaladin

Post #7June 30, 2010, 6:43 PM UTC

Unfortunately, not really. I tried some other things before someone told me about this site. I THINK it started (or I noticed it starting) about 5/29 or 6/5. This answer probably doesn't really help you, but it was definitely a Saturday (not last week), and I tried to do a couple things a friend suggested first that spanned at least 2 weeks.

Jack&Jill

Post #8July 1, 2010, 6:36 AM UTC

Hello LastPaladin :),

Please download ATF (Atribune Temp File) Cleaner© by Atribune from one of the links below and save it to your desktop.

Link 1
Link 2
Link 3

Run ATF Cleaner

Double-click ATF Cleaner.exe to open it.
Click Run if prompted.
At the bottom of the list, check (tick) Select All.
Note: If you would like to keep your cookies, please uncheck this option as it will remove all cookies, including the useful ones you may want to keep.
Then click the Empty Selected button.
Firefox:
- Click Firefox at the top and choose: Select All. Uncheck the cookies option if you want to keep them.
- Click the Empty Selected button.
- Note: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.

——————–

Please download Malwarebytes' Anti-Malware (MBAM)© from Malwarebytes and save it to your desktop. Click here.

Run MBAM

Double click on mbam-setup.exe and follow the prompts to install the program.
At the end of installation, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
MBAM will now check for updates. If your firewall prompts, please allow it. If you can't update it, select the Update tab. Under Update mirror, select one of the websites and click on Check for Updates.
Upon completion of update and loading, select the Scanner tab. Click on Perform full scan, then click on Scan.
Leave the default options as it is and click on Start Scan.
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process.
When done, you will be prompted. Click OK, then click on Show Results.
Check (tick) all items except items in the C:\System Volume Information folder and click on Remove Selected.
After it has removed the items, a log in Notepad will open. Please post this log in your next reply. You can also find the log in the Logs tab. The bottom most log is the latest.

If asked to restart the computer, please do so. Failure to reboot will prevent MBAM from removing all the malware. If you receive an (Error Loading) error on reboot, please reboot a second time . It is normal for this error to occur once and does not need to be reported unless it returns on future reboots.

——————–

Please post back:
1. the MBAM report

LastPaladin

Post #9July 1, 2010, 6:32 PM UTC

Here's the MBAM report. Unfortunately it didn't remove whatever it is, but it did slow its repetition rate down so I can type without having one hand on the mouse. I would presume that some of the files that the MBAM removed were extra copies of whatever it is so I don't have as many copies running at the same time and making it REALLY hard to type.

Hmmm. It has stopped running while I've been typing this reply….. I wonder if it's just gone back into hiding since it was running right before I logged in here? I guess I'll just have to wait and see. On the plus/minus side, since I have a very long day/night ahead of me, I will not notice anything (or be able to reply here) until near midnight on Friday.

BTW, next time you tell someone to use the ATF Cleaner, you may want to suggest that they select them all individually if it "freezes up" while running on Select All. I tried downloading the ATF from all 3 links and had them all freeze. Then I tried running it individually to delete all of them, was successful, and then Select All which didn't freeze at that point.

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4263

Windows 5.1.2600 Service Pack 2
Internet Explorer 8.0.6001.18702

7/1/2010 7:32:53 AM
mbam-log-2010-07-01 (07-32-53).txt

Scan type: Full scan (C:\|D:\|)
Objects scanned: 414920
Time elapsed: 4 hour(s), 5 minute(s), 19 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 2
Folders Infected: 19
Files Infected: 8

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.004\Application Data\ATManager (Rogue.ATManager) -> Quarantined and deleted successfully.
C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.004\Application Data\ATManager\metafiles (Rogue.ATManager) -> Quarantined and deleted successfully.
C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.003\Application Data\ezLife (Adware.EzLife) -> Quarantined and deleted successfully.
C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.003\Application Data\ezLife\ezLife (Adware.EzLife) -> Quarantined and deleted successfully.
C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.004\Application Data\ezLife (Adware.EzLife) -> Quarantined and deleted successfully.
C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.004\Application Data\ezLife\ezLife (Adware.EzLife) -> Quarantined and deleted successfully.
C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.003\Application Data\Smart-Ads-Solutions (Adware.SmartAds) -> Quarantined and deleted successfully.
C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.004\Application Data\Smart-Ads-Solutions (Adware.SmartAds) -> Quarantined and deleted successfully.
C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.004\Application Data\Smart-Ads-Solutions\SmartAds (Adware.SmartAds) -> Quarantined and deleted successfully.
C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.004\Application Data\Smart-Ads-Solutions\SmartAds\download (Adware.SmartAds) -> Quarantined and deleted successfully.
C:\Program Files\ezLife (Adware.EzLife) -> Quarantined and deleted successfully.
C:\Program Files\ezLife\ezLife (Adware.EzLife) -> Quarantined and deleted successfully.
C:\Program Files\ezLife\ezLife\1.5.1.0 (Adware.EzLife) -> Quarantined and deleted successfully.
C:\Program Files\ezLife\ezLife\1.5.2.0 (Adware.EzLife) -> Quarantined and deleted successfully.
C:\Program Files\Smart-Ads-Solutions (Adware.SmartAds) -> Quarantined and deleted successfully.
C:\Program Files\Smart-Ads-Solutions\SmartAds (Adware.SmartAds) -> Quarantined and deleted successfully.
C:\Program Files\Smart-Ads-Solutions\SmartAds\1.5.1.0 (Adware.SmartAds) -> Quarantined and deleted successfully.
C:\Program Files\Smart-Ads-Solutions\SmartAds\1.5.2.0 (Adware.SmartAds) -> Quarantined and deleted successfully.
C:\Program Files\Smart-Ads-Solutions\SmartAds\1.5.5.0 (Adware.SmartAds) -> Quarantined and deleted successfully.

Files Infected:
C:\Documents and Settings\Compaq_Owner\Application Data\Move Networks\MoveMediaPlayer_07103010.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.003\Local Settings\Temp\~nsu.tmp\Au_.exe (Adware.AdRotator) -> Quarantined and deleted successfully.
C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.004\Application Data\ATManager\metafiles\e7e2135bcdfc87179deacdb1cdac8b7a.torrent (Rogue.ATManager) -> Quarantined and deleted successfully.
C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.003\Application Data\ezLife\ezLife\log.xml (Adware.EzLife) -> Quarantined and deleted successfully.
C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.004\Application Data\ezLife\ezLife\log.xml (Adware.EzLife) -> Quarantined and deleted successfully.
C:\Program Files\Smart-Ads-Solutions\SmartAds\1.5.2.0\uninstall.exe (Adware.SmartAds) -> Quarantined and deleted successfully.
C:\Program Files\Smart-Ads-Solutions\SmartAds\1.5.5.0\uninstall.exe (Adware.SmartAds) -> Quarantined and deleted successfully.
C:\RECYCLER\ADAPT_Installer.exe (Trojan.Agent) -> Quarantined and deleted successfully.

Jack&Jill

Post #10July 2, 2010, 1:06 AM UTC

Hello LastPaladin :),

BTW, next time you tell someone to use the ATF Cleaner, you may want to suggest that they select them all individually if it "freezes up" while running on Select All. I tried downloading the ATF from all 3 links and had them all freeze. Then I tried running it individually to delete all of them, was successful, and then Select All which didn't freeze at that point.

Thanks for the heads up.

——————–

Look into folders

Open Notepad. Copy and paste the following text into it:

@echo off
dir "C:\WINDOWS\setupupd" /A /S > "%userprofile%\desktop\look.txt"
dir "C:\e10946a8e70c4d3cdb21" /A /S >> "%userprofile%\desktop\look.txt"
exit

Save it as folderlook.bat on the desktop. Make sure the Save as type: is All Files (*.*).
Double click on folderlook.bat to run it. Allow if prompted by any security software.
Post the contents of look.txt. It is found on your desktop.

——————–

Please download ERUNT© by Lars Hederer from one of the links below and save it to your desktop.

Link 1
Link 2
Link 3

Backup your registry with ERUNT

Double click on erunt-setup.exe and run the installation setup.
Follow the setup instructions until you reach Select Additional Tasks, uncheck (untick) Create NTREGOPT desktop icon.
Continue until you get prompted to run ERUNT at startup. Choose No.
Next, make sure Launch ERUNT is checked (ticked) and click Finish.
Click OK when ERUNT is launched, and accept all default setting. ERUNT will then backup the registry.

Fix with OTL

Please disable your real time protection of any Antivirus, Antispyware or Antimalware programs temporarily. They will interfere and may cause unexpected results.
If you need help to disable your protection programs see here.
Double click on OTL.exe to run it.

Copy and paste the following text into the white box below Custom Scans/Fixes:

:otl
[2010/06/27 04:44:00 | 000,000,394 | —- | M] () – C:\WINDOWS\Tasks\DriverCure.job
[2010/06/29 18:00:00 | 000,000,456 | —- | M] () – C:\WINDOWS\Tasks\ParetoLogic Registration.job
[2010/06/29 00:33:00 | 000,000,430 | —- | M] () – C:\WINDOWS\Tasks\ParetoLogic Update Version2.job
@Alternate Data Stream - 163 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2
@Alternate Data Stream - 145 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D1B5B4F1
@Alternate Data Stream - 135 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D287FACF
@Alternate Data Stream - 1221 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:C3A66529
@Alternate Data Stream - 1213 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:AC0758F4
@Alternate Data Stream - 109 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A8ADE5D8

:reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall"=dword:00000001

:commands
[CREATERESTOREPOINT]
[EMPTYFLASH]
[emptytemp]

Click Run Fix.
Please post the contents of the fix log file back here if you are prompted to open the file. It can also be found at C:\_OTL\Moved Files as MMDDYYY_HHMMSS.log where MMDDYYY is date format and HHMMSS is time format.
If requested to reboot, please do so. The log file will open after restart.
Enable back your security softwares as soon as you completed the OTL fix steps.

——————–

Do an online scan with ESET Online Scanner.
Please be patient as scanning will take quite some time. If you have problem running the scan, you might want to disable any real time protection that you have.

Click here to go to ESET Online Scanner page.
Click on ESET Online Scanner. A new window will open.
For FireFox user, you will need to download and install esetsmartinstaller_enu.exe. Click on it and save the file to a convenient location. Double click on it to install and a new window will open.
After reading through the Terms of Use, check YES, I accept the Terms of Use and click Start to begin scan.
You will be prompted to install an ActiveX Control from ESET. Please install.
At the Computer scan settings section, uncheck (untick) Remove found threats and then check Scan archives.
Now, click on Advanced settings and make sure all these are checked:
- Scan for potentially unwanted applications
- Scan for potentially unsafe applications
- Enable Anti-Stealth technology
Click on Scan to proceed.
Click Finish and close the window.
Navigate to C:\Program Files\ESET\ESET Online Scanner using Windows Explorer and look for log.txt.
Post the contents of log.txt in your reply.

——————–

Please post back:
1. the contents of look.txt
2. OTL fix log
3. ESET online scan result
4. how is your computer now?

LastPaladin

Post #11July 3, 2010, 5:07 PM UTC

Okay, my computer is apparently running fine now, but I'll wait 3 days to see for sure (Okay, I'm paranoid and am thinking there might be another copy still hiding SOMEWHERE in my computer just waiting for me to turn my back). So I put in the look.txt and the OTL fix in this post, but I cannot find the ESET scan result. I thought that the log.txt would be saved automatically and tried looking for it, but it is nowhere on my computer. I also tried going back to the ESET site and looking there but couldn't find anything there either. I do remember that it found 2 items but couldn't tell you what they were. Since these 2 items may be hurting someone else, is there any other place/file name that it could have been saved/saved under? (Of course, if it has just gone into hiding and starts up again, I'll manually copy those 2 filenames on PAPER so I can make sure you get copies of them.) Volume in drive C is PRESARIO Volume Serial Number is 4088-96CE Directory of C:\WINDOWS\setupupd 06/28/2010 12:17 AM . 06/28/2010 12:17 AM .. 06/28/2010 12:17 AM 99 guidrvs.inf 06/28/2010 12:17 AM temp 1 File(s) 99 bytes Directory of C:\WINDOWS\setupupd\temp 06/28/2010 12:17 AM . 06/28/2010 12:17 AM .. 06/28/2010 12:17 AM 104 90724_0x00000409.as 06/28/2010 12:17 AM 104 91017_0x00000409.as 06/28/2010 12:17 AM 17 catalog.ini 06/28/2010 12:17 AM 7,690 ident.cab 02/18/2003 08:35 AM 3,456 ident.txt 06/28/2010 12:17 AM 40,586 wsdueng.cab 07/14/2001 05:32 PM 69,632 wsdueng.dll 7 File(s) 121,589 bytes Total Files Listed: 8 File(s) 121,688 bytes 5 Dir(s) 141,269,041,152 bytes free Volume in drive C is PRESARIO Volume Serial Number is 4088-96CE Directory of C:\e10946a8e70c4d3cdb21 06/26/2010 03:38 AM . 06/26/2010 03:38 AM .. 05/28/2010 12:37 PM 32,472,008 mrt.exe 05/28/2010 12:37 PM 58,312 mrtstub.exe 2 File(s) 32,530,320 bytes Total Files Listed: 2 File(s) 32,530,320 bytes 2 Dir(s) 141,269,041,152 bytes free ________________________________________________________________________________ _________________________________________________ All processes killed ========== OTL ========== C:\WINDOWS\Tasks\DriverCure.job moved successfully. C:\WINDOWS\Tasks\ParetoLogic Registration.job moved successfully. C:\WINDOWS\Tasks\ParetoLogic Update Version2.job moved successfully. ADS C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2 deleted successfully. ADS C:\Documents and Settings\All Users\Application Data\TEMP:D1B5B4F1 deleted successfully. ADS C:\Documents and Settings\All Users\Application Data\TEMP:D287FACF deleted successfully. ADS C:\Documents and Settings\All Users\Application Data\TEMP:C3A66529 deleted successfully. ADS C:\Documents and Settings\All Users\Application Data\TEMP:AC0758F4 deleted successfully. ADS C:\Documents and Settings\All Users\Application Data\TEMP:A8ADE5D8 deleted successfully. ========== REGISTRY ========== HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus\\"DisableMonitoring"|dword:00000000 /E : value set successfully! HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall\\"DisableMonitoring"|dword:00000000 /E : value set successfully! HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\\"EnableFirewall"|dword:00000001 /E : value set successfully! ========== COMMANDS ========== Restore point Set: OTL Restore Point (0) [EMPTYFLASH] User: All Users User: Compaq_Owner ->Flash cache emptied: 2608786 bytes User: Compaq_Owner.YOUR-F78BF48CE2 ->Flash cache emptied: 1733673 bytes User: Compaq_Owner.YOUR-F78BF48CE2.000 ->Flash cache emptied: 1889626 bytes User: Compaq_Owner.YOUR-F78BF48CE2.001 ->Flash cache emptied: 1931001 bytes User: Compaq_Owner.YOUR-F78BF48CE2.002 ->Flash cache emptied: 3809 bytes User: Compaq_Owner.YOUR-F78BF48CE2.003 ->Flash cache emptied: 17867 bytes User: Compaq_Owner.YOUR-F78BF48CE2.004 ->Flash cache emptied: 1475 bytes User: Compaq_Owner.YOUR-F78BF48CE2.005 ->Flash cache emptied: 2482 bytes User: COMPAQ~1~000 User: COMPAQ~1~001 User: COMPAQ~1~003 User: COMPAQ~1~YOU User: Default User User: LocalService User: Margaret E. Lui User: NetworkService ->Flash cache emptied: 6163 bytes Total Flash Files Cleaned = 8.00 mb [EMPTYTEMP] User: All Users User: Compaq_Owner ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes ->Java cache emptied: 0 bytes ->FireFox cache emptied: 1703354 bytes ->Google Chrome cache emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Compaq_Owner.YOUR-F78BF48CE2 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 22459 bytes ->Java cache emptied: 7597024 bytes ->FireFox cache emptied: 27861860 bytes ->Flash cache emptied: 0 bytes User: Compaq_Owner.YOUR-F78BF48CE2.000 ->Temp folder emptied: 489113328 bytes ->Temporary Internet Files folder emptied: 67 bytes ->Flash cache emptied: 0 bytes User: Compaq_Owner.YOUR-F78BF48CE2.001 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 9870 bytes ->Java cache emptied: 0 bytes ->FireFox cache emptied: 2520270 bytes ->Google Chrome cache emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Compaq_Owner.YOUR-F78BF48CE2.002 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes ->Java cache emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Compaq_Owner.YOUR-F78BF48CE2.003 ->Temp folder emptied: 111749010 bytes ->Temporary Internet Files folder emptied: 67 bytes ->Java cache emptied: 89954 bytes ->Flash cache emptied: 0 bytes User: Compaq_Owner.YOUR-F78BF48CE2.004 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes ->Java cache emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Compaq_Owner.YOUR-F78BF48CE2.005 ->Temp folder emptied: 1205005 bytes ->Temporary Internet Files folder emptied: 22690153 bytes ->Java cache emptied: 0 bytes ->Flash cache emptied: 0 bytes User: COMPAQ~1~000 User: COMPAQ~1~001 User: COMPAQ~1~003 User: COMPAQ~1~YOU User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: LocalService ->Temp folder emptied: 65984 bytes ->Temporary Internet Files folder emptied: 16786 bytes User: Margaret E. Lui User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes ->Flash cache emptied: 0 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 4316026 bytes %systemroot%\System32 .tmp files removed: 2577 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 16384 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 638.00 mb OTL by OldTimer - Version 3.2.7.0 log created on 07022010_235309 Files\Folders moved on Reboot… File\Folder C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\Local Settings\Temp\~DFA0F1.tmp not found! File\Folder C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\Local Settings\Temp\~DFCC73.tmp not found! C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\Local Settings\Temp\~DFE48A.tmp moved successfully. C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\Local Settings\Temp\~DFEE69.tmp moved successfully. C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\Local Settings\Temporary Internet Files\Content.IE5\JM8AY623\index[1].php moved successfully. C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\Local Settings\Temporary Internet Files\Content.IE5\B2Z45KE5\iframe[1].htm moved successfully. C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\Local Settings\Temporary Internet Files\Content.IE5\29B8HS2R\de[1].ashx moved successfully. C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\Local Settings\Temporary Internet Files\Content.IE5\29B8HS2R\like[1].php moved successfully. C:\Documents and Settings\Compaq_Owner.YOUR-F78BF48CE2.005\Local Settings\Temporary Internet Files\AntiPhishing\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat moved successfully. C:\WINDOWS\temp\Perflib_Perfdata_638.dat moved successfully. Registry entries deleted on Reboot…

Jack&Jill

Post #12July 3, 2010, 5:21 PM UTC

Hello LastPaladin :),

Did you click on Finish at the end of the ESET scan?

Go to Start > Run…. Copy and paste the following text into the white box:

C:\Program Files\ESET\ESET Online Scanner\log.txt

Then click OK.

The ESET log should open now. Please post the contents.

LastPaladin

Post #13July 3, 2010, 9:57 PM UTC

Okay, I am officially NOT paranoid. The thing is still running. I'll try putting in the thing you just posted when the ESET finishes in ~4 hours.

LastPaladin

Post #14July 4, 2010, 2:32 AM UTC

This is humorous. I've tried deleting Spybot several times in the past. C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\eZulaHotText.zip Win32/Bagle.gen.zip worm D:\I386\Apps\APP32525\src\HPSummer2005.exe a variant of Win32/AdInstaller application

Jack&Jill

Post #15July 4, 2010, 3:04 PM UTC last edited July 4, 2010, 3:08 PM UTC

Hello LastPaladin :),

Fix with OTL

Please disable your real time protection of any Antivirus, Antispyware or Antimalware programs temporarily. They will interfere and may cause unexpected results.
If you need help to disable your protection programs see here.
Double click on OTL.exe to run it.

Copy and paste the following text into the white box below Custom Scans/Fixes:

:files
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\eZulaHotText.zip
D:\I386\Apps\APP32525\src\HPSummer2005.exe

Click Run Fix.
Please post the contents of the fix log file back here if you are prompted to open the file. It can also be found at C:\_OTL\Moved Files as MMDDYYY_HHMMSS.log where MMDDYYY is date format and HHMMSS is time format.
If requested to reboot, please do so. The log file will open after restart.
Enable back your security softwares as soon as you completed the OTL fix steps.

——————–

Please a fresh set of OTL logs.

Make sure all the Use SafeList options is checked (ticked). There are six of them.
Check Scan All Users.
At the lower right corner, check LOP Check and Purity Check.
Click on Run Scan at the top left hand corner. This might take a while.
When done, two Notepad files will open. Please post the contents of these 2 Notepad files in your next reply. One log per reply please.
Note: These files are saved as OTL.txt and Extras.txt on the desktop.

Double click on VEW.exe to start the program.
In the Select log to query section, check (tick):
- Application
- System
In the Select type to list section, check:
- Critical (not XP)
- Error
- Information
- Warning
In the Number or date of events section, check:
- Date of events… then enter the From and To dates (the range from the start of incident until now).
Press the Run button.
A Notepad report will open when done, please post the contents of this report. It is located at %systemdrive%\VEW.txt, usually C:\VEW.txt.

——————–

For your Autoplay problem, is it still occuring? I will need more detail description like what pop-ups appear or what are the exact messages, when does it occur, how is it disrupting your usage of the computer, etc. If you can get me a snapshot of the problem, it would be much helpful. You may attached it using the Attachments section just below the reply box.

——————–

Please close all programs and do not run any others before and during the GMER scan. Do not use the computer for anything else until after the scan is completed.

Please download GMER and save it to your desktop. Click here.

Please disable your real time protection of any Antivirus, Antispyware or Antimalware programs temporarily when running GMER. They may cause the computer to freeze.
If you need help to disable your protection programs see here.
Double click the .exe file. If asked to allow gmer.sys driver to load, please consent.
If it gives you a warning about rootkit activity and asks if you want to run scan, click on No.
In the right panel, you will see several boxes that have been checked (ticked).
- Uncheck IAT/EAT
- Uncheck All other Drives/Partitions except C:\ (leave C:\ checked)
- Uncheck Show All (don't miss this one)
Then click the Scan button and wait for it to finish.
Once done, click on the Save… button and save it as "Gmer.txt" at a convenient location. Post the contents of that report.
Enable back your security softwares as soon as you completed the GMER steps.
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries.

If you are having problems running this version of GMER, please try running GMER in Safe Mode. You can get into Safe Mode using the F8 key during the startup of your computer after a reboot.

——————–

Please post back:
1. the OTL fix log
2. new OTL logs (OTL.txt and Extras.txt)
3. VEW report
4. more detail information about your problem
5. GMER log

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Infected with something that keeps running

✨ Ask AI

Ask AI